# Top **URL:** https://discuss.elastic.co/top.md?page=478&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 479 --- ## [How to use json input](https://discuss.elastic.co/t/how-to-use-json-input/159848)
**Author:** [@somsin4u](https://discuss.elastic.co/u/somsin4u)\ **Replies:** 1\ **Last updated:** [December 7, 2018, 10:22pm UTC](https://discuss.elastic.co/t/how-to-use-json-input/159848 "2018-12-07T22:22:17Z")
How to use json input in visualization of kibana --- ## [\[Google Oauth2 Sign-In\] User impersonation alternative using OAuth2 Proxy](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946)
**Author:** [@MihaiS](https://discuss.elastic.co/u/MihaiS)\ **Replies:** 2\ **Last updated:** [May 25, 2017, 9:53am UTC](https://discuss.elastic.co/t/google-oauth2-sign-in-user-impersonation-alternative-using-oauth2-proxy/86946 "2017-05-25T09:53:00Z")
Hello, I wanted to share to the community a different approach to this great guide https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana. After playing a little bit with … --- ## [How to download log file from Kibana](https://discuss.elastic.co/t/how-to-download-log-file-from-kibana/95290)
**Author:** [@vivekpandey564](https://discuss.elastic.co/u/vivekpandey564)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 11:38am UTC](https://discuss.elastic.co/t/how-to-download-log-file-from-kibana/95290 "2017-08-03T11:38:39Z")
Hi i am able to see log file message in kibana 5. Using below filter date { match =\> \[ “timestamp” , “YYYY/MM/DD:HH:mm:ss Z” \] } below is the message format that i can see. "path" =\> "D:\\\\JHipster\_Demo\\\\logFil… --- ## [HELP! Unable to fetch mapping. Do you have indices matching the pattern?](https://discuss.elastic.co/t/help-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/100432)
**Author:** [@BE\_Rhodes](https://discuss.elastic.co/u/BE_Rhodes)\ **Replies:** 6\ **Last updated:** [September 15, 2017, 11:56pm UTC](https://discuss.elastic.co/t/help-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/100432 "2017-09-15T23:56:58Z")
Hey everyone! I'm working on a complete Beats build. Unfortunately, I can't get past the following error in Kibana: "Unable to fetch mapping. Do you have indices matching the pattern?" I'm driving everything through … --- ## [Setting the number of shards and replicas in /etc/filebeat/filebeat.yml](https://discuss.elastic.co/t/setting-the-number-of-shards-and-replicas-in-etc-filebeat-filebeat-yml/302029)
**Author:** [@ristov1](https://discuss.elastic.co/u/ristov1)\ **Replies:** 7\ **Last updated:** [April 10, 2022, 9:53am UTC](https://discuss.elastic.co/t/setting-the-number-of-shards-and-replicas-in-etc-filebeat-filebeat-yml/302029 "2022-04-10T09:53:20Z")
According to filebeat documentation (Configure Elasticsearch index template loading | Filebeat Reference \[8.1\] | Elastic), it should be possible to set the number of shards and replicas for Filebeat indexes with the foll… --- ## [Elasticsearch cannot find a non-existing file](https://discuss.elastic.co/t/elasticsearch-cannot-find-a-non-existing-file/255636)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 5\ **Last updated:** [November 17, 2020, 9:54am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-find-a-non-existing-file/255636 "2020-11-17T09:54:43Z")
Hello, after enabling and configuring ES to use s3 repository plugin when we restart each node we got a following error right after restarting nodes and only. When I enter the directory the file is missing. Els process … --- ## [Equivalent of a maximum\_should\_match?](https://discuss.elastic.co/t/equivalent-of-a-maximum-should-match/42791)
**Author:** [@feicipet](https://discuss.elastic.co/u/feicipet)\ **Replies:** 3\ **Last updated:** [February 27, 2016, 4:03pm UTC](https://discuss.elastic.co/t/equivalent-of-a-maximum-should-match/42791 "2016-02-27T16:03:29Z")
I have a "should" block in my bool query that contains 3 conditions. It would match anything that matches any 1 or more of the 3 conditions. But I would like to exclude anything that matches all 3 conditions, i.e. only m… --- ## [Can we give more than 32GB Memory to dedicated Machine learning Node?](https://discuss.elastic.co/t/can-we-give-more-than-32gb-memory-to-dedicated-machine-learning-node/325159)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 6\ **Last updated:** [February 23, 2023, 12:05pm UTC](https://discuss.elastic.co/t/can-we-give-more-than-32gb-memory-to-dedicated-machine-learning-node/325159 "2023-02-23T12:05:39Z")
