# Top

**URL:** https://discuss.elastic.co/top.md?page=666&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 667

---

## [Filebeat multiline java app log4j logs](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018)

<div class="topic-metadata">

**Author:** [@ktella](https://discuss.elastic.co/u/ktella)\
**Replies:** 4\
**Last updated:** [October 8, 2017, 11:26am UTC](https://discuss.elastic.co/t/filebeat-multiline-java-app-log4j-logs/102018 "2017-10-08T11:26:46Z")

</div>

Need some help with filebeat multiline configuration of java App logs. I'm pasting sample logs from my app. For each request Ill have a Request and Response lines with some extra lines sometimes. All these logging is do…

---

## [Installing Opendistro ES on Amazon Linux - ES running but empty reply form server](https://discuss.elastic.co/t/installing-opendistro-es-on-amazon-linux-es-running-but-empty-reply-form-server/220318)

<div class="topic-metadata">

**Author:** [@reshma\_ramakrishnan](https://discuss.elastic.co/u/reshma_ramakrishnan)\
**Replies:** 1\
**Last updated:** [February 21, 2020, 3:14pm UTC](https://discuss.elastic.co/t/installing-opendistro-es-on-amazon-linux-es-running-but-empty-reply-form-server/220318 "2020-02-21T15:14:27Z")

</div>

I am installing Opendistro Elasticsearch using RPM into Amazon Linux based EC2 instance. I see my ES is running but when I do curl http://localhost:9200/ it returns the below error: curl: (52) Empty reply from server …

---

## [Filebeats @timestamp 可也删除或者更改格式？](https://discuss.elastic.co/t/filebeats-timestamp/77100)

<div class="topic-metadata">

**Author:** [@zhenxing914](https://discuss.elastic.co/u/zhenxing914)\
**Replies:** 3\
**Last updated:** [May 29, 2017, 3:06pm UTC](https://discuss.elastic.co/t/filebeats-timestamp/77100 "2017-05-29T15:06:45Z")

</div>

我想通过filebeats收集日志，然后发送给eagle进行处理， 但是eagle不能处理filebeats @timestamp这个字段（2017-03-01T02:30:30.558Z） 我需要将2017-03-01T02:30:30.558Z 转换成 2017-03-01 02:30:30,558 filebeats @timestamp 可也删除或者更改格式？

---

## [FileBeat Connection reset by peer](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer/60153)

<div class="topic-metadata">

**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\
**Replies:** 3\
**Last updated:** [September 12, 2016, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer/60153 "2016-09-12T15:04:38Z")

</div>

Hello. I'm trying to get some log files from windows pc. And I can observe the following log message every time when I restart FileBeat service on Windows PC {:timestamp=\>"2016-09-09T04:59:41.233000-0400", :message=\>"B…

---

## [\[ Error parsing CSV \] : :exception=\>#\<CSV::MalformedCSVError: Illegal quoting in line 1.\>](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 2\
**Last updated:** [January 27, 2021, 4:55pm UTC](https://discuss.elastic.co/t/error-parsing-csv-exception-csv-illegal-quoting-in-line-1/262370 "2021-01-27T16:55:12Z")

</div>

Hello, I am trying to parse some csv logs using logstash and I am getting this error: \[WARN \] 2021-01-27 14:05:31.217 \[\[main\]\>worker2\] csv - Error parsing csv {:field=\>"message", :source=\>"\\"2020-12-24 00:01:23\\", \\"29…

---

## [How to switch from Kibana dashboard to Elastic dashboard](https://discuss.elastic.co/t/how-to-switch-from-kibana-dashboard-to-elastic-dashboard/304876)

<div class="topic-metadata">

**Author:** [@amenbs](https://discuss.elastic.co/u/amenbs)\
**Replies:** 6\
**Last updated:** [May 17, 2022, 1:04am UTC](https://discuss.elastic.co/t/how-to-switch-from-kibana-dashboard-to-elastic-dashboard/304876 "2022-05-17T01:04:11Z")

</div>

I have Elasticsearch , Logstash and Kibana version 6.8 on centos 7 VM and i want to access to elastic dashboard but every time i go to ip:5601 Kibana dashboard opens. what should i do to access this dashboard : this …

