# Top **URL:** https://discuss.elastic.co/top.md?page=646&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 647 --- ## [Settings to use with RestHighLevelClient and BulkProcessor](https://discuss.elastic.co/t/settings-to-use-with-resthighlevelclient-and-bulkprocessor/107433)
**Author:** [@gringogordo](https://discuss.elastic.co/u/gringogordo)\ **Replies:** 1\ **Last updated:** [November 17, 2017, 7:35am UTC](https://discuss.elastic.co/t/settings-to-use-with-resthighlevelclient-and-bulkprocessor/107433 "2017-11-17T07:35:00Z")
I am have written the very basic first steps of a java app to build 6 indexes. All works okay with somethign along these lines - \`highLevelRestClient.bulkAsync(request, bulkActionListener);\` until I add concurrency a… --- ## [How to use regex function on kibana for Ordered Search / match multiple keyword(sentence)](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/237452)
**Author:** [@nagmawan](https://discuss.elastic.co/u/nagmawan)\ **Replies:** 2\ **Last updated:** [June 18, 2020, 4:43am UTC](https://discuss.elastic.co/t/how-to-use-regex-function-on-kibana-for-ordered-search-match-multiple-keyword-sentence/237452 "2020-06-18T04:43:28Z")
Hi, Sorry i'm beginner in kibana. I will ask something about search, and will this work on kibana? I want to use the regex function with the goal to order search / matching 2 sentences or maybe more in just 1 field. I … --- ## [Logstash UDP listener died](https://discuss.elastic.co/t/logstash-udp-listener-died/97843)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-udp-listener-died/97843 "2017-08-22T11:37:57Z")
Hi everyone, I am trying to receive fortigate syslog from port 514, but there are some errors here’s my configure: input { tcp { port =\> 514 type =\> syslog } udp { port =\> 514 type =\> syslog } } output { el… --- ## [Rally 1.0.2 released](https://discuss.elastic.co/t/rally-1-0-2-released/157765)
**Author:** [@Evgenia\_Badiyanova](https://discuss.elastic.co/u/Evgenia_Badiyanova)\ **Replies:** 0\ **Last updated:** [November 21, 2018, 6:06pm UTC](https://discuss.elastic.co/t/rally-1-0-2-released/157765 "2018-11-21T18:06:29Z")
We have just released Rally 1.0.2. This release contains several improvements and bug fixes and we have improved stability in several areas. Rally 1.0.2 is now compatible with Python 3.7. We have also added ML API runner… --- ## [Elastic Stack 5.2.2 released](https://discuss.elastic.co/t/elastic-stack-5-2-2-released/76832)
**Author:** [@tudor](https://discuss.elastic.co/u/tudor)\ **Replies:** 0\ **Last updated:** [February 28, 2017, 5:05pm UTC](https://discuss.elastic.co/t/elastic-stack-5-2-2-released/76832 "2017-02-28T17:05:59Z")
Hi all, We've just released version 5.2.2 of the Elastic Stack. This is a bug fix release; please see the release notes/blogs for each product to get the details. You can find the individual blog posts here: https://… --- ## [Issue in Logstash after Upgrade](https://discuss.elastic.co/t/issue-in-logstash-after-upgrade/123421)
**Author:** [@sreejiths](https://discuss.elastic.co/u/sreejiths)\ **Replies:** 5\ **Last updated:** [March 13, 2018, 10:33pm UTC](https://discuss.elastic.co/t/issue-in-logstash-after-upgrade/123421 "2018-03-13T22:33:38Z")
I tested upgrade of ELK stack to V5.6.8 from V5.2.2 running on Centos 7 VM . Elasticsearch upgrade & Kibana upgrade Went fine ..But logstash ran into issue details below testing Logatsh config : input { udp { type =\> … --- ## [Filebeat-0SS throwing error while connecting with AWS ES](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402)
**Author:** [@Rakesh\_Joshi3107](https://discuss.elastic.co/u/Rakesh_Joshi3107)\ **Replies:** 7\ **Last updated:** [April 29, 2020, 7:14pm UTC](https://discuss.elastic.co/t/filebeat-0ss-throwing-error-while-connecting-with-aws-es/230402 "2020-04-29T19:14:45Z")
Hi, I'm trying to use Filebeat-OSS with AWS ES to ingest AWS ECS Container logs, I'm getting that Filebeat is not able to connect with ES. "2020-04-29T15:40:54.266Z ERROR pipeline/output.go:100 Failed to connect to bac… --- ## [Overwrite @timestamp field](https://discuss.elastic.co/t/overwrite-timestamp-field/91280)
