# Top

**URL:** https://discuss.elastic.co/top.md?page=567&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 568

---

## [Configuring Functionbeat with AWS VPC information for self-hosted ELK](https://discuss.elastic.co/t/configuring-functionbeat-with-aws-vpc-information-for-self-hosted-elk/178508)

<div class="topic-metadata">

**Author:** [@andrewjkrull](https://discuss.elastic.co/u/andrewjkrull)\
**Replies:** 8\
**Last updated:** [May 6, 2019, 7:19am UTC](https://discuss.elastic.co/t/configuring-functionbeat-with-aws-vpc-information-for-self-hosted-elk/178508 "2019-05-06T07:19:23Z")

</div>

Good day. I have been working with Functionbeat for the past couple weeks. I was finally able to get logs to my self hosted ELK but I had to modify the IAM role Functionbeat created by adding the following policies: AW…

---

## [exception=\>#\<CSV::MalformedCSVError: Unclosed quoted field on line 1](https://discuss.elastic.co/t/exception-csv-malformedcsverror-unclosed-quoted-field-on-line-1/90703)

<div class="topic-metadata">

**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 1\
**Last updated:** [June 24, 2017, 6:53pm UTC](https://discuss.elastic.co/t/exception-csv-malformedcsverror-unclosed-quoted-field-on-line-1/90703 "2017-06-24T18:53:33Z")

</div>

Hi Experts, I am getting exception=\>#\<CSV::MalformedCSVError: Unclosed quoted field on line 1 error while parsing a CSV file. Here is my data looks like . I am getting comma separated values surrounded by double quotes …

---

## [Good query doesn't work in logstash elastic input?](https://discuss.elastic.co/t/good-query-doesnt-work-in-logstash-elastic-input/108490)

<div class="topic-metadata">

**Author:** [@ra.girard](https://discuss.elastic.co/u/ra.girard)\
**Replies:** 4\
**Last updated:** [December 12, 2017, 11:51pm UTC](https://discuss.elastic.co/t/good-query-doesnt-work-in-logstash-elastic-input/108490 "2017-12-12T23:51:28Z")

</div>

This query run perfectly directly to ElasticSearch but doesn't work in logstash. Someone could explain to me why ? Thanks My query GET /my.logs/\_search?filter\_path=hits.total,hits.hits.\_source&size=9999 { "query" :…

---

## [Shutdown master means breakdown the cluster's service?](https://discuss.elastic.co/t/shutdown-master-means-breakdown-the-clusters-service/10259)

<div class="topic-metadata">

**Author:** [@asoqa](https://discuss.elastic.co/u/asoqa)\
**Replies:** 7\
**Last updated:** [January 10, 2013, 5:59am UTC](https://discuss.elastic.co/t/shutdown-master-means-breakdown-the-clusters-service/10259 "2013-01-10T05:59:10Z")

</div>

I have one cluster with two nodes. I used the curl command to shutdown the master node: $ curl -XPOST 'http://localhost:9200/\_cluster/nodes/\_master/\_shutdown' I thought es should automatically choose a new mast…

---

## [Write thread pool queue size defaults](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449)

<div class="topic-metadata">

**Author:** [@Alex\_Abdulin](https://discuss.elastic.co/u/Alex_Abdulin)\
**Replies:** 2\
**Last updated:** [June 30, 2021, 3:12pm UTC](https://discuss.elastic.co/t/write-thread-pool-queue-size-defaults/277449 "2021-06-30T15:12:05Z")

</div>

Hello, everyone! I'm tuning ES 6.8 for indexing performance and noticed one interesting thing. There is a significant difference in the default value of the q size in versions 6.8 and 7.x. The documentation states: ES …

---

## [IPv6 support](https://discuss.elastic.co/t/ipv6-support/24265)

<div class="topic-metadata">

**Author:** [@rikribbers](https://discuss.elastic.co/u/rikribbers)\
**Replies:** 2\
**Last updated:** [June 25, 2015, 7:14am UTC](https://discuss.elastic.co/t/ipv6-support/24265 "2015-06-25T07:14:05Z")

