# Top **URL:** https://discuss.elastic.co/top.md?page=625&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 626 --- ## [Searching for response code, get results without the response code field](https://discuss.elastic.co/t/searching-for-response-code-get-results-without-the-response-code-field/193558)
**Author:** [@flex567](https://discuss.elastic.co/u/flex567)\ **Replies:** 1\ **Last updated:** [August 2, 2019, 7:54pm UTC](https://discuss.elastic.co/t/searching-for-response-code-get-results-without-the-response-code-field/193558 "2019-08-02T19:54:34Z")
I ma using the Discover tab and I am using the Search field with the following query: "NOT response-http-code:(202)". The problem is I am getting result with 403 which is correct, but I also see entries without the res… --- ## [Rolling upgrade sequence of node types](https://discuss.elastic.co/t/rolling-upgrade-sequence-of-node-types/120311)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 8\ **Last updated:** [March 8, 2018, 2:44pm UTC](https://discuss.elastic.co/t/rolling-upgrade-sequence-of-node-types/120311 "2018-03-08T14:44:58Z")
Hi, rolling upgrading from 6.1.2 to 6.2 which includes node types: master ingest, coordinator and data and I use free license for monitoring. I encoutered 2 issues.. 1- I had started with the master nodes... Elastic c… --- ## [Large number of indexes](https://discuss.elastic.co/t/large-number-of-indexes/28853)
**Author:** [@Galim\_Kaudinov](https://discuss.elastic.co/u/Galim_Kaudinov)\ **Replies:** 3\ **Last updated:** [September 9, 2015, 4:48pm UTC](https://discuss.elastic.co/t/large-number-of-indexes/28853 "2015-09-09T16:48:54Z")
In my multi tenant application every tenant has an ability to create a custom data structure that is composed of different fields such as strings, bools, ints and etc. I am planning to create an index per data structu… --- ## [How to implement a user specific search?](https://discuss.elastic.co/t/how-to-implement-a-user-specific-search/5564)
**Author:** [@pmeier](https://discuss.elastic.co/u/pmeier)\ **Replies:** 3\ **Last updated:** [October 12, 2011, 8:07am UTC](https://discuss.elastic.co/t/how-to-implement-a-user-specific-search/5564 "2011-10-12T08:07:27Z")
Hi all, I have a bunch of items to search. Normally I would put them in one index and they are searchable. But I have the restriction that every user should only see a specific subset of all the items. The p… --- ## [Alert if index has 0 documents in last X minutes (Rules and connectors or Detection Rules)](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 3\ **Last updated:** [September 1, 2021, 2:36pm UTC](https://discuss.elastic.co/t/alert-if-index-has-0-documents-in-last-x-minutes-rules-and-connectors-or-detection-rules/282902 "2021-09-01T14:36:36Z")
Hello Guys, I've been working around with "Rules and Connectors" and "Detection Rules" in order to get a notification when one of my beats stops sending data. Each beat has different indexes, so i would like to "know" i… --- ## [Can I write script for Kibana 4 dashboard?](https://discuss.elastic.co/t/can-i-write-script-for-kibana-4-dashboard/24332)
**Author:** [@Siddhant\_Agarwal](https://discuss.elastic.co/u/Siddhant_Agarwal)\ **Replies:** 3\ **Last updated:** [June 26, 2015, 1:05pm UTC](https://discuss.elastic.co/t/can-i-write-script-for-kibana-4-dashboard/24332 "2015-06-26T13:05:33Z")
Is there a way to write a script to directly go to dashboard which contains multiple visualisations? The script includes making visualisation and attaching it to dashboard. The purpose is to run ELK stack with this scrip… --- ## [Elasticsearch GC log message](https://discuss.elastic.co/t/elasticsearch-gc-log-message/135355)
