# Top **URL:** https://discuss.elastic.co/top.md?page=73&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 74 --- ## [Help me in configure filebeat index](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253)
**Author:** [@Rajesh119](https://discuss.elastic.co/u/Rajesh119)\ **Replies:** 21\ **Last updated:** [May 24, 2022, 11:58am UTC](https://discuss.elastic.co/t/help-me-in-configure-filebeat-index/305253 "2022-05-24T11:58:34Z")
i use this command, it will not shown my filebeat index curl http://localhost:9200/\_cat/indices?v And i use below command to know the status filebeat -e -c /etc/filebeat/filebeat.yml output: {"log.level":"info",… --- ## [Pipeline Not Working Filebeats -\> Elasticsearch (5.0.0 Alpha 3)](https://discuss.elastic.co/t/pipeline-not-working-filebeats-elasticsearch-5-0-0-alpha-3/54197)
**Author:** [@petercort](https://discuss.elastic.co/u/petercort)\ **Replies:** 13\ **Last updated:** [July 19, 2016, 12:12pm UTC](https://discuss.elastic.co/t/pipeline-not-working-filebeats-elasticsearch-5-0-0-alpha-3/54197 "2016-07-19T12:12:19Z")
I'm parsing IIS logs and am unable to get the 'message' field to parse in Elasticsearch. This is my filebeat.yml file (relevant lines) output: ### Elasticsearch as output elasticsearch: hosts: \["elk-0… --- ## [Ssl certificate error with APM using fleet](https://discuss.elastic.co/t/ssl-certificate-error-with-apm-using-fleet/311786)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 17\ **Last updated:** [August 17, 2022, 5:42am UTC](https://discuss.elastic.co/t/ssl-certificate-error-with-apm-using-fleet/311786 "2022-08-17T05:42:08Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [Move the location of newly added add\_field out of nested?](https://discuss.elastic.co/t/move-the-location-of-newly-added-add-field-out-of-nested/59143)
**Author:** [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)\ **Replies:** 11\ **Last updated:** [August 30, 2016, 5:49am UTC](https://discuss.elastic.co/t/move-the-location-of-newly-added-add-field-out-of-nested/59143 "2016-08-30T05:49:06Z")
Hi I can access the nested field by \[field\]\[sub\_field\], and add this as a new field. However, this new field is still nested, then it is no use to me. How can i change its position out of net pls? Below is an example. I… --- ## [Issues parsing JSON with deep nesting](https://discuss.elastic.co/t/issues-parsing-json-with-deep-nesting/176133)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 22\ **Last updated:** [April 11, 2019, 9:38pm UTC](https://discuss.elastic.co/t/issues-parsing-json-with-deep-nesting/176133 "2019-04-11T21:38:31Z")
the array looks like this. data.children.data.replies.data.children.data.replies.data.children.data.replies.data.children.data.replies.data.children.....ETC I have this JSON array that nests and I would like to get all… --- ## [Connection: close](https://discuss.elastic.co/t/connection-close/165687)
**Author:** [@Pradeepan](https://discuss.elastic.co/u/Pradeepan)\ **Replies:** 10\ **Last updated:** [February 6, 2019, 1:39pm UTC](https://discuss.elastic.co/t/connection-close/165687 "2019-02-06T13:39:47Z")
http://localhost:5601 not success. Please help me \[root@localhost ~\]# curl -XGET http://localhost:5601/status -I HTTP/1.1 200 OK kbn-name: kibana kbn-xpack-sig: 7c2d9d868c80e37c5b837fc2ba7d44d3 cache-control: no-cac… --- ## [Convert Timestamp to UTC+0 and keep microseconds](https://discuss.elastic.co/t/convert-timestamp-to-utc-0-and-keep-microseconds/100811)
