# Top **URL:** https://discuss.elastic.co/top.md?page=410&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 411 --- ## [Winlogbeat and ECS](https://discuss.elastic.co/t/winlogbeat-and-ecs/149001)
**Author:** [@thegrockq](https://discuss.elastic.co/u/thegrockq)\ **Replies:** 7\ **Last updated:** [October 2, 2018, 9:33pm UTC](https://discuss.elastic.co/t/winlogbeat-and-ecs/149001 "2018-10-02T21:33:51Z")
Is there any current or completed effort to convert Windows event log fields to comply with ECS? I've parsed the schema for security-audit logs and made an initial pass through them to convert appropriate fields to what… --- ## [Instrumenting a C++ application](https://discuss.elastic.co/t/instrumenting-a-c-application/245026)
**Author:** [@DenProg](https://discuss.elastic.co/u/DenProg)\ **Replies:** 7\ **Last updated:** [August 21, 2020, 5:02am UTC](https://discuss.elastic.co/t/instrumenting-a-c-application/245026 "2020-08-21T05:02:14Z")
I didn't find any topic like that... Which library should I use to instrument a C++ application? We found the Elastic APM system very appropriate for our software, but we have C++ apps and we want to collect custom data … --- ## [How do I get the \_id which is the document id using NEST?](https://discuss.elastic.co/t/how-do-i-get-the-id-which-is-the-document-id-using-nest/288841)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [November 24, 2021, 6:17am UTC](https://discuss.elastic.co/t/how-do-i-get-the-id-which-is-the-document-id-using-nest/288841 "2021-11-24T06:17:34Z")
Hello dear friends, I have a question. I want to retrieve the \_id of a document, how can I do that with using Nest? The field I want to reach is the following "\_id" field : "\_id" : "4912ba5cfb86ea63541c7007b1791ab3a6f0… --- ## [\[query\_shard\_exception\]Failed to parse query](https://discuss.elastic.co/t/query-shard-exception-failed-to-parse-query/212648)
**Author:** [@Addepalli\_Venkata\_Ma](https://discuss.elastic.co/u/Addepalli_Venkata_Ma)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 10:06am UTC](https://discuss.elastic.co/t/query-shard-exception-failed-to-parse-query/212648 "2020-01-08T10:06:58Z")
I was trying to run a search query on the twitter data, i inserted in to elasticsearch. This is the error i am getting in kibana but not on from terminal where i have used curl version of the same query. From curl i am … --- ## [Kibana without elasticsearch?](https://discuss.elastic.co/t/kibana-without-elasticsearch/27236)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 3\ **Last updated:** [August 12, 2015, 6:25am UTC](https://discuss.elastic.co/t/kibana-without-elasticsearch/27236 "2015-08-12T06:25:32Z")
As we know elasticsearch stores, search and analyses data and then show it on kibana , But i ahve my data is already stored in postgresql and we have to deal with huge data then storing it in elasticsearch for seeing gra… --- ## [Json\_parse\_exception in elastic search](https://discuss.elastic.co/t/json-parse-exception-in-elastic-search/208887)
**Author:** [@jayasree](https://discuss.elastic.co/u/jayasree)\ **Replies:** 5\ **Last updated:** [December 19, 2019, 10:05am UTC](https://discuss.elastic.co/t/json-parse-exception-in-elastic-search/208887 "2019-12-19T10:05:46Z")
{"error":{"root\_cause":\[{"type":"json\_parse\_exception","reason":"Unrecognized character escape '&' (code 38)\\n at \[Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@5c05c49d; line: 7, column: 188\]"}\] we are … --- ## [ES version 6.3. IOException: listener timeout after waiting for \[60000\] ms](https://discuss.elastic.co/t/es-version-6-3-ioexception-listener-timeout-after-waiting-for-60000-ms/135899)
**Author:** [@porunov](https://discuss.elastic.co/u/porunov)\ **Replies:** 5\ **Last updated:** [June 14, 2018, 12:31pm UTC](https://discuss.elastic.co/t/es-version-6-3-ioexception-listener-timeout-after-waiting-for-60000-ms/135899 "2018-06-14T12:31:23Z")
Hello, I've just updated to elasticsearch version 6.3.0 and seems that rest high level client doesn't work there as has to. Right now I am using the next code to refresh indexes: Settings settings = Settings.builder()… --- ## [Cast mongodb \_id object to string](https://discuss.elastic.co/t/cast-mongodb-id-object-to-string/114844)
