# Top **URL:** https://discuss.elastic.co/top.md?page=499&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 500 --- ## [Reindex Existing data through ILM](https://discuss.elastic.co/t/reindex-existing-data-through-ilm/179429)
**Author:** [@pattercw](https://discuss.elastic.co/u/pattercw)\ **Replies:** 6\ **Last updated:** [May 3, 2019, 5:15pm UTC](https://discuss.elastic.co/t/reindex-existing-data-through-ilm/179429 "2019-05-03T17:15:45Z")
Hello: We are in the process of switching over to ILM (Index Lifecycle Management) and we're using Elasticsearch 6.6.1. One of the reasons why is that we want to control the size of our indices, and thus control our sh… --- ## [\\Java\\jre1.8.0\_201\\bin\\java.exe was unexpected at this time](https://discuss.elastic.co/t/java-jre1-8-0-201-bin-java-exe-was-unexpected-at-this-time/168105)
**Author:** [@bob28](https://discuss.elastic.co/u/bob28)\ **Replies:** 1\ **Last updated:** [February 17, 2019, 11:50pm UTC](https://discuss.elastic.co/t/java-jre1-8-0-201-bin-java-exe-was-unexpected-at-this-time/168105 "2019-02-17T23:50:52Z")
Hi, I am trying to start the elasticsearch and getting below message. I have upgraded my java version to jre1.8.0\_201 and then when I start it, I am facing this issue. \\Java\\jre1.8.0\_201\\bin\\java.exe was unexpected at … --- ## [Index auto increment issue](https://discuss.elastic.co/t/index-auto-increment-issue/87040)
**Author:** [@kamran.matloob](https://discuss.elastic.co/u/kamran.matloob)\ **Replies:** 7\ **Last updated:** [June 26, 2017, 8:39am UTC](https://discuss.elastic.co/t/index-auto-increment-issue/87040 "2017-06-26T08:39:30Z")
My requirement is to rollover indices after 7days. I successfully created dynamic index in my logstsh.conf file by using below link https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-aliases.html Below I… --- ## [Logstash logs all inputs to syslog](https://discuss.elastic.co/t/logstash-logs-all-inputs-to-syslog/84499)
**Author:** [@nicklaw](https://discuss.elastic.co/u/nicklaw)\ **Replies:** 2\ **Last updated:** [May 8, 2017, 1:27am UTC](https://discuss.elastic.co/t/logstash-logs-all-inputs-to-syslog/84499 "2017-05-08T01:27:18Z")
Logstash version: 5.3.2 OS: Ubuntu 16.04 I have issue that sees anything that comes through the Logstash Input get appended to the system's syslog, even if I have log.level: fatal set in the configuration file. Is this… --- ## [Ruby filter - how to access JSON fields when using the json codec](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071)
**Author:** [@anon24174512](https://discuss.elastic.co/u/anon24174512)\ **Replies:** 5\ **Last updated:** [January 19, 2018, 6:46am UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071 "2018-01-19T06:46:14Z")
Dear all, I have two payload.longitude and payload.latitude fields I can display in Kibana. There type in the elasticsearch mapping is float. I want to divide them by 1000000 and set the values of the corresponding lat… --- ## [FileBeat Not sending to kafka](https://discuss.elastic.co/t/filebeat-not-sending-to-kafka/104364)
**Author:** [@zubair777](https://discuss.elastic.co/u/zubair777)\ **Replies:** 7\ **Last updated:** [October 23, 2017, 2:46pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-to-kafka/104364 "2017-10-23T14:46:56Z")
HI All I m faced with an issue where my filebeat instance is either not sending files to my Kafka instances or its not reding the spicified log file in my filebeat.yml config my config looks like this : output.kafka: … --- ## [Creating multiple snapshots one after other immediatly](https://discuss.elastic.co/t/creating-multiple-snapshots-one-after-other-immediatly/106926)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 4\ **Last updated:** [November 9, 2017, 4:04am UTC](https://discuss.elastic.co/t/creating-multiple-snapshots-one-after-other-immediatly/106926 "2017-11-09T04:04:07Z")