</div>

Hello, Will elasticsearch support ipv6 addresses as an IP type. Especially native support for searching different presentations. e.g. The following addresses are all the same ip addresses with different presentations …

---

## [Elastic APM Not accessible outside docker container](https://discuss.elastic.co/t/elastic-apm-not-accessible-outside-docker-container/311026)

<div class="topic-metadata">

**Author:** [@sathishsoundharajan](https://discuss.elastic.co/u/sathishsoundharajan)\
**Replies:** 8\
**Last updated:** [August 3, 2022, 1:27am UTC](https://discuss.elastic.co/t/elastic-apm-not-accessible-outside-docker-container/311026 "2022-08-03T01:27:39Z")

</div>

Describe the bug OTEL Collector not able to connect to elastic-apm Steps to reproduce Please follow the instructions here, it is simple App What did you expect to see? i'm expecting to see the tracing logs to be se…

---

## [Topbeat with redis](https://discuss.elastic.co/t/topbeat-with-redis/34157)

<div class="topic-metadata">

**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Replies:** 8\
**Last updated:** [November 12, 2015, 2:57am UTC](https://discuss.elastic.co/t/topbeat-with-redis/34157 "2015-11-12T02:57:26Z")

</div>

topbeat version 1.0.0rc logstash 2.0 redis I am using the following in my logstash conf: input { beats { port =\> 5044 type =\> "X" } } output { if \[type\] == "X" { redis { host =\> "192.168.99.…

---

## [Querying for inner json parameters](https://discuss.elastic.co/t/querying-for-inner-json-parameters/105083)

<div class="topic-metadata">

**Author:** [@shaked571](https://discuss.elastic.co/u/shaked571)\
**Replies:** 3\
**Last updated:** [October 25, 2017, 5:00pm UTC](https://discuss.elastic.co/t/querying-for-inner-json-parameters/105083 "2017-10-25T17:00:34Z")

</div>

HI everyone, I am new in Kibana and i have some difficulties in my queries while using the Dev Tools. I try to find a log according to his nested json and getting an Error back and i wish to know what I'm doing wrong …

---

## [Canvas markdown is not showing data](https://discuss.elastic.co/t/canvas-markdown-is-not-showing-data/193442)

<div class="topic-metadata">

**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\
**Replies:** 5\
**Last updated:** [August 2, 2019, 11:52pm UTC](https://discuss.elastic.co/t/canvas-markdown-is-not-showing-data/193442 "2019-08-02T23:52:06Z")

</div>

Hi In canvas markdown. I am using elastic sql to pull data from metric beat and sorting it to latest document as I wanted to see the latest result of the jenkins job. SELECT http.json\_test.building,http.json\_test.url,h…

---

## [Filebeat - Dissect Message String](https://discuss.elastic.co/t/filebeat-dissect-message-string/251435)

<div class="topic-metadata">

**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\
**Replies:** 3\
**Last updated:** [October 12, 2020, 11:15am UTC](https://discuss.elastic.co/t/filebeat-dissect-message-string/251435 "2020-10-12T11:15:50Z")

</div>

Hi, I am looking for advise on how to use the processor-\> dissect within Filebeat for a log file. Below is an example of the log file date: \[08/10/2020 09:31:57\] servername - Processor Queue Ok 3 WMI (localhost:Pro…

---

## ["status" : "yellow"](https://discuss.elastic.co/t/status-yellow/35782)

<div class="topic-metadata">

**Author:** [@Ivan\_Ghisleni](https://discuss.elastic.co/u/Ivan_Ghisleni)\
**Replies:** 3\
**Last updated:** [November 30, 2015, 8:24am UTC](https://discuss.elastic.co/t/status-yellow/35782 "2015-11-30T08:24:31Z")

</div>

Hi to everyone, I'm a Elasticsearch noob and I'm testing it on my local PC, when I test the health of cluster it returns me status: yellow, what can I do? Result of cluster health: { "cluster\_name" : "elasticse…

---

## [Alert when there is no data in index](https://discuss.elastic.co/t/alert-when-there-is-no-data-in-index/206535)

<div class="topic-metadata">

**Author:** [@Polina\_Blinchevsky](https://discuss.elastic.co/u/Polina_Blinchevsky)\
**Replies:** 3\
**Last updated:** [November 6, 2019, 9:03am UTC](https://discuss.elastic.co/t/alert-when-there-is-no-data-in-index/206535 "2019-11-06T09:03:31Z")

