# Top

**URL:** https://discuss.elastic.co/top.md?page=635&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 636

---

## [How to tell if "tags" array is empty in LS 6](https://discuss.elastic.co/t/how-to-tell-if-tags-array-is-empty-in-ls-6/121357)

<div class="topic-metadata">

**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\
**Replies:** 4\
**Last updated:** [March 21, 2018, 8:11pm UTC](https://discuss.elastic.co/t/how-to-tell-if-tags-array-is-empty-in-ls-6/121357 "2018-03-21T20:11:33Z")

</div>

Hi, The code here (How can I check if the "tags" array is empty?) used to work for checking if tags was empty or not. if \[tags\] == \[\] { mutate { remove\_field =\> \["tags"\] } } Unfortunately, it no longer seems t…

---

## [Installing X-Pack on Windows 2016](https://discuss.elastic.co/t/installing-x-pack-on-windows-2016/118151)

<div class="topic-metadata">

**Author:** [@Yellow](https://discuss.elastic.co/u/Yellow)\
**Replies:** 8\
**Last updated:** [February 2, 2018, 8:37am UTC](https://discuss.elastic.co/t/installing-x-pack-on-windows-2016/118151 "2018-02-02T08:37:32Z")

</div>

Hi Guys, Stupid simple question. I'm new to installing Elasticsearch and do not know how to install x-pack, after i completed the msi install of Elasticsearch. During the ES install, i unchecked X-pack and wanted to ins…

---

## [Logstash Kafka Avro Confluent Schema Registry](https://discuss.elastic.co/t/logstash-kafka-avro-confluent-schema-registry/28827)

<div class="topic-metadata">

**Author:** [@Arttii](https://discuss.elastic.co/u/Arttii)\
**Replies:** 1\
**Last updated:** [September 8, 2015, 11:59pm UTC](https://discuss.elastic.co/t/logstash-kafka-avro-confluent-schema-registry/28827 "2015-09-08T23:59:29Z")

</div>

Hi, I was wondering if anyone has any experience on using the Logstash kafka plugin, but with AVRO and as an extra has anybody tried something like this using the Serializers from the Confluent Schema Registry? Thank…

---

## [Kibana doesn't refresh the cache - 50k+ fields](https://discuss.elastic.co/t/kibana-doesnt-refresh-the-cache-50k-fields/50174)

<div class="topic-metadata">

**Author:** [@Tommi\_Latti](https://discuss.elastic.co/u/Tommi_Latti)\
**Replies:** 3\
**Last updated:** [May 18, 2016, 2:35am UTC](https://discuss.elastic.co/t/kibana-doesnt-refresh-the-cache-50k-fields/50174 "2016-05-18T02:35:03Z")

</div>

I wanted to some edits in our visualisations today, and noticed that our index (this is not logstash, but live online game analytics data) has grown to 50k+ fields. This is pretty normal since we expand all the user data…

---

## [Kiban left navbar icons disappear when I click my plugin icon](https://discuss.elastic.co/t/kiban-left-navbar-icons-disappear-when-i-click-my-plugin-icon/167967)

<div class="topic-metadata">

**Author:** [@trex](https://discuss.elastic.co/u/trex)\
**Replies:** 3\
**Last updated:** [March 14, 2019, 4:36pm UTC](https://discuss.elastic.co/t/kiban-left-navbar-icons-disappear-when-i-click-my-plugin-icon/167967 "2019-03-14T16:36:12Z")

</div>

Kibana version: 6.6.0 Elasticsearch version: 6.6.0 Server OS version: Ubuntu 18 Browser version: Chrome 71 Browser OS version: Ubuntu 18 Original install method (e.g. download page, yum, from source, etc.): ki…

---

## [Pipeline - grok - truncating at "\\n" in \[multiline\] message from filebeat](https://discuss.elastic.co/t/pipeline-grok-truncating-at-n-in-multiline-message-from-filebeat/211800)

<div class="topic-metadata">

**Author:** [@nigel.piggott](https://discuss.elastic.co/u/nigel.piggott)\
**Replies:** 6\
**Last updated:** [January 6, 2020, 8:47am UTC](https://discuss.elastic.co/t/pipeline-grok-truncating-at-n-in-multiline-message-from-filebeat/211800 "2020-01-06T08:47:39Z")