**Author:** [@2knarf](https://discuss.elastic.co/u/2knarf)\ **Replies:** 1\ **Last updated:** [June 29, 2017, 1:36pm UTC](https://discuss.elastic.co/t/overwrite-timestamp-field/91280 "2017-06-29T13:36:02Z")
Hello, I'm trying to overwrite the timestamp field with incoming log messages' timestamp, However I am unable to get it working, I have tried searching the forums but I do not find anything that solves my case, attaching… --- ## [Increase size limit - Python ElasticSearch](https://discuss.elastic.co/t/increase-size-limit-python-elasticsearch/264830)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 7\ **Last updated:** [February 22, 2021, 4:02am UTC](https://discuss.elastic.co/t/increase-size-limit-python-elasticsearch/264830 "2021-02-22T04:02:16Z")
Hi, I'm currently writing a python script to extract out my elasticsearch documents and the following are my ES parameters that involves the sizing response = es.search(index= es\_index\_list,scroll='5m', size='10000', b… --- ## [ELK based CMDB](https://discuss.elastic.co/t/elk-based-cmdb/183269)
**Author:** [@mkain](https://discuss.elastic.co/u/mkain)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 8:56am UTC](https://discuss.elastic.co/t/elk-based-cmdb/183269 "2019-06-21T08:56:05Z")
Hi, I am planning to develop a CMDB sort of tool which can Hold list of hosts/servers , network devices, NMS, n/w device port level connections. Mark relation between apps (hosts/servers) and network devices, NMS… --- ## [ILM policy not working for all indexes](https://discuss.elastic.co/t/ilm-policy-not-working-for-all-indexes/216792)
**Author:** [@SergeSpinoza](https://discuss.elastic.co/u/SergeSpinoza)\ **Replies:** 4\ **Last updated:** [January 30, 2020, 10:26am UTC](https://discuss.elastic.co/t/ilm-policy-not-working-for-all-indexes/216792 "2020-01-30T10:26:08Z")
Hi! At some point ILM stopped working for all indexes. For example - ILM policy for index nginx-\*: GET /\_ilm/policy/nginx\_index\_delete: { "nginx\_index\_delete": { "policy": { "phases": { "hot": { … --- ## [Mapping for finding keywords in domains](https://discuss.elastic.co/t/mapping-for-finding-keywords-in-domains/179267)
**Author:** [@hacker\_21](https://discuss.elastic.co/u/hacker_21)\ **Replies:** 8\ **Last updated:** [May 15, 2019, 3:40pm UTC](https://discuss.elastic.co/t/mapping-for-finding-keywords-in-domains/179267 "2019-05-15T15:40:33Z")
hi there, I recently ran a search called "toronto dental" on google and noticed it even matches for keywords inside of domain names too: the domain is a single word, yet they are able to search for the two words (i… --- ## [Custom Region Maps](https://discuss.elastic.co/t/custom-region-maps/137377)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 8\ **Last updated:** [June 28, 2018, 10:31pm UTC](https://discuss.elastic.co/t/custom-region-maps/137377 "2018-06-28T22:31:20Z")
Hello, I configured Kibana to read a custom region geojson file following this guide: https://www.elastic.co/blog/custom-region-maps-in-kibana-6-0 However, no regions are showed in the map even if the Vector Map and Jo… --- ## [DSL Query For CPU Load (MetricBeat Data)](https://discuss.elastic.co/t/dsl-query-for-cpu-load-metricbeat-data/70917)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 8\ **Last updated:** [January 20, 2017, 5:35am UTC](https://discuss.elastic.co/t/dsl-query-for-cpu-load-metricbeat-data/70917 "2017-01-20T05:35:36Z")
Hi- Am trying to create a DSL query to fetch the CPU load of a server from my Elastic search engine. Could someone please help me in creating a query for this. PS: I will execute this query using the Elasticsearch ge… --- ## [Import visualization even with missing fields?](https://discuss.elastic.co/t/import-visualization-even-with-missing-fields/62716)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [October 13, 2016, 1:15am UTC](https://discuss.elastic.co/t/import-visualization-even-with-missing-fields/62716 "2016-10-13T01:15:29Z")