As per the documentation it is recommended by Elasticsearch Team that every Elasticsearch node should have the memory slightly less than 32GB. Now My question is that does this apply to a dedicated Machine learning Node … --- ## [Cannot create pipeline {:reason=\>"Illegal character in scheme name at index 0: 10.62.179.32: 9200"}](https://discuss.elastic.co/t/cannot-create-pipeline-reason-illegal-character-in-scheme-name-at-index-0-10-62-179-32-9200/99507)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 4\ **Last updated:** [September 6, 2017, 3:53am UTC](https://discuss.elastic.co/t/cannot-create-pipeline-reason-illegal-character-in-scheme-name-at-index-0-10-62-179-32-9200/99507 "2017-09-06T03:53:32Z")
Elasticsearch version: 5.5.2 Logstash version: 5.5.2 OS: Linux When I run the command “bin/logstash -f hello.conf”, I got a problem like this: ERROR StatusLogger No log4j2 configuration file found. Using default conf… --- ## [Special characters in field names](https://discuss.elastic.co/t/special-characters-in-field-names/10658)
**Author:** [@ghoumard](https://discuss.elastic.co/u/ghoumard)\ **Replies:** 3\ **Last updated:** [February 8, 2013, 6:28pm UTC](https://discuss.elastic.co/t/special-characters-in-field-names/10658 "2013-02-08T18:28:30Z")
Is there any restriction in using some characters in field names ? Are these names valid ? - "field.name" -"#fieldname" - "@field.name" - "-field.name" Thanks ! -- You received this message because yo… --- ## [Error : \[1\] bootstrap checks failed \[1\]: max file descriptors \[4096\] for elasticsearch process is too low, increase to at least \[65535\]](https://discuss.elastic.co/t/error-1-bootstrap-checks-failed-1-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65535/213530)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 2\ **Last updated:** [January 2, 2020, 12:42pm UTC](https://discuss.elastic.co/t/error-1-bootstrap-checks-failed-1-max-file-descriptors-4096-for-elasticsearch-process-is-too-low-increase-to-at-least-65535/213530 "2020-01-02T12:42:04Z")
HI, im using elastic stack of version 7.5.1 with x-pack installed and im unable to start elastic as single node and i getting the following errors. Please help me solve it. \[2020-01-02T13:34:03,835\]\[DEBUG\]\[o.e.a.Actio… --- ## [Logstash add field metadata not working](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 4\ **Last updated:** [August 14, 2020, 12:40pm UTC](https://discuss.elastic.co/t/logstash-add-field-metadata-not-working/244911 "2020-08-14T12:40:42Z")
I have tried a number of different solutions and cannot get this to work. What am I missing? https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html filter { mutate { id =\> "add-pipeline" … --- ## [Circuit Breaker Exception + Data Too Large for HTTP Request + HTTP/1.1 429 Too Many Requests](https://discuss.elastic.co/t/circuit-breaker-exception-data-too-large-for-http-request-http-1-1-429-too-many-requests/266460)
**Author:** [@israni.amit](https://discuss.elastic.co/u/israni.amit)\ **Replies:** 6\ **Last updated:** [March 11, 2021, 6:49pm UTC](https://discuss.elastic.co/t/circuit-breaker-exception-data-too-large-for-http-request-http-1-1-429-too-many-requests/266460 "2021-03-11T18:49:44Z")
Hello Team, We recently went Live with Elastic Search as our search engine and observed few instances where circuit breaker exception was thrown along with messages like Data too large and too many requests. We have 5 … --- ## [Winlogbeat processor not dropping events](https://discuss.elastic.co/t/winlogbeat-processor-not-dropping-events/115634)