</div>

Filebeat is configured to correctly process a mutline file Using the ingest pipeline the grok processor extracts fields from the "message" However it is truncating the message when the message contains the regex "\\n" …

---

## [Smtp authentication error](https://discuss.elastic.co/t/smtp-authentication-error/79647)

<div class="topic-metadata">

**Author:** [@August\_rush](https://discuss.elastic.co/u/August_rush)\
**Replies:** 6\
**Last updated:** [March 23, 2017, 6:05pm UTC](https://discuss.elastic.co/t/smtp-authentication-error/79647 "2017-03-23T18:05:47Z")

</div>

I am trying to send emails email { port =\> 587 address =\> "smtp.gmail.com" username =\> "@gmail.com" password =\> "" authentication =\> "plain" use\_tls =\> true from =\> "@gmail.com" subject =\> "logstash alert" to =\>…

---

## [ERROR: Invalid Host Header Requests](https://discuss.elastic.co/t/error-invalid-host-header-requests/328885)

<div class="topic-metadata">

**Author:** [@irfancankaleli](https://discuss.elastic.co/u/irfancankaleli)\
**Replies:** 7\
**Last updated:** [March 30, 2023, 7:31am UTC](https://discuss.elastic.co/t/error-invalid-host-header-requests/328885 "2023-03-30T07:31:22Z")

</div>

We are running Elasticsearch v6.8.0 on AWS OpenSearch Service, through VPN, and we use following elasticsearch client in our NodeJS server: elasticsearch - npm Our client version is v16.7.2. When I check the metrics on…

---

## [Some install bugs - probably there is solution, not yet found by me](https://discuss.elastic.co/t/some-install-bugs-probably-there-is-solution-not-yet-found-by-me/21970)

<div class="topic-metadata">

**Author:** [@Peter\_Takac](https://discuss.elastic.co/u/Peter_Takac)\
**Replies:** 7\
**Last updated:** [February 25, 2015, 9:53pm UTC](https://discuss.elastic.co/t/some-install-bugs-probably-there-is-solution-not-yet-found-by-me/21970 "2015-02-25T21:53:14Z")

</div>

Hi, I have tested instalation of elastic search on SLES 11SP3 x64 and also on DEBIAN 7.8 x64. But have some issues: \*SLES 11SP3\* 1. After installation ( from rpm or tgz ) the service/daemon is not created in co…

---

## [Kibana did not load properly](https://discuss.elastic.co/t/kibana-did-not-load-properly/64867)

<div class="topic-metadata">

**Author:** [@oezm](https://discuss.elastic.co/u/oezm)\
**Replies:** 0\
**Last updated:** [November 3, 2016, 1:13pm UTC](https://discuss.elastic.co/t/kibana-did-not-load-properly/64867 "2016-11-03T13:13:53Z")

</div>

Here's the full message: Kibana did not load properly. Check the server output for more information. I'm using Kibana 5.0.0 on a Debian machine with Elasticsearch 5.0.0. Elasticsearch is running fine on localhost:920…

---

## [Searching local files/folders to test elastic search](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531)

<div class="topic-metadata">

**Author:** [@robo20](https://discuss.elastic.co/u/robo20)\
**Replies:** 4\
**Last updated:** [December 15, 2020, 4:36am UTC](https://discuss.elastic.co/t/searching-local-files-folders-to-test-elastic-search/258531 "2020-12-15T04:36:55Z")

</div>

Is there a simple way to do full text search on a bunch of files in various formats (e.g. PDF, EPUB, TXT, DOC) - on locally connected storage? I see the connectors for the cloud services, I just want to do local search. …

---

## [Get List of indices using Java Rest API](https://discuss.elastic.co/t/get-list-of-indices-using-java-rest-api/70004)

<div class="topic-metadata">

**Author:** [@kumarroopesh](https://discuss.elastic.co/u/kumarroopesh)\
**Replies:** 4\
**Last updated:** [December 28, 2016, 6:38am UTC](https://discuss.elastic.co/t/get-list-of-indices-using-java-rest-api/70004 "2016-12-28T06:38:06Z")

</div>

Hi, I am using Java REST APIs 5.1.1 for elasticsearch. I need to get the list of indexes on successful connection to elasticsearch using host, port, username, password. I am not able to get a list of available indexes. …