**Author:** [@Dr-Crow](https://discuss.elastic.co/u/Dr-Crow)\ **Replies:** 11\ **Last updated:** [September 21, 2017, 7:12pm UTC](https://discuss.elastic.co/t/convert-timestamp-to-utc-0-and-keep-microseconds/100811 "2017-09-21T19:12:14Z")
I am having a issue with my messages being out of order when I sort on @timestamp in Elastic Search. This is because @timestamp field does not store microseconds. What I want to do is take the timestamps I am getting fro… --- ## [Logstash/Elasticsearch beginner: Can't get File plugin to work. What am I doing wrong?](https://discuss.elastic.co/t/logstash-elasticsearch-beginner-cant-get-file-plugin-to-work-what-am-i-doing-wrong/26020)
**Author:** [@Marius\_Mathisen](https://discuss.elastic.co/u/Marius_Mathisen)\ **Replies:** 11\ **Last updated:** [July 25, 2015, 8:20am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-beginner-cant-get-file-plugin-to-work-what-am-i-doing-wrong/26020 "2015-07-25T08:20:39Z")
I try to run a JSON file trough Logstash to index in Elasticsearch, but I can't seem to get it indexed. I don't get any error messages or anything. It says: "Logstash startup complete". I have a conf file called "logst… --- ## [Performance of painless scripts in 6.x](https://discuss.elastic.co/t/performance-of-painless-scripts-in-6-x/137308)
**Author:** [@vangap](https://discuss.elastic.co/u/vangap)\ **Replies:** 9\ **Last updated:** [July 2, 2018, 11:50am UTC](https://discuss.elastic.co/t/performance-of-painless-scripts-in-6-x/137308 "2018-07-02T11:50:48Z")
I have tested with 6.3 + Java 10 in docker and also 6.2.4 + Java 8 in docker. Behavior is same. With the same query, ES 6.x latencies are 10x slower than 5.6.4. I have observed similar behavior with few other scripted … --- ## [Elastic search security](https://discuss.elastic.co/t/elastic-search-security/184671)
**Author:** [@Piotr\_Komisarski](https://discuss.elastic.co/u/Piotr_Komisarski)\ **Replies:** 12\ **Last updated:** [June 7, 2019, 10:30am UTC](https://discuss.elastic.co/t/elastic-search-security/184671 "2019-06-07T10:30:52Z")
Hi On rest /api/security/v1/users I'm getting : {"statusCode":403,"error":"Forbidden","message":"Access is denied because Security is disabled in Elasticsearch."} But i did everything according to security docs. I h… --- ## [Fitebeat 6.3.1 system module issue](https://discuss.elastic.co/t/fitebeat-6-3-1-system-module-issue/141587)
**Author:** [@mouli\_v](https://discuss.elastic.co/u/mouli_v)\ **Replies:** 29\ **Last updated:** [July 27, 2018, 8:00pm UTC](https://discuss.elastic.co/t/fitebeat-6-3-1-system-module-issue/141587 "2018-07-27T20:00:52Z")
recently I have installed fitebeat 6.3.1. I see the system logs are propagating to elasticsearch with 7hours delay. I have set var.convert\_timezone true, still, I don't see those logs with current time. system module … --- ## [Ingest-user-agent](https://discuss.elastic.co/t/ingest-user-agent/138658)
**Author:** [@naphtali](https://discuss.elastic.co/u/naphtali)\ **Replies:** 25\ **Last updated:** [August 1, 2018, 11:31am UTC](https://discuss.elastic.co/t/ingest-user-agent/138658 "2018-08-01T11:31:06Z")
Hi, I have the elk pack version 6.3.0. One node, on windows. I'm trying to use file beat with the iis module. For that I needed to install the ingest-user-agent and the ingest-geoip plugins. I run the install of the p… --- ## [Getting NULL\_POINTER\_EXCEPTION with URI Search](https://discuss.elastic.co/t/getting-null-pointer-exception-with-uri-search/71993)
**Author:** [@ori.rubinfeld](https://discuss.elastic.co/u/ori.rubinfeld)\ **Replies:** 18\ **Last updated:** [January 18, 2017, 3:34pm UTC](https://discuss.elastic.co/t/getting-null-pointer-exception-with-uri-search/71993 "2017-01-18T15:34:13Z")
Hi, We have Elasticsearch release 2.4.1 While running a URI Search, the results are: curl -u uname:password -XGET 'localhost:9200/myindex/mytype/\_search?q=myfield:123456&pretty' { "error" : { "root\_cause" :… --- ## [Index names including yyyy-mm-dd](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481)
