# Top **URL:** https://discuss.elastic.co/top.md?page=645&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 646 --- ## [Send ERROR logs by email - SMTP appender](https://discuss.elastic.co/t/send-error-logs-by-email-smtp-appender/29387)
**Author:** [@Emanuel\_Buzek](https://discuss.elastic.co/u/Emanuel_Buzek)\ **Replies:** 1\ **Last updated:** [September 16, 2015, 1:16pm UTC](https://discuss.elastic.co/t/send-error-logs-by-email-smtp-appender/29387 "2015-09-16T13:16:32Z")
Hi everyone, it looks like multiple ES users have asked this question, but I cannot find any working solution online. I am trying to configure a SMTP log4j appender in my logging.yml to send ERROR logs by email. My log… --- ## [Howto use buckets\_path for percentiles metric aggregation?](https://discuss.elastic.co/t/howto-use-buckets-path-for-percentiles-metric-aggregation/37985)
**Author:** [@chenryn](https://discuss.elastic.co/u/chenryn)\ **Replies:** 0\ **Last updated:** [December 26, 2015, 3:23pm UTC](https://discuss.elastic.co/t/howto-use-buckets-path-for-percentiles-metric-aggregation/37985 "2015-12-26T15:23:12Z")
Percentiles metric aggregtaion returns a multi-value result. And I know I can write buckets\_path for multi-value like bucketsname.metricname. But, the key of percentiles metric agg result is named like 50.0, 90.0, thos… --- ## [Suddenly unable to import parsed logs from logstash into elasticsearch](https://discuss.elastic.co/t/suddenly-unable-to-import-parsed-logs-from-logstash-into-elasticsearch/166439)
**Author:** [@cheem](https://discuss.elastic.co/u/cheem)\ **Replies:** 8\ **Last updated:** [February 4, 2019, 11:12pm UTC](https://discuss.elastic.co/t/suddenly-unable-to-import-parsed-logs-from-logstash-into-elasticsearch/166439 "2019-02-04T23:12:15Z")
About a day ago by now, my elasticsearch stack stopped accepting parsed nginx logs. Logstash and Elasticsearch are 6.5.4. Here are the filters for these logs: grok { match =\> {"message" =\> "%{IP:remote\_ip}?,?\\… --- ## [Logstash trying to connect to 127.0.0.1:9200 which is not there](https://discuss.elastic.co/t/logstash-trying-to-connect-to-127-0-0-1-9200-which-is-not-there/150089)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [September 27, 2018, 2:09pm UTC](https://discuss.elastic.co/t/logstash-trying-to-connect-to-127-0-0-1-9200-which-is-not-there/150089 "2018-09-27T14:09:13Z")
After setting up everything. suddenly logstash just keep trying to connect to 127.0.0.1 my ES is running on IP address \[2018-09-26T16:09:48,981\]\[INFO \]\[logstash.pipeline \] Starting pipeline {:pipeline\_id=\>"main"… --- ## [Parent and child fields in single document](https://discuss.elastic.co/t/parent-and-child-fields-in-single-document/219976)
**Author:** [@sunilmpatil](https://discuss.elastic.co/u/sunilmpatil)\ **Replies:** 7\ **Last updated:** [February 26, 2020, 9:20am UTC](https://discuss.elastic.co/t/parent-and-child-fields-in-single-document/219976 "2020-02-26T09:20:02Z")
Hi, I am planning to map a relational table which has parent and child relationship into Elastic index. SQL table Structure: pk\_id | parent\_id | child\_id | 100 | 1 | 2 | 101 | 2 … --- ## [Packetbeat on windows](https://discuss.elastic.co/t/packetbeat-on-windows/86346)
**Author:** [@Harinagarajan](https://discuss.elastic.co/u/Harinagarajan)\ **Replies:** 7\ **Last updated:** [June 7, 2017, 10:14am UTC](https://discuss.elastic.co/t/packetbeat-on-windows/86346 "2017-06-07T10:14:59Z")
Dears, I am using windows 10 os, I have configured Elasicsearch, kibana and packebeat as per standard I have installed pcapng too In powershell after execute the .\\packetbeat.exe -devices command 0: \\Device\\NPF\_{5… --- ## [Error when using separate config files](https://discuss.elastic.co/t/error-when-using-separate-config-files/82874)
