# Top

**URL:** https://discuss.elastic.co/top.md?page=667&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 668

---

## [Counting the last element of each aggregation](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865)

<div class="topic-metadata">

**Author:** [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)\
**Replies:** 5\
**Last updated:** [January 19, 2018, 3:54pm UTC](https://discuss.elastic.co/t/counting-the-last-element-of-each-aggregation/115865 "2018-01-19T15:54:37Z")

</div>

Hello, I have logs with the fields: . IP . Timestamp . URI . SessionId Each log shows the time (timestamp) the URI was visited. The SessionId is a field I created by concatenating IP with Timestamp (without the min…

---

## [Increase logstash Events Received Rate when using kafka as input](https://discuss.elastic.co/t/increase-logstash-events-received-rate-when-using-kafka-as-input/91507)

<div class="topic-metadata">

**Author:** [@hossein\_ey](https://discuss.elastic.co/u/hossein_ey)\
**Replies:** 2\
**Last updated:** [July 1, 2017, 8:58am UTC](https://discuss.elastic.co/t/increase-logstash-events-received-rate-when-using-kafka-as-input/91507 "2017-07-01T08:58:21Z")

</div>

I develop a system with Apache Kafka and Logstash And ElasticSearch. data Produced into Kafka and logstash indexes data into ElasticSearch. In Kafka side, I have good throughput and Produce 30K message per second, this…

---

## [Unable importing json file from kibana UI](https://discuss.elastic.co/t/unable-importing-json-file-from-kibana-ui/175388)

<div class="topic-metadata">

**Author:** [@Swati123](https://discuss.elastic.co/u/Swati123)\
**Replies:** 4\
**Last updated:** [April 10, 2019, 6:37am UTC](https://discuss.elastic.co/t/unable-importing-json-file-from-kibana-ui/175388 "2019-04-10T06:37:26Z")

</div>

I am facing this issue while import json file from kibana ui (saved object -\> import) even though when I checked the json file its a invalid one checked under this https://jsonlint.com. Even I am not able to perform …

---

## [Timelion Interval on dashboard](https://discuss.elastic.co/t/timelion-interval-on-dashboard/119932)

<div class="topic-metadata">

**Author:** [@Robert\_Naccache](https://discuss.elastic.co/u/Robert_Naccache)\
**Replies:** 2\
**Last updated:** [February 16, 2018, 7:11am UTC](https://discuss.elastic.co/t/timelion-interval-on-dashboard/119932 "2018-02-16T07:11:22Z")

</div>

Hello, I've been having an issue regarding kibana (both 5.6.4 and 6.1.3) I noticed that when you add Timelion visualizations with different intervals and add them to the dashboard, the interval assigned in the timelion…

---

## [Restoring Snapshot to another cluster](https://discuss.elastic.co/t/restoring-snapshot-to-another-cluster/284292)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 1\
**Last updated:** [September 15, 2021, 2:48pm UTC](https://discuss.elastic.co/t/restoring-snapshot-to-another-cluster/284292 "2021-09-15T14:48:33Z")

</div>

I have two v7.12.0 elastic clusters. I want to snapshot data from one and restore to another. Both clusters have the same "type": "fs" snapshot repository configured with the same "settings.location" and the snapshot …

---

## [Cluster health becomes RED after create a new index](https://discuss.elastic.co/t/cluster-health-becomes-red-after-create-a-new-index/45332)

<div class="topic-metadata">

**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Replies:** 3\
**Last updated:** [March 25, 2016, 3:02am UTC](https://discuss.elastic.co/t/cluster-health-becomes-red-after-create-a-new-index/45332 "2016-03-25T03:02:57Z")

</div>

hi, I met a very strange issue. My cluster (ES 1.7.1) always enters red status if I create a new index with only one doc. Repro steps: get current health: http://localhost:9200/\_cat/health 1458814224 10:10:24 my…

---

## [Filter terms tags with hyphen and whitespace](https://discuss.elastic.co/t/filter-terms-tags-with-hyphen-and-whitespace/8029)