---

## [BulkProcessor can not set refresh policy](https://discuss.elastic.co/t/bulkprocessor-can-not-set-refresh-policy/95630)

<div class="topic-metadata">

**Author:** [@LinPower](https://discuss.elastic.co/u/LinPower)\
**Replies:** 4\
**Last updated:** [August 4, 2017, 10:10am UTC](https://discuss.elastic.co/t/bulkprocessor-can-not-set-refresh-policy/95630 "2017-08-04T10:10:34Z")

</div>

I use BulkProcessor to index documents in java. And I want to set RefreshPolicy to each BulkRequest that processor created. But I can not find a method to do it. Is there a way to do so that I do not find? Or why is Bulk…

---

## [How to search dense\_vector](https://discuss.elastic.co/t/how-to-search-dense-vector/166097)

<div class="topic-metadata">

**Author:** [@LiuGangR](https://discuss.elastic.co/u/LiuGangR)\
**Replies:** 1\
**Last updated:** [January 29, 2019, 7:24am UTC](https://discuss.elastic.co/t/how-to-search-dense-vector/166097 "2019-01-29T07:24:47Z")

</div>

which query is used to search dense\_vector. There is no query type to work. dense\_vector is the new feature of es 7.0 https://www.elastic.co/guide/en/elasticsearch/reference/master/dense-vector.html

---

## [How to use low level client with scan and scroll?](https://discuss.elastic.co/t/how-to-use-low-level-client-with-scan-and-scroll/47527)

<div class="topic-metadata">

**Author:** [@Garrett\_Johnson](https://discuss.elastic.co/u/Garrett_Johnson)\
**Replies:** 0\
**Last updated:** [April 15, 2016, 5:26pm UTC](https://discuss.elastic.co/t/how-to-use-low-level-client-with-scan-and-scroll/47527 "2016-04-15T17:26:05Z")

</div>

Does anyone have a sample of how to use scan and scroll with C# and the low level client? Not having any luck. NEST examples not helping.

---

## [Changing the Font size or Font Color in Kibana widget Title](https://discuss.elastic.co/t/changing-the-font-size-or-font-color-in-kibana-widget-title/299417)

<div class="topic-metadata">

**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\
**Replies:** 3\
**Last updated:** [March 30, 2022, 4:36pm UTC](https://discuss.elastic.co/t/changing-the-font-size-or-font-color-in-kibana-widget-title/299417 "2022-03-30T16:36:10Z")

</div>

I need to update the Font styles (color, size, ..) in Kibana widgets. Please let me know the options to do that in Kibana UI.

---

## [Elasticsearch 7.5.1 does not have elasticsearch-keystore command](https://discuss.elastic.co/t/elasticsearch-7-5-1-does-not-have-elasticsearch-keystore-command/224909)

<div class="topic-metadata">

**Author:** [@Yanislav\_Shetrev](https://discuss.elastic.co/u/Yanislav_Shetrev)\
**Replies:** 2\
**Last updated:** [March 25, 2020, 2:29pm UTC](https://discuss.elastic.co/t/elasticsearch-7-5-1-does-not-have-elasticsearch-keystore-command/224909 "2020-03-25T14:29:15Z")

</div>

Hello, I have recently upgraded form elasticsearch 6.5.2 to 7.5.1 and when trying to add secrets to the keystore via bin/elasticsearch-keystore add I get the error message that the command was not found. There is no bin…

---

## [Kibana index patterns 如何自动添加索引模式](https://discuss.elastic.co/t/kibana-index-patterns/136778)

<div class="topic-metadata">

**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\
**Replies:** 2\
**Last updated:** [June 28, 2018, 3:40am UTC](https://discuss.elastic.co/t/kibana-index-patterns/136778 "2018-06-28T03:40:45Z")

</div>

大家好！ 由于我现的索引比较多，现在的每个索引都得手动一个个添加，太费时了，有没有好的法办可以批量添加或者是调用相关的API？

---

## [Kibana Discover generates Error Loading data but data shows up in Devtool](https://discuss.elastic.co/t/kibana-discover-generates-error-loading-data-but-data-shows-up-in-devtool/253609)

