# Top **URL:** https://discuss.elastic.co/top.md?page=608&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 609 --- ## [Trouble getting topbeat data into elasticsearch via logstash](https://discuss.elastic.co/t/trouble-getting-topbeat-data-into-elasticsearch-via-logstash/45062)
**Author:** [@velvetpixel](https://discuss.elastic.co/u/velvetpixel)\ **Replies:** 6\ **Last updated:** [March 24, 2016, 4:03pm UTC](https://discuss.elastic.co/t/trouble-getting-topbeat-data-into-elasticsearch-via-logstash/45062 "2016-03-24T16:03:48Z")
Newbie here so bash lightly \[:slight\_smile:\] I have a host server with ELK installed and able to view filebeat data sent from a client server to logstash on the host. I want to also view topbeat data from that same … --- ## [\[ANNOUNCEMENT\] Httpbeat 3.3.0 released](https://discuss.elastic.co/t/announcement-httpbeat-3-3-0-released/73947)
**Author:** [@christiangalsterer](https://discuss.elastic.co/u/christiangalsterer)\ **Replies:** 0\ **Last updated:** [February 4, 2017, 2:07pm UTC](https://discuss.elastic.co/t/announcement-httpbeat-3-3-0-released/73947 "2017-02-04T14:07:17Z")
I'm happy to announce the availability of Httpbeat 3.3.0. Httpbeat is a Beat which polls HTTP endpoints in a regular interval and sends the HTTP request and response as an event to a configured shipper, e.g. elasticsea… --- ## [Closing vs. freezing an index](https://discuss.elastic.co/t/closing-vs-freezing-an-index/229372)
**Author:** [@bobbyi](https://discuss.elastic.co/u/bobbyi)\ **Replies:** 1\ **Last updated:** [April 23, 2020, 9:39pm UTC](https://discuss.elastic.co/t/closing-vs-freezing-an-index/229372 "2020-04-23T21:39:19Z")
I have a use case in which there is an index I no longer need, but have some small chance of using in the future. Closing the index or freezing the index both look like reasonable ways of keeping the data from being gone… --- ## [Pagination in Kibana Discover](https://discuss.elastic.co/t/pagination-in-kibana-discover/56853)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 1\ **Last updated:** [August 1, 2016, 6:03am UTC](https://discuss.elastic.co/t/pagination-in-kibana-discover/56853 "2016-08-01T06:03:25Z")
Hello, In the Discover tab, for a search criteria, I have 20000 records. But is is showing only 1000 records. Is there any way to implement pagination in the dsicover tab and show all the records in different pages? --- ## [Java.lang.Double cannot be cast to org.apache.lucene.util.BytesRef](https://discuss.elastic.co/t/java-lang-double-cannot-be-cast-to-org-apache-lucene-util-bytesref/27733)
**Author:** [@Mahesh\_Bhat](https://discuss.elastic.co/u/Mahesh_Bhat)\ **Replies:** 1\ **Last updated:** [August 21, 2015, 3:30pm UTC](https://discuss.elastic.co/t/java-lang-double-cannot-be-cast-to-org-apache-lucene-util-bytesref/27733 "2015-08-21T15:30:14Z")
hi ! I have an ELK system running for Log Analysis. I very recently used the "elapsed" filter plugin in logstash in order to track the time elapsed for the completion of a certain sequence of message events. At time… --- ## [Session mangement in kibana server](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579)
**Author:** [@sandhya\_kumari](https://discuss.elastic.co/u/sandhya_kumari)\ **Replies:** 4\ **Last updated:** [May 28, 2018, 8:24pm UTC](https://discuss.elastic.co/t/session-mangement-in-kibana-server/133579 "2018-05-28T20:24:01Z")
If a user say (bob) logs in to kibana and then another user say (Alice) also logs in to kibana. How does kibana create dedicated sessions for both of them logged in to kibana at the same time? Moreover how does it differ… --- ## [Invalid snapshot name \[\_restore\], must not start with '\_'](https://discuss.elastic.co/t/invalid-snapshot-name--restore-must-not-start-with--/96622)