</div>

I have data coming into an index from few different sources and I want to create an alert (preferably slack) when there's no data for the last few minutes for one of the sources (filter by unique id field). I'm trying t…

---

## [Suggest next word without suggesting entire field value](https://discuss.elastic.co/t/suggest-next-word-without-suggesting-entire-field-value/20272)

<div class="topic-metadata">

**Author:** [@Richard\_Tier](https://discuss.elastic.co/u/Richard_Tier)\
**Replies:** 0\
**Last updated:** [October 15, 2014, 11:57pm UTC](https://discuss.elastic.co/t/suggest-next-word-without-suggesting-entire-field-value/20272 "2014-10-15T23:57:59Z")

</div>

Hi, I am a bit stuck with suggestions. I would like to suggest the next word, and I would like the suggestion to occur even if the word the user provides is in the middle of a field's value (and not just at the st…

---

## [Logstash memory requirements](https://discuss.elastic.co/t/logstash-memory-requirements/94735)

<div class="topic-metadata">

**Author:** [@soumya1](https://discuss.elastic.co/u/soumya1)\
**Replies:** 2\
**Last updated:** [August 3, 2017, 9:03am UTC](https://discuss.elastic.co/t/logstash-memory-requirements/94735 "2017-08-03T09:03:08Z")

</div>

Hi i am configuring logstash so as to send data from 3 kafka clusters which generates 1lac events per second per each cluster. can you tell me the java heap memory allocation and pipeline workers and batch size which …

---

## [Kibanaでのテーブル形式でのドキュメント表示 （アグリゲーションを必要としない、行表示）](https://discuss.elastic.co/t/kibana/178368)

<div class="topic-metadata">

**Author:** [@toshi\_miura](https://discuss.elastic.co/u/toshi_miura)\
**Replies:** 5\
**Last updated:** [April 25, 2019, 11:41am UTC](https://discuss.elastic.co/t/kibana/178368 "2019-04-25T11:41:05Z")

</div>

kibanaでテーブル形式の表示をしたいのですが、ドキュメントの全フィールドを表示することを求められております。 現状、下記のような形で、data tableで実装しているのですが、 ちょいちょい、動作が安定しない、テーブルが真っ白になる という状態が起きております。 （取得行は、50行とかそういったレベルです） この規模のデータ取得を、data table、アグリゲーションAPIでやるというのが無理があるように思えている…

---

## [New Elasticsearch installation takes all memory during the startup results get killed by OOM (7.15.2)](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010)

<div class="topic-metadata">

**Author:** [@cryonix\_pod](https://discuss.elastic.co/u/cryonix_pod)\
**Replies:** 6\
**Last updated:** [December 6, 2021, 10:57am UTC](https://discuss.elastic.co/t/new-elasticsearch-installation-takes-all-memory-during-the-startup-results-get-killed-by-oom-7-15-2/291010 "2021-12-06T10:57:08Z")

</div>

I was trying to install Elasticsearch last few hours and I was unable to do so. It turns out systemd got timed out trying to start the elasticsearch service. Initially I was trying to install it in a vm of 2 Gig mem (ora…

---

## [Single line visualization for data posted at different time stamp with relation between data set](https://discuss.elastic.co/t/single-line-visualization-for-data-posted-at-different-time-stamp-with-relation-between-data-set/73670)

<div class="topic-metadata">

**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\
**Replies:** 6\
**Last updated:** [February 7, 2017, 7:07am UTC](https://discuss.elastic.co/t/single-line-visualization-for-data-posted-at-different-time-stamp-with-relation-between-data-set/73670 "2017-02-07T07:07:53Z")

</div>

Hi All, Please suggest how to plot different states on a time line view when posted as below sample data , if I use line chart with time stamp on x axis and a sub-bucket of unique ID then it is left with only option wh…

