# Top

**URL:** https://discuss.elastic.co/top.md?page=553&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 554

---

## [Regex and Aggregations using Painless](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606)

<div class="topic-metadata">

**Author:** [@paulohss](https://discuss.elastic.co/u/paulohss)\
**Replies:** 5\
**Last updated:** [December 12, 2017, 1:29am UTC](https://discuss.elastic.co/t/regex-and-aggregations-using-painless/110606 "2017-12-12T01:29:59Z")

</div>

Hi guys, I got the following use case that even with the aid of your documentation, I'm not being able to achieve. It goes like this: Let's suppose that I have this index: \[sample\_1\] Important Note: It's oversimplif…

---

## [It seemed to be stuck when initializing](https://discuss.elastic.co/t/it-seemed-to-be-stuck-when-initializing/162191)

<div class="topic-metadata">

**Author:** [@minhua1983](https://discuss.elastic.co/u/minhua1983)\
**Replies:** 6\
**Last updated:** [January 4, 2019, 2:52am UTC](https://discuss.elastic.co/t/it-seemed-to-be-stuck-when-initializing/162191 "2019-01-04T02:52:18Z")

</div>

It seems to be stuck when initializing. I have no idea about why it happens when initializing. What does elasticsearch do after the system distributes the heaps to elasticsearch? Please check the text log below. 20…

---

## [Grokparsefailure, but works in grok debugger](https://discuss.elastic.co/t/grokparsefailure-but-works-in-grok-debugger/45613)

<div class="topic-metadata">

**Author:** [@mikeface](https://discuss.elastic.co/u/mikeface)\
**Replies:** 2\
**Last updated:** [March 29, 2016, 3:30pm UTC](https://discuss.elastic.co/t/grokparsefailure-but-works-in-grok-debugger/45613 "2016-03-29T15:30:17Z")

</div>

Hey guys, need some help with grok, kind of at a loss. I've used Logstash quite a bit in the past, never run into this issue. On Logstash v2.2.2, I can't seem to get grok to parse some logs from Nginx. They have some …

---

## [How to sync SQL Server data with ES indexes?](https://discuss.elastic.co/t/how-to-sync-sql-server-data-with-es-indexes/59567)

<div class="topic-metadata">

**Author:** [@prasperl](https://discuss.elastic.co/u/prasperl)\
**Replies:** 1\
**Last updated:** [September 1, 2016, 2:44pm UTC](https://discuss.elastic.co/t/how-to-sync-sql-server-data-with-es-indexes/59567 "2016-09-01T14:44:21Z")

</div>

Since Rivers plugin is deprecated now,what would be an ideal tool/plugin to sync ES indexes with SQL Server data. It looks like logstash supports jdbc plugin,but is that an ideal way to sync ES indexes with delta/incre…

---

## [Point Kibana to two elasticsearch clusters](https://discuss.elastic.co/t/point-kibana-to-two-elasticsearch-clusters/40415)

<div class="topic-metadata">

**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\
**Replies:** 7\
**Last updated:** [January 29, 2016, 8:59pm UTC](https://discuss.elastic.co/t/point-kibana-to-two-elasticsearch-clusters/40415 "2016-01-29T20:59:11Z")

</div>

I have two elasticsearch clusters - one running on the default port (9200) and the other on 9220. Right now, the Kibana I have points to the ES running on 9220 and fetches logs belonging to default index (logstash-\*). …

---

## [Kibana 4.1 background theme](https://discuss.elastic.co/t/kibana-4-1-background-theme/24141)

<div class="topic-metadata">

**Author:** [@rajeshchinnam1985](https://discuss.elastic.co/u/rajeshchinnam1985)\
**Replies:** 1\
**Last updated:** [June 23, 2015, 5:00pm UTC](https://discuss.elastic.co/t/kibana-4-1-background-theme/24141 "2015-06-23T17:00:29Z")

</div>

How to Set up / Style back ground theme / color to the widgets in kibana 4.1

---

## [Change java path in config file](https://discuss.elastic.co/t/change-java-path-in-config-file/96457)

<div class="topic-metadata">

**Author:** [@DFrant](https://discuss.elastic.co/u/DFrant)\
**Replies:** 3\
**Last updated:** [August 10, 2017, 8:43am UTC](https://discuss.elastic.co/t/change-java-path-in-config-file/96457 "2017-08-10T08:43:16Z")

