# Top **URL:** https://discuss.elastic.co/top.md?page=446&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 447 --- ## [Script to return array for scripted metric aggregation from combine](https://discuss.elastic.co/t/script-to-return-array-for-scripted-metric-aggregation-from-combine/23347)
**Author:** [@vineeth\_mohan\_2](https://discuss.elastic.co/u/vineeth_mohan_2)\ **Replies:** 2\ **Last updated:** [April 22, 2015, 7:01am UTC](https://discuss.elastic.co/t/script-to-return-array-for-scripted-metric-aggregation-from-combine/23347 "2015-04-22T07:01:02Z")
Hi , For scripted metric aggregation , in the example shown in the documentation , the combine script returns a single number. Instead here , can i pass an array or hash ? I tried doing it , though it did not… --- ## [Field \[@timestamp\] of type \[keyword\] does not support custom time zones](https://discuss.elastic.co/t/field-timestamp-of-type-keyword-does-not-support-custom-time-zones/134231)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 1\ **Last updated:** [June 5, 2018, 1:43pm UTC](https://discuss.elastic.co/t/field-timestamp-of-type-keyword-does-not-support-custom-time-zones/134231 "2018-06-05T13:43:47Z")
Once I set packetbeat to use fields.yml I get following exception in elastic logs and on kibana dashboard. Caused by: java.lang.IllegalArgumentException: Field \[@timestamp\] of type \[keyword\] does not support custom time… --- ## [Logstash 2.0.0 and Cisco ASA syslog](https://discuss.elastic.co/t/logstash-2-0-0-and-cisco-asa-syslog/35604)
**Author:** [@edgoad](https://discuss.elastic.co/u/edgoad)\ **Replies:** 4\ **Last updated:** [April 15, 2016, 10:26pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-and-cisco-asa-syslog/35604 "2016-04-15T22:26:09Z")
I have all my Cisco devices forwarding syslog to a central server, and then using Logstash-Forwarder to forward them to logstash. For general syslog features this works great, but I can't get logstash to properly grok th… --- ## [Logstash template file does not exist or cannot be opened](https://discuss.elastic.co/t/logstash-template-file-does-not-exist-or-cannot-be-opened/58829)
**Author:** [@daiyue](https://discuss.elastic.co/u/daiyue)\ **Replies:** 3\ **Last updated:** [August 24, 2016, 8:14pm UTC](https://discuss.elastic.co/t/logstash-template-file-does-not-exist-or-cannot-be-opened/58829 "2016-08-24T20:14:40Z")
Hi, I set up a template file in logstash.conf output like this, output { elasticsearch { hosts =\> \["172.17.0.2:9200"\] manage\_template =\> false template =\> "/home/user\_name/docker-elk/logstash/core\_map… --- ## [Ruby filter to convert date](https://discuss.elastic.co/t/ruby-filter-to-convert-date/193295)
**Author:** [@HFolly](https://discuss.elastic.co/u/HFolly)\ **Replies:** 2\ **Last updated:** [August 1, 2019, 12:38pm UTC](https://discuss.elastic.co/t/ruby-filter-to-convert-date/193295 "2019-08-01T12:38:01Z")
Hi there. In my Logstash configuration I need a Ruby filter to convert date from a given collection of strings. My collection uses an structure with 3 values containing a field name, it's value and it's data type: "C… --- ## [Cannot detect ES Version - Elasticsearch/Cloudera Hive Connectivity](https://discuss.elastic.co/t/cannot-detect-es-version-elasticsearch-cloudera-hive-connectivity/253168)
**Author:** [@bob1985](https://discuss.elastic.co/u/bob1985)\ **Replies:** 3\ **Last updated:** [October 27, 2020, 7:15am UTC](https://discuss.elastic.co/t/cannot-detect-es-version-elasticsearch-cloudera-hive-connectivity/253168 "2020-10-27T07:15:05Z")
Hi, I am creating a Cloudera CDH 6.1.2 Hive connection (bare metal cluster) with Elasticsearch 7.9.3 (in openshift environment) I am getting below error while selecting the data from the table. Error: java.io.IOExcept… --- ## [Elasticsearch Cluster topology](https://discuss.elastic.co/t/elasticsearch-cluster-topology/111418)