---

## [Elastalert change timezone](https://discuss.elastic.co/t/elastalert-change-timezone/287317)

<div class="topic-metadata">

**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\
**Replies:** 5\
**Last updated:** [October 21, 2021, 2:07pm UTC](https://discuss.elastic.co/t/elastalert-change-timezone/287317 "2021-10-21T14:07:17Z")

</div>

Hi i running my el;asticsearch and elastalert in docker. Data pass from beat to Elasticsearch. In Elasticsearch the time is stored local time but in elastalert is in UTC time. so when i test rule, i am hitting 0 hit sicn…

---

## [Kibana HTML Iframe](https://discuss.elastic.co/t/kibana-html-iframe/80478)

<div class="topic-metadata">

**Author:** [@ALS](https://discuss.elastic.co/u/ALS)\
**Replies:** 5\
**Last updated:** [March 29, 2017, 2:07pm UTC](https://discuss.elastic.co/t/kibana-html-iframe/80478 "2017-03-29T14:07:58Z")

</div>

Hello everyone, I have just installed ELK suite in order to visualize logs produced by a system. For users, i have a remote HTML interface with a Kibana Iframe (i use the share functionality to present a snapshot of…

---

## [Getting lots of context canceled - internal error in APM server logs](https://discuss.elastic.co/t/getting-lots-of-context-canceled-internal-error-in-apm-server-logs/241582)

<div class="topic-metadata">

**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\
**Replies:** 4\
**Last updated:** [July 22, 2020, 4:23am UTC](https://discuss.elastic.co/t/getting-lots-of-context-canceled-internal-error-in-apm-server-logs/241582 "2020-07-22T04:23:22Z")

</div>

I am having the below setup Elasticsearch version: 7.5.1 APM Server version: 7.5.1 APM Agent language and version: elasticapm-java/1.12.0 I am seeing lot of the below errors - 2020-07-17T11:10:00.132+0530 ERROR \[req…

---

## [Flush all history log in kibana](https://discuss.elastic.co/t/flush-all-history-log-in-kibana/80464)

<div class="topic-metadata">

**Author:** [@manopmk](https://discuss.elastic.co/u/manopmk)\
**Replies:** 3\
**Last updated:** [March 29, 2017, 11:09am UTC](https://discuss.elastic.co/t/flush-all-history-log-in-kibana/80464 "2017-03-29T11:09:28Z")

</div>

Hi Buddy How to flush , clear all history logs note : Dont want curl cmd,expecting solution like http://localhost:port....

---

## [Enabling File Data while using \_bulk API](https://discuss.elastic.co/t/enabling-file-data-while-using-bulk-api/102023)

<div class="topic-metadata">

**Author:** [@Atul\_Harsha](https://discuss.elastic.co/u/Atul_Harsha)\
**Replies:** 6\
**Last updated:** [September 29, 2017, 11:56am UTC](https://discuss.elastic.co/t/enabling-file-data-while-using-bulk-api/102023 "2017-09-29T11:56:24Z")

</div>

Hi all, I am elastic search beginner and i am stuck in the following code. Please Help me out POST /cars/transactions/\_bulk { "index": {}} { "price" : 10000, "color" : "red", "make" : "honda", "sold" : "2014-10-28" } …

---

## [Assign unassigned primary shard](https://discuss.elastic.co/t/assign-unassigned-primary-shard/9490)

<div class="topic-metadata">

**Author:** [@Stefan\_Pi\_3](https://discuss.elastic.co/u/Stefan_Pi_3)\
**Replies:** 6\
**Last updated:** [October 31, 2012, 10:02am UTC](https://discuss.elastic.co/t/assign-unassigned-primary-shard/9490 "2012-10-31T10:02:43Z")

</div>

Hi all, we're using ES 0.19.0 with 5 nodes and around 4700 primary shards. The index.number\_of\_replicas setting is set to 1, so we have 2 copies of each shard (one primary and one non-primary) which leads to aroun…

---

## [Date Detection not always wanted](https://discuss.elastic.co/t/date-detection-not-always-wanted/3410)

<div class="topic-metadata">

**Author:** [@jamster](https://discuss.elastic.co/u/jamster)\
**Replies:** 6\
**Last updated:** [October 6, 2010, 3:08pm UTC](https://discuss.elastic.co/t/date-detection-not-always-wanted/3410 "2010-10-06T15:08:18Z")

