# Top **URL:** https://discuss.elastic.co/top.md?page=591&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 592 --- ## [\[CH\] ES Meetup in Lausanne - Switzerland - 30th November 2016](https://discuss.elastic.co/t/ch-es-meetup-in-lausanne-switzerland-30th-november-2016/64879)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [November 3, 2016, 2:10pm UTC](https://discuss.elastic.co/t/ch-es-meetup-in-lausanne-switzerland-30th-november-2016/64879 "2016-11-03T14:10:46Z")
For our next ES meetup in Western Switzerland, we're happy to announce another fantastic line-up: Nicolas Ruflin (@ruflin from Elastic) will be there to talk about the brand new Beats 5.0 Benoît Quartier (from Campt… --- ## [Load data from spark to ElasticSearch Hadoop](https://discuss.elastic.co/t/load-data-from-spark-to-elasticsearch-hadoop/57075)
**Author:** [@saucam](https://discuss.elastic.co/u/saucam)\ **Replies:** 0\ **Last updated:** [August 3, 2016, 7:18am UTC](https://discuss.elastic.co/t/load-data-from-spark-to-elasticsearch-hadoop/57075 "2016-08-03T07:18:01Z")
Hi all, I am trying to write RDD of string (json data) to elasticsearch. My cluster has 3 nodes. Have set ES\_HEAP to about 15g on all three machines. Before starting the job I set : { "index": { "numbe… --- ## [Logstash logs duplicates in different indexes despite else if conditions](https://discuss.elastic.co/t/logstash-logs-duplicates-in-different-indexes-despite-else-if-conditions/147810)
**Author:** [@flyingstar16](https://discuss.elastic.co/u/flyingstar16)\ **Replies:** 6\ **Last updated:** [September 18, 2018, 1:48pm UTC](https://discuss.elastic.co/t/logstash-logs-duplicates-in-different-indexes-despite-else-if-conditions/147810 "2018-09-18T13:48:48Z")
Hi, I'm logging Apache logs using the file input, and my Logstash is logging events both to the logstash-yyyy.mm.dd index and the custom one I specify (sometimes also creating duplicates in one of the indexes). Here's … --- ## [Trying out Watcher but once installed, Elasticsearch feed stops](https://discuss.elastic.co/t/trying-out-watcher-but-once-installed-elasticsearch-feed-stops/25332)
**Author:** [@dmccuk](https://discuss.elastic.co/u/dmccuk)\ **Replies:** 5\ **Last updated:** [July 14, 2015, 2:39pm UTC](https://discuss.elastic.co/t/trying-out-watcher-but-once-installed-elasticsearch-feed-stops/25332 "2015-07-14T14:39:23Z")
Hi, I'm testing out watcher to see if it's viable to use as an alternative to out current monitoring systems. The issue I'm having is once I install watched (+license) and restart elasticsearch, my feed stops and I can… --- ## [Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms another client :)](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms-another-client/240022)
**Author:** [@sd99](https://discuss.elastic.co/u/sd99)\ **Replies:** 3\ **Last updated:** [July 6, 2020, 11:58pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms-another-client/240022 "2020-07-06T23:58:00Z")
Hi, I have installed Elasticsearch in my server and now I am installing Kibana, and there is an error appear with me. ( Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms) I'm also trying to alte… --- ## [Invalid UTF-8 middle byte 0x22\\n](https://discuss.elastic.co/t/invalid-utf-8-middle-byte-0x22-n/236047)
**Author:** [@joaopedro](https://discuss.elastic.co/u/joaopedro)\ **Replies:** 3\ **Last updated:** [June 26, 2020, 8:44am UTC](https://discuss.elastic.co/t/invalid-utf-8-middle-byte-0x22-n/236047 "2020-06-26T08:44:55Z")
So, I am trying to create a flask api that gets the name of the field of search and the term that we are going to search, then, the script writes the info into a file and uses subprocess to run a search, see: file = op… --- ## [ELK vs Splunk](https://discuss.elastic.co/t/elk-vs-splunk/96700)
**Author:** [@akash.01](https://discuss.elastic.co/u/akash.01)\ **Replies:** 3\ **Last updated:** [August 11, 2017, 8:33pm UTC](https://discuss.elastic.co/t/elk-vs-splunk/96700 "2017-08-11T20:33:16Z")
I am very new to ELK. In my organization We are thinking of migrating from Splunk Enterprise to ELK. But before doing that I was asked to test whether we are able to run all the use cases we have built on Splunk in ELK. … --- ## [Timezoneの設定について](https://discuss.elastic.co/t/timezone/162157)
