# Top **URL:** https://discuss.elastic.co/top.md?page=490&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 491 --- ## [Kibana lost connection to Elasticsearch after some time](https://discuss.elastic.co/t/kibana-lost-connection-to-elasticsearch-after-some-time/231126)
**Author:** [@tdoan](https://discuss.elastic.co/u/tdoan)\ **Replies:** 8\ **Last updated:** [May 7, 2020, 9:45am UTC](https://discuss.elastic.co/t/kibana-lost-connection-to-elasticsearch-after-some-time/231126 "2020-05-07T09:45:10Z")
I'm following this guide to run Elasticsearch and Kibana on Docker. Below is my docker-compose.yml file: version: "3.7" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.6.2 container\_name… --- ## [Shards are not allocating to available nodes](https://discuss.elastic.co/t/shards-are-not-allocating-to-available-nodes/80547)
**Author:** [@jonesetc](https://discuss.elastic.co/u/jonesetc)\ **Replies:** 0\ **Last updated:** [March 29, 2017, 8:26pm UTC](https://discuss.elastic.co/t/shards-are-not-allocating-to-available-nodes/80547 "2017-03-29T20:26:08Z")
Hi, I'm running a 3 node elasticsearch 5.0.0 cluster and restarted a node in the cluster for some maintenance. Since that restart, there is a set of shards that seem to not be allocating on node with valid copies. I have… --- ## [Elasticsearch 7.7 : field expansion matches too many fields, limit: 1024, got: 1139](https://discuss.elastic.co/t/elasticsearch-7-7-field-expansion-matches-too-many-fields-limit-1024-got-1139/237425)
**Author:** [@pappukhode](https://discuss.elastic.co/u/pappukhode)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 9:00am UTC](https://discuss.elastic.co/t/elasticsearch-7-7-field-expansion-matches-too-many-fields-limit-1024-got-1139/237425 "2020-06-17T09:00:06Z")
Hi, I am using ES 7.7 and indexed around 70K data. I also verified index has around 540 fields by invokinghttp://es\_host:port/2/\_mapping. While performing simple search query I am getting query\_shard\_exception. GE… --- ## [How important to have 3 zones for a cluster?](https://discuss.elastic.co/t/how-important-to-have-3-zones-for-a-cluster/123577)
**Author:** [@D.J](https://discuss.elastic.co/u/D.J)\ **Replies:** 3\ **Last updated:** [March 14, 2018, 9:24pm UTC](https://discuss.elastic.co/t/how-important-to-have-3-zones-for-a-cluster/123577 "2018-03-14T21:24:41Z")
Hi, I understand that it is recommended to have 2-3 zones for production cluster. the main documented reason is that in case entire site has an issue then It would have a redundant fail-over site. also , I know that … --- ## [Journalbeat can't create an alias and fails to work](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 6\ **Last updated:** [December 21, 2021, 5:09pm UTC](https://discuss.elastic.co/t/journalbeat-cant-create-an-alias-and-fails-to-work/201875 "2021-12-21T17:09:29Z")
Journalbeat is having issues getting started. It seems like it fails to create an alias? journalctl -l --follow -u journalbeat eventually spits this out: Oct 01 15:33:43 hostname journalbeat\[30589\]: 2019-10-01T15:33:43… --- ## [Is there a NOOP analyzer?](https://discuss.elastic.co/t/is-there-a-noop-analyzer/28967)
**Author:** [@dunnlow](https://discuss.elastic.co/u/dunnlow)\ **Replies:** 7\ **Last updated:** [September 10, 2015, 3:39pm UTC](https://discuss.elastic.co/t/is-there-a-noop-analyzer/28967 "2015-09-10T15:39:00Z")
I need to add a custom analyzer for a field during INDEX but I do not want any analysis done of the search term. I tried looking for an analyzer that would just group the entire search term as a complete phrase, like: … --- ## [Changing the field names of search results](https://discuss.elastic.co/t/changing-the-field-names-of-search-results/8719)
**Author:** [@Mark\_Huang\_2](https://discuss.elastic.co/u/Mark_Huang_2)\ **Replies:** 7\ **Last updated:** [August 13, 2012, 9:41am UTC](https://discuss.elastic.co/t/changing-the-field-names-of-search-results/8719 "2012-08-13T09:41:35Z")
Hi, I'm relatively new to elasticsearch, so please bare with me. I read through the documentation for two days and tried to write my own mapper for some sample data. I am the CouchDB River plugin to index my Cou… --- ## [Query multiple strings in a field in kibana3?](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090)