</div>

Hello, I seem to be having with the way ES auto determines a fields dateness. We have massive sets of data, that while we try our hardest to date scrub, data with bad dates sometimes do get through. Because ou…

---

## [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/125622)

<div class="topic-metadata">

**Author:** [@jchannon](https://discuss.elastic.co/u/jchannon)\
**Replies:** 1\
**Last updated:** [March 27, 2018, 4:57am UTC](https://discuss.elastic.co/t/illegal-argument-exception/125622 "2018-03-27T04:57:25Z")

</div>

I'm trying to index the below structure via fluentd We have no indexes so this is the first document. When sending it to Elastic we get 2018-03-26 13:51:16 +0000 \[error\]: #0 Could not push log to Elasticsearch: {"took…

---

## [Elasticsearch-PHP =\> query issue with parameter size & from \[FIX\]](https://discuss.elastic.co/t/elasticsearch-php-query-issue-with-parameter-size-from-fix/39215)

<div class="topic-metadata">

**Author:** [@Dom\_Sie](https://discuss.elastic.co/u/Dom_Sie)\
**Replies:** 4\
**Last updated:** [January 14, 2016, 10:03am UTC](https://discuss.elastic.co/t/elasticsearch-php-query-issue-with-parameter-size-from-fix/39215 "2016-01-14T10:03:42Z")

</div>

Hi \[:slightly\_smiling:\] I have a issue with my elasticsearch query \[use elasticsearch-php 2.0\]: $client = new Elasticsearch\\Client(); $suchString = addslashes(utf8\_decode($\_POST\['suche'\])); $params = \[ 'i…

---

## [Kibana って生データのプロットが選択肢に無いようなんですが・・](https://discuss.elastic.co/t/kibana/29003)

<div class="topic-metadata">

**Author:** [@samfukuda](https://discuss.elastic.co/u/samfukuda)\
**Replies:** 4\
**Last updated:** [September 11, 2015, 6:19am UTC](https://discuss.elastic.co/t/kibana/29003 "2015-09-11T06:19:14Z")

</div>

Experts, 素朴な疑問なんですが、ここ数日で Kibana をインストールしてみて X-Axis に Date Histogram を選択して Y-Axis に数値フィールドを表示したい場合、総数(count), 平均値(avg), 合計値(sum), 最小値(min), 最大値(max), 標準偏差、パーセンタイル等選択肢だけで生値をプロットしたい場合の方法は実装されてないんでしょうか？

---

## [How to remove fields with regex from json?](https://discuss.elastic.co/t/how-to-remove-fields-with-regex-from-json/111776)

<div class="topic-metadata">

**Author:** [@son](https://discuss.elastic.co/u/son)\
**Replies:** 5\
**Last updated:** [December 19, 2017, 8:48am UTC](https://discuss.elastic.co/t/how-to-remove-fields-with-regex-from-json/111776 "2017-12-19T08:48:45Z")

</div>

Hi, I am stucking in removing fields with regex. I have log in json. From filebeat i have configured it to push to logstash via config: filebeat.prospectors: input\_type: log paths: E:\\test\\app\\Logging\\test.json j…

---

## [Failed to connect to master node](https://discuss.elastic.co/t/failed-to-connect-to-master-node/119754)

<div class="topic-metadata">

**Author:** [@sbu](https://discuss.elastic.co/u/sbu)\
**Replies:** 2\
**Last updated:** [February 15, 2018, 11:58am UTC](https://discuss.elastic.co/t/failed-to-connect-to-master-node/119754 "2018-02-15T11:58:06Z")

</div>

Hi, We are having problems setting up a cluster on Azure using docker. We are using three docker run commands to start each of the nodes, along the lines of :- sudo docker run --net=bridge -d -e "node.master=true" -e "…

---

## [Duration values format in Kibana](https://discuss.elastic.co/t/duration-values-format-in-kibana/94396)

<div class="topic-metadata">

**Author:** [@Bob04](https://discuss.elastic.co/u/Bob04)\
**Replies:** 1\
**Last updated:** [July 24, 2017, 9:59pm UTC](https://discuss.elastic.co/t/duration-values-format-in-kibana/94396 "2017-07-24T21:59:42Z")