<div class="topic-metadata">

**Author:** [@bashir\_2](https://discuss.elastic.co/u/bashir_2)\
**Replies:** 3\
**Last updated:** [June 21, 2012, 9:56pm UTC](https://discuss.elastic.co/t/filter-terms-tags-with-hyphen-and-whitespace/8029 "2012-06-21T21:56:05Z")

</div>

I am trying to filter search results based on tags using terms filter. my tags field is not\_analyzed but I think the query filter processor breaks down terms by spaces and hyphens but I want to match tags like "wi-fi"…

---

## [Template PUT Failing](https://discuss.elastic.co/t/template-put-failing/72081)

<div class="topic-metadata">

**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Replies:** 2\
**Last updated:** [January 30, 2017, 3:05pm UTC](https://discuss.elastic.co/t/template-put-failing/72081 "2017-01-30T15:05:23Z")

</div>

I am building a new cluster and have copied out my existing template to use for importing into the new cluster: { "template": "logstash-", "order": 0, "settings": { "number\_of\_shards": 4, \<-- ONLY CHANGE "number\_o…

---

## [Shard and Zone awareness](https://discuss.elastic.co/t/shard-and-zone-awareness/121033)

<div class="topic-metadata">

**Author:** [@Ranjith\_M](https://discuss.elastic.co/u/Ranjith_M)\
**Replies:** 8\
**Last updated:** [February 22, 2018, 2:26pm UTC](https://discuss.elastic.co/t/shard-and-zone-awareness/121033 "2018-02-22T14:26:14Z")

</div>

We have build a new cluster with rack and zone awareness, and in our testing we have found shards are being distributed on rack properly, but we have issues with distributing shards based on zones Settings in elasticsea…

---

## [Total number of hits returned is wrong](https://discuss.elastic.co/t/total-number-of-hits-returned-is-wrong/28552)

<div class="topic-metadata">

**Author:** [@jelmer](https://discuss.elastic.co/u/jelmer)\
**Replies:** 1\
**Last updated:** [September 3, 2015, 1:13am UTC](https://discuss.elastic.co/t/total-number-of-hits-returned-is-wrong/28552 "2015-09-03T01:13:49Z")

</div>

Hi am running into the following scenario and I am hoping that someone can shed some light on this. I have an integration test that follows the following design insert 8 documents in an elastic index, Each item has…

---

## [Should ES\_HEAP\_SIZE be less than 31G?](https://discuss.elastic.co/t/should-es-heap-size-be-less-than-31g/19595)

<div class="topic-metadata">

**Author:** [@Jinyuan\_Zhou](https://discuss.elastic.co/u/Jinyuan_Zhou)\
**Replies:** 7\
**Last updated:** [September 4, 2014, 6:11pm UTC](https://discuss.elastic.co/t/should-es-heap-size-be-less-than-31g/19595 "2014-09-04T18:11:47Z")

</div>

I read somewhere that the ES\_HEAP\_SIZE is best to be less than 31G, in this case JVM can use an 32 bit number to address memory locations. If my server have about 64G ram. This seems a perfect. But what If I have…

---

## [Get counts of new users per day](https://discuss.elastic.co/t/get-counts-of-new-users-per-day/15389)

<div class="topic-metadata">

**Author:** [@Josh\_Harrison](https://discuss.elastic.co/u/Josh_Harrison)\
**Replies:** 2\
**Last updated:** [August 18, 2016, 11:48pm UTC](https://discuss.elastic.co/t/get-counts-of-new-users-per-day/15389 "2016-08-18T23:48:56Z")

</div>

I'm working with the twitter river data. Trying to figure out how to construct a query that would let me generate a count of all new users within a given time period, where in this case, new means "user has not had …

---

## [Maximum number of 'type' for one index of Elasticsearch](https://discuss.elastic.co/t/maximum-number-of-type-for-one-index-of-elasticsearch/35518)

<div class="topic-metadata">

**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\
**Replies:** 3\
**Last updated:** [November 26, 2015, 3:23am UTC](https://discuss.elastic.co/t/maximum-number-of-type-for-one-index-of-elasticsearch/35518 "2015-11-26T03:23:17Z")

</div>

Hi All, similar question like https://discuss.elastic.co/t/elasticsearch-max-number-of-documents-for-one-index/26578, maximum number of 'type' for one index of Elasticsearch? Jason

