# Top **URL:** https://discuss.elastic.co/top.md?page=533&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 534 --- ## [Elastic Cloud Enterprise (ECE) 2.13.3, 3.3.0 Security Update](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-2-13-3-3-3-0-security-update/338650)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [July 18, 2023, 9:57am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-2-13-3-3-3-0-security-update/338650 "2023-07-18T09:57:18Z")
ECE Denial of Service (DoS) issue (ESA-2023-09) A denial of service vulnerability was discovered in ECE that could lead to the ECE Admin API server becoming unavailable if a maliciously crafted JWT is supplied. This is … --- ## [Creating Time Comparison Dashboard](https://discuss.elastic.co/t/creating-time-comparison-dashboard/337471)
**Author:** [@vils](https://discuss.elastic.co/u/vils)\ **Replies:** 2\ **Last updated:** [July 3, 2023, 2:29pm UTC](https://discuss.elastic.co/t/creating-time-comparison-dashboard/337471 "2023-07-03T14:29:13Z")
Hi all, I am pretty new to Elastic and Kibana. I am hoping to create a dashboard that would be used to highlight any significant changes to key metrics over different time periods. For instance, showing the call volume… --- ## [How to identify and remove duplicates in Elasticsearch index](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866)
**Author:** [@Sowmya1](https://discuss.elastic.co/u/Sowmya1)\ **Replies:** 3\ **Last updated:** [June 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/how-to-identify-and-remove-duplicates-in-elasticsearch-index/307866 "2022-06-22T13:35:56Z")
we are using elasticsearch 7.11.1 recently we observed an issue and below are the points for it. we store data for every 15 mins interval and we get time stamp from our input file (ex: 05:00, 23:15, 20:30, 11:45 ) rece… --- ## [Elastic search installation error in windows](https://discuss.elastic.co/t/elastic-search-installation-error-in-windows/88169)
**Author:** [@Duraimurugan](https://discuss.elastic.co/u/Duraimurugan)\ **Replies:** 6\ **Last updated:** [June 5, 2017, 7:47pm UTC](https://discuss.elastic.co/t/elastic-search-installation-error-in-windows/88169 "2017-06-05T19:47:37Z")
I have been trying to setup elasticsearch in windows7 machine by following https://www.elastic.co/guide/en/elasticsearch/reference/current/\_installation.html I was able to download, unzip but when running ./elasticsearch… --- ## [Filebeat add\_fields processor](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [December 8, 2021, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-add-fields-processor/290990 "2021-12-08T12:29:04Z")
Hello colleagues; I am trying to add an ECS event.dataset with the add\_fields processor similar to several of the Filebeat modules e.g., the Apache module which add the event datasets apache.access and apache.error. I … --- ## [API call failure from IBM ACE server to Elasticsearch](https://discuss.elastic.co/t/api-call-failure-from-ibm-ace-server-to-elasticsearch/228150)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 5\ **Last updated:** [April 15, 2020, 6:20pm UTC](https://discuss.elastic.co/t/api-call-failure-from-ibm-ace-server-to-elasticsearch/228150 "2020-04-15T18:20:52Z")
ECE version 2.4 on-premise: I have a user that is trying to send IBM ACE logs to Elasticsearch with an API call. This call was working as of Feb 10, 2020 and then just stopped. The API call works from their local comp… --- ## [Upgrade to 7.5](https://discuss.elastic.co/t/upgrade-to-7-5/210764)
**Author:** [@datoadamia](https://discuss.elastic.co/u/datoadamia)\ **Replies:** 5\ **Last updated:** [December 23, 2019, 5:49am UTC](https://discuss.elastic.co/t/upgrade-to-7-5/210764 "2019-12-23T05:49:57Z")
Dear Friends! Pelase, Help me, when I upgrade my Elastisearch from 7.4 to 7.5 I have error message in Kibana log: logstash kibana\[1918\]: {"type":"log","@timestamp":"2019-12-05T18:11:18Z","tags":\["info","migrations"\],"p… --- ## [Shipping Postfix Logs to Elasticsearch V7.3](https://discuss.elastic.co/t/shipping-postfix-logs-to-elasticsearch-v7-3/202602)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 0\ **Last updated:** [October 7, 2019, 11:23pm UTC](https://discuss.elastic.co/t/shipping-postfix-logs-to-elasticsearch-v7-3/202602 "2019-10-07T23:23:25Z")