**Author:** [@EpiqSty](https://discuss.elastic.co/u/EpiqSty)\ **Replies:** 4\ **Last updated:** [August 10, 2017, 3:50pm UTC](https://discuss.elastic.co/t/invalid-snapshot-name--restore-must-not-start-with--/96622 "2017-08-10T15:50:06Z")
Hello, I tried to restore data from elasticsearch 2.4.3 cluster to new 5.5.1, and faced with strange issue: New ES 5.5.1 seen the snapshots itself: $ curl -XGET 'localhost:9200/\_snapshot/backup/sl-backup-2017.08.10?pr… --- ## [TCP connections to itself?](https://discuss.elastic.co/t/tcp-connections-to-itself/127680)
**Author:** [@dmarlow](https://discuss.elastic.co/u/dmarlow)\ **Replies:** 0\ **Last updated:** [April 11, 2018, 4:35pm UTC](https://discuss.elastic.co/t/tcp-connections-to-itself/127680 "2018-04-11T16:35:24Z")
Is it normal for ES to open many connections to itself? I'm on ES version 6.1.1. I have 3 machines in a cluster (internal IPs are: 172.16.2.4, 2.5 and 2.6). Is it normal for all of the 127.0.0.1 connections to itself?Whe… --- ## [How to get documents more than 10000 in elasticsearch for visualization?](https://discuss.elastic.co/t/how-to-get-documents-more-than-10000-in-elasticsearch-for-visualization/202845)
**Author:** [@Nirajan](https://discuss.elastic.co/u/Nirajan)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 9:00am UTC](https://discuss.elastic.co/t/how-to-get-documents-more-than-10000-in-elasticsearch-for-visualization/202845 "2019-10-10T09:00:34Z")
Hello, I am looking for a solution to get all the records from the elasticsearch for visualization. It seems only 10000 documents can be visualized at a time. I went through elasticsearch documentation and found out t… --- ## [Unable to get Logstash to read from kafka input](https://discuss.elastic.co/t/unable-to-get-logstash-to-read-from-kafka-input/82090)
**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\ **Replies:** 3\ **Last updated:** [April 14, 2017, 4:11pm UTC](https://discuss.elastic.co/t/unable-to-get-logstash-to-read-from-kafka-input/82090 "2017-04-14T16:11:17Z")
In my setup I have Filebeats -\> Kafka -\> Logstash -\> ElasticSearch. I can see filebeats producing logs into Kakfa-topic and I am also able to read logs from kafka topic using kafka-consumer-client. But I do not see l… --- ## [Elasticsearc 5 pipeline grok pattern\_definitions issue](https://discuss.elastic.co/t/elasticsearc-5-pipeline-grok-pattern-definitions-issue/69983)
**Author:** [@Recuncho\_Smith](https://discuss.elastic.co/u/Recuncho_Smith)\ **Replies:** 3\ **Last updated:** [December 29, 2016, 9:21am UTC](https://discuss.elastic.co/t/elasticsearc-5-pipeline-grok-pattern-definitions-issue/69983 "2016-12-29T09:21:41Z")
I need define an aditional pattern\_definition for my pipeline. We have hostnames virtual host with an invalid character "\_" than figure in apache log files. Standard definition for grok filter pattern HOSTNAME is: HOSTNA… --- ## [Duplicate results in resultset](https://discuss.elastic.co/t/duplicate-results-in-resultset/8156)
**Author:** [@David\_3](https://discuss.elastic.co/u/David_3)\ **Replies:** 3\ **Last updated:** [April 29, 2014, 8:46am UTC](https://discuss.elastic.co/t/duplicate-results-in-resultset/8156 "2014-04-29T08:46:22Z")
I have the following issue, I have an index with denormalized data.. the search returns the duplicated data and it seems there is no way in an elasticsearch query to distinct the search results to remove the dupli… --- ## [Fleet-server failed: context canceled](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348)
