# Top **URL:** https://discuss.elastic.co/top.md?page=692&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 693 --- ## ["match\_phrase\_prefix" TooManyClauses\[maxClauseCount is set to 1024\]](https://discuss.elastic.co/t/match-phrase-prefix-toomanyclauses-maxclausecount-is-set-to-1024/95841)
**Author:** [@felayman](https://discuss.elastic.co/u/felayman)\ **Replies:** 4\ **Last updated:** [August 11, 2017, 6:56am UTC](https://discuss.elastic.co/t/match-phrase-prefix-toomanyclauses-maxclausecount-is-set-to-1024/95841 "2017-08-11T06:56:33Z")
when i use “match\_phrase\_prefix” query in my project. the query is : { "query": { "match\_phrase\_prefix": { "nickName": "a" } } } but it throws the exception as follow: org.elasticsearch.action.searc… --- ## [Courier Fetch x of y shards are failed](https://discuss.elastic.co/t/courier-fetch-x-of-y-shards-are-failed/44100)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 8\ **Last updated:** [March 17, 2016, 10:00pm UTC](https://discuss.elastic.co/t/courier-fetch-x-of-y-shards-are-failed/44100 "2016-03-17T22:00:39Z")
Hello All, I have one node cluster running since last 20 days. Its taking syslogs from 4 devices. It used work fine till yesterday. Now when I refresh my Kibana page, it gives me this error on the top. If I press OK it… --- ## [Logstash 1.5.0 alternative for filter grep](https://discuss.elastic.co/t/logstash-1-5-0-alternative-for-filter-grep/2677)
**Author:** [@shartmann](https://discuss.elastic.co/u/shartmann)\ **Replies:** 2\ **Last updated:** [June 19, 2015, 9:23am UTC](https://discuss.elastic.co/t/logstash-1-5-0-alternative-for-filter-grep/2677 "2015-06-19T09:23:33Z")
Hello, we used logstash 1.4.2 and will update to 1.5.0. In logstash 1.4.2 we used grep as filter. For logstash 1.5.0 filter grep is never available, I think. Is there any alternative for grep or how can we change our con… --- ## [Filebeat stop harvesting](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553)
**Author:** [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Replies:** 5\ **Last updated:** [March 11, 2020, 8:53am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553 "2020-03-11T08:53:48Z")
I've configuring filebeat, logstash, elasticsearch. it works pretty well. But for some reason filebeat will stop harvesting log file. The file will be generated everyday. I've try this for few times at it always happene… --- ## [Typeerror: cannot read property 'message' of null watcher](https://discuss.elastic.co/t/typeerror-cannot-read-property-message-of-null-watcher/114002)
**Author:** [@SIJIA\_CHEN](https://discuss.elastic.co/u/SIJIA_CHEN)\ **Replies:** 5\ **Last updated:** [February 1, 2018, 4:39pm UTC](https://discuss.elastic.co/t/typeerror-cannot-read-property-message-of-null-watcher/114002 "2018-02-01T16:39:15Z")
Hi, I got this error when I was trying to create a watcher by using email action. Weird thing is that each time I tried to create the email action watcher, it not only gave me the error, but also kicked me out of the we… --- ## [Storage Best Practices](https://discuss.elastic.co/t/storage-best-practices/91377)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 5\ **Last updated:** [June 30, 2017, 9:09am UTC](https://discuss.elastic.co/t/storage-best-practices/91377 "2017-06-30T09:09:14Z")
As part of core operations class, i see a slide with the below details . path.data vs. RAID0 ‒ RAID0 will be slightly more performant ‒ path.data will allow a node to continue to function ‒ e.g. a machine with 4 2TB dr… --- ## [In filebeat, what is the difference between json.keys\_under\_root and decode\_json\_fields](https://discuss.elastic.co/t/in-filebeat-what-is-the-difference-between-json-keys-under-root-and-decode-json-fields/202732)
**Author:** [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\ **Replies:** 1\ **Last updated:** [October 9, 2019, 10:49am UTC](https://discuss.elastic.co/t/in-filebeat-what-is-the-difference-between-json-keys-under-root-and-decode-json-fields/202732 "2019-10-09T10:49:06Z")
I am confused about the difference between json.keys\_under\_root and decode\_json\_fields. Are these overlapping options ? I need the fields to be under root. I am getting these error and was wondering if decode\_json\_fie… --- ## [Error while inserting bulk data in big size via logstash to elasticsearch](https://discuss.elastic.co/t/error-while-inserting-bulk-data-in-big-size-via-logstash-to-elasticsearch/105031)