Hi there! I am trying to do a bulk import of dashboards from an old elasticsearch cluster into a new one. It appears that some of our dashboards/visualizations are not importing as objects, apparently because some of th… --- ## [Restrict the number of log files](https://discuss.elastic.co/t/restrict-the-number-of-log-files/25416)
**Author:** [@achimweigel](https://discuss.elastic.co/u/achimweigel)\ **Replies:** 3\ **Last updated:** [August 26, 2015, 1:36pm UTC](https://discuss.elastic.co/t/restrict-the-number-of-log-files/25416 "2015-08-26T13:36:03Z")
Hello, we are using Elasticsearch 1.6 and have configured in the logging.yml a logger which compresses a log file when it achieves a maximal size of 100KB: file: type: extrasRollingFile file: ${path.logs}/${c… --- ## [Java equivalent of GET cURL command?](https://discuss.elastic.co/t/java-equivalent-of-get-curl-command/91348)
**Author:** [@kaushah](https://discuss.elastic.co/u/kaushah)\ **Replies:** 2\ **Last updated:** [June 30, 2017, 10:32pm UTC](https://discuss.elastic.co/t/java-equivalent-of-get-curl-command/91348 "2017-06-30T22:32:55Z")
What is the java equivalent code for the following cURL command? curl -XGET "http://localhost:9200/index1/type1/\_search" -H 'Content-Type: application/json' -d' { "query": { "match": { "Tag": "Value1" … --- ## [Ordering for both axes of heatmap](https://discuss.elastic.co/t/ordering-for-both-axes-of-heatmap/104589)
**Author:** [@bgoldowsky](https://discuss.elastic.co/u/bgoldowsky)\ **Replies:** 2\ **Last updated:** [October 24, 2017, 2:44pm UTC](https://discuss.elastic.co/t/ordering-for-both-axes-of-heatmap/104589 "2017-10-24T14:44:03Z")
I'm trying to make a heatmap view of data that's categorized on two different dimensions, each of which has a natural order. It looks something like this: \[image\] As you can see the Y "class" axis is not in the ascend… --- ## [How to search users by first, last name](https://discuss.elastic.co/t/how-to-search-users-by-first-last-name/198489)
**Author:** [@undefinedman](https://discuss.elastic.co/u/undefinedman)\ **Replies:** 1\ **Last updated:** [September 7, 2019, 2:57am UTC](https://discuss.elastic.co/t/how-to-search-users-by-first-last-name/198489 "2019-09-07T02:57:53Z")
Hey Elasticsearch, a year ago I wrote a topic here https://discuss.elastic.co/t/what-is-the-best-way-to-query-first-and-last-name/136142 to help me out with searching users in my database. At that time, I partially reso… --- ## [Thread consumption in Filebeats](https://discuss.elastic.co/t/thread-consumption-in-filebeats/87313)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 3\ **Last updated:** [May 31, 2017, 8:46am UTC](https://discuss.elastic.co/t/thread-consumption-in-filebeats/87313 "2017-05-31T08:46:38Z")
Hello, I have a question on Filebeat internal: From reading Filebeat documentation "https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html", One harvester is started for each file. I am wonderin… --- ## ["failed to reduce search" error](https://discuss.elastic.co/t/failed-to-reduce-search-error/11946)
**Author:** [@Robin\_Boutros](https://discuss.elastic.co/u/Robin_Boutros)\ **Replies:** 3\ **Last updated:** [May 14, 2013, 8:20pm UTC](https://discuss.elastic.co/t/failed-to-reduce-search-error/11946 "2013-05-14T20:20:55Z")
Hey, A couple days ago, I started to get errors about shard failures, I can't remember the exact error message. So I decided to reindex everything from mysql and start fresh. I just delete all the old indexes, an… --- ## [Copying Dashboard from kibana](https://discuss.elastic.co/t/copying-dashboard-from-kibana/296142)
**Author:** [@Aniketvk008](https://discuss.elastic.co/u/Aniketvk008)\ **Replies:** 7\ **Last updated:** [February 4, 2022, 8:08am UTC](https://discuss.elastic.co/t/copying-dashboard-from-kibana/296142 "2022-02-04T08:08:15Z")
Hi how to copy dashboard from kibana without overwriting the existing object(dashboard) in same machine --- ## [Getting information Aruba IAP-207](https://discuss.elastic.co/t/getting-information-aruba-iap-207/206024)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 7\ **Last updated:** [November 14, 2019, 11:28am UTC](https://discuss.elastic.co/t/getting-information-aruba-iap-207/206024 "2019-11-14T11:28:15Z")
