# Top **URL:** https://discuss.elastic.co/top.md?page=716&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 717 --- ## [Logstash : How to extract a nested field from Json log and only index the content of the nested field](https://discuss.elastic.co/t/logstash-how-to-extract-a-nested-field-from-json-log-and-only-index-the-content-of-the-nested-field/317617)
**Author:** [@Ranjith\_kk](https://discuss.elastic.co/u/Ranjith_kk)\ **Replies:** 5\ **Last updated:** [October 27, 2022, 6:38pm UTC](https://discuss.elastic.co/t/logstash-how-to-extract-a-nested-field-from-json-log-and-only-index-the-content-of-the-nested-field/317617 "2022-10-27T18:38:57Z")
We have some logs in JSON format with a nested field called "data". We are looking for an option to extract only the content of this nested field and send it for indexing with ES. Actual log format: {"field1":"value1",… --- ## [\[Metrics\] Error when trying to fetch data](https://discuss.elastic.co/t/metrics-error-when-trying-to-fetch-data/270804)
**Author:** [@Dzious](https://discuss.elastic.co/u/Dzious)\ **Replies:** 5\ **Last updated:** [April 22, 2021, 1:21pm UTC](https://discuss.elastic.co/t/metrics-error-when-trying-to-fetch-data/270804 "2021-04-22T13:21:27Z")
Hi, Thanks to one of my co-workers, I've recently discovered the Observability tab. Unfortunately i can't manage to make it work properly. When i'm on the Observability page the only thing that i see is Metrics tellin… --- ## [Filebeat on "Docker for AWS" fails to start](https://discuss.elastic.co/t/filebeat-on-docker-for-aws-fails-to-start/110345)
**Author:** [@shazChaudhry](https://discuss.elastic.co/u/shazChaudhry)\ **Replies:** 5\ **Last updated:** [December 17, 2017, 9:25pm UTC](https://discuss.elastic.co/t/filebeat-on-docker-for-aws-fails-to-start/110345 "2017-12-17T21:25:16Z")
My Elastic stack version is at 6.0.0; ELK + Filebeat + Metricbeat running in docker swarm mode; Docker host machines are all ubuntu/xenial64. I have configured filebeat as described in this blog by Carlos Pérez-Aradro… --- ## [Parsing lines that only match a start string](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125)
**Author:** [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)\ **Replies:** 3\ **Last updated:** [January 27, 2020, 9:57am UTC](https://discuss.elastic.co/t/parsing-lines-that-only-match-a-start-string/215125 "2020-01-27T09:57:59Z")
hi Please if you can help. How can we get logstash to log only the lines starting with "central-logging": "true" and ignore rest which we dont need. { "central-logging": "true", "log-date": "2020-01-15 11:19:08 UTC",… --- ## [Modify Vega Json Template data source to read from Elasticsearch Index](https://discuss.elastic.co/t/modify-vega-json-template-data-source-to-read-from-elasticsearch-index/193230)
**Author:** [@Aniss\_Chohra](https://discuss.elastic.co/u/Aniss_Chohra)\ **Replies:** 4\ **Last updated:** [August 6, 2019, 6:35am UTC](https://discuss.elastic.co/t/modify-vega-json-template-data-source-to-read-from-elasticsearch-index/193230 "2019-08-06T06:35:26Z")
Hello everyone, I am new to Vega plugin in kibana and I need some help to change the json code of some visualization to read from my own Elasticsearch index. In more details, I want to use the following template: and… --- ## [\[routing\] is missing for join field \[relation\]](https://discuss.elastic.co/t/routing-is-missing-for-join-field-relation/162502)
