# Top **URL:** https://discuss.elastic.co/top.md?page=463&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 464 --- ## [Json parsing problem tcp input](https://discuss.elastic.co/t/json-parsing-problem-tcp-input/169562)
**Author:** [@hoff](https://discuss.elastic.co/u/hoff)\ **Replies:** 8\ **Last updated:** [February 27, 2019, 7:59am UTC](https://discuss.elastic.co/t/json-parsing-problem-tcp-input/169562 "2019-02-27T07:59:17Z")
I have a problem with logs in syslog. Logstash logging warn like a \[WARN \]\[logstash.codecs.jsonlines\] JSON parse error, original data now in message field {:error=\>#\, :… --- ## [Not able to see the source ip field in the auth.log on kibana dashboard](https://discuss.elastic.co/t/not-able-to-see-the-source-ip-field-in-the-auth-log-on-kibana-dashboard/72577)
**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Replies:** 7\ **Last updated:** [January 24, 2017, 12:29pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-source-ip-field-in-the-auth-log-on-kibana-dashboard/72577 "2017-01-24T12:29:18Z")
hello, I just want to add the source ip field in the auth.log separate as my auth.log dashboard are showing these field and the source ip flied is showing in the message I want it like this, showing in the below sc… --- ## [Setting JVM Heap size for Elasticsearch container](https://discuss.elastic.co/t/setting-jvm-heap-size-for-elasticsearch-container/300374)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 1\ **Last updated:** [March 24, 2022, 8:21am UTC](https://discuss.elastic.co/t/setting-jvm-heap-size-for-elasticsearch-container/300374 "2022-03-24T08:21:37Z")
I recently ran into an error where my cluster would turn red due to exceeding the maximum allocated heap. Once it returned back to below the threshold, I saw that by default, only 512mb was allocated. name id node.rol… --- ## [No way to specify filebeat 8.0.0 data stream and index template pattern](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979)
**Author:** [@rouke-broersma](https://discuss.elastic.co/u/rouke-broersma)\ **Replies:** 3\ **Last updated:** [February 11, 2022, 2:45pm UTC](https://discuss.elastic.co/t/no-way-to-specify-filebeat-8-0-0-data-stream-and-index-template-pattern/296979 "2022-02-11T14:45:18Z")
In filebeat 7.x we were able to specify custom index template and rollover\_alias for the indexes used by filebeat. We use this to split which indices different filebeats send their logs to because some filebeats collect … --- ## ["Error: fleet-server failed: context canceled" error when trying to "Install Fleet Server to a centralized host"](https://discuss.elastic.co/t/error-fleet-server-failed-context-canceled-error-when-trying-to-install-fleet-server-to-a-centralized-host/326112)
**Author:** [@Matt\_Johnston](https://discuss.elastic.co/u/Matt_Johnston)\ **Replies:** 4\ **Last updated:** [February 22, 2023, 9:30pm UTC](https://discuss.elastic.co/t/error-fleet-server-failed-context-canceled-error-when-trying-to-install-fleet-server-to-a-centralized-host/326112 "2023-02-22T21:30:09Z")
I am trying to "Add a Fleet Server" but am getting an error when I try to install the Elastic Agent. After running the following command as instructed: curl -L -O https://artifacts.elastic.co/downloads/beats/elastic… --- ## [Different score for exact same keyword](https://discuss.elastic.co/t/different-score-for-exact-same-keyword/15844)
**Author:** [@vallabh](https://discuss.elastic.co/u/vallabh)\ **Replies:** 4\ **Last updated:** [February 20, 2014, 11:02am UTC](https://discuss.elastic.co/t/different-score-for-exact-same-keyword/15844 "2014-02-20T11:02:12Z")
Dear Friends, I am using phonetic analysis in elasticsearch to search best results. When i search keyword lets say "McDonald" elastic search returns many listings with "McDonald's" but some of these have differre… --- ## [Security must be explicitly enabled when using a \[basic\] license](https://discuss.elastic.co/t/security-must-be-explicitly-enabled-when-using-a-basic-license/222602)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [March 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/security-must-be-explicitly-enabled-when-using-a-basic-license/222602 "2020-03-14T12:50:24Z")