**Author:** [@dbhatia](https://discuss.elastic.co/u/dbhatia)\ **Replies:** 3\ **Last updated:** [December 13, 2017, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-topology/111418 "2017-12-13T07:18:09Z")
Hello Experts, I am new to elastic search world, I need advice setting with the cluster topology. I am planning to have 5 nodes in the cluster. Can you guys suggest how many nodes should act as Master ? how many node… --- ## [Multi-field collapsing](https://discuss.elastic.co/t/multi-field-collapsing/19532)
**Author:** [@Brian\_Hudson](https://discuss.elastic.co/u/Brian_Hudson)\ **Replies:** 0\ **Last updated:** [August 29, 2014, 4:03pm UTC](https://discuss.elastic.co/t/multi-field-collapsing/19532 "2014-08-29T16:03:07Z")
I have a use case which requires collapsing on multiple fields. As a simple example assume I have some movie documents indexed with the fields: Director, Actor, Title & Release Date. I want to be able to collapse … --- ## [Best strategy for often updated documents](https://discuss.elastic.co/t/best-strategy-for-often-updated-documents/22790)
**Author:** [@11181](https://discuss.elastic.co/u/11181)\ **Replies:** 2\ **Last updated:** [March 23, 2015, 1:34pm UTC](https://discuss.elastic.co/t/best-strategy-for-often-updated-documents/22790 "2015-03-23T13:34:19Z")
I have forum. And every topic has such field as viewCount - how many times topic was viewed by forum users. I wanted that all fields of topics were taken from ES (id,date,title,content and viewCount). However, this c… --- ## [Read data from ElasticSearch data using vega](https://discuss.elastic.co/t/read-data-from-elasticsearch-data-using-vega/238670)
**Author:** [@issaissa](https://discuss.elastic.co/u/issaissa)\ **Replies:** 6\ **Last updated:** [June 29, 2020, 6:39am UTC](https://discuss.elastic.co/t/read-data-from-elasticsearch-data-using-vega/238670 "2020-06-29T06:39:14Z")
This is my vega code: { $schema: https://vega.github.io/schema/vega-lite/v2.json data: { url: { %context%: true %timefield%: "incident\_date\_time" index: incident\* body: { … --- ## [Kibana 4 won't start with elasticsearch creds in the config](https://discuss.elastic.co/t/kibana-4-wont-start-with-elasticsearch-creds-in-the-config/35197)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 1\ **Last updated:** [November 21, 2015, 2:48am UTC](https://discuss.elastic.co/t/kibana-4-wont-start-with-elasticsearch-creds-in-the-config/35197 "2015-11-21T02:48:57Z")
Guys, It seems that kibana can't communicate with ES 2.0 with the Shield plugin installed. I see this message in kibana instead of the logstash interface: \`plugin:elasticsearch Authentication Exception So I con… --- ## [Best practices for multiple instances of file beat vs. one filebeat instance with multiple prospectors](https://discuss.elastic.co/t/best-practices-for-multiple-instances-of-file-beat-vs-one-filebeat-instance-with-multiple-prospectors/170043)
**Author:** [@roblopes](https://discuss.elastic.co/u/roblopes)\ **Replies:** 4\ **Last updated:** [February 27, 2019, 1:52pm UTC](https://discuss.elastic.co/t/best-practices-for-multiple-instances-of-file-beat-vs-one-filebeat-instance-with-multiple-prospectors/170043 "2019-02-27T13:52:53Z")
Hi, I am replacing an existing enterprise logging system by Elastic Stack. I have hundreds of applications currently using the current system. Those applications they are spread across 3 or 4 servers (depending on the e… --- ## [Drools Engine](https://discuss.elastic.co/t/drools-engine/116433)