**Author:** [@9787d569382ad9fcce95](https://discuss.elastic.co/u/9787d569382ad9fcce95)\ **Replies:** 1\ **Last updated:** [June 15, 2018, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-gc-log-message/135355 "2018-06-15T09:48:49Z")
Hi, I install Elasticsearch 6.2.4 by .rpm (elasticsearch-6.2.4.rpm) for testing purpose. After installation, elasticsearch service running normally and no error log found in /var/log/elasticsearch.log However, there a… --- ## [How to calculate number of data node requirement in a cluster](https://discuss.elastic.co/t/how-to-calculate-number-of-data-node-requirement-in-a-cluster/128879)
**Author:** [@Jayakrishnan\_Nair](https://discuss.elastic.co/u/Jayakrishnan_Nair)\ **Replies:** 1\ **Last updated:** [April 20, 2018, 12:54pm UTC](https://discuss.elastic.co/t/how-to-calculate-number-of-data-node-requirement-in-a-cluster/128879 "2018-04-20T12:54:33Z")
How to calculate number of data only node required in a cluster. Calculating it in terms of number of shards, indexes or size of shards, indexes. Can any give some pointer or limits that provides pointer to add more d… --- ## [Mutate switch statement?](https://discuss.elastic.co/t/mutate-switch-statement/54720)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 11:58am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720 "2016-07-05T11:58:41Z")
I am trying to convert the mongodb log levels from single characters to normal values. Is there a simpler way to do this than: if \[level\] == "D" { mutate { gsub =\> \[ "level", "D", "DEBUG" \] } } … --- ## [DeprecationWarning: The 'body' parameter is deprecated for the 'index' API and will be removed in a future version](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876)
**Author:** [@ingmar](https://discuss.elastic.co/u/ingmar)\ **Replies:** 0\ **Last updated:** [December 14, 2021, 10:15pm UTC](https://discuss.elastic.co/t/deprecationwarning-the-body-parameter-is-deprecated-for-the-index-api-and-will-be-removed-in-a-future-version/291876 "2021-12-14T22:15:06Z")
Describe the feature: Elasticsearch version 7.15 elasticsearch-py version (elasticsearch.\_\_versionstr\_\_): 7.15.2 Please make sure the major version matches the Elasticsearch server you are running. Description of th… --- ## [Failed to flush export bulks / bulk \[my\_local\] reports failures when exporting documents](https://discuss.elastic.co/t/failed-to-flush-export-bulks-bulk-my-local-reports-failures-when-exporting-documents/162462)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [December 31, 2018, 12:04am UTC](https://discuss.elastic.co/t/failed-to-flush-export-bulks-bulk-my-local-reports-failures-when-exporting-documents/162462 "2018-12-31T00:04:27Z")
I'm trying to start Elasticsearch cluster and getting following error(s): esm4 | Caused by: org.elasticsearch.xpack.monitoring.exporter.ExportException: failed to flush export bulks esm4 | at or… --- ## [A lightweight partial index](https://discuss.elastic.co/t/a-lightweight-partial-index/11746)
**Author:** [@Jon\_Pither](https://discuss.elastic.co/u/Jon_Pither)\ **Replies:** 3\ **Last updated:** [April 30, 2013, 11:36pm UTC](https://discuss.elastic.co/t/a-lightweight-partial-index/11746 "2013-04-30T23:36:23Z")
Hi, We have an ES index of around 12.5 gb and growing. We use the index in various ways. For one use case we hit the index with an 'ids' query - passing around 500 ids typically and then pulling the documents b… --- ## [Exchange logs](https://discuss.elastic.co/t/exchange-logs/261413)