**Author:** [@IlyaG](https://discuss.elastic.co/u/IlyaG)\ **Replies:** 1\ **Last updated:** [December 31, 2018, 12:53pm UTC](https://discuss.elastic.co/t/routing-is-missing-for-join-field-relation/162502 "2018-12-31T12:53:20Z")
Process: I receive data from spark as Dataset. Then it is mapped to MyObject (according to the ES mapping) using map() function. Result is converted to RDD and passed to JavaEsSpark.saveToEs(). public class MyObject im… --- ## [Case insensitive search on FieldNames not values](https://discuss.elastic.co/t/case-insensitive-search-on-fieldnames-not-values/87097)
**Author:** [@paul2](https://discuss.elastic.co/u/paul2)\ **Replies:** 1\ **Last updated:** [May 25, 2017, 10:51am UTC](https://discuss.elastic.co/t/case-insensitive-search-on-fieldnames-not-values/87097 "2017-05-25T10:51:26Z")
Hi, I want to search a field. The fields, not field value, are either camel case, pascal case, lower case or upper case. When I do a search I don't know what case the field is. What options do I have... Make everythin… --- ## [Update or remove object from array not working in elastic search](https://discuss.elastic.co/t/update-or-remove-object-from-array-not-working-in-elastic-search/20132)
**Author:** [@Rajit\_Garg](https://discuss.elastic.co/u/Rajit_Garg)\ **Replies:** 1\ **Last updated:** [October 8, 2014, 11:35am UTC](https://discuss.elastic.co/t/update-or-remove-object-from-array-not-working-in-elastic-search/20132 "2014-10-08T11:35:42Z")
\*I have read the nested docs and create mapping and get mapping as follow\* "fields": { "type": "nested", "properties": { "\_id": { "type": "string" … --- ## [Cluster Upgrade, Shard Allocation and null vs all](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867)
**Author:** [@georgef](https://discuss.elastic.co/u/georgef)\ **Replies:** 6\ **Last updated:** [February 2, 2022, 4:08pm UTC](https://discuss.elastic.co/t/cluster-upgrade-shard-allocation-and-null-vs-all/295867 "2022-02-02T16:08:19Z")
Good Afternoon, I was conducting a rolling upgrade from 7.16.2 to 7.16.3 using the directions at Rolling upgrades | Elasticsearch Guide \[7.16\]. I stopped shard allocation with "cluster.routing.allocation.enable": prima… --- ## [Unable to Add Data Node to Elasticsearch Cluster](https://discuss.elastic.co/t/unable-to-add-data-node-to-elasticsearch-cluster/292232)
**Author:** [@Jeffrey\_Meurer](https://discuss.elastic.co/u/Jeffrey_Meurer)\ **Replies:** 6\ **Last updated:** [January 5, 2022, 8:41pm UTC](https://discuss.elastic.co/t/unable-to-add-data-node-to-elasticsearch-cluster/292232 "2022-01-05T20:41:00Z")
Hi, I'm having trouble adding another data node to my Master Elasticsearch. Running 7.16.1 Here's the Elasticsearch.yml from the Master: # ---------------------------------- Cluster ----------------------------------- … --- ## [Download CSV Option for a saved search is not working](https://discuss.elastic.co/t/download-csv-option-for-a-saved-search-is-not-working/210665)
**Author:** [@Sai\_Ramcharan](https://discuss.elastic.co/u/Sai_Ramcharan)\ **Replies:** 6\ **Last updated:** [December 6, 2019, 4:09am UTC](https://discuss.elastic.co/t/download-csv-option-for-a-saved-search-is-not-working/210665 "2019-12-06T04:09:13Z")
I have kibana on docker and I have tried to put a saved search in a dashboard, so to its export to CSV, we have an option "Download CSV", but it's not giving out anything, so can someone help me out on this. Thanks in ad… --- ## [Using Grok to add SID field to oracle database logmessages](https://discuss.elastic.co/t/using-grok-to-add-sid-field-to-oracle-database-logmessages/46216)
**Author:** [@debarun](https://discuss.elastic.co/u/debarun)\ **Replies:** 6\ **Last updated:** [April 4, 2016, 11:30am UTC](https://discuss.elastic.co/t/using-grok-to-add-sid-field-to-oracle-database-logmessages/46216 "2016-04-04T11:30:24Z")
Hi, I am trying to add a field to every message of my alert log . The test has to be extracted from the file name and appended as a field to every log entry. To do that I am doing:- if \[path\] =~ /alert/ { … --- ## [Failed to recover from translog CurrentState\[CLOSED\]](https://discuss.elastic.co/t/failed-to-recover-from-translog-currentstate-closed/192529)