**Author:** [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)\ **Replies:** 1\ **Last updated:** [October 24, 2017, 1:43pm UTC](https://discuss.elastic.co/t/error-while-inserting-bulk-data-in-big-size-via-logstash-to-elasticsearch/105031 "2017-10-24T13:43:23Z")
Hi All I am using elasticsearch version 5.4.1 and I have 8 Million records combined all the indices. Now I have one index which contains 21 lakhs records and I want to insert more records in that Index First bulk reque… --- ## [Unassigned Shards after Master node restart](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929)
**Author:** [@krishnav1](https://discuss.elastic.co/u/krishnav1)\ **Replies:** 3\ **Last updated:** [February 24, 2022, 11:37am UTC](https://discuss.elastic.co/t/unassigned-shards-after-master-node-restart/297929 "2022-02-24T11:37:35Z")
Hello, I am new to elastic cluster, sorry for the long post and I am looking for help to revive some unassigned shards which are a result of me abruptly shutting the master node. This has an impact on Kibana as it has pr… --- ## [Winlogbeat - Cannot start](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692)
**Author:** [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\ **Replies:** 3\ **Last updated:** [October 8, 2019, 3:29pm UTC](https://discuss.elastic.co/t/winlogbeat-cannot-start/202692 "2019-10-08T15:29:06Z")
Hello Folks, I use SSL/TLS encryption, it works fine. I use keystore to access my password. When I launch winlogbeat from powershell, it fails, see error below. However, if I make it run manually from PowerShell, I hav… --- ## [Logstash - How to use the node.name as a field value?](https://discuss.elastic.co/t/logstash-how-to-use-the-node-name-as-a-field-value/70753)
**Author:** [@hk-awil](https://discuss.elastic.co/u/hk-awil)\ **Replies:** 2\ **Last updated:** [January 9, 2017, 8:16am UTC](https://discuss.elastic.co/t/logstash-how-to-use-the-node-name-as-a-field-value/70753 "2017-01-09T08:16:46Z")
Hello I would like to add the node.name value to an extra message field. Is this value readable from inside of logstash? I tried to use the node.name like the host field: "fqdn" =\> "%{host}" without success. Dose an… --- ## [Hunting for bad actors / searching for multiple IP addresses](https://discuss.elastic.co/t/hunting-for-bad-actors-searching-for-multiple-ip-addresses/27095)
**Author:** [@JimCheetham](https://discuss.elastic.co/u/JimCheetham)\ **Replies:** 2\ **Last updated:** [August 14, 2015, 2:37am UTC](https://discuss.elastic.co/t/hunting-for-bad-actors-searching-for-multiple-ip-addresses/27095 "2015-08-14T02:37:42Z")
I often go to my dashboard to identify something like a compromised user account, and when I identify them I get a set of different source addresses, all used by the attacker. I can't figure out an elegant way to turn … --- ## [Where is the dashboard config stored?](https://discuss.elastic.co/t/where-is-the-dashboard-config-stored/181415)
**Author:** [@keshav\_garg](https://discuss.elastic.co/u/keshav_garg)\ **Replies:** 1\ **Last updated:** [May 16, 2019, 2:00pm UTC](https://discuss.elastic.co/t/where-is-the-dashboard-config-stored/181415 "2019-05-16T14:00:18Z")
Any metadata related to kibana dashboard where is it stored ? is it stored in elastic db itself. --- ## [Can we both enable outputs for Elasticsearch and Logstash?](https://discuss.elastic.co/t/can-we-both-enable-outputs-for-elasticsearch-and-logstash/124805)
**Author:** [@jackyshen](https://discuss.elastic.co/u/jackyshen)\ **Replies:** 4\ **Last updated:** [March 23, 2018, 5:49pm UTC](https://discuss.elastic.co/t/can-we-both-enable-outputs-for-elasticsearch-and-logstash/124805 "2018-03-23T17:49:07Z")
I want to my Logs to output both Elasticsearch and Logstash , can I config like the below? #================================ Outputs ===================================== Configure what outputs to use when sending the … --- ## [Relation between shards and nodes](https://discuss.elastic.co/t/relation-between-shards-and-nodes/104562)