**Author:** [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Replies:** 2\ **Last updated:** [June 13, 2014, 12:01pm UTC](https://discuss.elastic.co/t/query-multiple-strings-in-a-field-in-kibana3/18090 "2014-06-13T12:01:33Z")
I am using Logstash 1.4.1, elasticsearch 1.1.1, kibana 3.1 for analyzing my logs. I get the parsed fields (from log) in Kibana 3. Now, I have often query on a particular field for many strings. Eg: auth\_message… --- ## [Does ElasticSearch support GRPC or will support in near future?](https://discuss.elastic.co/t/does-elasticsearch-support-grpc-or-will-support-in-near-future/246916)
**Author:** [@isuhendro](https://discuss.elastic.co/u/isuhendro)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 7:40am UTC](https://discuss.elastic.co/t/does-elasticsearch-support-grpc-or-will-support-in-near-future/246916 "2020-08-31T07:40:17Z")
https://medium.com/@EmperorRXF/evaluating-performance-of-rest-vs-grpc-1b8bdf0b22da#:~:text=gRPC%20is%20roughly%207%20times,of%20HTTP%2F2%20by%20gRPC. The article above mentioned: gRPC is roughly 7 times faster than REST… --- ## [How to load data from large parquet files of 500M records to ES using logstash](https://discuss.elastic.co/t/how-to-load-data-from-large-parquet-files-of-500m-records-to-es-using-logstash/162640)
**Author:** [@Apple23](https://discuss.elastic.co/u/Apple23)\ **Replies:** 3\ **Last updated:** [January 2, 2019, 12:12pm UTC](https://discuss.elastic.co/t/how-to-load-data-from-large-parquet-files-of-500m-records-to-es-using-logstash/162640 "2019-01-02T12:12:08Z")
how to load data from large parquet files of 500M records to ES using logstash --- ## [Using multiple index patterns in kibana](https://discuss.elastic.co/t/using-multiple-index-patterns-in-kibana/124493)
**Author:** [@abhishekk](https://discuss.elastic.co/u/abhishekk)\ **Replies:** 1\ **Last updated:** [March 19, 2018, 10:55am UTC](https://discuss.elastic.co/t/using-multiple-index-patterns-in-kibana/124493 "2018-03-19T10:55:37Z")
Starting 6.0 it is encouraged to use different indexes for different types/formats of data. But I don't see a way to provide multiple indexes pattern (say user-,tweets-) in kibana for a single visualization. Such indexes… --- ## [Array with mixed values](https://discuss.elastic.co/t/array-with-mixed-values/38592)
**Author:** [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\ **Replies:** 4\ **Last updated:** [January 7, 2016, 12:51pm UTC](https://discuss.elastic.co/t/array-with-mixed-values/38592 "2016-01-07T12:51:30Z")
I have some "funny" data which looks like this: {"subsystem":\["windows gui",{"major":5,"minor":1}\]} This is a valid JSON string, but it won't go into Elasticsearch. If I define a dynamic template like {"subsystem… --- ## [Unable to configure oidc](https://discuss.elastic.co/t/unable-to-configure-oidc/234821)
**Author:** [@bandapally\_kumar](https://discuss.elastic.co/u/bandapally_kumar)\ **Replies:** 6\ **Last updated:** [May 30, 2020, 8:32am UTC](https://discuss.elastic.co/t/unable-to-configure-oidc/234821 "2020-05-30T08:32:22Z")
we are trying to setup elasticsearch to use oidc for authentication here is my yaml file xpack.security.authc.token.enabled: true xpack.security.authc.realms.oidc.oidc1: order: 1 rp.client\_id: "6bd9f9a3-… --- ## [Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch - Certificate problem?](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch-certificate-problem/157909)
**Author:** [@rpaterson](https://discuss.elastic.co/u/rpaterson)\ **Replies:** 1\ **Last updated:** [November 22, 2018, 5:23pm UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch-certificate-problem/157909 "2018-11-22T17:23:54Z")
Hey followed this guide to install ELK on a Ubuntu VM. https://www.howtoforge.com/tutorial/ubuntu-elastic-stack/ Can't get filebeat to start. Don't know what I've done wrong. Get this error when running 'sudo service fi… --- ## [Logstash with multiple kafka inputs](https://discuss.elastic.co/t/logstash-with-multiple-kafka-inputs/57646)