**Author:** [@baddack](https://discuss.elastic.co/u/baddack)\ **Replies:** 4\ **Last updated:** [February 19, 2021, 3:29pm UTC](https://discuss.elastic.co/t/exchange-logs/261413 "2021-02-19T15:29:06Z")
Hello everyone ! I create this new topic today beacause I have an issue with message tracking in Exchange logs. Indeed I want to make a top10 senders for example but when I am looking to Exchange's logs there are many e… --- ## [Scripted Fields Disappeared from Index Pattern](https://discuss.elastic.co/t/scripted-fields-disappeared-from-index-pattern/34991)
**Author:** [@john\_monroe](https://discuss.elastic.co/u/john_monroe)\ **Replies:** 5\ **Last updated:** [May 26, 2016, 3:18pm UTC](https://discuss.elastic.co/t/scripted-fields-disappeared-from-index-pattern/34991 "2016-05-26T15:18:29Z")
After creating several scripted fields for one of our indexes and using them successfully in several visualizations and dashboards over a period of time, all saved scripted fields suddenly disappeared. In addition, all i… --- ## [CRIT Exiting: Could not start registrar: Error loading state: Error decoding states: json: cannot unmarshal object into Go value of type \[\]file](https://discuss.elastic.co/t/crit-exiting-could-not-start-registrar-error-loading-state-error-decoding-states-json-cannot-unmarshal-object-into-go-value-of-type-file/108887)
**Author:** [@David\_Montgomery](https://discuss.elastic.co/u/David_Montgomery)\ **Replies:** 1\ **Last updated:** [November 23, 2017, 8:38pm UTC](https://discuss.elastic.co/t/crit-exiting-could-not-start-registrar-error-loading-state-error-decoding-states-json-cannot-unmarshal-object-into-go-value-of-type-file/108887 "2017-11-23T20:38:58Z")
Why? Writing to log to AWS Es as a service. ES..whats the deal? What does that mean? How do I ship to ES using file beat on 16.04? filebeat: prospectors: - paths: - "/tmp/upload.log" - "/var/log/nginx/access.lo… --- ## [Developer licensing for X-Pack](https://discuss.elastic.co/t/developer-licensing-for-x-pack/90304)
**Author:** [@MikeThomsen](https://discuss.elastic.co/u/MikeThomsen)\ **Replies:** 3\ **Last updated:** [June 21, 2017, 6:35pm UTC](https://discuss.elastic.co/t/developer-licensing-for-x-pack/90304 "2017-06-21T18:35:30Z")
Is it within the licensing guidelines for developers to continuously reinstall X-Pack when the 30 day license runs out when we're just using the license to learn the products, develop and demonstrate capabilities? (ie th… --- ## [Spring Data and Elasticsearch 5.2 Transportclient error](https://discuss.elastic.co/t/spring-data-and-elasticsearch-5-2-transportclient-error/75030)
**Author:** [@sina309](https://discuss.elastic.co/u/sina309)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 2:20pm UTC](https://discuss.elastic.co/t/spring-data-and-elasticsearch-5-2-transportclient-error/75030 "2017-02-14T14:20:27Z")
I am experimenting with Spring Data Elasticsearch and also have a local Elasticsearch 5.2 running. Somehow can't connect from the application to the ES instance. My Repository XML looks like this: \ **Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 4\ **Last updated:** [March 22, 2016, 10:24pm UTC](https://discuss.elastic.co/t/problem-in-starting-a-node-in-es-2-2-1/45082 "2016-03-22T22:24:54Z") Hi All, I installed Elasticsearch 2.2.1 version in DEV server and configured 3 yml files like (elasticsearch-poc-master.yml, elasticsearch-poc-data.yml & elasticsearch-poc-client.yml). Below is the command details used… --- ## [Size of Closed Index](https://discuss.elastic.co/t/size-of-closed-index/27302)