---

## [Error for elasticsearch php api](https://discuss.elastic.co/t/error-for-elasticsearch-php-api/18368)

<div class="topic-metadata">

**Author:** [@Stefan\_Kruse\_2](https://discuss.elastic.co/u/Stefan_Kruse_2)\
**Replies:** 2\
**Last updated:** [July 24, 2014, 10:12am UTC](https://discuss.elastic.co/t/error-for-elasticsearch-php-api/18368 "2014-07-24T10:12:14Z")

</div>

Hi, i try to use the es php module. I can indexing documents but when i search for something i got an error and dont know what this mean. I use this script: require '../vendor/autoload.php'; $clie…

---

## [Help me understand the use case for indices](https://discuss.elastic.co/t/help-me-understand-the-use-case-for-indices/77631)

<div class="topic-metadata">

**Author:** [@mriber](https://discuss.elastic.co/u/mriber)\
**Replies:** 5\
**Last updated:** [March 9, 2017, 1:34pm UTC](https://discuss.elastic.co/t/help-me-understand-the-use-case-for-indices/77631 "2017-03-09T13:34:05Z")

</div>

Hello, I'm new user of Elasticsearch, Kibana, Logstash and Filebeat, but have managed to install an environment and can send logs from my servers to the Logstash, which parses and forwards these to Elasticsearch.. So f…

---

## [Aggregations over rescore](https://discuss.elastic.co/t/aggregations-over-rescore/148505)

<div class="topic-metadata">

**Author:** [@Brett\_Anderson](https://discuss.elastic.co/u/Brett_Anderson)\
**Replies:** 7\
**Last updated:** [September 20, 2018, 11:54pm UTC](https://discuss.elastic.co/t/aggregations-over-rescore/148505 "2018-09-20T23:54:11Z")

</div>

I'm using ES 5.6. It seems that the aggregations apply before the rescore is applied to the query. I say this because if you try to sort the buckets by a max "\_score" it uses the score from the main query and not the res…

---

## [Filebeat 5.6.4 Service can't be created : Access Denied](https://discuss.elastic.co/t/filebeat-5-6-4-service-cant-be-created-access-denied/123679)

<div class="topic-metadata">

**Author:** [@arun3](https://discuss.elastic.co/u/arun3)\
**Replies:** 1\
**Last updated:** [March 13, 2018, 11:24am UTC](https://discuss.elastic.co/t/filebeat-5-6-4-service-cant-be-created-access-denied/123679 "2018-03-13T11:24:12Z")

</div>

When I am trying to install filebeat with "install-service-filebeat.ps1" , getting the below error. Please suggest. PS C:\\Users\\Arun\\filebeat-5.6.4\> PowerShell.exe -ExecutionPolicy UnRestricted -File .\\install-service-…

---

## [Not able to parse large XML nmap scan with logstash-nmap-codec](https://discuss.elastic.co/t/not-able-to-parse-large-xml-nmap-scan-with-logstash-nmap-codec/143722)

<div class="topic-metadata">

**Author:** [@rkokkelk](https://discuss.elastic.co/u/rkokkelk)\
**Replies:** 8\
**Last updated:** [August 9, 2018, 7:45pm UTC](https://discuss.elastic.co/t/not-able-to-parse-large-xml-nmap-scan-with-logstash-nmap-codec/143722 "2018-08-09T19:45:36Z")

</div>

Hi, I've got some serieus issues with parsing relativly large nmap scan using the logstash-nmap-codec. In my situation I've got a ~1.8MB XML file with the resutls of the nmap scan which I want to import but I've got iss…

---

## [Difference between snowball stemmer and regular stemmer](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346)

<div class="topic-metadata">

**Author:** [@tomsquest](https://discuss.elastic.co/u/tomsquest)\
**Replies:** 0\
**Last updated:** [February 24, 2021, 1:35pm UTC](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346 "2021-02-24T13:35:28Z")

</div>

Hi, Elasticsearch (and Lucene ?) has two stemmer token filters: the snowball one and the regular one. It seems in my tests that the regular stemmer is under the hood the snowball stemmer. It this really the case ? Fo…