Hi , when I'm trying to open a Kibana I get :slight\_smile: Security must be explicitly enabled when using a \[basic\] license. Enable security by setting \[xpack.security.enabled\] ..... but when I set xpack.security.enab… --- ## [Importing Kibana dashboards: fail to create the Kibana loader](https://discuss.elastic.co/t/importing-kibana-dashboards-fail-to-create-the-kibana-loader/118637)
**Author:** [@BezVeze](https://discuss.elastic.co/u/BezVeze)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 8:48am UTC](https://discuss.elastic.co/t/importing-kibana-dashboards-fail-to-create-the-kibana-loader/118637 "2018-02-07T08:48:24Z")
Ok, im pretty sure that i know what is the deal but i cant figure it out how i can manage to work... the thing is when i start the filebeat setup -E action it cannot install the dashboards in the kibana it gives me an … --- ## [Cancel a forcemerge operation](https://discuss.elastic.co/t/cancel-a-forcemerge-operation/254481)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 1\ **Last updated:** [November 6, 2020, 4:32am UTC](https://discuss.elastic.co/t/cancel-a-forcemerge-operation/254481 "2020-11-06T04:32:24Z")
Is there a way to cancel and on-going \[\_forcemerge\](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/indices-forcemerge.html#indices-forcemerge) operation? ES Version 6.8.6. --- ## [Unable to register NFS for snapshot](https://discuss.elastic.co/t/unable-to-register-nfs-for-snapshot/186026)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 4\ **Last updated:** [June 18, 2019, 1:23pm UTC](https://discuss.elastic.co/t/unable-to-register-nfs-for-snapshot/186026 "2019-06-18T13:23:18Z")
Hi guys, I'm unable to do the following cURL command: curl -XPUT http://localhost:9200/\_snapshot/backup -H 'Content-Type: application/json' -d ' { "type": "fs", "settings": { "location": "/mnt/NFS/NFS/l… --- ## [Elasticsearch painless updating List\ in JAVA not working](https://discuss.elastic.co/t/elasticsearch-painless-updating-list-string-in-java-not-working/162232)
**Author:** [@Rashid\_Yes](https://discuss.elastic.co/u/Rashid_Yes)\ **Replies:** 8\ **Last updated:** [January 23, 2019, 12:58pm UTC](https://discuss.elastic.co/t/elasticsearch-painless-updating-list-string-in-java-not-working/162232 "2019-01-23T12:58:47Z")
When I am updating the single String in painless, its working fine. But when updating List in painless is not working. Any help would be appreciated. Regards --- ## [Need to create index on weekly basis](https://discuss.elastic.co/t/need-to-create-index-on-weekly-basis/57893)
**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\ **Replies:** 6\ **Last updated:** [August 17, 2016, 6:09am UTC](https://discuss.elastic.co/t/need-to-create-index-on-weekly-basis/57893 "2016-08-17T06:09:02Z")
Hi Team, I want to create my index on weekly basis, Can You suggest any method --- ## [Measuring the taking time](https://discuss.elastic.co/t/measuring-the-taking-time/113900)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 4\ **Last updated:** [January 4, 2018, 9:15am UTC](https://discuss.elastic.co/t/measuring-the-taking-time/113900 "2018-01-04T09:15:25Z")
hi everyone! is there any way to do measuring the time taken by logstash pipeline processing (input cloudwatch logs \> filter some patterns \> output to aws elasticsearch)???? i am using logstash v6.1.1 and not include x… --- ## [Filebeat holds on to a file descriptor too long even after a file was deleted?](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long-even-after-a-file-was-deleted/117731)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 8\ **Last updated:** [February 5, 2018, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-holds-on-to-a-file-descriptor-too-long-even-after-a-file-was-deleted/117731 "2018-02-05T20:26:55Z")
Hello, filebeat experts, I reported a similar problem before in Filebeat might erroneously hold on to the file descriptor? thanks @steffens for the tips! I added the following to our config file back then, which worked… --- ## [Filebeat autodiscover for docker does not work on /var/lib/docker/containers](https://discuss.elastic.co/t/filebeat-autodiscover-for-docker-does-not-work-on-var-lib-docker-containers/159766)
