# Top

**URL:** https://discuss.elastic.co/top.md?page=658&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 659

---

## [ES data replication to two ES clusters and restore](https://discuss.elastic.co/t/es-data-replication-to-two-es-clusters-and-restore/161970)

<div class="topic-metadata">

**Author:** [@Jason6](https://discuss.elastic.co/u/Jason6)\
**Replies:** 7\
**Last updated:** [December 25, 2018, 10:32am UTC](https://discuss.elastic.co/t/es-data-replication-to-two-es-clusters-and-restore/161970 "2018-12-25T10:32:14Z")

</div>

Hi ES experts, I have a question as below, please help me take a look, thanks a lot. we plan to build our disaster recovery(DR) env. we want to save data to our production env and DR ES clusters at the same time. the…

---

## [Mapping definition for \[geoip\] has unsupported parameters: \[path : full\]”}}}}, :level=\>:warn}](https://discuss.elastic.co/t/mapping-definition-for-geoip-has-unsupported-parameters-path-full-level-warn/36263)

<div class="topic-metadata">

**Author:** [@Rajaram\_Surimenu](https://discuss.elastic.co/u/Rajaram_Surimenu)\
**Replies:** 6\
**Last updated:** [December 3, 2015, 10:07am UTC](https://discuss.elastic.co/t/mapping-definition-for-geoip-has-unsupported-parameters-path-full-level-warn/36263 "2015-12-03T10:07:20Z")

</div>

Hi, I am trying to connect to remote host of elastic search using logstash. Taken a sample /var/log/message and given as input file path in my logstash.conf. Here is the conf file which i am using : input { file { pa…

---

## [Accessing environment variable in config file in a custom made beats](https://discuss.elastic.co/t/accessing-environment-variable-in-config-file-in-a-custom-made-beats/62241)

<div class="topic-metadata">

**Author:** [@wing999](https://discuss.elastic.co/u/wing999)\
**Replies:** 2\
**Last updated:** [October 6, 2016, 2:36am UTC](https://discuss.elastic.co/t/accessing-environment-variable-in-config-file-in-a-custom-made-beats/62241 "2016-10-06T02:36:54Z")

</div>

I have built a custom made beats based on libbeat and I want to use environment variable as a value in the config file. However, if I type ${VAR} in the config file and I run config test, I got: ./countbeat -c countbeat…

---

## [Elasticsearch service often goes down or gets killed](https://discuss.elastic.co/t/elasticsearch-service-often-goes-down-or-gets-killed/23320)

<div class="topic-metadata">

**Author:** [@Sebastien\_Vassaux](https://discuss.elastic.co/u/Sebastien_Vassaux)\
**Replies:** 2\
**Last updated:** [April 21, 2015, 9:43pm UTC](https://discuss.elastic.co/t/elasticsearch-service-often-goes-down-or-gets-killed/23320 "2015-04-21T21:43:24Z")

</div>

Hello! My webserver is running ubuntu 14.10 with elasticsearch 1.5.0 and java 1.7u55 For some reason,\* the elasticsearch service often goes down,\* resulting in my website not being available to my users anymore…

---

## [Grock filter to parse SQL query](https://discuss.elastic.co/t/grock-filter-to-parse-sql-query/136721)

<div class="topic-metadata">

**Author:** [@wafaAG](https://discuss.elastic.co/u/wafaAG)\
**Replies:** 4\
**Last updated:** [June 21, 2018, 11:26am UTC](https://discuss.elastic.co/t/grock-filter-to-parse-sql-query/136721 "2018-06-21T11:26:32Z")

</div>

Hi, i have some events on application logs that i want to parse (which logging slow SQL query), the events is like that : 19-Jun-2018 15:16:28.670 WARNING \[ajp-nio-8009-exec-67\] org.apache.tomcat.jdbc.pool.interceptor.…

---

## [Mirroring repos on red hat satellite](https://discuss.elastic.co/t/mirroring-repos-on-red-hat-satellite/118914)

<div class="topic-metadata">

**Author:** [@ejo](https://discuss.elastic.co/u/ejo)\
**Replies:** 4\
**Last updated:** [February 8, 2018, 3:56pm UTC](https://discuss.elastic.co/t/mirroring-repos-on-red-hat-satellite/118914 "2018-02-08T15:56:34Z")