**Author:** [@jessepeixoto](https://discuss.elastic.co/u/jessepeixoto)\ **Replies:** 4\ **Last updated:** [October 25, 2017, 7:34pm UTC](https://discuss.elastic.co/t/relation-between-shards-and-nodes/104562 "2017-10-25T19:34:15Z")
Could anyone please tell me a little about the relation between shards and nodes. If I have 30 nodes, I believe it won't work setting up more than 30 shards per index. In the other hand, if I have 30 nodes, setting up … --- ## [Heartbeat.config.monitors option not working on 6.5.4?](https://discuss.elastic.co/t/heartbeat-config-monitors-option-not-working-on-6-5-4/166755)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 6\ **Last updated:** [February 4, 2019, 4:59pm UTC](https://discuss.elastic.co/t/heartbeat-config-monitors-option-not-working-on-6-5-4/166755 "2019-02-04T16:59:45Z")
Hello, I'm trying to use heartbeat to monitor the uptime of some devices and looking into the documentation I saw that is possible to have your monitors in a separated file instead of having them in the main heartbeat.y… --- ## [Elasticsearch-5.2.0 java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/elasticsearch-5-2-0-java-lang-outofmemoryerror-java-heap-space/76483)
**Author:** [@blair319](https://discuss.elastic.co/u/blair319)\ **Replies:** 3\ **Last updated:** [February 26, 2017, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-5-2-0-java-lang-outofmemoryerror-java-heap-space/76483 "2017-02-26T10:19:46Z")
Elasticsearch version:5.2.0 Plugins installed: \[\] JVM version:1.8.0\_121 OS version:redhat config/jvm.options -Xms20g -Xmx20g -XX:+UseCondCardMark -XX:CMSWaitDuration=250 -XX:+UseG1GC -XX:MaxGCPauseMillis=20… --- ## [Shield Custom Realm Sample not Compiling](https://discuss.elastic.co/t/shield-custom-realm-sample-not-compiling/56733)
**Author:** [@Yasho](https://discuss.elastic.co/u/Yasho)\ **Replies:** 8\ **Last updated:** [September 9, 2016, 8:03am UTC](https://discuss.elastic.co/t/shield-custom-realm-sample-not-compiling/56733 "2016-09-09T08:03:15Z")
Hi, I have dowloaded Shield Custom realm sample from GitHub to compile it and execute it so that later will be developing our own custom realm for our project, However when I try to compile i get the missing artifact an… --- ## [Use Vega Visualization with Dynamic Data (Index)](https://discuss.elastic.co/t/use-vega-visualization-with-dynamic-data-index/172942)
**Author:** [@suhasgupta1](https://discuss.elastic.co/u/suhasgupta1)\ **Replies:** 2\ **Last updated:** [March 20, 2019, 2:30pm UTC](https://discuss.elastic.co/t/use-vega-visualization-with-dynamic-data-index/172942 "2019-03-20T14:30:56Z")
Hi All, I am beginner in Kibana and Elasticsearch. When I try to use index with vegalite visualization, I am getting single bar with undefined CC\_E field instead of showing colors w.r.t. CC\_E(This is nominal field valu… --- ## [DNS lookup failure: host in /etchosts](https://discuss.elastic.co/t/dns-lookup-failure-host-in-etchosts/49111)
**Author:** [@carrot](https://discuss.elastic.co/u/carrot)\ **Replies:** 2\ **Last updated:** [May 4, 2016, 3:55pm UTC](https://discuss.elastic.co/t/dns-lookup-failure-host-in-etchosts/49111 "2016-05-04T15:55:01Z")
I provisioned the destination hostname in /etc/hosts for testing, but looks like filebeat doesn't honor /etc/hosts entries... Just asking first before putting a bug. Seems like it's not using the normal Linux resolvers. … --- ## [Split grok pattern](https://discuss.elastic.co/t/split-grok-pattern/26535)
**Author:** [@nzbloto22](https://discuss.elastic.co/u/nzbloto22)\ **Replies:** 2\ **Last updated:** [August 3, 2015, 12:42am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535 "2015-08-03T00:42:12Z")
Hey, I have just recently started using logstash and am still getting my head around it. Is it possible to run a grok filter to match a pattern then split it into two fields or get other values out of it? For examp… --- ## [Pathetic Logstash performance using UDP input and Redis output](https://discuss.elastic.co/t/pathetic-logstash-performance-using-udp-input-and-redis-output/34409)