---

## [Java Api for UpdateByQuery requests](https://discuss.elastic.co/t/java-api-for-updatebyquery-requests/60820)

<div class="topic-metadata">

**Author:** [@mdcoon](https://discuss.elastic.co/u/mdcoon)\
**Replies:** 4\
**Last updated:** [September 19, 2016, 3:11am UTC](https://discuss.elastic.co/t/java-api-for-updatebyquery-requests/60820 "2016-09-19T03:11:12Z")

</div>

I've written a groovy script and tested the update\_by\_query rest functionality using Sense. Everything works perfectly. Then I wanted to simply take the JSON I use in Sense and port that over just like I do with the othe…

---

## [Exception while bulk indexing](https://discuss.elastic.co/t/exception-while-bulk-indexing/28685)

<div class="topic-metadata">

**Author:** [@Ramky](https://discuss.elastic.co/u/Ramky)\
**Replies:** 5\
**Last updated:** [September 7, 2015, 5:50am UTC](https://discuss.elastic.co/t/exception-while-bulk-indexing/28685 "2015-09-07T05:50:45Z")

</div>

I am getting following exception while bulk indexing data with ElasticSearch v1.7.1 \[2015-09-01 07:53:51,172\]\[DEBUG\]\[action.search.type \] Machine1\] \[Index14\_2015-06-25\]\[2\], node\[G5T2VzgkQNqFvIzPlC-5ow\], \[R\], s\[ST…

---

## [Using wildcard and fuzziness in Elasticsearch](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822)

<div class="topic-metadata">

**Author:** [@jpllana](https://discuss.elastic.co/u/jpllana)\
**Replies:** 3\
**Last updated:** [October 22, 2021, 11:41am UTC](https://discuss.elastic.co/t/using-wildcard-and-fuzziness-in-elasticsearch/286822 "2021-10-22T11:41:42Z")

</div>

I have a query to search for an address where I am using also the wildcard. So if I am searching for Kennedy using the query below, I have these addresses: Query: GET my\_index/\_search { "query": { "query\_string":…

---

## [Elastic Endpoint 8.1.1 - Memory usage crashing services](https://discuss.elastic.co/t/elastic-endpoint-8-1-1-memory-usage-crashing-services/301274)

<div class="topic-metadata">

**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Replies:** 1\
**Last updated:** [April 6, 2022, 3:41pm UTC](https://discuss.elastic.co/t/elastic-endpoint-8-1-1-memory-usage-crashing-services/301274 "2022-04-06T15:41:28Z")

</div>

Well the locking issue is gone but the memory usage has started to climb from the generally 512Mb usage. At one point it took 100% memory and crashed services on several servers causing downtime and lost revenue. 7.17 …

---

## [Disk threshold](https://discuss.elastic.co/t/disk-threshold/271414)

<div class="topic-metadata">

**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\
**Replies:** 6\
**Last updated:** [May 3, 2021, 5:57pm UTC](https://discuss.elastic.co/t/disk-threshold/271414 "2021-05-03T17:57:35Z")

</div>

We are trying to implement single node cluster of Elasticsearch per installation of our application. Our application is on-prem. I was looking at the indexing data location parameters in the Elastic documentation. I came…

---

## [Failed to parse field \[coordinates\] of type \[geo\_shape\]](https://discuss.elastic.co/t/failed-to-parse-field-coordinates-of-type-geo-shape/251305)

<div class="topic-metadata">

**Author:** [@davidb1](https://discuss.elastic.co/u/davidb1)\
**Replies:** 6\
**Last updated:** [October 13, 2020, 7:36am UTC](https://discuss.elastic.co/t/failed-to-parse-field-coordinates-of-type-geo-shape/251305 "2020-10-13T07:36:02Z")

</div>

I'm using Kibana to upload a geojson to Elasticsearch. It loads and shows up without problems but when I try to index it I get: { "success": true, "failures": \[ { "item": 0, "reason": "failed to pars…

---

## [ElasticSearch 5.1.1 on Ubuntu 16.04, fails when started with \`network.host\` set to 0.0.0.0](https://discuss.elastic.co/t/elasticsearch-5-1-1-on-ubuntu-16-04-fails-when-started-with-network-host-set-to-0-0-0-0/70558)