</div>

Hello, I would like to know in which file I can define the JAVA path in my logstash configuration because my JAVA\_HOME is set to Java 7 and cannot be changed, to avoid that: /usr/share/logstash/bin/logstash -e 'input {…

---

## [Beats plugin configuation](https://discuss.elastic.co/t/beats-plugin-configuation/36867)

<div class="topic-metadata">

**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\
**Replies:** 6\
**Last updated:** [December 10, 2015, 11:38am UTC](https://discuss.elastic.co/t/beats-plugin-configuation/36867 "2015-12-10T11:38:51Z")

</div>

is it possible to set ports as a range or array in logstash config instead beats { port =\> 5013 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/priv…

---

## [How to fix status: red in unassigned shards?](https://discuss.elastic.co/t/how-to-fix-status-red-in-unassigned-shards/72444)

<div class="topic-metadata">

**Author:** [@Siva\_Sai](https://discuss.elastic.co/u/Siva_Sai)\
**Replies:** 1\
**Last updated:** [January 23, 2017, 8:40am UTC](https://discuss.elastic.co/t/how-to-fix-status-red-in-unassigned-shards/72444 "2017-01-23T08:40:06Z")

</div>

I got 20-30% of unassigned shards in a cluster and showing status red. How to Fix that issue. Some nodes are down at certain point of time and they are OFF now for around 2 hrs. and now they are Up and showing status r…

---

## [Please don't deprecate sparse vector fields](https://discuss.elastic.co/t/please-dont-deprecate-sparse-vector-fields/219063)

<div class="topic-metadata">

**Author:** [@George\_Kinsman](https://discuss.elastic.co/u/George_Kinsman)\
**Replies:** 1\
**Last updated:** [February 13, 2020, 3:29pm UTC](https://discuss.elastic.co/t/please-dont-deprecate-sparse-vector-fields/219063 "2020-02-13T15:29:55Z")

</div>

Hi there! I noticed that support for sparse vectors is being deprecated due to lack of interest and use cases: https://github.com/elastic/elasticsearch/pull/48781. This is a great article that discusses the trade off b…

---

## [Docker(ELK+Filebeat) -\> pas de log](https://discuss.elastic.co/t/docker-elk-filebeat-pas-de-log/40502)

<div class="topic-metadata">

**Author:** [@Ragnar](https://discuss.elastic.co/u/Ragnar)\
**Replies:** 4\
**Last updated:** [February 5, 2016, 5:38pm UTC](https://discuss.elastic.co/t/docker-elk-filebeat-pas-de-log/40502 "2016-02-05T17:38:13Z")

</div>

Bonjour à tous, Je débute avec la stack elastic, je ne suis d'ailleurs qu'en stagiaire, donc étudiant. Je dois être à l'aise avec ces outils en vu ensuite de faire des mini projets pour que je puisse ensuite les util…

---

## [ClusterBlockException after closing an index](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972)

<div class="topic-metadata">

**Author:** [@Bruno\_Cruz](https://discuss.elastic.co/u/Bruno_Cruz)\
**Replies:** 2\
**Last updated:** [December 18, 2014, 10:32am UTC](https://discuss.elastic.co/t/clusterblockexception-after-closing-an-index/20972 "2014-12-18T10:32:05Z")

</div>

Hi, I hope this is the correct group for asking about this behavior, sorry in advance if it isn't but I would greatly appreciate some help. I'm pretty new to ElasticSearch itself, currently trying to setup an ELK …

---

## [No route to self](https://discuss.elastic.co/t/no-route-to-self/19042)

<div class="topic-metadata">

**Author:** [@mhughes](https://discuss.elastic.co/u/mhughes)\
**Replies:** 5\
**Last updated:** [March 4, 2015, 3:09am UTC](https://discuss.elastic.co/t/no-route-to-self/19042 "2015-03-04T03:09:37Z")

