# Top

**URL:** https://discuss.elastic.co/top.md?page=495&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 496

---

## [Query filtering based on one element in an array of nested elements](https://discuss.elastic.co/t/query-filtering-based-on-one-element-in-an-array-of-nested-elements/161533)

<div class="topic-metadata">

**Author:** [@codobbit](https://discuss.elastic.co/u/codobbit)\
**Replies:** 4\
**Last updated:** [January 18, 2019, 10:53am UTC](https://discuss.elastic.co/t/query-filtering-based-on-one-element-in-an-array-of-nested-elements/161533 "2019-01-18T10:53:21Z")

</div>

Hello everyone! Been grappling this issue for a couple of days now and cannot find a way out of it. I'm using C# and NEST but the issue is in my filtration. I have a product with nested prices array for each different …

---

## [How to have Kibana convert KQL to request (cURL command)?](https://discuss.elastic.co/t/how-to-have-kibana-convert-kql-to-request-curl-command/213062)

<div class="topic-metadata">

**Author:** [@ttpro1995](https://discuss.elastic.co/u/ttpro1995)\
**Replies:** 1\
**Last updated:** [December 26, 2019, 3:26pm UTC](https://discuss.elastic.co/t/how-to-have-kibana-convert-kql-to-request-curl-command/213062 "2019-12-26T15:26:06Z")

</div>

I am using Kibana 7.2 I want to have Kibana convert KQL that I use in Discover tab app/kibana#/discover into format like in in dev tool (app/kibana#/dev\_tools/console) So far, I can't see the button or anything to out…

---

## [Using beats in pfsense firewall to get system logs](https://discuss.elastic.co/t/using-beats-in-pfsense-firewall-to-get-system-logs/113749)

<div class="topic-metadata">

**Author:** [@rahul01](https://discuss.elastic.co/u/rahul01)\
**Replies:** 5\
**Last updated:** [January 5, 2018, 12:08pm UTC](https://discuss.elastic.co/t/using-beats-in-pfsense-firewall-to-get-system-logs/113749 "2018-01-05T12:08:09Z")

</div>

Hello I'm using freebsd pfsense 2.4.2, and I want to send system authentication logs to kafka. So is it possible to install any beats in pfsense and monitor? Thanks & Regards Rahul

---

## [Ingest mixed container logs with text and JSON \[filebeat\]\[docker\]](https://discuss.elastic.co/t/ingest-mixed-container-logs-with-text-and-json-filebeat-docker/271139)

<div class="topic-metadata">

**Author:** [@bluepuma77](https://discuss.elastic.co/u/bluepuma77)\
**Replies:** 4\
**Last updated:** [May 12, 2021, 1:22pm UTC](https://discuss.elastic.co/t/ingest-mixed-container-logs-with-text-and-json-filebeat-docker/271139 "2021-05-12T13:22:05Z")

</div>

Hi all, we are currently using plain text logging and import container output with filebeat into elastic and kibana. We would like to migrate to structured logging with JSON. Is a bit-by-bit migration possible, can I h…

---

## [Get document by id is does not work for some docs but the docs are there](https://discuss.elastic.co/t/get-document-by-id-is-does-not-work-for-some-docs-but-the-docs-are-there/14254)

<div class="topic-metadata">

**Author:** [@Francisco\_Viramontes](https://discuss.elastic.co/u/Francisco_Viramontes)\
**Replies:** 4\
**Last updated:** [November 5, 2013, 7:51am UTC](https://discuss.elastic.co/t/get-document-by-id-is-does-not-work-for-some-docs-but-the-docs-are-there/14254 "2013-11-05T07:51:48Z")

</div>

Hi! I could not find another person reporting this issue and I am totally baffled by this weird issue. The problem is pretty straight forward. I have an index with multiple mappings where I use parent child associ…

---

## [Logstash cpu usage is very high, and there are a large number of thread GC](https://discuss.elastic.co/t/logstash-cpu-usage-is-very-high-and-there-are-a-large-number-of-thread-gc/305666)

<div class="topic-metadata">

**Author:** [@1065916870](https://discuss.elastic.co/u/1065916870)\
**Replies:** 6\
**Last updated:** [May 27, 2022, 12:16pm UTC](https://discuss.elastic.co/t/logstash-cpu-usage-is-very-high-and-there-are-a-large-number-of-thread-gc/305666 "2022-05-27T12:16:39Z")