---

## [Can't create new index pattern after deleting all](https://discuss.elastic.co/t/cant-create-new-index-pattern-after-deleting-all/165619)

<div class="topic-metadata">

**Author:** [@Primeval](https://discuss.elastic.co/u/Primeval)\
**Replies:** 6\
**Last updated:** [February 1, 2019, 5:57pm UTC](https://discuss.elastic.co/t/cant-create-new-index-pattern-after-deleting-all/165619 "2019-02-01T17:57:04Z")

</div>

Hi, I deleted all my index patterns (I still have few indexes in elasticsearch, also visible from management in kibana). Right now I wanted to create new (first) index pattern, but there is message: No default index p…

---

## [Language analyzer en français](https://discuss.elastic.co/t/language-analyzer-en-francais/41045)

<div class="topic-metadata">

**Author:** [@zeenon](https://discuss.elastic.co/u/zeenon)\
**Replies:** 6\
**Last updated:** [February 21, 2017, 10:59am UTC](https://discuss.elastic.co/t/language-analyzer-en-francais/41045 "2017-02-21T10:59:32Z")

</div>

bonjour, je suis la documentation Language Analyzers avec cette URL https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-lang-analyzer.html. Je prends l'exemple pour le français mais j'obtiens le mess…

---

## [How to split log data into message fields when we have dynamic logs](https://discuss.elastic.co/t/how-to-split-log-data-into-message-fields-when-we-have-dynamic-logs/235725)

<div class="topic-metadata">

**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\
**Replies:** 4\
**Last updated:** [June 5, 2020, 8:40am UTC](https://discuss.elastic.co/t/how-to-split-log-data-into-message-fields-when-we-have-dynamic-logs/235725 "2020-06-05T08:40:26Z")

</div>

i have created some log patterns in logstash but when i get new log pattern it is parsed into the kibana as a message filed but is not split up into other fields. I would like to know do i need to add log patterns for e…

---

## [Basic license - some xpack options seem to be wrongfully not available?](https://discuss.elastic.co/t/basic-license-some-xpack-options-seem-to-be-wrongfully-not-available/187076)

<div class="topic-metadata">

**Author:** [@bezopaznosti](https://discuss.elastic.co/u/bezopaznosti)\
**Replies:** 4\
**Last updated:** [June 24, 2019, 9:30am UTC](https://discuss.elastic.co/t/basic-license-some-xpack-options-seem-to-be-wrongfully-not-available/187076 "2019-06-24T09:30:18Z")

</div>

Hey all, When reading the subscriptions page, it seemed to me as if some xpack security options would be available for a basic license. The subscription page mentions that following options should be available: Encrypte…

---

## [Average Line Chart](https://discuss.elastic.co/t/average-line-chart/162601)

<div class="topic-metadata">

**Author:** [@Anup\_Kurup](https://discuss.elastic.co/u/Anup_Kurup)\
**Replies:** 4\
**Last updated:** [January 7, 2019, 3:45pm UTC](https://discuss.elastic.co/t/average-line-chart/162601 "2019-01-07T15:45:59Z")

</div>

Hi, I have documents containing feedback data like user, rating(1,2,3,4,5), date. I want to create a line chart where the x-axis will be date and there will 2 line charts one shows the average feedback on that particul…

---

## [Field set as not analyzed but kibana shows it as analyzed](https://discuss.elastic.co/t/field-set-as-not-analyzed-but-kibana-shows-it-as-analyzed/33450)

<div class="topic-metadata">

**Author:** [@prtkgaur](https://discuss.elastic.co/u/prtkgaur)\
**Replies:** 4\
**Last updated:** [March 9, 2016, 6:02am UTC](https://discuss.elastic.co/t/field-set-as-not-analyzed-but-kibana-shows-it-as-analyzed/33450 "2016-03-09T06:02:35Z")

</div>

Index template : { "template" : "index-\*", "settings" : { "index.refresh\_interval" : "10s" }, "mappings" : { "\_default\_" : { "\_all" : {"enabled" : true}, "dynamic\_templates" : \[ { …

---

## [Calculate time difference between two different record timestamps](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-record-timestamps/136545)