Hello Everyone, we have been trying to find a solution to ship and parse postfix logs with Elastic stack 7.3, and have attempted several solutions in the last few days and have ran out of options. Solutions attempted: … --- ## [Signal - multiple login failure from same user](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 1\ **Last updated:** [November 16, 2020, 12:24pm UTC](https://discuss.elastic.co/t/signal-multiple-login-failure-from-same-user/255517 "2020-11-16T12:24:57Z")
Please help me to create a signal for below logic. Alert if there is more than 3 login failure from same user in last 5min. I have mentioned below the watcher query written for same above logic. “query”: { “bool”: { … --- ## [AWS Elasticsearch - xpack\_main@6.3.1 Authentication Exception from Kibana on prem](https://discuss.elastic.co/t/aws-elasticsearch-xpack-main-6-3-1-authentication-exception-from-kibana-on-prem/152726)
**Author:** [@Jigar\_Patel1](https://discuss.elastic.co/u/Jigar_Patel1)\ **Replies:** 4\ **Last updated:** [October 18, 2018, 7:19pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-xpack-main-6-3-1-authentication-exception-from-kibana-on-prem/152726 "2018-10-18T19:19:05Z")
I am trying to connect to ES (6.3.1) in AWS from on prem Kibana(6.3.1) and getting below error on kibana ./kibana log \[22:47:08.035\] \[info\]\[status\]\[plugin:kibana@6.3.1\] Status changed from uninitialized to green - Rea… --- ## [Event.remove not working](https://discuss.elastic.co/t/event-remove-not-working/134147)
**Author:** [@Akash\_Kumar\_Dutta](https://discuss.elastic.co/u/Akash_Kumar_Dutta)\ **Replies:** 4\ **Last updated:** [June 1, 2018, 12:57pm UTC](https://discuss.elastic.co/t/event-remove-not-working/134147 "2018-06-01T12:57:37Z")
I am using the following ruby filter to update the fields. def filter(event) keys = event.to\_hash.keys keys.each{|key| if ( key.start\_with? '\_' and key != "\_@timestamp") value = event.get(key) newke… --- ## [Java APIs - again - and IncludeExclude agg query parameters](https://discuss.elastic.co/t/java-apis-again-and-includeexclude-agg-query-parameters/93224)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 3\ **Last updated:** [July 15, 2017, 10:24am UTC](https://discuss.elastic.co/t/java-apis-again-and-includeexclude-agg-query-parameters/93224 "2017-07-15T10:24:27Z")
I see many questions about the availability of full Java API docs for ElasticSearch - some form 2014/2015. Still, I cannot find them anywhere. The only docs that are close to what a Java developer would need to start int… --- ## [Pull instead of push](https://discuss.elastic.co/t/pull-instead-of-push/56033)
**Author:** [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Replies:** 3\ **Last updated:** [July 25, 2016, 12:17pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033 "2016-07-25T12:17:23Z")
Is there a specific beat or a way anyone knows where i can have my ELK server pull data from a syslog server? Instead of having to install a beat on my syslog server and pushing the data to my ELK server. I do not know i… --- ## [Added fields are not displaying](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937)
**Author:** [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Replies:** 8\ **Last updated:** [July 6, 2015, 11:20am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937 "2015-07-06T11:20:03Z")
Hi, I have added some fields like received\_at and received\_from using add\_field in logstash configuration file,but these fields are not displaying anywhere. Where these fields will be displayed.I want these fields to be… --- ## [Docker-error: no log4j2.properties found; tried \[/usr/share/elasticsearch/config\] and its subdirectories](https://discuss.elastic.co/t/docker-error-no-log4j2-properties-found-tried-usr-share-elasticsearch-config-and-its-subdirectories/109760)