**Author:** [@dreadlocked1](https://discuss.elastic.co/u/dreadlocked1)\ **Replies:** 1\ **Last updated:** [April 20, 2017, 5:16am UTC](https://discuss.elastic.co/t/error-when-using-separate-config-files/82874 "2017-04-20T05:16:01Z")
Hi, I'm using the following command line to execute logstash with multiple config files: $ /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/{1\_inputs.conf,2\_filters.conf,3\_outputs.conf} --path.settings /etc/logs… --- ## [Struggling to specify field types](https://discuss.elastic.co/t/struggling-to-specify-field-types/34964)
**Author:** [@Grenage](https://discuss.elastic.co/u/Grenage)\ **Replies:** 4\ **Last updated:** [November 19, 2015, 11:50am UTC](https://discuss.elastic.co/t/struggling-to-specify-field-types/34964 "2015-11-19T11:50:05Z")
Hi everyone, I've got a box running Kibana and Elasticsearch, with the information being handed across by fluentd rather than logstash. In hindsight I'd have picked Logstash, but the guide at the time covered fluentd.… --- ## [Shards Failure - Kibana Dashboard](https://discuss.elastic.co/t/shards-failure-kibana-dashboard/318287)
**Author:** [@balaa](https://discuss.elastic.co/u/balaa)\ **Replies:** 5\ **Last updated:** [December 4, 2022, 9:06pm UTC](https://discuss.elastic.co/t/shards-failure-kibana-dashboard/318287 "2022-12-04T21:06:29Z")
Hi Team, We are are using ELK 7.16.3 version and when ever the timeframe is more than 30 days i am getting the shards failure in my dashboard. node\_disconnected\_exception at shard 0 index sd-daily-20220422-00105-000… --- ## [Graph by Value](https://discuss.elastic.co/t/graph-by-value/26537)
**Author:** [@camarasingham](https://discuss.elastic.co/u/camarasingham)\ **Replies:** 1\ **Last updated:** [July 30, 2015, 2:08pm UTC](https://discuss.elastic.co/t/graph-by-value/26537 "2015-07-30T14:08:06Z")
I am trying to get a graph of a field value over time in Kibana, but can't get it. I can graph hits or number of docs per time interval but not the value itself it seems. The field value is of type long. I have noti… --- ## [Help with hour of day in the date field's timezone](https://discuss.elastic.co/t/help-with-hour-of-day-in-the-date-fields-timezone/147874)
**Author:** [@veqryn](https://discuss.elastic.co/u/veqryn)\ **Replies:** 6\ **Last updated:** [September 14, 2018, 5:31pm UTC](https://discuss.elastic.co/t/help-with-hour-of-day-in-the-date-fields-timezone/147874 "2018-09-14T17:31:50Z")
I originally posted this over on github, where I was told this behavior was not a bug and was encouraged to seek help here instead. I am using AWS ElasticSearch Service, version 6.2. I am trying to get the hour of the … --- ## [Kernel Update on Ubuntu 17.10 causes Elasticsearch to panic](https://discuss.elastic.co/t/kernel-update-on-ubuntu-17-10-causes-elasticsearch-to-panic/116865)
**Author:** [@Dominik\_Stadler](https://discuss.elastic.co/u/Dominik_Stadler)\ **Replies:** 6\ **Last updated:** [January 25, 2018, 3:24am UTC](https://discuss.elastic.co/t/kernel-update-on-ubuntu-17-10-causes-elasticsearch-to-panic/116865 "2018-01-25T03:24:30Z")
Hi, anybody else seeing this? When we run Elasticsearch 5.3.3 on Ubuntu 17.10 after the most recent kernel update from 4.13.0-25-generic to 4.13.0-31-generic we see kernel oopses, any remedy except downgrading the kerne… --- ## [Field name duplicate with file conf and json doc](https://discuss.elastic.co/t/field-name-duplicate-with-file-conf-and-json-doc/34295)
**Author:** [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Replies:** 6\ **Last updated:** [November 11, 2015, 1:08pm UTC](https://discuss.elastic.co/t/field-name-duplicate-with-file-conf-and-json-doc/34295 "2015-11-11T13:08:23Z")
Hello. I'm new to logstash and using logstash 1.5.2, elasticsearch 1.7.x And have logstash configuration like... 1 input { 2 file { 3 path =\> "/home1/.logstash/json\_input/deco.json.\*" 4 … --- ## [Elasticsearch aggregations, counting nested objects](https://discuss.elastic.co/t/elasticsearch-aggregations-counting-nested-objects/133002)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 2\ **Last updated:** [May 23, 2018, 11:13pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregations-counting-nested-objects/133002 "2018-05-23T23:13:34Z")