</div>

Using 3-node logstash to consume kafka data, logstash cpu usage is very high, and there are a large number of thread GC logstash configuration: 3 node , 16C 32G jvm -Xms16g -Xmx16g two pipeline: pipeline.workers: 16 …

---

## [Enhanced Table](https://discuss.elastic.co/t/enhanced-table/240817)

<div class="topic-metadata">

**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\
**Replies:** 6\
**Last updated:** [July 13, 2020, 11:24am UTC](https://discuss.elastic.co/t/enhanced-table/240817 "2020-07-13T11:24:56Z")

</div>

Hi @fbaligand , at first I would like to thank for creating the awesome and very useful Kibana Enhanced Table plugin, it really helped me . my first question is it possible to set a row alert , i mean adding a compute…

---

## [Ignore\_older option in filebeat not working as expected](https://discuss.elastic.co/t/ignore-older-option-in-filebeat-not-working-as-expected/40437)

<div class="topic-metadata">

**Author:** [@Kartik\_Ramachandran](https://discuss.elastic.co/u/Kartik_Ramachandran)\
**Replies:** 6\
**Last updated:** [February 3, 2016, 3:28pm UTC](https://discuss.elastic.co/t/ignore-older-option-in-filebeat-not-working-as-expected/40437 "2016-02-03T15:28:43Z")

</div>

I just started using filebeat. I have set ignore\_older options to 5s. There are a lot of old files in the directory which gets scanned (which cannot be deleted). I see that the old files are opened which causes filebeat …

---

## [Simple moving average in Kibana over a date histogram help](https://discuss.elastic.co/t/simple-moving-average-in-kibana-over-a-date-histogram-help/77249)

<div class="topic-metadata">

**Author:** [@mmoxam](https://discuss.elastic.co/u/mmoxam)\
**Replies:** 2\
**Last updated:** [March 3, 2017, 6:52pm UTC](https://discuss.elastic.co/t/simple-moving-average-in-kibana-over-a-date-histogram-help/77249 "2017-03-03T18:52:55Z")

</div>

Can someone explain or show me how to add a simple moving average over a line chart with a date histogram in Kibana? I see the documentation on moving average but it's not clear how I would use it in Kibana.

---

## [Index Closed Exception](https://discuss.elastic.co/t/index-closed-exception/24343)

<div class="topic-metadata">

**Author:** [@tanveer3](https://discuss.elastic.co/u/tanveer3)\
**Replies:** 2\
**Last updated:** [June 25, 2015, 4:42pm UTC](https://discuss.elastic.co/t/index-closed-exception/24343 "2015-06-25T16:42:16Z")

</div>

Hi All, Please advice, on executing the below command to Close the Index CURL -XPOST 'http://localhost:9200/places/\_close' I received below message "error": "IndexClosedException\[\[places\] closed\]"

---

## [Target month name to @timestamp](https://discuss.elastic.co/t/target-month-name-to-timestamp/81621)

<div class="topic-metadata">

**Author:** [@Emilien](https://discuss.elastic.co/u/Emilien)\
**Replies:** 4\
**Last updated:** [April 7, 2017, 3:30pm UTC](https://discuss.elastic.co/t/target-month-name-to-timestamp/81621 "2017-04-07T15:30:22Z")

</div>

Hi everyone, I'm using logstash to manage my catalina logs. The issue I encounter is the fact that I have to type of timestamp in my logs. 2017-04-04 10:16:54,297 04-Apr-2017 10:16:54.443 Here my filter configuratio…

---

## [Deleted the indexes but the data is still there](https://discuss.elastic.co/t/deleted-the-indexes-but-the-data-is-still-there/232343)

<div class="topic-metadata">

**Author:** [@GGUERRA](https://discuss.elastic.co/u/GGUERRA)\
**Replies:** 5\
**Last updated:** [May 17, 2020, 4:21pm UTC](https://discuss.elastic.co/t/deleted-the-indexes-but-the-data-is-still-there/232343 "2020-05-17T16:21:29Z")

</div>

Hello everyone, I have the following question. Through Kibana, in the management section, specifically in Index Management, I deleted indexes. However, in the monitoring section, the indexes keep appearing and the disk s…