**Author:** [@tanveer3](https://discuss.elastic.co/u/tanveer3)\ **Replies:** 4\ **Last updated:** [August 13, 2015, 7:58am UTC](https://discuss.elastic.co/t/size-of-closed-index/27302 "2015-08-13T07:58:59Z")
Hi All How could we check the size of Closed Index on filesystem in Elasticsearch. --- ## [Getting logged in user details in Kibana](https://discuss.elastic.co/t/getting-logged-in-user-details-in-kibana/72684)
**Author:** [@gsb](https://discuss.elastic.co/u/gsb)\ **Replies:** 3\ **Last updated:** [January 25, 2017, 9:02pm UTC](https://discuss.elastic.co/t/getting-logged-in-user-details-in-kibana/72684 "2017-01-25T21:02:11Z")
I have recently configured Kibana with elasticshield Is there any mechanism which retrieves the logged in user's details within kibana.? for instance elastic search query or something else. --- ## [Streaming a whole SearchResponse as JSON](https://discuss.elastic.co/t/streaming-a-whole-searchresponse-as-json/3688)
**Author:** [@skaffman\_2](https://discuss.elastic.co/u/skaffman_2)\ **Replies:** 3\ **Last updated:** [December 22, 2010, 11:25am UTC](https://discuss.elastic.co/t/streaming-a-whole-searchresponse-as-json/3688 "2010-12-22T11:25:50Z")
I'm writing a thin proxy server to sit in front of ElasticSearch, using the java client API. The proxy constructs a query, sends it off to ElasticSearch, and returns the results to the proxy client. Pretty simple, … --- ## [Aggregation on Boolean Fields](https://discuss.elastic.co/t/aggregation-on-boolean-fields/132790)
**Author:** [@siddharth\_jain](https://discuss.elastic.co/u/siddharth_jain)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 12:30pm UTC](https://discuss.elastic.co/t/aggregation-on-boolean-fields/132790 "2018-05-23T12:30:56Z")
To save space I want to convert one field to boolean type. The mapping of the index is- { "siddharth-03": { "mappings": { "\_doc": { "properties": { "age": { "type": "boolean" } } } } } } I can write a qu… --- ## [Elasticsearch index issue with logstash-netflow in 5.x](https://discuss.elastic.co/t/elasticsearch-index-issue-with-logstash-netflow-in-5-x/65854)
**Author:** [@Anantha\_Ravi](https://discuss.elastic.co/u/Anantha_Ravi)\ **Replies:** 7\ **Last updated:** [November 16, 2016, 3:56pm UTC](https://discuss.elastic.co/t/elasticsearch-index-issue-with-logstash-netflow-in-5-x/65854 "2016-11-16T15:56:44Z")
I find elastcisearch is not creating the index based on the below logstash configuration . have installed netflow-codec through logstash-plugin . logstash config: \[root@SERVER logstash\]# cat /etc/logstash/conf.d/logs… --- ## [Is it possible to install multiple Fleet Servers?](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-fleet-servers/315744)
**Author:** [@sirineb](https://discuss.elastic.co/u/sirineb)\ **Replies:** 4\ **Last updated:** [October 6, 2022, 7:15am UTC](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-fleet-servers/315744 "2022-10-06T07:15:03Z")
Hi everyone, I was wondering, is it possible to install multiple Fleet Servers connected to the same ES ? I explain myself, I already have a Fleet Server installed but there might be a lot more Elastic agents than now … --- ## [How long do deleted documents remain in the index?](https://discuss.elastic.co/t/how-long-do-deleted-documents-remain-in-the-index/12981)
**Author:** [@Stefan\_Fussenegger](https://discuss.elastic.co/u/Stefan_Fussenegger)\ **Replies:** 4\ **Last updated:** [July 29, 2013, 9:06pm UTC](https://discuss.elastic.co/t/how-long-do-deleted-documents-remain-in-the-index/12981 "2013-07-29T21:06:23Z")
Hi all, in a previous question I was asking how long it takes for documents to get expunged from the index. I was pointed to index.gc\_deletes on SO (and created #3396 thereafter). However, I still didn't get … --- ## [Can we use ELK stack without X-Pack?](https://discuss.elastic.co/t/can-we-use-elk-stack-without-x-pack/125104)