**Author:** [@dilipchiru](https://discuss.elastic.co/u/dilipchiru)\ **Replies:** 7\ **Last updated:** [January 30, 2018, 2:06pm UTC](https://discuss.elastic.co/t/drools-engine/116433 "2018-01-30T14:06:00Z")
Hi , I want to know how to write the drools rule to send the data to another elastic search which is not in cluster --- ## [Parsing the logs](https://discuss.elastic.co/t/parsing-the-logs/108095)
**Author:** [@Sniipe](https://discuss.elastic.co/u/Sniipe)\ **Replies:** 7\ **Last updated:** [December 11, 2017, 11:18am UTC](https://discuss.elastic.co/t/parsing-the-logs/108095 "2017-12-11T11:18:46Z")
Hi, I went to a devOpsDays event and saw ELK for the first time. I've it installed locally to test it out. Its working with filebeat =\> ElasticSearch =\> Kibana. I want to parse the message because it has the useful in… --- ## [Filebeat to AWS SQS](https://discuss.elastic.co/t/filebeat-to-aws-sqs/48271)
**Author:** [@gcherneski](https://discuss.elastic.co/u/gcherneski)\ **Replies:** 5\ **Last updated:** [April 5, 2017, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-to-aws-sqs/48271 "2017-04-05T14:22:03Z")
I am configuring an AWS-based ELK stack where I want to send my Filebeat output to AWS SQS and then from AWS SQS to an AWS ELB facing multiple Logstash instances. I cannot find any blog or doc on this subject. Has someon… --- ## [Unable to setup first time password for the new cluster](https://discuss.elastic.co/t/unable-to-setup-first-time-password-for-the-new-cluster/188941)
**Author:** [@dumkaz](https://discuss.elastic.co/u/dumkaz)\ **Replies:** 4\ **Last updated:** [July 4, 2019, 4:31pm UTC](https://discuss.elastic.co/t/unable-to-setup-first-time-password-for-the-new-cluster/188941 "2019-07-04T16:31:26Z")
I install brand new elasticsearch 7.1.1 cluster using saltstack. I start from 3 master nodes and they properly provisioned and from cluster. After that i want to set-up passwords for built-in users, before provisioning… --- ## [Deleted documents in search results](https://discuss.elastic.co/t/deleted-documents-in-search-results/9872)
**Author:** [@Petr\_Jancarik](https://discuss.elastic.co/u/Petr_Jancarik)\ **Replies:** 5\ **Last updated:** [November 29, 2012, 2:34pm UTC](https://discuss.elastic.co/t/deleted-documents-in-search-results/9872 "2012-11-29T14:34:33Z")
Hi, I have index for examle "twitter" with 2 shards and 1 replica in the 5 node cluster (master node has no data). Several documents was deleted from index like this: curl -XDELETE 'http://localhost:9200/twitte… --- ## [Unable to fetch mapping with kibana, however there are indices in Elasticsearch](https://discuss.elastic.co/t/unable-to-fetch-mapping-with-kibana-however-there-are-indices-in-elasticsearch/100998)
**Author:** [@Nandor\_Soma\_Abonyi](https://discuss.elastic.co/u/Nandor_Soma_Abonyi)\ **Replies:** 8\ **Last updated:** [October 3, 2017, 3:48pm UTC](https://discuss.elastic.co/t/unable-to-fetch-mapping-with-kibana-however-there-are-indices-in-elasticsearch/100998 "2017-10-03T15:48:08Z")
Hello! I have a problem that I can't configure index pattern. Error message: Unable to fetch mapping. Do you have indices matching the pattern? Seems like that Kibana can't query elasticsearch properly. curl 'http:/… --- ## [Dynamic range in Goal or Gauge visualization](https://discuss.elastic.co/t/dynamic-range-in-goal-or-gauge-visualization/106032)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 3\ **Last updated:** [November 1, 2017, 2:48pm UTC](https://discuss.elastic.co/t/dynamic-range-in-goal-or-gauge-visualization/106032 "2017-11-01T14:48:03Z")