**Author:** [@mahajan344](https://discuss.elastic.co/u/mahajan344)\ **Replies:** 1\ **Last updated:** [January 11, 2018, 5:56am UTC](https://discuss.elastic.co/t/cast-mongodb-id-object-to-string/114844 "2018-01-11T05:56:51Z")
Hi, I am working on creating a pipeline to get data from MongoDB to Elasticsearch using Logstash. I am using dbschema mongodb jdbc drivers. I am able to connect to database using driver but I am facing issue with \_id .… --- ## [Filebeat service running in windows but not shipping logs](https://discuss.elastic.co/t/filebeat-service-running-in-windows-but-not-shipping-logs/51819)
**Author:** [@marco.mojica](https://discuss.elastic.co/u/marco.mojica)\ **Replies:** 5\ **Last updated:** [June 17, 2016, 1:36pm UTC](https://discuss.elastic.co/t/filebeat-service-running-in-windows-but-not-shipping-logs/51819 "2016-06-17T13:36:40Z")
I have been expiriencing the following problem. System Specs Windows Server 2012 Standard filebeat; Version: 1.2.2 I am running this package of ELK everything is running as localhost. so the problem is that the serv… --- ## [Unable to Authenticate user \[kibana\_system\] for REST request](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455)
**Author:** [@Ihms](https://discuss.elastic.co/u/Ihms)\ **Replies:** 2\ **Last updated:** [October 26, 2022, 5:00am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request/317455 "2022-10-26T05:00:22Z")
I have just installed Elasticsearch 8.4. I can successfully connect to Elasticsearch, but when I try connecting to Kibana, I get the below error: Unable to retrieve version information from Elasticsearch nodes. security… --- ## [Docker-compose fails with ingest-attachment](https://discuss.elastic.co/t/docker-compose-fails-with-ingest-attachment/173598)
**Author:** [@SteveMapes](https://discuss.elastic.co/u/SteveMapes)\ **Replies:** 4\ **Last updated:** [March 25, 2019, 4:31pm UTC](https://discuss.elastic.co/t/docker-compose-fails-with-ingest-attachment/173598 "2019-03-25T16:31:59Z")
I'm having real troubles trying to get the ingest-attachment plugin working with docker via docker-compose. I can get ES working without any plugins using the following YML file version: '3' services: elasticsearch: … --- ## [Logstash not starting; error reason : Your settings are invalid](https://discuss.elastic.co/t/logstash-not-starting-error-reason-your-settings-are-invalid/310440)
**Author:** [@sanuboy](https://discuss.elastic.co/u/sanuboy)\ **Replies:** 7\ **Last updated:** [July 30, 2022, 5:36pm UTC](https://discuss.elastic.co/t/logstash-not-starting-error-reason-your-settings-are-invalid/310440 "2022-07-30T17:36:38Z")
Hi, This is the first time i am trying to setup ELK stack to read my application log files and i have been struggling to get through this issue for about two days and finally resorted to asking for help. I have illustrat… --- ## [A couple questions regarding bucket splits by rows/columns and exclude patterns in kibana visualizations](https://discuss.elastic.co/t/a-couple-questions-regarding-bucket-splits-by-rows-columns-and-exclude-patterns-in-kibana-visualizations/84752)
**Author:** [@tsullivan93](https://discuss.elastic.co/u/tsullivan93)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 2:31pm UTC](https://discuss.elastic.co/t/a-couple-questions-regarding-bucket-splits-by-rows-columns-and-exclude-patterns-in-kibana-visualizations/84752 "2017-05-08T14:31:45Z")
Hello, Apologies for grouping two questions together, but I figured I would just take care of both with one post. 1.) Is there anyway to split a chart by significant term by row AND column. What I'm asking is as it s… --- ## [Kibana plugin development | Skill matrix](https://discuss.elastic.co/t/kibana-plugin-development-skill-matrix/126877)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 8\ **Last updated:** [April 26, 2018, 4:38am UTC](https://discuss.elastic.co/t/kibana-plugin-development-skill-matrix/126877 "2018-04-26T04:38:44Z")