**Author:** [@RogerLapin](https://discuss.elastic.co/u/RogerLapin)\ **Replies:** 7\ **Last updated:** [December 18, 2018, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-for-docker-does-not-work-on-var-lib-docker-containers/159766 "2018-12-18T15:04:58Z")
Hi, I am quite puzzled about the autodiscover feature for "tea"ing docker logs. This look quite useful, but despite reading the documentation and the few posts about it, I could not manage to have it fully work. To be… --- ## [Using Custom value for \_id instead of es generated value](https://discuss.elastic.co/t/using-custom-value-for--id-instead-of-es-generated-value/96540)
**Author:** [@jsbonline2007](https://discuss.elastic.co/u/jsbonline2007)\ **Replies:** 1\ **Last updated:** [August 11, 2017, 8:20am UTC](https://discuss.elastic.co/t/using-custom-value-for--id-instead-of-es-generated-value/96540 "2017-08-11T08:20:20Z")
Hi Team, We are implementing search on candidate data of about 10 mil records and we are planning to use candidate email ID as primary key for each record in elasticsearch. Can we use emailAddress as \_id in elasticsear… --- ## [How to set the index name to the value of tags set by filebeat](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 6\ **Last updated:** [August 2, 2021, 1:22am UTC](https://discuss.elastic.co/t/how-to-set-the-index-name-to-the-value-of-tags-set-by-filebeat/279820 "2021-08-02T01:22:08Z")
I am using filebeat to collect some logs. I have set the value of tags for each log, and I want to use that value as the name of the index. Is that possible? vi /etc/filebeat/filebeat.yml ... snip ... filebeat.inputs:… --- ## [Error while doing oidc - nested: ParseException\[Missing JSON object member with key "token\_type"](https://discuss.elastic.co/t/error-while-doing-oidc-nested-parseexception-missing-json-object-member-with-key-token-type/205197)
**Author:** [@yash\_nigam](https://discuss.elastic.co/u/yash_nigam)\ **Replies:** 3\ **Last updated:** [October 25, 2019, 9:49am UTC](https://discuss.elastic.co/t/error-while-doing-oidc-nested-parseexception-missing-json-object-member-with-key-token-type/205197 "2019-10-25T09:49:14Z")
Hello Team, We are using platinum-tier-xpack-trial-license While using oidc authentication without Kibana- following steps mentioned here: https://www.elastic.co/guide/en/elasticsearch/reference/7.3/oidc-without-kiban… --- ## [Add\_field to write object & array values](https://discuss.elastic.co/t/add-field-to-write-object-array-values/1095)
**Author:** [@kyunam](https://discuss.elastic.co/u/kyunam)\ **Replies:** 1\ **Last updated:** [April 4, 2017, 3:56am UTC](https://discuss.elastic.co/t/add-field-to-write-object-array-values/1095 "2017-04-04T03:56:15Z")
Hi! I'm trying to create geo\_point field in a filter. I can create a string representation of geo\_point fine. But I can't figure out how to write object representation & array representation of geo\_point by using add\_f… --- ## [Prevent from filebeat to logging to /var/messages](https://discuss.elastic.co/t/prevent-from-filebeat-to-logging-to-var-messages/223773)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [March 16, 2020, 9:41pm UTC](https://discuss.elastic.co/t/prevent-from-filebeat-to-logging-to-var-messages/223773 "2020-03-16T21:41:23Z")
Hi , is there any way to prevent from filebeat logging to /var/messages ? , it logging and sends to logstash every beat example /var/log/messages Mar 16 15:27:19 solrc-stg1 filebeat\[20876\]: 2020-03-16T15:27:19.680+… --- ## [Elasticsearch 8.0 RPM Install Security autoconfiguration issues](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-security-autoconfiguration-issues/297907)
**Author:** [@apjkelly](https://discuss.elastic.co/u/apjkelly)\ **Replies:** 5\ **Last updated:** [February 22, 2022, 4:33pm UTC](https://discuss.elastic.co/t/elasticsearch-8-0-rpm-install-security-autoconfiguration-issues/297907 "2022-02-22T16:33:53Z")
I'm in the process of attempting to install Elasticsearch on a group of CentOS 7 servers. I am installing using the rpm provided in the Elasticsearch repo. However there appears to be an issue with the automated security… --- ## [Error Running ElasticSearch](https://discuss.elastic.co/t/error-running-elasticsearch/3930)
