# Top

**URL:** https://discuss.elastic.co/top.md?page=570&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 571

---

## [Filebeat - Multiline & Exclude Lines Combination](https://discuss.elastic.co/t/filebeat-multiline-exclude-lines-combination/120193)

<div class="topic-metadata">

**Author:** [@Amgryptio](https://discuss.elastic.co/u/Amgryptio)\
**Replies:** 2\
**Last updated:** [February 16, 2018, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-multiline-exclude-lines-combination/120193 "2018-02-16T16:15:44Z")

</div>

Hi there, We're currently using Filebeat to ship a log file into Logstash where fields are transformed for searching on in Elasticsearch however I've come into an issue I'm hoping someone here can help with. So the ide…

---

## [Stress Test / Performance Test on Elasticsearch](https://discuss.elastic.co/t/stress-test-performance-test-on-elasticsearch/84733)

<div class="topic-metadata">

**Author:** [@kishorramanan](https://discuss.elastic.co/u/kishorramanan)\
**Replies:** 1\
**Last updated:** [May 6, 2017, 3:53am UTC](https://discuss.elastic.co/t/stress-test-performance-test-on-elasticsearch/84733 "2017-05-06T03:53:51Z")

</div>

Hi, I am trying to get the performance test of my Elastic cluster. Need to check how my cluster will perform when log data is above 2 TB. Is there any test available like so?

---

## [Logstash doesn't log to elastic](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025)

<div class="topic-metadata">

**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\
**Replies:** 5\
**Last updated:** [March 30, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025 "2021-03-30T21:43:02Z")

</div>

I've been trying to troubleshoot this for quite some time and have managed to find out the following: filebeat logs everything seemingly fine turning on logstash after deleting the indexes i'm logging to SEEMINGLY wor…

---

## [Logstash json filter's add\_field ignored](https://discuss.elastic.co/t/logstash-json-filters-add-field-ignored/36504)

<div class="topic-metadata">

**Author:** [@vgondil](https://discuss.elastic.co/u/vgondil)\
**Replies:** 6\
**Last updated:** [December 7, 2015, 11:37am UTC](https://discuss.elastic.co/t/logstash-json-filters-add-field-ignored/36504 "2015-12-07T11:37:05Z")

</div>

I'm trying to use the json filter for Logstash 2.1. I find the "add\_field" option is ignored. I had a more complex config earlier, but I stripped it down to test just the add\_field. input { generator{ lines =\> \['{"@m…

---

## [Auto acknowledgement to message from RabbitMQ](https://discuss.elastic.co/t/auto-acknowledgement-to-message-from-rabbitmq/75511)

<div class="topic-metadata">

**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\
**Replies:** 4\
**Last updated:** [February 17, 2017, 2:40pm UTC](https://discuss.elastic.co/t/auto-acknowledgement-to-message-from-rabbitmq/75511 "2017-02-17T14:40:08Z")

</div>

Hi List-users I have a logstash consumer which is reading messages from RabbitMQ queues through rabbitmq input. I want to speed up the delivery using auto acknowledgement = true . I have checked the logstash documentat…

---

## [Can we expand scroll request timeout (Java API)?](https://discuss.elastic.co/t/can-we-expand-scroll-request-timeout-java-api/57696)

<div class="topic-metadata">

**Author:** [@Akita](https://discuss.elastic.co/u/Akita)\
**Replies:** 4\
**Last updated:** [August 11, 2016, 8:17am UTC](https://discuss.elastic.co/t/can-we-expand-scroll-request-timeout-java-api/57696 "2016-08-11T08:17:20Z")

</div>

Hi! Is it possible to expand the timeout of a scroll after it has been sent? Basically telling ES: "You sent me some results in the last scroll, but I'm late for processing it. Can you keep the scroll context alive a l…

---

## [Aggregate count based on Time](https://discuss.elastic.co/t/aggregate-count-based-on-time/158642)

<div class="topic-metadata">

**Author:** [@kb2295](https://discuss.elastic.co/u/kb2295)\
**Replies:** 7\
**Last updated:** [November 29, 2018, 7:48pm UTC](https://discuss.elastic.co/t/aggregate-count-based-on-time/158642 "2018-11-29T19:48:43Z")