**Author:** [@Bukhtawar\_Khan](https://discuss.elastic.co/u/Bukhtawar_Khan)\ **Replies:** 2\ **Last updated:** [August 7, 2019, 12:51pm UTC](https://discuss.elastic.co/t/failed-to-recover-from-translog-currentstate-closed/192529 "2019-08-07T12:51:09Z")
The cluster has unassigned shards possibly due to shard corruption. The process on the node was flaky due to OOM errors and was frequently starting. Disk space was sufficient on the node. I'm yet to verify the hardware f… --- ## [POC with ELK](https://discuss.elastic.co/t/poc-with-elk/161640)
**Author:** [@hariprasanthdurairaj](https://discuss.elastic.co/u/hariprasanthdurairaj)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 12:14pm UTC](https://discuss.elastic.co/t/poc-with-elk/161640 "2018-12-21T12:14:05Z")
Hi , I'm a Performance Tester and new to ELK tool. I'm doing POC for my project to install Logstash , ELastic search and Kibana in my local machine . I couldnt find any details about the Minimum hardware requirements … --- ## [Logstash 5.6.2 aborts with “warning: ignoring JAVA\_OPTS=-Xmx1024m; pass JVM parameters via LS\_JAVA\_OPTS”](https://discuss.elastic.co/t/logstash-5-6-2-aborts-with-warning-ignoring-java-opts-xmx1024m-pass-jvm-parameters-via-ls-java-opts/102753)
**Author:** [@srini1](https://discuss.elastic.co/u/srini1)\ **Replies:** 2\ **Last updated:** [October 10, 2017, 3:16pm UTC](https://discuss.elastic.co/t/logstash-5-6-2-aborts-with-warning-ignoring-java-opts-xmx1024m-pass-jvm-parameters-via-ls-java-opts/102753 "2017-10-10T15:16:06Z")
I just downloaded latest versions of ELK 5.6.2 to upgrade so that I can use X-pack 5.6.2. Elasticsearch and kibana started with no issues but Logstash is aborting with the below message. "warning: ignoring JAVA\_OPTS=-Xmx… --- ## [Error loading configuration after upgrading to 5.0.1](https://discuss.elastic.co/t/error-loading-configuration-after-upgrading-to-5-0-1/68886)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 5:54pm UTC](https://discuss.elastic.co/t/error-loading-configuration-after-upgrading-to-5-0-1/68886 "2016-12-13T17:54:42Z")
I am getting the following error: "Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: LoadError"} What wrong? Thanks … --- ## [How can I monitor a specific process via metricbeat on Kibana dashboard?](https://discuss.elastic.co/t/how-can-i-monitor-a-specific-process-via-metricbeat-on-kibana-dashboard/152824)
**Author:** [@Swati\_Singh](https://discuss.elastic.co/u/Swati_Singh)\ **Replies:** 3\ **Last updated:** [November 14, 2018, 8:19am UTC](https://discuss.elastic.co/t/how-can-i-monitor-a-specific-process-via-metricbeat-on-kibana-dashboard/152824 "2018-11-14T08:19:39Z")
Hi, I am a beginner in usage of Elastic Stack. I plan to use it for monitoring various machines in a network. I have a system A where elasticsearch and kibana is installed with System B & C where metricbeat is install… --- ## [How can ı split url using grok pattern?](https://discuss.elastic.co/t/how-can-i-split-url-using-grok-pattern/174987)
**Author:** [@khergner](https://discuss.elastic.co/u/khergner)\ **Replies:** 5\ **Last updated:** [April 3, 2019, 1:11pm UTC](https://discuss.elastic.co/t/how-can-i-split-url-using-grok-pattern/174987 "2019-04-03T13:11:15Z")
I want to use grok pattern but ı cant't bellow mode . /xx.test.com/hls/media\_600699.ts I'd like result { url:"xx.test.com", media:"hls",....... } How can ı do? --- ## [Spark SQL and complex types](https://discuss.elastic.co/t/spark-sql-and-complex-types/24873)
