**Author:** [@Harper\_S1](https://discuss.elastic.co/u/Harper_S1)\
**Replies:** 5\
**Last updated:** [August 16, 2022, 1:42am UTC](https://discuss.elastic.co/t/index-is-not-getting-rolled-over/312124 "2022-08-16T01:42:51Z")
Hi, I have installed the ELK 8.2 but seems rollover is not working well. index size reached to 2+ Tb. when I tried to rollover using command line POST some-index-name/\_rollover { "conditions": { "max\_age": "30…
---
## [Data too large, data for \[\\] would be larger than limit of \[311387750/296.9mb\]](https://discuss.elastic.co/t/data-too-large-data-for-agg-1-would-be-larger-than-limit-of-311387750-296-9mb/90510)
**Author:** [@xwang1](https://discuss.elastic.co/u/xwang1)\
**Replies:** 2\
**Last updated:** [June 27, 2017, 3:23am UTC](https://discuss.elastic.co/t/data-too-large-data-for-agg-1-would-be-larger-than-limit-of-311387750-296-9mb/90510 "2017-06-27T03:23:04Z")
I am using a data engine to send data about web traffic to my ELK stack (version 5.2). When I try to visualize the data in my dashboard I sometimes get the following error: Error Visualize: \[request\] Data too large, d…
---
## [We are losing data in elastic search cluster. v2.4.0](https://discuss.elastic.co/t/we-are-losing-data-in-elastic-search-cluster-v2-4-0/62011)
**Author:** [@Mustafa\_Halil\_YILDIZ](https://discuss.elastic.co/u/Mustafa_Halil_YILDIZ)\
**Replies:** 4\
**Last updated:** [October 3, 2016, 11:47am UTC](https://discuss.elastic.co/t/we-are-losing-data-in-elastic-search-cluster-v2-4-0/62011 "2016-10-03T11:47:21Z")
We made a poc with ElasticSearch but while doing it, we lost data in clustered enviroment. We used ES 2.4.0. Can anyone say what we are missing? Our scenario is: 1- Open Elastic Server-1 and Server-2 with the confi…
---
## [Why I am getting "No results displayed because all values equal 0" for Pie chart?](https://discuss.elastic.co/t/why-i-am-getting-no-results-displayed-because-all-values-equal-0-for-pie-chart/49641)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 4\
**Last updated:** [May 11, 2016, 12:59pm UTC](https://discuss.elastic.co/t/why-i-am-getting-no-results-displayed-because-all-values-equal-0-for-pie-chart/49641 "2016-05-11T12:59:29Z")
Hi Experts, I am on kibana 4.1.1 and I have one pie chart visualization, it says "No results displayed because all values equal 0". Not sure if "No results found" and "No results displayed because all values equal 0" …
---
## [Creating a dashboard with different time ranges](https://discuss.elastic.co/t/creating-a-dashboard-with-different-time-ranges/97015)
**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\
**Replies:** 3\
**Last updated:** [August 15, 2017, 2:17pm UTC](https://discuss.elastic.co/t/creating-a-dashboard-with-different-time-ranges/97015 "2017-08-15T14:17:13Z")
Hi, i am creating a dashboard with kibana with visualizations with different time range(last month, last year …) but i discover when adding those visualizations to the same dashboard that all of them become filtered by …
---
## [PHP example not working](https://discuss.elastic.co/t/php-example-not-working/34942)
**Author:** [@tybreizh29190](https://discuss.elastic.co/u/tybreizh29190)\
**Replies:** 2\
**Last updated:** [November 18, 2015, 2:37pm UTC](https://discuss.elastic.co/t/php-example-not-working/34942 "2015-11-18T14:37:00Z")
Hello in this page : https://www.elastic.co/guide/en/elasticsearch/client/php-api/2.0/\_index\_management\_operations.html#\_put\_settings\_api I try this example : $client = ClientBuilder::create()-\>build(); $params = \[ …