**Author:** [@saikrishnagaddipati](https://discuss.elastic.co/u/saikrishnagaddipati)\ **Replies:** 7\ **Last updated:** [January 30, 2018, 3:49am UTC](https://discuss.elastic.co/t/winlogbeat-processor-not-dropping-events/115634 "2018-01-30T03:49:51Z")
I want to drop events if provider is not Service Control Manager or mfehidk or PRIVMAN AND if event\_id is not 7036 or 516 or 100. However this doesnot seems to work i am getting events that should be blocked? Any sugges… --- ## [Error occurred while running the logstash installation command in windows](https://discuss.elastic.co/t/error-occurred-while-running-the-logstash-installation-command-in-windows/120230)
**Author:** [@sandy\_19](https://discuss.elastic.co/u/sandy_19)\ **Replies:** 3\ **Last updated:** [April 6, 2018, 10:28am UTC](https://discuss.elastic.co/t/error-occurred-while-running-the-logstash-installation-command-in-windows/120230 "2018-04-06T10:28:14Z")
Hi, I am new to ELK stack. I downloaded logstash, elasticsearch and kibana 6.2.1 versions. I am successful in installing elasticsearch and kibana in windows 10. But while installing logstash i am getting error. I execu… --- ## [Parsing Log4j2 logs from filebeat based on defined Pattern Layout](https://discuss.elastic.co/t/parsing-log4j2-logs-from-filebeat-based-on-defined-pattern-layout/149941)
**Author:** [@sbienert](https://discuss.elastic.co/u/sbienert)\ **Replies:** 7\ **Last updated:** [September 28, 2018, 1:33pm UTC](https://discuss.elastic.co/t/parsing-log4j2-logs-from-filebeat-based-on-defined-pattern-layout/149941 "2018-09-28T13:33:57Z")
Hello, I want to parse my logs from Filebeat into Elasticsearch as if there would be an Elasticsearch appender in Log4j2.xml meaning correct fields with their values and not one field with message where every field valu… --- ## [Rest High level client performance](https://discuss.elastic.co/t/rest-high-level-client-performance/159735)
**Author:** [@gzeskas](https://discuss.elastic.co/u/gzeskas)\ **Replies:** 3\ **Last updated:** [December 6, 2018, 6:32pm UTC](https://discuss.elastic.co/t/rest-high-level-client-performance/159735 "2018-12-06T18:32:32Z")
Hi I'm doing some research how to utilize elasticsearch cluster in best way. I have written simple java application that is using Rest High level client and setup of 2 elasticsearch nodes with 1 index that contains 2 … --- ## [Logstash in docker input jdbc plugin not updating last\_run\_metadata\_path](https://discuss.elastic.co/t/logstash-in-docker-input-jdbc-plugin-not-updating-last-run-metadata-path/37411)
**Author:** [@sripri](https://discuss.elastic.co/u/sripri)\ **Replies:** 4\ **Last updated:** [December 8, 2017, 12:15pm UTC](https://discuss.elastic.co/t/logstash-in-docker-input-jdbc-plugin-not-updating-last-run-metadata-path/37411 "2017-12-08T12:15:42Z")
Hi I am trying to use the input jdbc plugin jdbc { type =\> "logs" jdbc\_driver\_library =\> "/opt/logstash/driver/ojdbc6.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> … --- ## [Setup for kibana dashboards: fail to get the Kibana version](https://discuss.elastic.co/t/setup-for-kibana-dashboards-fail-to-get-the-kibana-version/114111)
**Author:** [@derikss](https://discuss.elastic.co/u/derikss)\ **Replies:** 5\ **Last updated:** [January 19, 2018, 8:21am UTC](https://discuss.elastic.co/t/setup-for-kibana-dashboards-fail-to-get-the-kibana-version/114111 "2018-01-19T08:21:55Z")
Hi, I get this error message when trying to import the dashboard for winlogbeat in to kibana. (winlogbeat-6.1.1-windows-x86\_64) .\\winlogbeat.exe setup --dashboards Exiting: Error importing Kibana dashboards: fail to … --- ## [Add 'multiline' to tags field](https://discuss.elastic.co/t/add-multiline-to-tags-field/41285)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 4\ **Last updated:** [February 10, 2016, 12:58pm UTC](https://discuss.elastic.co/t/add-multiline-to-tags-field/41285 "2016-02-10T12:58:17Z")
The logstash multiline plugin adds the value 'multiline' to tags. Then it is possible to perform additional processing of such events: if 'multiline' in \[tags\] { .... } Are there plans to add this into Filebeat? --- ## [Truncate Scripted Field](https://discuss.elastic.co/t/truncate-scripted-field/160087)