Hello, I have an index in elasticsearch that store messages from firewall logs, in one of the fields I have the name of the matching rule for each session and some of them are deny rules. I'm trying to create a goal or… --- ## [Pattern does not contain any of the following field types: geo\_point](https://discuss.elastic.co/t/pattern-does-not-contain-any-of-the-following-field-types-geo-point/85834)
**Author:** [@Rahul\_Lao](https://discuss.elastic.co/u/Rahul_Lao)\ **Replies:** 5\ **Last updated:** [May 16, 2017, 11:31am UTC](https://discuss.elastic.co/t/pattern-does-not-contain-any-of-the-following-field-types-geo-point/85834 "2017-05-16T11:31:39Z")
Hi, I am trying to fetch data from a csv file and store it in elastic search. Finally i want to visualize it on Tile Map. logstash conf file input { file { path =\> "/airports\_test.csv" codec =\> "plain" start\_po… --- ## [What does the Cpu throttling means?](https://discuss.elastic.co/t/what-does-the-cpu-throttling-means/235450)
**Author:** [@Bingu\_Shim](https://discuss.elastic.co/u/Bingu_Shim)\ **Replies:** 3\ **Last updated:** [June 4, 2020, 6:45am UTC](https://discuss.elastic.co/t/what-does-the-cpu-throttling-means/235450 "2020-06-04T06:45:42Z")
Is there any document that describe what the 'CPU Throttling' means? I found similar question, but the topic has been closed without answer. How to understand the monitor metric “cpu Throttling” --- ## [Hosts table : host.name (alias of beat.name) used instead of agent.hostname](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088)
**Author:** [@Georgios\_Gkinis](https://discuss.elastic.co/u/Georgios_Gkinis)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 8:10pm UTC](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088 "2020-02-17T20:10:19Z")
I am using beats to forward metrics and logs to Elasticsearch. In the configuration of each beat I have setup its name manually : name: "${COMPUTERNAME}-filebeat-applications" When I go to SIEM -\> Hosts -\> table All H… --- ## [Truncating String in Data Table](https://discuss.elastic.co/t/truncating-string-in-data-table/154876)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 5\ **Last updated:** [October 31, 2018, 9:38pm UTC](https://discuss.elastic.co/t/truncating-string-in-data-table/154876 "2018-10-31T21:38:30Z")
I have a data table visualization where I am counting the top hits on a list of URLs. All the URLs have http://www.example.com/index. I am counting top hits on the part after /index. Is it possible to truncate the roo… --- ## [Invalid index name \[Simulation\], must be lowercase](https://discuss.elastic.co/t/invalid-index-name-simulation-must-be-lowercase/120366)
**Author:** [@tomak](https://discuss.elastic.co/u/tomak)\ **Replies:** 2\ **Last updated:** [February 18, 2018, 7:59pm UTC](https://discuss.elastic.co/t/invalid-index-name-simulation-must-be-lowercase/120366 "2018-02-18T19:59:54Z")
I get this error when I try to add a son file using the bulk API. {"index":{"\_index":"Simulation","\_type":"type","\_id":"5a6675d1e4b09094a9a03114","status":400,"error":{"type":"invalid\_index\_name\_exception","reason":"Inv… --- ## [European number formats in Kibana](https://discuss.elastic.co/t/european-number-formats-in-kibana/85453)
**Author:** [@nesretep](https://discuss.elastic.co/u/nesretep)\ **Replies:** 6\ **Last updated:** [May 16, 2017, 2:44pm UTC](https://discuss.elastic.co/t/european-number-formats-in-kibana/85453 "2017-05-16T14:44:59Z")
Hi There How can we set the number to be displayed properly according to our national standards? We use dot as thousand separator and comma as decimal pointer (10.510,75) (Editing in settings "format:number:defaultPatt… --- ## [Total shards, but this cluster currently has \[1000\]/\[1000\]](https://discuss.elastic.co/t/total-shards-but-this-cluster-currently-has-1000-1000/204960)