**Author:** [@arthur1](https://discuss.elastic.co/u/arthur1)\ **Replies:** 2\ **Last updated:** [July 15, 2016, 4:30am UTC](https://discuss.elastic.co/t/spark-sql-and-complex-types/24873 "2016-07-15T04:30:08Z")
I am using Spark 1.3.1 to access some twitter data stored in ElasticSearch. I am using Spark SQL. The problem I am having has to do with Complex Types. For example, the following SQL works but I can't seem to retrieve… --- ## [Metricbeat http http.json: invalid character '\<' looking for beginning of value error](https://discuss.elastic.co/t/metricbeat-http-http-json-invalid-character-looking-for-beginning-of-value-error/240147)
**Author:** [@Faten](https://discuss.elastic.co/u/Faten)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 11:52pm UTC](https://discuss.elastic.co/t/metricbeat-http-http-json-invalid-character-looking-for-beginning-of-value-error/240147 "2020-07-07T23:52:35Z")
Hi, I configured in metricbeat the http module as below example, but I am getting the following error : http.json: invalid character '\<' looking for beginning of value. # Module: http # Docs: https://www.elastic.co/gui… --- ## [SSL communication fails btw Filebeat (5.1.1) and Logstash (5.1.1)](https://discuss.elastic.co/t/ssl-communication-fails-btw-filebeat-5-1-1-and-logstash-5-1-1/80123)
**Author:** [@Gaurav\_Tandon](https://discuss.elastic.co/u/Gaurav_Tandon)\ **Replies:** 2\ **Last updated:** [March 27, 2017, 2:47pm UTC](https://discuss.elastic.co/t/ssl-communication-fails-btw-filebeat-5-1-1-and-logstash-5-1-1/80123 "2017-03-27T14:47:40Z")
Getting below error in Logstash when filebeat tries to publish logs to Logstash “Looks like you either have an invalid key or your private key was not in PKCS8 format.” I followed guidelines in the docs: https://www… --- ## [Must\_not exists Query not Working Correctly](https://discuss.elastic.co/t/must-not-exists-query-not-working-correctly/70157)
**Author:** [@krmathieu](https://discuss.elastic.co/u/krmathieu)\ **Replies:** 2\ **Last updated:** [December 28, 2016, 8:39pm UTC](https://discuss.elastic.co/t/must-not-exists-query-not-working-correctly/70157 "2016-12-28T20:39:28Z")
I am running the following query against the count end point trying to get a count of all of the documents where the hq field is either missing or empty and I am getting a count of zero back even though I know there are … --- ## [How to export all data to csv?](https://discuss.elastic.co/t/how-to-export-all-data-to-csv/101660)
**Author:** [@MatthD](https://discuss.elastic.co/u/MatthD)\ **Replies:** 1\ **Last updated:** [September 25, 2017, 6:57pm UTC](https://discuss.elastic.co/t/how-to-export-all-data-to-csv/101660 "2017-09-25T18:57:19Z")
I everyone, I just want to export result from a vizualisation but when I export from "raw" of "csv" I could only get the first page of the export (for eg, if my visualisation is pagined into 500 pages how can I do ?) I… --- ## [Changed grok pattern for ingest pipeline and now grok pattern matching is timing out after 1000ms](https://discuss.elastic.co/t/changed-grok-pattern-for-ingest-pipeline-and-now-grok-pattern-matching-is-timing-out-after-1000ms/207775)
**Author:** [@thethomp](https://discuss.elastic.co/u/thethomp)\ **Replies:** 3\ **Last updated:** [November 14, 2019, 7:31pm UTC](https://discuss.elastic.co/t/changed-grok-pattern-for-ingest-pipeline-and-now-grok-pattern-matching-is-timing-out-after-1000ms/207775 "2019-11-14T19:31:41Z")
Hello, I'm using ingest pipelines to do some grokking and formatting before inserting documents into Elasticsearch, I've been using this grok pattern for months without any issue. Today the format of my logs changed a l… --- ## [Filter current dashboard with URL formatter](https://discuss.elastic.co/t/filter-current-dashboard-with-url-formatter/204456)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 2:48pm UTC](https://discuss.elastic.co/t/filter-current-dashboard-with-url-formatter/204456 "2019-10-22T14:48:31Z")