**Author:** [@muthu\_kumar1](https://discuss.elastic.co/u/muthu_kumar1)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 6:49am UTC](https://discuss.elastic.co/t/can-we-use-elk-stack-without-x-pack/125104 "2018-03-22T06:49:41Z")
Can we use ELK stack without X-Pack --- ## [APM Server index template matching \[traces-apm.sampled\] not found](https://discuss.elastic.co/t/apm-server-index-template-matching-traces-apm-sampled-not-found/319677)
**Author:** [@DenishPatel](https://discuss.elastic.co/u/DenishPatel)\ **Replies:** 2\ **Last updated:** [December 6, 2022, 3:06pm UTC](https://discuss.elastic.co/t/apm-server-index-template-matching-traces-apm-sampled-not-found/319677 "2022-12-06T15:06:40Z")
Kibana version: 8.5.1 Elasticsearch version:8.5.1 APM Server version:8.5.1 APM Agent language and version: Not yet installed Browser version:Chrome 107.0.5304.63 Original install method (e.g. download page, yum, deb… --- ## [Check if port is open with Logstash/Elasticsearch](https://discuss.elastic.co/t/check-if-port-is-open-with-logstash-elasticsearch/56177)
**Author:** [@beelastic](https://discuss.elastic.co/u/beelastic)\ **Replies:** 2\ **Last updated:** [July 24, 2016, 11:24am UTC](https://discuss.elastic.co/t/check-if-port-is-open-with-logstash-elasticsearch/56177 "2016-07-24T11:24:56Z")
I want to be alerted (with wather) if a specific port is closed. To achiev this i want to create a field with logstash (e.g. port\_status), and fill it with open or close, whether the port is open or closed. How can i… --- ## [Phonetic plugin](https://discuss.elastic.co/t/phonetic-plugin/41405)
**Author:** [@Jerome\_David](https://discuss.elastic.co/u/Jerome_David)\ **Replies:** 2\ **Last updated:** [February 10, 2016, 6:14pm UTC](https://discuss.elastic.co/t/phonetic-plugin/41405 "2016-02-10T18:14:43Z")
I would like to use the phonetic analysis. I am using elasticsearch v2.2.0. I installed the analysis\_phonetic plugin: bin\\plugin install analysis-phonetic It seems to be installed correctly. bin\\plugin list ret… --- ## [Output to any output is not working](https://discuss.elastic.co/t/output-to-any-output-is-not-working/157439)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 7\ **Last updated:** [November 23, 2018, 1:40am UTC](https://discuss.elastic.co/t/output-to-any-output-is-not-working/157439 "2018-11-23T01:40:32Z")
Hello, I am importing logs via filebeat 6.5.0 into logstash. If in debug mode I can see the data being taken by logstash but it is not sent to any output I have tried stdout output and elasticsearch output but did not g… --- ## [Combine 2 events into one](https://discuss.elastic.co/t/combine-2-events-into-one/70825)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 1\ **Last updated:** [January 11, 2017, 11:02pm UTC](https://discuss.elastic.co/t/combine-2-events-into-one/70825 "2017-01-11T23:02:22Z")
Hi, I am trying to merge 2 log events into a single event in logstash.. After some research, i found out about the aggregate filter.. I am not quite sure if I am doing this correctly but as of now.. It is not adding th… --- ## [Forcing Types in Elasticsearch](https://discuss.elastic.co/t/forcing-types-in-elasticsearch/79370)
**Author:** [@lisadeng](https://discuss.elastic.co/u/lisadeng)\ **Replies:** 4\ **Last updated:** [April 4, 2017, 7:23am UTC](https://discuss.elastic.co/t/forcing-types-in-elasticsearch/79370 "2017-04-04T07:23:13Z")
I'm using the http\_poller plugin right now to monitor websites. I noticed that when I query a website that refuses a connection, it doesn't give me a status code field in the error log. Right now I'm trying to visualiz… --- ## [I am not able to see security option in management under kibana UI](https://discuss.elastic.co/t/i-am-not-able-to-see-security-option-in-management-under-kibana-ui/177787)