---

## [Bulk Insert using helpers](https://discuss.elastic.co/t/bulk-insert-using-helpers/126836)

<div class="topic-metadata">

**Author:** [@Sunil\_Kalyanpur](https://discuss.elastic.co/u/Sunil_Kalyanpur)\
**Replies:** 3\
**Last updated:** [April 5, 2018, 6:31am UTC](https://discuss.elastic.co/t/bulk-insert-using-helpers/126836 "2018-04-05T06:31:09Z")

</div>

I'm using Elasticsearch 6.2. This link mentions that \_type would be removed from future versions. Hence, I tried to do a bulk insert without specifying \_type in \_make\_documents function. But, it threw below error. elas…

---

## [Trying to Unit Test with ElasticSearch Spark, Getting Error](https://discuss.elastic.co/t/trying-to-unit-test-with-elasticsearch-spark-getting-error/59243)

<div class="topic-metadata">

**Author:** [@sarunkum](https://discuss.elastic.co/u/sarunkum)\
**Replies:** 8\
**Last updated:** [September 7, 2016, 10:00pm UTC](https://discuss.elastic.co/t/trying-to-unit-test-with-elasticsearch-spark-getting-error/59243 "2016-09-07T22:00:19Z")

</div>

ElasticSearch Newbie here, trying to perform unit testing using local spark and localhost for elasticsearch, but I'm receiving the following error during runtime: \[info\] - Write to ElasticSearch \*\*\* FAILED \*\*\* \[info\] …

---

## [Elastic receives small amount of data and nginx buffers the bulk events](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578)

<div class="topic-metadata">

**Author:** [@opouwels](https://discuss.elastic.co/u/opouwels)\
**Replies:** 6\
**Last updated:** [January 5, 2021, 12:30pm UTC](https://discuss.elastic.co/t/elastic-receives-small-amount-of-data-and-nginx-buffers-the-bulk-events/259578 "2021-01-05T12:30:22Z")

</div>

Hi List, Sinces we switched from fluentd to fluent-bit our elastic cluster showed more problems with the bulk queue, is their a way to see whats in the bulk queue and why its not progressing the queue? the nginx shows …

---

## [Decimal numbers visualizations](https://discuss.elastic.co/t/decimal-numbers-visualizations/252695)

<div class="topic-metadata">

**Author:** [@gusgus1993](https://discuss.elastic.co/u/gusgus1993)\
**Replies:** 8\
**Last updated:** [October 22, 2020, 6:45am UTC](https://discuss.elastic.co/t/decimal-numbers-visualizations/252695 "2020-10-22T06:45:24Z")

</div>

Hello! I'm trying to show a sum of decimal numbers at Kibana. I'm sending as a double variable to the index pattern. When I did the sum at kibana it appears like 0. My index parttern has this format: What may be …

---

## [Count Unique IP ranges from IP's](https://discuss.elastic.co/t/count-unique-ip-ranges-from-ips/158196)

<div class="topic-metadata">

**Author:** [@WillyWonka](https://discuss.elastic.co/u/WillyWonka)\
**Replies:** 3\
**Last updated:** [November 27, 2018, 3:28pm UTC](https://discuss.elastic.co/t/count-unique-ip-ranges-from-ips/158196 "2018-11-27T15:28:58Z")

</div>

Hi guys, I want to create a Visualization that shows the total amount of different IP ranges. Currently i have a Visualization that counts ALL unique IP addresses from servers that connect with our server. However this…

---

## [How to define Kibana/Logstash password encrypted](https://discuss.elastic.co/t/how-to-define-kibana-logstash-password-encrypted/42850)

<div class="topic-metadata">

**Author:** [@Emmanuel\_DEMEY](https://discuss.elastic.co/u/Emmanuel_DEMEY)\
**Replies:** 7\
**Last updated:** [October 19, 2016, 9:27pm UTC](https://discuss.elastic.co/t/how-to-define-kibana-logstash-password-encrypted/42850 "2016-10-19T21:27:20Z")

</div>

Hi everyone, I am working with Shield, and I have a question about the configuration of the Kibana or Logstash user in their corresponding configuration file. Is it possible to encrypt password for thes users ? in …

---

## [What is the ES cluster size that requiers a dedicated master node?](https://discuss.elastic.co/t/what-is-the-es-cluster-size-that-requiers-a-dedicated-master-node/26489)