**Author:** [@gormanst](https://discuss.elastic.co/u/gormanst)\ **Replies:** 13\ **Last updated:** [January 16, 2019, 4:14pm UTC](https://discuss.elastic.co/t/index-names-including-yyyy-mm-dd/164481 "2019-01-16T16:14:53Z")
I am new to elasticsearch and am trying to figure out index management. I index smallish documents continuously for a week. I would like the index names to include the date in their name along with a project specifier i.… --- ## [Array index out of bound exception](https://discuss.elastic.co/t/array-index-out-of-bound-exception/283451)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 14\ **Last updated:** [September 22, 2021, 4:44pm UTC](https://discuss.elastic.co/t/array-index-out-of-bound-exception/283451 "2021-09-22T16:44:42Z")
Hello! i have snapshot repository which is located on NFS share, and i'm try to register repo from my local ES instance and got strange error curl -X PUT "192.168.2.11:9200/\_snapshot/delete\_after\_read?pretty" -H 'Conte… --- ## [Logstash filter cidr error](https://discuss.elastic.co/t/logstash-filter-cidr-error/73187)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 10\ **Last updated:** [February 7, 2017, 8:32am UTC](https://discuss.elastic.co/t/logstash-filter-cidr-error/73187 "2017-02-07T08:32:16Z")
Hi, I was trying CIDR filter of logstash. cidr { add\_tag =\> \["matched"\] address =\> \["%{clientip}"\] network =\> \["10.123.123.0/24", "10.xxx.xxx.0/24", "10.xxx.xxx.0/24", "10.xxx.xxx.0/24"\] } This is giving an… --- ## [Nested Aggregations are 5~10x times slower in ES 6.x than 5.6.x](https://discuss.elastic.co/t/nested-aggregations-are-5-10x-times-slower-in-es-6-x-than-5-6-x/131506)
**Author:** [@cmadera\_rp](https://discuss.elastic.co/u/cmadera_rp)\ **Replies:** 12\ **Last updated:** [June 18, 2018, 2:48pm UTC](https://discuss.elastic.co/t/nested-aggregations-are-5-10x-times-slower-in-es-6-x-than-5-6-x/131506 "2018-06-18T14:48:58Z")
I've prepare a test environment to try to find a way to fix this. I have one machine with 16 cores and 64gb ram, with ES 5.6.8 and ES 6.2.4, each instances of ES have a XMX/XMS in 30 Gb have only one index with 35.808.… --- ## [Java with twitter4j and send info to elasticsearch](https://discuss.elastic.co/t/java-with-twitter4j-and-send-info-to-elasticsearch/92541)
**Author:** [@Lbr1](https://discuss.elastic.co/u/Lbr1)\ **Replies:** 20\ **Last updated:** [August 15, 2017, 4:05pm UTC](https://discuss.elastic.co/t/java-with-twitter4j-and-send-info-to-elasticsearch/92541 "2017-08-15T16:05:35Z")
Good evening, I recently started exploring elasticsearch, as I'm doing a job in java to analyze sentiments in tweets. Initially I was just using java and the tweet4j API. Then I heard about ElasticSearch and started ex… --- ## [Filebeat best way to secure credentials?](https://discuss.elastic.co/t/filebeat-best-way-to-secure-credentials/61704)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 17\ **Last updated:** [October 4, 2016, 4:36am UTC](https://discuss.elastic.co/t/filebeat-best-way-to-secure-credentials/61704 "2016-10-04T04:36:45Z")
What is best way to secure credentials on filebeat configuration? If i put username/password on yml file, anyone customer can login and read them and login into elasticsearch. --- ## [How to restart ELK when it is stopped](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108)