</div>

I have an index in which each line has the field "name" and there are only about 15 names I'm dealing with. I also have a field called "lastUpdated" which is a of type Date. What I have is a pie chart of names by count.…

---

## [\[Too many errors, abort\]](https://discuss.elastic.co/t/too-many-errors-abort/151963)

<div class="topic-metadata">

**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\
**Replies:** 3\
**Last updated:** [October 15, 2018, 12:44am UTC](https://discuss.elastic.co/t/too-many-errors-abort/151963 "2018-10-15T00:44:21Z")

</div>

\`# A fatal error has been detected by the Java Runtime Environment: SIGSEGV (0xb) at pc=0x00007f8f50f71aac, pid=1, tid=72 JRE version: OpenJDK Runtime Environment (10.0.2+13) (build 10.0.2+13) Java VM: OpenJDK 64-Bit …

---

## [Parent child deep level hierarchy](https://discuss.elastic.co/t/parent-child-deep-level-hierarchy/37910)

<div class="topic-metadata">

**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\
**Replies:** 3\
**Last updated:** [December 28, 2015, 9:44am UTC](https://discuss.elastic.co/t/parent-child-deep-level-hierarchy/37910 "2015-12-28T09:44:49Z")

</div>

I want to implement multilevel inheritance in elasticsearch .And I know already that parent and child should be stored on the same shard .for example a-\>b-\>-c\>d-\>e here a is the top parent b is child of a c is child …

---

## [Too Many Request 429](https://discuss.elastic.co/t/too-many-request-429/69771)

<div class="topic-metadata">

**Author:** [@LOSApevo](https://discuss.elastic.co/u/LOSApevo)\
**Replies:** 2\
**Last updated:** [December 28, 2016, 11:44am UTC](https://discuss.elastic.co/t/too-many-request-429/69771 "2016-12-28T11:44:02Z")

</div>

Hello, I have this cluster configuration: Server 1: ES node Server 2: ES node + Logstash All the instances have pretty much the default settings of the version 2.4 I am retrieving data from social media and then push i…

---

## [Authorization Exception for SuperUser](https://discuss.elastic.co/t/authorization-exception-for-superuser/245311)

<div class="topic-metadata">

**Author:** [@apocalypse0](https://discuss.elastic.co/u/apocalypse0)\
**Replies:** 5\
**Last updated:** [August 24, 2020, 9:07pm UTC](https://discuss.elastic.co/t/authorization-exception-for-superuser/245311 "2020-08-24T21:07:51Z")

</div>

I'm running Elastic 7.8.0 on the latest Debian 10. SSL and authentication is enabled. Everything has been working fine. I've been able to connect to the ES instance using all of the stack products and using the python el…

---

## [Grok parse failed, works good with grok debugger](https://discuss.elastic.co/t/grok-parse-failed-works-good-with-grok-debugger/105473)

<div class="topic-metadata">

**Author:** [@sarikonl](https://discuss.elastic.co/u/sarikonl)\
**Replies:** 5\
**Last updated:** [October 30, 2017, 8:01pm UTC](https://discuss.elastic.co/t/grok-parse-failed-works-good-with-grok-debugger/105473 "2017-10-30T20:01:54Z")

</div>

Can someone please help me with this. I tried almost all possible ways but no luck. My grok debugger works perfect but get "beats\_input\_codec\_plain\_applied, failedparse" error in Kibana from logstash. This is the grok I…

---

## [\[ANNOUNCEMENT\] - Elasticsearch Beyonder 5.0 released](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-5-0-released/92542)

<div class="topic-metadata">

**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Replies:** 0\
**Last updated:** [July 10, 2017, 10:18pm UTC](https://discuss.elastic.co/t/announcement-elasticsearch-beyonder-5-0-released/92542 "2017-07-10T22:18:00Z")

</div>

The Elasticsearch Beyonder team is pleased to announce the elasticsearch-beyonder-5.0 release! Elasticsearch beyonder provides automatic index, mapping, alias or template creation when an elasticsearch client s…

---

## [Logs are not being pushed from beats to logstash](https://discuss.elastic.co/t/logs-are-not-being-pushed-from-beats-to-logstash/57335)