Hi All....... Here i am trying to create two snapshots at a time from Kibana devtool here are my commands looks like PUT /\_snapshot/repo/dev\_1?wait\_for\_completion=true PUT /\_snapshot/repo/dev\_2?wait\_for\_completion=tru… --- ## [Filebeat send different files to different output](https://discuss.elastic.co/t/filebeat-send-different-files-to-different-output/139036)
**Author:** [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Replies:** 1\ **Last updated:** [July 8, 2018, 1:48pm UTC](https://discuss.elastic.co/t/filebeat-send-different-files-to-different-output/139036 "2018-07-08T13:48:33Z")
Hi, We have a requirement where we need to parse two different logs using filebeat. Send the first file content to Kafka Since the second file has lot of irrelevant information, some basic filtering will be done in fi… --- ## [Indices.store.throttle.type: none and max\_bytes\_per\_sec (ES 1.7.x), should I raise max\_bytes\_per\_sec on RAID?](https://discuss.elastic.co/t/indices-store-throttle-type-none-and-max-bytes-per-sec-es-1-7-x-should-i-raise-max-bytes-per-sec-on-raid/45125)
**Author:** [@unknownunknown](https://discuss.elastic.co/u/unknownunknown)\ **Replies:** 4\ **Last updated:** [March 28, 2016, 1:09pm UTC](https://discuss.elastic.co/t/indices-store-throttle-type-none-and-max-bytes-per-sec-es-1-7-x-should-i-raise-max-bytes-per-sec-on-raid/45125 "2016-03-28T13:09:24Z")
I'm having issues with merge throttling indexing. Setting "indices.store.throttle.type" to "none" doesn't seem to prevent throttling if max\_merge\_count is exceeded. I don't have SSDs, but the server that I am using has… --- ## [Problem after disable \_source field](https://discuss.elastic.co/t/problem-after-disable--source-field/98262)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 5\ **Last updated:** [August 24, 2017, 7:01pm UTC](https://discuss.elastic.co/t/problem-after-disable--source-field/98262 "2017-08-24T19:01:54Z")
I am using logstash 1.3 to inject data into elasticsearch 5.1, it works fine and extract several fields from the messages when I added the following line to the index template setting , and it stopped extracting field … --- ## [Elastic APM(8.5.0) - error querying cluster\_uuid](https://discuss.elastic.co/t/elastic-apm-8-5-0-error-querying-cluster-uuid/323097)
**Author:** [@ragur](https://discuss.elastic.co/u/ragur)\ **Replies:** 7\ **Last updated:** [January 17, 2023, 9:32am UTC](https://discuss.elastic.co/t/elastic-apm-8-5-0-error-querying-cluster-uuid/323097 "2023-01-17T09:32:41Z")
Kibana version: 8.5.0 Elasticsearch version: 8.5.0 APM Server version: 8.5.0 APM Agent language and version: Java, 1.35.0 Browser version: Chrome, 105.0.5195.102 Original install method (e.g. download page, yum, deb… --- ## [Parsing Symantec Enterprise Protection (SEPM) Syslog messages in logstash](https://discuss.elastic.co/t/parsing-symantec-enterprise-protection-sepm-syslog-messages-in-logstash/176977)
**Author:** [@TimoHar](https://discuss.elastic.co/u/TimoHar)\ **Replies:** 7\ **Last updated:** [April 17, 2019, 7:21pm UTC](https://discuss.elastic.co/t/parsing-symantec-enterprise-protection-sepm-syslog-messages-in-logstash/176977 "2019-04-17T19:21:36Z")
SEPM sends syslog messages in batches at a time interval that is user specified. According to our SEP manager, it is not able to send them one at a time. The message field separates each message with the \\r (carriage r… --- ## [Metric visual for number occurrences of a field and apply arithmetic](https://discuss.elastic.co/t/metric-visual-for-number-occurrences-of-a-field-and-apply-arithmetic/50699)