**Author:** [@marouane](https://discuss.elastic.co/u/marouane)\ **Replies:** 1\ **Last updated:** [December 3, 2017, 4:27pm UTC](https://discuss.elastic.co/t/docker-error-no-log4j2-properties-found-tried-usr-share-elasticsearch-config-and-its-subdirectories/109760 "2017-12-03T16:27:01Z")
Hello every one i'm new with elasticsearsh Those are the steps that i followed :slight\_smile: docker pull elasticsearch:5.2.2 docker run -d --name=ElasticSearch --restart=unless-stopped -v /myfolder/elasticsearch… --- ## [Fresh install stuck](https://discuss.elastic.co/t/fresh-install-stuck/127763)
**Author:** [@nandha\_88](https://discuss.elastic.co/u/nandha_88)\ **Replies:** 5\ **Last updated:** [April 12, 2018, 4:41pm UTC](https://discuss.elastic.co/t/fresh-install-stuck/127763 "2018-04-12T16:41:54Z")
Hi all, I am doing a fresh install and its running this step for a logntime bin\]$ ./elasticsearch \[2018-04-12T13:17:40,127\]\[INFO \]\[o.e.n.Node \] \[\] initializing ... \[2018-04-12T13:17:40,330\]\[INFO \]\[o.e.e.NodeEnvironment… --- ## [ElasticSearch store Index data externally](https://discuss.elastic.co/t/elasticsearch-store-index-data-externally/19571)
**Author:** [@a\_aneiros](https://discuss.elastic.co/u/a_aneiros)\ **Replies:** 5\ **Last updated:** [September 10, 2014, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-store-index-data-externally/19571 "2014-09-10T10:43:33Z")
Hello, I've been using ElasticSearch last few months, and due to specifications of one project I have one doubt about configuration. It's possible to set the path of the index data in the file "elasticsearch.… --- ## [What is the difference between elastic and apache licensed version](https://discuss.elastic.co/t/what-is-the-difference-between-elastic-and-apache-licensed-version/139015)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 1\ **Last updated:** [July 7, 2018, 3:14pm UTC](https://discuss.elastic.co/t/what-is-the-difference-between-elastic-and-apache-licensed-version/139015 "2018-07-07T15:14:25Z")
what is the difference between Elasticsearch and Elasticsearch - OSS Only version ? Is there any difference in the configuration ? --- ## [How can I use client side (browser) javascript to call elasticsearch?](https://discuss.elastic.co/t/how-can-i-use-client-side-browser-javascript-to-call-elasticsearch/50277)
**Author:** [@zemus](https://discuss.elastic.co/u/zemus)\ **Replies:** 2\ **Last updated:** [May 19, 2016, 4:53pm UTC](https://discuss.elastic.co/t/how-can-i-use-client-side-browser-javascript-to-call-elasticsearch/50277 "2016-05-19T16:53:37Z")
Hello I am new to programming and ES. I want to learn by building something -that looks- like Google search page. A simple search page using only the browser JavaScript. I want to use HTTP API calls to ES to return do… --- ## [Logstash crashes when ES isn't available](https://discuss.elastic.co/t/logstash-crashes-when-es-isnt-available/132390)
**Author:** [@CasMeiron](https://discuss.elastic.co/u/CasMeiron)\ **Replies:** 8\ **Last updated:** [May 29, 2018, 4:09pm UTC](https://discuss.elastic.co/t/logstash-crashes-when-es-isnt-available/132390 "2018-05-29T16:09:21Z")
Hello, I turned off my elasticsearch to test what happens when it fails (or isn't running). I want to handle this kind of behaviour, sending an alarm to zabbix. The weird thing happened. When I started my logstash, I g… --- ## [What is difference between Elastic Agent and Beat?](https://discuss.elastic.co/t/what-is-difference-between-elastic-agent-and-beat/340383)
**Author:** [@musialny](https://discuss.elastic.co/u/musialny)\ **Replies:** 3\ **Last updated:** [August 8, 2023, 3:28pm UTC](https://discuss.elastic.co/t/what-is-difference-between-elastic-agent-and-beat/340383 "2023-08-08T15:28:51Z")
What is difference between Elastic Agent and Beat? --- ## [How can I cancel a search request?](https://discuss.elastic.co/t/how-can-i-cancel-a-search-request/11625)
