# Top **URL:** https://discuss.elastic.co/top.md?page=726&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 727 --- ## [Scripted fields to convert IP string to GeoIP?](https://discuss.elastic.co/t/scripted-fields-to-convert-ip-string-to-geoip/217243)
**Author:** [@Rahul\_Kumar4](https://discuss.elastic.co/u/Rahul_Kumar4)\ **Replies:** 5\ **Last updated:** [January 31, 2020, 1:14am UTC](https://discuss.elastic.co/t/scripted-fields-to-convert-ip-string-to-geoip/217243 "2020-01-31T01:14:17Z")
Is the possible to use Kibana Scripted fields (Using Painless) to convert an IP address field (that is currently indexed as a string) to a GeoJSON object (geoip datatype) field? --- ## ["this field is present in your elasticsearch mapping" on \_source field](https://discuss.elastic.co/t/this-field-is-present-in-your-elasticsearch-mapping-on-source-field/190308)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 5\ **Last updated:** [August 12, 2019, 8:12pm UTC](https://discuss.elastic.co/t/this-field-is-present-in-your-elasticsearch-mapping-on-source-field/190308 "2019-08-12T20:12:46Z")
Upgraded my ELK stack to 6.8 finally. Beats are on 6.4 still. Zero issues all last week and all this week. Today I noticed one of my filters for one of my beats was experiencing some parsing errors on certain log entr… --- ## [Read containers log files using fleet](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [December 10, 2021, 4:50am UTC](https://discuss.elastic.co/t/read-containers-log-files-using-fleet/288067 "2021-12-10T04:50:46Z")
Good afternoon. When studying Fleet and apm agents, the question arose, is it possible to somehow collect logs from docker containers, as done in filebeat, or is there no such possibility yet? --- ## [Reindexing Elasticsearch index with parent and child relationship](https://discuss.elastic.co/t/reindexing-elasticsearch-index-with-parent-and-child-relationship/101331)
**Author:** [@benjes](https://discuss.elastic.co/u/benjes)\ **Replies:** 2\ **Last updated:** [September 22, 2017, 1:55pm UTC](https://discuss.elastic.co/t/reindexing-elasticsearch-index-with-parent-and-child-relationship/101331 "2017-09-22T13:55:34Z")
Hi we currently have a 'message' that can have a link to a 'parent' message. E.g. a reply would have the original message as the parent\_id. PUT { "mappings": { "message": { "properties": { "subj… --- ## [Issues with connecting to Kibana - search\_parse\_exception error - No mapping found for \[buildNum\] in order to sort on](https://discuss.elastic.co/t/issues-with-connecting-to-kibana-search-parse-exception-error-no-mapping-found-for-buildnum-in-order-to-sort-on/32315)
**Author:** [@bgow](https://discuss.elastic.co/u/bgow)\ **Replies:** 2\ **Last updated:** [October 15, 2015, 8:39pm UTC](https://discuss.elastic.co/t/issues-with-connecting-to-kibana-search-parse-exception-error-no-mapping-found-for-buildnum-in-order-to-sort-on/32315 "2015-10-15T20:39:14Z")
I'm new to this world but have followed the instructions for getting Elasticsearch, Logstash and Kibana running. Elasticsearch appears to be running properly: { "name" : "Tether", "cluster\_name" : "elasticsearch",… --- ## [\[ERROR\] logstash.filters.ruby](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841)
**Author:** [@kyk](https://discuss.elastic.co/u/kyk)\ **Replies:** 4\ **Last updated:** [December 29, 2021, 3:14am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby/291841 "2021-12-29T03:14:16Z")
I have the next ruby code ruby { code =\> ' m = event.get("ip\_port").scan(/(\\d+.\\d+.\\d+.\\d+):(\\d+)-\>(\\d+.\\d+.\\d+.\\d+):(\\d+)/) w = ; x = ; y = ; z = m.each { |a| w \<\< a\[0\].to\_fo x \<\< a\[1\].to\_fo y \<\< a\[2\].to\_fo z \<… --- ## [Send metadata from filebeat to logstash](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030)