**Author:** [@timscott](https://discuss.elastic.co/u/timscott)\ **Replies:** 6\ **Last updated:** [February 16, 2011, 5:49pm UTC](https://discuss.elastic.co/t/error-running-elasticsearch/3930 "2011-02-16T17:49:04Z")
When I try to run ElasticSearch (on a Linux Ubuntu VM) I get the following error: Error occurred during initialization of VM Could not reserve enough space for object heap I am a Linux/Java dummy. I realize this… --- ## [Replica Shard is in unallocated state after upgrade to 6.0 from 5.6.0](https://discuss.elastic.co/t/replica-shard-is-in-unallocated-state-after-upgrade-to-6-0-from-5-6-0/108375)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 6\ **Last updated:** [December 6, 2017, 2:49am UTC](https://discuss.elastic.co/t/replica-shard-is-in-unallocated-state-after-upgrade-to-6-0-from-5-6-0/108375 "2017-12-06T02:49:32Z")
I have performed a rolling upgrade on my ES cluster to upgrade it from 5.6.0 to 6.0.0. The upgrade went smoothly and all of my nodes were upgraded. Post upgrade, I noticed that a single replica shard of an index was una… --- ## [Sort query kibana (in the search window)](https://discuss.elastic.co/t/sort-query-kibana-in-the-search-window/63809)
**Author:** [@rheng](https://discuss.elastic.co/u/rheng)\ **Replies:** 2\ **Last updated:** [October 25, 2016, 9:26pm UTC](https://discuss.elastic.co/t/sort-query-kibana-in-the-search-window/63809 "2016-10-25T21:26:16Z")
Is there a way to create a search query in kibana I have multiple entries, and i want to return that last one. Here's the query i ran in elasticsearch which returns the latest entry. I want to do that in kibana. … --- ## [Basic security without xpack](https://discuss.elastic.co/t/basic-security-without-xpack/198349)
**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\ **Replies:** 5\ **Last updated:** [September 6, 2019, 12:40pm UTC](https://discuss.elastic.co/t/basic-security-without-xpack/198349 "2019-09-06T12:40:55Z")
Is there an option to have login/password connectivity(tls is optional) to elasticsearch and authentication enabled on kibana without xpack installation? --- ## [Logstashのエラーについて](https://discuss.elastic.co/t/logstash/191562)
**Author:** [@kapibara824](https://discuss.elastic.co/u/kapibara824)\ **Replies:** 3\ **Last updated:** [July 24, 2019, 2:20am UTC](https://discuss.elastic.co/t/logstash/191562 "2019-07-24T02:20:17Z")
Logstashからnginxのアクセスログを別のサーバで動いているElasticsearchに送りたいのですがエラーが出て困っています \[2019-07-22T12:24:18,898\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\ **Author:** [@Praneet\_Khandelwal](https://discuss.elastic.co/u/Praneet_Khandelwal)\ **Replies:** 2\ **Last updated:** [February 22, 2019, 9:47am UTC](https://discuss.elastic.co/t/disable-indexing-for-all-fields-by-default/169342 "2019-02-22T09:47:47Z") I have a mapping for the index I want to create in ElasticSearch. I want to disable indexing for all the fields in the mapping and enable only for a few fields which I can specify. Any suggestions for which mapping param… --- ## [Using a different Index other than Heartbeat-7.0.0](https://discuss.elastic.co/t/using-a-different-index-other-than-heartbeat-7-0-0/193134)
**Author:** [@PeterPain](https://discuss.elastic.co/u/PeterPain)\ **Replies:** 4\ **Last updated:** [August 5, 2019, 10:30am UTC](https://discuss.elastic.co/t/using-a-different-index-other-than-heartbeat-7-0-0/193134 "2019-08-05T10:30:12Z")
Hey dear Elastic-Team, The documentation gives following specification about how the index should be named for uptime App. Kibana 7.0 requires an index of heartbeat-7\* (containing documents from Heartbeat 7.0). An… --- ## [Elastic search indices, what variables are available?](https://discuss.elastic.co/t/elastic-search-indices-what-variables-are-available/58412)
**Author:** [@sjlongland](https://discuss.elastic.co/u/sjlongland)\ **Replies:** 4\ **Last updated:** [August 22, 2016, 6:23am UTC](https://discuss.elastic.co/t/elastic-search-indices-what-variables-are-available/58412 "2016-08-22T06:23:06Z")
Hi all, I've hunted high and low through the documentation (written; not all of us have the luxury of watching videos) for information on this. In short, I have a prototype monitoring system using the elk-docker contai… --- ## [Uptime not loading Heartbeat logs](https://discuss.elastic.co/t/uptime-not-loading-heartbeat-logs/201992)