<div class="topic-metadata">

**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\
**Replies:** 2\
**Last updated:** [August 26, 2016, 2:22am UTC](https://discuss.elastic.co/t/what-is-the-es-cluster-size-that-requiers-a-dedicated-master-node/26489 "2016-08-26T02:22:09Z")

</div>

Hi all, I've been reading several articles (Sizing Master nodes and Master Node role in a cluster) as well as Node module article. None of the above mention the cluster structure attributes that should be taken into c…

---

## [Dissect combined with multiline pattern gives errors](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728)

<div class="topic-metadata">

**Author:** [@kainazzzo](https://discuss.elastic.co/u/kainazzzo)\
**Replies:** 5\
**Last updated:** [July 8, 2020, 7:40pm UTC](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728 "2020-07-08T19:40:19Z")

</div>

I have log files being picked up and dissected fine when they are single line. I even have a multi line pattern ensuring that the message attribute contains all the lines I want. What I can't seem to figure out is how t…

---

## [Sending Log4j logs ( in XML format) to Elasticsearch](https://discuss.elastic.co/t/sending-log4j-logs-in-xml-format-to-elasticsearch/214387)

<div class="topic-metadata">

**Author:** [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\
**Replies:** 5\
**Last updated:** [January 16, 2020, 1:34pm UTC](https://discuss.elastic.co/t/sending-log4j-logs-in-xml-format-to-elasticsearch/214387 "2020-01-16T13:34:43Z")

</div>

Hello, I need to send log files generated using Log4j on client machines to Elasticsearch installed on a server. The logs are in XML format. Is there any other plugin, etc required, or can it just be done using Filebea…

---

## [Exception while starting Logstash \[LoadError: load error: jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1.ASN1Primitive overrides final method equals\]](https://discuss.elastic.co/t/exception-while-starting-logstash-loaderror-load-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1-asn1primitive-overrides-final-method-equals/51024)

<div class="topic-metadata">

**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\
**Replies:** 1\
**Last updated:** [May 26, 2016, 11:32am UTC](https://discuss.elastic.co/t/exception-while-starting-logstash-loaderror-load-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1-asn1primitive-overrides-final-method-equals/51024 "2016-05-26T11:32:04Z")

</div>

I am getting below exception while starting logstash \[logstash-1.5.3\]. Can any one please help me. LoadError: load error: jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1.ASN1Primitive overrides final …

---

## [How to make elasticdump faster](https://discuss.elastic.co/t/how-to-make-elasticdump-faster/334380)

<div class="topic-metadata">

**Author:** [@sonujatav35](https://discuss.elastic.co/u/sonujatav35)\
**Replies:** 4\
**Last updated:** [May 29, 2023, 7:24am UTC](https://discuss.elastic.co/t/how-to-make-elasticdump-faster/334380 "2023-05-29T07:24:05Z")

</div>

Hi Elastic Community members, I would like to know, Is there any way to speed up the elastic-dump. I need to migrate data from one elasticsearch to another elasticsearch cluster. I noticed for 1GB of data is taking aro…

---

## [Set indices based on a field value](https://discuss.elastic.co/t/set-indices-based-on-a-field-value/69579)

<div class="topic-metadata">

**Author:** [@YLombardi](https://discuss.elastic.co/u/YLombardi)\
**Replies:** 4\
**Last updated:** [December 21, 2016, 1:12pm UTC](https://discuss.elastic.co/t/set-indices-based-on-a-field-value/69579 "2016-12-21T13:12:58Z")

</div>

I'm trying to send my logs to multiple indices based on a field value. The exemple in the documentation works fine : https://www.elastic.co/guide/en/beats/filebeat/5.0/elasticsearch-output.html#\_indices But it is based o…

---

## [Aggregate query: Elasticsearch:java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/aggregate-query-elasticsearch-java-lang-outofmemoryerror-java-heap-space/187366)

<div class="topic-metadata">

**Author:** [@ErisDS](https://discuss.elastic.co/u/ErisDS)\
**Replies:** 7\
**Last updated:** [June 27, 2019, 11:05am UTC](https://discuss.elastic.co/t/aggregate-query-elasticsearch-java-lang-outofmemoryerror-java-heap-space/187366 "2019-06-27T11:05:25Z")

</div>

I have a single node on a 32GB RAM machine, running ES 5.6.2, which is collecting a reasonable volume of nginx logs. It's just about working well enough and we are in the process of moving over to a 3-node cluster with u…