<div class="topic-metadata">

**Author:** [@tomekit](https://discuss.elastic.co/u/tomekit)\
**Replies:** 4\
**Last updated:** [January 10, 2017, 12:37pm UTC](https://discuss.elastic.co/t/elasticsearch-5-1-1-on-ubuntu-16-04-fails-when-started-with-network-host-set-to-0-0-0-0/70558 "2017-01-10T12:37:00Z")

</div>

I am running ES 5.1.1 on Ubuntu 16.04, kernel: 4.4.0-53-generic JVM Version: 5.1.1, Build: 5395e21/2016-12-06T12:36:15.409Z, JVM: 1.8.0\_111 When used (in /etc/elasticsearch/elasticsearch.yml): network.host: "0.0.0.0" o…

---

## [Logstash NGINX Generic and NAXSI Error pattern parse failure](https://discuss.elastic.co/t/logstash-nginx-generic-and-naxsi-error-pattern-parse-failure/49278)

<div class="topic-metadata">

**Author:** [@reinier](https://discuss.elastic.co/u/reinier)\
**Replies:** 2\
**Last updated:** [May 7, 2016, 12:07pm UTC](https://discuss.elastic.co/t/logstash-nginx-generic-and-naxsi-error-pattern-parse-failure/49278 "2016-05-07T12:07:06Z")

</div>

Hi All, We are using NGINX in combination with NAXSI and just started using Logstash inside an ELK Stack. When NAXSI blocks a specific request it logs this in the NGINX error log. These logs are shipped using Filebeat …

---

## [Is the Confluence Cloud documentation correct?](https://discuss.elastic.co/t/is-the-confluence-cloud-documentation-correct/208547)

<div class="topic-metadata">

**Author:** [@jporter](https://discuss.elastic.co/u/jporter)\
**Replies:** 0\
**Last updated:** [November 19, 2019, 4:47pm UTC](https://discuss.elastic.co/t/is-the-confluence-cloud-documentation-correct/208547 "2019-11-19T16:47:53Z")

</div>

I was following the documentation here Everything goes as described until I click 'add' on the section Click \*\*Add\*\* under the Confluence source. First, you'll need to click \*\*I understand\*\* . Why the hurdle? We want …

---

## [No matching token for number\_type \[BIG\_INTEGER\] on update](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer-on-update/60634)

<div class="topic-metadata">

**Author:** [@afaraone](https://discuss.elastic.co/u/afaraone)\
**Replies:** 0\
**Last updated:** [September 15, 2016, 4:49pm UTC](https://discuss.elastic.co/t/no-matching-token-for-number-type-big-integer-on-update/60634 "2016-09-15T16:49:26Z")

</div>

I've run into an issue with a bulk update that i'm doing. I have a string field that for some records stores a long string of integers. Based on other similar threads (https://discuss.elastic.co/t/no-matching-token-f…

---

## [Could not execute action: PipelineAction::Create\<main\> after xpack.security enabled](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861)

<div class="topic-metadata">

**Author:** [@ASA01](https://discuss.elastic.co/u/ASA01)\
**Replies:** 5\
**Last updated:** [November 2, 2020, 3:06am UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main-after-xpack-security-enabled/253861 "2020-11-02T03:06:12Z")

</div>

Logstash works fine for me until I enable xpack security in elasticsearch.yml. When I do I get the following error from any conf that creates indices. \[ERROR\] 2020-10-30 15:52:06.741 \[Converge PipelineAction::Create\] a…

---

## [Repository verification exception when trying to create snapshot](https://discuss.elastic.co/t/repository-verification-exception-when-trying-to-create-snapshot/225125)

<div class="topic-metadata">

**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\
**Replies:** 5\
**Last updated:** [April 27, 2020, 8:54pm UTC](https://discuss.elastic.co/t/repository-verification-exception-when-trying-to-create-snapshot/225125 "2020-04-27T20:54:30Z")

</div>

version: 7.6.1 We are using the latest version of elasticsearch in kubernetes and the cluster is not able to verify the snapshot repository. As you can see, I'm able to upload files to the bucket and I was also able to…

---

## [Document-level metadata](https://discuss.elastic.co/t/document-level-metadata/113183)

<div class="topic-metadata">

**Author:** [@val](https://discuss.elastic.co/u/val)\
**Replies:** 5\
**Last updated:** [January 2, 2018, 12:54pm UTC](https://discuss.elastic.co/t/document-level-metadata/113183 "2018-01-02T12:54:42Z")