Hi All, Good afternoon After adding filebeat and auditbeat to my linux host, now I wanted to try out getting details from access point "Aruba IAP-207" . Guidance requested for the any documentation URL which talks abo… --- ## [Logstash Index Name as "%{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}"](https://discuss.elastic.co/t/logstash-index-name-as-metadata-beat-metadata-version/184225)
**Author:** [@robscott27](https://discuss.elastic.co/u/robscott27)\ **Replies:** 1\ **Last updated:** [June 5, 2019, 5:19pm UTC](https://discuss.elastic.co/t/logstash-index-name-as-metadata-beat-metadata-version/184225 "2019-06-05T17:19:25Z")
How can I get the index name for netflow to be set correctly upon creation? Some background: Prior to using Netflow, I've been using Logstash to send beats data into Elasticsearch - Filebeat, Auditbeat, Metricbeat, etc… --- ## [Logstash Filter Json To Array of Json](https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345)
**Author:** [@Vineethpp](https://discuss.elastic.co/u/Vineethpp)\ **Replies:** 7\ **Last updated:** [May 16, 2019, 2:52pm UTC](https://discuss.elastic.co/t/logstash-filter-json-to-array-of-json/181345 "2019-05-16T14:52:24Z")
Hi, I was trying get a logstash filter which will write json object to kafka as array of json object. As of now with out any filter its writing the json object, but for me i want the kafka events as array of json objec… --- ## [Please help with grok pattern](https://discuss.elastic.co/t/please-help-with-grok-pattern/123497)
**Author:** [@vitich](https://discuss.elastic.co/u/vitich)\ **Replies:** 7\ **Last updated:** [March 14, 2018, 10:47am UTC](https://discuss.elastic.co/t/please-help-with-grok-pattern/123497 "2018-03-14T10:47:59Z")
Hi! Log string: "12/Mar/2018:07:45:23 +0000"; "91.198.36.14"; "UA:-:-"; "10.10.10.1:80"; "200"; "0.000 sec"; "0.003 sec"; "www.some-site.ua"; "GET /services/ HTTP/1.1"; "327"; "https://www.some-site.ua/services/"; "Moz… --- ## [Rolling Logs in Logstash?](https://discuss.elastic.co/t/rolling-logs-in-logstash/37268)
**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 6:26pm UTC](https://discuss.elastic.co/t/rolling-logs-in-logstash/37268 "2015-12-15T18:26:21Z")
Every time there's an event in Logstash, I ensure that it's logged in a log file. But the problem is that .. the log file keeps growing every day. I need to segregrate logs by the day so I could delete old logs as per my… --- ## [Unable to connect to AWS Elasticsearch Service Domain from Metricbeat](https://discuss.elastic.co/t/unable-to-connect-to-aws-elasticsearch-service-domain-from-metricbeat/183677)
**Author:** [@Sukrity\_Chakraborty](https://discuss.elastic.co/u/Sukrity_Chakraborty)\ **Replies:** 2\ **Last updated:** [May 31, 2019, 10:57am UTC](https://discuss.elastic.co/t/unable-to-connect-to-aws-elasticsearch-service-domain-from-metricbeat/183677 "2019-05-31T10:57:18Z")
Hi All, I have configured a new Elasticsearch Service domain in AWS following the steps mentioned in the tutorial. I have set open access to the domain as of now. I installed and configured Metricbeat on one of my EC2 … --- ## [Following elasticstack installation instructions and got hung up](https://discuss.elastic.co/t/following-elasticstack-installation-instructions-and-got-hung-up/94507)
**Author:** [@lucasjkr](https://discuss.elastic.co/u/lucasjkr)\ **Replies:** 8\ **Last updated:** [July 26, 2017, 8:07pm UTC](https://discuss.elastic.co/t/following-elasticstack-installation-instructions-and-got-hung-up/94507 "2017-07-26T20:07:19Z")
I'm using an Ubuntu VM, and following the instructions listed here: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/deb.html Here is a complete list of the commands I've executed (post Ubuntu installation): … --- ## [APM .NET Agent](https://discuss.elastic.co/t/apm-net-agent/155449)
