# Top **URL:** https://discuss.elastic.co/top.md?page=585&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 586 --- ## [Stale index](https://discuss.elastic.co/t/stale-index/35918)
**Author:** [@antonkallenberg](https://discuss.elastic.co/u/antonkallenberg)\ **Replies:** 5\ **Last updated:** [November 30, 2015, 8:45pm UTC](https://discuss.elastic.co/t/stale-index/35918 "2015-11-30T20:45:00Z")
Hi Guys, Is there some way to know if an index is stale? Regards, Anton --- ## [Creating a set of yaml to create a basic ELK k8s system](https://discuss.elastic.co/t/creating-a-set-of-yaml-to-create-a-basic-elk-k8s-system/251172)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 6\ **Last updated:** [October 9, 2020, 5:41pm UTC](https://discuss.elastic.co/t/creating-a-set-of-yaml-to-create-a-basic-elk-k8s-system/251172 "2020-10-09T17:41:46Z")
In part, I think there will be some limitations with a 2015 Macbook Pro, so I plan to expand this to a cluster soon. The issue I was having though fundamentally is the creation and implementation of ELK on k8s. I was t… --- ## [Mapper Parsing Exception: Root mapping definition has unsupported paramenters](https://discuss.elastic.co/t/mapper-parsing-exception-root-mapping-definition-has-unsupported-paramenters/55809)
**Author:** [@Amjustin](https://discuss.elastic.co/u/Amjustin)\ **Replies:** 1\ **Last updated:** [July 19, 2016, 8:13am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-root-mapping-definition-has-unsupported-paramenters/55809 "2016-07-19T08:13:19Z")
Hello, I am having trouble using the Mapper attachment with ES. I am trying to use the mapper attachment to create a mapping corresponding to the MongoDB collection where my GridFS files are. I am using the mongo-conne… --- ## [How to search with only raw query JSON with ES Java API?](https://discuss.elastic.co/t/how-to-search-with-only-raw-query-json-with-es-java-api/22194)
**Author:** [@Tim\_Molter](https://discuss.elastic.co/u/Tim_Molter)\ **Replies:** 1\ **Last updated:** [February 16, 2015, 6:15pm UTC](https://discuss.elastic.co/t/how-to-search-with-only-raw-query-json-with-es-java-api/22194 "2015-02-16T18:15:11Z")
I've been trying to get this to work for many hours, but cannot figure out how to do this. First I play around with different queries using the Kopf interface, and I get a working DSL query such as: { "que… --- ## [Exclude empty values from output](https://discuss.elastic.co/t/exclude-empty-values-from-output/43517)
**Author:** [@goonzie](https://discuss.elastic.co/u/goonzie)\ **Replies:** 4\ **Last updated:** [March 4, 2016, 9:44pm UTC](https://discuss.elastic.co/t/exclude-empty-values-from-output/43517 "2016-03-04T21:44:04Z")
Hello May be anybody know how can I exclude empty lines for disk usage stat? For example where average fs.total = 0 --- ## [Average shard size](https://discuss.elastic.co/t/average-shard-size/130365)
**Author:** [@tsangdl](https://discuss.elastic.co/u/tsangdl)\ **Replies:** 3\ **Last updated:** [May 3, 2018, 7:34am UTC](https://discuss.elastic.co/t/average-shard-size/130365 "2018-05-03T07:34:31Z")
Hello learned ladies and gentlemen, I am trying to get a feel for a good average shard size. I have a 6 node cluster 3 nodes are master, data, ingest 3 nodes are data Each node has 64GB memory and 30GB java heap siz… --- ## [ADFS SAML Authentication in Elastic Stack](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127)
**Author:** [@soch234](https://discuss.elastic.co/u/soch234)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 6:49am UTC](https://discuss.elastic.co/t/adfs-saml-authentication-in-elastic-stack/129127 "2018-04-24T06:49:33Z")
Hi there, I've tested Kibana /Elasticsearch 6.2.4 SAML Authentication with MS ADFS and noticed a strange behavoir. The elasticsearch.yml file contains the following config: xpack.security.authc.realms.saml1: type: sa… --- ## [Problems with Redis input](https://discuss.elastic.co/t/problems-with-redis-input/98537)