**Author:** [@bm\_rec](https://discuss.elastic.co/u/bm_rec)\ **Replies:** 4\ **Last updated:** [August 9, 2019, 3:57am UTC](https://discuss.elastic.co/t/send-metadata-from-filebeat-to-logstash/194030 "2019-08-09T03:57:23Z")
Hi! I'd like to send a hostname and some other host metadata from filebeat to Logstash. Then Logstash saves files with a name like: Summaryfile { path =\> "~/%{+YYYY-MM-dd}/%{component}/%{\[@metadata\]\[host… --- ## [How to get border for each visualization in Kibana 5 like Kibana 4](https://discuss.elastic.co/t/how-to-get-border-for-each-visualization-in-kibana-5-like-kibana-4/98218)
**Author:** [@saafianihan](https://discuss.elastic.co/u/saafianihan)\ **Replies:** 4\ **Last updated:** [August 25, 2017, 5:35am UTC](https://discuss.elastic.co/t/how-to-get-border-for-each-visualization-in-kibana-5-like-kibana-4/98218 "2017-08-25T05:35:41Z")
Missing border between two visualization. It is possible in kibana 4. Is there any option to get borders around visualizations in Kibana 5? --- ## [Not getting all Records imported from Logstash to Elasticsearch](https://discuss.elastic.co/t/not-getting-all-records-imported-from-logstash-to-elasticsearch/38697)
**Author:** [@trushad](https://discuss.elastic.co/u/trushad)\ **Replies:** 4\ **Last updated:** [January 11, 2016, 9:20am UTC](https://discuss.elastic.co/t/not-getting-all-records-imported-from-logstash-to-elasticsearch/38697 "2016-01-11T09:20:40Z")
My config file is as below: input { jdbc { jdbc\_driver\_library =\> "D:\\Microsoft JDBC Driver 6.0 for SQL Server\\sqljdbc\_6.0\\enu\\sqljdbc42.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc… --- ## [Iframe Dashboard Filters](https://discuss.elastic.co/t/iframe-dashboard-filters/229618)
**Author:** [@tonyskulk](https://discuss.elastic.co/u/tonyskulk)\ **Replies:** 3\ **Last updated:** [April 25, 2020, 4:57pm UTC](https://discuss.elastic.co/t/iframe-dashboard-filters/229618 "2020-04-25T16:57:20Z")
Hi, I have read a lot about this topic but could not get it to work. The simple problem: I want to include my dashboard in my own webapp. This works fine by using share-\>iframe. Now I want to be able to specify filter… --- ## [Updating settings and mapping with java API](https://discuss.elastic.co/t/updating-settings-and-mapping-with-java-api/6566)
**Author:** [@louis\_gueye](https://discuss.elastic.co/u/louis_gueye)\ **Replies:** 3\ **Last updated:** [February 6, 2012, 8:57am UTC](https://discuss.elastic.co/t/updating-settings-and-mapping-with-java-api/6566 "2012-02-06T08:57:11Z")
Hi all, I'm trying to achieve this sequence with the java API : 1 - create a node ------------------- NodeFactory \*Node node = NodeBuilder.nodeBuilder() //\* \* .local(true).data(true) //\* \* … --- ## [Obtaining an TransportClient via Spring Inject?](https://discuss.elastic.co/t/obtaining-an-transportclient-via-spring-inject/3159)
**Author:** [@Franz\_Allan\_Valencia](https://discuss.elastic.co/u/Franz_Allan_Valencia)\ **Replies:** 3\ **Last updated:** [July 13, 2011, 11:15am UTC](https://discuss.elastic.co/t/obtaining-an-transportclient-via-spring-inject/3159 "2011-07-13T11:15:53Z")
Good day, I am currently instantiating a Client similar to http://www.elasticsearch.com/docs/elasticsearch/java\_api/client/#TransportClientusing spring, which implies that I only instantiate this once and use it ev… --- ## [Runtime conditional](https://discuss.elastic.co/t/runtime-conditional/324210)