**Author:** [@Swati123](https://discuss.elastic.co/u/Swati123)\ **Replies:** 2\ **Last updated:** [April 26, 2019, 6:34am UTC](https://discuss.elastic.co/t/i-am-not-able-to-see-security-option-in-management-under-kibana-ui/177787 "2019-04-26T06:34:40Z")
Hi All, I am not able to see the security feature under kibana UI? I have to set Kibana\_user\_only mode under Managment -\> security -\> Users. Can anyone please help me with this? --- ## [Trying to calculate time difference using scripted fields](https://discuss.elastic.co/t/trying-to-calculate-time-difference-using-scripted-fields/197674)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 5\ **Last updated:** [September 4, 2019, 10:57am UTC](https://discuss.elastic.co/t/trying-to-calculate-time-difference-using-scripted-fields/197674 "2019-09-04T10:57:00Z")
Hi i am trying to calculate time difference between two fields: netflow.first\_switched Sep 2, 2019 @ 16:25:51.000 netflow.last\_switched Sep 2, 2019 @ 16:25:52.182 I am using: doc\['netflow.last\_switched'\].value-doc\[… --- ## [Not\_Analyzed Field Splits On Spaces](https://discuss.elastic.co/t/not-analyzed-field-splits-on-spaces/33825)
**Author:** [@gromit](https://discuss.elastic.co/u/gromit)\ **Replies:** 5\ **Last updated:** [June 21, 2016, 4:59pm UTC](https://discuss.elastic.co/t/not-analyzed-field-splits-on-spaces/33825 "2016-06-21T16:59:38Z")
I have a field marked as type string, not\_analyzed. When visualising data from this field each word is separated. It is as if the field were mapped as analyzed. I have another index which has the same field not\_analyzed … --- ## [Dec 13th, 2023: \[EN\] 10 reasons to upgrade to elasticsearch-py 8.x](https://discuss.elastic.co/t/dec-13th-2023-en-10-reasons-to-upgrade-to-elasticsearch-py-8-x/347292)
**Author:** [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)\ **Replies:** 0\ **Last updated:** [December 13, 2023, 8:00am UTC](https://discuss.elastic.co/t/dec-13th-2023-en-10-reasons-to-upgrade-to-elasticsearch-py-8-x/347292 "2023-12-13T08:00:29Z")
Cet article est disponible en français. Back in February 2022, when Elasticsearch 8.0 was released, the Python client also got an 8.0 release. It was a partial rewrite of the 7.x client, and came with a bunch of nice… --- ## [Can I calculate approximate segments memory requirements?](https://discuss.elastic.co/t/can-i-calculate-approximate-segments-memory-requirements/2426)
**Author:** [@dave](https://discuss.elastic.co/u/dave)\ **Replies:** 4\ **Last updated:** [June 15, 2015, 8:00pm UTC](https://discuss.elastic.co/t/can-i-calculate-approximate-segments-memory-requirements/2426 "2015-06-15T20:00:09Z")
Hey! So I am running Elasticsearch on somewhat memory-constrained cloud boxes, and after I index a few hundred gigs of data the segments memory begins to approach the amount of memory I've allocated to the process, and s… --- ## [Math calculation in kibana to visualize](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970)