**Author:** [@hmlhmz](https://discuss.elastic.co/u/hmlhmz)\ **Replies:** 2\ **Last updated:** [December 27, 2018, 2:32am UTC](https://discuss.elastic.co/t/timezone/162157 "2018-12-27T02:32:04Z")
index作成時またはElasticsearchへのデータ投入時等に、timezoneを指定する方法はありますか？UTCで明示的に指定したいです。 GUIではなくelasticsearch-pyで指定する方法があれば教えて下さい。 私の環境は以下です。 ■環境 ・Windows 10 64bit ・Elasticsearch 6.5.4 ・kibana 6.5.4 ・elasticsearch-py 6.3.1 --- ## [Elasticsearch ILM rollover from hot to warm phase not happening even when the condition for rollover is met](https://discuss.elastic.co/t/elasticsearch-ilm-rollover-from-hot-to-warm-phase-not-happening-even-when-the-condition-for-rollover-is-met/193235)
**Author:** [@ElkNovice](https://discuss.elastic.co/u/ElkNovice)\ **Replies:** 7\ **Last updated:** [August 1, 2019, 4:05am UTC](https://discuss.elastic.co/t/elasticsearch-ilm-rollover-from-hot-to-warm-phase-not-happening-even-when-the-condition-for-rollover-is-met/193235 "2019-08-01T04:05:20Z")
Elasticsearch version 7.1 I have created ILM policy as per which if the index grows more than 50 GB in size or is more than 15days old the index should rollover to warm phase. In my env, this is not happening consistent… --- ## [Elastic search as multi-key value cache](https://discuss.elastic.co/t/elastic-search-as-multi-key-value-cache/14858)
**Author:** [@geegalrawat](https://discuss.elastic.co/u/geegalrawat)\ **Replies:** 7\ **Last updated:** [December 16, 2013, 9:30pm UTC](https://discuss.elastic.co/t/elastic-search-as-multi-key-value-cache/14858 "2013-12-16T21:30:58Z")
I am writing a service that will be creating and managing user records. 100+ million of them. For each new user, service will generate a unique user id and write it in database. Database is sharded based on unique… --- ## [Certificate invalid](https://discuss.elastic.co/t/certificate-invalid/306875)
**Author:** [@ftayyab](https://discuss.elastic.co/u/ftayyab)\ **Replies:** 4\ **Last updated:** [June 27, 2022, 5:53pm UTC](https://discuss.elastic.co/t/certificate-invalid/306875 "2022-06-27T17:53:42Z")
Hello, I am running Elasticsearch locally with default configuration out of the box. When I try to browse to https://localhost:9200, I get Privacy error in chrome, saying that connection is not private. I know that duri… --- ## [Get tasks hang and accumulate on 5.4.2](https://discuss.elastic.co/t/get-tasks-hang-and-accumulate-on-5-4-2/92368)
**Author:** [@Tamas\_Pakolicz](https://discuss.elastic.co/u/Tamas_Pakolicz)\ **Replies:** 8\ **Last updated:** [July 24, 2017, 2:05pm UTC](https://discuss.elastic.co/t/get-tasks-hang-and-accumulate-on-5-4-2/92368 "2017-07-24T14:05:34Z")
Hi! I have a problem with our Elasticsearch 5.4.2 cluster. We have 52 nodes of which 40 are data nodes. On our non-master data nodes tasks are accumulating and get stuck. A full cluster restart did not solve our probl… --- ## [Does document database means denormalize](https://discuss.elastic.co/t/does-document-database-means-denormalize/18075)
**Author:** [@eunever32](https://discuss.elastic.co/u/eunever32)\ **Replies:** 3\ **Last updated:** [June 14, 2014, 5:13pm UTC](https://discuss.elastic.co/t/does-document-database-means-denormalize/18075 "2014-06-14T17:13:51Z")
Hey, What is the best way to design indexes in elasticsearch? I mean in terms of normalization vs denormalization So am I right in thinking that because elasticsearch is a document database we don't worry abo… --- ## [Filebeat not monitoring data](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 5:41am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500 "2016-01-20T05:41:43Z")
Hi Friends, I set up Elasticsearch in our Lab, there in filebeat.yml I given the following configuration filebeat: paths: - /var/log/\* document\_type: syslog scan\_frequency: 10s logstash: # The Logstash h… --- ## [How can I group a couple of terms behind one name?](https://discuss.elastic.co/t/how-can-i-group-a-couple-of-terms-behind-one-name/27027)