**Author:** [@spo](https://discuss.elastic.co/u/spo)\ **Replies:** 2\ **Last updated:** [April 14, 2022, 3:00pm UTC](https://discuss.elastic.co/t/fleet-server-failed-context-canceled/302348 "2022-04-14T15:00:01Z")
Hi Having trouble enrolling fleet server Elasticsearch kibana and elastic agent versions 7.17.2 command I used is .\\elastic-agent.exe install --url=https://fleet server ip:8220 --fleet-server-es=https://elasticsearch… --- ## [I cannot run Logstash on Raspberry pi3](https://discuss.elastic.co/t/i-cannot-run-logstash-on-raspberry-pi3/109789)
**Author:** [@AhmyOhlin](https://discuss.elastic.co/u/AhmyOhlin)\ **Replies:** 2\ **Last updated:** [December 2, 2017, 12:05pm UTC](https://discuss.elastic.co/t/i-cannot-run-logstash-on-raspberry-pi3/109789 "2017-12-02T12:05:40Z")
Hello all, i could install and run elasticsearch and Kibana on Raspberry pi 3 but iam struggling right now to run logstash. I did the same steps on windows and it works without problems. i run Logstash With this com… --- ## [Logstash timestamp issue - the parsed value is one hour behind the log value](https://discuss.elastic.co/t/logstash-timestamp-issue-the-parsed-value-is-one-hour-behind-the-log-value/170)
**Author:** [@DannyK](https://discuss.elastic.co/u/DannyK)\ **Replies:** 3\ **Last updated:** [May 5, 2015, 12:12pm UTC](https://discuss.elastic.co/t/logstash-timestamp-issue-the-parsed-value-is-one-hour-behind-the-log-value/170 "2015-05-05T12:12:24Z")
I am using the following code to read McAfee Logs ( I chose to use CSV filters because grok filters turned out to be messy) input { stdin{} } filter { csv { columns =\> \["timestamp", "McAf\_ThreatSeverity… --- ## [Elastic Stack 6.0.0-rc1 is here!](https://discuss.elastic.co/t/elastic-stack-6-0-0-rc1-is-here/102165)
**Author:** [@asawari](https://discuss.elastic.co/u/asawari)\ **Replies:** 0\ **Last updated:** [September 28, 2017, 6:45pm UTC](https://discuss.elastic.co/t/elastic-stack-6-0-0-rc1-is-here/102165 "2017-09-28T18:45:00Z")
Elastic Stack 6.0.0-rc1 is here! The 6.0.0-rc1 of Elasticsearch, Logstash, Beats, Kibana, and X-Pack are now available to download and test! Learn about what’s coming in 6.0: https://www.elastic.co/blog/elastic-stack-6-… --- ## [Minimum JVM heap size](https://discuss.elastic.co/t/minimum-jvm-heap-size/72564)
**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 3:47am UTC](https://discuss.elastic.co/t/minimum-jvm-heap-size/72564 "2017-01-24T03:47:02Z")
I have once ES 2.4.1 instance on one Digital Ocean server. It holds about ~2M documents. Quite large. It uses, at the time of writing, 546Mb of memory. No tuning done. Just 1 shard. In other project I have ES 5.1.1. … --- ## [Can multiple ES instances share the same data directory?](https://discuss.elastic.co/t/can-multiple-es-instances-share-the-same-data-directory/123754)
**Author:** [@vicodark](https://discuss.elastic.co/u/vicodark)\ **Replies:** 3\ **Last updated:** [April 11, 2018, 9:58am UTC](https://discuss.elastic.co/t/can-multiple-es-instances-share-the-same-data-directory/123754 "2018-04-11T09:58:32Z")
I understand that this is a strange question, but for reasons that defy logic my users want the following setup and after much google-ing and testing I can't figure out if it's possible: a) There are 5 users, each at th… --- ## [Bool query with filter is slower than filtered query](https://discuss.elastic.co/t/bool-query-with-filter-is-slower-than-filtered-query/47152)
**Author:** [@eprst](https://discuss.elastic.co/u/eprst)\ **Replies:** 8\ **Last updated:** [April 18, 2016, 1:26pm UTC](https://discuss.elastic.co/t/bool-query-with-filter-is-slower-than-filtered-query/47152 "2016-04-18T13:26:43Z")
we tested more like this query inside filtered query with some filters. but filtered query is depricated. and that's why we transform it bool query, we put more\_like\_this inside must clause and all filters inside filter… --- ## [Multi Master configuration](https://discuss.elastic.co/t/multi-master-configuration/188612)