I'm trying to use the index pattern string URL formatter to turn list items in data tables into clickable links that will filter the current page. It works more or less as expected from TSVB, but in mainline Kibana it s… --- ## [Can not start Elasticserach on Ubuntu 16.04](https://discuss.elastic.co/t/can-not-start-elasticserach-on-ubuntu-16-04/111207)
**Author:** [@atifa](https://discuss.elastic.co/u/atifa)\ **Replies:** 3\ **Last updated:** [December 12, 2017, 2:38am UTC](https://discuss.elastic.co/t/can-not-start-elasticserach-on-ubuntu-16-04/111207 "2017-12-12T02:38:34Z")
Hi! I am basic startup user with ELK. I could not start Elasticserach service Platform Linux SLMKibana 4.4.0-103-generic #126-Ubuntu SMP Mon Dec 4 16:23:28 UTC 2017 x86\_64 x86\_64 x86\_64 GNU/Linux Error sudo sys… --- ## [Sending logs from OpenShift using Filebeat to external Elastic Stack](https://discuss.elastic.co/t/sending-logs-from-openshift-using-filebeat-to-external-elastic-stack/183459)
**Author:** [@vivek14](https://discuss.elastic.co/u/vivek14)\ **Replies:** 2\ **Last updated:** [June 3, 2019, 3:46am UTC](https://discuss.elastic.co/t/sending-logs-from-openshift-using-filebeat-to-external-elastic-stack/183459 "2019-06-03T03:46:28Z")
Hi, I want to install Beats (Filebeat for time being) on OpenShift in order to ship data to Logstash. This Logstash instance is part of external Elastic Stack environment outside of OpenShift. Is this currently possibl… --- ## [Kibana with nginx ingress on minikube](https://discuss.elastic.co/t/kibana-with-nginx-ingress-on-minikube/160303)
**Author:** [@sud7](https://discuss.elastic.co/u/sud7)\ **Replies:** 1\ **Last updated:** [December 14, 2018, 1:08pm UTC](https://discuss.elastic.co/t/kibana-with-nginx-ingress-on-minikube/160303 "2018-12-14T13:08:38Z")
Hi, I am trying to test my ELK stack configuration on minikube, Kibana is "exposed" using a ngnix ingress (http only). My ELK stack version is 6.2.4 with searchguard. I went through various posts here as well as on stac… --- ## [Logs are not displaying with event wise](https://discuss.elastic.co/t/logs-are-not-displaying-with-event-wise/83643)
**Author:** [@Raja1](https://discuss.elastic.co/u/Raja1)\ **Replies:** 4\ **Last updated:** [April 27, 2017, 3:21am UTC](https://discuss.elastic.co/t/logs-are-not-displaying-with-event-wise/83643 "2017-04-27T03:21:58Z")
Hi All, I am facing the strange issue, I am seeing the logs in file is 693400 lines but i am seeing 2222419 lines of logs in Kibana. Dont know how it was taken from my log file. I used multiline also but still the same… --- ## [Generate .csv using Elasticsearch API](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 7:48am UTC](https://discuss.elastic.co/t/generate-csv-using-elasticsearch-api/255841 "2020-11-19T07:48:45Z")
Hi team, Can I create .csv file using Elasticsearch REST API. Because I want automatic .csv file generation mechanism. Thanks --- ## [Topbeat index not found](https://discuss.elastic.co/t/topbeat-index-not-found/59191)
**Author:** [@Jozsef](https://discuss.elastic.co/u/Jozsef)\ **Replies:** 5\ **Last updated:** [August 31, 2016, 9:31am UTC](https://discuss.elastic.co/t/topbeat-index-not-found/59191 "2016-08-31T09:31:08Z")
Hello, I'm using the 14 day Elastic Cloud free trial and I'm trying to monitor a remote server using Kibana + Topbeat. Since the Topbeat dashboard was not included by default in Kibana, I loaded them in using the offic… --- ## [Watcher, hits array empty](https://discuss.elastic.co/t/watcher-hits-array-empty/268909)