**Author:** [@bsongcc](https://discuss.elastic.co/u/bsongcc)\ **Replies:** 14\ **Last updated:** [December 31, 2017, 1:41pm UTC](https://discuss.elastic.co/t/how-to-restart-elk-when-it-is-stopped/113108 "2017-12-31T13:41:30Z")
I am using ELK and the Twitter API to scrape data from twitter. It has been going for more than a week and suddenly stopped working. I am not sure if it is due to the "limits of total fields in index has been exceeded" e… --- ## [Which Storage type to be used for ELK on AWS?](https://discuss.elastic.co/t/which-storage-type-to-be-used-for-elk-on-aws/170047)
**Author:** [@rahulkumar1](https://discuss.elastic.co/u/rahulkumar1)\ **Replies:** 10\ **Last updated:** [March 11, 2019, 5:01pm UTC](https://discuss.elastic.co/t/which-storage-type-to-be-used-for-elk-on-aws/170047 "2019-03-11T17:01:22Z")
https://www.elastic.co/guide/en/elasticsearch/plugins/master/cloud-aws-best-practices.html From the above it is recommended to use Instance storage, but then data is lost in the below scenarios: The underlying disk dr… --- ## [Issues running Filebeat on Windows](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343)
**Author:** [@jmcinnis](https://discuss.elastic.co/u/jmcinnis)\ **Replies:** 9\ **Last updated:** [April 18, 2016, 1:14pm UTC](https://discuss.elastic.co/t/issues-running-filebeat-on-windows/47343 "2016-04-18T13:14:23Z")
Hi, I have a Windows 7 Client VM that I'm trying to run Filebeat on. I can run "Start-Service filebeat" without getting any errors, but when I look at the log file, it's having a connection failure. My ELK Stack is runni… --- ## [HTTP Poller \[API\] input in Logstash - Does it support "Request\_data" on top of "Headers"?](https://discuss.elastic.co/t/http-poller-api-input-in-logstash-does-it-support-request-data-on-top-of-headers/316327)
**Author:** [@Roger\_Huang](https://discuss.elastic.co/u/Roger_Huang)\ **Replies:** 34\ **Last updated:** [October 22, 2022, 2:33am UTC](https://discuss.elastic.co/t/http-poller-api-input-in-logstash-does-it-support-request-data-on-top-of-headers/316327 "2022-10-22T02:33:41Z")
Hi everyone, I am new to ELK and I am trying to pull JSON data from Palo Alto platform into Logstash for processing. Some info redacted as xxxx. API DOCS: Get Alerts Does Logstash support such http headers? input … --- ## [New to elastic having issue with file beat](https://discuss.elastic.co/t/new-to-elastic-having-issue-with-file-beat/38560)
**Author:** [@Ronald\_Hill](https://discuss.elastic.co/u/Ronald_Hill)\ **Replies:** 9\ **Last updated:** [January 7, 2016, 1:27am UTC](https://discuss.elastic.co/t/new-to-elastic-having-issue-with-file-beat/38560 "2016-01-07T01:27:56Z")
Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat 2016/01/07 00:17:05.443037 outputs.go:105: ERR failed to initialize elasticsearch plugin as output: no host configuration foun… --- ## [Elasticsearch remains unhealthy because master node or Node is not able to find master node](https://discuss.elastic.co/t/elasticsearch-remains-unhealthy-because-master-node-or-node-is-not-able-to-find-master-node/92805)
**Author:** [@Kaushal\_Pandey](https://discuss.elastic.co/u/Kaushal_Pandey)\ **Replies:** 12\ **Last updated:** [July 20, 2017, 9:15am UTC](https://discuss.elastic.co/t/elasticsearch-remains-unhealthy-because-master-node-or-node-is-not-able-to-find-master-node/92805 "2017-07-20T09:15:06Z")
Elasticsearch Version 5.5.0 java version "1.8.0\_131" Java(TM) SE Runtime Environment (build 1.8.0\_131-b11) Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode) OS Version- Linux version 2.6.32-642.11.1.el6.… --- ## [How does Elasticsearch Splitting an Index Work?](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319)