Hi, I wish to develop a Kibana App to act as an input to Elasticsearch. I am willing to invest time and effort in understanding the technology stack needed to develop this App. I have browsed through majority of the ap… --- ## [How to start logstash 6.2.4 multiple instance](https://discuss.elastic.co/t/how-to-start-logstash-6-2-4-multiple-instance/139728)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [July 25, 2018, 11:40am UTC](https://discuss.elastic.co/t/how-to-start-logstash-6-2-4-multiple-instance/139728 "2018-07-25T11:40:52Z")
Hi , How can i run multiple logstash configuration file on single server ? When i am running more than one configuration file i am getting error message for multiple instance running. Thanks, Priti --- ## [Sorting or ordering by specific values](https://discuss.elastic.co/t/sorting-or-ordering-by-specific-values/67244)
**Author:** [@midget2000x](https://discuss.elastic.co/u/midget2000x)\ **Replies:** 2\ **Last updated:** [November 26, 2016, 8:05pm UTC](https://discuss.elastic.co/t/sorting-or-ordering-by-specific-values/67244 "2016-11-26T20:05:12Z")
I have a client that wants to show specific products first when a category is viewed (specifically I'm using a bool query for categories). Can this be accomplished with ES? For mysql, you'd use the CASE statement like… --- ## [Why is this wildcard and query returning zero results?](https://discuss.elastic.co/t/why-is-this-wildcard-and-query-returning-zero-results/13511)
**Author:** [@dantuff](https://discuss.elastic.co/u/dantuff)\ **Replies:** 7\ **Last updated:** [September 24, 2013, 5:57pm UTC](https://discuss.elastic.co/t/why-is-this-wildcard-and-query-returning-zero-results/13511 "2013-09-24T17:57:32Z")
I have a query that returns results. For example lets say the following query returns 5 results { "from" : 0, "size" : 20, "query" : { "query\_string" : { "query" : "name:elastic OR title:elastic… --- ## [Query on multiple index using NEST](https://discuss.elastic.co/t/query-on-multiple-index-using-nest/185200)
**Author:** [@Chandru](https://discuss.elastic.co/u/Chandru)\ **Replies:** 3\ **Last updated:** [June 17, 2019, 9:01am UTC](https://discuss.elastic.co/t/query-on-multiple-index-using-nest/185200 "2019-06-17T09:01:29Z")
Hi All , i'm new to elasticsearch ,and trying to implement "Free Text search" and the challenge to fetch records from two index , but there is no straightforward way to do this and i got the below link and i followed th… --- ## [Start\_position =\> "end"](https://discuss.elastic.co/t/start-position-end/141536)
**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\ **Replies:** 5\ **Last updated:** [July 25, 2018, 10:31am UTC](https://discuss.elastic.co/t/start-position-end/141536 "2018-07-25T10:31:28Z")
Hello, I used to set the start position to "beginning" but now I want to set the value to "end". The problem is that after setting the start\_position to "end" logstash does not parse my logs anymore. I already tried to… --- ## [Logstash crash for "LoadError: no such file to load -- restclient"](https://discuss.elastic.co/t/logstash-crash-for-loaderror-no-such-file-to-load-restclient/25697)
**Author:** [@Silvana\_Vezzoli](https://discuss.elastic.co/u/Silvana_Vezzoli)\ **Replies:** 5\ **Last updated:** [July 20, 2015, 7:16am UTC](https://discuss.elastic.co/t/logstash-crash-for-loaderror-no-such-file-to-load-restclient/25697 "2015-07-20T07:16:03Z")
I installed logstash 1.5.2 on Centos 6.5 VM (test environment). My previous used version was Logstash 1.4.2 and I kept the same configuration files used with previous version. When I launch logstash I get the following … --- ## [Ingest Manager requires superuser privileges](https://discuss.elastic.co/t/ingest-manager-requires-superuser-privileges/251086)
**Author:** [@LukaszBis](https://discuss.elastic.co/u/LukaszBis)\ **Replies:** 3\ **Last updated:** [October 6, 2020, 10:09am UTC](https://discuss.elastic.co/t/ingest-manager-requires-superuser-privileges/251086 "2020-10-06T10:09:24Z")
Hi, I can't open the tab Ingest Manager. Message appears what could be causing this behavior? --- ## [I cannot change kibana to port 443](https://discuss.elastic.co/t/i-cannot-change-kibana-to-port-443/234013)