<div class="topic-metadata">

**Author:** [@RayS](https://discuss.elastic.co/u/RayS)\
**Replies:** 5\
**Last updated:** [November 5, 2020, 10:09pm UTC](https://discuss.elastic.co/t/kibana-discover-generates-error-loading-data-but-data-shows-up-in-devtool/253609 "2020-11-05T22:09:31Z")

</div>

I have heartbeat logging to one single index. When I go to Discover and set it for any time frame (I usually use list 60 minutes) I get Error loading data display on the screen. When I click on See Full Error this is…

---

## [Unable to create scripted field](https://discuss.elastic.co/t/unable-to-create-scripted-field/252028)

<div class="topic-metadata">

**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\
**Replies:** 5\
**Last updated:** [October 14, 2020, 11:43am UTC](https://discuss.elastic.co/t/unable-to-create-scripted-field/252028 "2020-10-14T11:43:52Z")

</div>

Hello, Elastic version: 7.9.1 Kibana version: 7.9.0 I am struggling to create a scripted field. To put it on perspective, I have the field "apache.status.total\_kbytes". And I would like to create a scripted field name…

---

## [Last 15/30 min data being displayed in UTC whereas in Today its the actual Timestamp inserted in ES](https://discuss.elastic.co/t/last-15-30-min-data-being-displayed-in-utc-whereas-in-today-its-the-actual-timestamp-inserted-in-es/127590)

<div class="topic-metadata">

**Author:** [@jiouser](https://discuss.elastic.co/u/jiouser)\
**Replies:** 8\
**Last updated:** [April 17, 2018, 10:19am UTC](https://discuss.elastic.co/t/last-15-30-min-data-being-displayed-in-utc-whereas-in-today-its-the-actual-timestamp-inserted-in-es/127590 "2018-04-17T10:19:42Z")

</div>

Hello Everyone. My filebeat is pushing logs into ES via pipeline. The current Timezone (IST) is applicable on the filebeat server and also on the ES server. As such, if log gets generated at 11/04/2018 13:40:00 IST same…

---

## [Comparing 2 sources of log input ( using fuzzy? hash? term ?)](https://discuss.elastic.co/t/comparing-2-sources-of-log-input-using-fuzzy-hash-term/29256)

<div class="topic-metadata">

**Author:** [@noelyim](https://discuss.elastic.co/u/noelyim)\
**Replies:** 6\
**Last updated:** [September 14, 2015, 4:59pm UTC](https://discuss.elastic.co/t/comparing-2-sources-of-log-input-using-fuzzy-hash-term/29256 "2015-09-14T16:59:20Z")

</div>

I need to compare 2 log files from 2 different hosts ( eventually 2 sources of breadcrumbs). How to do it with logstash and elasticsearch?

---

## [Non-zero metrics in the last 30s (filebeat with docker)](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat-with-docker/250859)

<div class="topic-metadata">

**Author:** [@linhonghui](https://discuss.elastic.co/u/linhonghui)\
**Replies:** 4\
**Last updated:** [October 4, 2020, 9:17am UTC](https://discuss.elastic.co/t/non-zero-metrics-in-the-last-30s-filebeat-with-docker/250859 "2020-10-04T09:17:03Z")

</div>

I used docker to run filebeat and always got this message "Non-zero metrics in the last 30s". It seems not to work. file docker-compose.yml: version: '2' services: filebeat: image: elastic/filebea…

---

## [Static groovy script and java security access control issue](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516)

<div class="topic-metadata">

**Author:** [@elkonaut](https://discuss.elastic.co/u/elkonaut)\
**Replies:** 4\
**Last updated:** [April 29, 2016, 7:46am UTC](https://discuss.elastic.co/t/static-groovy-script-and-java-security-access-control-issue/48516 "2016-04-29T07:46:10Z")

</div>

Hi, I want to use a groovy script: 1.) to calculate a value (this works) and 2.) to add the newly calculated value to the document using the update API The script is stored in /etc/elasticsearch/scripts and I underst…