</div>

The \_meta field makes it possible to attach custom metadata at the mapping type level. I've come through a few use cases recently (see genesis here) where it'd be handy to have a \_meta field at the document level, too, i…

---

## [Danish special chars (Æ, Ø, Å) are seen as æ==a/ae, ø == o, å == a](https://discuss.elastic.co/t/danish-special-chars-ae-o-a-are-seen-as-ae-a-ae-o-o-a-a/105219)

<div class="topic-metadata">

**Author:** [@smhoeks](https://discuss.elastic.co/u/smhoeks)\
**Replies:** 5\
**Last updated:** [October 27, 2017, 11:47am UTC](https://discuss.elastic.co/t/danish-special-chars-ae-o-a-are-seen-as-ae-a-ae-o-o-a-a/105219 "2017-10-27T11:47:15Z")

</div>

Hi All :slight\_smile: I'm facing a problem with my elastic search for Magento 2 (Wyomind) In general, it seems the danish special characters Æ, Ø and Å are translated to: Æ: A /Ae Ø: O Å: A This causes the search n…

---

## [Logstash "input" performance?](https://discuss.elastic.co/t/logstash-input-performance/31830)

<div class="topic-metadata">

**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\
**Replies:** 8\
**Last updated:** [October 12, 2015, 10:48pm UTC](https://discuss.elastic.co/t/logstash-input-performance/31830 "2015-10-12T22:48:36Z")

</div>

Hi, we have one logstash instance that is monitoring several application log folders (about 10 folders). The configuration looks like: input { file { codec =\> json { charset =\> "UTF-8" …

---

## [Monitoring changes to application property files](https://discuss.elastic.co/t/monitoring-changes-to-application-property-files/28386)

<div class="topic-metadata">

**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\
**Replies:** 8\
**Last updated:** [September 4, 2015, 4:12pm UTC](https://discuss.elastic.co/t/monitoring-changes-to-application-property-files/28386 "2015-09-04T16:12:15Z")

</div>

We have several important application property files that we would like to monitor with Logstash (app1.properties, app2.properties, etc). Ideally, whenever anything changes to one of these application property files, w…

---

## [Организация кластера](https://discuss.elastic.co/t/topic/67787)

<div class="topic-metadata">

**Author:** [@bugsel](https://discuss.elastic.co/u/bugsel)\
**Replies:** 6\
**Last updated:** [December 2, 2016, 10:29am UTC](https://discuss.elastic.co/t/topic/67787 "2016-12-02T10:29:16Z")

</div>

Добрый день. Хотел бы посоветоваться по вопросу организации кластера. Есть кластер состоящий из двух нод (два отдельных сервера: 24 и 32 GB соответственно): ip heap.percent ram.percent cpu load\_1m load\_5m load\_1…

---

## [When does geo\_shape orientation matter?](https://discuss.elastic.co/t/when-does-geo-shape-orientation-matter/25486)

<div class="topic-metadata">

**Author:** [@luke\_smoron](https://discuss.elastic.co/u/luke_smoron)\
**Replies:** 7\
**Last updated:** [November 15, 2016, 3:53am UTC](https://discuss.elastic.co/t/when-does-geo-shape-orientation-matter/25486 "2016-11-15T03:53:02Z")

</div>

I got right hand geo\_shape index. I have inserted following 2 geometries (one is right handed and other is left handed) { PRIMARY\_GEOMETRY\_JSON:{ "type" : "MultiPolygon" , "coordinates" : \[ \[ \[ \[ 55.8044 , 1.76417\] , \[ 4…

---

## [Running two different Filebeat Versions on same input](https://discuss.elastic.co/t/running-two-different-filebeat-versions-on-same-input/75641)

<div class="topic-metadata">

**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\
**Replies:** 5\
**Last updated:** [February 23, 2017, 12:52pm UTC](https://discuss.elastic.co/t/running-two-different-filebeat-versions-on-same-input/75641 "2017-02-23T12:52:38Z")

</div>

Hi, I have currently Prod using filebeat version 1.3.2, with ES Version 2.1 I am working on implementing an environment with release 5.0 Can there be any issue running on same Application Server Filebeat version 1.3.…