I have an index with nested objects and am trying to derive some statistics about the data, but am having trouble doing so. The documents look like this simplified version: { "rn": 1, "t": "X", "a": \[ { "r… --- ## [Facing problem to create curator.yml file?](https://discuss.elastic.co/t/facing-problem-to-create-curator-yml-file/142067)
**Author:** [@letty12](https://discuss.elastic.co/u/letty12)\ **Replies:** 4\ **Last updated:** [July 30, 2018, 10:58am UTC](https://discuss.elastic.co/t/facing-problem-to-create-curator-yml-file/142067 "2018-07-30T10:58:39Z")
Hi, I've recently install curator on my server and i want to create curator config file and action file but i'm little bit confused about the path, where should i create both the file because in the documentation it's s… --- ## [Integrating Logstash with websphere running in AIX](https://discuss.elastic.co/t/integrating-logstash-with-websphere-running-in-aix/58972)
**Author:** [@Hari1](https://discuss.elastic.co/u/Hari1)\ **Replies:** 4\ **Last updated:** [August 30, 2016, 4:06pm UTC](https://discuss.elastic.co/t/integrating-logstash-with-websphere-running-in-aix/58972 "2016-08-30T16:06:21Z")
I have a websphere application server running in a AIX machine, and all the log file are configured to fall under (usual) path /opt/..... /Appserver/logs/SystemOut.log.... Now I have successfully installed ELK in one of … --- ## [String manipulation in painless script](https://discuss.elastic.co/t/string-manipulation-in-painless-script/65239)
**Author:** [@ahmmum](https://discuss.elastic.co/u/ahmmum)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 4:46pm UTC](https://discuss.elastic.co/t/string-manipulation-in-painless-script/65239 "2016-11-07T16:46:46Z")
I need to compute some scores using query string and title of a document, which are not exposed by elasticsearch. I need to split a string to a list as follows: 'applie pie' --\> \['apple', 'pie'\] . I am using custom scrip… --- ## [Unable to read headers from HTTP requests](https://discuss.elastic.co/t/unable-to-read-headers-from-http-requests/53365)
**Author:** [@rmartin](https://discuss.elastic.co/u/rmartin)\ **Replies:** 7\ **Last updated:** [June 29, 2016, 8:03pm UTC](https://discuss.elastic.co/t/unable-to-read-headers-from-http-requests/53365 "2016-06-29T20:03:52Z")
Hello, I've come across a problem when writing a custom authentication Shield module in that headers do not seem to be accessible from the plugin. Here's what I've got: In the CustomRealm itself, I've got a method li… --- ## [Tcp over SSL error message](https://discuss.elastic.co/t/tcp-over-ssl-error-message/43303)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 7\ **Last updated:** [March 15, 2016, 2:29pm UTC](https://discuss.elastic.co/t/tcp-over-ssl-error-message/43303 "2016-03-15T14:29:25Z")
I'm attempting to receive syslog events that are being sent over SSL/TLS. I'm using the post at https://groups.google.com/forum/#!topic/logstash-users/PcR0it4wiK0 as an example. input{ tcp{ port =\> 7007 … --- ## [Cannot connect to elasticsearch via java api](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-via-java-api/10795)
**Author:** [@Ulli](https://discuss.elastic.co/u/Ulli)\ **Replies:** 7\ **Last updated:** [February 20, 2013, 2:36pm UTC](https://discuss.elastic.co/t/cannot-connect-to-elasticsearch-via-java-api/10795 "2013-02-20T14:36:00Z")
Hi, I'm trying to connect to a runnung elasticsearch instance via java api: Settings settings = ImmutableSettings.settingsBuilder().put( "cluster.name", "elasticsearch").put( "client.trans… --- ## [Unknown setting \[xpack.notification.email\]](https://discuss.elastic.co/t/unknown-setting-xpack-notification-email/115218)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 3\ **Last updated:** [January 19, 2018, 3:40pm UTC](https://discuss.elastic.co/t/unknown-setting-xpack-notification-email/115218 "2018-01-19T15:40:22Z")