<div class="topic-metadata">

**Author:** [@harish\_c](https://discuss.elastic.co/u/harish_c)\
**Replies:** 2\
**Last updated:** [June 20, 2018, 2:02pm UTC](https://discuss.elastic.co/t/calculate-time-difference-between-two-different-record-timestamps/136545 "2018-06-20T14:02:15Z")

</div>

So I am logging a bunch of logs of a big and mediumly complex workflow. This workflow is a graph and can take different paths based on the inputs or a particular workflow step's output. When the workflow is created a wor…

---

## [With variable output file name : "The starting part of the path should not be dynamic"](https://discuss.elastic.co/t/with-variable-output-file-name-the-starting-part-of-the-path-should-not-be-dynamic/127966)

<div class="topic-metadata">

**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\
**Replies:** 2\
**Last updated:** [April 13, 2018, 12:04pm UTC](https://discuss.elastic.co/t/with-variable-output-file-name-the-starting-part-of-the-path-should-not-be-dynamic/127966 "2018-04-13T12:04:03Z")

</div>

When I add a output file with variable in the pipiline.conf path =\> "%{type}\_%{+yyyy\_MM\_dd}.log" I get the logstash error : The starting part of the path should not be dynamic It works fine when I remove the path l…

---

## [Simple Query String analyzer question](https://discuss.elastic.co/t/simple-query-string-analyzer-question/76273)

<div class="topic-metadata">

**Author:** [@thiru](https://discuss.elastic.co/u/thiru)\
**Replies:** 2\
**Last updated:** [March 23, 2017, 3:57am UTC](https://discuss.elastic.co/t/simple-query-string-analyzer-question/76273 "2017-03-23T03:57:08Z")

</div>

I have created the following index settings and mapping . I used the simple query string syntax for search . Do I need to explicitly specify my custom analyzer in the simple query search or it uses the required analyzer…

---

## [Indexing Multipolyon with Elasticearch](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265)

<div class="topic-metadata">

**Author:** [@Faradandy](https://discuss.elastic.co/u/Faradandy)\
**Replies:** 5\
**Last updated:** [October 11, 2021, 5:50pm UTC](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265 "2021-10-11T17:50:56Z")

</div>

Hi there, I'm using Elasticsearch 7.15 with GDAL 3.3.1 and trying to index the UK Land Registry Dataset. I currently have these data stored in a PSQL table and am trying to use ogr2ogr to create the ES index. I've def…

---

## [Logstash "\_grokparsefailure" in output](https://discuss.elastic.co/t/logstash--grokparsefailure-in-output/74519)

<div class="topic-metadata">

**Author:** [@ash007](https://discuss.elastic.co/u/ash007)\
**Replies:** 5\
**Last updated:** [February 13, 2017, 7:28pm UTC](https://discuss.elastic.co/t/logstash--grokparsefailure-in-output/74519 "2017-02-13T19:28:02Z")

</div>

Hi, I am trying to execute a simple logstash config by using the grok patterns. Following is the total.conf file: input { tcp { port =\> 5000 type =\> meter } udp { port =\> 5000 type =\> meter } } filt…

---

## [Error fetching fields](https://discuss.elastic.co/t/error-fetching-fields/200008)

<div class="topic-metadata">

**Author:** [@Josef\_Fritzer](https://discuss.elastic.co/u/Josef_Fritzer)\
**Replies:** 3\
**Last updated:** [September 19, 2019, 4:55am UTC](https://discuss.elastic.co/t/error-fetching-fields/200008 "2019-09-19T04:55:44Z")

</div>

Hi guys, I got the following error if I try to create an index pattern: Index size about 2.2GB approximately 3500 fields per document Has anyone an idea? THANKS

---

## [Logstash "The error reported is: \\n Permission denied - bind(2)"](https://discuss.elastic.co/t/logstash-the-error-reported-is-n-permission-denied-bind-2/38770)

<div class="topic-metadata">

**Author:** [@shihab\_rabee](https://discuss.elastic.co/u/shihab_rabee)\
**Replies:** 3\
**Last updated:** [January 10, 2016, 4:56am UTC](https://discuss.elastic.co/t/logstash-the-error-reported-is-n-permission-denied-bind-2/38770 "2016-01-10T04:56:41Z")