**Author:** [@LorensiusOksigii](https://discuss.elastic.co/u/LorensiusOksigii)\ **Replies:** 7\ **Last updated:** [January 31, 2023, 6:39pm UTC](https://discuss.elastic.co/t/runtime-conditional/324210 "2023-01-31T18:39:59Z")
Hi, i get confuse how to set a new value for msg value from message field. i want set if message value == { "msg" : "ICMP flood" }, msg value will show only ICMP flood i have try this but getting error --- ## [{"error":"Content-Type header \[application/x-www-form-urlencoded\] is not supported","status":406}](https://discuss.elastic.co/t/error-content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/122017)
**Author:** [@Chiang\_Poh\_Lin](https://discuss.elastic.co/u/Chiang_Poh_Lin)\ **Replies:** 1\ **Last updated:** [March 4, 2018, 5:34am UTC](https://discuss.elastic.co/t/error-content-type-header-application-x-www-form-urlencoded-is-not-supported-status-406/122017 "2018-03-04T05:34:40Z")
Hi, so i was installing elk on server following this website: https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04#load-kibana-dashboards so until h… --- ## [Input from JDBC - Convert to JSON & Push to SNS Topic](https://discuss.elastic.co/t/input-from-jdbc-convert-to-json-push-to-sns-topic/98395)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 7\ **Last updated:** [August 29, 2017, 7:59pm UTC](https://discuss.elastic.co/t/input-from-jdbc-convert-to-json-push-to-sns-topic/98395 "2017-08-29T19:59:44Z")
Team, Not sure if this is possible via one logstash pipeline so appreciate feedback. Data Source: Oracle DB. Extract using standard JDBC input plugin. Destination: SNS After extracting fields from DB e.g. lets say my… --- ## [Only visualize fields of the the latest document](https://discuss.elastic.co/t/only-visualize-fields-of-the-the-latest-document/24420)
**Author:** [@rio2014](https://discuss.elastic.co/u/rio2014)\ **Replies:** 5\ **Last updated:** [July 3, 2015, 1:43pm UTC](https://discuss.elastic.co/t/only-visualize-fields-of-the-the-latest-document/24420 "2015-07-03T13:43:35Z")
We have several servers that send config data to the elastic db. I would like to build a visualization with the current settings for each server. I have sections like "Operating System" or "database version" and each ser… --- ## [Elastic cluster sizing estimator : why I am not having 2 data nodes](https://discuss.elastic.co/t/elastic-cluster-sizing-estimator-why-i-am-not-having-2-data-nodes/282378)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 3\ **Last updated:** [August 25, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elastic-cluster-sizing-estimator-why-i-am-not-having-2-data-nodes/282378 "2021-08-25T15:39:14Z")
I am trying to estimate my cluster size based on an excel sheet provided by elastic.co in a webinar in 20/05/2021 about "elastic sizing", I filled the daily volume data but I see that it gives me only 1 data not for "Ho… --- ## [Wildcard directories](https://discuss.elastic.co/t/wildcard-directories/225544)
**Author:** [@mimimike](https://discuss.elastic.co/u/mimimike)\ **Replies:** 1\ **Last updated:** [March 30, 2020, 9:02am UTC](https://discuss.elastic.co/t/wildcard-directories/225544 "2020-03-30T09:02:22Z")
Hi, I want to process the logs of multiple directories with filebeat. This files are contained in a share folder. I do not understand why the path "\\\\share\\folder\\\*.log" works well and the path "\\\\share\\\*\\\*.log" works w… --- ## [Is it possible to hide a colum in visualization](https://discuss.elastic.co/t/is-it-possible-to-hide-a-colum-in-visualization/45682)