---

## [Filebeat fails with connecting to Kibana over GET 127.0.0.1:5601](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193)

<div class="topic-metadata">

**Author:** [@makrellen](https://discuss.elastic.co/u/makrellen)\
**Replies:** 7\
**Last updated:** [April 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-fails-with-connecting-to-kibana-over-get-127-0-0-1-5601/269193 "2021-04-08T19:10:45Z")

</div>

Description of problem I'm trying to get Filebeat to work on my Ubuntu VPS via docker-compose and I've set it up behind my caddy-reverse proxy and configured everything as I should according to the Filebeat docs, but I …

---

## [Isue error by elasticsearch-rest-high-level-client to create Index](https://discuss.elastic.co/t/isue-error-by-elasticsearch-rest-high-level-client-to-create-index/269281)

<div class="topic-metadata">

**Author:** [@votouch904931293](https://discuss.elastic.co/u/votouch904931293)\
**Replies:** 7\
**Last updated:** [April 7, 2021, 12:49am UTC](https://discuss.elastic.co/t/isue-error-by-elasticsearch-rest-high-level-client-to-create-index/269281 "2021-04-07T00:49:14Z")

</div>

i use doc url:Maven Repository | Java REST Client \[6.8\] | Elastic i has get init and try to cread indexrequest , the system exception error,for this Handler dispatch failed; nested exception is java.lang.NoSuchMethodE…

---

## [Full Content Search within documents in S3](https://discuss.elastic.co/t/full-content-search-within-documents-in-s3/70729)

<div class="topic-metadata">

**Author:** [@Shraddha](https://discuss.elastic.co/u/Shraddha)\
**Replies:** 2\
**Last updated:** [January 5, 2017, 10:27pm UTC](https://discuss.elastic.co/t/full-content-search-within-documents-in-s3/70729 "2017-01-05T22:27:17Z")

</div>

I have documents stored in S3 and am using ElasticSearch for indexing. I need to do a full text search within the contents of the files in S3 using NodeJs. Can you give me an example which includes the scenario I have P…

---

## [Missing kbn-version header](https://discuss.elastic.co/t/missing-kbn-version-header/47771)

<div class="topic-metadata">

**Author:** [@Hyojoung\_Shin](https://discuss.elastic.co/u/Hyojoung_Shin)\
**Replies:** 2\
**Last updated:** [April 19, 2016, 10:06am UTC](https://discuss.elastic.co/t/missing-kbn-version-header/47771 "2016-04-19T10:06:11Z")

</div>

Hi All, I am using graph and it works fine on Kibana. When I copy the Request from kibana and paste it to terminal it shows Missing kbn-version header error. Also, Does graph has java api to get 'Response' that I can…

---

## [Transport.tcp.compress](https://discuss.elastic.co/t/transport-tcp-compress/20365)

<div class="topic-metadata">

**Author:** [@David\_Ashby](https://discuss.elastic.co/u/David_Ashby)\
**Replies:** 2\
**Last updated:** [January 14, 2015, 12:29pm UTC](https://discuss.elastic.co/t/transport-tcp-compress/20365 "2015-01-14T12:29:29Z")

</div>

Is there a reason that this is disabled by default? Are there downsides to activating it? I'm assuming it results in extra CPU burn during intra-cluster communication. -- You received this message because you ar…

---

## [Install Elasticsearch as a service - Windows](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463)

<div class="topic-metadata">

**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\
**Replies:** 4\
**Last updated:** [November 29, 2022, 9:41am UTC](https://discuss.elastic.co/t/install-elasticsearch-as-a-service-windows/319463 "2022-11-29T09:41:19Z")

</div>

HI all, I have a fresh installation of Elasticsearch 8.5 and Kibana 8.5 on my Windows Server. I would like to install Elasticsearch as a Service that it gets started as soon as the Server starts and Kibana as well. Ho…

---

## [Error Registry File](https://discuss.elastic.co/t/error-registry-file/80681)

<div class="topic-metadata">

**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\
**Replies:** 4\
**Last updated:** [March 31, 2017, 7:57am UTC](https://discuss.elastic.co/t/error-registry-file/80681 "2017-03-31T07:57:39Z")