**Author:** [@JWR](https://discuss.elastic.co/u/JWR)\ **Replies:** 1\ **Last updated:** [December 10, 2018, 10:16pm UTC](https://discuss.elastic.co/t/truncate-scripted-field/160087 "2018-12-10T22:16:53Z")
I have a text field that I'd like to truncate to the first 5 characters. The Truncate String option doesn't seem to do what I thought. Could someone recommend anything here? --- ## [Include\_lines problem](https://discuss.elastic.co/t/include-lines-problem/52723)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 7\ **Last updated:** [June 14, 2016, 7:34pm UTC](https://discuss.elastic.co/t/include-lines-problem/52723 "2016-06-14T19:34:53Z")
Hi, I am trying to configure Filebeats to only process lines from my logs which match a couple of regexes. Nothing too complicated. I set it up like this: include\_lines: \[".\*returned\\sthe\\sstatus.\*",".\*information\\sf… --- ## [Split "message" Field using Ruby](https://discuss.elastic.co/t/split-message-field-using-ruby/193375)
**Author:** [@jakecramer17](https://discuss.elastic.co/u/jakecramer17)\ **Replies:** 2\ **Last updated:** [August 1, 2019, 5:20pm UTC](https://discuss.elastic.co/t/split-message-field-using-ruby/193375 "2019-08-01T17:20:35Z")
My input with the type "sym" contains a single string of multiple syslog logs separated by the '\\r' character (which I'm guessing represents carriage return). I'm not focused on parsing each log yet. First, I need to sep… --- ## [Ruby code to split array message and get the index and value in logstash](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 2\ **Last updated:** [May 9, 2017, 12:08pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075 "2017-05-09T12:08:47Z")
I am new to ruby code. Will appreciate any help on this. my input is message =\> field id=\\"0\\" value=\\"01\\"/\>\\n field id=\\"3\\" value=\\"03\\"/\>\\n \ **Author:** [@Rupesh\_Ranjan](https://discuss.elastic.co/u/Rupesh_Ranjan)\ **Replies:** 2\ **Last updated:** [April 6, 2017, 5:28pm UTC](https://discuss.elastic.co/t/kibana-port-on-80-throws-error/80987 "2017-04-06T17:28:44Z") I am using a linux RHEL server, and trying to change kibana port from 5601 to 80. With port 5601, everything seems working fine. But kibana does not start at all while changing port to 80. Any suggestions? --- ## [Parse JSON string contained in a Syslog message](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951)
**Author:** [@norandom](https://discuss.elastic.co/u/norandom)\ **Replies:** 2\ **Last updated:** [July 7, 2016, 2:57pm UTC](https://discuss.elastic.co/t/parse-json-string-contained-in-a-syslog-message/54951 "2016-07-07T14:57:07Z")
Hi, I have a program which sends its JSON data via Syslog. Example: Jul 7 14:17:48 10.1.1.221 suricata\[28230\]: {"timestamp":"2016-07-07T14:19:52.081015+0000",..."} input { file { type =\> "sysl… --- ## [Best practices for mappings (if they don't differ)](https://discuss.elastic.co/t/best-practices-for-mappings-if-they-dont-differ/55198)
**Author:** [@samatthias](https://discuss.elastic.co/u/samatthias)\ **Replies:** 4\ **Last updated:** [July 26, 2016, 11:51am UTC](https://discuss.elastic.co/t/best-practices-for-mappings-if-they-dont-differ/55198 "2016-07-26T11:51:30Z")
Hi Everyone I'm new to elasticsearch and I had to maintain a running elasticsearch instance. I found myself analyzing the indices and the load process. I figured out that the solution has 4 different indices with 4 dif… --- ## [Plot p90 percentile](https://discuss.elastic.co/t/plot-p90-percentile/85378)
**Author:** [@141984](https://discuss.elastic.co/u/141984)\ **Replies:** 1\ **Last updated:** [May 11, 2017, 3:49pm UTC](https://discuss.elastic.co/t/plot-p90-percentile/85378 "2017-05-11T15:49:50Z")
Hi All, Is it possible to plot p90/p95/p99 percentile of a numeric value in Kibana, if so how to? --gibu --- ## [X Pack](https://discuss.elastic.co/t/x-pack/92634)