</div>

Logstash fails to start when listining on port 80. although i am starting it with root user logstash "The error reported is: \\n Permission denied - bind(2)"

---

## [Elastic Agent vs Logstash with Filebeat](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556)

<div class="topic-metadata">

**Author:** [@marian.veverka](https://discuss.elastic.co/u/marian.veverka)\
**Replies:** 5\
**Last updated:** [January 17, 2026, 5:10pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556 "2026-01-17T17:10:53Z")

</div>

Hello, I have a server running several Docker containers (including, for example, Keycloak). I want to send logs from these Docker containers to Elasticsearch. Currently, for one Docker container I'm using a separate D…

---

## [Convert fields to ECS](https://discuss.elastic.co/t/convert-fields-to-ecs/224888)

<div class="topic-metadata">

**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Replies:** 7\
**Last updated:** [March 24, 2020, 7:57pm UTC](https://discuss.elastic.co/t/convert-fields-to-ecs/224888 "2020-03-24T19:57:01Z")

</div>

Hello, I´m trying to ingest log file using ECS (Elastic Common Schema). For doing it, I have to rename source fields following the ECS convention. I made a filter which is not working: filter { json { source =\> "messag…

---

## [Timeseriesのlabel間集計](https://discuss.elastic.co/t/timeseries-label/209419)

<div class="topic-metadata">

**Author:** [@nakar-kashi](https://discuss.elastic.co/u/nakar-kashi)\
**Replies:** 8\
**Last updated:** [November 27, 2019, 6:17am UTC](https://discuss.elastic.co/t/timeseries-label/209419 "2019-11-27T06:17:22Z")

</div>

こんにちは。 現在kibanaでサーバごとのディスク使用量の前日との増減を表示したいと思っています。 timeseriesで当日、前日のディス使用量は表示できたのですが、差分がうまく取れません。 別ラベルのデータをとってくることは出来るのでしょうか。 尚、ディスク使用量は1つのデータとなっているので、同じindexに対するoffsetを使用しています。 ラベル1 Aggregation:MAX Field:use\_disk …

---

## [\[help wanted\] Invalid index name \[\_security\]](https://discuss.elastic.co/t/help-wanted-invalid-index-name-security/232746)

<div class="topic-metadata">

**Author:** [@Null\_None](https://discuss.elastic.co/u/Null_None)\
**Replies:** 2\
**Last updated:** [May 15, 2020, 7:17am UTC](https://discuss.elastic.co/t/help-wanted-invalid-index-name-security/232746 "2020-05-15T07:17:26Z")

</div>

Kibana version: 7.7 Elasticsearch version: 7.7 APM Server version: 7.7 APM Agent language and version: go, go.elastic.co/apm v1.8.0 Browser version: Chrome 81 Original install method (e.g. download page, yum, …

---

## [How can I compress my elasticsearch logs data?](https://discuss.elastic.co/t/how-can-i-compress-my-elasticsearch-logs-data/140828)

<div class="topic-metadata">

**Author:** [@sfrogit96](https://discuss.elastic.co/u/sfrogit96)\
**Replies:** 2\
**Last updated:** [July 20, 2018, 7:08am UTC](https://discuss.elastic.co/t/how-can-i-compress-my-elasticsearch-logs-data/140828 "2018-07-20T07:08:00Z")

</div>

Hi there, I'm new in elasticsearch and I have an issue. I created 2 indexes "test1" and "test2" to test log storage in elasticsaerch, I used this for test1, and default for test2: PUT /test1/\_settings {"index":{"codec":…

---

## [Create URL scripted field to view surrounding documents (SOLVED)](https://discuss.elastic.co/t/create-url-scripted-field-to-view-surrounding-documents-solved/131396)

<div class="topic-metadata">

**Author:** [@saramali](https://discuss.elastic.co/u/saramali)\
**Replies:** 2\
**Last updated:** [May 14, 2018, 5:22am UTC](https://discuss.elastic.co/t/create-url-scripted-field-to-view-surrounding-documents-solved/131396 "2018-05-14T05:22:37Z")