</div>

We have a requirement to mirror elastic and a few other products on an internal red hat satellite 6 system. This is a security requirement on several fronts. The problem for me is where do I go to get the repo urls for t…

---

## [Filter out (drop) a log sent to Logstash, based on the values of its fields](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664)

<div class="topic-metadata">

**Author:** [@zoug](https://discuss.elastic.co/u/zoug)\
**Replies:** 5\
**Last updated:** [July 28, 2022, 1:47pm UTC](https://discuss.elastic.co/t/filter-out-drop-a-log-sent-to-logstash-based-on-the-values-of-its-fields/310664 "2022-07-28T13:47:15Z")

</div>

Hello, I use a pipeline to ingest logs generated by suricata, everything set up with filebeat setup --pipelines --modules suricata,\<other\_modules\>. I don't want to ingest any "event" logs, only "alert" logs. So I added …

---

## [Is there a limit for the msearch?](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361)

<div class="topic-metadata">

**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\
**Replies:** 5\
**Last updated:** [August 18, 2020, 8:11am UTC](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361 "2020-08-18T08:11:50Z")

</div>

i tried getting results from elastic\_client.search and elastic\_client.msearch and both returns different amount of results. and elastic\_client.search returns the most accurate result

---

## [Import Windows Event Dashboard](https://discuss.elastic.co/t/import-windows-event-dashboard/192495)

<div class="topic-metadata">

**Author:** [@motts](https://discuss.elastic.co/u/motts)\
**Replies:** 5\
**Last updated:** [July 30, 2019, 5:35pm UTC](https://discuss.elastic.co/t/import-windows-event-dashboard/192495 "2019-07-30T17:35:53Z")

</div>

Hello there, Is there a good Windows Event Dashboard/Visualizations that I can import from somewhere? I don't really care what it monitors, I'd just like to be able to find something that I can interact with without hav…

---

## [LogStash XMLFilter REXML::ParseException: No close tag](https://discuss.elastic.co/t/logstash-xmlfilter-rexml-no-close-tag/155084)

<div class="topic-metadata">

**Author:** [@Sankalan\_Banerjee](https://discuss.elastic.co/u/Sankalan_Banerjee)\
**Replies:** 5\
**Last updated:** [November 7, 2018, 10:56am UTC](https://discuss.elastic.co/t/logstash-xmlfilter-rexml-no-close-tag/155084 "2018-11-07T10:56:34Z")

</div>

Sample XML Doc : \<?xml-stylesheet type="text/xsl" encoding="UTF-8" href="..\\stepDetail.xsl"?\> \<tc\_id\>C608690E65444B3F8A3B9DA25BA1493E\</tc\_id\> D08B65929BEC48B5BB4B5FF2843CA3B5 \<tc\_name\>EGBO\_SANITY\_02\_AuthRes\</tc\_nam…

---

## [Multipipeline with Filebeat, am I doing it right?](https://discuss.elastic.co/t/multipipeline-with-filebeat-am-i-doing-it-right/135402)

<div class="topic-metadata">

**Author:** [@FOXHOUNDER](https://discuss.elastic.co/u/FOXHOUNDER)\
**Replies:** 6\
**Last updated:** [July 3, 2018, 3:00pm UTC](https://discuss.elastic.co/t/multipipeline-with-filebeat-am-i-doing-it-right/135402 "2018-07-03T15:00:11Z")

</div>

Hi, I'm new to the ELK Stack and I've been assigned the simple task to use this technology to store and analyze our logs. Quick intro: we have a folder containing logs, one for each microservice. A new log is produced e…

---

## [Call Elasticsearch queries from Custom Kibana Plugin](https://discuss.elastic.co/t/call-elasticsearch-queries-from-custom-kibana-plugin/268179)

<div class="topic-metadata">

**Author:** [@theonlycatonice](https://discuss.elastic.co/u/theonlycatonice)\
**Replies:** 8\
**Last updated:** [March 25, 2021, 8:55pm UTC](https://discuss.elastic.co/t/call-elasticsearch-queries-from-custom-kibana-plugin/268179 "2021-03-25T20:55:56Z")

</div>

Good day, I have searched high and low for an example that works in 2021 (ES 7.11) on how to implement ES querying from a Custom Kibana Plugin. The use case is there are config files stored in an index that we would like…