**Author:** [@Akanksha\_Toshniwal](https://discuss.elastic.co/u/Akanksha_Toshniwal)\ **Replies:** 6\ **Last updated:** [July 12, 2017, 8:55am UTC](https://discuss.elastic.co/t/x-pack/92634 "2017-07-12T08:55:37Z")
I am using windows 8 32bit, and working on elastic search and kibana. I want to use x-pack now, but unable to start ES after installing x-pack. I have following questions: 1. Can we install x-pack without logstash. 2.Why… --- ## [Creating two graphs in same plot](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 6\ **Last updated:** [February 9, 2017, 8:25am UTC](https://discuss.elastic.co/t/creating-two-graphs-in-same-plot/74377 "2017-02-09T08:25:42Z")
Hi, I monitor number of packets sent and received in my network and would like to visualize this in Kibana. I can plot one entity at the time but I would like to see both at the same time. I have data looking like this… --- ## [How to "exclude\_lines but make these exceptions"?](https://discuss.elastic.co/t/how-to-exclude-lines-but-make-these-exceptions/46917)
**Author:** [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Replies:** 8\ **Last updated:** [April 13, 2016, 2:17pm UTC](https://discuss.elastic.co/t/how-to-exclude-lines-but-make-these-exceptions/46917 "2016-04-13T14:17:50Z")
I'm shipping syslog with custom template to log the severity. I'm using exclude\_lines to not bother shipping anything with severity greater than severity info. I'd like to make an exception for a handful of processes t… --- ## [NoNodeAvailableException happening when connecting to cluster deployed on GCP](https://discuss.elastic.co/t/nonodeavailableexception-happening-when-connecting-to-cluster-deployed-on-gcp/85312)
**Author:** [@Rohit\_Nigam](https://discuss.elastic.co/u/Rohit_Nigam)\ **Replies:** 6\ **Last updated:** [May 11, 2017, 6:24am UTC](https://discuss.elastic.co/t/nonodeavailableexception-happening-when-connecting-to-cluster-deployed-on-gcp/85312 "2017-05-11T06:24:53Z")
Hi I did a one click deployment of elastic search cluster on Google cloud. It is using 2.4.4 version of elastic search and i am using 5.4.0 version in pom.xml org.elasticsearch.client transport 5.4.0 I keep on getting … --- ## [Boosting results by date](https://discuss.elastic.co/t/boosting-results-by-date/5312)
**Author:** [@Tania](https://discuss.elastic.co/u/Tania)\ **Replies:** 6\ **Last updated:** [September 6, 2012, 12:18pm UTC](https://discuss.elastic.co/t/boosting-results-by-date/5312 "2012-09-06T12:18:19Z")
Hi all, I posted this topic one month ago but there were no related replies. I am interested in boosting my results by more recent date, this is, modifying they score so as to \*newer documents have a slightly bigger… --- ## [Logstash: max\_bytes\_length\_exceeded exception](https://discuss.elastic.co/t/logstash-max-bytes-length-exceeded-exception/115874)
**Author:** [@annaK](https://discuss.elastic.co/u/annaK)\ **Replies:** 3\ **Last updated:** [January 19, 2018, 7:42am UTC](https://discuss.elastic.co/t/logstash-max-bytes-length-exceeded-exception/115874 "2018-01-19T07:42:43Z")
Hi all, I have a short question, which might be very stupid indeed. I have a document that got 34321 byte of lenght. So I get a response like response=\>{"index"=\>{"\_index"=\>"kafka-test-car-2018.01.15", "\_type"=\>"logs"… --- ## [JDBC input plugin to feed JSON from database table](https://discuss.elastic.co/t/jdbc-input-plugin-to-feed-json-from-database-table/37876)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 3\ **Last updated:** [December 24, 2015, 4:52pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-to-feed-json-from-database-table/37876 "2015-12-24T16:52:11Z")
I need to feed JSON data from a PostGreSQL table as input to logstash. For this, I shall use the JDBC input plugin. In Kibana I need to display only selective fields from this JSON. So, somewhere I need to parse this JSO… --- ## [ECK responds empty via curl](https://discuss.elastic.co/t/eck-responds-empty-via-curl/266893)