**Author:** [@stalinbritto](https://discuss.elastic.co/u/stalinbritto)\ **Replies:** 1\ **Last updated:** [July 3, 2019, 6:06am UTC](https://discuss.elastic.co/t/multi-master-configuration/188612 "2019-07-03T06:06:27Z")
Hi Team, I'm currently trying to configure an elastic search cluster with 2 masters and 3 data nodes My cluster is working 1 Master and 3 data Node. root@ELK-Master1:~# curl http://IP:9200/\_cat/nodes?v ip … --- ## [Logstash input file codec multiline not working as expected](https://discuss.elastic.co/t/logstash-input-file-codec-multiline-not-working-as-expected/55913)
**Author:** [@S\_Roy](https://discuss.elastic.co/u/S_Roy)\ **Replies:** 3\ **Last updated:** [September 20, 2016, 8:58am UTC](https://discuss.elastic.co/t/logstash-input-file-codec-multiline-not-working-as-expected/55913 "2016-09-20T08:58:52Z")
I am trying to process multiline messages in log using input codec multiline. I am getting stuck and sometimes giving grokparse error. Any recommendations? --Log lines start -- 2016-06-24 12:21:38||INFO||\ **Author:** [@silarhi](https://discuss.elastic.co/u/silarhi)\ **Replies:** 4\ **Last updated:** [February 9, 2022, 4:56pm UTC](https://discuss.elastic.co/t/filter-terms-aggregation-on-array-field/296627 "2022-02-09T16:56:06Z") Hello there, I'm looking for a solution to filter some aggregation terms based on an array field. Here's an example of data: PUT /test-index POST /test-index/\_doc/ { "type": "album", "authors": \[1, 2, 3, 4, 5\] } … --- ## [ELK Stack on AWS - Contd](https://discuss.elastic.co/t/elk-stack-on-aws-contd/184331)
**Author:** [@rahulkumar1](https://discuss.elastic.co/u/rahulkumar1)\ **Replies:** 5\ **Last updated:** [June 7, 2019, 2:15am UTC](https://discuss.elastic.co/t/elk-stack-on-aws-contd/184331 "2019-06-07T02:15:15Z")
I would like to reopen this thread. What are the best practices on setting up ELK ~Stack on AWS ? How many Master and Data Nodes should I have ? Do I need a shared storage ? Below is my design: AZ1 - (3 x Master No… --- ## [JVM memory increase (1 time more -Xmx16g) while ElasticSearch HEAP is stable](https://discuss.elastic.co/t/jvm-memory-increase-1-time-more-xmx16g-while-elasticsearch-heap-is-stable/55413)
**Author:** [@damien\_desmarets](https://discuss.elastic.co/u/damien_desmarets)\ **Replies:** 6\ **Last updated:** [July 13, 2016, 3:22pm UTC](https://discuss.elastic.co/t/jvm-memory-increase-1-time-more-xmx16g-while-elasticsearch-heap-is-stable/55413 "2016-07-13T15:22:45Z")
Hello, We have a cluster of 5 ES servers with a "good" hardware config (Intel Xeon 32 threads, 64GB, 4 x SSD RAID0 ...). We are using last version of ES (2.3.3) and last JVM (JVM: 1.8.0\_91) inside a Debian 8.5 with the… --- ## [ELK logstash config statement error for mongodb input-jdbc plugin](https://discuss.elastic.co/t/elk-logstash-config-statement-error-for-mongodb-input-jdbc-plugin/210690)
**Author:** [@Shantaram\_Tupe](https://discuss.elastic.co/u/Shantaram_Tupe)\ **Replies:** 7\ **Last updated:** [December 11, 2019, 9:48am UTC](https://discuss.elastic.co/t/elk-logstash-config-statement-error-for-mongodb-input-jdbc-plugin/210690 "2019-12-11T09:48:11Z")
Hi All I am new to ELK and MongoDB too, trying to view MongoDB data into Kibana. But but index is not getting created due to following error \[2019-12-05T16:49:14,073\]\[DEBUG\]\[org.mongodb.driver.protocol.command\]\[main\]… --- ## [How to Look for Specific Tag in Filter Conditional](https://discuss.elastic.co/t/how-to-look-for-specific-tag-in-filter-conditional/142964)