**Author:** [@dorg](https://discuss.elastic.co/u/dorg)\ **Replies:** 6\ **Last updated:** [October 21, 2019, 1:59pm UTC](https://discuss.elastic.co/t/uptime-not-loading-heartbeat-logs/201992 "2019-10-21T13:59:23Z")
Hello We are using Elasticsearch 7.3 with kibana 7.2 versions. I set up Heartbeat (using docker) and configured the heartbeat.yml properly. After that I saw all of our services are exists under "Uptime" tab and saw tha… --- ## [Kibana Unable to retrieve version information from Elasticsearch nodes. socket hang up](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/303528)
**Author:** [@Roshan1](https://discuss.elastic.co/u/Roshan1)\ **Replies:** 8\ **Last updated:** [May 4, 2022, 4:46am UTC](https://discuss.elastic.co/t/kibana-unable-to-retrieve-version-information-from-elasticsearch-nodes-socket-hang-up/303528 "2022-05-04T04:46:46Z")
Dear Team, kindly advise why error occurs when starting Kibana? da46c1"}} {"ecs":{"version":"8.0.0"},"@timestamp":"2022-04-28T18:37:07.516+04:00","message":"Unable to retrieve version information from Elasticsearch nod… --- ## [How to show the metrics of adding two fields through Timelion visualization](https://discuss.elastic.co/t/how-to-show-the-metrics-of-adding-two-fields-through-timelion-visualization/137985)
**Author:** [@hyzhang6639](https://discuss.elastic.co/u/hyzhang6639)\ **Replies:** 4\ **Last updated:** [July 2, 2018, 7:02am UTC](https://discuss.elastic.co/t/how-to-show-the-metrics-of-adding-two-fields-through-timelion-visualization/137985 "2018-07-02T07:02:26Z")
There are two fields such as field1, field2. I need to show the time series data of adding two fields. I tried the below scripts in Timelion visualization and it can't work. .es(index=index\_t, metric='field1+field2').la… --- ## [How to set kibana ELASTICSEARCH\_URL parameter](https://discuss.elastic.co/t/how-to-set-kibana-elasticsearch-url-parameter/185342)
**Author:** [@heyixiaoran](https://discuss.elastic.co/u/heyixiaoran)\ **Replies:** 2\ **Last updated:** [June 13, 2019, 9:22am UTC](https://discuss.elastic.co/t/how-to-set-kibana-elasticsearch-url-parameter/185342 "2019-06-13T09:22:11Z")
I run a elasticsearch and kibana in docker. elasticsearch is run .But kibana can not run . It always try to connected http://elasticsearch:9200 .I set the ELASTICSEARCH\_URL kibana command. But not work I used the comman… --- ## [Get oldest / newest document in \*beat](https://discuss.elastic.co/t/get-oldest-newest-document-in-beat/212229)
**Author:** [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Replies:** 7\ **Last updated:** [December 20, 2019, 8:57pm UTC](https://discuss.elastic.co/t/get-oldest-newest-document-in-beat/212229 "2019-12-20T20:57:00Z")
Greetings. I need to fetch the oldest or newest document saved into a beat. Someone asked this before and this was the suggested course of action: This approach will NOT work for metricbeat data because you cannot s… --- ## [Add Clock to Ops Dashboard](https://discuss.elastic.co/t/add-clock-to-ops-dashboard/254684)
**Author:** [@Brandon\_Wagoner](https://discuss.elastic.co/u/Brandon_Wagoner)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 1:52pm UTC](https://discuss.elastic.co/t/add-clock-to-ops-dashboard/254684 "2020-11-09T13:52:21Z")
Is there a way to add a clock or several clocks (multiple time zones) to a kibana dashboard for display in an operations center? --- ## [File input: sincedb general questions](https://discuss.elastic.co/t/file-input-sincedb-general-questions/28846)
**Author:** [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Replies:** 6\ **Last updated:** [February 13, 2017, 9:02pm UTC](https://discuss.elastic.co/t/file-input-sincedb-general-questions/28846 "2017-02-13T21:02:20Z")
I have some questions about how sincedb and File input works. My current understanding is that File input records where it gets up to in a particular file by writing it to the sincedb file every x seconds or on Logstash … --- ## [Relative date range skipping weekends (saturdays and sundays)](https://discuss.elastic.co/t/relative-date-range-skipping-weekends-saturdays-and-sundays/10802)