**Author:** [@abhi\_chinchole](https://discuss.elastic.co/u/abhi_chinchole)\ **Replies:** 4\ **Last updated:** [August 15, 2016, 4:10pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-kafka-inputs/57646 "2016-08-15T16:10:18Z")
I am trying to filter kafka events from multiple topics, but once all events from one topic has been filtered logstash is not able to fetch events from the other kafka topic. I am using topics with 3 partitions and 2 rep… --- ## [Error and access logs are merged: Filebeat + Elasticsearch + php-fpm on Docker](https://discuss.elastic.co/t/error-and-access-logs-are-merged-filebeat-elasticsearch-php-fpm-on-docker/178163)
**Author:** [@remimikalsen](https://discuss.elastic.co/u/remimikalsen)\ **Replies:** 7\ **Last updated:** [April 25, 2019, 11:06am UTC](https://discuss.elastic.co/t/error-and-access-logs-are-merged-filebeat-elasticsearch-php-fpm-on-docker/178163 "2019-04-25T11:06:48Z")
I'm having an annoying problem with the way php-fpm behaves on Docker; it writes both error and access logs to stderr! This is done because php-fpm closes the stdout stream when it starts up, so it's impossible to write … --- ## [Fire alert for each document with specific value in field](https://discuss.elastic.co/t/fire-alert-for-each-document-with-specific-value-in-field/273685)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 5\ **Last updated:** [May 25, 2021, 12:51pm UTC](https://discuss.elastic.co/t/fire-alert-for-each-document-with-specific-value-in-field/273685 "2021-05-25T12:51:05Z")
Hi, I'm currently struggling with Filebeat and Alerts. I'm trying to build a system that would allow me to fire an alert for each document with a specific value in log.level field. From what i tried i was only able to… --- ## [Spark sql filter pushdown](https://discuss.elastic.co/t/spark-sql-filter-pushdown/46985)
**Author:** [@vincent\_gromakowski](https://discuss.elastic.co/u/vincent_gromakowski)\ **Replies:** 5\ **Last updated:** [April 11, 2016, 4:28pm UTC](https://discuss.elastic.co/t/spark-sql-filter-pushdown/46985 "2016-04-11T16:28:50Z")
I cannot make the filter to be pushdown to ES when reading from a 1 billion docs index. Here is the code: val options = Map("pushdown" -\> "true", "double.filtering" -\> "false") val es=sqlContext.read.format("es").opti… --- ## [Filebeat works for Centos 5.7](https://discuss.elastic.co/t/filebeat-works-for-centos-5-7/76800)
**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\ **Replies:** 3\ **Last updated:** [March 2, 2017, 4:39pm UTC](https://discuss.elastic.co/t/filebeat-works-for-centos-5-7/76800 "2017-03-02T16:39:50Z")
I'm trying for while but not sure filebeat supports centos 5.7 able to install but no luck to strat it any sugessition would be helpful. uname -a 2.6.18-274.el5 #1 SMP Fri Jul 8 17:36:59 EDT 2011 x86\_64 x86\_64 x86\_64… --- ## [io.netty.handler.ssl.SslHandshakeTimeoutException: handshake timed out after 10000ms](https://discuss.elastic.co/t/io-netty-handler-ssl-sslhandshaketimeoutexception-handshake-timed-out-after-10000ms/326117)
**Author:** [@Raghulvishal](https://discuss.elastic.co/u/Raghulvishal)\ **Replies:** 6\ **Last updated:** [February 23, 2023, 3:25am UTC](https://discuss.elastic.co/t/io-netty-handler-ssl-sslhandshaketimeoutexception-handshake-timed-out-after-10000ms/326117 "2023-02-23T03:25:11Z")
Hi Team, We are getting this below exception daily. so, can you please give solution for this exception. we are using Elasticsearch 7.3.2, java version 1.8.0\_131 and tomcat version 9. 2023-02-19 18:55:20.683 \[elastic… --- ## [Characters to avoid in field names](https://discuss.elastic.co/t/characters-to-avoid-in-field-names/5783)
**Author:** [@Nick\_Hoffman](https://discuss.elastic.co/u/Nick_Hoffman)\ **Replies:** 2\ **Last updated:** [November 7, 2011, 5:19am UTC](https://discuss.elastic.co/t/characters-to-avoid-in-field-names/5783 "2011-11-07T05:19:03Z")
Hey guys. After reading this threadwhere kimchy said to avoid spaces in field names, I'm wondering what other characters should not be included in field names. Thanks, Nick --- ## [View in Console not Working](https://discuss.elastic.co/t/view-in-console-not-working/211345)