**Author:** [@ruhrohshingo](https://discuss.elastic.co/u/ruhrohshingo)\ **Replies:** 2\ **Last updated:** [August 3, 2018, 7:45pm UTC](https://discuss.elastic.co/t/how-to-look-for-specific-tag-in-filter-conditional/142964 "2018-08-03T19:45:05Z")
I've been playing with building an ELK stack with Kafka between Filebeat and Logstash for a couple weeks. On hosts, I have Filebeat configured with a Tags property like so: filebeat.inputs: - type: log enabled: tr… --- ## [JSON parsing issue and mis-reported JSON\_ERROR](https://discuss.elastic.co/t/json-parsing-issue-and-mis-reported-json-error/63074)
**Author:** [@kpam](https://discuss.elastic.co/u/kpam)\ **Replies:** 2\ **Last updated:** [October 14, 2016, 7:57pm UTC](https://discuss.elastic.co/t/json-parsing-issue-and-mis-reported-json-error/63074 "2016-10-14T19:57:09Z")
Hi all, I am using Filebeat 5.0 rc and shipping logs directly to ES/Kibana. I am currently trying to use the JSON option to decode my JSON object log message. The behavior I'm seeing is that when I include the JSON con… --- ## [\[Logstash\] Plusieurs fichiers .conf et indexation d'un type X dans un type Y](https://discuss.elastic.co/t/logstash-plusieurs-fichiers-conf-et-indexation-dun-type-x-dans-un-type-y/98108)
**Author:** [@M4nd76](https://discuss.elastic.co/u/M4nd76)\ **Replies:** 5\ **Last updated:** [September 4, 2017, 9:56am UTC](https://discuss.elastic.co/t/logstash-plusieurs-fichiers-conf-et-indexation-dun-type-x-dans-un-type-y/98108 "2017-09-04T09:56:27Z")
Bonjour ! Je suis entrain de mettre en place une configuration Logstash pour lire les données dans une base de données et écrire dans un ElasticSearch. J’ai géré ma configuration par plusieurs fichiers .conf dans un se… --- ## [SOLVED: Memory Locking not working DEB/5.3.0](https://discuss.elastic.co/t/solved-memory-locking-not-working-deb-5-3-0/82429)
**Author:** [@adamrdrew](https://discuss.elastic.co/u/adamrdrew)\ **Replies:** 1\ **Last updated:** [April 14, 2017, 3:59pm UTC](https://discuss.elastic.co/t/solved-memory-locking-not-working-deb-5-3-0/82429 "2017-04-14T15:59:04Z")
Installed 5.3.0 via DEB on Debian Stretch. I believe I have everything set right but I still get bootstrap failure for memlock: root@stretch:~# grep memory /etc/elasticsearch/elasticsearch.yml bootstrap.memory\_lock: tr… --- ## [Login in Kibana using Custom Realm installed in Elasticsearch](https://discuss.elastic.co/t/login-in-kibana-using-custom-realm-installed-in-elasticsearch/96773)
**Author:** [@sumit\_monga](https://discuss.elastic.co/u/sumit_monga)\ **Replies:** 6\ **Last updated:** [August 16, 2017, 6:53pm UTC](https://discuss.elastic.co/t/login-in-kibana-using-custom-realm-installed-in-elasticsearch/96773 "2017-08-16T18:53:54Z")
I have created a custom realm for X-Pack which uses spring-security-oauth2 based web application for authentication and authorization. This realm is working perfectly with elasticsearch i.e. user is only to able to do o… --- ## [Disable swap](https://discuss.elastic.co/t/disable-swap/83213)
**Author:** [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Replies:** 6\ **Last updated:** [April 25, 2017, 1:05pm UTC](https://discuss.elastic.co/t/disable-swap/83213 "2017-04-25T13:05:46Z")
ERROR: bootstrap checks failed memory locking requested for elasticsearch process but memory is not locked I am getting this error while bringing up ES. I am running my ES as user. How to lock the memory while running i… --- ## [Painless script "Cannot cast from \[boolean\] to \[java.lang.String\]" issue](https://discuss.elastic.co/t/painless-script-cannot-cast-from-boolean-to-java-lang-string-issue/318034)