</div>

Hi everyone, I have an issue with Filebeat in Windows. Sometimes, when the computer is rebooted, Filebeat is not able to start. I see in the log the next error: 2017-03-30T11:06:31+01:00 ERR Error decoding old state: …

---

## [Kibana dashboards embedded in my website became blank after a while](https://discuss.elastic.co/t/kibana-dashboards-embedded-in-my-website-became-blank-after-a-while/101915)

<div class="topic-metadata">

**Author:** [@nicedee](https://discuss.elastic.co/u/nicedee)\
**Replies:** 8\
**Last updated:** [September 28, 2017, 5:19pm UTC](https://discuss.elastic.co/t/kibana-dashboards-embedded-in-my-website-became-blank-after-a-while/101915 "2017-09-28T17:19:05Z")

</div>

i embedded two dashboards in my website, one with summary statistics about year-to-date info, the other with summary statistics about the last 24 hours info. the dashboards have been showing nice statistics since a week…

---

## [Trying to setup beats](https://discuss.elastic.co/t/trying-to-setup-beats/257794)

<div class="topic-metadata">

**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\
**Replies:** 6\
**Last updated:** [January 4, 2021, 5:22pm UTC](https://discuss.elastic.co/t/trying-to-setup-beats/257794 "2021-01-04T17:22:47Z")

</div>

I had deployed Elasticsearch cluster along with kibana in GCP. I was trying to deploy beats as well. I had used the beats yaml files which are in the following link: I just changed the elastic and kibana references…

---

## [How to calculate web page load times?](https://discuss.elastic.co/t/how-to-calculate-web-page-load-times/67945)

<div class="topic-metadata">

**Author:** [@oil](https://discuss.elastic.co/u/oil)\
**Replies:** 6\
**Last updated:** [December 7, 2016, 12:33pm UTC](https://discuss.elastic.co/t/how-to-calculate-web-page-load-times/67945 "2016-12-07T12:33:57Z")

</div>

Hi everyone, I'm using Packetbeat to capture traffic from an Internet access network. How can I calculate and chart the times taken by individual users' devices to load web pages, over some time period? As you can see, …

---

## [How to add new node to Elasticsearch cluster with Https](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942)

<div class="topic-metadata">

**Author:** [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\
**Replies:** 7\
**Last updated:** [January 16, 2023, 2:00pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942 "2023-01-16T14:00:19Z")

</div>

Hi, I'm using a single-node Elasticsearch instance. I want to add another node to my cluster by Enrolling the new node. But I have the same Issue: ERROR: Failed to determine the health of the cluster with elasticsearc…

---

## [How to Search elasticsearch Indexes name filter on Index Creation date](https://discuss.elastic.co/t/how-to-search-elasticsearch-indexes-name-filter-on-index-creation-date/259479)

<div class="topic-metadata">

**Author:** [@yael](https://discuss.elastic.co/u/yael)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 11:24pm UTC](https://discuss.elastic.co/t/how-to-search-elasticsearch-indexes-name-filter-on-index-creation-date/259479 "2020-12-23T23:24:21Z")

</div>

How can I filter the result I get from the query: GET /\_cat/indices?h=h,s,i,id,p,r,dc,dd,ss,creation.date.string to all indexes from specific creation.date. Thanks Yael

---

## [Kibana 7.9.1 to 7.9.2 failure](https://discuss.elastic.co/t/kibana-7-9-1-to-7-9-2-failure/249883)

<div class="topic-metadata">

**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\
**Replies:** 3\
**Last updated:** [October 15, 2020, 7:16am UTC](https://discuss.elastic.co/t/kibana-7-9-1-to-7-9-2-failure/249883 "2020-10-15T07:16:59Z")

</div>

Ok I'm at a loss normally the updates even failed ones are easy to fix. Roll back to 7.9.1 worked thankfully. On the journal log when attempting to start kibana 7.9.2 with the elasticsearch already updated to 7.9.2 and …