</div>

Originally I was getting a bunch of "No Route to Host" errors and tracked it down to being out of file handles. I have fixed the file handle, problem, but I still keep getting "No route to host" errors; the odd thin…

---

## [What is the fastest way to read all the records in an index?](https://discuss.elastic.co/t/what-is-the-fastest-way-to-read-all-the-records-in-an-index/635)

<div class="topic-metadata">

**Author:** [@ptrei](https://discuss.elastic.co/u/ptrei)\
**Replies:** 2\
**Last updated:** [October 14, 2015, 10:39am UTC](https://discuss.elastic.co/t/what-is-the-fastest-way-to-read-all-the-records-in-an-index/635 "2015-10-14T10:39:34Z")

</div>

New to the list, semi-new to ELK. Apologies if this is a FAQ, but I can't find an answer. I'm processing proxy logs. Logstash does just fine in parsing them, and putting them into daily logstash-\[date\] indices. Howev…

---

## [Compression in Elasticsearch documents](https://discuss.elastic.co/t/compression-in-elasticsearch-documents/23235)

<div class="topic-metadata">

**Author:** [@ajay\_bh111](https://discuss.elastic.co/u/ajay_bh111)\
**Replies:** 4\
**Last updated:** [April 15, 2015, 8:25am UTC](https://discuss.elastic.co/t/compression-in-elasticsearch-documents/23235 "2015-04-15T08:25:22Z")

</div>

I would like to know if Elasticsearch documents/indices are stored in compressed format on disk . If yes, what type of compression options are available and it's performance overheads. and if these compression opt…

---

## [How secure Logstash keystore to keep Database Connection credentials](https://discuss.elastic.co/t/how-secure-logstash-keystore-to-keep-database-connection-credentials/166462)

<div class="topic-metadata">

**Author:** [@Sumesh\_p\_s](https://discuss.elastic.co/u/Sumesh_p_s)\
**Replies:** 5\
**Last updated:** [February 15, 2019, 6:34am UTC](https://discuss.elastic.co/t/how-secure-logstash-keystore-to-keep-database-connection-credentials/166462 "2019-02-15T06:34:18Z")

</div>

Hi All, We have deployed ELK platinum and uses Logstash keystore to fetch DB logs and statistics. What are the exploit vector that some one can read the DB passwords from Keystore ? or is it safe to assume passwords are…

---

## ["query\_string" Wildcard search with special characters issue](https://discuss.elastic.co/t/query-string-wildcard-search-with-special-characters-issue/254068)

<div class="topic-metadata">

**Author:** [@Anas1](https://discuss.elastic.co/u/Anas1)\
**Replies:** 3\
**Last updated:** [November 4, 2020, 10:15am UTC](https://discuss.elastic.co/t/query-string-wildcard-search-with-special-characters-issue/254068 "2020-11-04T10:15:10Z")

</div>

When searching using a wildcard words, i have an unexpected behavior. I'm working on ES 5.6.8. To reproduce the issue: (Test with Kibana) - create the index : PUT my-index-00001 { "mappings": { "test": {…

---

## [ML - Not picking up anomalies?](https://discuss.elastic.co/t/ml-not-picking-up-anomalies/97699)

<div class="topic-metadata">

**Author:** [@dragick](https://discuss.elastic.co/u/dragick)\
**Replies:** 8\
**Last updated:** [September 9, 2017, 11:04am UTC](https://discuss.elastic.co/t/ml-not-picking-up-anomalies/97699 "2017-09-09T11:04:05Z")

</div>

I am investigating X-Pack's Machine Learning as a way to tell me when customer orders are declining / stopped. I've got from one client I know we lost and am seeing if X-Pack could have alerted us on their changed behavi…

---

## [Using ES for 1 PB of unstructured data](https://discuss.elastic.co/t/using-es-for-1-pb-of-unstructured-data/63886)

<div class="topic-metadata">

**Author:** [@demknight6](https://discuss.elastic.co/u/demknight6)\
**Replies:** 3\
**Last updated:** [October 26, 2016, 1:09am UTC](https://discuss.elastic.co/t/using-es-for-1-pb-of-unstructured-data/63886 "2016-10-26T01:09:42Z")