**Author:** [@alex\_sws](https://discuss.elastic.co/u/alex_sws)\ **Replies:** 3\ **Last updated:** [November 3, 2022, 6:03pm UTC](https://discuss.elastic.co/t/painless-script-cannot-cast-from-boolean-to-java-lang-string-issue/318034 "2022-11-03T18:03:55Z")
Having trouble spotting the error in my script. "reason": "class\_cast\_exception: Cannot cast from \[boolean\] to \[java.lang.String\]." The Scripted field: Instant Currentdate = Instant.ofEpochMilli(new Date().getTime());… --- ## [java.lang.IllegalStateException: Failed to obtain node lock](https://discuss.elastic.co/t/java-lang-illegalstateexception-failed-to-obtain-node-lock/166681)
**Author:** [@Vineet\_Kumar](https://discuss.elastic.co/u/Vineet_Kumar)\ **Replies:** 3\ **Last updated:** [February 1, 2019, 8:55am UTC](https://discuss.elastic.co/t/java-lang-illegalstateexception-failed-to-obtain-node-lock/166681 "2019-02-01T08:55:40Z")
While starting Sonarqube, it stop and showing error for elastic seaach (es node): 2019.01.29 21:24:44 INFO es\[o.s.p.ProcessEntryPoint\] Starting es 2019.01.29 21:24:44 INFO es\[o.s.s.EsSettings\] Elasticsearch listening… --- ## [Login to Kibana indices:data/write/update is unauthorized for user](https://discuss.elastic.co/t/login-to-kibana-indices-data-write-update-is-unauthorized-for-user/120787)
**Author:** [@seyhmus](https://discuss.elastic.co/u/seyhmus)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 1:29pm UTC](https://discuss.elastic.co/t/login-to-kibana-indices-data-write-update-is-unauthorized-for-user/120787 "2018-02-27T13:29:09Z")
Hi all, We have started to use x-pack and configured the AD integration according to documentation on elastic website. We have granted read to kibana index for users and necessary permissions for their indices. However … --- ## [ElasticSearch doesn't start due to insufficient space](https://discuss.elastic.co/t/elasticsearch-doesnt-start-due-to-insufficient-space/101473)
**Author:** [@Lahari](https://discuss.elastic.co/u/Lahari)\ **Replies:** 3\ **Last updated:** [September 22, 2017, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-due-to-insufficient-space/101473 "2017-09-22T14:34:49Z")
We are using ElasticSearch to store logs from around 15 servers in AWS environment. The disk space in ElasticSearch is running out and ElasticSearch isn't starting due to insufficient space. We are using X-pack on Kibana… --- ## [Logstash v6 beta with multiple pipelines configuration](https://discuss.elastic.co/t/logstash-v6-beta-with-multiple-pipelines-configuration/102559)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 9:29am UTC](https://discuss.elastic.co/t/logstash-v6-beta-with-multiple-pipelines-configuration/102559 "2017-10-04T09:29:40Z")
Hello, Thanks for reading this. I am trying out Logstash v6 and multiple pipeline configuration, as per https://www.elastic.co/guide/en/logstash/6.x/multiple-pipelines.html I have configured my pipelines.yml follows: … --- ## [Highlighting not working with keyword normalizer](https://discuss.elastic.co/t/highlighting-not-working-with-keyword-normalizer/97571)
**Author:** [@daviddd](https://discuss.elastic.co/u/daviddd)\ **Replies:** 0\ **Last updated:** [August 18, 2017, 11:34am UTC](https://discuss.elastic.co/t/highlighting-not-working-with-keyword-normalizer/97571 "2017-08-18T11:34:42Z")
\[CUT\] When i set a normalizer with lowercase filter for a field with keyword data type, the highlighting for this field doesn't work. If i create mapping without setting normalizer property of keyword data type, it work… --- ## [Proximity searches - sentenses and paragraphs](https://discuss.elastic.co/t/proximity-searches-sentenses-and-paragraphs/64420)