**Author:** [@Tomonori-YOSHIKAWA](https://discuss.elastic.co/u/Tomonori-YOSHIKAWA)\ **Replies:** 4\ **Last updated:** [March 16, 2021, 11:51pm UTC](https://discuss.elastic.co/t/eck-responds-empty-via-curl/266893 "2021-03-16T23:51:29Z")
I have deployed ECK and BANZAI logging on AKS, then trying sent logs to elasticsearch via fluentd. No index have found on the Kibana discovery, I deployed a CentOS pod and verified its HTTP connectivity. But empty resp… --- ## ["GET \_cat/indices" does not output all the indices](https://discuss.elastic.co/t/get-cat-indices-does-not-output-all-the-indices/292096)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 2\ **Last updated:** [December 16, 2021, 7:24pm UTC](https://discuss.elastic.co/t/get-cat-indices-does-not-output-all-the-indices/292096 "2021-12-16T19:24:18Z")
Hi Elastic, kibana 7.15.1 This gives me 31 rows (30 indices in total and first row for heading) GET \_cat/indices/\*?v&s=index:desc health status index uuid pri rep docs.coun… --- ## [Different time field instead of @timestamp and filters](https://discuss.elastic.co/t/different-time-field-instead-of-timestamp-and-filters/273924)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 2\ **Last updated:** [May 26, 2021, 6:48am UTC](https://discuss.elastic.co/t/different-time-field-instead-of-timestamp-and-filters/273924 "2021-05-26T06:48:26Z")
Hi, I've recently inherited an ELK instance where all indexes are mapped with @timestamp as time field. Users are complaining a lot because the meaningful timestamp is not @timestamp, but some @event\_time field instead.… --- ## [How to change Fleet Output Host](https://discuss.elastic.co/t/how-to-change-fleet-output-host/305245)
**Author:** [@Ataye](https://discuss.elastic.co/u/Ataye)\ **Replies:** 6\ **Last updated:** [May 23, 2022, 11:51am UTC](https://discuss.elastic.co/t/how-to-change-fleet-output-host/305245 "2022-05-23T11:51:04Z")
Hello, I am adding fleet managed agents, but they are not sending data due to incorrect Elastic Output Host. I cannot change this setting since "This output is managed outside of Fleet". I tried changing it outside of… --- ## [How to disable the monitoring completely?](https://discuss.elastic.co/t/how-to-disable-the-monitoring-completely/137728)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 1\ **Last updated:** [June 28, 2018, 5:32am UTC](https://discuss.elastic.co/t/how-to-disable-the-monitoring-completely/137728 "2018-06-28T05:32:03Z")
I am using following docker-compose.yml file to disable the monitoring on ELK stack. I have removed the lines for kibana intentionally because kibana was crashing continuously if I add the monitoring parameter in it als… --- ## [Elasticsearch won't start anymore](https://discuss.elastic.co/t/elasticsearch-wont-start-anymore/16857)
**Author:** [@Danny\_Joris](https://discuss.elastic.co/u/Danny_Joris)\ **Replies:** 8\ **Last updated:** [April 7, 2014, 9:43pm UTC](https://discuss.elastic.co/t/elasticsearch-wont-start-anymore/16857 "2014-04-07T21:43:43Z")
After making a simple change on a query in Kibana, my Elasticsearch instance stopped working and I can't start it up again. I'm using ES 0.90.9 on OSX using homebrew. Normally I would use this to start ES: ela… --- ## [SIEM ECS descriptions taking huge amount of unneccesary space in SIEM](https://discuss.elastic.co/t/siem-ecs-descriptions-taking-huge-amount-of-unneccesary-space-in-siem/200972)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 10:27am UTC](https://discuss.elastic.co/t/siem-ecs-descriptions-taking-huge-amount-of-unneccesary-space-in-siem/200972 "2019-09-27T10:27:59Z")
Hello, Just some constructive feedback. When data is added to a SIEM timeline and the results are analyzed, it seems every field has a description column, which imho takes a huge amount of space, which could be used for… --- ## [How can I change the location of Logstash's logs?](https://discuss.elastic.co/t/how-can-i-change-the-location-of-logstashs-logs/81992)
**Author:** [@dolanmk](https://discuss.elastic.co/u/dolanmk)\ **Replies:** 6\ **Last updated:** [April 12, 2017, 12:30pm UTC](https://discuss.elastic.co/t/how-can-i-change-the-location-of-logstashs-logs/81992 "2017-04-12T12:30:12Z")
Hi, I am hoping to change the location of where Logstash stores the logs it creates of its own actions. As I understand it right now, this can be done with path.logs in the logstash.yml file. However, it doesn't seem a… --- ## [Hide some of "available fields" in Kibana Discover](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088)