**Author:** [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Replies:** 0\ **Last updated:** [November 12, 2015, 12:30pm UTC](https://discuss.elastic.co/t/pathetic-logstash-performance-using-udp-input-and-redis-output/34409 "2015-11-12T12:30:01Z")
Following is the log-stash configuration used for capturing the events from various nodes streaming syslog events and the events are buffered in Redis queue for processing. input { udp { port =\> 514 … --- ## [Indexing and searching strings with periods (".")](https://discuss.elastic.co/t/indexing-and-searching-strings-with-periods/118919)
**Author:** [@rsk](https://discuss.elastic.co/u/rsk)\ **Replies:** 4\ **Last updated:** [February 17, 2018, 10:22pm UTC](https://discuss.elastic.co/t/indexing-and-searching-strings-with-periods/118919 "2018-02-17T22:22:53Z")
How can I set up indexing and searching to disregard periods when matching strings? For example, if I search for USA I want USA and U.S.A to be returned. Likewise, U.S.A. should return both U.S.A. and USA. I know I can… --- ## [Extending Shield 2.0 with custom plugin](https://discuss.elastic.co/t/extending-shield-2-0-with-custom-plugin/33888)
**Author:** [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Replies:** 4\ **Last updated:** [March 15, 2016, 3:58pm UTC](https://discuss.elastic.co/t/extending-shield-2-0-with-custom-plugin/33888 "2016-03-15T15:58:48Z")
I am looking for information on authoring a Java plugin that extends Shield 2.0 capabilities. Specifically I want the plugin to use a custom library to authenticate a user based a SAML token. The SAML token contains cl… --- ## [Reindex using scroll api](https://discuss.elastic.co/t/reindex-using-scroll-api/39752)
**Author:** [@cirot87](https://discuss.elastic.co/u/cirot87)\ **Replies:** 4\ **Last updated:** [January 22, 2016, 9:06am UTC](https://discuss.elastic.co/t/reindex-using-scroll-api/39752 "2016-01-22T09:06:55Z")
Hi, The scope is that i want to reindex my document. I have the last version of Elasticsearch, in the documentation i see that i need to use scroll api and bulk api (i know how to use them), The first question is: Ca… --- ## [Elasticsearch java code sample for query](https://discuss.elastic.co/t/elasticsearch-java-code-sample-for-query/7828)
**Author:** [@Kara](https://discuss.elastic.co/u/Kara)\ **Replies:** 4\ **Last updated:** [May 23, 2012, 11:12pm UTC](https://discuss.elastic.co/t/elasticsearch-java-code-sample-for-query/7828 "2012-05-23T23:12:58Z")
Where can I find some java code or documentation where it queries the ES? Just a code snippet where it makes a connection to a ES server and queries for simple fields. Thanks, Karine --- ## [Idempotent indexing into ElasticSearch when neither data nor version number have changed?](https://discuss.elastic.co/t/idempotent-indexing-into-elasticsearch-when-neither-data-nor-version-number-have-changed/7715)
**Author:** [@Michael\_Snell](https://discuss.elastic.co/u/Michael_Snell)\ **Replies:** 4\ **Last updated:** [May 22, 2012, 9:26pm UTC](https://discuss.elastic.co/t/idempotent-indexing-into-elasticsearch-when-neither-data-nor-version-number-have-changed/7715 "2012-05-22T21:26:05Z")
Hi - Currently, when using external versioning, ElasticSearch always returns the same error when there is a version number conflict, eg: VersionConflictEngineException\[\[twitter\]\[2\] \[tweet\]\[1\]: version conflict, cu… --- ## [Using processors with modules in Filebeat](https://discuss.elastic.co/t/using-processors-with-modules-in-filebeat/251001)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 5\ **Last updated:** [October 6, 2020, 6:15pm UTC](https://discuss.elastic.co/t/using-processors-with-modules-in-filebeat/251001 "2020-10-06T18:15:19Z")
TL;DR How do I add fields (or any processors) to the config for a preexisting module without editing the module source? Issue I'm attempting to add some fields to logs ingested via the system module. This is my modules.… --- ## [How to optimize elasticsearch aggregations to just take any for specific fields](https://discuss.elastic.co/t/how-to-optimize-elasticsearch-aggregations-to-just-take-any-for-specific-fields/173968)