**Author:** [@dvyu](https://discuss.elastic.co/u/dvyu)\ **Replies:** 2\ **Last updated:** [April 1, 2021, 5:31pm UTC](https://discuss.elastic.co/t/watcher-hits-array-empty/268909 "2021-04-01T17:31:28Z")
Hello, I am trying to use ctx fields in watcher action but some of them is empty My watcher is: { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { … --- ## [Only String and Array types are splittable. field:\[field\]\[Name\] is of type = Hash](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252)
**Author:** [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)\ **Replies:** 1\ **Last updated:** [January 30, 2017, 5:23pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252 "2017-01-30T17:23:58Z")
Hello, I just upgraded from LS 2.4 to 5.1.2 and i am having an issue with splitting values using the "split" filter. This exact configuration works in 2.4 without any issue but i am unable to get past the error in 5.1… --- ## [Get https://localhost:9200/\_xpack/security/\_authenticate?pretty: x509: certificate signed by unknown authority](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256)
**Author:** [@krithb](https://discuss.elastic.co/u/krithb)\ **Replies:** 2\ **Last updated:** [June 12, 2019, 6:30am UTC](https://discuss.elastic.co/t/get-https-localhost-9200-xpack-security-authenticate-pretty-x509-certificate-signed-by-unknown-authority/185256 "2019-06-12T06:30:38Z")
Hi I am getting below error "x509: certificate signed by unknown authority " when running the program. Steps I have followed to generate server-certificates: openssl req -x509 -newkey rsa:4096 -keyout server\_key.pem … --- ## [WSM url for world map](https://discuss.elastic.co/t/wsm-url-for-world-map/99620)
**Author:** [@njaggi](https://discuss.elastic.co/u/njaggi)\ **Replies:** 2\ **Last updated:** [September 19, 2017, 4:16pm UTC](https://discuss.elastic.co/t/wsm-url-for-world-map/99620 "2017-09-19T16:16:29Z")
Hi , I am struggling with WSM configuration for world map especially Canadian map to be visualized. The default map shows US states and city only. Any help linked to some resources would be greatly appreciated. --- ## [ELK Stack and the Lambda Architecture](https://discuss.elastic.co/t/elk-stack-and-the-lambda-architecture/41149)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 2\ **Last updated:** [April 13, 2017, 4:21am UTC](https://discuss.elastic.co/t/elk-stack-and-the-lambda-architecture/41149 "2017-04-13T04:21:31Z")
Currently, I am wondering whether the whole ELK Stack can be mapped to the Lambda Architecture or not, without regarding other technologies? My idea was that Elasticsearch can be settled to the Serving Layer, whereas Log… --- ## [Getting the max theoretical score for a search query](https://discuss.elastic.co/t/getting-the-max-theoretical-score-for-a-search-query/16927)
**Author:** [@Guy\_Bowden](https://discuss.elastic.co/u/Guy_Bowden)\ **Replies:** 2\ **Last updated:** [April 15, 2014, 1:14pm UTC](https://discuss.elastic.co/t/getting-the-max-theoretical-score-for-a-search-query/16927 "2014-04-15T13:14:30Z")
Hi there, is there any way to figure out a maximum theoretical score for a non text search query - something like: "query": { "query\_string": { "query": "location:(1)^3 accom… --- ## [Rule execution failure: Rule registry writing is disabled](https://discuss.elastic.co/t/rule-execution-failure-rule-registry-writing-is-disabled/314755)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 4\ **Last updated:** [January 10, 2023, 10:56pm UTC](https://discuss.elastic.co/t/rule-execution-failure-rule-registry-writing-is-disabled/314755 "2023-01-10T22:56:08Z")