**Author:** [@Jpuch](https://discuss.elastic.co/u/Jpuch)\ **Replies:** 1\ **Last updated:** [March 29, 2016, 4:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-hide-a-colum-in-visualization/45682 "2016-03-29T16:53:27Z")
Hi, I'v put some filter in my data table visualization but i don't want them to appear in the final table. Is there an option to hide columns ? Thanks for the help --- ## [When \`xpack.ml.enabled\` is set to false, entering Kibana's machine learning page has a error in the log](https://discuss.elastic.co/t/when-xpack-ml-enabled-is-set-to-false-entering-kibanas-machine-learning-page-has-a-error-in-the-log/301158)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 4\ **Last updated:** [April 1, 2022, 12:18am UTC](https://discuss.elastic.co/t/when-xpack-ml-enabled-is-set-to-false-entering-kibanas-machine-learning-page-has-a-error-in-the-log/301158 "2022-04-01T00:18:43Z")
I am doing some tests in docker-compose.yml, I noticed that when I set the Elasticsearch environment variable to contain XPACK\_ML\_ENABLED: false, the machine learning page of the Kibana instance will jump to some urls … --- ## [Log source "unknown" in Observability Overview](https://discuss.elastic.co/t/log-source-unknown-in-observability-overview/262568)
**Author:** [@strophy](https://discuss.elastic.co/u/strophy)\ **Replies:** 3\ **Last updated:** [January 30, 2021, 4:20am UTC](https://discuss.elastic.co/t/log-source-unknown-in-observability-overview/262568 "2021-01-30T04:20:38Z")
I'm new to Elastic Stack and have successfully set up a pipeline with Filebeat, Elasticsearch and Kibana to ingest data from log files. I have set up the display fields in Observability settings, which works for the Logs… --- ## [Foreach index action error](https://discuss.elastic.co/t/foreach-index-action-error/215107)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 8\ **Last updated:** [January 16, 2020, 1:42pm UTC](https://discuss.elastic.co/t/foreach-index-action-error/215107 "2020-01-16T13:42:52Z")
Hi, As i was trying to index multiple hits using the foreach action and index action, i'm getting an error similar to this post When reading the documentation it says it support multiple documents and since \_doc field… --- ## [Monit + logstash](https://discuss.elastic.co/t/monit-logstash/64553)
**Author:** [@rashthedude](https://discuss.elastic.co/u/rashthedude)\ **Replies:** 3\ **Last updated:** [November 30, 2016, 9:32pm UTC](https://discuss.elastic.co/t/monit-logstash/64553 "2016-11-30T21:32:44Z")
Hi there, I'm having a difficult time trying to monitor Logstash using monit. All I want to do is check if Logstash is either up/down and if it's processing requests. Can anyone point to me to a direction here? Rega… --- ## [Logstash input multiple files output one index elasticsearch failure](https://discuss.elastic.co/t/logstash-input-multiple-files-output-one-index-elasticsearch-failure/72898)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 2\ **Last updated:** [January 27, 2017, 9:08am UTC](https://discuss.elastic.co/t/logstash-input-multiple-files-output-one-index-elasticsearch-failure/72898 "2017-01-27T09:08:39Z")
hi , plz i m trying to receive multiple logs then after filteriing i want to have one index containing all filtered logs but i failed this is my config file input { file { path =\>"C:\\elk\\pvin" type =\> "pvin" s… --- ## [Possible 7.7.0 bug with searching idle shards](https://discuss.elastic.co/t/possible-7-7-0-bug-with-searching-idle-shards/233168)
**Author:** [@Andy\_Wick](https://discuss.elastic.co/u/Andy_Wick)\ **Replies:** 1\ **Last updated:** [May 29, 2020, 12:02pm UTC](https://discuss.elastic.co/t/possible-7-7-0-bug-with-searching-idle-shards/233168 "2020-05-29T12:02:32Z")
I'm having an issue with 7.7.0 where when I search an index that does NOT have refresh\_interval set, I don't get all the results back I'm expecting. If I do the query over and over by the 6th time it will work and have … --- ## [Filebeat netflow module do not start after update to 7.11](https://discuss.elastic.co/t/filebeat-netflow-module-do-not-start-after-update-to-7-11/264037)