**Author:** [@rbrodrigues](https://discuss.elastic.co/u/rbrodrigues)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 12:03am UTC](https://discuss.elastic.co/t/total-shards-but-this-cluster-currently-has-1000-1000/204960 "2019-10-24T00:03:36Z")
Hello Elasticsearch Team, I have the following problem when I index a very large volume of data. 2019-10-23 17:33:52,158 ERROR 0:0:0:0:0:0:0:1 admin \[LumisRequest - http-nio-8080-exec-7; url: \[http://localhost:8080/… --- ## [Searching by date in Kibana](https://discuss.elastic.co/t/searching-by-date-in-kibana/85419)
**Author:** [@snakonechny](https://discuss.elastic.co/u/snakonechny)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 4:39pm UTC](https://discuss.elastic.co/t/searching-by-date-in-kibana/85419 "2017-05-11T16:39:41Z")
Hello all, I have a general question about searching indices by date. For instance, if I have a property such as September 3rd 1950, 00:00:00.000, how would I search for all documents that include that date? If I try… --- ## [Match\_phrase not matching all terms](https://discuss.elastic.co/t/match-phrase-not-matching-all-terms/162221)
**Author:** [@mkarmi](https://discuss.elastic.co/u/mkarmi)\ **Replies:** 5\ **Last updated:** [December 28, 2018, 1:10pm UTC](https://discuss.elastic.co/t/match-phrase-not-matching-all-terms/162221 "2018-12-28T13:10:54Z")
Reading from elastic documentation: the match\_phrase query first analyzes the query string to produce a list of terms. It then searches for all the terms, but keeps only documents that contain all of the search ter… --- ## [6.2.1 to 6.4 upgrade results in X-pack 'NoSuchFileException' issue](https://discuss.elastic.co/t/6-2-1-to-6-4-upgrade-results-in-x-pack-nosuchfileexception-issue/145935)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 6\ **Last updated:** [October 1, 2018, 8:26pm UTC](https://discuss.elastic.co/t/6-2-1-to-6-4-upgrade-results-in-x-pack-nosuchfileexception-issue/145935 "2018-10-01T20:26:00Z")
Hi All, I tried running an offline RPM upgrade of the new Elasticsearch 6.4 on top of my existing 6.2.1 environment. The original environment has X-pack installed on it, configured to provide just a basic licence (so no… --- ## [Subsets](https://discuss.elastic.co/t/subsets/46488)
**Author:** [@MrIncredible](https://discuss.elastic.co/u/MrIncredible)\ **Replies:** 7\ **Last updated:** [April 9, 2016, 2:22pm UTC](https://discuss.elastic.co/t/subsets/46488 "2016-04-09T14:22:26Z")
Hi everyone, Thanks for reading. Here's my problem. I have an array with numbers on each document as such: Document 1: \[1, 2, 3\] Document 2: \[1, 4\] Document 3: \[6,12,2\] I want to query my documents and find those… --- ## [Grok pattern to split the stream name!](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 8\ **Last updated:** [November 20, 2015, 2:55pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696 "2015-11-20T14:55:24Z")
Again, Come with Wowza Log parsing issue ! When I parse the wowza server logs, the stream name come as below, Is there any way to split exact stream name alone from the entire url ?. Convert the below one , FROM w… --- ## [Log4j2 input plugin](https://discuss.elastic.co/t/log4j2-input-plugin/32171)