**Author:** [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Replies:** 7\ **Last updated:** [June 1, 2016, 7:52am UTC](https://discuss.elastic.co/t/metric-visual-for-number-occurrences-of-a-field-and-apply-arithmetic/50699 "2016-06-01T07:52:40Z")
Hi, I have read https://www.elastic.co/blog/kibana-4-beta-3-now-more-filtery and https://qbox.io/blog/elasticsearch-scripting-aggregations-2 but I cannot see how to use Kibana to fulfill my use-case: I log an "event"… --- ## [How do I undo a decommission of an IP?](https://discuss.elastic.co/t/how-do-i-undo-a-decommission-of-an-ip/15500)
**Author:** [@Martin\_Stabenfeldt](https://discuss.elastic.co/u/Martin_Stabenfeldt)\ **Replies:** 2\ **Last updated:** [January 31, 2014, 8:35am UTC](https://discuss.elastic.co/t/how-do-i-undo-a-decommission-of-an-ip/15500 "2014-01-31T08:35:26Z")
Hi, I've decommissioned a node by it's IP. curl -XPUT localhost:9200/\_cluster/settings -d '{ "transient" : { "cluster.routing.allocation.exclude.\_ip" : "10.0.0.1" } }' How can I remove that s… --- ## [Add Index 7.1.0 "index.mapper.dynamic was removed after version 6.0.0"](https://discuss.elastic.co/t/add-index-7-1-0-index-mapper-dynamic-was-removed-after-version-6-0-0/183067)
**Author:** [@SpinDORK](https://discuss.elastic.co/u/SpinDORK)\ **Replies:** 3\ **Last updated:** [May 28, 2019, 12:38pm UTC](https://discuss.elastic.co/t/add-index-7-1-0-index-mapper-dynamic-was-removed-after-version-6-0-0/183067 "2019-05-28T12:38:03Z")
Hi, I have recently installed ElasticSearch and Kibana 7.1.0 and I'm trying to use the Document API to submit a new Index to ElasticSearch, I'm using the same method and json file as we used for ElasticSearch v6.5.4 how… --- ## [\[Logstash\] - Exception in Pipelineworker](https://discuss.elastic.co/t/logstash-exception-in-pipelineworker/105191)
**Author:** [@azam](https://discuss.elastic.co/u/azam)\ **Replies:** 3\ **Last updated:** [November 11, 2017, 9:51pm UTC](https://discuss.elastic.co/t/logstash-exception-in-pipelineworker/105191 "2017-11-11T21:51:11Z")
Hi everyone I am a new user to ELK stack. I tried to setup elastic stack on my local machine but logstash doesn't work for me. I tried to debug, it showed an error "Exception in pipelineworker". Please help ! My logsta… --- ## [Kibana Iframe communicator: What is APP-STATE?](https://discuss.elastic.co/t/kibana-iframe-communicator-what-is-app-state/141000)
**Author:** [@Amey\_G](https://discuss.elastic.co/u/Amey_G)\ **Replies:** 2\ **Last updated:** [July 29, 2018, 2:15am UTC](https://discuss.elastic.co/t/kibana-iframe-communicator-what-is-app-state/141000 "2018-07-29T02:15:39Z")
I am trying to use Kibana Iframce request and I saw the post which says: myIframe.contentWindow.postMessage('searchRequest###' + this.iframeFinalUrl, '\*'); this.iframeFinalUrl is your kibana URI containing the complet… --- ## [Trying to show all records in given time range using "size:0"](https://discuss.elastic.co/t/trying-to-show-all-records-in-given-time-range-using-size-0/114352)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 3\ **Last updated:** [January 8, 2018, 5:21am UTC](https://discuss.elastic.co/t/trying-to-show-all-records-in-given-time-range-using-size-0/114352 "2018-01-08T05:21:09Z")
I tried searching to find an option for this question. But all says to put the size value in the query to get the output. Rather than, define the size value in the query \[ by default it returns 10 records \], I need to s… --- ## [Creating mappings via the Java API](https://discuss.elastic.co/t/creating-mappings-via-the-java-api/6303)