**Author:** [@Hoony](https://discuss.elastic.co/u/Hoony)\ **Replies:** 3\ **Last updated:** [April 19, 2013, 9:23am UTC](https://discuss.elastic.co/t/how-can-i-cancel-a-search-request/11625 "2013-04-19T09:23:22Z")
Hi all, Are there some way to cancel a search request? Sometimes, there is the request which costs too much time, so I want to cancel it? Does ES support this kind of function or API to cancel the se… --- ## [Return only the data inside hits \[ \]](https://discuss.elastic.co/t/return-only-the-data-inside-hits/182576)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 4\ **Last updated:** [May 24, 2019, 8:41am UTC](https://discuss.elastic.co/t/return-only-the-data-inside-hits/182576 "2019-05-24T08:41:50Z")
Hi, I have a query that returns the hits field nested inside key andaggregations. I'm using curl to send the data to logstash for further processing and I would like to make my life a bit easier by only having to proce… --- ## [SOLVED - Index Template for filebeat - fails on fields](https://discuss.elastic.co/t/solved-index-template-for-filebeat-fails-on-fields/176745)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 4\ **Last updated:** [April 16, 2019, 10:52pm UTC](https://discuss.elastic.co/t/solved-index-template-for-filebeat-fails-on-fields/176745 "2019-04-16T22:52:15Z")
Hi, Recently we switched from beats -\> ES Cloud to beats -\> logstash -\> ES cloud. In our new cluster we found that the index mappings were not done (per previous post). I am trying to run the commands per documentation… --- ## [Indexing pdf documents](https://discuss.elastic.co/t/indexing-pdf-documents/67437)
**Author:** [@soorajhere](https://discuss.elastic.co/u/soorajhere)\ **Replies:** 1\ **Last updated:** [November 29, 2016, 7:28am UTC](https://discuss.elastic.co/t/indexing-pdf-documents/67437 "2016-11-29T07:28:33Z")
Hi All, ES version - 2.1 Mapper attachments plugin - 3.1 I am trying to index a pdf document in elastic search. I used Nest,ElasticSearch.net APIs to index the document. I have installed mapper-attachment plugin. Ind… --- ## [Circuit\_breaking\_exception](https://discuss.elastic.co/t/circuit-breaking-exception/302698)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 3:51am UTC](https://discuss.elastic.co/t/circuit-breaking-exception/302698 "2022-04-26T03:51:31Z")
ES:7.10.2 this is my error log： \[parent\] Data too large, data for \[indices:data/write/bulk\[s\]\] would be \[30380624822/28.2gb\], which is larger than the limit of \[28975929753/26.9gb\], real usage: \[30380571432/28.2gb\],… --- ## [Logstash docker image doesn't connect to elasticsearch image](https://discuss.elastic.co/t/logstash-docker-image-doesnt-connect-to-elasticsearch-image/113691)
**Author:** [@jeancharles](https://discuss.elastic.co/u/jeancharles)\ **Replies:** 2\ **Last updated:** [January 1, 2018, 6:09pm UTC](https://discuss.elastic.co/t/logstash-docker-image-doesnt-connect-to-elasticsearch-image/113691 "2018-01-01T18:09:19Z")
Hi, I'm a new user of Elasticsearch / Kibana / Logstash with docker images. I launched the images using the following commands: docker run -d -p 9200:9200 -p 9300:9300 --network=elastic -it --rm --name elasticsearch -… --- ## [Elasticsearch is not starting after the restart](https://discuss.elastic.co/t/elasticsearch-is-not-starting-after-the-restart/40695)
**Author:** [@mramaprasad](https://discuss.elastic.co/u/mramaprasad)\ **Replies:** 4\ **Last updated:** [February 3, 2016, 6:09am UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting-after-the-restart/40695 "2016-02-03T06:09:57Z")
We have 3 nodes. nodes are not coming back up after the restart. I get following errors nested: RecoverFilesRecoveryException\[Failed to transfer \[0\] files with total size of \[0b\]\]; nested: IllegalStateException\[try to… --- ## [Unable to authenticate user \[kibana\_system\] for REST request \[/\_xpack\] error](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441)
**Author:** [@daniela09](https://discuss.elastic.co/u/daniela09)\ **Replies:** 6\ **Last updated:** [May 29, 2023, 11:57am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-kibana-system-for-rest-request-xpack-error/333441 "2023-05-29T11:57:18Z")
I am using EFK stack on Kubernetes, Elastic and Kibana 8.7.0: I changed the passwords for built-in users elastic and kibana\_system with ./bin/elasticsearch-reset-password user --username kibana\_system and ./bin/elastic… --- ## [Kibana / CSV Upload / Request Timeout](https://discuss.elastic.co/t/kibana-csv-upload-request-timeout/195361)