---
## [Backup in one server And restore it in another](https://discuss.elastic.co/t/backup-in-one-server-and-restore-it-in-another/78968)
**Author:** [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\
**Replies:** 3\
**Last updated:** [March 20, 2017, 5:21am UTC](https://discuss.elastic.co/t/backup-in-one-server-and-restore-it-in-another/78968 "2017-03-20T05:21:24Z")
I took backup in my ES 5.1.1 PUT /\_snapshot/my\_backup/snapshot\_1 { "indices": "smsc", "ignore\_unavailable": true } My snapshot look like PUT /\_snapshot/my\_backup { "type": "fs", "settings": { "location"…
---
## [Logstash JDBC string column value to array data type](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436)
**Author:** [@simon80](https://discuss.elastic.co/u/simon80)\
**Replies:** 4\
**Last updated:** [October 7, 2016, 1:58pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436 "2016-10-07T13:58:22Z")
I would like to provide a SQL column value that contains concatenated strings (i.e. "value1,value2,value3") and have this value 'split' into an array data type within ElasticSearch. I've looked at the 'join' mutator an…
---
## [Create a calculated field or empty if value missing](https://discuss.elastic.co/t/create-a-calculated-field-or-empty-if-value-missing/181908)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\
**Replies:** 7\
**Last updated:** [June 6, 2019, 8:38am UTC](https://discuss.elastic.co/t/create-a-calculated-field-or-empty-if-value-missing/181908 "2019-06-06T08:38:26Z")
Hi here, I'm struggling trying to find the best way to create a field been calculated by doing the multiplication of two others. So first, I need to test that both fields are not null and then I can do my multiplication…
---
## [How to retrieving all fields with Java client?](https://discuss.elastic.co/t/how-to-retrieving-all-fields-with-java-client/8572)
**Author:** [@Yuhan](https://discuss.elastic.co/u/Yuhan)\
**Replies:** 6\
**Last updated:** [October 16, 2012, 9:50pm UTC](https://discuss.elastic.co/t/how-to-retrieving-all-fields-with-java-client/8572 "2012-10-16T21:50:31Z")
Hi all, In case receiving a certain fields from a doc, I could construct query in this way: SearchRequestBuilder searchBuilder = client.prepareSearch( indexName, indexType ) .setSearc…
---
## [504 timeout email watcher](https://discuss.elastic.co/t/504-timeout-email-watcher/117832)
**Author:** [@AbdulH](https://discuss.elastic.co/u/AbdulH)\
**Replies:** 8\
**Last updated:** [February 7, 2018, 4:27pm UTC](https://discuss.elastic.co/t/504-timeout-email-watcher/117832 "2018-02-07T16:27:26Z")
I managed to set up an email watcher on a server, with the same config on another server I getting no errors or any output in logs though the action fails. Using the following command to simulate the watcher: POST \_xpac…
---
## [How can I turn off the security warning popup in kibana Discover UI](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560)
**Author:** [@wabrit](https://discuss.elastic.co/u/wabrit)\
**Replies:** 2\
**Last updated:** [November 22, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560 "2021-11-22T11:44:14Z")
I'm running es/kibana 7.15.1 with security disabled in es, but the kibana discovery screen is unusable because of the constant appearance of these popups: Is there any way to turn them off?