**Author:** [@faitlezen](https://discuss.elastic.co/u/faitlezen)\ **Replies:** 6\ **Last updated:** [August 13, 2015, 1:15am UTC](https://discuss.elastic.co/t/how-can-i-group-a-couple-of-terms-behind-one-name/27027 "2015-08-13T01:15:11Z")
I'm pretty sure, I once saw a demo of someone extracting all the user agent from some kind of web server log and through adding something in the JSON filed on his visualization widget was able to say "consider everything… --- ## [Top hits by sort criteria or include source into arbitrary aggs](https://discuss.elastic.co/t/top-hits-by-sort-criteria-or-include-source-into-arbitrary-aggs/25548)
**Author:** [@Vladimir\_Khazin](https://discuss.elastic.co/u/Vladimir_Khazin)\ **Replies:** 6\ **Last updated:** [July 22, 2015, 3:00pm UTC](https://discuss.elastic.co/t/top-hits-by-sort-criteria-or-include-source-into-arbitrary-aggs/25548 "2015-07-22T15:00:40Z")
https://www.elastic.co/guide/en/elasticsearch/reference/1.6/search-aggregations-metrics-top-hits-aggregation.html is great feature! How about an ability to custom define 'the most relevant document', e.g. order the agg… --- ## [Analyzer, Fuzzy Query?](https://discuss.elastic.co/t/analyzer-fuzzy-query/8499)
**Author:** [@maik2102](https://discuss.elastic.co/u/maik2102)\ **Replies:** 6\ **Last updated:** [July 30, 2012, 12:40pm UTC](https://discuss.elastic.co/t/analyzer-fuzzy-query/8499 "2012-07-30T12:40:49Z")
Hi toghether, I'm wondering if its possible for elasticsearch to solve the following problems: 1. Productname contains "Media Player", Customer searches for "mediaplayer" (0 hits) or "media player" (lots of hi… --- ## [Elastic APM RUM not working with Angular 8](https://discuss.elastic.co/t/elastic-apm-rum-not-working-with-angular-8/214274)
**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\ **Replies:** 8\ **Last updated:** [January 16, 2020, 1:41pm UTC](https://discuss.elastic.co/t/elastic-apm-rum-not-working-with-angular-8/214274 "2020-01-16T13:41:53Z")
Kibana version: 7.4.0 Elasticsearch version: 7.4.0 APM Server version: 7.4.0 APM Agent language and version: @elastic/apm-rum-angular 0.3.0. Angular 8.2.14. Fresh install or upgraded from other version? Fresh Is th… --- ## [Change Default Homepage](https://discuss.elastic.co/t/change-default-homepage/186924)
**Author:** [@plx](https://discuss.elastic.co/u/plx)\ **Replies:** 3\ **Last updated:** [June 25, 2019, 8:54pm UTC](https://discuss.elastic.co/t/change-default-homepage/186924 "2019-06-25T20:54:21Z")
Hi, I'm using Wazuh plugin on Kibana and I want my homepage goes to Wazuh page as default, instead of Kibana dashboard. Is there any way to do that? --- ## [GET API performance](https://discuss.elastic.co/t/get-api-performance/150738)
**Author:** [@Justin\_Treher](https://discuss.elastic.co/u/Justin_Treher)\ **Replies:** 8\ **Last updated:** [October 3, 2018, 12:00pm UTC](https://discuss.elastic.co/t/get-api-performance/150738 "2018-10-03T12:00:49Z")
I was assuming that we could use elasticsearch as a sort of document store for high performance reads when accessing documents by id in addition to the amazing search engine. However, I am finding that when accessing a … --- ## [Kibana Metric Aggregations showing different values](https://discuss.elastic.co/t/kibana-metric-aggregations-showing-different-values/126705)
**Author:** [@falsekingpin](https://discuss.elastic.co/u/falsekingpin)\ **Replies:** 8\ **Last updated:** [April 13, 2018, 4:39am UTC](https://discuss.elastic.co/t/kibana-metric-aggregations-showing-different-values/126705 "2018-04-13T04:39:44Z")
Hi , I am applying min metric aggregation to a numeric field which has unix time, it is showing different value as it should show with the data. I have also tried querying elasticsearch Here is the response query: cur… --- ## [Comparison Between AppDynamics](https://discuss.elastic.co/t/comparison-between-appdynamics/103327)