**Author:** [@truongdqse03303](https://discuss.elastic.co/u/truongdqse03303)\ **Replies:** 5\ **Last updated:** [August 29, 2017, 4:45am UTC](https://discuss.elastic.co/t/problems-with-redis-input/98537 "2017-08-29T04:45:26Z")
Hi experts I have config to use Redis input for logstash. Here is my input logstash input { redis { host =\> "\*\*\*.\*\*\*.\*\*.\*\*\*" type =\> "redis-input" data\_type =\> "list" key =\> "filebeat" } } Whenever… --- ## [Kibana monitor index exists, but dashboard says "No Monitoring Data Found"](https://discuss.elastic.co/t/kibana-monitor-index-exists-but-dashboard-says-no-monitoring-data-found/96553)
**Author:** [@abbshr](https://discuss.elastic.co/u/abbshr)\ **Replies:** 2\ **Last updated:** [August 10, 2017, 10:03am UTC](https://discuss.elastic.co/t/kibana-monitor-index-exists-but-dashboard-says-no-monitoring-data-found/96553 "2017-08-10T10:03:51Z")
There did exist elasticsearch monitor indices for a week, but Kibana Monitoring can not show the metrics. Until yesterday, everything is ok. And I didn’t find any related error or warning logs outputted by elasticsearch… --- ## [Filebeat Memory Usage (Linux)](https://discuss.elastic.co/t/filebeat-memory-usage-linux/63772)
**Author:** [@flodense](https://discuss.elastic.co/u/flodense)\ **Replies:** 2\ **Last updated:** [October 24, 2016, 5:24pm UTC](https://discuss.elastic.co/t/filebeat-memory-usage-linux/63772 "2016-10-24T17:24:29Z")
I am experiencing a similar issue with filebeat-1.2.3 on centos7. The log file that is being tracked reaches a maximum size of about 9.6MB and rotates out every couple days. At startup, filebeat will start using 200-30… --- ## [How to share ClassLoader bewteen different Plugins](https://discuss.elastic.co/t/how-to-share-classloader-bewteen-different-plugins/181076)
**Author:** [@pazugan](https://discuss.elastic.co/u/pazugan)\ **Replies:** 6\ **Last updated:** [June 5, 2019, 6:51pm UTC](https://discuss.elastic.co/t/how-to-share-classloader-bewteen-different-plugins/181076 "2019-06-05T18:51:17Z")
Hi, I am trying develop Elatsicsearch plugins and currently facing some issue as how to share single request model and allow one plugin to accept the request in the TransportAction from other plugin. Error I message I … --- ## [VPC flow logs](https://discuss.elastic.co/t/vpc-flow-logs/131548)
**Author:** [@randomuserid](https://discuss.elastic.co/u/randomuserid)\ **Replies:** 6\ **Last updated:** [May 16, 2018, 12:04pm UTC](https://discuss.elastic.co/t/vpc-flow-logs/131548 "2018-05-16T12:04:34Z")
So I'm parsing VPC flow logs (the AWS flow logs) using the csv filter with the space char as the separator b/c I thought this would be efficient and I want to convert certain numeric fields to integers and, ideally, IPs … --- ## [Metricbeat default dashboards: how to load into specific space?](https://discuss.elastic.co/t/metricbeat-default-dashboards-how-to-load-into-specific-space/167491)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [February 7, 2019, 7:49pm UTC](https://discuss.elastic.co/t/metricbeat-default-dashboards-how-to-load-into-specific-space/167491 "2019-02-07T19:49:55Z")
Hi, I am on elastic stack 6.5.4. In the past I created my own metricbeat visualizations and dashboards, but I would like to give the sample dashboards a try to check if they can replace mine or at least to get more ins… --- ## [Logstash not producing output although pipeline main starts](https://discuss.elastic.co/t/logstash-not-producing-output-although-pipeline-main-starts/111689)
**Author:** [@khare.garima](https://discuss.elastic.co/u/khare.garima)\ **Replies:** 4\ **Last updated:** [December 14, 2017, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-producing-output-although-pipeline-main-starts/111689 "2017-12-14T08:57:26Z")
I am trying to execute logstash.bat with version 5.6 and 6.0 on a windows 10 machine. Following is the conf file: input { file { path =\> "D:/access\_log113.log" start\_position =\> "beginning" sincedb\_path =\> "/dev/nu… --- ## [Regex + phrase search](https://discuss.elastic.co/t/regex-phrase-search/111143)