**Author:** [@Frank\_LaRosa](https://discuss.elastic.co/u/Frank_LaRosa)\ **Replies:** 8\ **Last updated:** [January 7, 2012, 7:55pm UTC](https://discuss.elastic.co/t/creating-mappings-via-the-java-api/6303 "2012-01-07T19:55:19Z")
Hi, I'm just getting started with Elasticsearch. My first goal is to create a particular index. I'm an experienced Solr/Lucene user, so I've already designed what I want in terms of field names, types, analyizers, … --- ## [How to update and add new filed in the existing Document?](https://discuss.elastic.co/t/how-to-update-and-add-new-filed-in-the-existing-document/102368)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 2\ **Last updated:** [October 3, 2017, 8:49am UTC](https://discuss.elastic.co/t/how-to-update-and-add-new-filed-in-the-existing-document/102368 "2017-10-03T08:49:06Z")
Hi Experts, I want to update a specific field value in a document . Also I want to add new filed in this document . So here is the document that I want to update GET \_search { "query": { "query\_string": { "query": … --- ## [Snapshot creation to s3 is failing with unknown field name min\_version](https://discuss.elastic.co/t/snapshot-creation-to-s3-is-failing-with-unknown-field-name-min-version/220990)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 3\ **Last updated:** [February 26, 2020, 12:50pm UTC](https://discuss.elastic.co/t/snapshot-creation-to-s3-is-failing-with-unknown-field-name-min-version/220990 "2020-02-26T12:50:01Z")
Hi, I created a s3 repository and verified that its getting connected by verify repository. Verification status : Connected However, when I try to put a snapshot, its throwing parse exception. PUT /\_snapshot/elk-snap… --- ## [Docker host node Java opts](https://discuss.elastic.co/t/docker-host-node-java-opts/107448)
**Author:** [@Tyler\_Siemers](https://discuss.elastic.co/u/Tyler_Siemers)\ **Replies:** 3\ **Last updated:** [November 15, 2017, 2:50pm UTC](https://discuss.elastic.co/t/docker-host-node-java-opts/107448 "2017-11-15T14:50:05Z")
I am in the process of going from dev to a production model of the Elastic stack with docker compose. I have a few newbie questions about java mem and heap sizes. The docker host box has a total of 24gb of ram. In my … --- ## [ES Plugin add to Node server programmatically](https://discuss.elastic.co/t/es-plugin-add-to-node-server-programmatically/37616)
**Author:** [@ycunc](https://discuss.elastic.co/u/ycunc)\ **Replies:** 6\ **Last updated:** [December 20, 2015, 10:40pm UTC](https://discuss.elastic.co/t/es-plugin-add-to-node-server-programmatically/37616 "2015-12-20T22:40:36Z")
Hello I am trying to add ES plugin to a Node server programmatically. For example, 1) Plugin is something like this https://github.com/imotov/elasticsearch-native-script-example and compiled it and I can install it w… --- ## [Which: no javac for local plugin installation](https://discuss.elastic.co/t/which-no-javac-for-local-plugin-installation/86181)
**Author:** [@lgee](https://discuss.elastic.co/u/lgee)\ **Replies:** 2\ **Last updated:** [May 24, 2017, 9:32pm UTC](https://discuss.elastic.co/t/which-no-javac-for-local-plugin-installation/86181 "2017-05-24T21:32:02Z")
I have a logstash dockerfile which uses the elastic docker 5.3.2 image (docker.elastic.co/logstash/logstash:5.3.2) as a base and installs 3 local gem plugins which aren't in the logstash plugin repository. If I bump the… --- ## [\[SOLVED\] Can Kibana discover documents from an index alias name?](https://discuss.elastic.co/t/solved-can-kibana-discover-documents-from-an-index-alias-name/67454)