**Author:** [@spottedmahn](https://discuss.elastic.co/u/spottedmahn)\ **Replies:** 7\ **Last updated:** [December 11, 2019, 2:29pm UTC](https://discuss.elastic.co/t/view-in-console-not-working/211345 "2019-12-11T14:29:57Z")
Where are we supposed to log feedback/issues about the doc pages? Example doc page. I would assume there is a category/tag(s) for this, no? When I click "View in Console" on any of the examples here, I get: Notic… --- ## [Delay starting Kibana until Elasticsearch fully up](https://discuss.elastic.co/t/delay-starting-kibana-until-elasticsearch-fully-up/42580)
**Author:** [@hvisage](https://discuss.elastic.co/u/hvisage)\ **Replies:** 7\ **Last updated:** [February 28, 2016, 12:35am UTC](https://discuss.elastic.co/t/delay-starting-kibana-until-elasticsearch-fully-up/42580 "2016-02-28T00:35:17Z")
Hi there, It appears that I have a elasticsearch starting too slow for kibana, and tuning variables in config/kibana.yml didn't work. Any help in how to convince Kibana to wait longer for Elasticsearch to startup? See … --- ## [Trouble with escaped fields in nested JSON... Causing LogStash Json ParserError: Unrecognized token](https://discuss.elastic.co/t/trouble-with-escaped-fields-in-nested-json-causing-logstash-json-parsererror-unrecognized-token/129125)
**Author:** [@steven-lacher](https://discuss.elastic.co/u/steven-lacher)\ **Replies:** 4\ **Last updated:** [April 23, 2018, 6:21pm UTC](https://discuss.elastic.co/t/trouble-with-escaped-fields-in-nested-json-causing-logstash-json-parsererror-unrecognized-token/129125 "2018-04-23T18:21:05Z")
I'm having trouble parsing nested JSON from events. I'm concerned I'm not dealing with the escaped quotation marks properly, or missing some interim step. Original entry as written to the log {"timeMillis":15242606228… --- ## [Best option for performing min-max aggregation](https://discuss.elastic.co/t/best-option-for-performing-min-max-aggregation/97247)
**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\ **Replies:** 4\ **Last updated:** [August 21, 2017, 4:05pm UTC](https://discuss.elastic.co/t/best-option-for-performing-min-max-aggregation/97247 "2017-08-21T16:05:33Z")
Hi, Given a series incoming events like say: @timestamp1: a,b,c,d,e @timestamp2: a,b,c,d,e (all numbers) I need to perform some calculation which would be of the form (max (a) - min (a) )\* (max (b) - min (b)) / (ma… --- ## [Kibana 4.x with multiple indexes](https://discuss.elastic.co/t/kibana-4-x-with-multiple-indexes/23991)
**Author:** [@matt](https://discuss.elastic.co/u/matt)\ **Replies:** 4\ **Last updated:** [June 22, 2015, 2:31am UTC](https://discuss.elastic.co/t/kibana-4-x-with-multiple-indexes/23991 "2015-06-22T02:31:04Z")
Hi All, I am in a mission to update our existing kibana 3 setup to Kibana 4. Only issue is that our old Kibana 3 has user level access control on the dashboards (which has been done with an external wrapper + nginx + lu… --- ## [How data will be distributed among the data nodes](https://discuss.elastic.co/t/how-data-will-be-distributed-among-the-data-nodes/293099)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 8\ **Last updated:** [December 30, 2021, 5:09pm UTC](https://discuss.elastic.co/t/how-data-will-be-distributed-among-the-data-nodes/293099 "2021-12-30T17:09:23Z")
Hi, I have cluster with 3 master nodes and 3 data nodes and when I am trying to add the documents/data to cluster it seems only 2 data nodes are used. I have only one index and it is same for all the data nodes. if yo… --- ## [Logstash index template + data streams](https://discuss.elastic.co/t/logstash-index-template-data-streams/295872)
**Author:** [@cmanzur](https://discuss.elastic.co/u/cmanzur)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 7:39pm UTC](https://discuss.elastic.co/t/logstash-index-template-data-streams/295872 "2022-01-31T19:39:25Z")
I'm trying to use data streams and index templates in logstash v7.17 What is the right Elasticsearch output configuration to achieve this? Option 1: Using data stream in the template Fails output { elasticse… --- ## [Index.mapping.total\_fields.limit is important only for query operations?](https://discuss.elastic.co/t/index-mapping-total-fields-limit-is-important-only-for-query-operations/218217)