---

## [Logstash =\> ES, Timezone and IndexName](https://discuss.elastic.co/t/logstash-es-timezone-and-indexname/94297)

<div class="topic-metadata">

**Author:** [@bastimm](https://discuss.elastic.co/u/bastimm)\
**Replies:** 3\
**Last updated:** [July 25, 2017, 9:10pm UTC](https://discuss.elastic.co/t/logstash-es-timezone-and-indexname/94297 "2017-07-25T21:10:36Z")

</div>

Hello, we have logfiles with a timestamp like "yyyyMMddHHmmss" with Europe/Berlin Timezone. This files were sent via FileBeat=\>Logstash=\>ES. Now we changed timezone in our Logstash config. Now the timestamp in ES is …

---

## [Cannot access Kibana from remote PC](https://discuss.elastic.co/t/cannot-access-kibana-from-remote-pc/234135)

<div class="topic-metadata">

**Author:** [@kcat](https://discuss.elastic.co/u/kcat)\
**Replies:** 6\
**Last updated:** [May 26, 2020, 4:12pm UTC](https://discuss.elastic.co/t/cannot-access-kibana-from-remote-pc/234135 "2020-05-26T16:12:18Z")

</div>

Hi, I am new in ES. I get a problem in Kibana. My remote PC cannot access to Kibana. Can anyone please help? Kibana.yml server.port: 5601 server.host: "0.0.0.0" elasticsearch.hosts: \["http://localhost:9200"\] It work…

---

## [\[APM\] Failed to handle event of type SPAN with this error: Received fatal alert: protocol\_version](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795)

<div class="topic-metadata">

**Author:** [@brossini](https://discuss.elastic.co/u/brossini)\
**Replies:** 4\
**Last updated:** [November 12, 2020, 11:40pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795 "2020-11-12T23:40:04Z")

</div>

I have deployed the APM agent on my Tomcat Application Server. It runs for about 10 min and then stops throwing the following error: Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,176 \[elastic-apm-server-repo…

---

## [Viewing hostname instead of ip](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023)

<div class="topic-metadata">

**Author:** [@JohnM](https://discuss.elastic.co/u/JohnM)\
**Replies:** 4\
**Last updated:** [July 9, 2019, 2:14am UTC](https://discuss.elastic.co/t/viewing-hostname-instead-of-ip/189023 "2019-07-09T02:14:39Z")

</div>

LOGSTASH 7.2 ES 7.2 I am receiving simple Linux syslog. In logstash node input filter, I have; mutate { add\_field =\> { "syslog\_host" =\> "%{host}" } } dns { reverse =\> \[ "host" \] action =\> "replace" } but in Ki…

---

## [Watcherのwebhookのbodyの設定方法について](https://discuss.elastic.co/t/watcher-webhook-body/211064)

<div class="topic-metadata">

**Author:** [@harue](https://discuss.elastic.co/u/harue)\
**Replies:** 5\
**Last updated:** [December 12, 2019, 2:16am UTC](https://discuss.elastic.co/t/watcher-webhook-body/211064 "2019-12-12T02:16:30Z")

</div>

お世話になっております。 Watcherについて、質問させて頂きます。 ご質問 ①bodyの項目名(下記例だと"resion")について、以下エラーが発生します。 \[x\_content\_parse\_exception\] \[1:587\] \[script\] unknown field \[resion\], parser not found 項目名は自由に指定できる認識ですが、違うのでしょうか。 エラーの解決策についてご教示をお願い…

---

## [Searching an empty index with a sort field specified should not fail](https://discuss.elastic.co/t/searching-an-empty-index-with-a-sort-field-specified-should-not-fail/7862)

<div class="topic-metadata">

**Author:** [@Michael\_Snell](https://discuss.elastic.co/u/Michael_Snell)\
**Replies:** 5\
**Last updated:** [June 3, 2012, 9:55am UTC](https://discuss.elastic.co/t/searching-an-empty-index-with-a-sort-field-specified-should-not-fail/7862 "2012-06-03T09:55:31Z")

</div>

Hi - In ElasticSearch 0.19.4, if we issue a search request via the Java API against an empty index with a sort field specified, eg searchSourceBuilder.sort("foo"), an error is returned: ...Parse Failure \[No mappin…