**Author:** [@AndiSosp](https://discuss.elastic.co/u/AndiSosp)\ **Replies:** 1\ **Last updated:** [November 3, 2015, 11:19am UTC](https://discuss.elastic.co/t/log4j2-input-plugin/32171 "2015-11-03T11:19:57Z")
Hi everyone, I'm trying to get Log4j2 SocketAppenders to log directly in to logstash with the log4j plugin but no messages are processed by logstash. Is the log4j input plugin not working with log4j 2.x? Logstash 1.… --- ## [\[SOLVED\] Mail server configuration issues](https://discuss.elastic.co/t/solved-mail-server-configuration-issues/28933)
**Author:** [@tom\_jonge](https://discuss.elastic.co/u/tom_jonge)\ **Replies:** 7\ **Last updated:** [September 16, 2015, 12:06pm UTC](https://discuss.elastic.co/t/solved-mail-server-configuration-issues/28933 "2015-09-16T12:06:49Z")
Greetings, I followed the guides to install the ELK stack and everything went according to expectations. I currently have 2 kibana4 nodes with elasticsearch 1.7.1 query nodes, 2 elasticsearch 1.7.1 data nodes and 2 log… --- ## [How filebeat collect iis log through grok filter? tags:\_grokparsefailure](https://discuss.elastic.co/t/how-filebeat-collect-iis-log-through-grok-filter-tags--grokparsefailure/40001)
**Author:** [@clifford](https://discuss.elastic.co/u/clifford)\ **Replies:** 4\ **Last updated:** [January 26, 2016, 3:35am UTC](https://discuss.elastic.co/t/how-filebeat-collect-iis-log-through-grok-filter-tags--grokparsefailure/40001 "2016-01-26T03:35:06Z")
I want to use logstash grok collect iis\_log,but I didn't succeed.\[tags:\_grokparsefailure\] my iis\_log format: 2016-01-25 07:54:53 11.11.120.130 GET /Portal/Content/HtmlImageHandler.ashx fid=50ffc09402534d70b17736b7b30… --- ## [Attempted to resurrect connection to dead ES instance, but got an error](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/102632)
**Author:** [@Adam\_Schappell](https://discuss.elastic.co/u/Adam_Schappell)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 5:39am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-but-got-an-error/102632 "2017-10-06T05:39:11Z")
Hey all can someone help me please. I just upgraded to XPack and am having trouble getting Logstash back up and running. Here is the errors I am seeing in logstash-plain.log \[2017-10-03T19:58:14,092\]\[WARN \]\[logstash.out… --- ## [Worker setting of elasticsearch output plugin](https://discuss.elastic.co/t/worker-setting-of-elasticsearch-output-plugin/56020)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 1\ **Last updated:** [July 27, 2016, 6:32pm UTC](https://discuss.elastic.co/t/worker-setting-of-elasticsearch-output-plugin/56020 "2016-07-27T18:32:55Z")
I have a question about the number of pipeline workers and elasticsearch output workers. By default, logstash pipeline will initiate workers based on the number of cores of the server. If I have 6 cores in the server,… --- ## [bgeVam/kibana\_treemap\_visualization](https://discuss.elastic.co/t/bgevam-kibana-treemap-visualization/165892)
**Author:** [@bgeVam](https://discuss.elastic.co/u/bgeVam)\ **Replies:** 1\ **Last updated:** [January 27, 2019, 12:43pm UTC](https://discuss.elastic.co/t/bgevam-kibana-treemap-visualization/165892 "2019-01-27T12:43:25Z")
Hey everyone! I'm very happy to announce that I released the first version of my treemap visualization for kibana. Of course, I am looking for feedback so any comment will be greatly appreciated :grinning: Here is a l… --- ## [Exact difference between "Query\_string" query and "multi\_match" query with cross\_fields](https://discuss.elastic.co/t/exact-difference-between-query-string-query-and-multi-match-query-with-cross-fields/16666)