I'm trying to follow Email Action | X-Pack for the Elastic Stack \[6.1\] | Elastic and getting following error while trying to start elasticsearch: elasticsearch | \[2018-01-12T05:48:39,956\]\[WARN \]\[o.e.b.ElasticsearchUncau… --- ## [\[ERROR\]\[logstash.agent Failed to execute action {:id=\>:main...}](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main/200248)
**Author:** [@a.gavric](https://discuss.elastic.co/u/a.gavric)\ **Replies:** 1\ **Last updated:** [September 23, 2019, 6:17am UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main/200248 "2019-09-23T06:17:46Z")
Hello Everyone, i have been experiencing a problem with starting the pipeline ever since turning on SSL connection for Elasticsearch, Kibana and Logstash. My configuration is below: input { beats { port =\> 6969 } } … --- ## [Configure Kafka Output to send ByteArray](https://discuss.elastic.co/t/configure-kafka-output-to-send-bytearray/60758)
**Author:** [@fsellecchia](https://discuss.elastic.co/u/fsellecchia)\ **Replies:** 1\ **Last updated:** [September 21, 2016, 7:44pm UTC](https://discuss.elastic.co/t/configure-kafka-output-to-send-bytearray/60758 "2016-09-21T19:44:00Z")
I'm working with logstash version 2.3.4 and trying to write an Array of Bytes to kafka. For doing this, I built a filter that encodes a message in avro. All the enconding / deconding unit tests on the filter work fine. I… --- ## [Unable to get batch command to run in logstash output exec](https://discuss.elastic.co/t/unable-to-get-batch-command-to-run-in-logstash-output-exec/176949)
**Author:** [@mgolubov55](https://discuss.elastic.co/u/mgolubov55)\ **Replies:** 6\ **Last updated:** [April 16, 2019, 1:08pm UTC](https://discuss.elastic.co/t/unable-to-get-batch-command-to-run-in-logstash-output-exec/176949 "2019-04-16T13:08:40Z")
I have a batch file in .../logstash/bin that looks like this: copy c:\\LogsIndexService\\BackupXX\\IndexInitializer.log c:\\LogsIndexService I am trying to run it from a pipeline output section as follows output { exec … --- ## [Filebeat Suricata Module "module suricata is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954)
**Author:** [@Aaron\_C\_de\_Bruyn](https://discuss.elastic.co/u/Aaron_C_de_Bruyn)\ **Replies:** 4\ **Last updated:** [April 14, 2023, 2:44pm UTC](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954 "2023-04-14T14:44:50Z")
I'm running filebeat 8.6.2. I initially had it grabbing /var/log/remote.log and it worked fine. Then I enabled the suricata module and set the configuration to this (excluding the output.elasticsearch section): filebe… --- ## ["The field \[metricset.name\] must be aggregatable across all indices" and a huge rolled-up index](https://discuss.elastic.co/t/the-field-metricset-name-must-be-aggregatable-across-all-indices-and-a-huge-rolled-up-index/216319)
**Author:** [@yagodorea](https://discuss.elastic.co/u/yagodorea)\ **Replies:** 1\ **Last updated:** [January 24, 2020, 9:01pm UTC](https://discuss.elastic.co/t/the-field-metricset-name-must-be-aggregatable-across-all-indices-and-a-huge-rolled-up-index/216319 "2020-01-24T21:01:48Z")
I'm using an on-prem version of Elasticsearch in a GCP instance, and I'm having to deal with the huge amounts of data quickly accumulating into my instance's storage. Especially Metricbeat data, that is far to extensive … --- ## [Ruby syntax](https://discuss.elastic.co/t/ruby-syntax/171899)
**Author:** [@fedwe](https://discuss.elastic.co/u/fedwe)\ **Replies:** 4\ **Last updated:** [March 12, 2019, 12:48pm UTC](https://discuss.elastic.co/t/ruby-syntax/171899 "2019-03-12T12:48:34Z")
How do i write the else if in Ruby. I tried elsif but it didnt work --- ## [Denormalized Data vs. Joins](https://discuss.elastic.co/t/denormalized-data-vs-joins/181041)
**Author:** [@donnie](https://discuss.elastic.co/u/donnie)\ **Replies:** 2\ **Last updated:** [May 15, 2019, 12:51pm UTC](https://discuss.elastic.co/t/denormalized-data-vs-joins/181041 "2019-05-15T12:51:21Z")
If I have many posts that belong to a particular user, is it better to do a parent/child relationship or denormalize the data by putting the user in every post document. In my use-case, the user is regularly being updat… --- ## [Duplicate entries after grok](https://discuss.elastic.co/t/duplicate-entries-after-grok/41644)