**Author:** [@Michael\_TRAN](https://discuss.elastic.co/u/Michael_TRAN)\ **Replies:** 3\ **Last updated:** [October 11, 2017, 4:21pm UTC](https://discuss.elastic.co/t/comparison-between-appdynamics/103327 "2017-10-11T16:21:36Z")
Hi, In my company, we use AppDynamics as APM for our client. We use this tool to analyze the root cause of the application failure. Could you tell us what Opbeat can do more ? Regards, Michael --- ## [Manually Calculate Terms within a bar chart](https://discuss.elastic.co/t/manually-calculate-terms-within-a-bar-chart/35745)
**Author:** [@lineman](https://discuss.elastic.co/u/lineman)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 12:54pm UTC](https://discuss.elastic.co/t/manually-calculate-terms-within-a-bar-chart/35745 "2015-11-30T12:54:53Z")
Hello all together, i just started to get into Kibana 4, and i've the 1st little problem. Hopefully. The bar shows different terms, called "events". My problem is, that the correct status 1 = status 1 minus status 2 … --- ## [Fuzziness in prefix query](https://discuss.elastic.co/t/fuzziness-in-prefix-query/117377)
**Author:** [@Vishal\_Chaurasia](https://discuss.elastic.co/u/Vishal_Chaurasia)\ **Replies:** 5\ **Last updated:** [February 2, 2018, 2:53pm UTC](https://discuss.elastic.co/t/fuzziness-in-prefix-query/117377 "2018-02-02T14:53:06Z")
I want the functionalities of both fuzzy query and prefix query together , is there a way to achieve so. --- ## [Timelion condtion function example](https://discuss.elastic.co/t/timelion-condtion-function-example/55987)
**Author:** [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Replies:** 1\ **Last updated:** [August 16, 2016, 9:37am UTC](https://discuss.elastic.co/t/timelion-condtion-function-example/55987 "2016-08-16T09:37:44Z")
Hi, I have built this TimeLion query that works: .es('PID:123 AND event:"Button%20Clicked"').divide(.es('PID:123 AND event:\*')).multiply(100).lines().label('Rate as %') But sometimes there are no values to plot, so Ti… --- ## [Hash matching queries](https://discuss.elastic.co/t/hash-matching-queries/7995)
**Author:** [@Alex\_4](https://discuss.elastic.co/u/Alex_4)\ **Replies:** 4\ **Last updated:** [June 11, 2012, 10:40pm UTC](https://discuss.elastic.co/t/hash-matching-queries/7995 "2012-06-11T22:40:40Z")
Hello elasticsearch members, I am currently have in my elasticsearch documents that have a field with a string of the form "hash\_1 hash\_2 hash\_3 ... hash\_n". Each document has roughly around 5000 to 6000 hashes in… --- ## [In Elasticsearch, is possible to cluster documents that share the most similar texts, without giving an initial query to compare to?](https://discuss.elastic.co/t/in-elasticsearch-is-possible-to-cluster-documents-that-share-the-most-similar-texts-without-giving-an-initial-query-to-compare-to/90962)
**Author:** [@pachilo](https://discuss.elastic.co/u/pachilo)\ **Replies:** 2\ **Last updated:** [June 27, 2017, 2:18pm UTC](https://discuss.elastic.co/t/in-elasticsearch-is-possible-to-cluster-documents-that-share-the-most-similar-texts-without-giving-an-initial-query-to-compare-to/90962 "2017-06-27T14:18:15Z")
In Elasticsearch, is possible to group documents that share the most similar texts, without giving an initial query to compare to? I know is possible to query and get "more like this document" but, is possible to clust… --- ## [Sorting by \_uid](https://discuss.elastic.co/t/sorting-by--uid/12956)
**Author:** [@Roy\_Russo](https://discuss.elastic.co/u/Roy_Russo)\ **Replies:** 3\ **Last updated:** [July 29, 2013, 2:52pm UTC](https://discuss.elastic.co/t/sorting-by--uid/12956 "2013-07-29T14:52:06Z")
Hello all, When sorting by ES's internal ID (\_uid), I've noticed that the uid field is not treated/sorted as numeric, even though ES assigns it a numeric value. Is this by design? Example: (Note that "2" comes… --- ## [Compress Elasticsearch Index/Disk Usage Elasticsearch](https://discuss.elastic.co/t/compress-elasticsearch-index-disk-usage-elasticsearch/16463)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 2\ **Last updated:** [March 20, 2014, 7:20am UTC](https://discuss.elastic.co/t/compress-elasticsearch-index-disk-usage-elasticsearch/16463 "2014-03-20T07:20:57Z")