**Author:** [@111287](https://discuss.elastic.co/u/111287)\ **Replies:** 0\ **Last updated:** [February 6, 2020, 4:25pm UTC](https://discuss.elastic.co/t/index-mapping-total-fields-limit-is-important-only-for-query-operations/218217 "2020-02-06T16:25:51Z")
Hello, On next page I fount interesting statement regarding mapping total fields limit settings: index.mapping.total\_fields.limit The maximum number of fields in an index. Field and object mappings, as well as field… --- ## [Detections coverage of ATT&CK documentation](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:57pm UTC](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692 "2021-04-15T17:57:24Z")
Hi, We are trying to review the ATT&CK coverage for the current detections to help us with creation and coverage of our own ruleset, is there anything available for us to use? Thanks --- ## [How to create time range conditions on Timelion?](https://discuss.elastic.co/t/how-to-create-time-range-conditions-on-timelion/119404)
**Author:** [@keeshqs](https://discuss.elastic.co/u/keeshqs)\ **Replies:** 1\ **Last updated:** [February 12, 2018, 4:28pm UTC](https://discuss.elastic.co/t/how-to-create-time-range-conditions-on-timelion/119404 "2018-02-12T16:28:51Z")
Hi all, I'm not sure if it's possible on timelion, but on elasticsearch we are receiving document every 1 minute. These documents contain SQL database related metric (such as Object Locks and Database Locks), and each h… --- ## [Scripted field conditionals failing (5 of 15 shards failed)](https://discuss.elastic.co/t/scripted-field-conditionals-failing-5-of-15-shards-failed/147807)
**Author:** [@caub](https://discuss.elastic.co/u/caub)\ **Replies:** 3\ **Last updated:** [September 11, 2018, 7:53pm UTC](https://discuss.elastic.co/t/scripted-field-conditionals-failing-5-of-15-shards-failed/147807 "2018-09-11T19:53:40Z")
I get this error "n of N shards failed" in the bottom right notification in Discover tab, when I add a scripted field such as: \_msg painless return doc\['err\_msg'\].value || doc\['message'\].value; String I trie… --- ## [Kibana browser support (IE-11)?](https://discuss.elastic.co/t/kibana-browser-support-ie-11/143770)
**Author:** [@ehfdub](https://discuss.elastic.co/u/ehfdub)\ **Replies:** 3\ **Last updated:** [August 10, 2018, 1:25am UTC](https://discuss.elastic.co/t/kibana-browser-support-ie-11/143770 "2018-08-10T01:25:05Z")
Hello, https://www.elastic.co/support/matrix#matrix\_browsers claims that Kibana supports IE-11. But when I view localhost:5601 in an IE-11 browser all of the kibana "gauge controls" have both horizontal and vertical sc… --- ## [Cloudtrail logs using logstash](https://discuss.elastic.co/t/cloudtrail-logs-using-logstash/143955)
**Author:** [@jellsworth](https://discuss.elastic.co/u/jellsworth)\ **Replies:** 5\ **Last updated:** [August 13, 2018, 2:04pm UTC](https://discuss.elastic.co/t/cloudtrail-logs-using-logstash/143955 "2018-08-13T14:04:34Z")
I have a mostly-working config for ingesting my cloudtrail logs using logstash. ElasticSearch doesn't seem to be parsing the 'ResponseElements' field, though, as well as a few other fields that can vary from being empty … --- ## [Get filename using beats and filter it in logstash](https://discuss.elastic.co/t/get-filename-using-beats-and-filter-it-in-logstash/190058)
**Author:** [@111175](https://discuss.elastic.co/u/111175)\ **Replies:** 5\ **Last updated:** [July 12, 2019, 2:00pm UTC](https://discuss.elastic.co/t/get-filename-using-beats-and-filter-it-in-logstash/190058 "2019-07-12T14:00:16Z")
Hi, I have logfile with date as it's name and time inside it. I'm using filebeats to get logs from remote server. Is it possible to combine date with time somehow and put in @timestamp? I tried something like this: // … --- ## [How can use Avro serialize codec when output message to Kafka?](https://discuss.elastic.co/t/how-can-use-avro-serialize-codec-when-output-message-to-kafka/74018)