**Author:** [@AFShin](https://discuss.elastic.co/u/AFShin)\ **Replies:** 6\ **Last updated:** [November 15, 2018, 11:22am UTC](https://discuss.elastic.co/t/apm-net-agent/155449 "2018-11-15T11:22:53Z")
Hello, Is there an official .Net Agent available now? The Only support topic is: Elastic .NET Agent and Java Agent Which is closed almost one year ago. Thank you. --- ## [WordDelimiterTokenFilter used twice in same analyzer with different configurations causes issues](https://discuss.elastic.co/t/worddelimitertokenfilter-used-twice-in-same-analyzer-with-different-configurations-causes-issues/116259)
**Author:** [@Atul\_Bagga](https://discuss.elastic.co/u/Atul_Bagga)\ **Replies:** 6\ **Last updated:** [February 21, 2018, 8:55am UTC](https://discuss.elastic.co/t/worddelimitertokenfilter-used-twice-in-same-analyzer-with-different-configurations-causes-issues/116259 "2018-02-21T08:55:16Z")
ES 5.4.1 Config-1 GenerateWordParts = true, // \[wi-fi\] ---\> \[wi,fi\] GenerateNumberParts = true, // \[12-03\] ---\> \[12,03\] CatenateWords = false, // \[wi-fi\] -/-\> \[wifi\] CatenateNumbers = false, // \[12-03\] -… --- ## [Java exception when using cap\_net\_bind\_service+ep with Logstash 5.x](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947)
**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\ **Replies:** 6\ **Last updated:** [November 29, 2016, 11:09pm UTC](https://discuss.elastic.co/t/java-exception-when-using-cap-net-bind-service-ep-with-logstash-5-x/63947 "2016-11-29T23:09:16Z")
I require Logstash to listen on TCP and UDP port 514. To do this, I use setcap to allow java to bind to this low port number. After doing this (and rerunning ldconfig), Java throws an exception. logstash: Sending Logst… --- ## [Winlogbeat Mapping Template](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 5\ **Last updated:** [August 10, 2016, 8:08am UTC](https://discuss.elastic.co/t/winlogbeat-mapping-template/57554 "2016-08-10T08:08:45Z")
Hi I am having the following issue https://discuss.elastic.co/t/query-help-search-for/57429 I have loaded the default winlogbeat template (I'm using v5 Alpha 4 agents) { "mappings": { "\_default\_": { … --- ## [Given Apache logs in ES, how do I get this data out into Elasticsearch](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-this-data-out-into-elasticsearch/26035)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 5\ **Last updated:** [July 22, 2015, 3:56pm UTC](https://discuss.elastic.co/t/given-apache-logs-in-es-how-do-i-get-this-data-out-into-elasticsearch/26035 "2015-07-22T15:56:40Z")
I've got apache logs in Elasticsearch. I can see the data in Kibana. How do I visualize the following? Total Page Views Total Hits Unique Page Views Average Visitor Stay Length I'm just a system administrator. Af… --- ## [Elasticsearch bucket\_script to subtract two timestamps](https://discuss.elastic.co/t/elasticsearch-bucket-script-to-subtract-two-timestamps/125309)
**Author:** [@Siddaram\_Jamagav](https://discuss.elastic.co/u/Siddaram_Jamagav)\ **Replies:** 4\ **Last updated:** [March 23, 2018, 10:38am UTC](https://discuss.elastic.co/t/elasticsearch-bucket-script-to-subtract-two-timestamps/125309 "2018-03-23T10:38:14Z")
Unable to subtract two time stamps using bucket\_script aggregation: Below is my query: POST xxxxxxxxxxxxxxxxxxxxxxxxxx/\_search?size=0 { "query": { "bool": { "must": \[ { "match\_phrase": { "projectId.keyword": "… --- ## [Explanation of terms in a search](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523)
**Author:** [@MrFantastic2022](https://discuss.elastic.co/u/MrFantastic2022)\ **Replies:** 7\ **Last updated:** [February 23, 2022, 8:36pm UTC](https://discuss.elastic.co/t/explanation-of-terms-in-a-search/297523 "2022-02-23T20:36:19Z")
Hello. I am trying to understand this passage, which is in the 6.8 REST API docs: By default, all terms are optional, as long as one term matches. A search for foo bar baz will find any document that contains one or mo… --- ## [Winlogbeat sending sysmon data to kibana](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168)