**Author:** [@SomeUser](https://discuss.elastic.co/u/SomeUser)\ **Replies:** 3\ **Last updated:** [February 20, 2013, 10:49am UTC](https://discuss.elastic.co/t/relative-date-range-skipping-weekends-saturdays-and-sundays/10802 "2013-02-20T10:49:54Z")
Hi, Is it possible to write a query such as "created:\[now-2d TO now\]" where now-2d will skip weekends. So if it is Monday then "now-2d" should also yield results for Tuesday and Friday. Is this possible in some… --- ## [Extract SNMP table from "SNMP input plugin" with key-value or Split filter](https://discuss.elastic.co/t/extract-snmp-table-from-snmp-input-plugin-with-key-value-or-split-filter/223991)
**Author:** [@piellick](https://discuss.elastic.co/u/piellick)\ **Replies:** 1\ **Last updated:** [March 19, 2020, 3:26am UTC](https://discuss.elastic.co/t/extract-snmp-table-from-snmp-input-plugin-with-key-value-or-split-filter/223991 "2020-03-19T03:26:29Z")
Hello everyone, SNMP input plugin doesn't include (for the moment) an option to split SNMP table : indexed documents looks like this : { "\_index": "XXXX-2020.03.17", "\_type": "doc", "\_id": "Puby6XABeaR9KJCdhk0… --- ## [How to store a backup (snapshot) of my indexes to local storage using python in elasticsearch and then also be able to restore them?](https://discuss.elastic.co/t/how-to-store-a-backup-snapshot-of-my-indexes-to-local-storage-using-python-in-elasticsearch-and-then-also-be-able-to-restore-them/210940)
**Author:** [@hjiop\_oop](https://discuss.elastic.co/u/hjiop_oop)\ **Replies:** 5\ **Last updated:** [December 14, 2019, 7:13am UTC](https://discuss.elastic.co/t/how-to-store-a-backup-snapshot-of-my-indexes-to-local-storage-using-python-in-elasticsearch-and-then-also-be-able-to-restore-them/210940 "2019-12-14T07:13:50Z")
Hello, I know that I need to create a snapshot (?) for doing so, but can someone please tell me how? Say I have indexes: indexA and indexB How do I go about storing a snapshot (containing these indexes) to local stora… --- ## [Env variables in not working in custom fields in filebeat](https://discuss.elastic.co/t/env-variables-in-not-working-in-custom-fields-in-filebeat/101374)
**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\ **Replies:** 4\ **Last updated:** [September 26, 2017, 9:58am UTC](https://discuss.elastic.co/t/env-variables-in-not-working-in-custom-fields-in-filebeat/101374 "2017-09-26T09:58:28Z")
Filebeat version 5.6 centos 7.0 I am using env variable like this fields\_under\_root: true fields: clustername: ${CLUSTER\_NAME} output of # env HOSTNAME=gsljumphost.cisco.com SHELL=/bin/bash TERM=xterm HISTSIZE=… --- ## [Kibana 5.0 shows field type as string, not keyword: working as designed?](https://discuss.elastic.co/t/kibana-5-0-shows-field-type-as-string-not-keyword-working-as-designed/67164)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [November 28, 2016, 3:52am UTC](https://discuss.elastic.co/t/kibana-5-0-shows-field-type-as-string-not-keyword-working-as-designed/67164 "2016-11-28T03:52:09Z")
In Elastic 5.0, I understand that the index property no longer supports the value not\_analyzed. So I'm now using the following index template to map "incoming" strings to the new-for-5.0 keyword type: { "template": "… --- ## [Http\_poller REST API authentication token](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870)
**Author:** [@joe\_good](https://discuss.elastic.co/u/joe_good)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 2:07pm UTC](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870 "2020-08-30T14:07:12Z")
Hello, I'm trying to use logstasth http\_poller plugin to get some events from a rest API method. Before calling the events API methods, I should call the login method and get a token from its response. While I use the … --- ## [Iteration and loop in logstash](https://discuss.elastic.co/t/iteration-and-loop-in-logstash/80485)
**Author:** [@Mohamed](https://discuss.elastic.co/u/Mohamed)\ **Replies:** 4\ **Last updated:** [March 30, 2017, 8:05am UTC](https://discuss.elastic.co/t/iteration-and-loop-in-logstash/80485 "2017-03-30T08:05:02Z")
Hello, I have a list data in Logstash that has been parsed as that looks like "Attribute": \[ "\\N1\\Clement\\", "\\N2\\Bundle Name\\<… --- ## [How can we download elastic search data](https://discuss.elastic.co/t/how-can-we-download-elastic-search-data/38748)