I've created a rule for logs threshold, and there is an error while running the rule: 'Process check wildfly' (that's the name of the rule) - Rule registry writing is disabled due to an error during Rule Data Client Ini… --- ## [ILM, creation\_date and reindexing](https://discuss.elastic.co/t/ilm-creation-date-and-reindexing/297469)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 4\ **Last updated:** [February 22, 2022, 6:19pm UTC](https://discuss.elastic.co/t/ilm-creation-date-and-reindexing/297469 "2022-02-22T18:19:15Z")
Hello Elastic people, this is a follow-up to Is it possible change creation\_date on reindexed Indexes to get Life cycle Management to work on old indexes My usecase - so to say - is learning to use ES while trying to b… --- ## [First search for a while always slow](https://discuss.elastic.co/t/first-search-for-a-while-always-slow/7345)
**Author:** [@PabloEskimo](https://discuss.elastic.co/u/PabloEskimo)\ **Replies:** 4\ **Last updated:** [April 17, 2012, 1:18pm UTC](https://discuss.elastic.co/t/first-search-for-a-while-always-slow/7345 "2012-04-17T13:18:07Z")
Hi, I have a strange problem with ElasticSearch. ElasticSearch is setup with number of indexes rotated on a daily basis (eg: 20120416-logs) for collecting logs from a large number of servers (~2GB/day currently).… --- ## [Painless script for a comparison between two fields taken at interval](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464)
**Author:** [@CyaTo](https://discuss.elastic.co/u/CyaTo)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 10:41pm UTC](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464 "2021-01-07T22:41:21Z")
Hello :wave: I take the ELK suite in hand and try to do a few things with it to learn. Currently I'm trying to make a scripted field that will be able to determine a change between two hashes taken at two different mom… --- ## [Winlogbeat data is not parsing properly](https://discuss.elastic.co/t/winlogbeat-data-is-not-parsing-properly/228820)
**Author:** [@sundar\_elk](https://discuss.elastic.co/u/sundar_elk)\ **Replies:** 8\ **Last updated:** [May 10, 2020, 7:03am UTC](https://discuss.elastic.co/t/winlogbeat-data-is-not-parsing-properly/228820 "2020-05-10T07:03:17Z")
Hi Team, I'm using winlogbeat for pushing all windows events to elasticsearch. Parsing is not happening properly. One of the examples is under “Message” there is “Properties” which when parsed in winlog.event\_data.Pro… --- ## [\[Logstash7.0.1\] lError occurs when connecting to database](https://discuss.elastic.co/t/logstash7-0-1-lerror-occurs-when-connecting-to-database/202630)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 8\ **Last updated:** [October 18, 2019, 9:32am UTC](https://discuss.elastic.co/t/logstash7-0-1-lerror-occurs-when-connecting-to-database/202630 "2019-10-18T09:32:33Z")
Hi Team, I have below logstash configuration file by trying to connect to SAP HANA database(HANA DB and elk stack are not on same laptop). But there's error when executing logstash -f ../config/logstashJDBC.conf. inpu… --- ## [When will the next patch be released for Elasticsearch](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066)
**Author:** [@Aydan](https://discuss.elastic.co/u/Aydan)\ **Replies:** 7\ **Last updated:** [December 20, 2021, 3:41am UTC](https://discuss.elastic.co/t/when-will-the-next-patch-be-released-for-elasticsearch/292066 "2021-12-20T03:41:03Z")
When will be the next patch for Elasticsearch? --- ## [Curator\_cli show\_indices gives no output](https://discuss.elastic.co/t/curator-cli-show-indices-gives-no-output/135519)