**Author:** [@Hao\_Yellow](https://discuss.elastic.co/u/Hao_Yellow)\ **Replies:** 17\ **Last updated:** [September 26, 2022, 1:37am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-splitting-an-index-work/313319 "2022-09-26T01:37:54Z")
Hello, recently I've been working on splitting some indices with too large shards (not too many), so that the cluster's free disk space is more balanced among the multiple nodes. I read a discussion (see the discussion … --- ## [Possible to make ES Node Name same as Hostname?](https://discuss.elastic.co/t/possible-to-make-es-node-name-same-as-hostname/14988)
**Author:** [@Tony\_Su](https://discuss.elastic.co/u/Tony_Su)\ **Replies:** 16\ **Last updated:** [December 31, 2013, 1:25am UTC](https://discuss.elastic.co/t/possible-to-make-es-node-name-same-as-hostname/14988 "2013-12-31T01:25:12Z")
System: Java openJDK 1.7 elasticsearch 0.90.7 Following some old instructions, I modified /etc/sysconfig/elasticsearch ES\_JAVA\_OPTS="-Des.node.name=$(name -n cut -d'.' -f1)" But, that crashes the elas… --- ## [ElasticSearch timeouts after upgrade to 6.5.1](https://discuss.elastic.co/t/elasticsearch-timeouts-after-upgrade-to-6-5-1/160235)
**Author:** [@devops\_mike](https://discuss.elastic.co/u/devops_mike)\ **Replies:** 18\ **Last updated:** [December 14, 2018, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-timeouts-after-upgrade-to-6-5-1/160235 "2018-12-14T18:18:15Z")
Last week I upgraded my ELK stack from 6.4 to 6.5.1. Since then, performance has been declining. Elastic is running on a single server, cluster consists of one node. I have 3 beats (winlogbeat, metricbeat, filebeat) run… --- ## [Elasticsearch Keeps Crashing shards and data to big](https://discuss.elastic.co/t/elasticsearch-keeps-crashing-shards-and-data-to-big/229463)
**Author:** [@Archie\_Crawford](https://discuss.elastic.co/u/Archie_Crawford)\ **Replies:** 17\ **Last updated:** [April 24, 2020, 4:52pm UTC](https://discuss.elastic.co/t/elasticsearch-keeps-crashing-shards-and-data-to-big/229463 "2020-04-24T16:52:02Z")
When I restart elasticsearch the cluster will go into green for a little while then it will go back to read and kibana will no longer come up. Instead I see this error " {"message":"all shards failed: \[search\_phase\_execu… --- ## [Как сделать правильно запрос](https://discuss.elastic.co/t/topic/204344)
**Author:** [@Dimasp](https://discuss.elastic.co/u/Dimasp)\ **Replies:** 12\ **Last updated:** [October 21, 2019, 5:09pm UTC](https://discuss.elastic.co/t/topic/204344 "2019-10-21T17:09:47Z")
Добрый день! Есть запрос SQL как правильно сделать в Elastic Ищем слова где and ( city\_id IN ( "12,34,56,76,67,") or city IN ( 'Киев', 'Харьков') ) --- ## [Logstash is not accepting my Filebeat logs](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555)
**Author:** [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Replies:** 9\ **Last updated:** [March 9, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555 "2017-03-09T15:05:19Z")
Filebeat is on a prod server and Logstash is on a different servers.. I can not figure out why Logstash is rejecting my Filebeat log pushes. Below is the Logstash error. And below that shows telnet to port 5044 works. EL… --- ## [Drop all grok matches](https://discuss.elastic.co/t/drop-all-grok-matches/97391)
**Author:** [@sentinel](https://discuss.elastic.co/u/sentinel)\ **Replies:** 9\ **Last updated:** [August 17, 2017, 7:38pm UTC](https://discuss.elastic.co/t/drop-all-grok-matches/97391 "2017-08-17T19:38:44Z")
I want to obliterate everything this grok filter matches unconditionally is there a simple way? There are a lot of combinations so it’s better if mated by grok otherwise I will be declaring a lot of conditions. Unless … --- ## [Logstash filter not working as expected](https://discuss.elastic.co/t/logstash-filter-not-working-as-expected/85190)