**Author:** [@moncky](https://discuss.elastic.co/u/moncky)\ **Replies:** 2\ **Last updated:** [February 15, 2016, 12:21pm UTC](https://discuss.elastic.co/t/duplicate-entries-after-grok/41644 "2016-02-15T12:21:14Z")
We have, for reasons, a massive error file that has many different message formats in it. Im just looking to initially get the line into the server, then I should be able to split up the message field after. My config… --- ## [Why I am getting one huge metricbeat index instead of daily indices?](https://discuss.elastic.co/t/why-i-am-getting-one-huge-metricbeat-index-instead-of-daily-indices/252789)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 7\ **Last updated:** [November 6, 2020, 7:15am UTC](https://discuss.elastic.co/t/why-i-am-getting-one-huge-metricbeat-index-instead-of-daily-indices/252789 "2020-11-06T07:15:19Z")
Hi, I am using elastic stack 7.9.2. I have set up metricbeat and it is exporting to elasticsearch. I haven't modified the index name setting in metricbeat.yml and is taking the default setting index: "metricbeat-%{\[agen… --- ## [How to mutate %{\[host\]\[hostname\]} to lowercase for pipeline output](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116)
**Author:** [@Thanura\_Kannangara](https://discuss.elastic.co/u/Thanura_Kannangara)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 10:48pm UTC](https://discuss.elastic.co/t/how-to-mutate-host-hostname-to-lowercase-for-pipeline-output/190116 "2019-07-11T22:48:32Z")
I wanted to create indices with hostnames EG: logstash-\-7.2.0-2019.07.11 My output for the pipeline looks like this output { elasticsearch { ssl =\> true hosts =\> \["xxxxxxx.us-east-1.aws.… --- ## [Kibana browser compatibility issues](https://discuss.elastic.co/t/kibana-browser-compatibility-issues/17860)
**Author:** [@brian\_yoder](https://discuss.elastic.co/u/brian_yoder)\ **Replies:** 3\ **Last updated:** [July 2, 2014, 9:46pm UTC](https://discuss.elastic.co/t/kibana-browser-compatibility-issues/17860 "2014-07-02T21:46:01Z")
My first attempt at Kibana 3.1.0 was a little bumpy due to browser issues. After some reading, I performed the minimal "download, unpack, and point the browser at index.html. If both Kibana and ES are on the same mac… --- ## [PKI authentication for Kibana](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943)
**Author:** [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Replies:** 5\ **Last updated:** [October 15, 2016, 9:08pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943 "2016-10-15T21:08:30Z")
I set up PKI authentication on elasticsearch, which is working fine. Client auth is required for all http and transport access to the elasticsearch cluster from browsers, logstash, kibana and other elasticsearch nodes. … --- ## [How to update a filed with current date and time in ES5.6?](https://discuss.elastic.co/t/how-to-update-a-filed-with-current-date-and-time-in-es5-6/102532)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 1\ **Last updated:** [October 3, 2017, 9:32am UTC](https://discuss.elastic.co/t/how-to-update-a-filed-with-current-date-and-time-in-es5-6/102532 "2017-10-03T09:32:52Z")
Hi Experts, I want to update my existing field with current date and time so I am using below srcipt and update by query API to achieve the same but I am not getting the desired result . POST abc-2017.09/\_update\_by\_qu… --- ## [Как исключить подстветку не полностью совпадающих запросов?](https://discuss.elastic.co/t/topic/25362)
**Author:** [@Stan](https://discuss.elastic.co/u/Stan)\ **Replies:** 6\ **Last updated:** [July 20, 2015, 7:53pm UTC](https://discuss.elastic.co/t/topic/25362 "2015-07-20T19:53:32Z")
Добрый день! Просьба подсказать. Есть проиндексирвоанные данные - имя и фамилия, которые проиндексированы через edgeNGram. Когда я делаю поиск с помощью match\_prefix, с указанием необходимости сделать highlight, я полу… --- ## [For loop and count](https://discuss.elastic.co/t/for-loop-and-count/67542)