---

## [Kibana 4 stuck at Loading](https://discuss.elastic.co/t/kibana-4-stuck-at-loading/2065)

<div class="topic-metadata">

**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\
**Replies:** 2\
**Last updated:** [June 6, 2015, 2:55pm UTC](https://discuss.elastic.co/t/kibana-4-stuck-at-loading/2065 "2015-06-06T14:55:49Z")

</div>

Per the docs: https://www.elastic.co/guide/en/kibana/current/setup.html This screen never gets to the Create button....it sits at Loading and maxes out the server CPU. After a while I get a Fatal Error: Fatal E…

---

## [Can't run ElasticSearch](https://discuss.elastic.co/t/cant-run-elasticsearch/238842)

<div class="topic-metadata">

**Author:** [@zepp\_e](https://discuss.elastic.co/u/zepp_e)\
**Replies:** 5\
**Last updated:** [July 22, 2020, 8:11am UTC](https://discuss.elastic.co/t/cant-run-elasticsearch/238842 "2020-07-22T08:11:58Z")

</div>

Hey guys, I try to install ElasticSearch but when I download it and try to set it up via the command window it looks like the following: '// C:\\Users\\josef\>cd C:\\Program Files\\elasticsearch-7.8.0 C:\\Program Files\\elas…

---

## [Sorting of fields with special charecters](https://discuss.elastic.co/t/sorting-of-fields-with-special-charecters/115481)

<div class="topic-metadata">

**Author:** [@SawyerFord](https://discuss.elastic.co/u/SawyerFord)\
**Replies:** 5\
**Last updated:** [January 15, 2018, 10:01am UTC](https://discuss.elastic.co/t/sorting-of-fields-with-special-charecters/115481 "2018-01-15T10:01:31Z")

</div>

Currently we have used the elastic sort sorting capability in our Java application for sorting or a field called description, but the sort does not return a correct order. Our field consists of special charecters, (#,$,…

---

## [Spam over the past few days](https://discuss.elastic.co/t/spam-over-the-past-few-days/31214)

<div class="topic-metadata">

**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Replies:** 5\
**Last updated:** [September 29, 2015, 1:33am UTC](https://discuss.elastic.co/t/spam-over-the-past-few-days/31214 "2015-09-29T01:33:42Z")

</div>

Apologies about all of this folks, we're working on a mitigation strategy \[:smile:\] If you see something that looks like spam we ask that you flag it for us to action.

---

## [Fleet Server 8.8.1 on prems boot issue](https://discuss.elastic.co/t/fleet-server-8-8-1-on-prems-boot-issue/337312)

<div class="topic-metadata">

**Author:** [@johnjohnsp1](https://discuss.elastic.co/u/johnjohnsp1)\
**Replies:** 3\
**Last updated:** [June 30, 2023, 2:08pm UTC](https://discuss.elastic.co/t/fleet-server-8-8-1-on-prems-boot-issue/337312 "2023-06-30T14:08:46Z")

</div>

Hi, i have deployed on prems elasticsearch,kibana and fleet (version 8) on a Centos 8 distro, now every time i boot up the server i see the fleet service is up and running, but, once i go to the fleet sheet i see the ag…

---

## [Evacuate data off of a node?](https://discuss.elastic.co/t/evacuate-data-off-of-a-node/15209)

<div class="topic-metadata">

**Author:** [@natefox](https://discuss.elastic.co/u/natefox)\
**Replies:** 4\
**Last updated:** [January 11, 2014, 7:57pm UTC](https://discuss.elastic.co/t/evacuate-data-off-of-a-node/15209 "2014-01-11T19:57:37Z")

</div>

Is there a way to tell a node to remove all of its data (spread it back out among the other nodes) so that I can shut it down and not deal with a rebalance/re-replicate once its down? If I have 2 copies of each…

---

## [Using Watcher to drive ticket life cycles?](https://discuss.elastic.co/t/using-watcher-to-drive-ticket-life-cycles/93046)

<div class="topic-metadata">

**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\
**Replies:** 2\
**Last updated:** [July 19, 2017, 8:05am UTC](https://discuss.elastic.co/t/using-watcher-to-drive-ticket-life-cycles/93046 "2017-07-19T08:05:39Z")