</div>

I have a duration field that is calculated as a difference between two data values. In Kibana, I updated field Format as Duration, Input Format as Seconds and Output Format as Human Readable. But on the graph the va…

---

## [Resolved - Logstash - CSV parse failure for some records](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-for-some-records/170842)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 6\
**Last updated:** [March 8, 2019, 1:32pm UTC](https://discuss.elastic.co/t/resolved-logstash-csv-parse-failure-for-some-records/170842 "2019-03-08T13:32:38Z")

</div>

Hi Team, I have a huge csv file exported from github which is the commit information of engineers. In the csv, there're two columns (COMMIT\_COMMENT and JIRA\_KEY) might contain special characters, but unlikely I am not a…

---

## [How to compress data automatically?](https://discuss.elastic.co/t/how-to-compress-data-automatically/180908)

<div class="topic-metadata">

**Author:** [@david3721](https://discuss.elastic.co/u/david3721)\
**Replies:** 2\
**Last updated:** [May 14, 2019, 3:31am UTC](https://discuss.elastic.co/t/how-to-compress-data-automatically/180908 "2019-05-14T03:31:20Z")

</div>

I have very huge data very day,I have to delete manually. how to automate data compression elasticsearch?

---

## [Security Technical Implementation Guide (STIG)](https://discuss.elastic.co/t/security-technical-implementation-guide-stig/90472)

<div class="topic-metadata">

**Author:** [@SendMcjak](https://discuss.elastic.co/u/SendMcjak)\
**Replies:** 1\
**Last updated:** [January 11, 2018, 7:32pm UTC](https://discuss.elastic.co/t/security-technical-implementation-guide-stig/90472 "2018-01-11T19:32:28Z")

</div>

Is there a STIG available for Elasticsearch?

---

## [Logstash "Age" Filter Plugin](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602)

<div class="topic-metadata">

**Author:** [@bt3388](https://discuss.elastic.co/u/bt3388)\
**Replies:** 6\
**Last updated:** [May 15, 2017, 6:01pm UTC](https://discuss.elastic.co/t/logstash-age-filter-plugin/84602 "2017-05-15T18:01:22Z")

</div>

I am hoping to get some help getting the age plugin to work. It seems like a really new filter plugin without a log of documentation. - https://www.elastic.co/guide/en/logstash/current/plugins-filters-age.html Here is m…

---

## [Anamoly score calculation method](https://discuss.elastic.co/t/anamoly-score-calculation-method/105737)

<div class="topic-metadata">

**Author:** [@anomalyml](https://discuss.elastic.co/u/anomalyml)\
**Replies:** 1\
**Last updated:** [October 31, 2017, 1:14pm UTC](https://discuss.elastic.co/t/anamoly-score-calculation-method/105737 "2017-10-31T13:14:02Z")

</div>

Hi, I have a sample server data for which I'm trying to use the machine learning pack and calculate anomalies in it. I have fed the data into database and created a single metric job to perform the analysis. The job was…

---

## [Elastic search doesn't start](https://discuss.elastic.co/t/elastic-search-doesnt-start/83801)

<div class="topic-metadata">

**Author:** [@raghuvarma](https://discuss.elastic.co/u/raghuvarma)\
**Replies:** 4\
**Last updated:** [April 27, 2017, 12:21pm UTC](https://discuss.elastic.co/t/elastic-search-doesnt-start/83801 "2017-04-27T12:21:09Z")

</div>

i have Elasticsearch 2.2 in my instance. It was working fine. recently i found the service stoped. So tried restarting, but it's stoping again by throughing below log. can any one help me here plz? \[2017-04-27 06:05…

---

## [Logstash listening on 3515 and 514](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461)

<div class="topic-metadata">

**Author:** [@cav10](https://discuss.elastic.co/u/cav10)\
**Replies:** 4\
**Last updated:** [January 31, 2017, 4:50pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461 "2017-01-31T16:50:29Z")

</div>

I am trying to get logstash listening on 3515 and 514 so I can ship logs from my Windows client and Bro sensor. I am using CentOS 6.6. Any thoughts be awesome. I've been working on this for a few days. Things I have do…