**Author:** [@wspoon](https://discuss.elastic.co/u/wspoon)\ **Replies:** 3\ **Last updated:** [May 23, 2020, 9:10pm UTC](https://discuss.elastic.co/t/i-cannot-change-kibana-to-port-443/234013 "2020-05-23T21:10:22Z")
I am trying to have kibana on port 443 so I can use a domain name to access from the internet. Whenever the port is 5601 kibana starts correctly, but when I change the port to 443 the kibana process fails with the follo… --- ## [Using Nginx Proxy + ES + Spark](https://discuss.elastic.co/t/using-nginx-proxy-es-spark/54634)
**Author:** [@Brad\_Jungsu\_Heo](https://discuss.elastic.co/u/Brad_Jungsu_Heo)\ **Replies:** 6\ **Last updated:** [July 13, 2016, 7:39am UTC](https://discuss.elastic.co/t/using-nginx-proxy-es-spark/54634 "2016-07-13T07:39:40Z")
I'd like to setup Nginx proxy to secure my ES Cluster. But I'm stuck with setting Nginx proxy + ES + Spark. I bound network.host to \_local\_ to prevent connecting directly without proxy. http.port: 9200 transport.tcp… --- ## [Use output of one query in as input in another](https://discuss.elastic.co/t/use-output-of-one-query-in-as-input-in-another/27481)
**Author:** [@Ankit\_Pradhan](https://discuss.elastic.co/u/Ankit_Pradhan)\ **Replies:** 3\ **Last updated:** [August 18, 2015, 9:46pm UTC](https://discuss.elastic.co/t/use-output-of-one-query-in-as-input-in-another/27481 "2015-08-18T21:46:30Z")
I would like to use the out of One query as input in another but dont know how. For example: Index1: (Field 1, Field 2, Field 3) Index2: (Field 3, Field 4, Field 5) Select Field 2 from from Index1 where Field 3 =… --- ## [Calculation on ES query?](https://discuss.elastic.co/t/calculation-on-es-query/98813)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [September 1, 2017, 1:36pm UTC](https://discuss.elastic.co/t/calculation-on-es-query/98813 "2017-09-01T13:36:32Z")
Hi, until now I was mostly just using kibana and i borrowed some queries from there, to fire some of them via curl. So I am quite a Newbie about quering ES directly. So I need your help. I have an index which has docu… --- ## [Stuck (~100 % CPU) pipeline workers](https://discuss.elastic.co/t/stuck-100-cpu-pipeline-workers/163650)
**Author:** [@maxh1](https://discuss.elastic.co/u/maxh1)\ **Replies:** 7\ **Last updated:** [January 14, 2019, 11:52am UTC](https://discuss.elastic.co/t/stuck-100-cpu-pipeline-workers/163650 "2019-01-14T11:52:43Z")
Hi! We suddenly noticed that we were no longer receiving events in Kibana/Elasticsearch, and upon further investigation we saw that the server running Logstash was using 100 % CPU. We've tried restarting both Logstash,… --- ## [How to properly close a connection in a Java API Client?](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995)
**Author:** [@jacksparrow414](https://discuss.elastic.co/u/jacksparrow414)\ **Replies:** 5\ **Last updated:** [October 12, 2022, 11:58am UTC](https://discuss.elastic.co/t/how-to-properly-close-a-connection-in-a-java-api-client/314995 "2022-10-12T11:58:10Z")
Configuration Sample Code @ApplicationScoped public class ElasticSearchConfiguration { private static ElasticsearchClient client; private static synchronized void connectElasticSearchCluster() { if (Ob… --- ## [Accessing event data in an Kibana Alerts](https://discuss.elastic.co/t/accessing-event-data-in-an-kibana-alerts/271541)
**Author:** [@dcamozzato](https://discuss.elastic.co/u/dcamozzato)\ **Replies:** 4\ **Last updated:** [May 28, 2021, 10:35am UTC](https://discuss.elastic.co/t/accessing-event-data-in-an-kibana-alerts/271541 "2021-05-28T10:35:06Z")
I am trying to create a Kibana alert for a syslog that is captured by logstash and minimally parsed. The format is this: \process\_name\[pid\]: message The "message" portion is not parsed further, but it … --- ## [Help with rule variables(email alert)](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313)