</div>

I'd like to use Elasticsearch to perform a full-text index of a large set of unstructured data, in the neighborhood of 1 PB. I estimate the actually index to be about 40% of this size, around 400 TB. There would be bil…

---

## [Convert sting to date time in logstash](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523)

<div class="topic-metadata">

**Author:** [@Senz79](https://discuss.elastic.co/u/Senz79)\
**Replies:** 4\
**Last updated:** [October 8, 2016, 5:11am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523 "2016-10-08T05:11:52Z")

</div>

how can i convert the below string into date time Wed Aug 03 11:48:58 2016 I am using the below pattern to put it in a column ?\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\])

---

## [Building elasticsearch 0.8 with maven2 and use in netbeans](https://discuss.elastic.co/t/building-elasticsearch-0-8-with-maven2-and-use-in-netbeans/3108)

<div class="topic-metadata">

**Author:** [@Ein\_Droid](https://discuss.elastic.co/u/Ein_Droid)\
**Replies:** 1\
**Last updated:** [February 19, 2016, 7:35am UTC](https://discuss.elastic.co/t/building-elasticsearch-0-8-with-maven2-and-use-in-netbeans/3108 "2016-02-19T07:35:15Z")

</div>

Hi \*, if someone is interested in building elasticsearch 0.8 with maven2 and using netbeans, I wrote down what to do:: http://pascal.selfip.org/jforum/posts/list/117.page#401 oo

---

## [Partial search encrypted data](https://discuss.elastic.co/t/partial-search-encrypted-data/28804)

<div class="topic-metadata">

**Author:** [@Bing\_Qiu](https://discuss.elastic.co/u/Bing_Qiu)\
**Replies:** 0\
**Last updated:** [September 8, 2015, 3:50am UTC](https://discuss.elastic.co/t/partial-search-encrypted-data/28804 "2015-09-08T03:50:34Z")

</div>

Hi, Our company is considering to encrypt all the personal information data, e.g. first name, last name, email, etc. And we also want to support the partial match of those personal information. The current idea is : …

---

## [Create custom column name in data table kibana](https://discuss.elastic.co/t/create-custom-column-name-in-data-table-kibana/58118)

<div class="topic-metadata">

**Author:** [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\
**Replies:** 3\
**Last updated:** [August 17, 2016, 6:38am UTC](https://discuss.elastic.co/t/create-custom-column-name-in-data-table-kibana/58118 "2016-08-17T06:38:09Z")

</div>

My log pattern is as 1246575858696|10|TEST|30|OTHERS I want to create a data table like Customer no Provider ID Operator Rate Store 1246575858696 10 TEST 30 OTHERS I h…

---

## [Access Denied while starting elastic search](https://discuss.elastic.co/t/access-denied-while-starting-elastic-search/164550)

<div class="topic-metadata">

**Author:** [@jsunish](https://discuss.elastic.co/u/jsunish)\
**Replies:** 5\
**Last updated:** [January 18, 2019, 3:17pm UTC](https://discuss.elastic.co/t/access-denied-while-starting-elastic-search/164550 "2019-01-18T15:17:02Z")

</div>

Hi, My elasticsearch-6.4.2 instance was running successfully on Windows 7, until yesterday before I shutdown the windows without shutting down the elastic search instance that was running. Now I am getting 'Access is de…

---

## [Disable modules in Metricbeat.yml](https://discuss.elastic.co/t/disable-modules-in-metricbeat-yml/126047)

<div class="topic-metadata">

**Author:** [@pvderivco](https://discuss.elastic.co/u/pvderivco)\
**Replies:** 5\
**Last updated:** [March 29, 2018, 2:43pm UTC](https://discuss.elastic.co/t/disable-modules-in-metricbeat-yml/126047 "2018-03-29T14:43:42Z")

</div>

I am pretty new to Elastic and Beats, hence looking for some quick help! I am trying to disable some default modules like (system, aerospike etc) in metricbeat.yml using the following configuration, but this is not havi…

---

## [Failed to fetch https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease 403 Forbidden \[IP: 2600:1901:0:1d7:: 443\]](https://discuss.elastic.co/t/failed-to-fetch-https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-403-forbidden-ip-26000-443/341442)