---

## [Cluster configuration change failed : not possible to remove node attributes](https://discuss.elastic.co/t/cluster-configuration-change-failed-not-possible-to-remove-node-attributes/186254)

<div class="topic-metadata">

**Author:** [@abdelbaki](https://discuss.elastic.co/u/abdelbaki)\
**Replies:** 2\
**Last updated:** [June 18, 2019, 2:34pm UTC](https://discuss.elastic.co/t/cluster-configuration-change-failed-not-possible-to-remove-node-attributes/186254 "2019-06-18T14:34:02Z")

</div>

I have 3 zones and my initial cluster is : data-default in 2 zones data-highstorage in 2 zones ml in 1 zone kibana 2 zones i changed the number of zones for 'ml' nodes to 2 zones instead of 1. and by doing so i need …

---

## [Painless scripting params.entrySet()?](https://discuss.elastic.co/t/painless-scripting-params-entryset/143306)

<div class="topic-metadata">

**Author:** [@panthersquirrel](https://discuss.elastic.co/u/panthersquirrel)\
**Replies:** 2\
**Last updated:** [August 7, 2018, 10:02pm UTC](https://discuss.elastic.co/t/painless-scripting-params-entryset/143306 "2018-08-07T22:02:46Z")

</div>

If I have a document like this: POST random/\_doc/1 { "id": 1 } and i want to do: POST random/\_doc/1/\_update { "script": { "source": " for (entry in params.entrySet()) { ctx.\_source\[entry.getKey…

---

## [Netflow module and \*.conf file](https://discuss.elastic.co/t/netflow-module-and-conf-file/125246)

<div class="topic-metadata">

**Author:** [@ggdagg](https://discuss.elastic.co/u/ggdagg)\
**Replies:** 2\
**Last updated:** [March 23, 2018, 4:57pm UTC](https://discuss.elastic.co/t/netflow-module-and-conf-file/125246 "2018-03-23T16:57:58Z")

</div>

Hi, I set up the Netflow module for Logstash and it works well. In my Logstash config (in /etc/logstash/logstash.yml), I added: modules: - name: netflow var.input.udp.port: 2055 var.kibana.host: "mykibanahost.com:56…

---

## [Hide Kibana management tab for some users](https://discuss.elastic.co/t/hide-kibana-management-tab-for-some-users/202687)

<div class="topic-metadata">

**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\
**Replies:** 4\
**Last updated:** [October 9, 2019, 8:29am UTC](https://discuss.elastic.co/t/hide-kibana-management-tab-for-some-users/202687 "2019-10-09T08:29:22Z")

</div>

Hi, Can any one please let me know, how to disable/hide the kibana Management tab for some users,i used the predefined role and it works but the kibana\_dashboard\_only\_user shows all the available spaces and i want to sh…

---

## [How to remove some unnecessary parts if filebeat's output is file](https://discuss.elastic.co/t/how-to-remove-some-unnecessary-parts-if-filebeats-output-is-file/85905)

<div class="topic-metadata">

**Author:** [@tang](https://discuss.elastic.co/u/tang)\
**Replies:** 4\
**Last updated:** [May 17, 2017, 12:32pm UTC](https://discuss.elastic.co/t/how-to-remove-some-unnecessary-parts-if-filebeats-output-is-file/85905 "2017-05-17T12:32:34Z")

</div>

use filebeat to send stderr or stdout to file. but file has some unnecessary parts, such as "@timestamp", "beat", "fields" and so on. All I need just is message part. How can I remove unnecessary parts in file? use fil…

---

## [Output to elasticsearch gives errors but works with stdout](https://discuss.elastic.co/t/output-to-elasticsearch-gives-errors-but-works-with-stdout/54530)

<div class="topic-metadata">

**Author:** [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\
**Replies:** 8\
**Last updated:** [July 4, 2016, 1:53pm UTC](https://discuss.elastic.co/t/output-to-elasticsearch-gives-errors-but-works-with-stdout/54530 "2016-07-04T13:53:27Z")

</div>

I think the error could be related to the ruby code, how do I fix this ? Config: input { beats { port =\> 5044 ssl =\> false } } filter { if \[type\] == "apache" { ruby { code =\> " if event\['message'\] event\[…