**Author:** [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Replies:** 4\ **Last updated:** [September 8, 2021, 9:03pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313 "2021-09-08T21:03:22Z")
I would like to know if it is possible for me to use the value of an event field in the email notification of a rule, for example, in the log index comes the fields with IP, SRC, ATTACK\_INFO, severity and others, and I w… --- ## [Problem in connecting to Elasticsearch using Python script](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 6:17am UTC](https://discuss.elastic.co/t/problem-in-connecting-to-elasticsearch-using-python-script/276130 "2021-06-17T06:17:42Z")
Hello All, I have a 3 node elastic cluster setup on EC2. I am trying to connect to my cluster and index some sample data using python script. Below is my python script: - from elasticsearch import Elasticsearch es=Ela… --- ## [Filebeat keeps files open uses up disk space](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841)
**Author:** [@GioXmen](https://discuss.elastic.co/u/GioXmen)\ **Replies:** 7\ **Last updated:** [July 30, 2018, 10:13am UTC](https://discuss.elastic.co/t/filebeat-keeps-files-open-uses-up-disk-space/140841 "2018-07-30T10:13:12Z")
Hello, I am trying to figure out why Filebeat keeps incoming log files open. When Logstash gets full, Filebeat will keep files open thus using up disk space and eventually eating it up. I would like to find a way to hav… --- ## [Updating a mapping in existing indicese](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918)
**Author:** [@pruttle](https://discuss.elastic.co/u/pruttle)\ **Replies:** 6\ **Last updated:** [January 20, 2022, 11:14am UTC](https://discuss.elastic.co/t/updating-a-mapping-in-existing-indicese/294918 "2022-01-20T11:14:42Z")
Hi I have added a new mapping to an Index Template and it is updating new Indices as they are created. I need to update all the pre-existing retrospective Indices with the new mapping. What is the best approach to this… --- ## [General Workflow to Sync Data to ElasticSearch from PostGres](https://discuss.elastic.co/t/general-workflow-to-sync-data-to-elasticsearch-from-postgres/107095)
**Author:** [@Akshay\_Deep\_Lamba](https://discuss.elastic.co/u/Akshay_Deep_Lamba)\ **Replies:** 1\ **Last updated:** [November 9, 2017, 7:37pm UTC](https://discuss.elastic.co/t/general-workflow-to-sync-data-to-elasticsearch-from-postgres/107095 "2017-11-09T19:37:43Z")
Hello I wanted to Real time or Near Real time sync Data from postgres to elastic Search... Below Are some Option I Tried Implementing :- Followed https://www.elastic.co/blog/logstash-jdbc-input-plugin Tutorial and th… --- ## [Unable to get geoip.location to a geo\_point in ES](https://discuss.elastic.co/t/unable-to-get-geoip-location-to-a-geo-point-in-es/107252)
**Author:** [@Tony\_Skalski](https://discuss.elastic.co/u/Tony_Skalski)\ **Replies:** 6\ **Last updated:** [November 13, 2017, 3:19pm UTC](https://discuss.elastic.co/t/unable-to-get-geoip-location-to-a-geo-point-in-es/107252 "2017-11-13T15:19:22Z")
I've read dozens of posts about doing this but am still unable to get a location into ES as a geo\_point. I am using the following logstash conf snippet: input { stdin {}} filter { geoip { source =\> "message" } } output … --- ## [Logstash 2.2 Installation issue on Ubuntu 14.04 (APT) - First time](https://discuss.elastic.co/t/logstash-2-2-installation-issue-on-ubuntu-14-04-apt-first-time/42939)
**Author:** [@gabe](https://discuss.elastic.co/u/gabe)\ **Replies:** 6\ **Last updated:** [February 29, 2016, 7:13am UTC](https://discuss.elastic.co/t/logstash-2-2-installation-issue-on-ubuntu-14-04-apt-first-time/42939 "2016-02-29T07:13:20Z")
Hi All, This is my first time installing Logstash and have been doing my best to follow the documentation for APT (on Ubuntu). As an aside, I just finished installing InfluxDB, Telegraf, Kapacitor which had a similar… --- ## [Client sent an HTTP request to an HTTPS server](https://discuss.elastic.co/t/client-sent-an-http-request-to-an-https-server/216365)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 4\ **Last updated:** [January 30, 2020, 4:26am UTC](https://discuss.elastic.co/t/client-sent-an-http-request-to-an-https-server/216365 "2020-01-30T04:26:59Z")