<div class="topic-metadata">

**Author:** [@rocky4bmw](https://discuss.elastic.co/u/rocky4bmw)\
**Replies:** 5\
**Last updated:** [August 8, 2016, 4:35am UTC](https://discuss.elastic.co/t/logs-are-not-being-pushed-from-beats-to-logstash/57335 "2016-08-08T04:35:37Z")

</div>

Can anyone help me in fixing this issue -\> I configured Logstash 2.3.4 , Kibana 4.5.3 and ES 2.3.4 along with search guard bundle 2.3.4 on single master server. -\> I configured beats as per standard document on clien…

---

## [Logatash input file from URL](https://discuss.elastic.co/t/logatash-input-file-from-url/29241)

<div class="topic-metadata">

**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Replies:** 5\
**Last updated:** [September 15, 2015, 10:38am UTC](https://discuss.elastic.co/t/logatash-input-file-from-url/29241 "2015-09-15T10:38:01Z")

</div>

Hi, I have a requirement where I need to put the file path as URL . Is it possible in logatash to put the file path as a URL ? and will it be real time ? ex: input { file { path =\> https://www.google.com/jsonfile…

---

## [ES doesn't remove Persian stopwords](https://discuss.elastic.co/t/es-doesnt-remove-persian-stopwords/92949)

<div class="topic-metadata">

**Author:** [@Ahmad\_Ahmadi](https://discuss.elastic.co/u/Ahmad_Ahmadi)\
**Replies:** 1\
**Last updated:** [July 13, 2017, 8:30am UTC](https://discuss.elastic.co/t/es-doesnt-remove-persian-stopwords/92949 "2017-07-13T08:30:10Z")

</div>

I made a custom analyzer based on Persian analyzer to use my custom stopwords. The problem is ES doesn't remove Persian words from the text. The analyzer: persian-without-stopwords-analyzer: { type: "persia…

---

## [ELK stack elasticsrearch index issue](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861)

<div class="topic-metadata">

**Author:** [@shufil](https://discuss.elastic.co/u/shufil)\
**Replies:** 8\
**Last updated:** [January 24, 2018, 6:48pm UTC](https://discuss.elastic.co/t/elk-stack-elasticsrearch-index-issue/116861 "2018-01-24T18:48:58Z")

</div>

I have installed ELK to analyze our log files in ubuntu 14, using nginx - kibana - elasticsearch -logstsh --- logstash client server (filebeate) nginx connected to kibana with port 5601 ,and elasticsearch.yml is running …

---

## [bulkで20M以上のデータを登録したい](https://discuss.elastic.co/t/bulk-20m/112189)

<div class="topic-metadata">

**Author:** [@thagie1i2321](https://discuss.elastic.co/u/thagie1i2321)\
**Replies:** 3\
**Last updated:** [December 20, 2017, 12:56am UTC](https://discuss.elastic.co/t/bulk-20m/112189 "2017-12-20T00:56:20Z")

</div>

お世話になります。 フォーラムへは初投稿です。 現在 bulkAPIを利用しての大量データ登録のスクリプトを作成しています。 公式では5〜15Mが推奨とされていますがどうしても20M以上の登録が不可欠となっています。 試してみたこと ・refresh\_interval -1 ・number\_of\_replicas 0 ・indices.store.throttle.max\_bytes\_per\_sec "100mb" ・i…

---

## [Customize Kibana Favicon](https://discuss.elastic.co/t/customize-kibana-favicon/58188)

<div class="topic-metadata">

**Author:** [@lorrainegray](https://discuss.elastic.co/u/lorrainegray)\
**Replies:** 3\
**Last updated:** [August 23, 2016, 9:48pm UTC](https://discuss.elastic.co/t/customize-kibana-favicon/58188 "2016-08-23T21:48:06Z")

</div>

I am struggling to figure out how to change the kibana favicon to a custom branded one. I've tried overlaying the elk.ico file in: /opt/kibana/src/ui/public/images/ and /opt/kibana/optimize/bundles/src/ui/public/…

---

## [How to change indexing\_pressure.memory.limit configuration](https://discuss.elastic.co/t/how-to-change-indexing-pressure-memory-limit-configuration/312444)

<div class="topic-metadata">

**Author:** [@DesireWithin](https://discuss.elastic.co/u/DesireWithin)\
**Replies:** 5\
**Last updated:** [August 31, 2022, 5:56am UTC](https://discuss.elastic.co/t/how-to-change-indexing-pressure-memory-limit-configuration/312444 "2022-08-31T05:56:22Z")

