# Top **URL:** https://discuss.elastic.co/top.md?page=739&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 740 --- ## [Can i collect and parse TCP response messages from a server and port ? if so kindly help me with the config file and steps](https://discuss.elastic.co/t/can-i-collect-and-parse-tcp-response-messages-from-a-server-and-port-if-so-kindly-help-me-with-the-config-file-and-steps/144269)
**Author:** [@gopesh\_reddy](https://discuss.elastic.co/u/gopesh_reddy)\ **Replies:** 7\ **Last updated:** [August 16, 2018, 2:29am UTC](https://discuss.elastic.co/t/can-i-collect-and-parse-tcp-response-messages-from-a-server-and-port-if-so-kindly-help-me-with-the-config-file-and-steps/144269 "2018-08-16T02:29:03Z")
input { tcp { port =\> 5000 type =\> syslog } udp { port =\> 5000 type =\> syslog } } filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_host… --- ## [Sort aggregations by sum of sub aggregations?](https://discuss.elastic.co/t/sort-aggregations-by-sum-of-sub-aggregations/204329)
**Author:** [@casieowen](https://discuss.elastic.co/u/casieowen)\ **Replies:** 2\ **Last updated:** [October 20, 2019, 3:35pm UTC](https://discuss.elastic.co/t/sort-aggregations-by-sum-of-sub-aggregations/204329 "2019-10-20T15:35:11Z")
Hi, The query at the bottom of this thread returns data in this shape, ordered by the key value asc: Is there a way for me to sort the aggregations by the sum of the user\_count values per key? I want the data to sta… --- ## [Ctx.payload.hits.hits not working](https://discuss.elastic.co/t/ctx-payload-hits-hits-not-working/180524)
**Author:** [@yagami23](https://discuss.elastic.co/u/yagami23)\ **Replies:** 2\ **Last updated:** [May 13, 2019, 2:09am UTC](https://discuss.elastic.co/t/ctx-payload-hits-hits-not-working/180524 "2019-05-13T02:09:24Z")
Hi, below is my watcher content, its not working when add in transform section into it, the whole looping for ctx.payload.hits.hits is not working, the email receive only showing " The alert condition for 'OSB - ni-ecomm… --- ## [Parsing Wazuh archives.json file with Logstash](https://discuss.elastic.co/t/parsing-wazuh-archives-json-file-with-logstash/169935)
**Author:** [@HaranKumar](https://discuss.elastic.co/u/HaranKumar)\ **Replies:** 2\ **Last updated:** [February 26, 2019, 12:43pm UTC](https://discuss.elastic.co/t/parsing-wazuh-archives-json-file-with-logstash/169935 "2019-02-26T12:43:58Z")
Hello Team, Might be json codec would have been discussed in the past , i tried googling and did not find relevant solution . so posting my query to get direct assistance from experts. I have a file alerts.json and it … --- ## [Delete large amount of data using \_delete\_by\_query](https://discuss.elastic.co/t/delete-large-amount-of-data-using--delete-by-query/79075)
**Author:** [@platform-team](https://discuss.elastic.co/u/platform-team)\ **Replies:** 2\ **Last updated:** [March 17, 2017, 7:35pm UTC](https://discuss.elastic.co/t/delete-large-amount-of-data-using--delete-by-query/79075 "2017-03-17T19:35:42Z")
Hello, I am trying to remove a large amount of data from elasticsearch using deleteby\_query. I've tried many options to get this to complete, but typically can only get several hundred (out of millions) of records to … --- ## [Multiline grok problem](https://discuss.elastic.co/t/multiline-grok-problem/51608)
**Author:** [@James\_Beal](https://discuss.elastic.co/u/James_Beal)\ **Replies:** 2\ **Last updated:** [June 2, 2016, 5:43pm UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608 "2016-06-02T17:43:25Z")
I am reading in the mysql slow log with a multiline filebeat, I would like to parse it in logstash. My log line looks like: # Time: 160601 19:29:43 # User@Host: root\[root\] @ localhost \[\] Id: 1055005 # Schema: Last\_… --- ## [APM agent crashes NodeJs after reporting exception in tedious instrumentation code](https://discuss.elastic.co/t/apm-agent-crashes-nodejs-after-reporting-exception-in-tedious-instrumentation-code/259851)
**Author:** [@rodbil](https://discuss.elastic.co/u/rodbil)\ **Replies:** 4\ **Last updated:** [January 19, 2021, 2:28am UTC](https://discuss.elastic.co/t/apm-agent-crashes-nodejs-after-reporting-exception-in-tedious-instrumentation-code/259851 "2021-01-19T02:28:57Z")
Kibana version: 7.8.1 (flavor:default, type:docker) Elasticsearch version: 7.8.1 (flavor:default, type:docker) APM Server version: 7.8.1 (flavor:default, type:docker) APM Agent language and version: Elastic-apm-node … --- ## [Adding Field from one index to another index / Merging two Index](https://discuss.elastic.co/t/adding-field-from-one-index-to-another-index-merging-two-index/232518)