**Author:** [@mikerkeating](https://discuss.elastic.co/u/mikerkeating)\ **Replies:** 6\ **Last updated:** [August 21, 2019, 2:29pm UTC](https://discuss.elastic.co/t/kibana-csv-upload-request-timeout/195361 "2019-08-21T14:29:00Z")
Hi I'd like to analyse a CSV with text data following steps in https://www.elastic.co/blog/importing-csv-and-log-data-into-elasticsearch-with-file-data-visualizer. I've created a elastic cloud trial account with a depl… --- ## [Shard rebalancing vs shard allocation](https://discuss.elastic.co/t/shard-rebalancing-vs-shard-allocation/154492)
**Author:** [@HugoP](https://discuss.elastic.co/u/HugoP)\ **Replies:** 2\ **Last updated:** [October 31, 2018, 1:52pm UTC](https://discuss.elastic.co/t/shard-rebalancing-vs-shard-allocation/154492 "2018-10-31T13:52:11Z")
Hi, What is the difference/link between shard rebalancing and shard allocation ? Is it possible to have a shard rebalancing with a disable sharding allocation ? I don't think so but I need some confirmation. Furtherm… --- ## [\[ERROR\]\[logstash.outputs.elasticsearch\] Failed to install template. {:message=\>"Got response code '400' contacting Elasticsearch at URL 'http://localhost:9200/\_template/jose\_prueba\_v14'"](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-localhost-9200-template-jose-prueba-v14/252582)
**Author:** [@joseantonio.sanchez](https://discuss.elastic.co/u/joseantonio.sanchez)\ **Replies:** 3\ **Last updated:** [October 20, 2020, 7:54am UTC](https://discuss.elastic.co/t/error-logstash-outputs-elasticsearch-failed-to-install-template-message-got-response-code-400-contacting-elasticsearch-at-url-http-localhost-9200-template-jose-prueba-v14/252582 "2020-10-20T07:54:26Z")
Good afternoon, I'm having problems with logstash when putting a template file to perform a mapping. in my logstash .conf file, I put "output { elasticsearch { hosts =\> \['localhost: 9200'\] index =\> 'jose\_test\_v14' … --- ## [Update marvel basic license failed](https://discuss.elastic.co/t/update-marvel-basic-license-failed/42886)
**Author:** [@jiunjiunma](https://discuss.elastic.co/u/jiunjiunma)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 6:27pm UTC](https://discuss.elastic.co/t/update-marvel-basic-license-failed/42886 "2016-03-21T18:27:40Z")
Hi, I tried to update the marvel basic license, but got this obscure error message while running: curl -XPUT 'http://host:port/\_license' -d @mylicense.json (Note I don't have shield installed so I didn't use the -u … --- ## [Ignore a field in the scoring](https://discuss.elastic.co/t/ignore-a-field-in-the-scoring/21373)
**Author:** [@roger](https://discuss.elastic.co/u/roger)\ **Replies:** 8\ **Last updated:** [January 8, 2015, 2:11pm UTC](https://discuss.elastic.co/t/ignore-a-field-in-the-scoring/21373 "2015-01-08T14:11:57Z")
Hello Our documents have metadata indexed with them, but we don't want the metadata to interfere in the scoring After a user searches for documents, they can bookmark them (what means we add more metadata to the … --- ## [Sending the alert JSON details using Webhook Connector](https://discuss.elastic.co/t/sending-the-alert-json-details-using-webhook-connector/357223)
**Author:** [@aviran-cato](https://discuss.elastic.co/u/aviran-cato)\ **Replies:** 7\ **Last updated:** [April 11, 2024, 3:42pm UTC](https://discuss.elastic.co/t/sending-the-alert-json-details-using-webhook-connector/357223 "2024-04-11T15:42:06Z")
Hi, I want to use a Webhook connector to send the alert data to an automation platform. The issue is that in the Connector action, I can't find a way to send only the JSON alert information. As marked in the image. … --- ## [How can I check indices.memory.index\_buffer\_size parameter is effectively working?](https://discuss.elastic.co/t/how-can-i-check-indices-memory-index-buffer-size-parameter-is-effectively-working/11069)