**Author:** [@raghuvarma](https://discuss.elastic.co/u/raghuvarma)\ **Replies:** 12\ **Last updated:** [May 11, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-filter-not-working-as-expected/85190 "2017-05-11T09:13:32Z")
i am new to ELK and trying to learn it. I have given following filter file for logtash to get log details from the application server. these are the paths where i am taking the logs from /opt/tomcat7/apache-tomcat-7.0.… --- ## [Max Indexing rate per single Elasticsearch server](https://discuss.elastic.co/t/max-indexing-rate-per-single-elasticsearch-server/91340)
**Author:** [@jakesjohn](https://discuss.elastic.co/u/jakesjohn)\ **Replies:** 10\ **Last updated:** [July 2, 2017, 6:05am UTC](https://discuss.elastic.co/t/max-indexing-rate-per-single-elasticsearch-server/91340 "2017-07-02T06:05:32Z")
I have a single ES node(5.4.3) for doing benchmarks. It is a 64 GB machine with having 32 G as Heap size. Others are default settings with mlocking kept as true I am using the following settings for the benchmark te… --- ## [Flushing after yourself](https://discuss.elastic.co/t/flushing-after-yourself/129204)
**Author:** [@ecc256](https://discuss.elastic.co/u/ecc256)\ **Replies:** 20\ **Last updated:** [May 30, 2018, 10:18pm UTC](https://discuss.elastic.co/t/flushing-after-yourself/129204 "2018-05-30T22:18:11Z")
I’ve rewritten logstash processing logic with beats. Beats starts a lot faster, consumes less memory and feels snappier. Overall beats are pleasure to work with, even debugging is fun. The only problem it keeps loosin… --- ## [ElasticSearch output of Filebeat is empty, displays http error 400 Bad Request](https://discuss.elastic.co/t/elasticsearch-output-of-filebeat-is-empty-displays-http-error-400-bad-request/352407)
**Author:** [@NotTheRealV](https://discuss.elastic.co/u/NotTheRealV)\ **Replies:** 32\ **Last updated:** [February 28, 2024, 4:53am UTC](https://discuss.elastic.co/t/elasticsearch-output-of-filebeat-is-empty-displays-http-error-400-bad-request/352407 "2024-02-28T04:53:08Z")
So installed Elasticsearch (v8.12.0) for Windows as per the guide given here: Elasticsearch Installation Guide. I similarly, installed Kibana (v8.12.0) for Windows as per the guide given here: Kibana Installation Guide. … --- ## [Filebeat lost data](https://discuss.elastic.co/t/filebeat-lost-data/90631)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 12\ **Last updated:** [July 31, 2017, 4:24am UTC](https://discuss.elastic.co/t/filebeat-lost-data/90631 "2017-07-31T04:24:15Z")
Hi all, We have experienced a lost data issue with filebeat \> logstash. Our Logstash server was down for 4 hours and some events have not been indexed. The filebeat configuration is as follows : scan\_frequency: 3… --- ## [LDAP X-pack error Config: Error 403 Forbidden](https://discuss.elastic.co/t/ldap-x-pack-error-config-error-403-forbidden/105582)
**Author:** [@Serg](https://discuss.elastic.co/u/Serg)\ **Replies:** 14\ **Last updated:** [November 1, 2017, 9:44am UTC](https://discuss.elastic.co/t/ldap-x-pack-error-config-error-403-forbidden/105582 "2017-11-01T09:44:04Z")
I installed x-pack and edited config elasticsearch.yml xpack: security: authc: realms: ldap1: type: ldap order: 0 url: "ldap://ldap" bind\_dn: "cn=admin,dc=my" bind\_password: pass user\_search: base\_dn: "dc=my" … --- ## [Logstash - Collecting SNMP data from network devices](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814)