**Author:** [@bb1234](https://discuss.elastic.co/u/bb1234)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 9:49pm UTC](https://discuss.elastic.co/t/regex-phrase-search/111143 "2017-12-12T21:49:58Z")
Hello everybody. I'm trying to create a search query that would allow me to find only documents e.g. with the string like this: "some kind of text 1000 other text 200 new text 3" "some kind of text 2000 other text 320… --- ## [Range filter not working for “gt” operator but working for “lt”](https://discuss.elastic.co/t/range-filter-not-working-for-gt-operator-but-working-for-lt/135603)
**Author:** [@ankurlathwal](https://discuss.elastic.co/u/ankurlathwal)\ **Replies:** 7\ **Last updated:** [June 13, 2018, 4:03pm UTC](https://discuss.elastic.co/t/range-filter-not-working-for-gt-operator-but-working-for-lt/135603 "2018-06-13T16:03:07Z")
I am using Elasticsearch to index my documents and wanted to filter documents based on a specific property. Here is my code: filter.push({ range: {"audience.ethnicity.asian" : { gt: 50 } } }) It doesn't work with g… --- ## [ES Benchmark using rally to stress a 2 node setup](https://discuss.elastic.co/t/es-benchmark-using-rally-to-stress-a-2-node-setup/150020)
**Author:** [@Jorge\_Betancourt](https://discuss.elastic.co/u/Jorge_Betancourt)\ **Replies:** 5\ **Last updated:** [October 11, 2018, 9:41am UTC](https://discuss.elastic.co/t/es-benchmark-using-rally-to-stress-a-2-node-setup/150020 "2018-10-11T09:41:00Z")
Currently, we’re trying to use rally to test how much data I can ingest in a 2 node setup (1 data node, 1 dedicated master node). Our ES setup is running in Docker. With rally we get a maximum ingestion of ~150k docs/s u… --- ## [Sincedb is not created](https://discuss.elastic.co/t/sincedb-is-not-created/52648)
**Author:** [@cokeroman](https://discuss.elastic.co/u/cokeroman)\ **Replies:** 5\ **Last updated:** [December 22, 2016, 3:52pm UTC](https://discuss.elastic.co/t/sincedb-is-not-created/52648 "2016-12-22T15:52:10Z")
Hello all, I just update my logstash server from 1.5.4 to 2.3.2. I have to update some config parameters and I am collect log from several file and indexing to elasticsearch. My problem is when the logstash processs… --- ## [Template fields are missing fields on Kibana](https://discuss.elastic.co/t/template-fields-are-missing-fields-on-kibana/23842)
**Author:** [@Beatriz\_Mano](https://discuss.elastic.co/u/Beatriz_Mano)\ **Replies:** 5\ **Last updated:** [July 1, 2015, 12:20pm UTC](https://discuss.elastic.co/t/template-fields-are-missing-fields-on-kibana/23842 "2015-07-01T12:20:47Z")
Hi, I am new on Elasticsearch and I am having some troubles with accessing certain fields, in Kibana(4.1.0). (Therefore, my problem might be being caused by an obvious mistake.) I am using logstash (1.5.0) to load logs … --- ## [Shards failed warning on Network dashboard in SIEM app](https://discuss.elastic.co/t/shards-failed-warning-on-network-dashboard-in-siem-app/219908)
**Author:** [@wconnell](https://discuss.elastic.co/u/wconnell)\ **Replies:** 8\ **Last updated:** [March 3, 2020, 12:04am UTC](https://discuss.elastic.co/t/shards-failed-warning-on-network-dashboard-in-siem-app/219908 "2020-03-03T00:04:40Z")
Hi there, I'm getting a shards failed warning in the Network dashboard of the SIEM app (v7.6). I'm unable to diagnose as when I click the "Show details" button, nothing happens. I used the inspect tool in Chrome and it … --- ## [Logstash Syslog @timestamp incorrect](https://discuss.elastic.co/t/logstash-syslog-timestamp-incorrect/166658)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 8\ **Last updated:** [February 5, 2019, 6:59pm UTC](https://discuss.elastic.co/t/logstash-syslog-timestamp-incorrect/166658 "2019-02-05T18:59:10Z")
Hi all, I am running into a bit of an issue with Logstash 6.6.0 and it processing Syslog messages. For some reason it is setting the @timestamp field to America/New\_York time thinking that it is UTC time (Kibana is also… --- ## [How to install Filebeat?](https://discuss.elastic.co/t/how-to-install-filebeat/37094)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 8\ **Last updated:** [December 14, 2015, 8:28am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094 "2015-12-14T08:28:17Z")