</div>

I'm trying to create a scripted field which is will be a URL to view the surrounding documents of the log. I've found that if I give the document id of the log. In the view surrounding logs link it brings the surroundin…

---

## [Load Balancing ECE Deployments](https://discuss.elastic.co/t/load-balancing-ece-deployments/130077)

<div class="topic-metadata">

**Author:** [@John\_Zimmerman](https://discuss.elastic.co/u/John_Zimmerman)\
**Replies:** 2\
**Last updated:** [May 3, 2018, 5:54pm UTC](https://discuss.elastic.co/t/load-balancing-ece-deployments/130077 "2018-05-03T17:54:21Z")

</div>

I'm looking for example configurations for load balancing ECE deployments and was hoping others have something they'd be able to share. The ECE documentation appears to just leave the load balancing recommendation as "u…

---

## [(statusCode : 304 )IN KIBANA NOT ABLE TO OPEN/EDIT/CREATE/DELETE any VISUALS OR DASHBOARD](https://discuss.elastic.co/t/statuscode-304-in-kibana-not-able-to-open-edit-create-delete-any-visuals-or-dashboard/124906)

<div class="topic-metadata">

**Author:** [@ashutoshningot](https://discuss.elastic.co/u/ashutoshningot)\
**Replies:** 2\
**Last updated:** [March 26, 2018, 4:57am UTC](https://discuss.elastic.co/t/statuscode-304-in-kibana-not-able-to-open-edit-create-delete-any-visuals-or-dashboard/124906 "2018-03-26T04:57:32Z")

</div>

statusCode":304,"req":{"url":"/bundles/kibana.style.css?v=8467","method":"get"....

---

## [Prevent checking existence of document ID when specified](https://discuss.elastic.co/t/prevent-checking-existence-of-document-id-when-specified/159175)

<div class="topic-metadata">

**Author:** [@iamredlus](https://discuss.elastic.co/u/iamredlus)\
**Replies:** 3\
**Last updated:** [December 3, 2018, 1:10pm UTC](https://discuss.elastic.co/t/prevent-checking-existence-of-document-id-when-specified/159175 "2018-12-03T13:10:18Z")

</div>

Hey It is well documented that when specifying an ID of a document upon ingestion, elasticsearch will first check whether that ID is already in use, and only then approve the new document for indexing. This comes with a…

---

## [Time picker missing in Kibana 7](https://discuss.elastic.co/t/time-picker-missing-in-kibana-7/193537)

<div class="topic-metadata">

**Author:** [@Sommerdal](https://discuss.elastic.co/u/Sommerdal)\
**Replies:** 4\
**Last updated:** [August 6, 2019, 6:01am UTC](https://discuss.elastic.co/t/time-picker-missing-in-kibana-7/193537 "2019-08-06T06:01:58Z")

</div>

I just upgraded from ELK 6.3 thru 6.8, 7.7 to 7.3 on ES and Kibana. Now I have several problems, but I'll take them one at a time to avoid confusion. Time Picker in the Kibana toolbar is completely missing in Default s…

---

## [Grokparsefailure PostgreSQL](https://discuss.elastic.co/t/grokparsefailure-postgresql/133783)

<div class="topic-metadata">

**Author:** [@Jose\_Calvelo](https://discuss.elastic.co/u/Jose_Calvelo)\
**Replies:** 4\
**Last updated:** [May 30, 2018, 7:43pm UTC](https://discuss.elastic.co/t/grokparsefailure-postgresql/133783 "2018-05-30T19:43:51Z")

</div>

Hi, im trying to build a filter for PostgreSQL and I have managed to make it work with the debugger. But when I receive it in my application I see that logstash failed to parse it. Log example: 2018-05-29 11:09:44 -03 …

---

## [Vega request @timestamp not mapped to timestamp field](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200)

<div class="topic-metadata">

**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\
**Replies:** 6\
**Last updated:** [December 1, 2020, 4:14pm UTC](https://discuss.elastic.co/t/vega-request-timestamp-not-mapped-to-timestamp-field/257200 "2020-12-01T16:14:52Z")

</div>

Hi, I am using Kibana and ES 7.10.0. I have a vega-lite widget that works and fetches from Elasticsearch the data. When trying using @timestamp in a vega-lite widget I get no results, and the warning: "Infinite extent …