**Author:** [@akrupnik](https://discuss.elastic.co/u/akrupnik)\ **Replies:** 0\ **Last updated:** [October 31, 2016, 9:26am UTC](https://discuss.elastic.co/t/proximity-searches-sentenses-and-paragraphs/64420 "2016-10-31T09:26:21Z")
Hi there! I have a problem with ElasticSearch - something that I don't quite understand how to approach. We are trying to move from our old search engine (Hummingbird) to ElasticSearch - at the exploration stage at t… --- ## [Exclude Directorys in Filebeat](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139)
**Author:** [@Neropointer](https://discuss.elastic.co/u/Neropointer)\ **Replies:** 4\ **Last updated:** [March 12, 2020, 10:05am UTC](https://discuss.elastic.co/t/exclude-directorys-in-filebeat/223139 "2020-03-12T10:05:42Z")
I need harvest all log files in an directory and the subdirectories and exclude the backup directories that are in the same location. e. g. /foo/bar/service1/.log /foo/bar/service1.backup/.log /foo/bar/service2/.log … --- ## [How to Split the one field into multiple fields using kv plugins](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067)
**Author:** [@muralasandeep](https://discuss.elastic.co/u/muralasandeep)\ **Replies:** 4\ **Last updated:** [March 14, 2019, 5:17am UTC](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067 "2019-03-14T05:17:55Z")
Hi , This is Sandeep, I am new at logstash, here i am trying to fatch data from .csv file to elasticsearch using logstash and i have 6 fields total , in that 6 fields one of the field(log\_message) have actually data i … --- ## [Adding Fleet Server failed because “x509: certificate signed by unknown authority“](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 5\ **Last updated:** [January 30, 2023, 2:52pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157 "2023-01-30T14:52:52Z")
Hello, I tried to add a fleet server today on a CentOS Server. Because I don’t want to add Agents with the —insecure flag anymore, I followed this documentation step by step: I created the ca.crt that signed the fleet… --- ## [Grok match pattern](https://discuss.elastic.co/t/grok-match-pattern/24906)
**Author:** [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Replies:** 5\ **Last updated:** [July 6, 2015, 10:29am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906 "2015-07-06T10:29:41Z")
Wondering if I should be applying a (?=subexp) look-ahead match rule but I haven't been able to do so successfully, Basically I need to do a grok match against a.b.c/1/2/A/IN or a.b/1/AA/IN where the setup is something… --- ## [Filebeat find error Dropping event: no topic could be selected](https://discuss.elastic.co/t/filebeat-find-error-dropping-event-no-topic-could-be-selected/179876)
**Author:** [@icoolchn](https://discuss.elastic.co/u/icoolchn)\ **Replies:** 2\ **Last updated:** [May 8, 2019, 10:57am UTC](https://discuss.elastic.co/t/filebeat-find-error-dropping-event-no-topic-could-be-selected/179876 "2019-05-08T10:57:05Z")
filebeat Helm chart deploy ，autodiscover kubernetes log . find ERROR: kafka/client.go:131 Dropping event: no topic could be selected. cause CPU 300% /var/lib/docker/containers/ dir path of filebeat docker log Disk … --- ## [Logstash - Filter-Date-Match](https://discuss.elastic.co/t/logstash-filter-date-match/84329)
**Author:** [@senthilyes](https://discuss.elastic.co/u/senthilyes)\ **Replies:** 2\ **Last updated:** [May 4, 2017, 3:29pm UTC](https://discuss.elastic.co/t/logstash-filter-date-match/84329 "2017-05-04T15:29:09Z")
Hi Trying to replace the timestamp (interval\_start\_date\_time) retrieved from DB2 to the logstash time stamp. Referred other similar threads but didn't help and finally here. Output without using Date filter: { "@… --- ## [How to exclude numeric value from a pie chart?](https://discuss.elastic.co/t/how-to-exclude-numeric-value-from-a-pie-chart/81458)