**Author:** [@elkan1788](https://discuss.elastic.co/u/elkan1788)\ **Replies:** 2\ **Last updated:** [February 10, 2017, 9:59am UTC](https://discuss.elastic.co/t/how-can-use-avro-serialize-codec-when-output-message-to-kafka/74018 "2017-02-10T09:59:40Z")
Hi guys. There had meet a problem when use Avro framework serialize codec for output message to Kafka. The Logstash configure file setting like below: input { file { path =\> "/data/tmp/\*.log" start… --- ## [Best way to truncate a date field?](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 4\ **Last updated:** [December 18, 2015, 3:47pm UTC](https://discuss.elastic.co/t/best-way-to-truncate-a-date-field/37507 "2015-12-18T15:47:40Z")
I'm ingesting old logs and want to use a data field value in the index name: elasticsearch{ index =\> "logstash-systemname-%{day}" ... } It's a LogStash::TimeStamp field but I want to copy it and truncate the c… --- ## [Convert lat and long to geohash](https://discuss.elastic.co/t/convert-lat-and-long-to-geohash/197631)
**Author:** [@Brian\_Seel](https://discuss.elastic.co/u/Brian_Seel)\ **Replies:** 5\ **Last updated:** [September 7, 2019, 5:51pm UTC](https://discuss.elastic.co/t/convert-lat-and-long-to-geohash/197631 "2019-09-07T17:51:30Z")
I have done quite a bit of searching, but either don't know what I am doing wrong, or don't know the right question to ask. I am ingesting data, including latitude and longitude, and converting them to floats like this: … --- ## [Problem when creating index : Request Timeout after 30000ms](https://discuss.elastic.co/t/problem-when-creating-index-request-timeout-after-30000ms/95593)
**Author:** [@Ankita\_Nema](https://discuss.elastic.co/u/Ankita_Nema)\ **Replies:** 5\ **Last updated:** [August 3, 2017, 7:14pm UTC](https://discuss.elastic.co/t/problem-when-creating-index-request-timeout-after-30000ms/95593 "2017-08-03T19:14:14Z")
Hi I get this error when I try to create a new index from kibana. (Management --\> Index pattern–\> Add new) When I try to search for that index in Dev tools I could see it. Request Timeout after 30000ms Version: 5.2.1 … --- ## [Input JSON](https://discuss.elastic.co/t/input-json/65528)
**Author:** [@TimE](https://discuss.elastic.co/u/TimE)\ **Replies:** 5\ **Last updated:** [November 11, 2016, 2:02pm UTC](https://discuss.elastic.co/t/input-json/65528 "2016-11-11T14:02:44Z")
Hey, After trying for a long time trying to get a nested JSON working I've just created a flat one - http://pastebin.com/0VVF4HNZ. I feel like this should be trivial but trying input codec json, filter json, some att… --- ## [Moving elasticsearch storage directory](https://discuss.elastic.co/t/moving-elasticsearch-storage-directory/260611)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 2\ **Last updated:** [January 9, 2021, 5:45pm UTC](https://discuss.elastic.co/t/moving-elasticsearch-storage-directory/260611 "2021-01-09T17:45:15Z")
I've been using the elastic stack for last one year to capture research data (mainly using honeypots hosted on cloud service providers.) I'm using a three-node cluster to capture the data. 2 nodes are data nodes 1 nod… --- ## [Multiple 'Multiline' blocks in same filebeat.yml - Filebeats](https://discuss.elastic.co/t/multiple-multiline-blocks-in-same-filebeat-yml-filebeats/215922)
**Author:** [@klang](https://discuss.elastic.co/u/klang)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 5:49pm UTC](https://discuss.elastic.co/t/multiple-multiline-blocks-in-same-filebeat-yml-filebeats/215922 "2020-01-21T17:49:13Z")
I'm looking to understand if I may have more than 1 multiline.pattern defined in a filebeat configuration of which these multiline configurations would be against the same log file. When I run something similar to the be… --- ## [How to parse json values from http poller into event fields?](https://discuss.elastic.co/t/how-to-parse-json-values-from-http-poller-into-event-fields/136597)