</div>

My es version is 7.17.5, single node. I notice that my fluent-bit return following error log: {"log":"{\\"error\\":{\\"root\_cause\\":\[{\\"type\\":\\"es\_rejected\_execution\_exception\\",\\"reason\\":\\"rejected execution of coordin…

---

## [Time Duration difference calculation in Logstash](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599)

<div class="topic-metadata">

**Author:** [@Rebin](https://discuss.elastic.co/u/Rebin)\
**Replies:** 7\
**Last updated:** [February 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599 "2021-02-09T17:01:43Z")

</div>

Hi All, i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc Input "opentime" : "2020-11-01T11:42:59.000Z", "resolvedtime" : "2020-11-02T22:38:37.000Z", Code filter { date…

---

## [Elasticsearch deprecated log - Expected a boolean for property \[index\] but got \[not\_analyzed\]](https://discuss.elastic.co/t/elasticsearch-deprecated-log-expected-a-boolean-for-property-index-but-got-not-analyzed/84232)

<div class="topic-metadata">

**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Replies:** 1\
**Last updated:** [May 2, 2017, 10:30am UTC](https://discuss.elastic.co/t/elasticsearch-deprecated-log-expected-a-boolean-for-property-index-but-got-not-analyzed/84232 "2017-05-02T10:30:27Z")

</div>

Hello, I upload data in my node and i believe at each index elasticsearch return me this error message in elasticsearch\_deprecated log : 2017-05-02T11:32:22,082\]\[WARN \]\[o.e.d.i.m.TypeParsers \] Expected a boolean …

---

## [Filtering with minimum\_should\_match: "100%" not using all tokens in field](https://discuss.elastic.co/t/filtering-with-minimum-should-match-100-not-using-all-tokens-in-field/61007)

<div class="topic-metadata">

**Author:** [@Vaughn\_Dickson](https://discuss.elastic.co/u/Vaughn_Dickson)\
**Replies:** 4\
**Last updated:** [September 20, 2016, 1:56pm UTC](https://discuss.elastic.co/t/filtering-with-minimum-should-match-100-not-using-all-tokens-in-field/61007 "2016-09-20T13:56:23Z")

</div>

Hi, We have a sourceUrl compound field with a custom analyzer for the sourceUrl.pathName component. The idea is that we can run a query to get all urls in a path, e.g. example.com/path/here brings back everything under…

---

## [Error: uninitialized constant Aws::Client::Errors](https://discuss.elastic.co/t/error-uninitialized-constant-aws-client-errors/64923)

<div class="topic-metadata">

**Author:** [@swebask](https://discuss.elastic.co/u/swebask)\
**Replies:** 5\
**Last updated:** [January 11, 2017, 5:18pm UTC](https://discuss.elastic.co/t/error-uninitialized-constant-aws-client-errors/64923 "2017-01-11T17:18:41Z")

</div>

I'm trying got move json files from s3 to elastic search and I get the following error: Error: uninitialized constant Aws::Client::Errors Here is my .conf file input { s3 { bucket =\> "xxxxxxx" access\_key\_…

---

## [Logstash 7.1.0 problem on Install](https://discuss.elastic.co/t/logstash-7-1-0-problem-on-install/182522)

<div class="topic-metadata">

**Author:** [@kingram](https://discuss.elastic.co/u/kingram)\
**Replies:** 3\
**Last updated:** [May 24, 2019, 12:04am UTC](https://discuss.elastic.co/t/logstash-7-1-0-problem-on-install/182522 "2019-05-24T00:04:37Z")

</div>

Hardware: Raspbberry Pi3 (arm processor) OS: Raspbian (Debian Stretch 9) Java: openjdk 10 $ bin/logstash -e 'input { stdin {} } output { stdout {} }' OpenJDK Server VM warning: Option UseConcMarkSweepGC was deprecated…

---

## [Unable To connect kibana 6.4 with elasticsearch 6.4](https://discuss.elastic.co/t/unable-to-connect-kibana-6-4-with-elasticsearch-6-4/149399)