---
## [Network Interface Utilization Visualization](https://discuss.elastic.co/t/network-interface-utilization-visualization/53499)
**Author:** [@jdmac](https://discuss.elastic.co/u/jdmac)\
**Replies:** 5\
**Last updated:** [October 17, 2016, 5:50pm UTC](https://discuss.elastic.co/t/network-interface-utilization-visualization/53499 "2016-10-17T17:50:03Z")
Hi Everyone, I'm new to the ELK stack and have formerly used commercial monitoring products to achieve the task I'm now placed with but I'm looking towards monitoring network appliances for their network utilization us…
---
## [Upgrade storage space for elasticsearch](https://discuss.elastic.co/t/upgrade-storage-space-for-elasticsearch/218630)
**Author:** [@atotheb](https://discuss.elastic.co/u/atotheb)\
**Replies:** 5\
**Last updated:** [July 4, 2022, 12:59pm UTC](https://discuss.elastic.co/t/upgrade-storage-space-for-elasticsearch/218630 "2022-07-04T12:59:49Z")
I try to increase the capacity of my persistant volume for elasticsearch. However this seems to be not so straightforward, as explained in this article: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-orchestr…
---
## [LogStash::ConfigurationError](https://discuss.elastic.co/t/logstash-configurationerror/132521)
**Author:** [@format.guardian](https://discuss.elastic.co/u/format.guardian)\
**Replies:** 1\
**Last updated:** [May 18, 2018, 5:45pm UTC](https://discuss.elastic.co/t/logstash-configurationerror/132521 "2018-05-18T17:45:40Z")
Hello, I'm new to ELK and I'm attempting to start logstash with a custom logstash.conf file, when I run the command jadmin@elastic-server:/usr/share/logstash$ sudo bin/logstash -f /etc/logstash/conf.d/logstash.conf I…
---
## [Extract specific fields from Json using Logstash](https://discuss.elastic.co/t/extract-specific-fields-from-json-using-logstash/198750)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\
**Replies:** 3\
**Last updated:** [September 9, 2019, 5:50pm UTC](https://discuss.elastic.co/t/extract-specific-fields-from-json-using-logstash/198750 "2019-09-09T17:50:20Z")
I have this json file { "type": "resource", "headers": { "destination\_channel": "data" }, "body": { "type":"resource", "resourceId":"estimatorB", "resourceType":null, "resourceValue":"data.c…
---
## [Running queries created by Kibana using Java API?](https://discuss.elastic.co/t/running-queries-created-by-kibana-using-java-api/1313)
**Author:** [@Aymen\_Zaghouani](https://discuss.elastic.co/u/Aymen_Zaghouani)\
**Replies:** 3\
**Last updated:** [May 27, 2015, 5:15pm UTC](https://discuss.elastic.co/t/running-queries-created-by-kibana-using-java-api/1313 "2015-05-27T17:15:50Z")
Is it feasible to run queries created by Kibana using Java API? I mean get a ready queries from Kibana dashboards that are created by users dynamically, and pass like a parameter in Java ? this is an example of a query…
---
## [Filebeat - how limit events per second?](https://discuss.elastic.co/t/filebeat-how-limit-events-per-second/159099)
**Author:** [@unix196](https://discuss.elastic.co/u/unix196)\
**Replies:** 3\
**Last updated:** [December 4, 2018, 11:40am UTC](https://discuss.elastic.co/t/filebeat-how-limit-events-per-second/159099 "2018-12-04T11:40:44Z")
Good day everyone. One server have 2 containers with filebeat 6.4. This two containers read logs and generate over 10.000 events per second =\> leads some troubles: server contain other containers which generate some …
---