**Author:** [@UweW](https://discuss.elastic.co/u/UweW)\ **Replies:** 7\ **Last updated:** [March 22, 2021, 7:53am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-do-not-start-after-update-to-7-11/264037 "2021-03-22T07:53:53Z")
Hi, after updating the stack from 7.10.2 to 7.11 the netflow module will not start anymore. The only message we see every 10 seconds in journal is filebeat\[1976620\]: 2021-02-11T17:40:01.242+0100 ERROR \[r… --- ## [How Make Select Case When from ElasticSearch](https://discuss.elastic.co/t/how-make-select-case-when-from-elasticsearch/190295)
**Author:** [@amateur](https://discuss.elastic.co/u/amateur)\ **Replies:** 1\ **Last updated:** [July 13, 2019, 6:26am UTC](https://discuss.elastic.co/t/how-make-select-case-when-from-elasticsearch/190295 "2019-07-13T06:26:52Z")
Hello, I have an integration between Grafana and SQL Server, but I want to change to ElasticSearch, but I need to know how to do this query in Grafana with for ElasticSeacrh: "SELECT dbo.access.time, case when dbo.ac… --- ## [Elasticsearch dead but subsys locked](https://discuss.elastic.co/t/elasticsearch-dead-but-subsys-locked/257066)
**Author:** [@ItsMee](https://discuss.elastic.co/u/ItsMee)\ **Replies:** 5\ **Last updated:** [December 3, 2020, 1:33pm UTC](https://discuss.elastic.co/t/elasticsearch-dead-but-subsys-locked/257066 "2020-12-03T13:33:22Z")
Dear All, I have tried to restart the elasticsearch but getting 'elasticsearch dead but subsys locked' after start. I have removed the lock the file(elasticsearch) under /var/lock/subsys/ multiple times but no luck. Co… --- ## [Data collection from Proxmox](https://discuss.elastic.co/t/data-collection-from-proxmox/295469)
**Author:** [@vovan13111](https://discuss.elastic.co/u/vovan13111)\ **Replies:** 3\ **Last updated:** [February 3, 2022, 2:47pm UTC](https://discuss.elastic.co/t/data-collection-from-proxmox/295469 "2022-02-03T14:47:09Z")
Good afternoon. When studying metricbeat for the ability to collect data from kvm, the question arose, will the ability to collect data from proxmox be added, like from vSphere? If this is already possible, then please … --- ## [Sending logs from a remote machine](https://discuss.elastic.co/t/sending-logs-from-a-remote-machine/151330)
**Author:** [@calebereis](https://discuss.elastic.co/u/calebereis)\ **Replies:** 2\ **Last updated:** [October 8, 2018, 1:15pm UTC](https://discuss.elastic.co/t/sending-logs-from-a-remote-machine/151330 "2018-10-08T13:15:26Z")
Hi everyone, I'm using the Elastic Stack with Elasticsearch, Logstash and Kibana in different servers. It's communicating well and I have acess to the Kibana web browser. But, The server that is running the logs I want… --- ## [Min RAM during dev for large dataset](https://discuss.elastic.co/t/min-ram-during-dev-for-large-dataset/104479)
**Author:** [@duderson](https://discuss.elastic.co/u/duderson)\ **Replies:** 2\ **Last updated:** [October 19, 2017, 11:17pm UTC](https://discuss.elastic.co/t/min-ram-during-dev-for-large-dataset/104479 "2017-10-19T23:17:57Z")
So I've really got two questions here. If I have about 100GB of documents that I want to make searchable with elasticsearch, is it bad to just stick it in a single node / shard? ( I can figure out replicas later when … --- ## [How to create a logstash instance in Elastic Cloud](https://discuss.elastic.co/t/how-to-create-a-logstash-instance-in-elastic-cloud/131731)