**Author:** [@jj1234](https://discuss.elastic.co/u/jj1234)\ **Replies:** 7\ **Last updated:** [May 9, 2019, 7:58pm UTC](https://discuss.elastic.co/t/how-to-optimize-elasticsearch-aggregations-to-just-take-any-for-specific-fields/173968 "2019-05-09T19:58:47Z")
Let's say I am trying to get the top 10 items with the top sales across a time period. I want to just show it on a UI with the item id, item name, item store id, item section id, item brand and item sales amount in perio… --- ## [Java Serialization of Exceptions](https://discuss.elastic.co/t/java-serialization-of-exceptions/16528)
**Author:** [@Chris\_Berry\_2](https://discuss.elastic.co/u/Chris_Berry_2)\ **Replies:** 7\ **Last updated:** [March 21, 2014, 8:05pm UTC](https://discuss.elastic.co/t/java-serialization-of-exceptions/16528 "2014-03-21T20:05:11Z")
Greetings, Let me say up-front, I am a huge fan and proponent of Elasticsearch. It is a beautiful tool. So, that said, it surprises me that Elasticsearch has such a pedestrian flaw, and serializes it's Exceptio… --- ## [FortiAnalyzer logs to SIEM](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801)
**Author:** [@gabrieltavares\_pp](https://discuss.elastic.co/u/gabrieltavares_pp)\ **Replies:** 1\ **Last updated:** [July 18, 2019, 2:48pm UTC](https://discuss.elastic.co/t/fortianalyzer-logs-to-siem/190801 "2019-07-18T14:48:52Z")
Hello, I'm new with ELK and I installed Elasticsearch, Kibana and Logstash in the same server. I followed this procedure to send logs from FortiAnalyzer to ELK. I tried to send logs to SIEM, but I have to setup Beats … --- ## [Knowing when and when not to retry a request based on ElasticsearchException or IOException with the RestHighLevelClient](https://discuss.elastic.co/t/knowing-when-and-when-not-to-retry-a-request-based-on-elasticsearchexception-or-ioexception-with-the-resthighlevelclient/183779)
**Author:** [@Forrest\_Townsend](https://discuss.elastic.co/u/Forrest_Townsend)\ **Replies:** 1\ **Last updated:** [May 31, 2019, 7:23pm UTC](https://discuss.elastic.co/t/knowing-when-and-when-not-to-retry-a-request-based-on-elasticsearchexception-or-ioexception-with-the-resthighlevelclient/183779 "2019-05-31T19:23:56Z")
I would like to build in some retry logic on our Elasticsearch requests but I cannot find documentation to explain WHEN a request should be submitted again after a short delay. Also knowing if you are supposed to retry I… --- ## [Canvas Kibana metric background color formating](https://discuss.elastic.co/t/canvas-kibana-metric-background-color-formating/283070)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 12:54pm UTC](https://discuss.elastic.co/t/canvas-kibana-metric-background-color-formating/283070 "2021-09-15T12:54:09Z")
Hi, I am using canvas where I am trying to color format a metric background : color1 if value=0, color2 if value between 0 and 7, and color3 if value \>7 . I looked into several answers here (and also looked at the docs)… --- ## [Threat Intelligence](https://discuss.elastic.co/t/threat-intelligence/110453)
**Author:** [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)\ **Replies:** 6\ **Last updated:** [December 6, 2017, 5:57am UTC](https://discuss.elastic.co/t/threat-intelligence/110453 "2017-12-06T05:57:16Z")
Hello Everyone, Can you suggest me how to integrate threat intelligence platform with ELK i want to integrate threat intelligence with my ELK please guide me how to integrate. Thnks & Regards, Krunal K. --- ## [Memory usage for ELK-style systems](https://discuss.elastic.co/t/memory-usage-for-elk-style-systems/24570)
**Author:** [@rrva](https://discuss.elastic.co/u/rrva)\ **Replies:** 3\ **Last updated:** [June 30, 2015, 9:11pm UTC](https://discuss.elastic.co/t/memory-usage-for-elk-style-systems/24570 "2015-06-30T21:11:54Z")
Hi, I'm using Elasticsearch with Kibana as a searchable/aggregatable event log, so a kind of ELK installation although no logstash. Recently we made the jump to Elasticsearch 0.20 all the way up to 1.5 and added Kibana… --- ## [ElasticSearch Visual Editor](https://discuss.elastic.co/t/elasticsearch-visual-editor/107647)