---

## [Resource metricbeat-7.17.1 exists, but it is not an alias](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030)

<div class="topic-metadata">

**Author:** [@Evgeny\_Barykin](https://discuss.elastic.co/u/Evgeny_Barykin)\
**Replies:** 6\
**Last updated:** [June 2, 2022, 7:49am UTC](https://discuss.elastic.co/t/resource-metricbeat-7-17-1-exists-but-it-is-not-an-alias/306030 "2022-06-02T07:49:12Z")

</div>

Hello! I have an issue with connecting second cluster to Elasticsearch. I changed dynamic mappings and added best\_compression to the settings, but now I get an error every time I try to connect new beats to it. If I le…

---

## [Default Install Configuration](https://discuss.elastic.co/t/default-install-configuration/71934)

<div class="topic-metadata">

**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Replies:** 6\
**Last updated:** [January 18, 2017, 5:06am UTC](https://discuss.elastic.co/t/default-install-configuration/71934 "2017-01-18T05:06:18Z")

</div>

I am in the process of rebuilding my ELK stack instances in all my office locations (28 locations). So tonight, after installing Ubuntu 16.04 on each server and patching, I start the install process for Elasticsearch. A…

---

## [Save results from aggregation to new index?](https://discuss.elastic.co/t/save-results-from-aggregation-to-new-index/86913)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 1\
**Last updated:** [May 24, 2017, 8:42am UTC](https://discuss.elastic.co/t/save-results-from-aggregation-to-new-index/86913 "2017-05-24T08:42:34Z")

</div>

Hi, we have a log with some million events per day. We have a data retention time of 30 days. Allthough we keep data accessible only for 30 days, we have the need to compare some aggregations from current month and …

---

## [Terms with fuzzy operator don't use mapping analyzer, but always standard analyzer](https://discuss.elastic.co/t/terms-with-fuzzy-operator-dont-use-mapping-analyzer-but-always-standard-analyzer/68593)

<div class="topic-metadata">

**Author:** [@fbaligand](https://discuss.elastic.co/u/fbaligand)\
**Replies:** 5\
**Last updated:** [December 13, 2016, 10:25pm UTC](https://discuss.elastic.co/t/terms-with-fuzzy-operator-dont-use-mapping-analyzer-but-always-standard-analyzer/68593 "2016-12-13T22:25:43Z")

</div>

Hi, fuzzy operator is a really powerful feature for full-text search. But I have a problem : When I do a fuzzy search (ex: accenTTué~1), I see that analyzer used is standard analyzer (which has only a lowercase filt…

---

## [Unknown error message while opening Monitoring](https://discuss.elastic.co/t/unknown-error-message-while-opening-monitoring/55693)

<div class="topic-metadata">

**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\
**Replies:** 7\
**Last updated:** [August 7, 2016, 11:07am UTC](https://discuss.elastic.co/t/unknown-error-message-while-opening-monitoring/55693 "2016-08-07T11:07:37Z")

</div>

Upon opening Monitoring tab in Kibana, getting following error:- Monitoring: Error 400 Bad Request: \[parse\_exception\] Failed to derive xcontent The error doesn't describe what went wrong and instead gives an error wh…

---

## [Plugin install via proxy still broken ? ver 5.4.2](https://discuss.elastic.co/t/plugin-install-via-proxy-still-broken-ver-5-4-2/90679)

<div class="topic-metadata">

**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\
**Replies:** 0\
**Last updated:** [June 23, 2017, 7:22pm UTC](https://discuss.elastic.co/t/plugin-install-via-proxy-still-broken-ver-5-4-2/90679 "2017-06-23T19:22:32Z")

</div>

Is plugin installation behind proxies still broken in LS 5.4.2 ? This is what I'm getting; (anonymised) export http\_proxy=http://myname:mypass@x.x.x.x:3128 export https\_proxy=http://myname:mypass@x.x.x.x:3128 export '…

---

## [How to show a truncated field value in Kibana Visualization?](https://discuss.elastic.co/t/how-to-show-a-truncated-field-value-in-kibana-visualization/121828)

<div class="topic-metadata">

**Author:** [@vinay.bhardwaj](https://discuss.elastic.co/u/vinay.bhardwaj)\
**Replies:** 3\
**Last updated:** [February 28, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-to-show-a-truncated-field-value-in-kibana-visualization/121828 "2018-02-28T10:54:46Z")

</div>

How can I show a sub string of a field value in Kibana Visualization axis label?