**Author:** [@EloaCardoso](https://discuss.elastic.co/u/EloaCardoso)\ **Replies:** 8\ **Last updated:** [May 24, 2018, 5:14pm UTC](https://discuss.elastic.co/t/how-to-create-a-logstash-instance-in-elastic-cloud/131731 "2018-05-24T17:14:36Z")
I am a bit lost in how to create a logstash instance in the EC. I've changed the following fields within logstash.yml file: cloud.id: \:\ cloud.auth: \:\ http.host: "\ **Author:** [@Xor44](https://discuss.elastic.co/u/Xor44)\ **Replies:** 5\ **Last updated:** [July 5, 2021, 4:38pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13-monitoring-execution-failed/277334 "2021-07-05T16:38:13Z") Hi Folks , I have lot of issue with my ELK Stack . This stack is composed of 3 nodes ( Master , Data , Data ) . Logs are populated with the following errors . When I'm trying to make a transform on an index it's failed … --- ## [Logstash JDBC index field with multiple values](https://discuss.elastic.co/t/logstash-jdbc-index-field-with-multiple-values/199498)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 5\ **Last updated:** [September 17, 2019, 8:40pm UTC](https://discuss.elastic.co/t/logstash-jdbc-index-field-with-multiple-values/199498 "2019-09-17T20:40:20Z")
Newbie here, I am using Logstash to index data on our PostgreSQL database, the thing is, we have a very complex query for just one record,e.g 1 table has many relations. Is it possible to format the index like this: { … --- ## [How to revert metadata blocking?](https://discuss.elastic.co/t/how-to-revert-metadata-blocking/14129)
**Author:** [@ramazan](https://discuss.elastic.co/u/ramazan)\ **Replies:** 5\ **Last updated:** [October 31, 2013, 9:46pm UTC](https://discuss.elastic.co/t/how-to-revert-metadata-blocking/14129 "2013-10-31T21:46:04Z")
Hi, I am facing an issue related to the metadata blocking setting. I told ES to disable the metadata changes for an index using update API but don't know how to revert it back. I tried reverting it back using t… --- ## [Kibana, SAML, Okta - help?](https://discuss.elastic.co/t/kibana-saml-okta-help/178126)
**Author:** [@honzo](https://discuss.elastic.co/u/honzo)\ **Replies:** 7\ **Last updated:** [April 26, 2019, 4:34am UTC](https://discuss.elastic.co/t/kibana-saml-okta-help/178126 "2019-04-26T04:34:34Z")
Hello, I am trying to get our EC Kibana to authenticate with Okta, following the steps in the guide, but not having any luck :cry: Here is the elastic.yml override: xpack: security: authc: realms: … --- ## [Kibana 7.5.0 - Unable to generate report Error: Failed to decrypt report job data](https://discuss.elastic.co/t/kibana-7-5-0-unable-to-generate-report-error-failed-to-decrypt-report-job-data/233824)
**Author:** [@Zabulon](https://discuss.elastic.co/u/Zabulon)\ **Replies:** 1\ **Last updated:** [June 16, 2020, 9:19pm UTC](https://discuss.elastic.co/t/kibana-7-5-0-unable-to-generate-report-error-failed-to-decrypt-report-job-data/233824 "2020-06-16T21:19:39Z")
Hello, I'm trying to run reports and get stock with that message in the reporting console: \`Unable to generate report Error: Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set a… --- ## [Extract file name and add as a field](https://discuss.elastic.co/t/extract-file-name-and-add-as-a-field/282105)
**Author:** [@Sherabu](https://discuss.elastic.co/u/Sherabu)\ **Replies:** 2\ **Last updated:** [August 21, 2021, 5:30pm UTC](https://discuss.elastic.co/t/extract-file-name-and-add-as-a-field/282105 "2021-08-21T17:30:50Z")
Hi bro and sis I will be sending file from filebeat to logstash. Is there a way I can extract file name on logstash filter? I want to add as a new field My file name Path/sample.log Path/sample.20210821 Your small a… --- ## [Behavior of + in Simple Query Strings vs. Query Strings](https://discuss.elastic.co/t/behavior-of-in-simple-query-strings-vs-query-strings/53823)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 3\ **Last updated:** [June 23, 2016, 7:52pm UTC](https://discuss.elastic.co/t/behavior-of-in-simple-query-strings-vs-query-strings/53823 "2016-06-23T19:52:45Z")