---

## [Searching word with special characters](https://discuss.elastic.co/t/searching-word-with-special-characters/251244)

<div class="topic-metadata">

**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\
**Replies:** 6\
**Last updated:** [October 7, 2020, 2:33pm UTC](https://discuss.elastic.co/t/searching-word-with-special-characters/251244 "2020-10-07T14:33:32Z")

</div>

Hi! I am having a little problem, I wanted to search a word on elasticsearch but the result that I am expecting is not coming up because it has a tailing special character. Here’s an example: The result that I want to …

---

## [Logstash shut down after pipeline terminated](https://discuss.elastic.co/t/logstash-shut-down-after-pipeline-terminated/255478)

<div class="topic-metadata">

**Author:** [@Amir\_Almian](https://discuss.elastic.co/u/Amir_Almian)\
**Replies:** 2\
**Last updated:** [November 17, 2020, 1:24pm UTC](https://discuss.elastic.co/t/logstash-shut-down-after-pipeline-terminated/255478 "2020-11-17T13:24:27Z")

</div>

i,m running elastic stack on docker and with ssl security enable. this is my logstash.yml file http.host: "0.0.0.0" xpack.monitoring.elasticsearch.hosts: \[ "https://elasticsearch:9200" \] xpack.monitoring.enabled: true …

---

## [Accessing Kibana of AWS ElasticSearch by Gateway using AWS IAM](https://discuss.elastic.co/t/accessing-kibana-of-aws-elasticsearch-by-gateway-using-aws-iam/58938)

<div class="topic-metadata">

**Author:** [@camarar](https://discuss.elastic.co/u/camarar)\
**Replies:** 2\
**Last updated:** [August 26, 2016, 1:07pm UTC](https://discuss.elastic.co/t/accessing-kibana-of-aws-elasticsearch-by-gateway-using-aws-iam/58938 "2016-08-26T13:07:15Z")

</div>

I'm studying about ELK Stack and AWS Gateway. I created AWS ElasticSearch and set this access policy: { "Version": "2012-10-17", "Statement": \[ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::AWS account ID:ro…

---

## [Elastic API consumption at Client Side (Browser) using JavaScript](https://discuss.elastic.co/t/elastic-api-consumption-at-client-side-browser-using-javascript/182132)

<div class="topic-metadata">

**Author:** [@anushshukla](https://discuss.elastic.co/u/anushshukla)\
**Replies:** 7\
**Last updated:** [June 12, 2019, 5:56pm UTC](https://discuss.elastic.co/t/elastic-api-consumption-at-client-side-browser-using-javascript/182132 "2019-06-12T17:56:07Z")

</div>

Just curious to know if there we can consume ES API (only GET Http Requests) on client side i.e. browser using JavaScript of the browser (note: not Server Side JavaScript i.e. Nodejs). Is server, as the client, the only…

---

## [Filebeat get big log file](https://discuss.elastic.co/t/filebeat-get-big-log-file/49736)

<div class="topic-metadata">

**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Replies:** 1\
**Last updated:** [May 11, 2016, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-get-big-log-file/49736 "2016-05-11T14:13:47Z")

</div>

I'm using filebeat 1.2.1 I have one fie log iis (6Gb) and many file log (~2000 file/day, 10MB/file). example : In this time, i check in kibana and i saw newest log of the 7 hours ago. I'm using rabbitMQ, I checkd in …

---

## [Efficient query with multiple boolean flags](https://discuss.elastic.co/t/efficient-query-with-multiple-boolean-flags/227367)

<div class="topic-metadata">

**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\
**Replies:** 6\
**Last updated:** [April 21, 2020, 10:35pm UTC](https://discuss.elastic.co/t/efficient-query-with-multiple-boolean-flags/227367 "2020-04-21T22:35:30Z")

</div>

Hello, in the "real world" the entities I need to search have many yes/no characteristics which I need to filter in AppSearch (for example, "is retailer", "accepts credit card", "accepts crypto", etc). Users may filter …

[Previous page](https://discuss.elastic.co/top.md?page=666&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=668&per_page=50&period=all)