<div class="topic-metadata">

**Author:** [@mrumeshkumar](https://discuss.elastic.co/u/mrumeshkumar)\
**Replies:** 3\
**Last updated:** [September 22, 2018, 6:30am UTC](https://discuss.elastic.co/t/unable-to-connect-kibana-6-4-with-elasticsearch-6-4/149399 "2018-09-22T06:30:58Z")

</div>

Hi All, I have 3 instance of elastic search 6.4.0 . on three different servers. Node Configuration: ALPR1DESEARCH01 node.data: false node.ingest: false node.master: true ALPR1DESEARCH02 node.data: true node.inge…

---

## [Can't export Data table visualization into CSV](https://discuss.elastic.co/t/cant-export-data-table-visualization-into-csv/307890)

<div class="topic-metadata">

**Author:** [@mmartinez](https://discuss.elastic.co/u/mmartinez)\
**Replies:** 2\
**Last updated:** [July 8, 2022, 3:46pm UTC](https://discuss.elastic.co/t/cant-export-data-table-visualization-into-csv/307890 "2022-07-08T15:46:05Z")

</div>

Hello, We would like to export one of our Data table visualizations into a CSV file but we just have the option to generate PDF and PNG reports. I have seen some examples in different webpages that exported in CSV but w…

---

## ["Device or resource busy" when adding to keystore in Docker Compose](https://discuss.elastic.co/t/device-or-resource-busy-when-adding-to-keystore-in-docker-compose/228130)

<div class="topic-metadata">

**Author:** [@slhck](https://discuss.elastic.co/u/slhck)\
**Replies:** 2\
**Last updated:** [May 8, 2020, 6:21pm UTC](https://discuss.elastic.co/t/device-or-resource-busy-when-adding-to-keystore-in-docker-compose/228130 "2020-05-08T18:21:44Z")

</div>

I want to persist the elasticsearch.keystore file in a Docker Compose project. Obviously there is a Catch-22 in that I could mount an existing keystore file, but I don't have one yet if I start with a new setup. So fir…

---

## [Special characters in data preventing CSV import using logstash 6.6.2](https://discuss.elastic.co/t/special-characters-in-data-preventing-csv-import-using-logstash-6-6-2/173014)

<div class="topic-metadata">

**Author:** [@touchstonemark](https://discuss.elastic.co/u/touchstonemark)\
**Replies:** 4\
**Last updated:** [March 20, 2019, 11:13am UTC](https://discuss.elastic.co/t/special-characters-in-data-preventing-csv-import-using-logstash-6-6-2/173014 "2019-03-20T11:13:44Z")

</div>

Hi all, I am trying to import a CSV file which is an export from a Service Now ticketing system into ES using Logstash 6.6.2 - but it works if I use manually entered test data - but as soon as I use actual data it fails.…

---

## [Custom fields in metricset](https://discuss.elastic.co/t/custom-fields-in-metricset/79360)

<div class="topic-metadata">

**Author:** [@shweta\_chugh](https://discuss.elastic.co/u/shweta_chugh)\
**Replies:** 1\
**Last updated:** [March 21, 2017, 1:57pm UTC](https://discuss.elastic.co/t/custom-fields-in-metricset/79360 "2017-03-21T13:57:59Z")

</div>

Can we add custom/user defined fields in inbuild modules in metricset. for instance adding filed description in MySQL module?

---

## [Kibana fails to start after 7.9.3 -\> 7.10.0 upgrade](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737)

<div class="topic-metadata">

**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\
**Replies:** 5\
**Last updated:** [November 19, 2020, 4:10pm UTC](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737 "2020-11-19T16:10:23Z")

</div>

Just updated Elastic stack from 7.9.3 to 7.10 and now kibana fails to start. I didn't notice anything in breaking changes that would apply. License is Basic, authentication is not used. \[16:24:26.937\] \[error\]\[data\]\[e…

---

## [How to Integrate Visualisation in Discover](https://discuss.elastic.co/t/how-to-integrate-visualisation-in-discover/93511)

<div class="topic-metadata">

**Author:** [@theroht](https://discuss.elastic.co/u/theroht)\
**Replies:** 5\
**Last updated:** [July 18, 2017, 8:25am UTC](https://discuss.elastic.co/t/how-to-integrate-visualisation-in-discover/93511 "2017-07-18T08:25:05Z")