**Author:** [@vinod\_rao](https://discuss.elastic.co/u/vinod_rao)\ **Replies:** 3\ **Last updated:** [January 8, 2016, 7:20pm UTC](https://discuss.elastic.co/t/how-can-we-download-elastic-search-data/38748 "2016-01-08T19:20:13Z")
Hi Team, Is there any possibility do download the elastic search index data ? --- ## [Fleet Server v8.10.3 Security Update](https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [October 10, 2023, 12:46pm UTC](https://discuss.elastic.co/t/fleet-server-v8-10-3-security-update/344737 "2023-10-10T12:46:07Z")
Fleet Server Insertion of Sensitive Information into Log File (ESA-2023-20) An issue was discovered in Fleet Server \>= v8.10.0 and \< v8.10.3 where Agent enrollment tokens are being inserted into the Fleet Server’s log f… --- ## [Kibana Table Visualization of documents with nested array of JSON](https://discuss.elastic.co/t/kibana-table-visualization-of-documents-with-nested-array-of-json/284740)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 5\ **Last updated:** [September 24, 2021, 8:42pm UTC](https://discuss.elastic.co/t/kibana-table-visualization-of-documents-with-nested-array-of-json/284740 "2021-09-24T20:42:13Z")
Hi, I have the following json documents stored in Elasticsearch. It is a json with a nested array with json items: { "took": 40, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "faile… --- ## [ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://0.0.0.0:5044)): dial tcp 0.0.0.0:5044: connect: connection refused](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-async-tcp-0-0-0-0-5044-dial-tcp-0-0-0-0-connect-connection-refused/260121)
**Author:** [@UjjwalBera](https://discuss.elastic.co/u/UjjwalBera)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 7:30am UTC](https://discuss.elastic.co/t/error-pipeline-output-go-100-failed-to-connect-to-backoff-async-tcp-0-0-0-0-5044-dial-tcp-0-0-0-0-connect-connection-refused/260121 "2021-01-05T07:30:11Z")
Here below filebeat.yml output configuration output.logstash: enabled: true hosts: \["0.0.0.0:5044"\] timeout: 86400\`\` logstash.conf input configuration input { beats { port =\> 5044 … --- ## [Elasticsearch 7.16.2 on M1 Max under Docker (ARM) aggressive throttling while indexing](https://discuss.elastic.co/t/elasticsearch-7-16-2-on-m1-max-under-docker-arm-aggressive-throttling-while-indexing/293468)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 2\ **Last updated:** [January 5, 2022, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-7-16-2-on-m1-max-under-docker-arm-aggressive-throttling-while-indexing/293468 "2022-01-05T14:56:39Z")
Hey folks, I've been struggling a bit with Elasticsearch 7.16.2 running under Docker on my MacBook Pro M1 Max (64 GB RAM, 8 TB SSD). I have a job running under Ruby on Rails 6.1 with the most recent Elasticsearch Ruby … --- ## [High flood state disk watermark results in read only indexes](https://discuss.elastic.co/t/high-flood-state-disk-watermark-results-in-read-only-indexes/122335)
**Author:** [@ramarik](https://discuss.elastic.co/u/ramarik)\ **Replies:** 2\ **Last updated:** [March 3, 2018, 12:05am UTC](https://discuss.elastic.co/t/high-flood-state-disk-watermark-results-in-read-only-indexes/122335 "2018-03-03T00:05:33Z")
I have 1TB SSD on my notebook with 15GB free space at the moment. Although ES node data take only 130MB, all indexes inluding the .kibana are marked as read-only and any further work is blocked. I would consider that as… --- ## [Elasticsearch-spark not compatible with Spark 2.0.0](https://discuss.elastic.co/t/elasticsearch-spark-not-compatible-with-spark-2-0-0/57959)
**Author:** [@Bryce](https://discuss.elastic.co/u/Bryce)\ **Replies:** 7\ **Last updated:** [December 19, 2016, 1:03pm UTC](https://discuss.elastic.co/t/elasticsearch-spark-not-compatible-with-spark-2-0-0/57959 "2016-12-19T13:03:47Z")
I our team uses elasticsearch-spark and are currently in the process of upgrading our spark to version 2.0.0. We get the following errors: \[error\] bad symbolic reference. A signature in Column.class refers to type Log… [Previous page](https://discuss.elastic.co/top.md?page=462&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=464&per_page=50&period=all)