**Author:** [@Hoony](https://discuss.elastic.co/u/Hoony)\ **Replies:** 0\ **Last updated:** [March 8, 2013, 5:57am UTC](https://discuss.elastic.co/t/how-can-i-check-indices-memory-index-buffer-size-parameter-is-effectively-working/11069 "2013-03-08T05:57:48Z")
Hi all, I have elasticsearch cluster, and I add indices.memory.index\_buffer\_sizeparameter in elasticsearch.yml file. I set this parameter be 70%. And then the cluster began to indexing. After all, I reset this… --- ## [Extract number from a text in kibana](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605)
**Author:** [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\ **Replies:** 5\ **Last updated:** [April 5, 2022, 9:47am UTC](https://discuss.elastic.co/t/extract-number-from-a-text-in-kibana/301605 "2022-04-05T09:47:57Z")
Hi, I need to extract a number from these text and then get the result if the value is greater than 1 or lesser than 1, can somebody knows how to do that? I show in the picture whitch filters I use to get the message, I… --- ## [Using the Truncate filter on keywords](https://discuss.elastic.co/t/using-the-truncate-filter-on-keywords/153476)
**Author:** [@Arik\_A](https://discuss.elastic.co/u/Arik_A)\ **Replies:** 5\ **Last updated:** [November 13, 2018, 7:33am UTC](https://discuss.elastic.co/t/using-the-truncate-filter-on-keywords/153476 "2018-11-13T07:33:13Z")
Hi, I'm using Elasticsearch 5.5.1. In a defined template, a keyword field is added to each text field, currently mainly for sorting. These texts could be long, and keywords have limited size. I know there's the ignore… --- ## [Very Slow incrementing counter](https://discuss.elastic.co/t/very-slow-incrementing-counter/55114)
**Author:** [@loske](https://discuss.elastic.co/u/loske)\ **Replies:** 5\ **Last updated:** [July 11, 2016, 8:51am UTC](https://discuss.elastic.co/t/very-slow-incrementing-counter/55114 "2016-07-11T08:51:03Z")
Hello, I have a counter which i need to increment : curl -XPOST 'localhost:9200/something/ble/372204/\_update' -d' { "script": { "inline": "ctx.\_source.counter++" } }' This index has around ~4k elements but … --- ## [Input multiline JSON?](https://discuss.elastic.co/t/input-multiline-json/165287)
**Author:** [@Jan\_Rodriguez\_Quabu](https://discuss.elastic.co/u/Jan_Rodriguez_Quabu)\ **Replies:** 3\ **Last updated:** [January 24, 2019, 1:36pm UTC](https://discuss.elastic.co/t/input-multiline-json/165287 "2019-01-24T13:36:10Z")
Hello! I have the following JSON file and I send it to an Amazon Elasticsearch Service using FIlebeat, but Elasticsearch isn't capable to index it properly. { "scan": { "id\_scan": "2019-01-22 19:00:35", "files": \[… --- ## [How to Get a Raw Logs Copy from elasticsearch](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 6\ **Last updated:** [March 19, 2021, 3:11pm UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326 "2021-03-19T15:11:42Z")
Hi Team, We are currently sending all our audit logs to elasticsearch cluster using filebeat and auditbeat ( Logstash is not used) , Can we get the raw copy of logs or some log forwarder can be used in elasticsearch to … --- ## [Multiline codec in if else condition in beat input of logstash](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323)
**Author:** [@Shubhank\_Gupta](https://discuss.elastic.co/u/Shubhank_Gupta)\ **Replies:** 7\ **Last updated:** [December 18, 2017, 11:00am UTC](https://discuss.elastic.co/t/multiline-codec-in-if-else-condition-in-beat-input-of-logstash/110323 "2017-12-18T11:00:09Z")
I want to put condition on input logs through filebeat using type of log but in input section we can't put if else condition if i am right ? Suggest a method to apply multiline codec on a particular type of log only. --- ## [How to remove packetbeat](https://discuss.elastic.co/t/how-to-remove-packetbeat/108074)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 7\ **Last updated:** [November 17, 2017, 10:30am UTC](https://discuss.elastic.co/t/how-to-remove-packetbeat/108074 "2017-11-17T10:30:47Z")
As title. I want to remove packetbeat and reinstall it.(not just service) how could I do . thank you in advance! --- ## [Elastic-agent - Fail to enroll, Status code: 404](https://discuss.elastic.co/t/elastic-agent-fail-to-enroll-status-code-404/255772)