Hey guys, I just wanted to ask if there´s a possibility to decrease the disk space useage of an elasticsearch index. e.g. i got an index called logstash-2014.03.17 with an size of 547MB and an total of 1018761 … --- ## [Logstash 5.2.0 - \_grokparsefailure, but it looks like the grok filter is correctly working](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570)
**Author:** [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\ **Replies:** 5\ **Last updated:** [March 9, 2017, 5:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570 "2017-03-09T17:17:50Z")
If I tail -f /var/log/messages, I see: ... { Mar 6 12:18:16 s-ut-logstash-1 logstash: "server" =\> "443", Mar 6 12:18:16 s-ut-logstash-1 logstash: "referer" =\> "\\"https://broadcast.storagecraft.com/videos/\\"", Mar … --- ## [Restrict some kibana users in a particular dashboard](https://discuss.elastic.co/t/restrict-some-kibana-users-in-a-particular-dashboard/82104)
**Author:** [@aryaray](https://discuss.elastic.co/u/aryaray)\ **Replies:** 2\ **Last updated:** [April 12, 2017, 3:00pm UTC](https://discuss.elastic.co/t/restrict-some-kibana-users-in-a-particular-dashboard/82104 "2017-04-12T15:00:30Z")
Hi, I want to restrict some users in kibana ,that users only able to access kibana dashboard (if possible then particular dashboard too). I am using kibana version 4.5.4 . Currently I am using htpass for user authentic… --- ## [Grok Patterns - issue using repetitive regular expressions](https://discuss.elastic.co/t/grok-patterns-issue-using-repetitive-regular-expressions/37106)
**Author:** [@marv](https://discuss.elastic.co/u/marv)\ **Replies:** 2\ **Last updated:** [December 14, 2015, 1:24pm UTC](https://discuss.elastic.co/t/grok-patterns-issue-using-repetitive-regular-expressions/37106 "2015-12-14T13:24:38Z")
Hey guys, I´ve been using the ELK-Stack for a while and it really is a great tool. Right now I am confronted with a problem, which I try solving for a while. I wrote a custom SAP pattern to match SAP-Taks from the … --- ## [Deploy OpenTelemetry Collector](https://discuss.elastic.co/t/deploy-opentelemetry-collector/247326)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 12:17am UTC](https://discuss.elastic.co/t/deploy-opentelemetry-collector/247326 "2020-09-16T00:17:56Z")
Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.3.2 APM Agent language and version : java 1.9.0 Fresh install or upgraded from other version? fresh install Is there anything special in y… --- ## [Waiting for a Fleet Server to connect… error](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 1:53pm UTC](https://discuss.elastic.co/t/waiting-for-a-fleet-server-to-connect-error/279500 "2021-07-28T13:53:23Z")
We are running into an issue with Fleet, where on our Agents page, the Fleet server is stuck in what appears to be a continuous reboot cycle. We have terminated and redeployed the Fleet node and still run into this issu… --- ## ["Unable to upgrade the mappings for the index" error when migrating index from 1.x to 2.x](https://discuss.elastic.co/t/unable-to-upgrade-the-mappings-for-the-index-error-when-migrating-index-from-1-x-to-2-x/63305)
**Author:** [@sloniki](https://discuss.elastic.co/u/sloniki)\ **Replies:** 4\ **Last updated:** [October 20, 2016, 1:00pm UTC](https://discuss.elastic.co/t/unable-to-upgrade-the-mappings-for-the-index-error-when-migrating-index-from-1-x-to-2-x/63305 "2016-10-20T13:00:05Z")
I'm trying to snapshot an index in 1.7.2 and restore it in another cluster 2.4.0. Snapshot created successfully and "published" as URL. When I try to restore on the new cluster I get: { \_ "error": {\_ \_ "root\_cau… --- ## [Logstash not sending logs to elastic search](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 4\ **Last updated:** [October 16, 2016, 3:44pm UTC](https://discuss.elastic.co/t/logstash-not-sending-logs-to-elastic-search/63120 "2016-10-16T15:44:02Z")