---

## [Kafka-input plugin issue](https://discuss.elastic.co/t/kafka-input-plugin-issue/64086)

<div class="topic-metadata">

**Author:** [@rai](https://discuss.elastic.co/u/rai)\
**Replies:** 7\
**Last updated:** [June 27, 2017, 4:26am UTC](https://discuss.elastic.co/t/kafka-input-plugin-issue/64086 "2017-06-27T04:26:54Z")

</div>

I am trying to use kafka-input plugin with my elk image. I have created a docker iamge based on sebp/elk and add the following line in docker file to install kafka-input plugin. RUN gosu logstash bin/logstash-plugin…

---

## [SIEM Threshold - unique values](https://discuss.elastic.co/t/siem-threshold-unique-values/246606)

<div class="topic-metadata">

**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\
**Replies:** 5\
**Last updated:** [September 1, 2020, 3:18pm UTC](https://discuss.elastic.co/t/siem-threshold-unique-values/246606 "2020-09-01T15:18:33Z")

</div>

Hi I am playing with the SIEM capability and have been using it since it was released with custom queries. I am now looking at Threshold based detection in v7.9 - something I think will be very useful. I'm not sure if…

---

## [Error establishing direct connection to mongo node at \[ip:port\]. Error output: no reachable servers](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434)

<div class="topic-metadata">

**Author:** [@devopshulk](https://discuss.elastic.co/u/devopshulk)\
**Replies:** 3\
**Last updated:** [September 1, 2021, 6:59am UTC](https://discuss.elastic.co/t/error-establishing-direct-connection-to-mongo-node-at-ip-port-error-output-no-reachable-servers/282434 "2021-09-01T06:59:26Z")

</div>

Hi, I am using MongoDB with a replica set. When I am trying to create a metricbeat MongoDB module am not sure How to give a URL. I don't understand how to solve it. when uncommenting the ssl.verification\_mode: 'none' th…

---

## [Network.publish\_host for an address outside a docker container](https://discuss.elastic.co/t/network-publish-host-for-an-address-outside-a-docker-container/20812)

<div class="topic-metadata">

**Author:** [@Robin\_Clarke](https://discuss.elastic.co/u/Robin_Clarke)\
**Replies:** 3\
**Last updated:** [November 19, 2014, 12:18pm UTC](https://discuss.elastic.co/t/network-publish-host-for-an-address-outside-a-docker-container/20812 "2014-11-19T12:18:49Z")

</div>

I am trying to do a setup like this: machine1 - 192.168.0.10 9300 =\> 9300 Docker container elasticsearch1 internal vlan 172.17.0.68 Elasticsearch transport running on port 9300 network.publish\_host 192.168.1…

---

## [Grok Pattern for optional XML tags](https://discuss.elastic.co/t/grok-pattern-for-optional-xml-tags/49667)

<div class="topic-metadata">

**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\
**Replies:** 2\
**Last updated:** [May 12, 2016, 7:12am UTC](https://discuss.elastic.co/t/grok-pattern-for-optional-xml-tags/49667 "2016-05-12T07:12:06Z")

</div>

Hi All, Apologies if this is a dumb and/or basic question. I had a search through the forums but didn't find anything that quite gave me the help I was after. I need to use a grok filter to parse events with XML payl…

---

## [Elastic Search Cluster has unassigned Shards](https://discuss.elastic.co/t/elastic-search-cluster-has-unassigned-shards/83828)

<div class="topic-metadata">

**Author:** [@farazkhan](https://discuss.elastic.co/u/farazkhan)\
**Replies:** 3\
**Last updated:** [April 27, 2017, 11:14am UTC](https://discuss.elastic.co/t/elastic-search-cluster-has-unassigned-shards/83828 "2017-04-27T11:14:22Z")

</div>

I ran health check for my cluster. Its showing RED. I see there are plenty of unassigned shards. I tried restarting the but it still wont remove the unassigned shards. I am using ES version 2.4 { "cluster\_name":"te…