**Author:** [@godfather7](https://discuss.elastic.co/u/godfather7)\ **Replies:** 7\ **Last updated:** [November 19, 2018, 6:47am UTC](https://discuss.elastic.co/t/winlogbeat-sending-sysmon-data-to-kibana/154168 "2018-11-19T06:47:46Z")
in the kibana dashboard, winlogbeat records the sysmon event and send it to elasticsearch and henceforth to kibana. there are 3 field name on time basis and i am not able to understand the difference between them namely … --- ## [Concurrent user visualization](https://discuss.elastic.co/t/concurrent-user-visualization/56488)
**Author:** [@Aludirk](https://discuss.elastic.co/u/Aludirk)\ **Replies:** 2\ **Last updated:** [July 27, 2016, 10:00pm UTC](https://discuss.elastic.co/t/concurrent-user-visualization/56488 "2016-07-27T22:00:51Z")
Hi All I want to know the number of concurrent user in my application over time, I log all login and logout for each user to Elasticsearch. How can I setup the visualization to achieve it ? --- ## [Can not access dot (eg foo.bar) fields in logstash](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884)
**Author:** [@ankmathur14](https://discuss.elastic.co/u/ankmathur14)\ **Replies:** 2\ **Last updated:** [August 25, 2015, 7:08am UTC](https://discuss.elastic.co/t/can-not-access-dot-eg-foo-bar-fields-in-logstash/27884 "2015-08-25T07:08:07Z")
How to access dot fields in logstash. if \[foo.bar\] == "xyz" { grok { add\_field =\> {"new\_field", "pqr"} } } Field "foo.bar" exists and its value is "xyz" but its not going in the 'if' block I al… --- ## [Getting slow logs on kibana with an hour delay time](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645)
**Author:** [@Milad\_Akhlaghi](https://discuss.elastic.co/u/Milad_Akhlaghi)\ **Replies:** 6\ **Last updated:** [June 21, 2022, 6:06pm UTC](https://discuss.elastic.co/t/getting-slow-logs-on-kibana-with-an-hour-delay-time/307645 "2022-06-21T18:06:34Z")
Hi friends, i have elk cluster that includes: 20 filebeats , 6 logstash, 9 elasticsearches and 2 kibanas Elasticsearch node roles are : 3 x \[ data\_hot, data\_content \] 3 x \[ data\_warm, ingest, master \] 1x \[ master \] … --- ## [Merge 500 daily indices to weekly / Reindex data](https://discuss.elastic.co/t/merge-500-daily-indices-to-weekly-reindex-data/185614)
**Author:** [@test\_qweqwe](https://discuss.elastic.co/u/test_qweqwe)\ **Replies:** 6\ **Last updated:** [June 13, 2019, 11:05am UTC](https://discuss.elastic.co/t/merge-500-daily-indices-to-weekly-reindex-data/185614 "2019-06-13T11:05:24Z")
Hi there. How to merge 500 daily indices to weekly? Will this increase the search speed? If it possible? 1.1) What can increase speed of search expect of my hardware? :sweat\_smile: What is the best way to reindex dat… --- ## [Filter Aggegation with a lot of aggs](https://discuss.elastic.co/t/filter-aggegation-with-a-lot-of-aggs/103523)
**Author:** [@rvanginneken](https://discuss.elastic.co/u/rvanginneken)\ **Replies:** 8\ **Last updated:** [October 16, 2017, 10:03am UTC](https://discuss.elastic.co/t/filter-aggegation-with-a-lot-of-aggs/103523 "2017-10-16T10:03:56Z")
I have a pretty specific usecase, which I have working at the moment, but I'm just wondering if there is a better, cleaner way to do it. I have 10 aggs For all aggs filters can and will be applied Results should be fil… --- ## [Can I use both json and plain logs in a common filebeat input?](https://discuss.elastic.co/t/can-i-use-both-json-and-plain-logs-in-a-common-filebeat-input/36879)
**Author:** [@iammichiel](https://discuss.elastic.co/u/iammichiel)\ **Replies:** 3\ **Last updated:** [December 10, 2015, 5:58pm UTC](https://discuss.elastic.co/t/can-i-use-both-json-and-plain-logs-in-a-common-filebeat-input/36879 "2015-12-10T17:58:43Z")
Hi, I'm trying to send both classic nginx logs (access/error) using filebeat. Which works great. Now, my application, also spawns logs which are json encoded. Which also works great if I send only these. It is whe… --- ## [Filebeat is not authenticating with elasticsearch after xpack was enabled](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909)