---

## [Upload logfile in the kibana](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972)

<div class="topic-metadata">

**Author:** [@Son\_Vu\_Bao](https://discuss.elastic.co/u/Son_Vu_Bao)\
**Replies:** 6\
**Last updated:** [April 1, 2021, 3:22am UTC](https://discuss.elastic.co/t/upload-logfile-in-the-kibana/268972 "2021-04-01T03:22:01Z")

</div>

Hi, I am new in Elasticsearch. I am trying to upload a log file into elasticsearch by using data visualizer. However, I ran to some error like below:

---

## [Multiline codec is not working with filebeats plugin in logstash 2.0.0](https://discuss.elastic.co/t/multiline-codec-is-not-working-with-filebeats-plugin-in-logstash-2-0-0/33768)

<div class="topic-metadata">

**Author:** [@jaybm](https://discuss.elastic.co/u/jaybm)\
**Replies:** 6\
**Last updated:** [November 25, 2015, 2:19pm UTC](https://discuss.elastic.co/t/multiline-codec-is-not-working-with-filebeats-plugin-in-logstash-2-0-0/33768 "2015-11-25T14:19:17Z")

</div>

Multiline codec is not working with filebeats plugin (version 0.9.3) in logstash 2.0.0, were as logstash-forwarder plugin works perfectly fine. Here is the code that I am having problem with: input { beats { po…

---

## [Logs appear out of order when burst logging is done](https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843)

<div class="topic-metadata">

**Author:** [@sbsatter](https://discuss.elastic.co/u/sbsatter)\
**Replies:** 0\
**Last updated:** [August 30, 2017, 11:08am UTC](https://discuss.elastic.co/t/logs-appear-out-of-order-when-burst-logging-is-done/98843 "2017-08-30T11:08:33Z")

</div>

When the logs appear to have the same timestamps, some of it appears out of order. Reading through some of the topics, I couldn’t find a suitable solution. But I believe there must be something done about it since this i…

---

## [Multi-term synonyms: How can this be used in practice?](https://discuss.elastic.co/t/multi-term-synonyms-how-can-this-be-used-in-practice/219423)

<div class="topic-metadata">

**Author:** [@aj\_potc](https://discuss.elastic.co/u/aj_potc)\
**Replies:** 5\
**Last updated:** [March 11, 2020, 3:17am UTC](https://discuss.elastic.co/t/multi-term-synonyms-how-can-this-be-used-in-practice/219423 "2020-03-11T03:17:21Z")

</div>

I'm evaluating Elasticsearch 7.6 and its handling of multi-term (multi-word) synonyms, and I'm having a lot of trouble figuring out how to make practical use of it. In short: How can I take a user's query and present it…

---

## [KQL Query with wildcard and space not working (with wildcard type)](https://discuss.elastic.co/t/kql-query-with-wildcard-and-space-not-working-with-wildcard-type/267237)

<div class="topic-metadata">

**Author:** [@Sebastien\_Taniere](https://discuss.elastic.co/u/Sebastien_Taniere)\
**Replies:** 3\
**Last updated:** [March 22, 2021, 11:57pm UTC](https://discuss.elastic.co/t/kql-query-with-wildcard-and-space-not-working-with-wildcard-type/267237 "2021-03-22T23:57:29Z")

</div>

Hello, I used a wildcard field in my index mapping in order to be able to use wilcard in my logs. Now, I try to select some lines in my logs which begins with "Request finished" message:Request\* it is working but t…

---

## [Splitting index into smaller ones](https://discuss.elastic.co/t/splitting-index-into-smaller-ones/21405)

<div class="topic-metadata">

**Author:** [@ElasticSearch\_Users\_](https://discuss.elastic.co/u/ElasticSearch_Users_)\
**Replies:** 4\
**Last updated:** [December 27, 2014, 5:13pm UTC](https://discuss.elastic.co/t/splitting-index-into-smaller-ones/21405 "2014-12-27T17:13:25Z")

</div>

Hello, Currently i have one index (by day) which contains logs from several applications. The size is ~50-80Gb/day. We often searches/aggregate documents by applications. So would it be better to split this index into…

---

## [Elasticsearch garbage collection problem](https://discuss.elastic.co/t/elasticsearch-garbage-collection-problem/129758)