We have two gcloud instances and we need to collect logs of those two instances using filebeat and we have another instance to store the logs and to analyze by kibana ,elasticsearch and logstash.My question can you tell… --- ## [Not able to setup filebeat on windows server 2012 R2](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304)
**Author:** [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Replies:** 6\ **Last updated:** [January 16, 2016, 9:52am UTC](https://discuss.elastic.co/t/not-able-to-setup-filebeat-on-windows-server-2012-r2/39304 "2016-01-16T09:52:56Z")
I am trying to setup filebeat on windows server. filebeat version : filebeat-1.2.0-nightlylatest-windows I will brieg the steps I did.. 1. PS C:\\Scripts\\filebeat\> ./install-service-filebeat.ps1 Here I got some exec… --- ## [Logstash : jdbc - Unable to connect to database](https://discuss.elastic.co/t/logstash-jdbc-unable-to-connect-to-database/239898)
**Author:** [@Amine\_Aloui](https://discuss.elastic.co/u/Amine_Aloui)\ **Replies:** 2\ **Last updated:** [July 6, 2020, 6:18pm UTC](https://discuss.elastic.co/t/logstash-jdbc-unable-to-connect-to-database/239898 "2020-07-06T18:18:23Z")
this is my file : contact.conf input { jdbc { jdbc\_driver\_library =\> "/tmp/postgresql-42.2.12.jar" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_connection\_st… --- ## [Mutate rename multiple fields, how to improve performance?](https://discuss.elastic.co/t/mutate-rename-multiple-fields-how-to-improve-performance/252606)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [October 19, 2020, 9:05pm UTC](https://discuss.elastic.co/t/mutate-rename-multiple-fields-how-to-improve-performance/252606 "2020-10-19T21:05:02Z")
Hello, I have a pipeline where I need to rename something around 1100 fields, the documents do not have all the fields, but in total I need to rename near 1100 fields. Currently I have one mutate filter with a rename a… --- ## [Logstash not Starting](https://discuss.elastic.co/t/logstash-not-starting/79148)
**Author:** [@AHK](https://discuss.elastic.co/u/AHK)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 3:29am UTC](https://discuss.elastic.co/t/logstash-not-starting/79148 "2017-03-21T03:29:48Z")
Hello, I am trying to install ELK & I follow all topic on when i try this command sudo service logstash configtest Error is Could not find any executable java binary. Please install java in your PATH or set JAVAH… --- ## [Display date without time in Elasticsearch](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266)
**Author:** [@VeeT](https://discuss.elastic.co/u/VeeT)\ **Replies:** 5\ **Last updated:** [November 16, 2020, 4:33pm UTC](https://discuss.elastic.co/t/display-date-without-time-in-elasticsearch/255266 "2020-11-16T16:33:46Z")
Hi, I have the following input in a "Date" field: Date=2020.11.12 Currently, it's displaying as this in Kibana: Date Nov 12, 2020 @ 00:00:00.000 I would like to display this as is in Kibana, i.e., Date: 2020.11.12. … --- ## [Sorting on field which in text data type but integer will be store](https://discuss.elastic.co/t/sorting-on-field-which-in-text-data-type-but-integer-will-be-store/217046)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 9:05am UTC](https://discuss.elastic.co/t/sorting-on-field-which-in-text-data-type-but-integer-will-be-store/217046 "2020-01-31T09:05:32Z")
Hi, We have a field in index - TempNo which has to be text type but all values in this field are number (integer) When i am doing sorting (desc) on this field , sort does not happen correctly. I am not getting result i… --- ## [Logstash 6.0 breaks ruby event iteration](https://discuss.elastic.co/t/logstash-6-0-breaks-ruby-event-iteration/109084)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 4\ **Last updated:** [November 27, 2017, 6:52am UTC](https://discuss.elastic.co/t/logstash-6-0-breaks-ruby-event-iteration/109084 "2017-11-27T06:52:07Z")