---

## [How to dump the entire contents of ES?](https://discuss.elastic.co/t/how-to-dump-the-entire-contents-of-es/4175)

<div class="topic-metadata">

**Author:** [@Daniel\_Maher](https://discuss.elastic.co/u/Daniel_Maher)\
**Replies:** 5\
**Last updated:** [May 10, 2011, 4:42am UTC](https://discuss.elastic.co/t/how-to-dump-the-entire-contents-of-es/4175 "2011-05-10T04:42:13Z")

</div>

Hello, I am curious to know what - if any - is the best-practice method for "dumping" the entire contents of Elasticsearch, say, for the purposes of doing a snapshot backup. Thank you. -- Daniel Maher Â« ca…

---

## [Change the type in index from String to Date](https://discuss.elastic.co/t/change-the-type-in-index-from-string-to-date/176426)

<div class="topic-metadata">

**Author:** [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Replies:** 3\
**Last updated:** [April 11, 2019, 3:41pm UTC](https://discuss.elastic.co/t/change-the-type-in-index-from-string-to-date/176426 "2019-04-11T15:41:28Z")

</div>

Hello, I parsed a date from the log but it's type in the index was String. I would like to change it to Date so that i could display lines in kibana in the same order of the log file. Any suggestions will be apperciat…

---

## [How to load json file in elastic search using kibana](https://discuss.elastic.co/t/how-to-load-json-file-in-elastic-search-using-kibana/115434)

<div class="topic-metadata">

**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\
**Replies:** 3\
**Last updated:** [January 14, 2018, 7:37pm UTC](https://discuss.elastic.co/t/how-to-load-json-file-in-elastic-search-using-kibana/115434 "2018-01-14T19:37:17Z")

</div>

I am firing command as fillow in kibana as follow POST /test/test/1 -d @zips.json Output as follow { "error": "Content-Type header \[text/plain\] is not supported", "status": 406 } Can anyone help me in this please.…

---

## [ES output using ILM settings "Malformed escape pair at index"](https://discuss.elastic.co/t/es-output-using-ilm-settings-malformed-escape-pair-at-index/178117)

<div class="topic-metadata">

**Author:** [@justinw](https://discuss.elastic.co/u/justinw)\
**Replies:** 1\
**Last updated:** [May 1, 2019, 11:42pm UTC](https://discuss.elastic.co/t/es-output-using-ilm-settings-malformed-escape-pair-at-index/178117 "2019-05-01T23:42:09Z")

</div>

Hi, Using logstash 6.7, I'm switching from daily rotated indices to ILM, and am seeing an error when trying to template the ILM settings. Error java.net.URISyntaxException: Malformed escape pair at index 0: %{dest}-6.…

---

## [How to rename field name in Elasticsearch with Time efficient?](https://discuss.elastic.co/t/how-to-rename-field-name-in-elasticsearch-with-time-efficient/299179)

<div class="topic-metadata">

**Author:** [@Haridoss\_M](https://discuss.elastic.co/u/Haridoss_M)\
**Replies:** 7\
**Last updated:** [March 10, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-rename-field-name-in-elasticsearch-with-time-efficient/299179 "2022-03-10T12:31:21Z")

</div>

I have been using the following query to rename fieldName. POST http://localhost:9200/INDEX\_NAME/\_update\_by\_query { "query": { "exists": { "field": "NEW\_FIELD\_NAME" } }, "script" : { "inline"…

---

## [ElasticSearch 5.x should query vs filtering](https://discuss.elastic.co/t/elasticsearch-5-x-should-query-vs-filtering/71952)

<div class="topic-metadata">

**Author:** [@Blade\_Watcher](https://discuss.elastic.co/u/Blade_Watcher)\
**Replies:** 2\
**Last updated:** [January 18, 2017, 1:38pm UTC](https://discuss.elastic.co/t/elasticsearch-5-x-should-query-vs-filtering/71952 "2017-01-18T13:38:44Z")

</div>

I have a problem with results come from an ES query. Filtering a query gives some confusing results, and I don't know how to overcome of it. So: { "query":{ "bool":{ "should":\[ { …

---

## [ES started but unable to open in browser (Linux)](https://discuss.elastic.co/t/es-started-but-unable-to-open-in-browser-linux/190746)