<div class="topic-metadata">

**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\
**Replies:** 7\
**Last updated:** [April 27, 2018, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-garbage-collection-problem/129758 "2018-04-27T10:43:20Z")

</div>

Hi, I have a cluster with four nodes to collect netflow , and every node has 16G RAM. So I set JAVA heap 8G. After working about three or four days the elasticsearch start to garbage collection(about 30 min) ,which cause…

---

## [Index Bulk Queue Size Update](https://discuss.elastic.co/t/index-bulk-queue-size-update/32045)

<div class="topic-metadata">

**Author:** [@Adarsh\_Jupudi](https://discuss.elastic.co/u/Adarsh_Jupudi)\
**Replies:** 2\
**Last updated:** [October 13, 2015, 2:18am UTC](https://discuss.elastic.co/t/index-bulk-queue-size-update/32045 "2015-10-13T02:18:53Z")

</div>

I have updated the bulk queue size of the cluster using the Cluster API settings. I am trying to understand if this is the way to go about it. curl -XPUT localhost:9200/\_cluster/settings -d '{"persistent" : {"threadpo…

---

## [Cannot connect to Kibana through public IP created on GCE](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-public-ip-created-on-gce/100142)

<div class="topic-metadata">

**Author:** [@8-bit](https://discuss.elastic.co/u/8-bit)\
**Replies:** 3\
**Last updated:** [September 13, 2017, 3:58pm UTC](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-public-ip-created-on-gce/100142 "2017-09-13T15:58:26Z")

</div>

Cannot get Kibana's public IP to work from google compute engine. Says the site cannot be reached, though Elasticsearch works through public IP if I change the elasticsearch.yml from localhost to 0.0.0.0 Turned off ngin…

---

## [Indexed document has an unknown field](https://discuss.elastic.co/t/indexed-document-has-an-unknown-field/223356)

<div class="topic-metadata">

**Author:** [@ethranes](https://discuss.elastic.co/u/ethranes)\
**Replies:** 3\
**Last updated:** [March 13, 2020, 2:37pm UTC](https://discuss.elastic.co/t/indexed-document-has-an-unknown-field/223356 "2020-03-13T14:37:22Z")

</div>

Hi, I've made an index using dynamic mapping. The document that I've used when creating it looks like this; { "graph":{ "id":601, "name":"Graph", "labels":\[ { "user":"\*B", "id":16, …

---

## [Duplication of data due to logstash configuration](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382)

<div class="topic-metadata">

**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Replies:** 6\
**Last updated:** [May 29, 2021, 4:15pm UTC](https://discuss.elastic.co/t/duplication-of-data-due-to-logstash-configuration/274382 "2021-05-29T16:15:49Z")

</div>

Hello, I hope you and your loved ones are safe and healthy. I am suspecting multiple copies of the same data being created due to faulty logstash configuration. Here is the ingestion pipeline: Log files in JSON file …

---

## [How to get ES aggregation data as Logstash input?](https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776)

<div class="topic-metadata">

**Author:** [@KIVagant](https://discuss.elastic.co/u/KIVagant)\
**Replies:** 4\
**Last updated:** [March 14, 2017, 4:46pm UTC](https://discuss.elastic.co/t/how-to-get-es-aggregation-data-as-logstash-input/64776 "2017-03-14T16:46:16Z")

</div>

I have a Logstash configuration with the 'elasticsearch' input. input { elasticsearch { hosts =\> "localhost" index =\> "logstash-\*" type =\> 'aggregation\_metric' size =\> 0 query =\> ' { …

---

## [Haproxy strconv.ParseFloat: parsing "": invalid syntax](https://discuss.elastic.co/t/haproxy-strconv-parsefloat-parsing-invalid-syntax/181403)

<div class="topic-metadata">

**Author:** [@yasin](https://discuss.elastic.co/u/yasin)\
**Replies:** 7\
**Last updated:** [May 24, 2019, 1:54pm UTC](https://discuss.elastic.co/t/haproxy-strconv-parsefloat-parsing-invalid-syntax/181403 "2019-05-24T13:54:44Z")

</div>

Dear Elastic Team, I've configured the haproxy but still receiving the following error message: "strconv.ParseFloat: parsing "": invalid syntax" as shown below. I'm wondering what i'm doing wrong. i also do not get the…