CentOS Linux release 7.2.1511 (Core) Using the latest Logstash and ES versions: Name : elasticsearch Arch : noarch Version : 2.4.0 Release : 1 Name : logstash Arch : noarch Epoch … --- ## [File input plugin always leaving files behind](https://discuss.elastic.co/t/file-input-plugin-always-leaving-files-behind/187196)
**Author:** [@abcarroll](https://discuss.elastic.co/u/abcarroll)\ **Replies:** 8\ **Last updated:** [June 25, 2019, 7:22pm UTC](https://discuss.elastic.co/t/file-input-plugin-always-leaving-files-behind/187196 "2019-06-25T19:22:19Z")
Hello there. Frankly, I've given up on the S3 input plugin entirely. We are attempting to ingest ELB access logs via S3. They're always a little behind anyway in AWS - by about 5 minutes - so it's not possible to keep… --- ## [Failed to load elasticsearch index](https://discuss.elastic.co/t/failed-to-load-elasticsearch-index/144577)
**Author:** [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Replies:** 8\ **Last updated:** [August 16, 2018, 10:29am UTC](https://discuss.elastic.co/t/failed-to-load-elasticsearch-index/144577 "2018-08-16T10:29:55Z")
kibana is not loading index Checking for Elasticsearch data Reticulating splines... --- ## [Custom Elastic Defend endpoint protection rules？](https://discuss.elastic.co/t/custom-elastic-defend-endpoint-protection-rules/383149)
**Author:** [@GeShanDaKongQi233](https://discuss.elastic.co/u/GeShanDaKongQi233)\ **Replies:** 3\ **Last updated:** [November 6, 2025, 1:57pm UTC](https://discuss.elastic.co/t/custom-elastic-defend-endpoint-protection-rules/383149 "2025-11-06T13:57:40Z")
The YARA rules and behavioral rules of Elastic Defend are shared with the community, allowing blue teams and defenders to learn from them and improve their defenses. However, we have also observed that many red team memb… --- ## [Create an analyzer to tokenize non-alphanumeric characters](https://discuss.elastic.co/t/create-an-analyzer-to-tokenize-non-alphanumeric-characters/61059)
**Author:** [@Josh\_Harrison](https://discuss.elastic.co/u/Josh_Harrison)\ **Replies:** 6\ **Last updated:** [September 23, 2016, 5:48pm UTC](https://discuss.elastic.co/t/create-an-analyzer-to-tokenize-non-alphanumeric-characters/61059 "2016-09-23T17:48:01Z")
I want a custom analyzer that can take a string like "((hello world!))" and give me a token list of: \["(", "(", "hello", "world", "!", ")", ")"\] That is to say, I basically want the "letter" tokenizer, but I want to keep… --- ## [What does t mean? in Discover?](https://discuss.elastic.co/t/what-does-t-mean-in-discover/189004)
**Author:** [@111171](https://discuss.elastic.co/u/111171)\ **Replies:** 2\ **Last updated:** [July 5, 2019, 7:57am UTC](https://discuss.elastic.co/t/what-does-t-mean-in-discover/189004 "2019-07-05T07:57:15Z")
Dear Community thank you in advance for your help... What does t and other symobols mean in Discover Field? \*the one which is located on the left side of @message.... I looked through the manual but could not find t… --- ## [Heroku add-on error: "This version of kopf is not compatible with your ES version"](https://discuss.elastic.co/t/heroku-add-on-error-this-version-of-kopf-is-not-compatible-with-your-es-version/68476)
**Author:** [@bryan0](https://discuss.elastic.co/u/bryan0)\ **Replies:** 8\ **Last updated:** [December 13, 2016, 1:05am UTC](https://discuss.elastic.co/t/heroku-add-on-error-this-version-of-kopf-is-not-compatible-with-your-es-version/68476 "2016-12-13T01:05:46Z")
After installing the elasticcloud heroku add-on, on the overview page is a link the to kopf dashboard. Opening Kopf it starts spamming the error: "This version of kopf is not compatible with your ES version". There… --- ## [Visualization in Dashboard](https://discuss.elastic.co/t/visualization-in-dashboard/49658)
**Author:** [@bbhandari0121](https://discuss.elastic.co/u/bbhandari0121)\ **Replies:** 7\ **Last updated:** [May 21, 2016, 9:17am UTC](https://discuss.elastic.co/t/visualization-in-dashboard/49658 "2016-05-21T09:17:53Z")
Hi all, I have created the dashboard in kibana, which is installed in the 5 nodes ES cluster,which has ES, kibana and lostash instaled.. Log is being forwarded from logstash(45 servers) -\> kafka(3 brokers) -\>logstash -\>… --- ## [Can't index new docs due to type error; sending to old indices still works](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628)