<div class="topic-metadata">

**Author:** [@SukeshGupta](https://discuss.elastic.co/u/SukeshGupta)\
**Replies:** 8\
**Last updated:** [July 18, 2019, 7:13am UTC](https://discuss.elastic.co/t/es-started-but-unable-to-open-in-browser-linux/190746 "2019-07-18T07:13:02Z")

</div>

Hi, My yml configuration looks like below : node.name: Cisco\_Dev\_Node cluster.name: Cisco\_Dev network.host: 192.168.0.10 discovery.seed\_hosts: \["192.168.0.10"\] http.port: 9201 cluster.initial\_master\_nodes: \["192.1…

---

## [APM server failed to listen:listen tcp 127.0.0.1:8200](https://discuss.elastic.co/t/apm-server-failed-to-listen-listen-tcp-127-0-0-1-8200/154664)

<div class="topic-metadata">

**Author:** [@shahid](https://discuss.elastic.co/u/shahid)\
**Replies:** 5\
**Last updated:** [November 21, 2018, 3:10pm UTC](https://discuss.elastic.co/t/apm-server-failed-to-listen-listen-tcp-127-0-0-1-8200/154664 "2018-11-21T15:10:47Z")

</div>

Hi APM Tech Team, I have ubuntu server 18.xx LTE on EC2 and i try to install the AMP server by using the below commands , But i am getting error. curl -L -O https://artifacts.elastic.co/downloads/apm-server/apm-serve…

---

## [How to check number of threads used for indexing in Elasticsearch?](https://discuss.elastic.co/t/how-to-check-number-of-threads-used-for-indexing-in-elasticsearch/174513)

<div class="topic-metadata">

**Author:** [@suvarna](https://discuss.elastic.co/u/suvarna)\
**Replies:** 3\
**Last updated:** [March 29, 2019, 2:51pm UTC](https://discuss.elastic.co/t/how-to-check-number-of-threads-used-for-indexing-in-elasticsearch/174513 "2019-03-29T14:51:47Z")

</div>

Hi My system having 28 cores and 112 cpus. How to check the number of threads used for indexing in Elasticsearch to enable the parallelism. How to check the number of threads used for merging in Elaticsearch. Please…

---

## [Send logs From Filebeat to 2 different logstash servers simultaneously](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-logstash-servers-simultaneously/212572)

<div class="topic-metadata">

**Author:** [@saravananveera](https://discuss.elastic.co/u/saravananveera)\
**Replies:** 2\
**Last updated:** [December 27, 2019, 3:27pm UTC](https://discuss.elastic.co/t/send-logs-from-filebeat-to-2-different-logstash-servers-simultaneously/212572 "2019-12-27T15:27:03Z")

</div>

Hi Team, My requirement is to configure filebeat output as two logstash servers and I need to send logs to defined 2 servers simultaneously. It is not load balance scenario. Both logstash servers should received same da…

---

## [ES Cluster Capacity Planning - Storage Limit](https://discuss.elastic.co/t/es-cluster-capacity-planning-storage-limit/198915)

<div class="topic-metadata">

**Author:** [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Replies:** 2\
**Last updated:** [September 16, 2019, 11:11am UTC](https://discuss.elastic.co/t/es-cluster-capacity-planning-storage-limit/198915 "2019-09-16T11:11:55Z")

</div>

In elasticsearch documentation for capacity planning, I read Per GB Heap will handle the 20 shards, with avg shard size of 20 - 40 GB. In ES Cluster it has 10 data nodes with the following config, 64 GB Heap (30 GB hea…

---

## [Excluding AWS ALB Health check from nginx logs](https://discuss.elastic.co/t/excluding-aws-alb-health-check-from-nginx-logs/108149)

<div class="topic-metadata">

**Author:** [@kersmacko](https://discuss.elastic.co/u/kersmacko)\
**Replies:** 2\
**Last updated:** [November 21, 2017, 6:21am UTC](https://discuss.elastic.co/t/excluding-aws-alb-health-check-from-nginx-logs/108149 "2017-11-21T06:21:29Z")

</div>

Hello, I've got a couple of NGINX instances running behind an ALB in AWS. I have Logstash forwarding the instances' access logs to elastic search instances. I've been trying to filter out the ELB health checks from be…