**Author:** [@muhammad-murad.nagoo](https://discuss.elastic.co/u/muhammad-murad.nagoo)\ **Replies:** 25\ **Last updated:** [January 3, 2023, 9:41am UTC](https://discuss.elastic.co/t/logstash-collecting-snmp-data-from-network-devices/321814 "2023-01-03T09:41:33Z")
Hello Gentlemen, Installed the logstash agent in on prem Windows server. Configure to collect the SNMP from network devices. However i found error "\[2022-12-20T09:05:57,307\]\[FATAL\]\[org.logstash.Logstash \] Logstash st… --- ## [Kibana crash after 7.9 install; revert to 7.8 is ok](https://discuss.elastic.co/t/kibana-crash-after-7-9-install-revert-to-7-8-is-ok/245697)
**Author:** [@bumpyfaceok](https://discuss.elastic.co/u/bumpyfaceok)\ **Replies:** 11\ **Last updated:** [August 20, 2020, 9:22pm UTC](https://discuss.elastic.co/t/kibana-crash-after-7-9-install-revert-to-7-8-is-ok/245697 "2020-08-20T21:22:51Z")
Kibana starts and then fails with "FATAL URIError: URI malformed" Debian 10, logstash, elasticsearch, kibana all on same box. I removed Kibana 7.9 and installed 7.8 and it's working fine again; elasticsearch remains a… --- ## [Cluster management: 2000+ open active shards](https://discuss.elastic.co/t/cluster-management-2000-open-active-shards/271868)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 30\ **Last updated:** [May 3, 2021, 6:35am UTC](https://discuss.elastic.co/t/cluster-management-2000-open-active-shards/271868 "2021-05-03T06:35:14Z")
Hello, I hope this messages finds you and your loved ones safe and healthy. I have a 3 node Elastic cluster with 2 data nodes and 1 voting node. Nodes are running Ubuntu 20.04.2 LTS with the stack at the latest current… --- ## [Cluster goes yellow a few times during the night](https://discuss.elastic.co/t/cluster-goes-yellow-a-few-times-during-the-night/108972)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 10\ **Last updated:** [November 27, 2017, 12:02pm UTC](https://discuss.elastic.co/t/cluster-goes-yellow-a-few-times-during-the-night/108972 "2017-11-27T12:02:30Z")
Hi, my elasticsearch cluster goes yellow every once in awhile during the night. It is because it starts to put the shards on the other nodes. Can I do anything to prevent my cluster from going yellow? \[2017-11-24T03:08… --- ## [Filebeat filestream input rereading rotated log files](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038)
**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\ **Replies:** 14\ **Last updated:** [May 12, 2022, 9:08am UTC](https://discuss.elastic.co/t/filebeat-filestream-input-rereading-rotated-log-files/300038 "2022-05-12T09:08:23Z")
Hello! I'm running into this very common problem of rotated files being reread and resent. I'm using Filebeat 8.1.0 with the new(ish) filestream input plugin. I've read the docs of the plugin and the article on this spe… --- ## [Very slow search performance after upgrade to 7.16.1](https://discuss.elastic.co/t/very-slow-search-performance-after-upgrade-to-7-16-1/296152)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 12\ **Last updated:** [February 10, 2022, 5:04am UTC](https://discuss.elastic.co/t/very-slow-search-performance-after-upgrade-to-7-16-1/296152 "2022-02-10T05:04:23Z")
I have noticed that search performance for my cluster has reduced drastically since upgrading to 7.16.1 (from 7.15). As an example consider an index dns-2022.01.31. There are around 56M docs in this and bulk of those do… --- ## [Permission to add GoogleDrive to WorkplaceSearch](https://discuss.elastic.co/t/permission-to-add-googledrive-to-workplacesearch/274288)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 30\ **Last updated:** [June 10, 2021, 8:25am UTC](https://discuss.elastic.co/t/permission-to-add-googledrive-to-workplacesearch/274288 "2021-06-10T08:25:44Z")