After upgrade to LS 6.0 following code stopped to work properly: ruby { code =\> " hash = event.to\_hash hash.each do |k,v| if v == '-' event.remove(k) else if v.is\_a?… --- ## [Finding documents \_almost\_ the same](https://discuss.elastic.co/t/finding-documents--almost--the-same/66089)
**Author:** [@frankkoornstra](https://discuss.elastic.co/u/frankkoornstra)\ **Replies:** 4\ **Last updated:** [November 15, 2016, 3:12pm UTC](https://discuss.elastic.co/t/finding-documents--almost--the-same/66089 "2016-11-15T15:12:21Z")
We're running into this problem and I'm musing about several solutions, please join me in that process :slight\_smile: We have about 25+ million documents relating to videos and I want to run More Like This, based on 1 … --- ## [WARN: org.elasticsearch.transport.netty:](https://discuss.elastic.co/t/warn-org-elasticsearch-transport-netty/38653)
**Author:** [@constantino](https://discuss.elastic.co/u/constantino)\ **Replies:** 4\ **Last updated:** [January 7, 2016, 7:14pm UTC](https://discuss.elastic.co/t/warn-org-elasticsearch-transport-netty/38653 "2016-01-07T19:14:33Z")
Hi, I'm working with ElasticSearch 1.5.1. and LogsTash1.4.2 if send message as follows: logstash -e 'input { stdin { } } output { elasticsearch { host =\> \["192.168.32.124"\] } }' everything works well, but whe… --- ## [Use term "id“ in input plugin, but "id" is not output and not shown in Kibana](https://discuss.elastic.co/t/use-term-id-in-input-plugin-but-id-is-not-output-and-not-shown-in-kibana/115038)
**Author:** [@fan-chao](https://discuss.elastic.co/u/fan-chao)\ **Replies:** 2\ **Last updated:** [January 11, 2018, 11:57am UTC](https://discuss.elastic.co/t/use-term-id-in-input-plugin-but-id-is-not-output-and-not-shown-in-kibana/115038 "2018-01-11T11:57:20Z")
Hi, We added common option "id" in input plugin. But this option is not output and it is not shown up in Kibana. The config is as below. input { udp { id =\> "my\_plugin\_id" port =\> 5040 codec =\> "line" type =\> "MA… --- ## [7.16 Java Client - UpdateRequest example](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 3\ **Last updated:** [January 31, 2022, 4:25pm UTC](https://discuss.elastic.co/t/7-16-java-client-updaterequest-example/295846 "2022-01-31T16:25:35Z")
Hi, I'm struggling to understand how to do an UpdateRequest with the latest java client. For example, this: client.update(new UpdateRequest.Builder\<\>() .index(index) .id(id) … --- ## [Different results for same query](https://discuss.elastic.co/t/different-results-for-same-query/111757)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [December 18, 2017, 9:36am UTC](https://discuss.elastic.co/t/different-results-for-same-query/111757 "2017-12-18T09:36:32Z")
Hi, Using kibana 6.0.1. I get different results when running the same question on the same data multiple times: \[grafik\] \[grafik\] on left side the the value for 25th and 50th percentile havent been changed, although… --- ## [Mapping ids to labels with a scripted field](https://discuss.elastic.co/t/mapping-ids-to-labels-with-a-scripted-field/221841)
**Author:** [@IvanHerreros](https://discuss.elastic.co/u/IvanHerreros)\ **Replies:** 5\ **Last updated:** [March 4, 2020, 1:23pm UTC](https://discuss.elastic.co/t/mapping-ids-to-labels-with-a-scripted-field/221841 "2020-03-04T13:23:30Z")
Hi, I am using ES to archive data originally stored in a relational DB, and then provide a Kibana Dashboard. I store "denormalized" data (that is, performing joins at upload time), which of course comes with some caveats… --- ## [.CSV input with JSON in it :(](https://discuss.elastic.co/t/csv-input-with-json-in-it/188952)
**Author:** [@EvanG](https://discuss.elastic.co/u/EvanG)\ **Replies:** 5\ **Last updated:** [July 4, 2019, 7:48pm UTC](https://discuss.elastic.co/t/csv-input-with-json-in-it/188952 "2019-07-04T19:48:50Z")
Hey Team, New here! And new to ELK stack. Me and my colleague have spent days trying to figure out a solution to our problem, and yet have not come up with a resolution. Background: Our company has tasked us to ingest … --- ## [ShieldによるAD連携](https://discuss.elastic.co/t/shield-ad/50104)