## [Filebeat 6.5 uninstall windows](https://discuss.elastic.co/t/filebeat-6-5-uninstall-windows/198322)
**Author:** [@sunny1](https://discuss.elastic.co/u/sunny1)\
**Replies:** 2\
**Last updated:** [September 5, 2019, 10:54pm UTC](https://discuss.elastic.co/t/filebeat-6-5-uninstall-windows/198322 "2019-09-05T22:54:17Z")
Hello Team, I tried to uninstall filebeat 6.5 service using the powershell script uninstall-service-filebeat.ps1 but after it ran successfully i can still see the filebeat service and able to start stop. How do i remove…
---
## [Monitor multiple URLs yml configiration](https://discuss.elastic.co/t/monitor-multiple-urls-yml-configiration/78478)
**Author:** [@dmihic](https://discuss.elastic.co/u/dmihic)\
**Replies:** 2\
**Last updated:** [March 15, 2017, 8:24am UTC](https://discuss.elastic.co/t/monitor-multiple-urls-yml-configiration/78478 "2017-03-15T08:24:08Z")
Hi! I have a question regarding heartbeat configuration inside heartbeat.yml file. I want to monitor multiple urls using http. I have added needed urls into heartbeat.yml and it is working. I am getting data in Elast…
---
## [How to deal with date type properties in elasticsearch](https://discuss.elastic.co/t/how-to-deal-with-date-type-properties-in-elasticsearch/135327)
**Author:** [@SharmaPrakhar25](https://discuss.elastic.co/u/SharmaPrakhar25)\
**Replies:** 6\
**Last updated:** [June 13, 2018, 8:14am UTC](https://discuss.elastic.co/t/how-to-deal-with-date-type-properties-in-elasticsearch/135327 "2018-06-13T08:14:09Z")
I am very new to elasticsearch and implementing elasticsearch in php-laravel based API using elasticsearch-php client. I am saving 2 datetime fields (created\_on, modified\_on) from the sql db which I want to index in prob…
---
## [502 Error with add data](https://discuss.elastic.co/t/502-error-with-add-data/110672)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\
**Replies:** 6\
**Last updated:** [December 19, 2017, 5:59am UTC](https://discuss.elastic.co/t/502-error-with-add-data/110672 "2017-12-19T05:59:16Z")
Hi While adding some huge data to elastic search is giving 502 error I am trying batch insert of 1000 at a time with Bulk insert. Thanks Aneesh L
---
## [Incremental snapshots - how do they they work](https://discuss.elastic.co/t/incremental-snapshots-how-do-they-they-work/79899)
**Author:** [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Replies:** 1\
**Last updated:** [March 24, 2017, 2:50pm UTC](https://discuss.elastic.co/t/incremental-snapshots-how-do-they-they-work/79899 "2017-03-24T14:50:26Z")
Ive googled around and see this is a common question but without a very clear answer. My situation - I need backups to run automatically I need to purge those output files on a rolling basis say by # of days or # of …
---
## [Never ending story: how to check and remove empty fields, arrays etc](https://discuss.elastic.co/t/never-ending-story-how-to-check-and-remove-empty-fields-arrays-etc/154243)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Replies:** 0\
**Last updated:** [October 26, 2018, 5:38pm UTC](https://discuss.elastic.co/t/never-ending-story-how-to-check-and-remove-empty-fields-arrays-etc/154243 "2018-10-26T17:38:35Z")
season I season II season III season IV (thanks to season III): ruby { # Initialize the suspects once: init =\> "SuspectFields = \['tags'\]" code =\> " SuspectFields.each do |fie…
---
## [Bluecoat Grok filter](https://discuss.elastic.co/t/bluecoat-grok-filter/98997)
**Author:** [@Maekee](https://discuss.elastic.co/u/Maekee)\
**Replies:** 8\
**Last updated:** [September 1, 2017, 5:56am UTC](https://discuss.elastic.co/t/bluecoat-grok-filter/98997 "2017-09-01T05:56:42Z")
Hello, I am running the ELK-stack on a server and want to parse the Bluecoat Proxy logs. I have created a grok filter and it works when i test it in the Grok Debugger (http://grokdebug.herokuapp.com/) but when i add th…
---