getting error when try to check elasticsearch Client sent an HTTP request to an HTTPS server --- ## [Elasticsearch 6.3.0 Scroll API requests got cancelled by backend](https://discuss.elastic.co/t/elasticsearch-6-3-0-scroll-api-requests-got-cancelled-by-backend/165613)
**Author:** [@goldsky](https://discuss.elastic.co/u/goldsky)\ **Replies:** 1\ **Last updated:** [February 14, 2019, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-0-scroll-api-requests-got-cancelled-by-backend/165613 "2019-02-14T15:39:59Z")
After some time on one of my clusters (others have identical configuration and type of data/actions but do not have following problem) I detect some strange cluster behavior: \[2019-01-24T05:32:01,537\]\[DEBUG\]\[o.e.a.a.c.n… --- ## [SNMP input (how to configure)](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105)
**Author:** [@inter07](https://discuss.elastic.co/u/inter07)\ **Replies:** 7\ **Last updated:** [May 28, 2019, 4:27pm UTC](https://discuss.elastic.co/t/snmp-input-how-to-configure/183105 "2019-05-28T16:27:48Z")
Hi! Could You please help to configure SNMP input in the Logstash. I 've tried to use the official documentation, but got some problems.( My input configuration is: { input { snmp { get =\> \["1.3.6.1.4.… --- ## [\[FIELDDATA\] Data too large, data for \[cubeId\] would be larger than limit of \[155713536/148.5mb\]\];](https://discuss.elastic.co/t/fielddata-data-too-large-data-for-cubeid-would-be-larger-than-limit-of-155713536-148-5mb/38086)
**Author:** [@LDA-MAN](https://discuss.elastic.co/u/LDA-MAN)\ **Replies:** 7\ **Last updated:** [December 29, 2015, 6:14am UTC](https://discuss.elastic.co/t/fielddata-data-too-large-data-for-cubeid-would-be-larger-than-limit-of-155713536-148-5mb/38086 "2015-12-29T06:14:14Z")
when i search index and use aggregation ，i got this problem which i never catch and use normal before! the full exception like this: 2015-12-29 12:45:38 ERROR com.eps.search.service.indicator.IndicatorServiceImpl\[http-… --- ## [Access Kibana outside the windows server it is running on?](https://discuss.elastic.co/t/access-kibana-outside-the-windows-server-it-is-running-on/25967)
**Author:** [@Marius\_Mathisen](https://discuss.elastic.co/u/Marius_Mathisen)\ **Replies:** 7\ **Last updated:** [July 21, 2015, 11:42am UTC](https://discuss.elastic.co/t/access-kibana-outside-the-windows-server-it-is-running-on/25967 "2015-07-21T11:42:16Z")
Hi, I am trying to access Kibana outside of the Windows server it is running on. I am able to access Marvel with serverName:9200/\_plugin/marvel, but I can't seem to access Kibana outside of the windows server it is run… --- ## [Change field names in kibana](https://discuss.elastic.co/t/change-field-names-in-kibana/126185)
**Author:** [@Kaviya\_Rawat](https://discuss.elastic.co/u/Kaviya_Rawat)\ **Replies:** 3\ **Last updated:** [March 30, 2018, 12:01pm UTC](https://discuss.elastic.co/t/change-field-names-in-kibana/126185 "2018-03-30T12:01:31Z")
Is it possibl to change the names of field that come from elasticsearch, in kibana ?? Also in the filters I dont want to see \_index, \_type can we remove it? --- ## [How to define shard count per index?](https://discuss.elastic.co/t/how-to-define-shard-count-per-index/70787)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [January 6, 2017, 4:13pm UTC](https://discuss.elastic.co/t/how-to-define-shard-count-per-index/70787 "2017-01-06T16:13:03Z")
Hi, I don't know, if the post in ES is correct or if logstash forum fits better. As I understand, the default chard size for indexes created by logstash is 5. Currently we have 1 index per day for all types which ha… --- ## [How to change cluster status is RED to YELLOW or GREEN](https://discuss.elastic.co/t/how-to-change-cluster-status-is-red-to-yellow-or-green/60893)