</div>

Trying to understand the throttle and acknowledge features, as part of evaluating whether Watcher will meet our use cases. This is a paper study so far - I haven't tried actually running Watcher yet for commercial and le…

---

## [Snapshot Error](https://discuss.elastic.co/t/snapshot-error/68819)

<div class="topic-metadata">

**Author:** [@gogularaja](https://discuss.elastic.co/u/gogularaja)\
**Replies:** 8\
**Last updated:** [December 13, 2016, 5:01pm UTC](https://discuss.elastic.co/t/snapshot-error/68819 "2016-12-13T17:01:00Z")

</div>

Hi All, I have been facing issue while taking snapshot of the indices in elasticsearch cluster. Command : curl -XPUT localhost:9200/\_snapshot/first\_1 -d '{ "type": "fs", "settings": { "location": "/tm…

---

## [Function score - boost\_mode replace when functions are empty](https://discuss.elastic.co/t/function-score-boost-mode-replace-when-functions-are-empty/130937)

<div class="topic-metadata">

**Author:** [@giga811](https://discuss.elastic.co/u/giga811)\
**Replies:** 1\
**Last updated:** [May 11, 2018, 7:44am UTC](https://discuss.elastic.co/t/function-score-boost-mode-replace-when-functions-are-empty/130937 "2018-05-11T07:44:45Z")

</div>

Hello, I have a question. Our search platform generates our query dynamically depending on the query. We use function\_score scoring to modify our search ordering. "boost\_mode" is "replace" in order to take only our "f…

---

## [Curator snapshot action timeout override](https://discuss.elastic.co/t/curator-snapshot-action-timeout-override/58362)

<div class="topic-metadata">

**Author:** [@KrzysztofSendor](https://discuss.elastic.co/u/KrzysztofSendor)\
**Replies:** 2\
**Last updated:** [August 19, 2016, 7:49am UTC](https://discuss.elastic.co/t/curator-snapshot-action-timeout-override/58362 "2016-08-19T07:49:37Z")

</div>

Hi all, I've been configuring curator and creating actions for it today and here is my question/problem. Based on documentation found here default value for timeout is 30 (seconds) and in case of actions like snapsho…

---

## [How can i get whole data response from elastic search without aggregation in kibana plugin?](https://discuss.elastic.co/t/how-can-i-get-whole-data-response-from-elastic-search-without-aggregation-in-kibana-plugin/91428)

<div class="topic-metadata">

**Author:** [@ayadirh](https://discuss.elastic.co/u/ayadirh)\
**Replies:** 5\
**Last updated:** [July 7, 2017, 5:36pm UTC](https://discuss.elastic.co/t/how-can-i-get-whole-data-response-from-elastic-search-without-aggregation-in-kibana-plugin/91428 "2017-07-07T17:36:58Z")

</div>

Use case: I want to append a column in data grid(custom) with green, red signal based on difference in time in two different columns? I want to display in one go instead of adding sub buckets and metrics. I can choose w…

---

## [How to work with realtime data](https://discuss.elastic.co/t/how-to-work-with-realtime-data/173491)

<div class="topic-metadata">

**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\
**Replies:** 3\
**Last updated:** [March 26, 2019, 12:34pm UTC](https://discuss.elastic.co/t/how-to-work-with-realtime-data/173491 "2019-03-26T12:34:21Z")

</div>

I want to send realtime logs from a proxy to elasticsearch (through logstash) and display information about those logs realtime. I already have made it possible to import a csv file into elasticsearch (through logstash)…

---

## [Listen loop error: IOError: closed stream](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/127083)

<div class="topic-metadata">

**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\
**Replies:** 4\
**Last updated:** [April 10, 2018, 10:52pm UTC](https://discuss.elastic.co/t/listen-loop-error-ioerror-closed-stream/127083 "2018-04-10T22:52:55Z")

</div>

Hi, When I start the logstash as a service, I receive the folowing error. I have set the pipeline.yml with a single entry as a conf file. at the same time when I start the logstash in commande line, it run correctly an…