## [Elasticsearch 2.0 and Vagrant port forwarding](https://discuss.elastic.co/t/elasticsearch-2-0-and-vagrant-port-forwarding/31851)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\
**Replies:** 3\
**Last updated:** [October 8, 2015, 3:00pm UTC](https://discuss.elastic.co/t/elasticsearch-2-0-and-vagrant-port-forwarding/31851 "2015-10-08T15:00:51Z")
Hi all, I'm having a heck of a time updating a vagrant box we use for local Elasticsearch experimentation. The vagrant box is rather simple, its Ubuntu 14.04 based and it Installs OpenJDK Downloads and installs t…
---
## [Spark job is failing with authenticating with BASIC error](https://discuss.elastic.co/t/spark-job-is-failing-with-authenticating-with-basic-error/25732)
**Author:** [@diplomaticguru](https://discuss.elastic.co/u/diplomaticguru)\
**Replies:** 5\
**Last updated:** [July 17, 2015, 7:59pm UTC](https://discuss.elastic.co/t/spark-job-is-failing-with-authenticating-with-basic-error/25732 "2015-07-17T19:59:45Z")
I have Elasticsearch cluster that has Basic HTTP authentication enabled. So, in my spark configuration I set the following parameters as described in the documentation: "es.net.http.auth.user" "es.net.http.auth.pass" …
---
## [Curl no URL specified](https://discuss.elastic.co/t/curl-no-url-specified/177739)
**Author:** [@AndyB](https://discuss.elastic.co/u/AndyB)\
**Replies:** 1\
**Last updated:** [April 21, 2019, 4:57am UTC](https://discuss.elastic.co/t/curl-no-url-specified/177739 "2019-04-21T04:57:49Z")
How come the following terminal command: curl -H "Content-Type: application/json" -XGET 'http://localhost:9200/southbay\_xenforo211/\_search' -d '{ "query": { "match": { "message": "test1234" } } }' comes back w…
---
## [Getting "You do not have permission to access the requested page" after configuring SSO](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301)
**Author:** [@challa](https://discuss.elastic.co/u/challa)\
**Replies:** 2\
**Last updated:** [April 16, 2021, 6:18am UTC](https://discuss.elastic.co/t/getting-you-do-not-have-permission-to-access-the-requested-page-after-configuring-sso/270301 "2021-04-16T06:18:38Z")
Hi, I have configured SSO using the guide here: Configuring SAML single-sign-on on the Elastic Stack | Elasticsearch Guide \[7.12\] | Elastic I also did role mapped my AD group to the role "superuser", when I try to login…
---
## [Create vs Update](https://discuss.elastic.co/t/create-vs-update/83673)
**Author:** [@Alex\_Davidovich](https://discuss.elastic.co/u/Alex_Davidovich)\
**Replies:** 3\
**Last updated:** [April 26, 2017, 2:58pm UTC](https://discuss.elastic.co/t/create-vs-update/83673 "2017-04-26T14:58:57Z")
Hello, I want to understand the differences in performance between update and create. I have a document that could be updated up to 4 times in my system. Is it making more sense to only create new documents with a prop…
---
## [Logstash not stopping/restarting](https://discuss.elastic.co/t/logstash-not-stopping-restarting/45249)
**Author:** [@mikeface](https://discuss.elastic.co/u/mikeface)\
**Replies:** 3\
**Last updated:** [February 20, 2017, 6:10am UTC](https://discuss.elastic.co/t/logstash-not-stopping-restarting/45249 "2017-02-20T06:10:36Z")
I did some searching first, apologies if this has been already covered but I couldn't find it. Running Logstash v2.2.2, on Ubuntu 14.04.3 LT, m3.medium in EC2. When I try to stop or restart, I get: Killing logstash (pi…
---