**Author:** [@Antonio\_Chadwick](https://discuss.elastic.co/u/Antonio_Chadwick)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 10:07pm UTC](https://discuss.elastic.co/t/filebeat-is-not-authenticating-with-elasticsearch-after-xpack-was-enabled/275909 "2021-06-15T22:07:09Z")
Hi Team, I have a local setup that running ubuntu which i have elasticsearch and kibana running on, and a separate box running centOS, which has filebeat installed on this is the server. I want to monitor logs from this… --- ## [Multiple Elasticsearch instance on one node](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449)
**Author:** [@AndyGarcia](https://discuss.elastic.co/u/AndyGarcia)\ **Replies:** 5\ **Last updated:** [February 9, 2020, 9:44am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449 "2020-02-09T09:44:50Z")
I'm having an issue with setting up multiple instances of Elasticsearch 7.5 on one node. I've created 3 seperate directories, each with elasticsearch.yml, jvm.options, and log44j2.properties. I run the command "/bin/ela… --- ## [Overriding logstash.yml in Docker not working](https://discuss.elastic.co/t/overriding-logstash-yml-in-docker-not-working/107197)
**Author:** [@dolanmk](https://discuss.elastic.co/u/dolanmk)\ **Replies:** 1\ **Last updated:** [November 13, 2017, 9:45pm UTC](https://discuss.elastic.co/t/overriding-logstash-yml-in-docker-not-working/107197 "2017-11-13T21:45:34Z")
Hi, I am trying to run Logstash in the Docker Toolbox (I have Windows 7) and I am having a few difficulties. The default logstash.yml from the Logstash image has x-pack preferences listed in it. I want to override this… --- ## [In elasticsearch audit, for data/write/bulk event, what is the target index?](https://discuss.elastic.co/t/in-elasticsearch-audit-for-data-write-bulk-event-what-is-the-target-index/275001)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [June 7, 2021, 6:20am UTC](https://discuss.elastic.co/t/in-elasticsearch-audit-for-data-write-bulk-event-what-is-the-target-index/275001 "2021-06-07T06:20:08Z")
I'm trying to debug a winlogbeat ingest, I'm seeing data/write/bulk events for the host and user in the audit logs, but it doesn't show the target index name. That seems like a useful audit item. I'm trying to get winl… --- ## [Checking if a field exists via scripted field in Kibana 5.1](https://discuss.elastic.co/t/checking-if-a-field-exists-via-scripted-field-in-kibana-5-1/72945)
**Author:** [@gkraan](https://discuss.elastic.co/u/gkraan)\ **Replies:** 2\ **Last updated:** [January 27, 2017, 6:02pm UTC](https://discuss.elastic.co/t/checking-if-a-field-exists-via-scripted-field-in-kibana-5-1/72945 "2017-01-27T18:02:33Z")
Hi, I am using the 'metricbeat' to pull data from several servers into a single E.S. instance, which works fine. I have several visualizations in Kibana based on this info, but Kibana is set to only display data not ol… --- ## [SOLVED: Grok + Dynamic field name](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842)
**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Replies:** 2\ **Last updated:** [June 17, 2016, 7:43am UTC](https://discuss.elastic.co/t/solved-grok-dynamic-field-name/52842 "2016-06-17T07:43:07Z")
Hi everybody, I am creating filters for monitoring a new server. I have a amavis log that perform spamassassin tests on email. The problem is that there are a hundred tests and the tests in the log are never the sam… --- ## [Simple visualization \*\*without timestamp?\*\*](https://discuss.elastic.co/t/simple-visualization-without-timestamp/29853)
**Author:** [@Brian\_Walsh](https://discuss.elastic.co/u/Brian_Walsh)\ **Replies:** 2\ **Last updated:** [September 24, 2015, 4:21pm UTC](https://discuss.elastic.co/t/simple-visualization-without-timestamp/29853 "2015-09-24T16:21:26Z")
Hello. I've used ELK in the past, although its been 2+ years since the last project. I have quick proof-of-concept up and running using 3 clusters & a tribe node. I've been able to get Kibana to connect and discover … [Previous page](https://discuss.elastic.co/top.md?page=645&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=647&per_page=50&period=all)