**Author:** [@kurio](https://discuss.elastic.co/u/kurio)\ **Replies:** 7\ **Last updated:** [June 3, 2016, 2:04am UTC](https://discuss.elastic.co/t/shield-ad/50104 "2016-06-03T02:04:55Z")
ご教示お願い致します。 Shieldの認証でAD連携を試みているのですが、一通り設定した後Kibanaにアクセスすると「plugin:elasticsearch Authentication Exception」と出てきます。 KibanaとElasticsearchがうまく連携できてないとは思うのですが・・・ 以下、各設定ファイル名とその内容でございます。 ----elasticsearch.yml---- shie… --- ## [Clearing a scroll during scan and scroll?](https://discuss.elastic.co/t/clearing-a-scroll-during-scan-and-scroll/42080)
**Author:** [@patrick99e99](https://discuss.elastic.co/u/patrick99e99)\ **Replies:** 1\ **Last updated:** [February 17, 2016, 11:31pm UTC](https://discuss.elastic.co/t/clearing-a-scroll-during-scan-and-scroll/42080 "2016-02-17T23:31:23Z")
I have a large document that I am trying to reindex in-place using scan and scroll. I've created a new index, and am doing a search on the old index with a type of scan, with a match all query, size of 600, and then bu… --- ## [Use of keyword 'else' causes error "Couldn't find any filter plugin named 'else'."](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988)
**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\ **Replies:** 3\ **Last updated:** [December 14, 2018, 3:28pm UTC](https://discuss.elastic.co/t/use-of-keyword-else-causes-error-couldnt-find-any-filter-plugin-named-else/159988 "2018-12-14T15:28:15Z")
I have the following code in my filter. The construct, if ... else if ... else are described by Logstash documentation as being valid yet /var/log/logstash/logstash-plain.log records this error message. filter { if \[s… --- ## [Can't get filebeat Netflow Module to work](https://discuss.elastic.co/t/cant-get-filebeat-netflow-module-to-work/258459)
**Author:** [@Gambit22](https://discuss.elastic.co/u/Gambit22)\ **Replies:** 4\ **Last updated:** [December 28, 2020, 6:36pm UTC](https://discuss.elastic.co/t/cant-get-filebeat-netflow-module-to-work/258459 "2020-12-28T18:36:14Z")
Hello Everyone, I've been pulling my hair out trying to understand why Filebeat's net flow module keeps causing filebeats to end. Heres the error it keeps outputting: 2020-12-11T17:42:22.025-0700 ERROR instance/be… --- ## [How to forward logs from a logstash “agent” to “master”](https://discuss.elastic.co/t/how-to-forward-logs-from-a-logstash-agent-to-master/35639)
**Author:** [@Michael\_Bulla](https://discuss.elastic.co/u/Michael_Bulla)\ **Replies:** 6\ **Last updated:** [November 26, 2015, 11:47am UTC](https://discuss.elastic.co/t/how-to-forward-logs-from-a-logstash-agent-to-master/35639 "2015-11-26T11:47:31Z")
Until now my ELK setup looks like this Logstash Forwarder -\> Logstash 1.4 -\> Elstatic Search Now I want to replace the Forwarder by a full blown Logstash, so I can collect data from more inputs than just files and c… --- ## [Sub string search along with case Insensitive and special characters](https://discuss.elastic.co/t/sub-string-search-along-with-case-insensitive-and-special-characters/93390)
**Author:** [@Suresh\_Yerrarapu](https://discuss.elastic.co/u/Suresh_Yerrarapu)\ **Replies:** 0\ **Last updated:** [July 17, 2017, 12:37pm UTC](https://discuss.elastic.co/t/sub-string-search-along-with-case-insensitive-and-special-characters/93390 "2017-07-17T12:37:09Z")
Hi There, Is it possible to query(wildcard search) on index with case insensitive as well as special characters without lower casing the input data . My requirements are below: a). Data contains small case, upper cas… --- ## [Logstash 1.5.0 GA released](https://discuss.elastic.co/t/logstash-1-5-0-ga-released/712)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [May 14, 2015, 7:36pm UTC](https://discuss.elastic.co/t/logstash-1-5-0-ga-released/712 "2015-05-14T19:36:53Z")
We are pleased to announce the GA release of Logstash 1.5.0 with plugin changes, performance improvements, Apache Kafka integration and more! A big thank you to all our users for the many contributions, feedback, GitHub … --- ## [\[SOLVED\] Syslog filter additional filtering](https://discuss.elastic.co/t/solved-syslog-filter-additional-filtering/65526)