## [Is it possible to have a hidden plugin with UI?](https://discuss.elastic.co/t/is-it-possible-to-have-a-hidden-plugin-with-ui/154835)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\
**Replies:** 2\
**Last updated:** [November 16, 2018, 4:46pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-a-hidden-plugin-with-ui/154835 "2018-11-16T16:46:41Z")
Kibana 6.2.4 I created a hidden plugin (there is no icon in the left navbar). But I can't access a UI route. When I put this URL in browser http://localhost:5601/ncz/app/alert, I get {"statusCode":404,"error":"Not Fou…
---
## [Return only high quality results in ElasticSearch query](https://discuss.elastic.co/t/return-only-high-quality-results-in-elasticsearch-query/180033)
**Author:** [@Shreya\_Jain](https://discuss.elastic.co/u/Shreya_Jain)\
**Replies:** 1\
**Last updated:** [May 10, 2019, 4:01pm UTC](https://discuss.elastic.co/t/return-only-high-quality-results-in-elasticsearch-query/180033 "2019-05-10T16:01:01Z")
I'm sending search queries to my ES index and get multiple results back. A lot of times the results with lower scores are irrelevant and I want to remove these results and return only high-quality results (which mostly h…
---
## [He given configuration is invalid. Reason: Expected one of #, input, filter, output](https://discuss.elastic.co/t/he-given-configuration-is-invalid-reason-expected-one-of-input-filter-output/202355)
**Author:** [@kenorb](https://discuss.elastic.co/u/kenorb)\
**Replies:** 2\
**Last updated:** [October 4, 2019, 2:24pm UTC](https://discuss.elastic.co/t/he-given-configuration-is-invalid-reason-expected-one-of-input-filter-output/202355 "2019-10-04T14:24:35Z")
I've got the following syntax error when running Logstash: $ sudo -u logstash /usr/share/logstash/bin/logstash -V logstash 7.1.0 $ sudo -u logstash /usr/share/logstash/bin/logstash -t -f /etc/logstash/logstash.yml WARN…
---
## [Nice interview with Elastic Developer Advocate for german speaking folks](https://discuss.elastic.co/t/nice-interview-with-elastic-developer-advocate-for-german-speaking-folks/112688)
**Author:** [@mos](https://discuss.elastic.co/u/mos)\
**Replies:** 2\
**Last updated:** [December 20, 2017, 7:34pm UTC](https://discuss.elastic.co/t/nice-interview-with-elastic-developer-advocate-for-german-speaking-folks/112688 "2017-12-20T19:34:05Z")
We interviewed Mr. Philipp Krenn about his job at Elastic. Fun! (The interview and his job ;)):
---
## [Set replica shard to default 0](https://discuss.elastic.co/t/set-replica-shard-to-default-0/55170)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\
**Replies:** 3\
**Last updated:** [July 11, 2016, 3:05pm UTC](https://discuss.elastic.co/t/set-replica-shard-to-default-0/55170 "2016-07-11T15:05:22Z")
Is there any way to set the replica shard such that it will always be 0 when a new index is created? The default that I am getting now is that logstash output will result the 5 primary and 5 replica shards in my 2 node…
---
## [Loading own json data using Bulk\_API gives error](https://discuss.elastic.co/t/loading-own-json-data-using-bulk-api-gives-error/51106)
**Author:** [@kausik93](https://discuss.elastic.co/u/kausik93)\
**Replies:** 3\
**Last updated:** [May 27, 2016, 8:46am UTC](https://discuss.elastic.co/t/loading-own-json-data-using-bulk-api-gives-error/51106 "2016-05-27T08:46:00Z")
Hi, I've generated my JSON data from a csv (excel) file and I'm trying to upload it. The code I'm using to update the data is curl -XPOST 'http://localhost:9200/jobs/2014\_jobs/\_update?pretty' --data-binary '@data.json' b…
---
## [CEPH Storage For Elasticsearch](https://discuss.elastic.co/t/ceph-storage-for-elasticsearch/280775)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\
**Replies:** 4\
**Last updated:** [August 11, 2021, 11:59am UTC](https://discuss.elastic.co/t/ceph-storage-for-elasticsearch/280775 "2021-08-11T11:59:09Z")
We are planning to create an Elasticsearch cluster over Kubernetes, and for this CEPH distributed file system would be used as Storage, I understand that elastic recommends using local storage, however are there any know…