---

## [Elasticsearch streaming data](https://discuss.elastic.co/t/elasticsearch-streaming-data/145551)

<div class="topic-metadata">

**Author:** [@akaNightmare](https://discuss.elastic.co/u/akaNightmare)\
**Replies:** 1\
**Last updated:** [August 24, 2018, 1:35pm UTC](https://discuss.elastic.co/t/elasticsearch-streaming-data/145551 "2018-08-24T13:35:29Z")

</div>

Hello, I am wondering if ES supports some events when documents have been changes? Similar to https://docs.mongodb.com/manual/changeStreams/ I want to build a real-time app, and I want to know if there are any best pr…

---

## [Upgrade elasticsearch version from 7.10 to 7.13 error](https://discuss.elastic.co/t/upgrade-elasticsearch-version-from-7-10-to-7-13-error/274459)

<div class="topic-metadata">

**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\
**Replies:** 6\
**Last updated:** [May 31, 2021, 11:22am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-version-from-7-10-to-7-13-error/274459 "2021-05-31T11:22:05Z")

</div>

Hey guys, I am trying to update the version of elasticsearch to 7.13 from 7.10 and I am following the instructions from Rolling upgrades | Elasticsearch Guide \[7.13\] | Elastic but in the final when i procced with the i…

---

## [Cluster name in monitoring data](https://discuss.elastic.co/t/cluster-name-in-monitoring-data/120248)

<div class="topic-metadata">

**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\
**Replies:** 6\
**Last updated:** [March 7, 2018, 5:19pm UTC](https://discuss.elastic.co/t/cluster-name-in-monitoring-data/120248 "2018-03-07T17:19:35Z")

</div>

We are using a monitoring cluster to monitor multiple elastic clusters. I'm trying to write a query to check all the nodes of a given cluster name, but not sure which property in .monitoring indice would provide me with …

---

## [Elasticsearch 2.0 java client](https://discuss.elastic.co/t/elasticsearch-2-0-java-client/35301)

<div class="topic-metadata">

**Author:** [@George](https://discuss.elastic.co/u/George)\
**Replies:** 6\
**Last updated:** [November 23, 2015, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-2-0-java-client/35301 "2015-11-23T15:04:55Z")

</div>

Hello, I'm trying to use the elasticsearch 2.0 java client and to create a transport node which connects to an elasticsearch 1.6.0 cluster. However, I'm getting this exception: 2015-11-23 13:32:02 WARN netty:723 - \[…

---

## [Field expansion for \[\*\] matches too many fields, limit: 1024, got: 1998](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168)

<div class="topic-metadata">

**Author:** [@vaishno.avi](https://discuss.elastic.co/u/vaishno.avi)\
**Replies:** 1\
**Last updated:** [July 22, 2021, 10:27am UTC](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168 "2021-07-22T10:27:12Z")

</div>

Hello, We have recently moved from AWS ES 5.x to 7.10. While performing search operation I go get the above error. In total my fields are between 2500 to 4000 for now. I know these values are not good, but this somehow …

---

## [Unable to point metricbeat to monitor elasticsearch instance running on custom port](https://discuss.elastic.co/t/unable-to-point-metricbeat-to-monitor-elasticsearch-instance-running-on-custom-port/243908)

<div class="topic-metadata">

**Author:** [@Vijay\_Gharge](https://discuss.elastic.co/u/Vijay_Gharge)\
**Replies:** 1\
**Last updated:** [August 5, 2020, 6:08pm UTC](https://discuss.elastic.co/t/unable-to-point-metricbeat-to-monitor-elasticsearch-instance-running-on-custom-port/243908 "2020-08-05T18:08:54Z")

</div>

Hi, I am trying to configure metricbeat-oss to monitor ES-OSS instance hosted on custom port i.e. 7077 (which is further forwarded to 9200 in docker instance configured on localhost). However I am unable to monitor as e…

---

## [Date Invalid format too short](https://discuss.elastic.co/t/date-invalid-format-too-short/141046)

<div class="topic-metadata">

**Author:** [@magedmakled](https://discuss.elastic.co/u/magedmakled)\
**Replies:** 3\
**Last updated:** [July 22, 2018, 8:22pm UTC](https://discuss.elastic.co/t/date-invalid-format-too-short/141046 "2018-07-22T20:22:28Z")

</div>

I have an elasticsearch model with a field starts\_at with the mapping "starts\_at": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZ" } When I try to enter 2018-07-29T13:00:…