---

## [Logstash XML parse with meta-data](https://discuss.elastic.co/t/logstash-xml-parse-with-meta-data/103687)

<div class="topic-metadata">

**Author:** [@sawri](https://discuss.elastic.co/u/sawri)\
**Replies:** 6\
**Last updated:** [October 16, 2017, 4:58pm UTC](https://discuss.elastic.co/t/logstash-xml-parse-with-meta-data/103687 "2017-10-16T16:58:00Z")

</div>

I don't like to needlessly bother people with long questions, so I'll keep this short and searchable. I need some logstash-xml expertise. Problem: I have a large directory of xml files that need to be inserted into ela…

---

## [Maximum allowed string Issue](https://discuss.elastic.co/t/maximum-allowed-string-issue/328076)

<div class="topic-metadata">

**Author:** [@alon\_carmelly](https://discuss.elastic.co/u/alon_carmelly)\
**Replies:** 5\
**Last updated:** [March 21, 2023, 4:21pm UTC](https://discuss.elastic.co/t/maximum-allowed-string-issue/328076 "2023-03-21T16:21:11Z")

</div>

I get this error: The content length (732630494) is bigger than the maximum allowed string (536870888) I added to kibana.yml: server.maxPayloadBytes: 888888888 savedObjects.maxImportPayloadBytes: 50485760 I added to…

---

## [Auto Reload conf file + Pipelines.yml](https://discuss.elastic.co/t/auto-reload-conf-file-pipelines-yml/248865)

<div class="topic-metadata">

**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\
**Replies:** 3\
**Last updated:** [September 17, 2020, 1:56pm UTC](https://discuss.elastic.co/t/auto-reload-conf-file-pipelines-yml/248865 "2020-09-17T13:56:42Z")

</div>

I am running conf files via pipelines.yml. pipeline.id: pipeline19 config.reload.automatic: true config.reload.interval: 3s path.config: "/etc/logstash/conf.d/ds-recentsearch.conf" queue.type: persisted After sett…

---

## [Cannot access logstash environmental variables](https://discuss.elastic.co/t/cannot-access-logstash-environmental-variables/151294)

<div class="topic-metadata">

**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\
**Replies:** 2\
**Last updated:** [October 7, 2018, 5:32am UTC](https://discuss.elastic.co/t/cannot-access-logstash-environmental-variables/151294 "2018-10-07T05:32:37Z")

</div>

I installed logstash via Docker and I keep getting the error when I am trying to access an environmental variable locally on the machine. I've tried adding it in /etc/environment and /etc/default/logstash both getting th…

---

## [S\_s\_l\_handshake\_exception in kibana while using reindex api](https://discuss.elastic.co/t/s-s-l-handshake-exception-in-kibana-while-using-reindex-api/139824)

<div class="topic-metadata">

**Author:** [@Praneeth](https://discuss.elastic.co/u/Praneeth)\
**Replies:** 2\
**Last updated:** [July 13, 2018, 1:09am UTC](https://discuss.elastic.co/t/s-s-l-handshake-exception-in-kibana-while-using-reindex-api/139824 "2018-07-13T01:09:19Z")

</div>

I have been using reindex api and trying to reindex data from remote cluster both of version 6.2.4 and I am running on centos and openjdk 1.8.0.161. X Pack installed on both clusters with trial license. When I am tryin…

---

## [Kibana dashboard import: failed to parse field visualization.kibanaSavedObjectMeta.searchSourceJSON](https://discuss.elastic.co/t/kibana-dashboard-import-failed-to-parse-field-visualization-kibanasavedobjectmeta-searchsourcejson/162169)

<div class="topic-metadata">

**Author:** [@matoro](https://discuss.elastic.co/u/matoro)\
**Replies:** 7\
**Last updated:** [January 4, 2019, 7:52pm UTC](https://discuss.elastic.co/t/kibana-dashboard-import-failed-to-parse-field-visualization-kibanasavedobjectmeta-searchsourcejson/162169 "2019-01-04T19:52:42Z")

</div>

Hi, just got filebeat installed with modules and pregenerated dashboards via make fields and make kibana. When trying to run for the first time with setup.dashboards.enabled: true, all dashboards error out with the foll…

[Previous page](https://discuss.elastic.co/top.md?page=566&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=568&per_page=50&period=all)