**Author:** [@a1tus](https://discuss.elastic.co/u/a1tus)\ **Replies:** 4\ **Last updated:** [September 18, 2020, 7:35pm UTC](https://discuss.elastic.co/t/hide-some-of-available-fields-in-kibana-discover/249088 "2020-09-18T19:35:21Z")
Hello. We've structured our logs so that we have only a few indexed and searchable fields and all the rest goes into "extra" field that is not indexed and can't be searched (so we put there arbitrary keys and values tha… --- ## [Kibana Grok Debugger Multiple Custom Patterns](https://discuss.elastic.co/t/kibana-grok-debugger-multiple-custom-patterns/106708)
**Author:** [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\ **Replies:** 4\ **Last updated:** [November 8, 2017, 4:23pm UTC](https://discuss.elastic.co/t/kibana-grok-debugger-multiple-custom-patterns/106708 "2017-11-08T16:23:35Z")
I am trying to add multiple custom grok patterns to the grok debugger in Kibana. I currently have this: {"IIS\_HOST" : "\[a-zA-z.-\]+"} But every time I add another grok patter, I get a syntax error. I am wondering if th… --- ## [Enroll command failed with exit code: 1](https://discuss.elastic.co/t/enroll-command-failed-with-exit-code-1/344739)
**Author:** [@Jean-Claude](https://discuss.elastic.co/u/Jean-Claude)\ **Replies:** 5\ **Last updated:** [October 10, 2023, 3:31pm UTC](https://discuss.elastic.co/t/enroll-command-failed-with-exit-code-1/344739 "2023-10-10T15:31:50Z")
Hello, i hope you are doing well This my infra ELASTIC v-elkmaster01.sys.u-bordeaux.fr v-elkmaster02.sys.u-bordeaux.fr v-elkmaster03.sys.u-bordeaux.fr p-elkhot01.sys.u-bordeaux.fr p-elkhot02.sys.u-bordeaux.fr p-elkwar… --- ## [Filter Total time a user Logged in ( Log on to Log Off time ) to RDP of Windows Server](https://discuss.elastic.co/t/filter-total-time-a-user-logged-in-log-on-to-log-off-time-to-rdp-of-windows-server/93139)
**Author:** [@amarjeetxc](https://discuss.elastic.co/u/amarjeetxc)\ **Replies:** 5\ **Last updated:** [July 19, 2017, 4:11pm UTC](https://discuss.elastic.co/t/filter-total-time-a-user-logged-in-log-on-to-log-off-time-to-rdp-of-windows-server/93139 "2017-07-19T16:11:52Z")
I want to know the total time a user logged in to Windows Server i.e. user log on to log off in a Data Table. I am using the following configurations in Logstash : input { beats { port =\> 5044 } } filter { if \[ty… --- ## [Can't get winlogbeat to send logs](https://discuss.elastic.co/t/cant-get-winlogbeat-to-send-logs/89416)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 5\ **Last updated:** [June 14, 2017, 7:23pm UTC](https://discuss.elastic.co/t/cant-get-winlogbeat-to-send-logs/89416 "2017-06-14T19:23:29Z")
Hello, all. In my continuing quest to get ELK 5.x set up, I've managed to get logstash, filebeat, and topbeat logging working. However, despite hours and hours spent researching the issue, then trying every tweak unde… --- ## [Advanced settings via config file possible?](https://discuss.elastic.co/t/advanced-settings-via-config-file-possible/68862)
**Author:** [@ShinyMcShine](https://discuss.elastic.co/u/ShinyMcShine)\ **Replies:** 2\ **Last updated:** [December 14, 2016, 7:37am UTC](https://discuss.elastic.co/t/advanced-settings-via-config-file-possible/68862 "2016-12-14T07:37:38Z")
Hello there! Is it possible to set the advanced settings (e.g. doc\_table:highlight or state:storeinSessionStorage) via config file? I'm doing a lot of testing right now, which also involves an occasional fresh installa… --- ## [Filter sub-aggregation syntax](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200)
**Author:** [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Replies:** 4\ **Last updated:** [November 5, 2015, 3:14pm UTC](https://discuss.elastic.co/t/filter-sub-aggregation-syntax/33200 "2015-11-05T15:14:37Z")
Kibana 4.2 doesn't seem to allow '.' in filter sub-aggregations. I don't see anything about '.' being special here: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#\_rese… [Previous page](https://discuss.elastic.co/top.md?page=477&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=479&per_page=50&period=all)