**Author:** [@panda2004](https://discuss.elastic.co/u/panda2004)\ **Replies:** 2\ **Last updated:** [November 15, 2017, 1:52am UTC](https://discuss.elastic.co/t/elasticsearch-visual-editor/107647 "2017-11-15T01:52:41Z")
Hey there, We must admit that making any changes/updates to an existing document in ElasticSearch is really messy. Some reasons for that might be: Using scripts: even when you can merge existing fields built-in, using… --- ## [How to change the default index name of .Kibana](https://discuss.elastic.co/t/how-to-change-the-default-index-name-of-kibana/105735)
**Author:** [@PrabakarKaruppasamy](https://discuss.elastic.co/u/PrabakarKaruppasamy)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 2:37pm UTC](https://discuss.elastic.co/t/how-to-change-the-default-index-name-of-kibana/105735 "2017-10-30T14:37:46Z")
Hello All, How can we change the .kibana index to some other custom index name? --- ## [Logstash does not pick up all gzip log files](https://discuss.elastic.co/t/logstash-does-not-pick-up-all-gzip-log-files/268446)
**Author:** [@erictung](https://discuss.elastic.co/u/erictung)\ **Replies:** 1\ **Last updated:** [March 26, 2021, 4:39pm UTC](https://discuss.elastic.co/t/logstash-does-not-pick-up-all-gzip-log-files/268446 "2021-03-26T16:39:25Z")
Hi community, this is my first post in this forum and I would like to seek help regarding Logstash. So here's the scenario: I have a Python script to pull logs from Cloudflare ELS and then save it into local folder as … --- ## [Index Lifecycle Management (ILM) Roadmap](https://discuss.elastic.co/t/index-lifecycle-management-ilm-roadmap/180818)
**Author:** [@miga](https://discuss.elastic.co/u/miga)\ **Replies:** 4\ **Last updated:** [May 16, 2019, 7:07am UTC](https://discuss.elastic.co/t/index-lifecycle-management-ilm-roadmap/180818 "2019-05-16T07:07:33Z")
Hi, I already know and used Curator to manage indices and was now reading about the ILM. It seems to me that Curator does a lot more that ILM, currently. However, since ILM is quite new and Curator is some sort of an e… --- ## [Logstash XML parsing issues - trying to send to Graylog](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog/192790)
**Author:** [@eclipsed450](https://discuss.elastic.co/u/eclipsed450)\ **Replies:** 1\ **Last updated:** [July 30, 2019, 4:20am UTC](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog/192790 "2019-07-30T04:20:09Z")
Hi, I would like to parse some NetApp CIFS share audit log XML files, but they are an ugly format that I don't have control over (below): \ \ \… --- ## [Nodes not linking up in cluster](https://discuss.elastic.co/t/nodes-not-linking-up-in-cluster/164206)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 4\ **Last updated:** [January 15, 2019, 9:29pm UTC](https://discuss.elastic.co/t/nodes-not-linking-up-in-cluster/164206 "2019-01-15T21:29:50Z")
Hello again, I'm setting up a 3 node cluster across 3 separate IPs, however the status shows that none are connected to each other. Here's the curl -uelastic -XGET 'cec-es-master:9200/\_cluster/health?pretty' output: … --- ## [Avoiding duplicate records](https://discuss.elastic.co/t/avoiding-duplicate-records/102471)
**Author:** [@bgoldowsky](https://discuss.elastic.co/u/bgoldowsky)\ **Replies:** 3\ **Last updated:** [October 5, 2017, 6:40pm UTC](https://discuss.elastic.co/t/avoiding-duplicate-records/102471 "2017-10-05T18:40:41Z")
I am using the logstash JDBC input plugin to push new rows from a database query into Elasticsearch, updating any old items that have changed. I'd like to avoid duplicates, so I tried to use an "upsert" pattern: output… --- ## [Comparison of String with number fails](https://discuss.elastic.co/t/comparison-of-string-with-number-fails/24480)
**Author:** [@refaelos](https://discuss.elastic.co/u/refaelos)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 10:26pm UTC](https://discuss.elastic.co/t/comparison-of-string-with-number-fails/24480 "2016-02-18T22:26:26Z")
Hey, I'm transferring multiple events into ES using LS. For every event, i'm creating a timeStamp according to a milliseconds field: date { match =\> \[ "saveTime", "UNIX\_MS" \] } Many events succeed but ever… --- ## [How to search xml data precisely](https://discuss.elastic.co/t/how-to-search-xml-data-precisely/109319)