</div>

How can I visualize the Data I seeing in the Discover part? I found this but that is not exactly the thing I want Is there any way to integrate a Visualisation to Discover? Or from the solution above from an other to…

---

## [Cluster nodes get disconnected and out of sync due to ping timeouts caused by transport load](https://discuss.elastic.co/t/cluster-nodes-get-disconnected-and-out-of-sync-due-to-ping-timeouts-caused-by-transport-load/56505)

<div class="topic-metadata">

**Author:** [@cardy](https://discuss.elastic.co/u/cardy)\
**Replies:** 3\
**Last updated:** [July 29, 2016, 11:47am UTC](https://discuss.elastic.co/t/cluster-nodes-get-disconnected-and-out-of-sync-due-to-ping-timeouts-caused-by-transport-load/56505 "2016-07-29T11:47:57Z")

</div>

Hiya, We have 3 elasticsearch clusters all of which are suffering a strange issue of the cluster failing after our application runs a query. We have around 1.5 TB to 2.5TB of data (including replicas) across the 3 d…

---

## [How to parse this date format and target it to @timestamp](https://discuss.elastic.co/t/how-to-parse-this-date-format-and-target-it-to-timestamp/56021)

<div class="topic-metadata">

**Author:** [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\
**Replies:** 3\
**Last updated:** [July 21, 2016, 6:00pm UTC](https://discuss.elastic.co/t/how-to-parse-this-date-format-and-target-it-to-timestamp/56021 "2016-07-21T18:00:34Z")

</div>

How to parse this date format and target it to @timestamp : 19/Jul/2016:17:39:02

---

## [Monitoring Linux System Temperature with Elasticsearch (Tested on Raspberry Pi)](https://discuss.elastic.co/t/monitoring-linux-system-temperature-with-elasticsearch-tested-on-raspberry-pi/266609)

<div class="topic-metadata">

**Author:** [@jamesgarside](https://discuss.elastic.co/u/jamesgarside)\
**Replies:** 0\
**Last updated:** [March 8, 2021, 9:45pm UTC](https://discuss.elastic.co/t/monitoring-linux-system-temperature-with-elasticsearch-tested-on-raspberry-pi/266609 "2021-03-08T21:45:12Z")

</div>

Hello all, I have just finished a quick temperature monitoring project for Linux systems using Filebeat and Elasticsearch. The repo can be found here: https://github.com/jamesgarside/linux-temperature-logger I develop…

---

## [Search for last 24 hours logs based on field?](https://discuss.elastic.co/t/search-for-last-24-hours-logs-based-on-field/222582)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 1\
**Last updated:** [March 8, 2020, 5:49am UTC](https://discuss.elastic.co/t/search-for-last-24-hours-logs-based-on-field/222582 "2020-03-08T05:49:43Z")

</div>

Hey Folks, Can someone please help me on constructing curl based query on src\_ip and agg: those for last 24 hours? here is something I constructed based on count and need help with for timerange curl -s -XGET "https:/…

---

## [/etc/init.d/kibana status show kibana not running, but actually it is running](https://discuss.elastic.co/t/etc-init-d-kibana-status-show-kibana-not-running-but-actually-it-is-running/206739)

<div class="topic-metadata">

**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\
**Replies:** 6\
**Last updated:** [November 10, 2019, 2:28am UTC](https://discuss.elastic.co/t/etc-init-d-kibana-status-show-kibana-not-running-but-actually-it-is-running/206739 "2019-11-10T02:28:22Z")

</div>

Hi All , Good morning I am using the latest stable version of elaticsearch and kibana 7.4.2 Like to point out the status of kibana using /etc/init.d/kibana status shows it as not running root@apm:~# /etc/init.d/e…

---

## [Elastic Common Schema Implementation](https://discuss.elastic.co/t/elastic-common-schema-implementation/167651)

<div class="topic-metadata">

**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\
**Replies:** 4\
**Last updated:** [February 14, 2019, 7:07pm UTC](https://discuss.elastic.co/t/elastic-common-schema-implementation/167651 "2019-02-14T19:07:55Z")

</div>

I'm working on a PoC with ELK to replace our existing SIEM product. I've used ELK in the past to pull in log data from filebeat with great success. One thing I always struggled with was schema/mapping between different…