<div class="topic-metadata">

**Author:** [@Andi0r](https://discuss.elastic.co/u/Andi0r)\
**Replies:** 8\
**Last updated:** [September 12, 2023, 9:35am UTC](https://discuss.elastic.co/t/failed-to-fetch-https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-403-forbidden-ip-26000-443/341442 "2023-09-12T09:35:06Z")

</div>

Hi, i am trying to install Elastic Search but i am getting the error: Failed to fetch https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease 403 Forbidden \[IP: 2600:1901:0:1d7:: 443\] Could it be that y…

---

## [Possible to have a health check url without authentication](https://discuss.elastic.co/t/possible-to-have-a-health-check-url-without-authentication/279564)

<div class="topic-metadata">

**Author:** [@f1outsourcing](https://discuss.elastic.co/u/f1outsourcing)\
**Replies:** 3\
**Last updated:** [July 26, 2021, 10:04pm UTC](https://discuss.elastic.co/t/possible-to-have-a-health-check-url-without-authentication/279564 "2021-07-26T22:04:50Z")

</div>

My container monitoring environment does not allow me to specify username and password for the health check url option. Is it possible to disable this for a specific url or 127.0.0.1 still having the xpack.security.enab…

---

## [Searching with Dense Vector](https://discuss.elastic.co/t/searching-with-dense-vector/213374)

<div class="topic-metadata">

**Author:** [@Dipanjan\_Nag](https://discuss.elastic.co/u/Dipanjan_Nag)\
**Replies:** 3\
**Last updated:** [January 3, 2020, 5:45pm UTC](https://discuss.elastic.co/t/searching-with-dense-vector/213374 "2020-01-03T17:45:10Z")

</div>

Is there a way to apply a query directly to DenseVector e.g. Nearest Neighbors. I understand that a vector field (i.e. Dense or Sparse) is accessible via scoring. But I'm rather curious about true sense vector search lik…

---

## [XML to JSON and parsing the last one](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824)

<div class="topic-metadata">

**Author:** [@JPelastic](https://discuss.elastic.co/u/JPelastic)\
**Replies:** 3\
**Last updated:** [September 4, 2018, 8:40am UTC](https://discuss.elastic.co/t/xml-to-json-and-parsing-the-last-one/146824 "2018-09-04T08:40:54Z")

</div>

If I am correct, after the xml filter the field invoice contains JSON. xml { source =\> "documentout" target =\> "invoice" } I did confirm this in the stdout "invoice" =\> { "DeliveryDate" =\>…

---

## [Sending Json Logs from Filebeat 5.0.0\_alpha5-1 to Graylog 2.2.0](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809)

<div class="topic-metadata">

**Author:** [@onedaywillcome](https://discuss.elastic.co/u/onedaywillcome)\
**Replies:** 3\
**Last updated:** [November 4, 2016, 7:41am UTC](https://discuss.elastic.co/t/sending-json-logs-from-filebeat-5-0-0-alpha5-1-to-graylog-2-2-0/64809 "2016-11-04T07:41:56Z")

</div>

I am trying to send my json logs to Graylog. I've configured my filebeat.yml config file that similar to following post. However, I am not able to send my logs to Graylog properly and I get "null" message in Graylog that…

---

## [Settings: Default pipeline workers: 2](https://discuss.elastic.co/t/settings-default-pipeline-workers-2/46128)

<div class="topic-metadata">

**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\
**Replies:** 4\
**Last updated:** [April 7, 2016, 5:33am UTC](https://discuss.elastic.co/t/settings-default-pipeline-workers-2/46128 "2016-04-07T05:33:17Z")

</div>

Hi My sample data is like follow TransactionsPK,InsertTime,RetrivalRefNo,MsgType,TimeLocal,DateLocal,DateCaptured,TerminalID,CardAcqID,SystemTraceNo,Amount,TransType,PrimaryAccNo,PrimaryAccNoEnc,IssCode,ProcessingCod…