**Author:** [@jarnold](https://discuss.elastic.co/u/jarnold)\ **Replies:** 7\ **Last updated:** [June 12, 2018, 3:40pm UTC](https://discuss.elastic.co/t/curator-cli-show-indices-gives-no-output/135519 "2018-06-12T15:40:26Z")
Just trying out creator, so far I've installed the RPM on my elasticsearch node & tried showing my indices which doesn't give any output. I've tried the following commands; \[root@elastic01 ~\]# curator\_cli --host 127.0.0… --- ## [How to update refresh interval for all existing indices](https://discuss.elastic.co/t/how-to-update-refresh-interval-for-all-existing-indices/203174)
**Author:** [@Anikesh\_Paul](https://discuss.elastic.co/u/Anikesh_Paul)\ **Replies:** 2\ **Last updated:** [October 11, 2019, 9:55am UTC](https://discuss.elastic.co/t/how-to-update-refresh-interval-for-all-existing-indices/203174 "2019-10-11T09:55:53Z")
Hi, I want to update the refresh interval for all my existing indices(approx 200-300 indices) to 60s. Though I know we can achieve it using template, but per my understanding that template will be effective only for ne… --- ## [Logstash to Elastic search, Could not index event to Elasticsearch , "reason"=\>"mapper \[\] of different type, current\_type \[long\], merged\_type \[text\]](https://discuss.elastic.co/t/logstash-to-elastic-search-could-not-index-event-to-elasticsearch-reason-mapper-of-different-type-current-type-long-merged-type-text/168279)
**Author:** [@SuperTomcat1](https://discuss.elastic.co/u/SuperTomcat1)\ **Replies:** 2\ **Last updated:** [February 17, 2019, 1:07am UTC](https://discuss.elastic.co/t/logstash-to-elastic-search-could-not-index-event-to-elasticsearch-reason-mapper-of-different-type-current-type-long-merged-type-text/168279 "2019-02-17T01:07:06Z")
error i see in logstash logs: Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"arrayx1", :\_type=\>"doc", :routing=\>nil}, #\\], :response=\> {"index"… --- ## [Support for freebsd](https://discuss.elastic.co/t/support-for-freebsd/39654)
**Author:** [@ChuyenGiaSon](https://discuss.elastic.co/u/ChuyenGiaSon)\ **Replies:** 2\ **Last updated:** [January 21, 2016, 11:45am UTC](https://discuss.elastic.co/t/support-for-freebsd/39654 "2016-01-21T11:45:34Z")
Hi Is there any plan to support for freebsd ? I see that you guys have mac os version so please support freebsd and pfsense also. Thank you very much --- ## [Grok and match windows path](https://discuss.elastic.co/t/grok-and-match-windows-path/183560)
**Author:** [@Sam\_Kisada](https://discuss.elastic.co/u/Sam_Kisada)\ **Replies:** 3\ **Last updated:** [June 2, 2019, 5:04am UTC](https://discuss.elastic.co/t/grok-and-match-windows-path/183560 "2019-06-02T05:04:36Z")
Hi. I have some troubles with matching path to field here is path in table: log.file.path C:\\Program Files\\1cv8\\srvinfo\\reg\_1541\\d3367601-19f9-4ad2-afa0-078939886fc5\\1Cv8Log\\20190217000000.lgp in json it looks like: … --- ## [Setting number\_of\_replicas value to 0 makes the cluster unavailable](https://discuss.elastic.co/t/setting-number-of-replicas-value-to-0-makes-the-cluster-unavailable/155083)
**Author:** [@vnallamothu](https://discuss.elastic.co/u/vnallamothu)\ **Replies:** 3\ **Last updated:** [November 1, 2018, 9:29pm UTC](https://discuss.elastic.co/t/setting-number-of-replicas-value-to-0-makes-the-cluster-unavailable/155083 "2018-11-01T21:29:05Z")
I've installed elasticsearch 5.4 and kibana 5.4 on a single node cluster. after creating index, my shard status went to yellow. So, I thought to edit the number\_of\_replicas value in elasticsearch.yml to "0". Then I am ge… [Previous page](https://discuss.elastic.co/top.md?page=715&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=717&per_page=50&period=all)