**Author:** [@sukesh](https://discuss.elastic.co/u/sukesh)\ **Replies:** 2\ **Last updated:** [September 29, 2016, 11:53am UTC](https://discuss.elastic.co/t/how-to-change-cluster-status-is-red-to-yellow-or-green/60893 "2016-09-29T11:53:49Z")
i am regularly facing this situation like clusterstatus is red How to stop it becoming status RED ! please provide me relevant solution --- ## [Removing shards](https://discuss.elastic.co/t/removing-shards/93363)
**Author:** [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Replies:** 4\ **Last updated:** [July 17, 2017, 12:03pm UTC](https://discuss.elastic.co/t/removing-shards/93363 "2017-07-17T12:03:26Z")
Hello, It is possible through the API to remove 3 shards to all existing index? Don't care if data will be lost. Thank you. --- ## [Consume data from sharded RabbitMQ queue](https://discuss.elastic.co/t/consume-data-from-sharded-rabbitmq-queue/130248)
**Author:** [@peter.ridzi](https://discuss.elastic.co/u/peter.ridzi)\ **Replies:** 6\ **Last updated:** [May 15, 2018, 3:06pm UTC](https://discuss.elastic.co/t/consume-data-from-sharded-rabbitmq-queue/130248 "2018-05-15T15:06:49Z")
Hi, I would like to set up a Logstash instance to consume data from a sharded RabbitMQ queue. I am using RabbitMQ 3.3.5 and Logstash 5.2 right now. I installed the rabbitmq-sharding plugin (https://github.com/rabbitmq/… --- ## [Unable to parse data while doing post to elastisearch](https://discuss.elastic.co/t/unable-to-parse-data-while-doing-post-to-elastisearch/84039)
**Author:** [@sonal410](https://discuss.elastic.co/u/sonal410)\ **Replies:** 3\ **Last updated:** [April 28, 2017, 5:51pm UTC](https://discuss.elastic.co/t/unable-to-parse-data-while-doing-post-to-elastisearch/84039 "2017-04-28T17:51:10Z")
I have have below request which runs fine on Kibana PUT /test\_sample/user\_log/3 { "coulmn1": "TEST", "coulmn2": """{"coulmn21":{"sessionId":"1234567","caseId":"XYZ","actionId":"myPage"}}""", … --- ## [Converting field with HEX value to ASCII](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878)
**Author:** [@gcaccia](https://discuss.elastic.co/u/gcaccia)\ **Replies:** 6\ **Last updated:** [January 4, 2017, 7:25pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878 "2017-01-04T19:25:28Z")
I have a dump file of JSON documents where many of the fields are in HEX. I want to import this into Elasticsearch using Logstash. Can Logstash convert HEX fields to ASCII? Thanks, Glenn --- ## [Logstash pid file](https://discuss.elastic.co/t/logstash-pid-file/152891)
**Author:** [@shivaprasadrao.b](https://discuss.elastic.co/u/shivaprasadrao.b)\ **Replies:** 3\ **Last updated:** [October 18, 2018, 8:58pm UTC](https://discuss.elastic.co/t/logstash-pid-file/152891 "2018-10-18T20:58:53Z")
Hi All, i'm starting my logstash with command ./logstash -f logstash.conf & as a backend process. i would like to generate a pid file in my logstash home directory. How to achieve this. For kibana i have used pid.fil… --- ## [Hardware requirements - good resilency - Elastic 8.4](https://discuss.elastic.co/t/hardware-requirements-good-resilency-elastic-8-4/314090)
**Author:** [@elkstack1](https://discuss.elastic.co/u/elkstack1)\ **Replies:** 4\ **Last updated:** [September 13, 2022, 4:23am UTC](https://discuss.elastic.co/t/hardware-requirements-good-resilency-elastic-8-4/314090 "2022-09-13T04:23:42Z")
I would like the hardware requirements for good resiliency - Elastic 8.4 I looked on the documentation and didnt find any info pertaining to hardware specs. We currently have 3 master nodes and 17 data nodes - 13 warm … --- ## [How to refer to subfield in logstash](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474)
**Author:** [@scutdk](https://discuss.elastic.co/u/scutdk)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 6:07am UTC](https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474 "2017-03-22T06:07:27Z")
I have following logstash conf snippet, but it doesn't work. I got the idea of subfield from this stackoverflow thread. How can I make it to work? I am trying to split the http\_refer field in my access log. Thanks. fil… [Previous page](https://discuss.elastic.co/top.md?page=409&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=411&per_page=50&period=all)