**Author:** [@cbismuth](https://discuss.elastic.co/u/cbismuth)\ **Replies:** 7\ **Last updated:** [December 2, 2016, 10:09pm UTC](https://discuss.elastic.co/t/solved-can-kibana-discover-documents-from-an-index-alias-name/67454 "2016-12-02T22:09:47Z")
Hi, I've an index named logstash-1480234219918 and an alias named logstash-current pointing to it. The two URLs below return the same document: http://elasticsearch.cloudera:9200/logstash-1480234219918/sd-output/A… --- ## [Recommended way of storing credentials in Beats configuration file?](https://discuss.elastic.co/t/recommended-way-of-storing-credentials-in-beats-configuration-file/235081)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 1\ **Last updated:** [May 31, 2020, 9:23pm UTC](https://discuss.elastic.co/t/recommended-way-of-storing-credentials-in-beats-configuration-file/235081 "2020-05-31T21:23:29Z")
What is the recommended way of storing the credentials like username and passwords in the beats configuration file? Our deployment is via terraform and ansible, which essentially stores the credentials in the environmen… --- ## [Multiple primary shards vs Replicas - why?](https://discuss.elastic.co/t/multiple-primary-shards-vs-replicas-why/113956)
**Author:** [@afrozl](https://discuss.elastic.co/u/afrozl)\ **Replies:** 2\ **Last updated:** [January 5, 2018, 3:17pm UTC](https://discuss.elastic.co/t/multiple-primary-shards-vs-replicas-why/113956 "2018-01-05T15:17:14Z")
If I understand correctly, the benefits of creating indices with multiple primary shards is to allow for parallelization in reads/writes as well as the ability to segregate documents to specific shards via routing. How… --- ## [How can i stop filebeat without killing the process?](https://discuss.elastic.co/t/how-can-i-stop-filebeat-without-killing-the-process/53560)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 1\ **Last updated:** [June 21, 2016, 7:43pm UTC](https://discuss.elastic.co/t/how-can-i-stop-filebeat-without-killing-the-process/53560 "2016-06-21T19:43:08Z")
I did an rpm install and ran my filebeat process with /etc/init.d/filebeat start. i want to change filebeat.yml, so i am trying to stop and restart filebeat. How can I stop filebeat without manually killing the process? … --- ## [NullPointerException in Elasticsearch when adding Index Pattern in kibana](https://discuss.elastic.co/t/nullpointerexception-in-elasticsearch-when-adding-index-pattern-in-kibana/187817)
**Author:** [@marekm](https://discuss.elastic.co/u/marekm)\ **Replies:** 5\ **Last updated:** [June 28, 2019, 12:37pm UTC](https://discuss.elastic.co/t/nullpointerexception-in-elasticsearch-when-adding-index-pattern-in-kibana/187817 "2019-06-28T12:37:49Z")
Hey, I noticed the following exception in the Elasticsearch logs \[2019-06-27T13:05:54,761\]\[DEBUG\]\[o.e.a.f.TransportFieldCapabilitiesIndexAction\] \[mpps-st-elastic-1\] null: failed to execute \[org.elasticsearch.action.fie… --- ## [Java REST Client and Multithreading](https://discuss.elastic.co/t/java-rest-client-and-multithreading/123298)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 6\ **Last updated:** [March 9, 2018, 5:36pm UTC](https://discuss.elastic.co/t/java-rest-client-and-multithreading/123298 "2018-03-09T17:36:41Z")
Is the Java REST Client Thread safe? Can I instantiate a single client object and share among the threads? Or should I open separate connections in each thread? --- ## [クエリの結果が文字化けすることがある](https://discuss.elastic.co/t/topic/109679)
**Author:** [@Skane](https://discuss.elastic.co/u/Skane)\ **Replies:** 3\ **Last updated:** [December 1, 2017, 3:20am UTC](https://discuss.elastic.co/t/topic/109679 "2017-12-01T03:20:57Z")
お世話になっております。 今、１時間ごとにElasicserachに突っ込まれている日本語を含んだデータをクエリで引っ掛けた結果をサイトに情報として流しているのですが、 そのクエリ結果の一部日本語の文字化けが１日に数回発生しております。 ドキュメントの中身は更新されておりませんし、毎度同じクエリでデータを取得しております。 また、文字化けして返却されるデータは、ある１文字が必ず"���"の特殊文字3文字に変換されて返却されます。 … --- ## [Elastic 8.10.3 failed to establish trust with server at \[\\]; the server provided a certificate with subject name](https://discuss.elastic.co/t/elastic-8-10-3-failed-to-establish-trust-with-server-at-unknown-host-the-server-provided-a-certificate-with-subject-name/345656)