---

## [Jdbc in filter section](https://discuss.elastic.co/t/jdbc-in-filter-section/36280)

<div class="topic-metadata">

**Author:** [@adellarocca](https://discuss.elastic.co/u/adellarocca)\
**Replies:** 7\
**Last updated:** [December 10, 2015, 12:14am UTC](https://discuss.elastic.co/t/jdbc-in-filter-section/36280 "2015-12-10T00:14:53Z")

</div>

I need to lookup fields in a RDBMS (MySQL) during filter phase of Logstash to extract new informations. Neverthless jdbc plugin exists only for input section. I can't do this in input section because my fields are availa…

---

## [Datafeed has missed documents due to ingest latency error](https://discuss.elastic.co/t/datafeed-has-missed-documents-due-to-ingest-latency-error/246016)

<div class="topic-metadata">

**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\
**Replies:** 4\
**Last updated:** [August 24, 2020, 2:42pm UTC](https://discuss.elastic.co/t/datafeed-has-missed-documents-due-to-ingest-latency-error/246016 "2020-08-24T14:42:33Z")

</div>

Hello, I have many of these in the Job Management \> Job Messages tab, and I'm looking for a way to check it. first of all, the dates don't make since, but I guess it's a timezone bug in Kibana (first column's date is…

---

## [Disk Size and RAM size for each data node and master node](https://discuss.elastic.co/t/disk-size-and-ram-size-for-each-data-node-and-master-node/140833)

<div class="topic-metadata">

**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Replies:** 4\
**Last updated:** [July 20, 2018, 9:28am UTC](https://discuss.elastic.co/t/disk-size-and-ram-size-for-each-data-node-and-master-node/140833 "2018-07-20T09:28:18Z")

</div>

Hello All, I want to setup elastic search cluster with 3 node. One node will be master node and other 2 node will be data node. I have around 20 GB data per day i.e 600 GB for one month. Can you please help me to decide…

---

## [Change Mapping for Field for ALL OF LOGSTASH Created indexes](https://discuss.elastic.co/t/change-mapping-for-field-for-all-of-logstash-created-indexes/45802)

<div class="topic-metadata">

**Author:** [@Isra](https://discuss.elastic.co/u/Isra)\
**Replies:** 4\
**Last updated:** [March 30, 2016, 4:52pm UTC](https://discuss.elastic.co/t/change-mapping-for-field-for-all-of-logstash-created-indexes/45802 "2016-03-30T16:52:36Z")

</div>

I would like to change the type of the field location to geo\_point. I'm using ES with Logstash, as y'all know, indices are generated with the name logstash-yyyy-mm-dd I first created a logstash index and named it logst…

---

## [Logstash grok - How to match not(negate) the pattern in grok](https://discuss.elastic.co/t/logstash-grok-how-to-match-not-negate-the-pattern-in-grok/131922)

<div class="topic-metadata">

**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\
**Replies:** 2\
**Last updated:** [May 15, 2018, 3:19pm UTC](https://discuss.elastic.co/t/logstash-grok-how-to-match-not-negate-the-pattern-in-grok/131922 "2018-05-15T15:19:08Z")

</div>

I have bunch of log files which are named using its version numbers like below. To match the filename having compA and 2-0/3-0 version, I have like below projectA-compA-test.log projectA-compA-2-0-test.log projectA-co…

---

## [Count with logstash](https://discuss.elastic.co/t/count-with-logstash/105862)

<div class="topic-metadata">

**Author:** [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)\
**Replies:** 6\
**Last updated:** [October 31, 2017, 2:09pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862 "2017-10-31T14:09:00Z")

</div>

Hi friends i'm using elk suite to analize log file My logs contain in any row a json file that with grok i can correctly extract it.. Now, i want count the occurrences to try, i want count a simple word (for example…

---

## [Kibana internal server error at login](https://discuss.elastic.co/t/kibana-internal-server-error-at-login/254695)

<div class="topic-metadata">

**Author:** [@ofer-dev](https://discuss.elastic.co/u/ofer-dev)\
**Replies:** 3\
**Last updated:** [November 12, 2020, 10:01pm UTC](https://discuss.elastic.co/t/kibana-internal-server-error-at-login/254695 "2020-11-12T22:01:38Z")