**Author:** [@ismyhairnice](https://discuss.elastic.co/u/ismyhairnice)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 9:02am UTC](https://discuss.elastic.co/t/elastic-agent-fail-to-enroll-status-code-404/255772 "2020-11-24T09:02:08Z")
Hi all I was trying to enroll an elastic-agent by following the instructions that are shown in Kibana. elastic-agent enroll https://\:5601 ENROLLMENT\_KEY 2020-11-18T10:07:23.249+0800 DEBUG kibana/client… --- ## [Scripted metric aggregations & sorting](https://discuss.elastic.co/t/scripted-metric-aggregations-sorting/143719)
**Author:** [@cohenran](https://discuss.elastic.co/u/cohenran)\ **Replies:** 3\ **Last updated:** [August 13, 2018, 8:48am UTC](https://discuss.elastic.co/t/scripted-metric-aggregations-sorting/143719 "2018-08-13T08:48:09Z")
I tried to select by a scripted\_metric aggregations & sort it by timestamp field. The result seems to be divided into sorted arrays in the aggregation bucket. However, the arrays themselves are not sorted between them… --- ## [Deprecation warning after set search.max\_buckets on Elastic 7](https://discuss.elastic.co/t/deprecation-warning-after-set-search-max-buckets-on-elastic-7/180397)
**Author:** [@klaus82](https://discuss.elastic.co/u/klaus82)\ **Replies:** 3\ **Last updated:** [May 9, 2019, 4:05pm UTC](https://discuss.elastic.co/t/deprecation-warning-after-set-search-max-buckets-on-elastic-7/180397 "2019-05-09T16:05:06Z")
Hi all, On elastic 7, we set the search.max\_buckets and after this change, we started to receive this deprecation warning: #! Deprecation: \[discovery.zen.minimum\_master\_nodes\] setting was deprecated in Elasticsearch a… --- ## [Missing x-pack filebeat monitors](https://discuss.elastic.co/t/missing-x-pack-filebeat-monitors/138364)
**Author:** [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Replies:** 3\ **Last updated:** [July 11, 2018, 2:10pm UTC](https://discuss.elastic.co/t/missing-x-pack-filebeat-monitors/138364 "2018-07-11T14:10:19Z")
Hello In the beginning our ELK stack filebeat monitoring worked perfectly with X-Pack but recently I tried adding some new hosts to it and although the data is correctly parsed by Logstash the monitoring data that get's… --- ## [Term query not working where type is "text"](https://discuss.elastic.co/t/term-query-not-working-where-type-is-text/324422)
**Author:** [@shebbi](https://discuss.elastic.co/u/shebbi)\ **Replies:** 6\ **Last updated:** [February 2, 2023, 10:05am UTC](https://discuss.elastic.co/t/term-query-not-working-where-type-is-text/324422 "2023-02-02T10:05:08Z")
Hi Team, We are using ES 7.16.2 version and below is the query which we have generated using Java apis, Please let us know why it is not working or are we doing something wrong? Query: - { "bool" : { "must" : \[ … --- ## [Converting timezones in Logstash - HOWTO](https://discuss.elastic.co/t/converting-timezones-in-logstash-howto/333821)
**Author:** [@nbertram](https://discuss.elastic.co/u/nbertram)\ **Replies:** 2\ **Last updated:** [May 21, 2023, 9:12pm UTC](https://discuss.elastic.co/t/converting-timezones-in-logstash-howto/333821 "2023-05-21T21:12:27Z")
Hi, After trawling a lot of the internet asking how to convert a timestamp from UTC to local time in Logstash I came up blank, and against a whole bunch of answers on here saying "don't - leave that to the presentation … --- ## [ERR Failed to publish events caused by: read tcp X.XXXX:55860-\>XXXXXXX:5044: i/o timeout](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-x-xxxx-55860-xxxxxxx-i-o-timeout/142000)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 7\ **Last updated:** [August 2, 2018, 3:58am UTC](https://discuss.elastic.co/t/err-failed-to-publish-events-caused-by-read-tcp-x-xxxx-55860-xxxxxxx-i-o-timeout/142000 "2018-08-02T03:58:55Z")
file beat is not able to send data and getting timeout error with logstash, what could be the reason [Previous page](https://discuss.elastic.co/top.md?page=532&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=534&per_page=50&period=all)