Does the + operator behave differently under simple\_query\_string queries than under query\_string queries? The simple\_query\_string documentation says: + signifies AND operation From my testing and from the way this … --- ## [Packetbeat for telecom grade network traces](https://discuss.elastic.co/t/packetbeat-for-telecom-grade-network-traces/138061)
**Author:** [@Luke\_Devon](https://discuss.elastic.co/u/Luke_Devon)\ **Replies:** 1\ **Last updated:** [June 30, 2018, 3:17pm UTC](https://discuss.elastic.co/t/packetbeat-for-telecom-grade-network-traces/138061 "2018-06-30T15:17:37Z")
Hi, I am thinking of implementing Packetbeats to send telecom grade packet traces to eleasticsearch. In a telecom network, we are dealing with different types of protocol stacks such as SS7 (including GSM MAP), and TCP… --- ## [Dynamic rollover alias and template name](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371)
**Author:** [@tong6462](https://discuss.elastic.co/u/tong6462)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 1:32am UTC](https://discuss.elastic.co/t/dynamic-rollover-alias-and-template-name/280371 "2021-08-04T01:32:57Z")
Hi. Could it be possible to allow using variables in the properties " ilm\_rollover\_alias " as well as " template\_name " in the Elasticsearch output, like we can do with the "index" property? Index lifecycle error ille… --- ## [Issue with Endpoint agent](https://discuss.elastic.co/t/issue-with-endpoint-agent/261610)
**Author:** [@trixrahbit](https://discuss.elastic.co/u/trixrahbit)\ **Replies:** 6\ **Last updated:** [February 10, 2021, 12:30am UTC](https://discuss.elastic.co/t/issue-with-endpoint-agent/261610 "2021-02-10T00:30:18Z")
I finally got everything setup for my stack but the endpoints are generating a "Failed to download or validate user artifacts error. " I cant seem to find anything on this. Could anyone point me in the right direction? … --- ## [How to re-index if I have changed the shard numbers?](https://discuss.elastic.co/t/how-to-re-index-if-i-have-changed-the-shard-numbers/39966)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 6\ **Last updated:** [July 26, 2016, 10:46am UTC](https://discuss.elastic.co/t/how-to-re-index-if-i-have-changed-the-shard-numbers/39966 "2016-07-26T10:46:00Z")
Hi, I am newbie to ELK. I have set up the ELK stack on two Windows boxes; one is for ES and Kibana and other Logstash. I have configured the ES with default config therefore, 5 shards were created though I am using onl… --- ## [How to print the logs of logstash execution?](https://discuss.elastic.co/t/how-to-print-the-logs-of-logstash-execution/32539)
**Author:** [@Gaurav\_Varma](https://discuss.elastic.co/u/Gaurav_Varma)\ **Replies:** 1\ **Last updated:** [October 20, 2015, 12:09am UTC](https://discuss.elastic.co/t/how-to-print-the-logs-of-logstash-execution/32539 "2015-10-20T00:09:22Z")
Is there a way we can print logstash execution output to a log file? For example, I am using a jdbc plugin to read data as per sql\_last\_start. I want to know at what time the query was executed, how many records in re… --- ## [Restore index templates?](https://discuss.elastic.co/t/restore-index-templates/91870)