**Author:** [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 3:05pm UTC](https://discuss.elastic.co/t/solved-syslog-filter-additional-filtering/65526 "2016-11-10T15:05:40Z")
Hello all. I'm very new to logstash and I'm trying to add additional fields to an existing syslog filter. My base filter is: Rubrik Syslog Input input { tcp { host =\> "192.168.1.180" port =\> 1514 } } … --- ## [Ruby - First few characters (substring)](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 4\ **Last updated:** [August 12, 2020, 2:09am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493 "2020-08-12T02:09:46Z")
Hey All, Trying to get the first 4 characters of a field that is obtained via XPATH. This is what i currently have, but it copies everything rather then the first 4 characters. Been stumped on it for the past couple ho… --- ## [Json parse breaks with TCP input](https://discuss.elastic.co/t/json-parse-breaks-with-tcp-input/88129)
**Author:** [@jigar4u2](https://discuss.elastic.co/u/jigar4u2)\ **Replies:** 7\ **Last updated:** [July 13, 2017, 10:32pm UTC](https://discuss.elastic.co/t/json-parse-breaks-with-tcp-input/88129 "2017-07-13T22:32:17Z")
I tried test.config with 'stdin' input which works fine, but when I change to 'tcp' input which I use with nxlog for other logs breaks...what I am missing? Works: input { stdin { codec =\> mult… --- ## [Two successive UpdateByQuery, How to refresh after first one](https://discuss.elastic.co/t/two-successive-updatebyquery-how-to-refresh-after-first-one/78912)
**Author:** [@amidani](https://discuss.elastic.co/u/amidani)\ **Replies:** 6\ **Last updated:** [March 17, 2017, 10:56am UTC](https://discuss.elastic.co/t/two-successive-updatebyquery-how-to-refresh-after-first-one/78912 "2017-03-17T10:56:37Z")
Hi all, I have two updatebyquery like this one. UpdateByQueryRequestBuilder ubqrb = UpdateByQueryAction.INSTANCE.newRequestBuilder(client); ubqrb.source(index).source().setTypes(itemType); BulkIndexByScrollResponse … --- ## [How to rename json parsed field](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 1\ **Last updated:** [December 31, 2016, 12:59pm UTC](https://discuss.elastic.co/t/how-to-rename-json-parsed-field/70059 "2016-12-31T12:59:15Z")
Hi, I am parsing json log file in Logstash. There is a field named @person.name. I tried to rename this field name before sending it to elasticsearch. I also tried to remove the field but I couldn't remove or delete tha… --- ## [Filebeat - input not enabled when using external config load](https://discuss.elastic.co/t/filebeat-input-not-enabled-when-using-external-config-load/245365)
**Author:** [@eMDee](https://discuss.elastic.co/u/eMDee)\ **Replies:** 5\ **Last updated:** [September 11, 2020, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-input-not-enabled-when-using-external-config-load/245365 "2020-09-11T16:02:44Z")
Hi There, I'm trying to use filebeat to import logs from custom locations. In configuration I have: filebeat: config.inputs: enabled: true path: "/etc/filebeat/conf.d/\*.yml" output.logstash: … --- ## [Terms list is incomplete because the request is taking too long in controls visualization](https://discuss.elastic.co/t/terms-list-is-incomplete-because-the-request-is-taking-too-long-in-controls-visualization/231282)
**Author:** [@Jaishree\_Pal](https://discuss.elastic.co/u/Jaishree_Pal)\ **Replies:** 8\ **Last updated:** [May 9, 2020, 8:54am UTC](https://discuss.elastic.co/t/terms-list-is-incomplete-because-the-request-is-taking-too-long-in-controls-visualization/231282 "2020-05-09T08:54:49Z")
I was trying to use controls for my visualizations, but it does not load all the values from the selected field. The list doesn't even show half of them. I've tried increasing the kibana.autocompleteTerminateAfter and k… [Previous page](https://discuss.elastic.co/top.md?page=584&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=586&per_page=50&period=all)