**Author:** [@pmbanka](https://discuss.elastic.co/u/pmbanka)\ **Replies:** 2\ **Last updated:** [April 7, 2017, 7:22am UTC](https://discuss.elastic.co/t/how-to-exclude-numeric-value-from-a-pie-chart/81458 "2017-04-07T07:22:01Z")
I'm trying to set up a piechart displaying data from a number-type field. In advanced option there is an "Exclude" field which I want to use, but I can't find a way to get it to work. Whatever I type in (I want to exclud… --- ## [Java, mlockall and high cpu kswapd](https://discuss.elastic.co/t/java-mlockall-and-high-cpu-kswapd/20168)
**Author:** [@elasticsearch1](https://discuss.elastic.co/u/elasticsearch1)\ **Replies:** 6\ **Last updated:** [October 18, 2014, 3:15pm UTC](https://discuss.elastic.co/t/java-mlockall-and-high-cpu-kswapd/20168 "2014-10-18T15:15:48Z")
Hi All, This is a bit off topic, but we only see this on some of our elastic search hosts, and it is also the only place where we enable mlockall for java which is our understanding is a strongly recommended best prac… --- ## [Firewall log in ECS](https://discuss.elastic.co/t/firewall-log-in-ecs/198224)
**Author:** [@phruby](https://discuss.elastic.co/u/phruby)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 6:00pm UTC](https://discuss.elastic.co/t/firewall-log-in-ecs/198224 "2019-09-16T18:00:04Z")
I have a couple of basic questions regarding mapping firewall log fields to Elastic Common Schema, in the way compatible with the intentions of ECS designers. Firewall is deployed on a server determined by the 'origin' … --- ## [Bulk indexing with x-pack Exception](https://discuss.elastic.co/t/bulk-indexing-with-x-pack-exception/92086)
**Author:** [@franck.lefebure](https://discuss.elastic.co/u/franck.lefebure)\ **Replies:** 4\ **Last updated:** [July 7, 2017, 7:01am UTC](https://discuss.elastic.co/t/bulk-indexing-with-x-pack-exception/92086 "2017-07-07T07:01:15Z")
Hi, With a 5.4.3 single node cluster and a 5.4.3 java client, last JDK, all centos Linux : I meet the following error when the x-pack is installed on the cluster (with config xpack.security.enabled: false) org.elastics… --- ## [ES 2.1.0 bulk api throws ArrayIndexOutOfBoundsException](https://discuss.elastic.co/t/es-2-1-0-bulk-api-throws-arrayindexoutofboundsexception/38743)
**Author:** [@James\_Kelvin](https://discuss.elastic.co/u/James_Kelvin)\ **Replies:** 4\ **Last updated:** [January 11, 2016, 2:09am UTC](https://discuss.elastic.co/t/es-2-1-0-bulk-api-throws-arrayindexoutofboundsexception/38743 "2016-01-11T02:09:52Z")
I use BulkProcessor for indexing, bulksize = 5M. It works very well with ES 1.7.3. but when upgrade to ES 2.1.0, throw exceptions as below: \[2016-01-08 17:45:19,733\]\[DEBUG\]\[action.bulk \] \[mybox\] \[mgindex0\]\[3\] failed… --- ## [Filebeat truncates output data](https://discuss.elastic.co/t/filebeat-truncates-output-data/210645)
**Author:** [@gappa](https://discuss.elastic.co/u/gappa)\ **Replies:** 7\ **Last updated:** [December 5, 2019, 1:25pm UTC](https://discuss.elastic.co/t/filebeat-truncates-output-data/210645 "2019-12-05T13:25:00Z")
I'm using Filebeat 7.4.2 in order to read files from a directory. Each file contains valid json data line by line. Each json row within the file is read from filebeat then sent to a logstash (v7.4.2) instance that will s… [Previous page](https://discuss.elastic.co/top.md?page=607&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=609&per_page=50&period=all)