---
## [Could not create SSL/TLS secure channel](https://discuss.elastic.co/t/could-not-create-ssl-tls-secure-channel/218668)
**Author:** [@steevegldev](https://discuss.elastic.co/u/steevegldev)\
**Replies:** 4\
**Last updated:** [February 12, 2020, 12:33am UTC](https://discuss.elastic.co/t/could-not-create-ssl-tls-secure-channel/218668 "2020-02-12T00:33:07Z")
I'm trying to post index by using ApiKey and .NET library, but I got an error. Dim auth = New ApiKeyAuthenticationCredentials("ApiKeyID", "ApiKey" ) Dim settings = New ConnectionConfiguration("CloudID", auth) Dim client…
---
## [Remove header information added by logstash](https://discuss.elastic.co/t/remove-header-information-added-by-logstash/108892)
**Author:** [@vishal0708gautam](https://discuss.elastic.co/u/vishal0708gautam)\
**Replies:** 4\
**Last updated:** [November 24, 2017, 12:08pm UTC](https://discuss.elastic.co/t/remove-header-information-added-by-logstash/108892 "2017-11-24T12:08:26Z")
Hello experts, We are using logstash as syslog event receiver and forwarder using UDP & TCP and it is doing as expected but on forwarding syslog events to output, logstash is adding its own header, we want to remove thi…
---
## [Problem in parsing XML files using logstash?](https://discuss.elastic.co/t/problem-in-parsing-xml-files-using-logstash/90096)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Replies:** 5\
**Last updated:** [June 20, 2017, 2:58pm UTC](https://discuss.elastic.co/t/problem-in-parsing-xml-files-using-logstash/90096 "2017-06-20T14:58:14Z")
Hi, My xml file is like this: \ \Tove\ \Jani\ \Reminder\ \Don't forget me this weekend!\ \ \ \Tove\ \Jani\ \Reminder\ \<…
---
## [Applying docker input to Nginx module with autodiscover](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032)
**Author:** [@Claude\_Juif](https://discuss.elastic.co/u/Claude_Juif)\
**Replies:** 1\
**Last updated:** [October 12, 2018, 10:01am UTC](https://discuss.elastic.co/t/applying-docker-input-to-nginx-module-with-autodiscover/152032 "2018-10-12T10:01:46Z")
Hi people, I'm currently struggling to apply docker input to the Nginx module with filebeat 6.4.1. Here is my filebeat configuration file : filebeat.autodiscover: providers: - type: docker templates: …
---
## [TCP data sending from pyton to logstash fails](https://discuss.elastic.co/t/tcp-data-sending-from-pyton-to-logstash-fails/130358)
**Author:** [@RRSR](https://discuss.elastic.co/u/RRSR)\
**Replies:** 4\
**Last updated:** [May 3, 2018, 5:44am UTC](https://discuss.elastic.co/t/tcp-data-sending-from-pyton-to-logstash-fails/130358 "2018-05-03T05:44:04Z")
Hi, I am trying to send data from python script over TCP and receive the same in the logstash. But there is no exchange of data happening. logstash.conf input { tcp { port =\> 5959 codec =\> json } } …
---
## [o.e.c.c.ClusterFormationFailureHelper\] \[Master-node\] master not discovered or elected yet, an election requires a node with id \[Y11KbKB-SX2HIYM77Z1Zqg\], have discovered](https://discuss.elastic.co/t/o-e-c-c-clusterformationfailurehelper-master-node-master-not-discovered-or-elected-yet-an-election-requires-a-node-with-id-y11kbkb-sx2hiym77z1zqg-have-discovered/213829)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Replies:** 6\
**Last updated:** [January 7, 2020, 3:47am UTC](https://discuss.elastic.co/t/o-e-c-c-clusterformationfailurehelper-master-node-master-not-discovered-or-elected-yet-an-election-requires-a-node-with-id-y11kbkb-sx2hiym77z1zqg-have-discovered/213829 "2020-01-07T03:47:43Z")
Hello, I am trying to form a 3 node ES cluster but i am getting a above mentioned error. I have one master node and 2 data nodes. My ES configurations are as follows: \*\*For master node:\*\* cluster.name: InTouc…