---

## [Digest Email for specific categories](https://discuss.elastic.co/t/digest-email-for-specific-categories/190)

<div class="topic-metadata">

**Author:** [@Umit\_Seren](https://discuss.elastic.co/u/Umit_Seren)\
**Replies:** 3\
**Last updated:** [June 11, 2015, 5:57am UTC](https://discuss.elastic.co/t/digest-email-for-specific-categories/190 "2015-06-11T05:57:15Z")

</div>

Is it possible to set specific categories for which I can get a daily digest email ? I went to my preferences and activated the "When I don't visit here, send an email digest of what's new: daily" checkbox. Do I know g…

---

## [Failed to send ping to \[{#zen\_unicast}\] RemoteTransportException in Tribe node setup](https://discuss.elastic.co/t/failed-to-send-ping-to-zen-unicast-remotetransportexception-in-tribe-node-setup/40827)

<div class="topic-metadata">

**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Replies:** 1\
**Last updated:** [February 3, 2016, 7:01am UTC](https://discuss.elastic.co/t/failed-to-send-ping-to-zen-unicast-remotetransportexception-in-tribe-node-setup/40827 "2016-02-03T07:01:37Z")

</div>

Hi, I am trying to create a tribe node setup. I am having two servers , I am trying to setup one server as tribe and another as normal data node. I am using Elasticsearch version 2.1.1 Please find my config below, #D…

---

## [Node.max\_local\_storage\_nodes was set to 3, now can't upgrade to 8.0](https://discuss.elastic.co/t/node-max-local-storage-nodes-was-set-to-3-now-cant-upgrade-to-8-0/302642)

<div class="topic-metadata">

**Author:** [@Justin\_Cross](https://discuss.elastic.co/u/Justin_Cross)\
**Replies:** 7\
**Last updated:** [April 19, 2022, 7:20pm UTC](https://discuss.elastic.co/t/node-max-local-storage-nodes-was-set-to-3-now-cant-upgrade-to-8-0/302642 "2022-04-19T19:20:19Z")

</div>

Hi, So our node.max\_local\_storage\_nodes was set to 3 even though we only need 1 the whole time. Now we are trying to upgrade from 7.17.0 to 8 and it won't allow us even when we remove the node.max\_local\_storage\_nodes fr…

---

## [Error in Elasticsearch cluster on Openshift after restarting nodes](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010)

<div class="topic-metadata">

**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\
**Replies:** 7\
**Last updated:** [July 30, 2021, 1:20am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010 "2021-07-30T01:20:02Z")

</div>

Hi there, I have an Elasticsearch cluster 7.13.2 : 2 data nodes 3 master nodes 2 client nodes all of them deployed on Openshift with minimal security enabled. TLS security is not enabled, is not necessary in our case…

---

## [Error repository verification exception](https://discuss.elastic.co/t/error-repository-verification-exception/227238)

<div class="topic-metadata">

**Author:** [@Fourir\_Akbar](https://discuss.elastic.co/u/Fourir_Akbar)\
**Replies:** 7\
**Last updated:** [April 21, 2020, 4:45am UTC](https://discuss.elastic.co/t/error-repository-verification-exception/227238 "2020-04-21T04:45:57Z")

</div>

Hi there, I use Elasticsearch 6.x I follow this tutorial: https://badshah.io/backup-and-restore-elasticsearch-cluster-using-gcs/ But I got an error repository\_verification\_exception After I create a repository { "er…

---

## [The subscription link on Elastic website shows certain security features available with basic license but forum posts indicate otherwise. What's actually available with basic license?](https://discuss.elastic.co/t/the-subscription-link-on-elastic-website-shows-certain-security-features-available-with-basic-license-but-forum-posts-indicate-otherwise-whats-actually-available-with-basic-license/183819)

<div class="topic-metadata">

**Author:** [@Mandeep\_Gulati](https://discuss.elastic.co/u/Mandeep_Gulati)\
**Replies:** 1\
**Last updated:** [June 1, 2019, 10:39am UTC](https://discuss.elastic.co/t/the-subscription-link-on-elastic-website-shows-certain-security-features-available-with-basic-license-but-forum-posts-indicate-otherwise-whats-actually-available-with-basic-license/183819 "2019-06-01T10:39:54Z")