**Author:** [@efrainMZ](https://discuss.elastic.co/u/efrainMZ)\ **Replies:** 8\ **Last updated:** [October 29, 2023, 11:21am UTC](https://discuss.elastic.co/t/elastic-8-10-3-failed-to-establish-trust-with-server-at-unknown-host-the-server-provided-a-certificate-with-subject-name/345656 "2023-10-29T11:21:41Z")
Hello good morning! I am trying to create an elastic cluster in version 8.10.3 but when starting the coordinator role I get the following error: \[ithrtc3aen1elk1-coordinator-1\] failed to establish trust with server at … --- ## [Geoip.location not being created](https://discuss.elastic.co/t/geoip-location-not-being-created/110890)
**Author:** [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Replies:** 8\ **Last updated:** [December 11, 2017, 8:22pm UTC](https://discuss.elastic.co/t/geoip-location-not-being-created/110890 "2017-12-11T20:22:03Z")
I'm looking to use the geoip.location field but it's not being created. I've found a ton of articles about updating it to a geo\_point type but I'm not finding any about the issue of it simply not being created. Odd thing… --- ## [New collectd types do not show up in logstash/ES](https://discuss.elastic.co/t/new-collectd-types-do-not-show-up-in-logstash-es/42727)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 8\ **Last updated:** [February 26, 2016, 8:25pm UTC](https://discuss.elastic.co/t/new-collectd-types-do-not-show-up-in-logstash-es/42727 "2016-02-26T20:25:17Z")
I've created a collectd exec plugin with new collectd data types to send to logstash+ES, I get the ES documents but amputated without the new data type fields and wonder why. Hints appreciated, TIA. new collectd type: $… --- ## [MasterNotDiscoveredException with RHEL 7 Firewall on LS 1.4.2 & ES 1.2.1](https://discuss.elastic.co/t/masternotdiscoveredexception-with-rhel-7-firewall-on-ls-1-4-2-es-1-2-1/32568)
**Author:** [@mdconner](https://discuss.elastic.co/u/mdconner)\ **Replies:** 8\ **Last updated:** [October 23, 2015, 5:39pm UTC](https://discuss.elastic.co/t/masternotdiscoveredexception-with-rhel-7-firewall-on-ls-1-4-2-es-1-2-1/32568 "2015-10-23T17:39:14Z")
After opening ports 9200 and 9300-9400 for TCP & UDP, I get this error from Logstash. I am running both on the same Red Hat Enterprise Linux 7.0 server and can successfully log data when the firewall (firewalld) is disab… --- ## [ES and SAN storage](https://discuss.elastic.co/t/es-and-san-storage/17285)
**Author:** [@Patrick\_Proniewski](https://discuss.elastic.co/u/Patrick_Proniewski)\ **Replies:** 5\ **Last updated:** [April 30, 2014, 8:43pm UTC](https://discuss.elastic.co/t/es-and-san-storage/17285 "2014-04-30T20:43:25Z")
Hello, I'm still testing ES at a very small scale (1 node on a multipurpose server), but I would like to extend it's use at work as a backend for logstash. It means that the LS+ES cluster would have to eat few GB of d… --- ## [Restore all User created Indices, exclude the indices starting with](https://discuss.elastic.co/t/restore-all-user-created-indices-exclude-the-indices-starting-with/324428)
**Author:** [@x00m](https://discuss.elastic.co/u/x00m)\ **Replies:** 6\ **Last updated:** [February 17, 2023, 5:16am UTC](https://discuss.elastic.co/t/restore-all-user-created-indices-exclude-the-indices-starting-with/324428 "2023-02-17T05:16:12Z")
I am trying to ALL restore user created indices. I don't want to restore the .geoip\_databases, .security, .ds-.logs-deprecation.elasticsearch-default\* and so on. I tried this :- { "indices": "\*", "include\_global\_sta… --- ## [Filbeats not forwarding logs to logstash with back off now error](https://discuss.elastic.co/t/filbeats-not-forwarding-logs-to-logstash-with-back-off-now-error/137637)