**Author:** [@Prashant\_Pal](https://discuss.elastic.co/u/Prashant_Pal)\ **Replies:** 2\ **Last updated:** [April 1, 2014, 8:07am UTC](https://discuss.elastic.co/t/exact-difference-between-query-string-query-and-multi-match-query-with-cross-fields/16666 "2014-04-01T08:07:17Z")
Hi ES users, While exploring the new release of ES 1.1.0 I came across with the release of cross\_fields query in multi\_match. So is there any difference between "Query\_string" query and "multi\_match" query with c… --- ## [How to make beats send data to multiple instances](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/179010)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 4\ **Last updated:** [April 30, 2019, 10:02am UTC](https://discuss.elastic.co/t/how-to-make-beats-send-data-to-multiple-instances/179010 "2019-04-30T10:02:17Z")
Dear ElasticSearch Team, Here I take logs use case as an example, Basically, we'll collect these system logs, application logs, business logs for each application on our production, and ship them to different logstash c… --- ## [How to change @timestamp field from UTC to local times](https://discuss.elastic.co/t/how-to-change-timestamp-field-from-utc-to-local-times/93329)
**Author:** [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\ **Replies:** 7\ **Last updated:** [October 18, 2019, 12:01pm UTC](https://discuss.elastic.co/t/how-to-change-timestamp-field-from-utc-to-local-times/93329 "2019-10-18T12:01:05Z")
Hi, @magnusbaeck. I having problems with output beats, because output beats doesn't match with my local times. Example output from metricbeat 2017-07-17T03:52:38.878Z And my local times. 2017-07-17, 10.52 Can I… --- ## [How to get average of count events?](https://discuss.elastic.co/t/how-to-get-average-of-count-events/104727)
**Author:** [@ILanor](https://discuss.elastic.co/u/ILanor)\ **Replies:** 1\ **Last updated:** [October 21, 2017, 12:53pm UTC](https://discuss.elastic.co/t/how-to-get-average-of-count-events/104727 "2017-10-21T12:53:46Z")
Hi! I need help with some vizualize: details see below. I have some events in which I have next fields: name: heartbeat (this is name of event that i research) sessionId (this is session id that unique when user star… --- ## [Remote Filebeat can't send logs to Logstash](https://discuss.elastic.co/t/remote-filebeat-cant-send-logs-to-logstash/163688)
**Author:** [@Wellguys](https://discuss.elastic.co/u/Wellguys)\ **Replies:** 3\ **Last updated:** [January 11, 2019, 11:59am UTC](https://discuss.elastic.co/t/remote-filebeat-cant-send-logs-to-logstash/163688 "2019-01-11T11:59:06Z")
Hello. I'm having some problems understanding how to connect a filebeat from another server to my ELK server. I have a filebeat running on the ELK server with no issue and kibana is showing me all the logs needed, but … --- ## [Kibana startup failure in Windows](https://discuss.elastic.co/t/kibana-startup-failure-in-windows/279407)
**Author:** [@Srinivas\_Kris](https://discuss.elastic.co/u/Srinivas_Kris)\ **Replies:** 4\ **Last updated:** [August 29, 2021, 3:34pm UTC](https://discuss.elastic.co/t/kibana-startup-failure-in-windows/279407 "2021-08-29T15:34:41Z")
Hi All I downloaded Kibana 7.13.4 zip file and extracted in windows. I started kibarna.bat in command prompt. I am getting the following error. Any help is appreciated. log \[11:02:36.548\] \[fatal\]\[root\] Error: Cannot … --- ## [I want to know what the flush\_size and idle\_flush\_time has been changed to](https://discuss.elastic.co/t/i-want-to-know-what-the-flush-size-and-idle-flush-time-has-been-changed-to/127478)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 4\ **Last updated:** [April 11, 2018, 7:37am UTC](https://discuss.elastic.co/t/i-want-to-know-what-the-flush-size-and-idle-flush-time-has-been-changed-to/127478 "2018-04-11T07:37:35Z")