**Author:** [@Nanditha](https://discuss.elastic.co/u/Nanditha)\ **Replies:** 3\ **Last updated:** [October 19, 2022, 10:07am UTC](https://discuss.elastic.co/t/math-calculation-in-kibana-to-visualize/316970 "2022-10-19T10:07:09Z")
I need to calculate below math calculations and visualize it in dashboard. When i push new data it should calculate the same and change. Can anyone please help on this. precision = tp/ (tp + fp) recall = tp/tp + fn Fal… --- ## [Get back original message after grokking](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 7\ **Last updated:** [December 15, 2017, 10:30am UTC](https://discuss.elastic.co/t/get-back-original-message-after-grokking/111513 "2017-12-15T10:30:55Z")
hi all, I'm a beginner of elk. i'm trying to extract fields from log message event in logstash. after logstash extract fields from message, can i get back original message? and is there anyway to get back original mes… --- ## [Grep on input message with json format](https://discuss.elastic.co/t/grep-on-input-message-with-json-format/36221)
**Author:** [@vimalmpatel](https://discuss.elastic.co/u/vimalmpatel)\ **Replies:** 7\ **Last updated:** [January 26, 2016, 3:24pm UTC](https://discuss.elastic.co/t/grep-on-input-message-with-json-format/36221 "2016-01-26T15:24:08Z")
hello my input message is in json format. if i want to use condition to create new tag within jason how would i do that . please correct me if i am wrong. input file record {"applicationID":"12348811","timestamp"… --- ## [Elasticsearch.yml Email configuration](https://discuss.elastic.co/t/elasticsearch-yml-email-configuration/216754)
**Author:** [@Ali\_Coluk](https://discuss.elastic.co/u/Ali_Coluk)\ **Replies:** 5\ **Last updated:** [February 13, 2020, 8:03am UTC](https://discuss.elastic.co/t/elasticsearch-yml-email-configuration/216754 "2020-02-13T08:03:02Z")
Hello everyone, I am trying to configure Watcher and send an email and/or slack messages. To do this I know that I need to configure the elasticsearch.yml file and add an email sender. But after my configuration, as you… --- ## [How to implement MYSQL union, join and left join into elasticsearch query?](https://discuss.elastic.co/t/how-to-implement-mysql-union-join-and-left-join-into-elasticsearch-query/78669)
**Author:** [@vinay.bhardwaj](https://discuss.elastic.co/u/vinay.bhardwaj)\ **Replies:** 5\ **Last updated:** [March 21, 2017, 3:24am UTC](https://discuss.elastic.co/t/how-to-implement-mysql-union-join-and-left-join-into-elasticsearch-query/78669 "2017-03-21T03:24:59Z")
How to use mysql UNION, JOIN and LEFT JOIN in elasticsearch query? I want to implement the following MYSQL query in elasticsearch query language. select date\_format(x1.week, '%Y-%m-%d') as week, coalesce(users,… --- ## [Adding new node to cluster is not so easy -- new node is busted](https://discuss.elastic.co/t/adding-new-node-to-cluster-is-not-so-easy-new-node-is-busted/39819)
**Author:** [@jm650](https://discuss.elastic.co/u/jm650)\ **Replies:** 5\ **Last updated:** [January 23, 2016, 5:20pm UTC](https://discuss.elastic.co/t/adding-new-node-to-cluster-is-not-so-easy-new-node-is-busted/39819 "2016-01-23T17:20:06Z")
Life was beautiful on a single node but I index 300gb of logs per day and after ten or eleven days I added a new storage node. The new node doesnt work. I had high hopes for the cluster to automagically provision it but … --- ## [Snapshot api is not working](https://discuss.elastic.co/t/snapshot-api-is-not-working/204702)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 4\ **Last updated:** [October 23, 2019, 5:15pm UTC](https://discuss.elastic.co/t/snapshot-api-is-not-working/204702 "2019-10-23T17:15:27Z")
I have the following code: curl -X PUT "localhost:9200/\_snapshot/backup?wait\_for\_completion=true" -H'Content-Type:application/json' -d '{ "indices": "index\_1", ”type": "fs", "settings": { "location": "/Users/bas… --- ## [Logstash grok pattern COMBINEDAPACHELOG field name collision with latest filebeat 7.2.0 client and logstash useragent plugin](https://discuss.elastic.co/t/logstash-grok-pattern-combinedapachelog-field-name-collision-with-latest-filebeat-7-2-0-client-and-logstash-useragent-plugin/191584)