**Author:** [@01n12](https://discuss.elastic.co/u/01n12)\ **Replies:** 6\ **Last updated:** [July 6, 2018, 12:58pm UTC](https://discuss.elastic.co/t/filbeats-not-forwarding-logs-to-logstash-with-back-off-now-error/137637 "2018-07-06T12:58:54Z")
I'm facing a problem to forward logs from filebeats to logstash, my filbeats always throw a debug value backoff now and the following are logs of it, would some help me and also please help me to reprocess the logs from … --- ## [Failed action with response of 400, dropping action](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action/28802)
**Author:** [@angelsmile](https://discuss.elastic.co/u/angelsmile)\ **Replies:** 6\ **Last updated:** [September 11, 2015, 5:08am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action/28802 "2015-09-11T05:08:20Z")
Hi, For the following log: Job Start Summary: jobid=2291646.r-man2 project=p08 user=rnt651@raijin1 queue=express-node ncpus=16 mem\_requested=8gb walltime=16:00:00 cpu\_hrs=768.0 jobfs\_local=8gb jobfs\_global=None When… --- ## [Parse JSON stringified value of a field of an object in the array of objects](https://discuss.elastic.co/t/parse-json-stringified-value-of-a-field-of-an-object-in-the-array-of-objects/202791)
**Author:** [@xibal](https://discuss.elastic.co/u/xibal)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 4:58pm UTC](https://discuss.elastic.co/t/parse-json-stringified-value-of-a-field-of-an-object-in-the-array-of-objects/202791 "2019-10-10T16:58:41Z")
Hi all, I've been migrating order & order items one-to-many relation from MySQL into ES using Logstash. With the help of filter aggregation for my joined SQL, the items become a nested property under each order and the… --- ## [NGram search troubles(Is it possible to match entire string)](https://discuss.elastic.co/t/ngram-search-troubles-is-it-possible-to-match-entire-string/194111)
**Author:** [@N\_Antech](https://discuss.elastic.co/u/N_Antech)\ **Replies:** 4\ **Last updated:** [August 7, 2019, 4:03pm UTC](https://discuss.elastic.co/t/ngram-search-troubles-is-it-possible-to-match-entire-string/194111 "2019-08-07T16:03:52Z")
I am almost positive that this is a simple misunderstanding on my part as I'm very new to Elasticsearch. I am trying to implement a substring matching search using ngrams. I've got it set as max\_ngram\_diff of 10. My se… --- ## [Scripting aggregation order](https://discuss.elastic.co/t/scripting-aggregation-order/18959)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 4\ **Last updated:** [February 1, 2016, 8:31am UTC](https://discuss.elastic.co/t/scripting-aggregation-order/18959 "2016-02-01T08:31:29Z")
Would it be possible to script the sort order of aggregations? Let me explain with a contrived example: { "aggs": { "agg1": { "terms": { "field": "somefield", "order": {… --- ## [How To Add a New Field, Then Populate It Based On Another Field's Value?](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 12:43am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190 "2019-11-07T00:43:11Z")
Hello Elasticsearch Sorcerers, I am running Logstash v7.4.0 and Elasticsearch v7.4.0 in a nicely-working pipeline. My chain of fruit stores are sending my sales information to Logstash; Logstash then pushes that data t… --- ## [Kibana kibana script field indexof](https://discuss.elastic.co/t/kibana-kibana-script-field-indexof/109000)
**Author:** [@hsiuming](https://discuss.elastic.co/u/hsiuming)\ **Replies:** 4\ **Last updated:** [November 27, 2017, 10:31am UTC](https://discuss.elastic.co/t/kibana-kibana-script-field-indexof/109000 "2017-11-27T10:31:55Z")
Hello If we now have two field: "event\_data.Binary" and "Binary1". We want set a script field to get a word position from the field. We set the script field: language:painless type:number script: doc\['event\_data.Bi… --- ## [Crash using elasticsearch-shard tool to recover corrupt index (EOF)](https://discuss.elastic.co/t/crash-using-elasticsearch-shard-tool-to-recover-corrupt-index-eof/189155)