</div>

I have installed Elasticsearch via docker (version 6.5.4) not the oss image. As per my understanding it comes with a basic license. An API call to /\_xpack/license shows this response { "license" : { "status" : "ac…

---

## [Index Name is not changing in metric beat](https://discuss.elastic.co/t/index-name-is-not-changing-in-metric-beat/112452)

<div class="topic-metadata">

**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\
**Replies:** 2\
**Last updated:** [December 21, 2017, 10:05am UTC](https://discuss.elastic.co/t/index-name-is-not-changing-in-metric-beat/112452 "2017-12-21T10:05:34Z")

</div>

Hi, I have installed metricbeat in my cluster and its working fine. Now I want to change the index name for the metricbeat. For that I have changed index name in Outputs of metricbeat.reference.yml file as shown below …

---

## [Dynamic template mappins are failing on ELasticsearch 6.0](https://discuss.elastic.co/t/dynamic-template-mappins-are-failing-on-elasticsearch-6-0/109903)

<div class="topic-metadata">

**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\
**Replies:** 2\
**Last updated:** [December 1, 2017, 5:08pm UTC](https://discuss.elastic.co/t/dynamic-template-mappins-are-failing-on-elasticsearch-6-0/109903 "2017-12-01T17:08:08Z")

</div>

We rolled over to new indexes yesterday, and this is the first time we've rolled over after upgrading to ES6. Immediately we started getting exceptions from logstash and missing data with errors like this: \[2017-12-01T0…

---

## [Appropriate Cluster Setup](https://discuss.elastic.co/t/appropriate-cluster-setup/136920)

<div class="topic-metadata">

**Author:** [@elnapo](https://discuss.elastic.co/u/elnapo)\
**Replies:** 6\
**Last updated:** [June 25, 2018, 12:14pm UTC](https://discuss.elastic.co/t/appropriate-cluster-setup/136920 "2018-06-25T12:14:10Z")

</div>

Hello, I am facing the following conditions I need set up an Elasticsearch Cluster and may recalculate the hardware resources. Even if some people won't like... conditions: 512GB RAM, 26 CPU Cores, traditional text-ba…

---

## [Elasticsearch JMX debugging](https://discuss.elastic.co/t/elasticsearch-jmx-debugging/161880)

<div class="topic-metadata">

**Author:** [@cactus](https://discuss.elastic.co/u/cactus)\
**Replies:** 2\
**Last updated:** [December 22, 2018, 11:00am UTC](https://discuss.elastic.co/t/elasticsearch-jmx-debugging/161880 "2018-12-22T11:00:08Z")

</div>

Hello, I'm trying to debug Elasticsearch with JMX using ldap authentication and jmxremote.access file. jmxremote.access file: testuser readwrite jvm.options file -Dcom.sun.management.jmxremote -Dcom.sun.management.j…

---

## [Customize Canvas Data Table cell based on condition](https://discuss.elastic.co/t/customize-canvas-data-table-cell-based-on-condition/172537)

<div class="topic-metadata">

**Author:** [@antti](https://discuss.elastic.co/u/antti)\
**Replies:** 0\
**Last updated:** [March 15, 2019, 1:34pm UTC](https://discuss.elastic.co/t/customize-canvas-data-table-cell-based-on-condition/172537 "2019-03-15T13:34:23Z")

</div>

Hi, was wondering can you in current Canvas version (Kibana 6.6.0) highlight table cells, based on some condition? I mean for example, if certain column in table contains response time in seconds and in some of the rows…

---

## [How to access nested property at script\_fields on elastic 5.x](https://discuss.elastic.co/t/how-to-access-nested-property-at-script-fields-on-elastic-5-x/69855)

<div class="topic-metadata">

**Author:** [@bitgandtter](https://discuss.elastic.co/u/bitgandtter)\
**Replies:** 0\
**Last updated:** [December 22, 2016, 11:12pm UTC](https://discuss.elastic.co/t/how-to-access-nested-property-at-script-fields-on-elastic-5-x/69855 "2016-12-22T23:12:33Z")

</div>

I need to iterate over nested objects on painless script\_fields for my query but notation doc\['nestedProperty.property'\] does not gave me the value, neither does using array notation doc\['nestedProperty.property'\]\[0\] A…

[Previous page](https://discuss.elastic.co/top.md?page=569&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=571&per_page=50&period=all)