**Author:** [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 10:08am UTC](https://discuss.elastic.co/t/restore-index-templates/91870 "2017-07-05T10:08:28Z")
Hi everyone, We have delete by error our folder that contains all data of our elasticsearch. I have restored it with our backup solution (TSM) and restore index on elastic from a small snapshot. After that, we seen the… --- ## [Simple Query to search within log text (not keyword)](https://discuss.elastic.co/t/simple-query-to-search-within-log-text-not-keyword/327095)
**Author:** [@Mark\_S](https://discuss.elastic.co/u/Mark_S)\ **Replies:** 3\ **Last updated:** [March 6, 2023, 6:51pm UTC](https://discuss.elastic.co/t/simple-query-to-search-within-log-text-not-keyword/327095 "2023-03-06T18:51:30Z")
I am trying to search within text that originates from log files. Am I using the correct query? Any suggestions on how to restrict results only to the exact match? (eg show only results with higher score?) I am using e… --- ## [Exiting: Could not start registrar: Error loading state: open /filebeat/data/registry: permission denied](https://discuss.elastic.co/t/exiting-could-not-start-registrar-error-loading-state-open-filebeat-data-registry-permission-denied/153349)
**Author:** [@sebastiaanspeck](https://discuss.elastic.co/u/sebastiaanspeck)\ **Replies:** 3\ **Last updated:** [October 24, 2018, 6:45pm UTC](https://discuss.elastic.co/t/exiting-could-not-start-registrar-error-loading-state-open-filebeat-data-registry-permission-denied/153349 "2018-10-24T18:45:00Z")
When running /filebeat --setup -e It exits with the next error: 2018-10-22T10:19:29.306+0200 ERROR instance/beat.go:743 Exiting: Could not start registrar: Error loading state: open /filebeat/data/registry: permission … --- ## [How to store a geo point csv file (contents) in elasticsearch and use it in a query filter against a field in an index](https://discuss.elastic.co/t/how-to-store-a-geo-point-csv-file-contents-in-elasticsearch-and-use-it-in-a-query-filter-against-a-field-in-an-index/131111)
**Author:** [@frehman\_pk](https://discuss.elastic.co/u/frehman_pk)\ **Replies:** 8\ **Last updated:** [May 9, 2018, 7:39am UTC](https://discuss.elastic.co/t/how-to-store-a-geo-point-csv-file-contents-in-elasticsearch-and-use-it-in-a-query-filter-against-a-field-in-an-index/131111 "2018-05-09T07:39:04Z")
I am new to ES. I have an index of user profiles, index contains geo point data of users along with the other fields. we upload a csv file containing geo points and i need to write a query to filter user based on the geo… --- ## [Logstash fingerprint not able to remove duplicate](https://discuss.elastic.co/t/logstash-fingerprint-not-able-to-remove-duplicate/200663)
**Author:** [@sharry007](https://discuss.elastic.co/u/sharry007)\ **Replies:** 7\ **Last updated:** [September 24, 2019, 5:45am UTC](https://discuss.elastic.co/t/logstash-fingerprint-not-able-to-remove-duplicate/200663 "2019-09-24T05:45:24Z")
Hi, We have been using logstash fingerprint plugin since quite sometime. We now have a specific requirement of creating fingerprint hashkey using multiple fields of Elasticsearch indexes, but we are stuck in two cases a… --- ## [How does elasticsearch schedule shards for query](https://discuss.elastic.co/t/how-does-elasticsearch-schedule-shards-for-query/155280)
**Author:** [@Jianzhou\_Z](https://discuss.elastic.co/u/Jianzhou_Z)\ **Replies:** 7\ **Last updated:** [November 5, 2018, 4:56am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-schedule-shards-for-query/155280 "2018-11-05T04:56:11Z")
I have a cluster with 11 nodes, and a table with 16 shard. Each shard has one replica. The allocation of the shards are like the follow. I added a number with ' for a replica. For example, 4 is the primary node, and 4' i… [Previous page](https://discuss.elastic.co/top.md?page=725&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=727&per_page=50&period=all)