I am looking to add GoogleDrive to WorkplaceSerch. Referring to the following URL, I received instructions to create an OAuth application with my organization's GoogleDriveAccount, so I went to the linked GoogleCloudPla… --- ## [Elasticsearch bulk insertion issue: 403 request throttled due to too many requests](https://discuss.elastic.co/t/elasticsearch-bulk-insertion-issue-403-request-throttled-due-to-too-many-requests/267748)
**Author:** [@divakar](https://discuss.elastic.co/u/divakar)\ **Replies:** 16\ **Last updated:** [March 19, 2021, 11:13am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-insertion-issue-403-request-throttled-due-to-too-many-requests/267748 "2021-03-19T11:13:36Z")
I have following cluster configuration of ES on AWS: Instance Type: t2.small.elasticsearch Number of Nodes: 1 EBS Volume Type: GP2 EBS Volume Size: 10 GiB Heap size: 1 GiB I am trying to index around 20000 document… --- ## [Need guidance on search for a list of servers that had software x installed from Kibana/Logstash/filebeat](https://discuss.elastic.co/t/need-guidance-on-search-for-a-list-of-servers-that-had-software-x-installed-from-kibana-logstash-filebeat/170680)
**Author:** [@Lee\_Weng\_Sheng](https://discuss.elastic.co/u/Lee_Weng_Sheng)\ **Replies:** 17\ **Last updated:** [April 8, 2019, 8:42pm UTC](https://discuss.elastic.co/t/need-guidance-on-search-for-a-list-of-servers-that-had-software-x-installed-from-kibana-logstash-filebeat/170680 "2019-04-08T20:42:11Z")
Hi, I'm not sure whether this should goes to Logstash, Elastic search or other forums. My objective: To search for a list of servers that had software x installed, can someone please give me an advice on what's the be… --- ## [Multiple grok match don't work](https://discuss.elastic.co/t/multiple-grok-match-dont-work/86103)
**Author:** [@stefanocog](https://discuss.elastic.co/u/stefanocog)\ **Replies:** 10\ **Last updated:** [May 22, 2017, 12:32pm UTC](https://discuss.elastic.co/t/multiple-grok-match-dont-work/86103 "2017-05-22T12:32:30Z")
Hi, i have an ELK stack on docker and put logs througt "gelf", i need match logs by log format, i have two files (access.log and error.log, and one single tag "apache") i have this filter filter { if \[tag\] == "apac… --- ## [Need help with setting up "Multiple prospectors" in filebeat](https://discuss.elastic.co/t/need-help-with-setting-up-multiple-prospectors-in-filebeat/52315)
**Author:** [@mjadhav](https://discuss.elastic.co/u/mjadhav)\ **Replies:** 11\ **Last updated:** [June 14, 2016, 10:43am UTC](https://discuss.elastic.co/t/need-help-with-setting-up-multiple-prospectors-in-filebeat/52315 "2016-06-14T10:43:09Z")
Hello Folks, I have a requirement to parse different type of log files (own Java application's log file) and catalina log files. Both of these have a different type of logging system, for which I have to use differen… --- ## [Basic understating regarding index creation](https://discuss.elastic.co/t/basic-understating-regarding-index-creation/278189)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 9\ **Last updated:** [July 16, 2021, 3:34pm UTC](https://discuss.elastic.co/t/basic-understating-regarding-index-creation/278189 "2021-07-16T15:34:58Z")
Hi Team, I am facing issue where I can see index has not got created after some changes in logstash pipeline file. Can you please help me with below questions to understand. I am finding difficulty in getting it. I ha… [Previous page](https://discuss.elastic.co/top.md?page=72&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=74&per_page=50&period=all)