</div>

Hi, I'm getting this error on a fresh install of Kibana: OS is ubuntu 20.04 Version: 7.9.3 Build: 34038 Error at Fetch.\_callee3$ (https://lane-concept-vic-illustration.trycloudflare.com/34038/bundles/core/core.ent…

---

## [Shards stuck in Initializing mode](https://discuss.elastic.co/t/shards-stuck-in-initializing-mode/31856)

<div class="topic-metadata">

**Author:** [@Jerome\_David](https://discuss.elastic.co/u/Jerome_David)\
**Replies:** 2\
**Last updated:** [October 11, 2015, 10:16am UTC](https://discuss.elastic.co/t/shards-stuck-in-initializing-mode/31856 "2015-10-11T10:16:28Z")

</div>

We've had a crash and had to restart our server. Our cluster has 5 nodes and we use 1 replica. Since then, every time we try to open an index, the replica for the shard 3 (always 3!) gets stuck in initializing mode. It e…

---

## [Elasticsearch Net, "all shards failed" when one node is shut down, 7.11.1](https://discuss.elastic.co/t/elasticsearch-net-all-shards-failed-when-one-node-is-shut-down-7-11-1/281712)

<div class="topic-metadata">

**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\
**Replies:** 7\
**Last updated:** [August 18, 2021, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-net-all-shards-failed-when-one-node-is-shut-down-7-11-1/281712 "2021-08-18T10:19:08Z")

</div>

Hi! I have a three nodes cluster setup on version 7.11.1, with this configuration file: bootstrap.memory\_lock: false cluster.initial\_master\_nodes: - STHLM-04 - STHLM-05 - STHLM-06 cluster.name: ELASTIC-TEST disco…

---

## [Export Users/Roles/Dashboards between instances](https://discuss.elastic.co/t/export-users-roles-dashboards-between-instances/202798)

<div class="topic-metadata">

**Author:** [@j\_a\_griffiths](https://discuss.elastic.co/u/j_a_griffiths)\
**Replies:** 1\
**Last updated:** [October 9, 2019, 10:21pm UTC](https://discuss.elastic.co/t/export-users-roles-dashboards-between-instances/202798 "2019-10-09T22:21:33Z")

</div>

We are using a dev env to trial user/role/dashboard development and would like to use a CI/CD pipeline to reflect all the changes to another instance of ECE is there any method of exporting the saved objects/users betwee…

---

## [Ruby filter event API](https://discuss.elastic.co/t/ruby-filter-event-api/95081)

<div class="topic-metadata">

**Author:** [@dtko](https://discuss.elastic.co/u/dtko)\
**Replies:** 1\
**Last updated:** [August 2, 2017, 10:23am UTC](https://discuss.elastic.co/t/ruby-filter-event-api/95081 "2017-08-02T10:23:35Z")

</div>

Hi, I’m recently having some issues with adjusting logstash ruby filter to logstash 5.0’s event API. here’s my old conf file (with suspected lines): filter { ruby { code =\> " require 'json' require 'diges…

---

## [Artifacts.elastic.co responds with 403](https://discuss.elastic.co/t/artifacts-elastic-co-responds-with-403/302151)

<div class="topic-metadata">

**Author:** [@kam1sh](https://discuss.elastic.co/u/kam1sh)\
**Replies:** 3\
**Last updated:** [May 3, 2022, 12:13pm UTC](https://discuss.elastic.co/t/artifacts-elastic-co-responds-with-403/302151 "2022-05-03T12:13:13Z")

</div>

Hi! I'm writing a blog post with overview of various logging solutions. When time has come to Elastic stack, I faced error downloading any package: $ sudo apt update \<...\> Err:8 https://artifacts.elastic.co/packages/8…

---

## [Access filtering in tree structure](https://discuss.elastic.co/t/access-filtering-in-tree-structure/130990)

<div class="topic-metadata">

**Author:** [@DLK](https://discuss.elastic.co/u/DLK)\
**Replies:** 8\
**Last updated:** [May 16, 2018, 2:15pm UTC](https://discuss.elastic.co/t/access-filtering-in-tree-structure/130990 "2018-05-16T14:15:27Z")