elasticsearch { hosts =\> localhost index =\> "logstash(%{+YYYY.MM.dd})" document\_type =\>"logstash" flush\_size=\>1000 idle\_flush\_time=\>15 } it didn‘t … --- ## [Too many open files error logged](https://discuss.elastic.co/t/too-many-open-files-error-logged/41249)
**Author:** [@Simina\_Dorin](https://discuss.elastic.co/u/Simina_Dorin)\ **Replies:** 4\ **Last updated:** [February 9, 2016, 11:58am UTC](https://discuss.elastic.co/t/too-many-open-files-error-logged/41249 "2016-02-09T11:58:11Z")
Hi, Does anyone know how can I fix the following error that I get? A service stop and restart does not solve it. \[2016-02-09 09:00:45,994\]\[INFO \]\[node \] \[Thunderbolt\] version\[1.7.3\], pid\[6450\], bu… --- ## [View amount of data stored in elk stack](https://discuss.elastic.co/t/view-amount-of-data-stored-in-elk-stack/136542)
**Author:** [@ray\_zuniga](https://discuss.elastic.co/u/ray_zuniga)\ **Replies:** 7\ **Last updated:** [June 29, 2018, 2:58pm UTC](https://discuss.elastic.co/t/view-amount-of-data-stored-in-elk-stack/136542 "2018-06-29T14:58:51Z")
Is there a way to view in the kibana web gui the the amount of logs stored by size and the retention rate ? Ive been looking around and I think tentatively xpack does this? also this question may be in the wrong categor… --- ## [Fetch 1 million records](https://discuss.elastic.co/t/fetch-1-million-records/220636)
**Author:** [@otherview](https://discuss.elastic.co/u/otherview)\ **Replies:** 6\ **Last updated:** [March 2, 2020, 4:33pm UTC](https://discuss.elastic.co/t/fetch-1-million-records/220636 "2020-03-02T16:33:09Z")
Hi ! I'm trying to fetch +1 Million records from elastic search. So far all approaches are still slow. At the moment I'm using a sliced scroll search. I just need a few fields from the documents, not the whole docume… --- ## [Elasticsearch and hugespages](https://discuss.elastic.co/t/elasticsearch-and-hugespages/82590)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [April 17, 2017, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-and-hugespages/82590 "2017-04-17T22:07:32Z")
Hi Usually java apps that use lot of ram likes having hugepages setup in the OS and then enabled in the jvm. Does this help elasticsearch or is not recommended? anyone have done any benchmark? Thanks! Daniel --- ## [Jdbc input plugin -- cannot locate last\_run\_metadata\_path](https://discuss.elastic.co/t/jdbc-input-plugin-cannot-locate-last-run-metadata-path/50716)
**Author:** [@Neil\_Alex](https://discuss.elastic.co/u/Neil_Alex)\ **Replies:** 3\ **Last updated:** [May 24, 2016, 8:34am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-cannot-locate-last-run-metadata-path/50716 "2016-05-24T08:34:55Z")
Hello , I am using logstash 2.3 in an Ubuntu 14.04 , not as a service ( just extracted the tar.gz ). I successfully ran logstash jdbc input plugin and fetched some data from my sql server. Now I wanna re run the sam… --- ## [Official docker image bug - cannot resolve config path](https://discuss.elastic.co/t/official-docker-image-bug-cannot-resolve-config-path/29015)
**Author:** [@Alexander\_Skiller](https://discuss.elastic.co/u/Alexander_Skiller)\ **Replies:** 8\ **Last updated:** [September 19, 2015, 4:04pm UTC](https://discuss.elastic.co/t/official-docker-image-bug-cannot-resolve-config-path/29015 "2015-09-19T16:04:25Z")
I am using official elasticsearch docker image to run my elasticsearch instance. I am trying to create an index with some filters which require to load some files (synonym filter, stopword filter...) none of such filters… [Previous page](https://discuss.elastic.co/top.md?page=445&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=447&per_page=50&period=all)