---

## [Setting up environment variables in Windows10](https://discuss.elastic.co/t/setting-up-environment-variables-in-windows10/215456)

<div class="topic-metadata">

**Author:** [@Elja\_Suhonen](https://discuss.elastic.co/u/Elja_Suhonen)\
**Replies:** 2\
**Last updated:** [February 6, 2020, 2:09am UTC](https://discuss.elastic.co/t/setting-up-environment-variables-in-windows10/215456 "2020-02-06T02:09:18Z")

</div>

my problem is in setting up environment variables once setting up Elasticsearch environment variables for local use. The instructions I follow can be found from: https://www.elastic.co/guide/en/elasticsearch/reference/cu…

---

## [Installing X-pack plugin for kibana 6.1.0 taking ~20min](https://discuss.elastic.co/t/installing-x-pack-plugin-for-kibana-6-1-0-taking-20min/112210)

<div class="topic-metadata">

**Author:** [@sadok-f](https://discuss.elastic.co/u/sadok-f)\
**Replies:** 6\
**Last updated:** [December 23, 2017, 8:09am UTC](https://discuss.elastic.co/t/installing-x-pack-plugin-for-kibana-6-1-0-taking-20min/112210 "2017-12-23T08:09:34Z")

</div>

Hi there, I already posted this issue in X-pack room: X-pack not installed for Kibana 6.1.0 The latest version of x-pack for kibana (6.1.0) is double the size comparing to the previous one (~250Mb) and during the insta…

---

## [Elasticsearch mapping \_parsing\_exception](https://discuss.elastic.co/t/elasticsearch-mapping-parsing-exception/196561)

<div class="topic-metadata">

**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\
**Replies:** 8\
**Last updated:** [August 26, 2019, 5:25am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-parsing-exception/196561 "2019-08-26T05:25:36Z")

</div>

Hi, I'm using ELasticsearch as docker . I havent created mapping indexes there . I'm getting following exception org.apache.spark.SparkException: Job aborted due to stage failure: Task 43 in stage 516846.0 failed 4 ti…

---

## [Search api not returning the results](https://discuss.elastic.co/t/search-api-not-returning-the-results/263556)

<div class="topic-metadata">

**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\
**Replies:** 5\
**Last updated:** [February 9, 2021, 6:47am UTC](https://discuss.elastic.co/t/search-api-not-returning-the-results/263556 "2021-02-09T06:47:52Z")

</div>

Hi, I want to get the logs from all the indices in elasticsearch for which I am using following search API. https://localhost:9200/\_search?pretty=true Output: { "took": 28, "timed\_out": false, "\_shards…

---

## [Pipeline processor with IF condition](https://discuss.elastic.co/t/pipeline-processor-with-if-condition/238618)

<div class="topic-metadata">

**Author:** [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\
**Replies:** 5\
**Last updated:** [June 26, 2020, 8:06am UTC](https://discuss.elastic.co/t/pipeline-processor-with-if-condition/238618 "2020-06-26T08:06:37Z")

</div>

Hi Team, We want to use Conditional pipeline processor on basis of operationName in below JSON data IF "operationName": "/searchRIBCustomerInMDM | request/response", then pipeline should execute . { "\_index": "j…

---

## [\[Solved\] Issuing error with "elasticsearch-setup-passwords auto" command](https://discuss.elastic.co/t/solved-issuing-error-with-elasticsearch-setup-passwords-auto-command/184544)

<div class="topic-metadata">

**Author:** [@Hyrastios](https://discuss.elastic.co/u/Hyrastios)\
**Replies:** 5\
**Last updated:** [June 7, 2019, 8:36am UTC](https://discuss.elastic.co/t/solved-issuing-error-with-elasticsearch-setup-passwords-auto-command/184544 "2019-06-07T08:36:25Z")

</div>

Hi, I'm trying to set up native authentification feature on my local ELK 7.1 installation. Yesterday, I asked here if it was possible to use it with a basic license and the answer was : yes since 6.8 version. So in th…

[Previous page](https://discuss.elastic.co/top.md?page=634&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=636&per_page=50&period=all)