</div>

I have to construct a non-trivial access filter for use with all queries on my document index. My documents and related models look like this: DocumentIndexModel int Id List(int) AncestorIdPath DocumentAccessModel Ac…

---

## [Assign default value to a field if no value is present](https://discuss.elastic.co/t/assign-default-value-to-a-field-if-no-value-is-present/135753)

<div class="topic-metadata">

**Author:** [@Hanciv](https://discuss.elastic.co/u/Hanciv)\
**Replies:** 2\
**Last updated:** [June 13, 2018, 4:47pm UTC](https://discuss.elastic.co/t/assign-default-value-to-a-field-if-no-value-is-present/135753 "2018-06-13T16:47:52Z")

</div>

Hi, I am reading a log message with KV pairs in logstash and sending them over to Elastic Search. If some of the fields dont have value, i want to assing a default value like "N/A" instead of sending them as "%FIELD\_NAM…

---

## [How to perform divide math operation in elasticsearch SQL](https://discuss.elastic.co/t/how-to-perform-divide-math-operation-in-elasticsearch-sql/218932)

<div class="topic-metadata">

**Author:** [@kiran\_kumar\_sukumar](https://discuss.elastic.co/u/kiran_kumar_sukumar)\
**Replies:** 5\
**Last updated:** [February 12, 2020, 4:01pm UTC](https://discuss.elastic.co/t/how-to-perform-divide-math-operation-in-elasticsearch-sql/218932 "2020-02-12T16:01:46Z")

</div>

I have logged a few transactions in Elasticsearch and now trying to log a success % metric in Canvas using the elasticsearch SQL So the logic is this. Out of all the transactions that have ended i need to get the metric…

---

## [Nginx can't get metrix](https://discuss.elastic.co/t/nginx-cant-get-metrix/121611)

<div class="topic-metadata">

**Author:** [@Andre\_Vert](https://discuss.elastic.co/u/Andre_Vert)\
**Replies:** 6\
**Last updated:** [March 26, 2018, 9:48am UTC](https://discuss.elastic.co/t/nginx-cant-get-metrix/121611 "2018-03-26T09:48:00Z")

</div>

Hi, it's me again... I'm running a virtual machine, that is reachable under 192.168.10.10 with an nginx server. config for the status page: location ~ ^/(status|ping)$ { stub\_status on; allow all; …

---

## [Loss of connection, Timeout](https://discuss.elastic.co/t/loss-of-connection-timeout/76781)

<div class="topic-metadata">

**Author:** [@mkoch](https://discuss.elastic.co/u/mkoch)\
**Replies:** 6\
**Last updated:** [March 7, 2017, 8:11am UTC](https://discuss.elastic.co/t/loss-of-connection-timeout/76781 "2017-03-07T08:11:12Z")

</div>

After a while (couldn't tell how long), Kibana loses connection to the ES cluster (tested with two installations, one locally on the ELK stack, one from a remote machine. I am getting these error messages: 2017/02/28 1…

---

## [Removal of Development category](https://discuss.elastic.co/t/removal-of-development-category/69373)

<div class="topic-metadata">

**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Replies:** 7\
**Last updated:** [March 20, 2017, 7:18am UTC](https://discuss.elastic.co/t/removal-of-development-category/69373 "2017-03-20T07:18:34Z")

</div>

This gets very few posts and they could be better handled in the per product categories. I'd like to suggest that we just remove this category accordingly.

---

## [FileBeat client failed to connect](https://discuss.elastic.co/t/filebeat-client-failed-to-connect/47745)

<div class="topic-metadata">

**Author:** [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\
**Replies:** 4\
**Last updated:** [April 21, 2016, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-client-failed-to-connect/47745 "2016-04-21T12:51:45Z")

</div>

We are frequently getting below error in filebeat Apr 19 04:14:56 c2t07851 /usr/bin/filebeat\[31476\]: transport.go:125: SSL client failed to connect with: dial tcp XX.XX.XX.XX:9700: i/o timeout It goes away when we rest…

[Previous page](https://discuss.elastic.co/top.md?page=552&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=554&per_page=50&period=all)