---

## [From json string to SearchResponse object](https://discuss.elastic.co/t/from-json-string-to-searchresponse-object/8575)

<div class="topic-metadata">

**Author:** [@Aykut\_Uysal](https://discuss.elastic.co/u/Aykut_Uysal)\
**Replies:** 3\
**Last updated:** [August 20, 2012, 1:52pm UTC](https://discuss.elastic.co/t/from-json-string-to-searchresponse-object/8575 "2012-08-20T13:52:55Z")

</div>

Hello all, I'm querying elasticsearch through its rest interface and getting a json result. I wonder if there is a common way to map returning json string into SearchResponse object which is available in Java API. …

---

## [Kibana 6 timeout below 2 minutes (every settings \> 10 minutes) with Gateway Timeout](https://discuss.elastic.co/t/kibana-6-timeout-below-2-minutes-every-settings-10-minutes-with-gateway-timeout/112420)

<div class="topic-metadata">

**Author:** [@DidierB](https://discuss.elastic.co/u/DidierB)\
**Replies:** 2\
**Last updated:** [December 21, 2017, 10:02am UTC](https://discuss.elastic.co/t/kibana-6-timeout-below-2-minutes-every-settings-10-minutes-with-gateway-timeout/112420 "2017-12-21T10:02:45Z")

</div>

Hello there, I use a Kibana 6.0.0 to request a very loaded Elasticsearch 6.0.0 to do insane dashboards. So the response time can go beyond 2 minutes. I agree to wait but Kibana seems to be less patient than me. After f…

---

## [Mapping on Index names with Date](https://discuss.elastic.co/t/mapping-on-index-names-with-date/81371)

<div class="topic-metadata">

**Author:** [@zero1](https://discuss.elastic.co/u/zero1)\
**Replies:** 2\
**Last updated:** [April 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/mapping-on-index-names-with-date/81371 "2017-04-06T04:52:30Z")

</div>

I have a document which I index this way: POST notifications/file { "system" : "server 1", "date" : "2017-04-04 10:00:00" } The date was mapped dynamically to string. In order to utilize the date in Kibana, I did…

---

## [Arranging priority in query](https://discuss.elastic.co/t/arranging-priority-in-query/2368)

<div class="topic-metadata">

**Author:** [@Maarten\_Roosendaal](https://discuss.elastic.co/u/Maarten_Roosendaal)\
**Replies:** 1\
**Last updated:** [June 10, 2015, 10:06pm UTC](https://discuss.elastic.co/t/arranging-priority-in-query/2368 "2015-06-10T22:06:44Z")

</div>

Hi, We have about 20 fields to search on: some fields are more important than others (product\_title and author are more important than synonyms or color) some fields can get exact matched (product\_title or author) s…

---

## [Logstash not updating last run metadata file](https://discuss.elastic.co/t/logstash-not-updating-last-run-metadata-file/133876)

<div class="topic-metadata">

**Author:** [@MichaelDz](https://discuss.elastic.co/u/MichaelDz)\
**Replies:** 0\
**Last updated:** [May 30, 2018, 1:14pm UTC](https://discuss.elastic.co/t/logstash-not-updating-last-run-metadata-file/133876 "2018-05-30T13:14:13Z")

</div>

In my Logstash I want to download from a database the most recent data using :sql\_last\_value in a query and tracking\_column option in conf file. I've set last\_run\_metadata\_path because I have 2 pipelines for the same ta…

---

## [Status : timeout when I'm starting Elasticsearch](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374)

<div class="topic-metadata">

**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\
**Replies:** 3\
**Last updated:** [November 5, 2019, 2:33pm UTC](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374 "2019-11-05T14:33:13Z")

</div>

Hi ! I just begin to learn the environment ELK one week ago and try to install Elasticsearch on my Debian 10 'Buster'. But I have a really big problem, when I'm doing "systemctl start elasticsearch.service" I got : A…

---

## [Visualize: "field" is a required parameter: How to solve?](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-how-to-solve/74619)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 3\
**Last updated:** [February 13, 2017, 3:37pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-how-to-solve/74619 "2017-02-13T15:37:03Z")

</div>

Hi, I have a big problem in kibana 5.2. I have developed dashboards and visualizations locally on my pc. Now I need to setup the new live system. I have some visualizations, which are splitting bars by a term aggrega…