**Author:** [@cars2991](https://discuss.elastic.co/u/cars2991)\ **Replies:** 4\ **Last updated:** [December 8, 2016, 6:22pm UTC](https://discuss.elastic.co/t/for-loop-and-count/67542 "2016-12-08T18:22:14Z")
Is it possible to tell kibana to create metrics on data such that if field X has X and field Y has Y Z, provide the count where field X has field Y and count of field X has field Z? --- ## [Kibana size parameter in split bar visualizations](https://discuss.elastic.co/t/kibana-size-parameter-in-split-bar-visualizations/68361)
**Author:** [@wokmichel](https://discuss.elastic.co/u/wokmichel)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 2:32pm UTC](https://discuss.elastic.co/t/kibana-size-parameter-in-split-bar-visualizations/68361 "2016-12-13T14:32:09Z")
Hello, I am having trouble understanding how Kibana 5.0 handles the size parameter in term aggregations for split bar charts. As an example, have a look here : The size parameter is set to 10 but the graphs shows way … --- ## [Field type for unix timestamp](https://discuss.elastic.co/t/field-type-for-unix-timestamp/48413)
**Author:** [@Dom\_Sie](https://discuss.elastic.co/u/Dom_Sie)\ **Replies:** 2\ **Last updated:** [April 27, 2016, 6:47am UTC](https://discuss.elastic.co/t/field-type-for-unix-timestamp/48413 "2016-04-27T06:47:57Z")
Hi, we use ES 1.4.4 We have three fields who stores a date \[format is the unix timestamp; in example 1461668482\] So far we save the field as a string - date detection is enabled. A "from-to date aggregation // gt< … --- ## [Logstash 6.1 failing to parse CSV](https://discuss.elastic.co/t/logstash-6-1-failing-to-parse-csv/115485)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 6\ **Last updated:** [February 1, 2018, 3:40pm UTC](https://discuss.elastic.co/t/logstash-6-1-failing-to-parse-csv/115485 "2018-02-01T15:40:48Z")
While parsing csv file i am getting below error. Any guess or help to remove this? \[2018-01-15T12:33:39,047\]\[WARN \]\[logstash.filters.csv \] Error parsing csv {:field=\>"message", :source=\>"\\"ip\_addr\\",\\"initiator\_line\\",\\… --- ## [Kibana KQL search saved with time range](https://discuss.elastic.co/t/kibana-kql-search-saved-with-time-range/295510)
**Author:** [@JonathanCabral](https://discuss.elastic.co/u/JonathanCabral)\ **Replies:** 1\ **Last updated:** [January 27, 2022, 12:59pm UTC](https://discuss.elastic.co/t/kibana-kql-search-saved-with-time-range/295510 "2022-01-27T12:59:34Z")
Hi guys, my team are trying to do some search in kibana using KQL, but we are facing some problems. I hope you could help us. This question was Asked by my teammate on the SO quite a long, but had no answer. I'm creati… --- ## [Elapsed filter with multiple workers..does it work or not?](https://discuss.elastic.co/t/elapsed-filter-with-multiple-workers-does-it-work-or-not/108538)
**Author:** [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)\ **Replies:** 7\ **Last updated:** [December 1, 2017, 6:40pm UTC](https://discuss.elastic.co/t/elapsed-filter-with-multiple-workers-does-it-work-or-not/108538 "2017-12-01T18:40:15Z")
Hi, I tried searching but haven't got a definite answer. Aggregate filter clearly mentions that: "You should be very careful to set Logstash filter workers to 1 (-w 1 flag) for this filter to work correctly otherwise … --- ## [Ignore malformed for date](https://discuss.elastic.co/t/ignore-malformed-for-date/80978)
**Author:** [@gsb](https://discuss.elastic.co/u/gsb)\ **Replies:** 5\ **Last updated:** [April 3, 2017, 11:27am UTC](https://discuss.elastic.co/t/ignore-malformed-for-date/80978 "2017-04-03T11:27:59Z")
In Elastic for field of type date , even if the ignore malformed attribute is set to true , it indexes the malformed data into this field. Ideally this field value should be empty in case the incoming data is malform… --- ## [Clone visualization in Kibana](https://discuss.elastic.co/t/clone-visualization-in-kibana/240289)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 12:15pm UTC](https://discuss.elastic.co/t/clone-visualization-in-kibana/240289 "2020-07-08T12:15:34Z")