**Author:** [@craigsheppard](https://discuss.elastic.co/u/craigsheppard)\ **Replies:** 5\ **Last updated:** [July 11, 2019, 11:12am UTC](https://discuss.elastic.co/t/crash-using-elasticsearch-shard-tool-to-recover-corrupt-index-eof/189155 "2019-07-11T11:12:46Z")
Had a power outage that took down a small (one node, 2 shards, two replicas) locally hosted elastic stack (was using sebp/elk 7.1 at the time, since upgraded to 7.2). Bringing the stack back online resulted in Kibana co… --- ## [Kibana 6.8 add filter to particular visualization](https://discuss.elastic.co/t/kibana-6-8-add-filter-to-particular-visualization/204976)
**Author:** [@zhangjinzhou](https://discuss.elastic.co/u/zhangjinzhou)\ **Replies:** 3\ **Last updated:** [October 25, 2019, 7:36am UTC](https://discuss.elastic.co/t/kibana-6-8-add-filter-to-particular-visualization/204976 "2019-10-25T07:36:38Z")
I am new to kibana. I created my first visualization and realized the time range and filter on the top is always applied to the visualization. But I need different filters for different visualization. Is there a way to s… --- ## [NEST - Option to not deserialize the source of hits](https://discuss.elastic.co/t/nest-option-to-not-deserialize-the-source-of-hits/125472)
**Author:** [@dba](https://discuss.elastic.co/u/dba)\ **Replies:** 3\ **Last updated:** [March 27, 2018, 5:50am UTC](https://discuss.elastic.co/t/nest-option-to-not-deserialize-the-source-of-hits/125472 "2018-03-27T05:50:42Z")
Hi I am using version 6.0.2 of NEST and Elasticsearch.Net. For performance reasons, and because the source may have unknown fields added dynamically, I would like to not deserialize the sources, when getting my search … --- ## [Logstash UDP output](https://discuss.elastic.co/t/logstash-udp-output/43219)
**Author:** [@apoc](https://discuss.elastic.co/u/apoc)\ **Replies:** 2\ **Last updated:** [March 2, 2016, 3:48pm UTC](https://discuss.elastic.co/t/logstash-udp-output/43219 "2016-03-02T15:48:05Z")
Hello, Is it possible to send only the message by UDP (output). If i remove the host field for example, i get %{host} instead :disappointed: Here is my conf : input { udp { port =\> 3000 codec =\> plain } } … --- ## [Fleet Server status stuck at updating, but seems to be working normally?!](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193)
**Author:** [@martinm76](https://discuss.elastic.co/u/martinm76)\ **Replies:** 4\ **Last updated:** [November 17, 2022, 10:20am UTC](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193 "2022-11-17T10:20:23Z")
Hello there. I recently updated a client system from 8.4.3 to 8.5.0. Everything was looking good, after the typical reindexing of shards until they were green or at least yellow. I then went to upgrade the Fleet Server… --- ## [How to find or query duplicate offsets?](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456)
**Author:** [@connectgeeks](https://discuss.elastic.co/u/connectgeeks)\ **Replies:** 6\ **Last updated:** [September 19, 2022, 1:04pm UTC](https://discuss.elastic.co/t/how-to-find-or-query-duplicate-offsets/314456 "2022-09-19T13:04:33Z")
I’m having duplicate records in my indexes. How can I find list of duplicate records ? Duplicate records have same offset, can you suggest the query to find list of offset with more than one count ? Or any other way to… [Previous page](https://discuss.elastic.co/top.md?page=498&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=500&per_page=50&period=all)