---

## [Grok add\_field creates two values](https://discuss.elastic.co/t/grok-add-field-creates-two-values/54277)

<div class="topic-metadata">

**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\
**Replies:** 1\
**Last updated:** [June 29, 2016, 12:37pm UTC](https://discuss.elastic.co/t/grok-add-field-creates-two-values/54277 "2016-06-29T12:37:52Z")

</div>

Hi, I'm using logstash 2.1, and I have the following filter: if ("sha1\_hash" in \[hash\_field\]) { grok { patterns\_dir =\> \["/opt/logstash/patterns"\] match =\> {"sha1\_hash: %{SHA1:sha1}"} add\_fie…

---

## [Unable to find JRuby](https://discuss.elastic.co/t/unable-to-find-jruby/33532)

<div class="topic-metadata">

**Author:** [@clemo](https://discuss.elastic.co/u/clemo)\
**Replies:** 1\
**Last updated:** [December 9, 2015, 2:00pm UTC](https://discuss.elastic.co/t/unable-to-find-jruby/33532 "2015-12-09T14:00:45Z")

</div>

Hi, Total newbie to logstash, have just downloaded it and unzipped it and then tried to execute the example on your webpages logstash-2.0.0\>bin\\logstash -e 'input { stdin { } } output { stdout {} }' and get the foll…

---

## [Help with a Custom Kibana Visualization :: Combine data in a table, then multiply two columns?](https://discuss.elastic.co/t/help-with-a-custom-kibana-visualization-combine-data-in-a-table-then-multiply-two-columns/202557)

<div class="topic-metadata">

**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Replies:** 6\
**Last updated:** [October 29, 2019, 7:22pm UTC](https://discuss.elastic.co/t/help-with-a-custom-kibana-visualization-combine-data-in-a-table-then-multiply-two-columns/202557 "2019-10-29T19:22:00Z")

</div>

Hello Kibana gurus, Boy, I need your help. I have built a network sFlow collector, which collects a lot of network data. That data is successfully flowing into Elasticsearch & Kibana. Let’s say for a toy example, I c…

---

## [How to access remotely to elasticsearch 5?](https://discuss.elastic.co/t/how-to-access-remotely-to-elasticsearch-5/65211)

<div class="topic-metadata">

**Author:** [@sen](https://discuss.elastic.co/u/sen)\
**Replies:** 6\
**Last updated:** [November 21, 2016, 8:36am UTC](https://discuss.elastic.co/t/how-to-access-remotely-to-elasticsearch-5/65211 "2016-11-21T08:36:28Z")

</div>

Hello folks, I want to access remotely to my elasticsearch version 5. I tried to add this line in the elasticseach.yml file as I did with elassticsearch version 4 (which worked): network.bind\_host: 0.0.0.0 however, …

---

## [New elasticsearch-java API \`CreateIndexRequest\` using \`.withJson\` causes \`co.elastic.clients.util.MissingRequiredPropertyException\`](https://discuss.elastic.co/t/new-elasticsearch-java-api-createindexrequest-using-withjson-causes-co-elastic-clients-util-missingrequiredpropertyexception/308303)

<div class="topic-metadata">

**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\
**Replies:** 1\
**Last updated:** [June 28, 2022, 2:24am UTC](https://discuss.elastic.co/t/new-elasticsearch-java-api-createindexrequest-using-withjson-causes-co-elastic-clients-util-missingrequiredpropertyexception/308303 "2022-06-28T02:24:46Z")

</div>

I am having a hard time on using the new elasticsearch-java api client. I am migrating from HLRC to the new elasticsearch java api. When I create an index, I used CreateIndexRequest and load it with json source But w…

---

## [Installing elasticsearch-head plugin without internet access](https://discuss.elastic.co/t/installing-elasticsearch-head-plugin-without-internet-access/6638)

<div class="topic-metadata">

**Author:** [@Nakul\_Jhalani](https://discuss.elastic.co/u/Nakul_Jhalani)\
**Replies:** 4\
**Last updated:** [February 9, 2012, 8:20pm UTC](https://discuss.elastic.co/t/installing-elasticsearch-head-plugin-without-internet-access/6638 "2012-02-09T20:20:02Z")

</div>

This is my first post so want to start with how awesome and easy to use ES. Great job Shay and community! We are starting to migrate and elasticsearch-head looks like a nice tool for admin. However the box where we ar…