---

## [SLI / SLO dashboard](https://discuss.elastic.co/t/sli-slo-dashboard/230116)

<div class="topic-metadata">

**Author:** [@Vincent\_Vallet](https://discuss.elastic.co/u/Vincent_Vallet)\
**Replies:** 2\
**Last updated:** [May 6, 2020, 9:27am UTC](https://discuss.elastic.co/t/sli-slo-dashboard/230116 "2020-05-06T09:27:34Z")

</div>

Hi there, I'm a new user of Kibana and I want to create a custom dashboard. More precisely an SLO/SLI dashboard. I want to begin with simple formulas such as: 99,9 % of successful requests on service A (EB: 1% of tot…

---

## [How to exclude a sub directory and all of it's files](https://discuss.elastic.co/t/how-to-exclude-a-sub-directory-and-all-of-its-files/137317)

<div class="topic-metadata">

**Author:** [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\
**Replies:** 1\
**Last updated:** [June 26, 2018, 2:59pm UTC](https://discuss.elastic.co/t/how-to-exclude-a-sub-directory-and-all-of-its-files/137317 "2018-06-26T14:59:18Z")

</div>

Hello, I am trying to exclude a sub directory and all of its files in file beat . In the documentation, i know that there is a flag called "exclude\_files". But having hard time to figure out how to use it to exclude a…

---

## [Multi query support for multiple visualizations in kibana dashboard](https://discuss.elastic.co/t/multi-query-support-for-multiple-visualizations-in-kibana-dashboard/197867)

<div class="topic-metadata">

**Author:** [@kev12](https://discuss.elastic.co/u/kev12)\
**Replies:** 3\
**Last updated:** [September 24, 2019, 10:30am UTC](https://discuss.elastic.co/t/multi-query-support-for-multiple-visualizations-in-kibana-dashboard/197867 "2019-09-24T10:30:08Z")

</div>

Hey, i am trying to migrate from kibana 3 to 5 and was wondering if this feature documented at https://www.elastic.co/guide/en/kibana/3.0/multiple-queries.html is available from kibana 4.0 and above. Specifically in kiba…

---

## [An internal server error occurred](https://discuss.elastic.co/t/an-internal-server-error-occurred/163525)

<div class="topic-metadata">

**Author:** [@harsh25](https://discuss.elastic.co/u/harsh25)\
**Replies:** 3\
**Last updated:** [January 10, 2019, 10:47am UTC](https://discuss.elastic.co/t/an-internal-server-error-occurred/163525 "2019-01-10T10:47:05Z")

</div>

Hi There, We are getting internal error occurred for Kibana. We are using elasticsearch-5.6.2 kibana-5.6.2-linux-x86\_64 It running fine on test environment and we are getting issue on UAT environment. Not sure what e…

---

## [Mapping for nested object with dynamic keys, uniform values](https://discuss.elastic.co/t/mapping-for-nested-object-with-dynamic-keys-uniform-values/11919)

<div class="topic-metadata">

**Author:** [@Carl\_C](https://discuss.elastic.co/u/Carl_C)\
**Replies:** 3\
**Last updated:** [July 10, 2013, 9:54pm UTC](https://discuss.elastic.co/t/mapping-for-nested-object-with-dynamic-keys-uniform-values/11919 "2013-07-10T21:54:07Z")

</div>

Hi all, I have a specific question about mapping definitions that I think will help with my understanding of mapping more generally. Suppose I have a document that looks something like the following: { "doc"…

---

## [Integration of Winlogbeat and Filebeat](https://discuss.elastic.co/t/integration-of-winlogbeat-and-filebeat/50510)

<div class="topic-metadata">

**Author:** [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\
**Replies:** 7\
**Last updated:** [July 13, 2016, 2:38am UTC](https://discuss.elastic.co/t/integration-of-winlogbeat-and-filebeat/50510 "2016-07-13T02:38:33Z")

</div>

The company IT wants to reduce the number of agents. So is there any way to put the fuctions of winlogbeat and filebeat together? Thanks!

[Previous page](https://discuss.elastic.co/top.md?page=665&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=667&per_page=50&period=all)