**Author:** [@HelloUniverse](https://discuss.elastic.co/u/HelloUniverse)\ **Replies:** 2\ **Last updated:** [November 28, 2017, 2:49pm UTC](https://discuss.elastic.co/t/how-to-search-xml-data-precisely/109319 "2017-11-28T14:49:31Z")
We have an es index storing some xml data. With the english analyzer, the angular brackets will be treated as stop words. Searching "value" equals searching "element value". How can I manage to search with the angular… --- ## [Permission troubles in Ubuntu with log files when installing plugins (and possibly other actions)](https://discuss.elastic.co/t/permission-troubles-in-ubuntu-with-log-files-when-installing-plugins-and-possibly-other-actions/33143)
**Author:** [@fdorssers](https://discuss.elastic.co/u/fdorssers)\ **Replies:** 2\ **Last updated:** [October 28, 2015, 12:08pm UTC](https://discuss.elastic.co/t/permission-troubles-in-ubuntu-with-log-files-when-installing-plugins-and-possibly-other-actions/33143 "2015-10-28T12:08:44Z")
The machine I'm using runs Ubuntu 15.04 with Java version 1.8.0\_66 (java -version). Installation of Elasticsearch was done using PPA: wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - ec… --- ## [Update-by-query: No mapping found for \[id\] in order to sort on](https://discuss.elastic.co/t/update-by-query-no-mapping-found-for-id-in-order-to-sort-on/339671)
**Author:** [@davysteegen](https://discuss.elastic.co/u/davysteegen)\ **Replies:** 6\ **Last updated:** [August 21, 2023, 1:34pm UTC](https://discuss.elastic.co/t/update-by-query-no-mapping-found-for-id-in-order-to-sort-on/339671 "2023-08-21T13:34:27Z")
Hi, We are in the process of migrating from Elasticsearch 2.3 to 8.6. One thing I noticed is that the sorting in the update-by-query API now only allows to provide a comma separated list of field/sort direction combos. … --- ## [How to download aws cloudwatch log data?](https://discuss.elastic.co/t/how-to-download-aws-cloudwatch-log-data/95158)
**Author:** [@wolfghost](https://discuss.elastic.co/u/wolfghost)\ **Replies:** 6\ **Last updated:** [July 31, 2017, 10:27am UTC](https://discuss.elastic.co/t/how-to-download-aws-cloudwatch-log-data/95158 "2017-07-31T10:27:00Z")
Please tell me about How to download aws cloudwatch log data? --- ## [\[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057)
**Author:** [@Sayontani\_Bose](https://discuss.elastic.co/u/Sayontani_Bose)\ **Replies:** 1\ **Last updated:** [September 18, 2020, 3:01pm UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/249057 "2020-09-18T15:01:23Z")
Hi I have Installed Logstash and whenever i m trying to run by "bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/01-wazuh.conf --config.reload.automatic I am getting this error - \[ERROR\]\[logstash.age… --- ## [Hello World for filebeat](https://discuss.elastic.co/t/hello-world-for-filebeat/197953)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 7\ **Last updated:** [September 5, 2019, 6:51pm UTC](https://discuss.elastic.co/t/hello-world-for-filebeat/197953 "2019-09-05T18:51:19Z")
I am attempting to do a 'hello-world' with filebeat by reading from a file and outputing to stdout or another file. I find that filebeat does not detect any changes to the log files. What would a hello-world look like? … --- ## [Kibana 4.4 release date?](https://discuss.elastic.co/t/kibana-4-4-release-date/40262)
**Author:** [@isaacpm](https://discuss.elastic.co/u/isaacpm)\ **Replies:** 7\ **Last updated:** [January 28, 2016, 4:38pm UTC](https://discuss.elastic.co/t/kibana-4-4-release-date/40262 "2016-01-28T16:38:23Z")
Hi, is there a release date set for kibana 4.4 yet? (or at least approximate) We are really interested in the new functionality of downloading csv from the discover/search page. (assuming is coming out in 4.4, which … [Previous page](https://discuss.elastic.co/top.md?page=691&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=693&per_page=50&period=all)