**Author:** [@iuuuuan](https://discuss.elastic.co/u/iuuuuan)\ **Replies:** 4\ **Last updated:** [July 29, 2019, 8:53am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-combinedapachelog-field-name-collision-with-latest-filebeat-7-2-0-client-and-logstash-useragent-plugin/191584 "2019-07-29T08:53:34Z")
Hi, there seems to be issues with logstash grok pattern COMBINEDAPACHELOG with latest filebeat 7.2.0 client and logstash useragent plugin. I am using grok pattern COMBINEDAPACHELOG which translates to %{COMMONAPACHELO… --- ## [Massive performance issues on our production cluster](https://discuss.elastic.co/t/massive-performance-issues-on-our-production-cluster/2785)
**Author:** [@salat](https://discuss.elastic.co/u/salat)\ **Replies:** 4\ **Last updated:** [June 20, 2015, 9:48am UTC](https://discuss.elastic.co/t/massive-performance-issues-on-our-production-cluster/2785 "2015-06-20T09:48:49Z")
Dear Folks, right now we see some serious performance issues on our AWS EC2 elasticsearch cluster. Our nodes are not responding very wenn and hanging at a CPU load of in average 90%. Here is a copy of the hot\_threads… --- ## [Elasticsearch and Smile encoded JSON](https://discuss.elastic.co/t/elasticsearch-and-smile-encoded-json/17796)
**Author:** [@Drew\_Kutcharian](https://discuss.elastic.co/u/Drew_Kutcharian)\ **Replies:** 4\ **Last updated:** [May 30, 2014, 9:47am UTC](https://discuss.elastic.co/t/elasticsearch-and-smile-encoded-json/17796 "2014-05-30T09:47:32Z")
Hey Guys, I wanted to get some clarification on how Elasticsearch handles/uses Smile binary JSON. Mainly: 1. Does ES convert JSON to Smile before saving into Lucene? 2. Does ES use Smile as the wire protocol for… --- ## [Inverse Query](https://discuss.elastic.co/t/inverse-query/160628)
**Author:** [@rudyamid](https://discuss.elastic.co/u/rudyamid)\ **Replies:** 6\ **Last updated:** [January 10, 2019, 7:25am UTC](https://discuss.elastic.co/t/inverse-query/160628 "2019-01-10T07:25:01Z")
I'm trying to create a Canvas markdown element with data from the following Elasticsearch SQL query: SELECT Severity FROM "firewall-logs\*" WHERE Severity LIKE '%critical%' AND ThreatName.keyword IS NOT NULL My problem … --- ## [5.1.1 : All shards unassigned?](https://discuss.elastic.co/t/5-1-1-all-shards-unassigned/70649)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [January 31, 2017, 11:40am UTC](https://discuss.elastic.co/t/5-1-1-all-shards-unassigned/70649 "2017-01-31T11:40:51Z")
Hi, I have a new cluster up and running and when I started up logstash it started sending heartbeat data through. However, all shards (primary and replica) for the newly created index remain unassigned with no reason cod… --- ## [Packetbeat Dashboard not displaying Client locations](https://discuss.elastic.co/t/packetbeat-dashboard-not-displaying-client-locations/63608)
**Author:** [@napoleon182](https://discuss.elastic.co/u/napoleon182)\ **Replies:** 8\ **Last updated:** [October 25, 2016, 2:08pm UTC](https://discuss.elastic.co/t/packetbeat-dashboard-not-displaying-client-locations/63608 "2016-10-25T14:08:03Z")
Hi All, I'm having problems with PacketBeat dashboard not displaying Client Locations correctly, (see screenshot attached)- although saved search is returning results from query correctly. [Previous page](https://discuss.elastic.co/top.md?page=624&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=626&per_page=50&period=all)