Hi, Is there a way to clone (Top pages \[Filebeat Nginx\] ECS) from visualize in order to edit the cloned version and keep the original one? I can see how can I clone dashboards but not visualizations? Any help is reall… --- ## [Calculate Time Difference in Kibana](https://discuss.elastic.co/t/calculate-time-difference-in-kibana/166112)
**Author:** [@Adi\_Purnama](https://discuss.elastic.co/u/Adi_Purnama)\ **Replies:** 2\ **Last updated:** [January 31, 2019, 11:01am UTC](https://discuss.elastic.co/t/calculate-time-difference-in-kibana/166112 "2019-01-31T11:01:45Z")
Hi I need help for new scripted field for this case: started\_at: 2017-04-01 07:41:25 ended\_at: 2017-05-01 10:14:34 output: 26:33:09 I am using Kibana 6.4.2 --- ## [Plati­num license](https://discuss.elastic.co/t/plati-num-license/345213)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 4\ **Last updated:** [October 17, 2023, 3:46pm UTC](https://discuss.elastic.co/t/plati-num-license/345213 "2023-10-17T15:46:15Z")
Hello , I want to know if the Plati­num license is based on the number of nodes or on capacity, and whether it applies to coordinator nodes. Thank you. --- ## [Libbeat documentation](https://discuss.elastic.co/t/libbeat-documentation/28304)
**Author:** [@deviantony](https://discuss.elastic.co/u/deviantony)\ **Replies:** 4\ **Last updated:** [September 5, 2015, 7:54am UTC](https://discuss.elastic.co/t/libbeat-documentation/28304 "2015-09-05T07:54:22Z")
Hello there, Is there any existing resources (docs, tutorials, best practices...) about how to begin/use the libbeat library to create a shipper? --- ## [Painless GeoPoint instantiation](https://discuss.elastic.co/t/painless-geopoint-instantiation/110011)
**Author:** [@ESmonkey](https://discuss.elastic.co/u/ESmonkey)\ **Replies:** 6\ **Last updated:** [December 3, 2017, 9:47pm UTC](https://discuss.elastic.co/t/painless-geopoint-instantiation/110011 "2017-12-03T21:47:24Z")
why cant we instantiate elasticsearch whitelisted classes like def pt = org.elasticsearch.common.geo.GeoPoint.fromGeohash("a"); or pt = new org.elasticsearch.common.geo.GeoPoint() both of these give errors. I am tryi… --- ## [High elastic search heap memory consumption while indexing huge files](https://discuss.elastic.co/t/high-elastic-search-heap-memory-consumption-while-indexing-huge-files/98004)
**Author:** [@akash](https://discuss.elastic.co/u/akash)\ **Replies:** 6\ **Last updated:** [August 23, 2017, 10:14am UTC](https://discuss.elastic.co/t/high-elastic-search-heap-memory-consumption-while-indexing-huge-files/98004 "2017-08-23T10:14:54Z")
Hi, We are trying to index large files in elastic search. Elastic heap memory consumption shoots up while indexing. Basic observation is that while indexing memory can go upto 30x and post indexing it remains at around… --- ## [Merge 2 index?](https://discuss.elastic.co/t/merge-2-index/226631)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 3\ **Last updated:** [April 8, 2020, 6:34am UTC](https://discuss.elastic.co/t/merge-2-index/226631 "2020-04-08T06:34:59Z")
Hi, Im trying to currently merge two indices together, (Both have the same data, just different name and dates), one index is names group it, another is named cloudflare. Is it possible to merge both indexes together a… --- ## [Logstash 抛错 code: 429](https://discuss.elastic.co/t/logstash-code-429/47109)
**Author:** [@guanguan\_wp](https://discuss.elastic.co/u/guanguan_wp)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 7:16am UTC](https://discuss.elastic.co/t/logstash-code-429/47109 "2016-04-13T07:16:01Z")
搭建elk日志收集，两台es服务做集群。 logstash的配置为 output { if \[type\] =="union\_user" { elasticsearch { hosts =\> \["10.10.1.167:9200","10.10.1.166:9200"\] index =\> "union\_user-%{+YYYY-MM-dd}" } stdout { codec =\> "json" … [Previous page](https://discuss.elastic.co/top.md?page=644&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=646&per_page=50&period=all)