---

## [Any suggestion of using kibana to create a burndown chart?](https://discuss.elastic.co/t/any-suggestion-of-using-kibana-to-create-a-burndown-chart/98300)

<div class="topic-metadata">

**Author:** [@capaneus](https://discuss.elastic.co/u/capaneus)\
**Replies:** 6\
**Last updated:** [September 11, 2017, 10:26am UTC](https://discuss.elastic.co/t/any-suggestion-of-using-kibana-to-create-a-burndown-chart/98300 "2017-09-11T10:26:46Z")

</div>

Hi, I’m looking to see if it’s possible to create burn down chart with Kibana. So for a burndown chart, it can be defined as open issue of the day(time), which means count or sum specified fields, aggregate with time/da…

---

## [Logstash and Kafka, nothing happening and nothing in the logs](https://discuss.elastic.co/t/logstash-and-kafka-nothing-happening-and-nothing-in-the-logs/43809)

<div class="topic-metadata">

**Author:** [@nvigier](https://discuss.elastic.co/u/nvigier)\
**Replies:** 5\
**Last updated:** [March 9, 2016, 4:57pm UTC](https://discuss.elastic.co/t/logstash-and-kafka-nothing-happening-and-nothing-in-the-logs/43809 "2016-03-09T16:57:16Z")

</div>

Hi everyone, I have a setup that looks like this: (The data nodes also have the master role) With Rsyslog used as a lightweight forwarder between the rest of my network and my ELK setup, storing the logs in Kafka so…

---

## [Stateful contextual tagging](https://discuss.elastic.co/t/stateful-contextual-tagging/36036)

<div class="topic-metadata">

**Author:** [@barisacar](https://discuss.elastic.co/u/barisacar)\
**Replies:** 7\
**Last updated:** [December 6, 2015, 10:38pm UTC](https://discuss.elastic.co/t/stateful-contextual-tagging/36036 "2015-12-06T22:38:41Z")

</div>

Hi, I have a logfile a bit like this: ... Starting task 123456 Reticulating splines Sequencing Particles Computing Optimal Bin Packing Integrating Curves Finished processing task 123456 Waiting for another task Star…

---

## [Elasticsearch v8 Java API client adding index settings](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-adding-index-settings/310888)

<div class="topic-metadata">

**Author:** [@ijaxahmed](https://discuss.elastic.co/u/ijaxahmed)\
**Replies:** 4\
**Last updated:** [July 29, 2022, 3:42pm UTC](https://discuss.elastic.co/t/elasticsearch-v8-java-api-client-adding-index-settings/310888 "2022-07-29T15:42:32Z")

</div>

How to set index setting while creation using Elasticsearch v8 Java API client. I can able to set numberOfShards and numberOfReplicas using below syntax but could not able to set analysis due to confusing builder syntax. …

---

## [Display multiple values in vertical bar graph](https://discuss.elastic.co/t/display-multiple-values-in-vertical-bar-graph/152724)

<div class="topic-metadata">

**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\
**Replies:** 4\
**Last updated:** [October 23, 2018, 12:43pm UTC](https://discuss.elastic.co/t/display-multiple-values-in-vertical-bar-graph/152724 "2018-10-23T12:43:36Z")

</div>

Hi I have a document that contains a minimum value, average value and maximum value inside. I want to display those three values in the same bar in the x-axis, displaying in green the minimum value, blue the average, a…

---

## [Huge 4 minute delay between adding a document and it showing up in Kibana](https://discuss.elastic.co/t/huge-4-minute-delay-between-adding-a-document-and-it-showing-up-in-kibana/84183)

<div class="topic-metadata">

**Author:** [@Menno\_B](https://discuss.elastic.co/u/Menno_B)\
**Replies:** 4\
**Last updated:** [May 2, 2017, 5:38am UTC](https://discuss.elastic.co/t/huge-4-minute-delay-between-adding-a-document-and-it-showing-up-in-kibana/84183 "2017-05-02T05:38:58Z")

</div>

Hi all, When logstash posts even a single document to ElasticSearch, it takes about 4 minutes for it to show up in Kibana. I installed the ELK stack (ES5.3) on a fresh Debian install on old hardware. The machine has …

[Previous page](https://discuss.elastic.co/top.md?page=657&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=659&per_page=50&period=all)