**Author:** [@wailoont](https://discuss.elastic.co/u/wailoont)\ **Replies:** 2\ **Last updated:** [June 21, 2018, 4:30am UTC](https://discuss.elastic.co/t/how-to-parse-json-values-from-http-poller-into-event-fields/136597 "2018-06-21T04:30:00Z")
I am using logstash http poller plugin to call an API to retrieve information. Below is my logstash conf. input { http\_poller { urls =\> { test2 =\> { method =\> get url =\> "http://localhost:90… --- ## [Extract Hour and Day from @timestamp](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 7\ **Last updated:** [October 22, 2019, 7:04pm UTC](https://discuss.elastic.co/t/extract-hour-and-day-from-timestamp/204542 "2019-10-22T19:04:13Z")
Hello! I am trying to copy the day and hour from the timestamp field and add each to their own fields. Here is my code: if \[source\] =~ "tableBASEtest" { mutate{ add\_field =\> { "\[@metadata\]\[timestam… --- ## [Best practice to backup Elasticsearch indexes](https://discuss.elastic.co/t/best-practice-to-backup-elasticsearch-indexes/109566)
**Author:** [@Milad\_Hamid](https://discuss.elastic.co/u/Milad_Hamid)\ **Replies:** 2\ **Last updated:** [November 29, 2017, 10:55am UTC](https://discuss.elastic.co/t/best-practice-to-backup-elasticsearch-indexes/109566 "2017-11-29T10:55:34Z")
How to make a backup of our Elasticsearch indexes to the disk to have archive of our logs? --- ## [Allow SSL/TLS with self-generated ca certs and keys in localhost](https://discuss.elastic.co/t/allow-ssl-tls-with-self-generated-ca-certs-and-keys-in-localhost/212502)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 4\ **Last updated:** [December 20, 2019, 8:49am UTC](https://discuss.elastic.co/t/allow-ssl-tls-with-self-generated-ca-certs-and-keys-in-localhost/212502 "2019-12-20T08:49:53Z")
Hello ELK workers, I'm working on the ELK stack and i manage to install it and make it work on my computer with local data etc... I'm now trying to make the stack use SSL/TLS for transport and http layer. I took the tri… --- ## [Help with Grok pattern with space in field?](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/80189)
**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 8:13pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-with-space-in-field/80189 "2017-03-27T20:13:43Z")
I have the following log... 2017-03-27 14:24:50,607 DEBUG :Finalizer thread \[com.company.classname\] ...and the following filter filter { grok { match =\> { "message" =\> \[ "%{TIMESTAMP\_ISO8601:log… --- ## [Is there a way to dynamically add elements to canvas?](https://discuss.elastic.co/t/is-there-a-way-to-dynamically-add-elements-to-canvas/168825)
**Author:** [@acalypha](https://discuss.elastic.co/u/acalypha)\ **Replies:** 8\ **Last updated:** [March 11, 2019, 7:54pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-dynamically-add-elements-to-canvas/168825 "2019-03-11T19:54:00Z")
Recently, I have been experimenting with Canvas on Kibana 6. The fact that one can use essql for filtering data and the elements are tweakable from the "expression editor" is awesome. I am now wondering if there is a wa… --- ## [Master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes but ips look ok](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes-but-ips-look-ok/194424)
**Author:** [@oobi89](https://discuss.elastic.co/u/oobi89)\ **Replies:** 8\ **Last updated:** [August 9, 2019, 6:26am UTC](https://discuss.elastic.co/t/master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes-but-ips-look-ok/194424 "2019-08-09T06:26:47Z")
Hello, I am trying to run elasticsearch node on 1 server using docker compose and then another node on different server. My docker-compose file: version: '2.2' services: es01: image: docker.elastic.co/elasticsea… --- ## [Error Scheduling Telemetry task](https://discuss.elastic.co/t/error-scheduling-telemetry-task/207002)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 8:01pm UTC](https://discuss.elastic.co/t/error-scheduling-telemetry-task/207002 "2019-11-07T20:01:31Z")
I am not able to find the issue with this error and how to understand whats happening! Please help. log \[19:35:49.863\] \[info\]\[listening\] Server running at http://localhost:5601 log \[19:35:49.878\] \[info\]\[server\]\[Ki… [Previous page](https://discuss.elastic.co/top.md?page=489&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=491&per_page=50&period=all)