---

## [Optimal value for indices.query.bool.max\_clause\_count](https://discuss.elastic.co/t/optimal-value-for-indices-query-bool-max-clause-count/117645)

<div class="topic-metadata">

**Author:** [@ffoysal](https://discuss.elastic.co/u/ffoysal)\
**Replies:** 3\
**Last updated:** [January 30, 2018, 6:42pm UTC](https://discuss.elastic.co/t/optimal-value-for-indices-query-bool-max-clause-count/117645 "2018-01-30T18:42:23Z")

</div>

We have 200K documents and each one has a title field. When we search for a single letter, it will generate huge number of search hits. Just wondering what value should we chose for the setting indices.query.bool.max\_cl…

---

## [ECS field for application data and payloads](https://discuss.elastic.co/t/ecs-field-for-application-data-and-payloads/254131)

<div class="topic-metadata">

**Author:** [@strokirk](https://discuss.elastic.co/u/strokirk)\
**Replies:** 3\
**Last updated:** [November 4, 2020, 5:04pm UTC](https://discuss.elastic.co/t/ecs-field-for-application-data-and-payloads/254131 "2020-11-04T17:04:47Z")

</div>

Hi, I'd like to hear if there are any suggestions in the ECS framework on how to provide app-specific fields. Do you use your own namespace for that, or just put it in the global namespace? Any recommendations for field…

---

## [Elastic password reset error -](https://discuss.elastic.co/t/elastic-password-reset-error/114705)

<div class="topic-metadata">

**Author:** [@vigneshaj](https://discuss.elastic.co/u/vigneshaj)\
**Replies:** 2\
**Last updated:** [January 17, 2018, 9:57am UTC](https://discuss.elastic.co/t/elastic-password-reset-error/114705 "2018-01-17T09:57:58Z")

</div>

Hi I am followng the below answer to reset the elastic password. {"error":{"root\_cause":\[{"type":"unavailable\_shards\_exception","reason":"\[.security-6\]\[0\] \[1\] shardIt, \[0\] active : Timeout waiting for \[1m\], request: …

---

## [Automatic setup problem](https://discuss.elastic.co/t/automatic-setup-problem/169789)

<div class="topic-metadata">

**Author:** [@se7en](https://discuss.elastic.co/u/se7en)\
**Replies:** 4\
**Last updated:** [February 26, 2019, 6:48am UTC](https://discuss.elastic.co/t/automatic-setup-problem/169789 "2019-02-26T06:48:47Z")

</div>

Am testing Automatic setup with apm-agent-attach-1.4.0.jar aways exception like this: 2019-02-25 16:19:48.878 INFO Attaching the Elastic APM agent to 8848 Exception in thread "main" java.lang.IllegalStateException: N…

---

## [Convert Ticks to @timestamp in logstash with Ruby-plugin](https://discuss.elastic.co/t/convert-ticks-to-timestamp-in-logstash-with-ruby-plugin/58457)

<div class="topic-metadata">

**Author:** [@cvanhalt](https://discuss.elastic.co/u/cvanhalt)\
**Replies:** 4\
**Last updated:** [August 20, 2016, 9:43pm UTC](https://discuss.elastic.co/t/convert-ticks-to-timestamp-in-logstash-with-ruby-plugin/58457 "2016-08-20T21:43:25Z")

</div>

I query every minute against a MSSQL Database with jdbc-plugin. In this Database my timestamp is stored in ticks. Field-name is lastupdate. Now I wanted to convert the lastupdate field to a timestamp-format and then over…

---

## [Replicas reduce performance complex queries drastically?](https://discuss.elastic.co/t/replicas-reduce-performance-complex-queries-drastically/148310)

<div class="topic-metadata">

**Author:** [@cdekker](https://discuss.elastic.co/u/cdekker)\
**Replies:** 5\
**Last updated:** [September 19, 2018, 10:18am UTC](https://discuss.elastic.co/t/replicas-reduce-performance-complex-queries-drastically/148310 "2018-09-19T10:18:37Z")

</div>

We are seeing some very strange query performance on most of our indices when replicas are enabled. Since we require high availability and all our data nodes are directly on local SSD drives we use 2 replicas for all ind…

[Previous page](https://discuss.elastic.co/top.md?page=494&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=496&per_page=50&period=all)