---
## [Postgresql to Elastic - River Plugin replacement](https://discuss.elastic.co/t/postgresql-to-elastic-river-plugin-replacement/29283)
**Author:** [@Kiranpatil](https://discuss.elastic.co/u/Kiranpatil)\
**Replies:** 3\
**Last updated:** [September 15, 2015, 9:01pm UTC](https://discuss.elastic.co/t/postgresql-to-elastic-river-plugin-replacement/29283 "2015-09-15T21:01:52Z")
Hi, I want to push Postgresql data to ElasticSearch on every change. This needs to be done in (near) realtime as my app search is relying on ES. As River plugin is deprecated, what are the other options/best practic…
---
## [Drop some line when match in logstash](https://discuss.elastic.co/t/drop-some-line-when-match-in-logstash/80270)
**Author:** [@DannyM](https://discuss.elastic.co/u/DannyM)\
**Replies:** 1\
**Last updated:** [March 28, 2017, 9:55am UTC](https://discuss.elastic.co/t/drop-some-line-when-match-in-logstash/80270 "2017-03-28T09:55:38Z")
At the moment i have this filter working to drop some lines ## var\_log\_messages filter filter { if \[type\] == "var\_log\_messages" { grok { patterns\_dir =\> \[…
---
## [Pipeline number of arguments error](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367)
**Author:** [@Michael\_Bailey](https://discuss.elastic.co/u/Michael_Bailey)\
**Replies:** 4\
**Last updated:** [February 24, 2022, 10:13am UTC](https://discuss.elastic.co/t/pipeline-number-of-arguments-error/297367 "2022-02-24T10:13:14Z")
Hi, For some reason I have started to get the following fatal error with logstash 8.0.0. \[LogStash::Runner\] runner - An unexpected error occurred! {:error=\>#\
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\
**Replies:** 6\
**Last updated:** [October 22, 2020, 9:46am UTC](https://discuss.elastic.co/t/elasticsearch-exception-type-json-parse-exception-reason-current-token-value-number-int-not-of-boolean-type/252728 "2020-10-22T09:46:36Z")
Hi all and sorry for my poor english. I'm using docker docker.elastic.co/elasticsearch/elasticsearch:6.2.1 paired with spring data elasticsearch. The issue does not involve spring for sure. When I try any kind of opera…
---
## [Remove double quotes from grok output](https://discuss.elastic.co/t/remove-double-quotes-from-grok-output/211822)
**Author:** [@Intissar\_Ayadi](https://discuss.elastic.co/u/Intissar_Ayadi)\
**Replies:** 8\
**Last updated:** [December 23, 2019, 1:47pm UTC](https://discuss.elastic.co/t/remove-double-quotes-from-grok-output/211822 "2019-12-23T13:47:46Z")
Hello, Anyone know how to remove the double quotes out of the grok output ? After grok filter, the ouput is "ip": "7.7.7.7", i would like to remove quotes and have an output like "ip": 7.7.7.7 I'm trying with gsub mut…
---
## [Splitting an event into multiple documents](https://discuss.elastic.co/t/splitting-an-event-into-multiple-documents/113851)
**Author:** [@MattHarvey](https://discuss.elastic.co/u/MattHarvey)\
**Replies:** 4\
**Last updated:** [January 3, 2018, 7:29pm UTC](https://discuss.elastic.co/t/splitting-an-event-into-multiple-documents/113851 "2018-01-03T19:29:17Z")
I am having some trouble splitting fields and cloning events in logstash--this is the first time I am doing so. Here's my logstash config (I've removed the filter split plugin configuration as it is incorrect): input {…
[Previous page](https://discuss.elastic.co/top.md?page=463&per_page=50&period=all)
[Next page](https://discuss.elastic.co/top.md?page=465&per_page=50&period=all)