**Author:** [@emw](https://discuss.elastic.co/u/emw)\ **Replies:** 2\ **Last updated:** [September 18, 2022, 12:23am UTC](https://discuss.elastic.co/t/cant-index-new-docs-due-to-type-error-sending-to-old-indices-still-works/314628 "2022-09-18T00:23:13Z")
In my ES 7.17 cluster, I'm using index templates to create a new weekly index where I send log data. The index names are generated by my application, not by ES; the template handles index patterns, field limits, and alia… --- ## [How to create a rule with aggregation](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [April 6, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-to-create-a-rule-with-aggregation/269023 "2021-04-06T07:57:22Z")
Hello, I would like to create a rule where I can detect brute force attack For example: in winlogbeat-\* and auditbeat-\* where event.action == logon-failed, aggregation by user.name , and if it's more than 10, it creat… --- ## [Aggregate text values of each bucket in Data Table Visualization](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500)
**Author:** [@Hoan\_Le](https://discuss.elastic.co/u/Hoan_Le)\ **Replies:** 4\ **Last updated:** [August 31, 2017, 2:18am UTC](https://discuss.elastic.co/t/aggregate-text-values-of-each-bucket-in-data-table-visualization/98500 "2017-08-31T02:18:25Z")
I have following sample data which include two fileds src\_address and threat\_name, src\_address | threat\_name 10.1.1.2 | virus\_infected 10.1.1.2 | port\_scan 10.1.1.3 | botnet\_ca… --- ## [Data too large using BulkProcessor with size limit](https://discuss.elastic.co/t/data-too-large-using-bulkprocessor-with-size-limit/241779)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 5\ **Last updated:** [July 20, 2020, 2:25pm UTC](https://discuss.elastic.co/t/data-too-large-using-bulkprocessor-with-size-limit/241779 "2020-07-20T14:25:36Z")
Hello, We are using a BulkProcessor (ES 7.8.0) with the following properties: Actions: 250 Size: 2097152 bytes (2MB) Flush Time: 3000 ms During a load test we are getting the following exception: org.elastic… --- ## [How to use Azure Storage plugin in ECK for Snapshot](https://discuss.elastic.co/t/how-to-use-azure-storage-plugin-in-eck-for-snapshot/237513)
**Author:** [@robinhood\_lko](https://discuss.elastic.co/u/robinhood_lko)\ **Replies:** 7\ **Last updated:** [August 11, 2021, 5:35pm UTC](https://discuss.elastic.co/t/how-to-use-azure-storage-plugin-in-eck-for-snapshot/237513 "2021-08-11T17:35:19Z")
Hi All, I have to configure snapshot in ECK Deployment. Elasticsearch documentation has given example for Google cloud. Please can anyone list the steps for that. I tried this - Created a file azure.client.default.cre… --- ## [Convert the @timestamp field](https://discuss.elastic.co/t/convert-the-timestamp-field/273902)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 6\ **Last updated:** [June 1, 2021, 5:26am UTC](https://discuss.elastic.co/t/convert-the-timestamp-field/273902 "2021-06-01T05:26:18Z")
Hello All , I am trying to convert the @timestamp field to the required format. @timestamp shows the field as : 2021-05-25T07:34:08.137Z and I want the value to be converted in to this format : 05/25/2021 07:34:08 . I … --- ## [Kibana visualisation no results found in data table](https://discuss.elastic.co/t/kibana-visualisation-no-results-found-in-data-table/108637)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 6\ **Last updated:** [November 22, 2017, 10:17am UTC](https://discuss.elastic.co/t/kibana-visualisation-no-results-found-in-data-table/108637 "2017-11-22T10:17:13Z")
i have this data in kibana discover, but in visualization ErrorMsg is showing no results found. \[Untitled1\] \[Untitled\] [Previous page](https://discuss.elastic.co/top.md?page=590&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=592&per_page=50&period=all)