**Author:** [@shubham184](https://discuss.elastic.co/u/shubham184)\ **Replies:** 4\ **Last updated:** [May 14, 2020, 4:56pm UTC](https://discuss.elastic.co/t/adding-field-from-one-index-to-another-index-merging-two-index/232518 "2020-05-14T16:56:57Z")
Hello, I have 2 tables coming in as CouchDb changes in logstash, which get converted into two separate indexes. Problem statement: I want to either merge the two indexes or add the fields in one of the indexes, I was th… --- ## [EFS:disk quota exceeded](https://discuss.elastic.co/t/efs-disk-quota-exceeded/127334)
**Author:** [@anuj6664](https://discuss.elastic.co/u/anuj6664)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 8:24am UTC](https://discuss.elastic.co/t/efs-disk-quota-exceeded/127334 "2018-04-10T08:24:09Z")
every day around 5 A.M i hava to restart the elasticsearch and logstash to push the logs to index. while viewing log i got the error " neste d: IndexShardRecoveryException\[failed to recover from gateway\]; nested: Engin… --- ## [Run SQL statement](https://discuss.elastic.co/t/run-sql-statement/105651)
**Author:** [@Sumit\_Gupta1](https://discuss.elastic.co/u/Sumit_Gupta1)\ **Replies:** 3\ **Last updated:** [October 30, 2017, 6:53am UTC](https://discuss.elastic.co/t/run-sql-statement/105651 "2017-10-30T06:53:31Z")
Hi, I want to run following SQL statment: input { jdbc { jdbc\_driver\_library =\> "/app/logstash-5.6.2/lib/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> "jdbc:orac… --- ## [Discoverの検索結果を上限サイズを超えてCSV出力したい](https://discuss.elastic.co/t/discover-csv/251061)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 2:45am UTC](https://discuss.elastic.co/t/discover-csv/251061 "2020-10-06T02:45:41Z")
DIscoverの検索結果30000件程をCSV出力したいです。しかし、CSVの出力サイズでサポートされているのは最大50MBまでと制限があるため、Discover画面から出力しようとすると、その上限に引っかかってしまいます。50MBを超えるCSV出力を実施するためには何かいい方法は無いでしょうか？ --- ## [Score de pertinence d'un document](https://discuss.elastic.co/t/score-de-pertinence-dun-document/48337)
**Author:** [@Deve\_java](https://discuss.elastic.co/u/Deve_java)\ **Replies:** 6\ **Last updated:** [May 9, 2016, 4:59pm UTC](https://discuss.elastic.co/t/score-de-pertinence-dun-document/48337 "2016-05-09T16:59:05Z")
Bonjour groupe comment recuperer avec l'API java le score de pertinence d'un document par rapport a la requete ou score de similarité je ne sais pas comment c'est nommé Merci par avance --- ## [Issue with elasticsearch query - dot in field values](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 20, 2021, 5:11pm UTC](https://discuss.elastic.co/t/issue-with-elasticsearch-query-dot-in-field-values/264943 "2021-02-20T17:11:45Z")
Hello, There's an issue with the use of . in my field value. The sample below is a 'valid' query that returns some hits Copy to clipboard { "query": { "bool": { "must": \[ { "wildcard": {… --- ## [Filebeat repeat send log](https://discuss.elastic.co/t/filebeat-repeat-send-log/99833)
**Author:** [@water\_smart](https://discuss.elastic.co/u/water_smart)\ **Replies:** 5\ **Last updated:** [September 27, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-repeat-send-log/99833 "2017-09-27T12:40:25Z")
2017/09/08 07:34:20.656217 client.go:184: DBG Publish: { "@timestamp": "2017-09-08T07:34:16.242Z", "beat": { "hostname": "85", "name": "10.58.51.85", "version": "5.2.2" }, "input\_type": "log", "mes… --- ## [Beats on SuSE 10/11](https://discuss.elastic.co/t/beats-on-suse-10-11/34654)
**Author:** [@Samuel\_Piedagnel](https://discuss.elastic.co/u/Samuel_Piedagnel)\ **Replies:** 5\ **Last updated:** [January 15, 2016, 6:51pm UTC](https://discuss.elastic.co/t/beats-on-suse-10-11/34654 "2016-01-15T18:51:06Z")
Is there any installation package or image of Beats (topbeat) available for SuSE 10 and SuSE 11? --- ## [Elasticsearch d3 and angularJS](https://discuss.elastic.co/t/elasticsearch-d3-and-angularjs/34380)
**Author:** [@RAJAUG](https://discuss.elastic.co/u/RAJAUG)\ **Replies:** 5\ **Last updated:** [November 12, 2015, 9:54am UTC](https://discuss.elastic.co/t/elasticsearch-d3-and-angularjs/34380 "2015-11-12T09:54:03Z")
I would like to make different kinds of graph using elasticsearch , AngularJS and D3.js . i have elaticsearch server in my local machine http://localhost:9200 , index name is nfl. i want to make graph based on data f… --- ## [Error "build constraints exclude all Go files" while building beats from source for Solaris 11.3 x86](https://discuss.elastic.co/t/error-build-constraints-exclude-all-go-files-while-building-beats-from-source-for-solaris-11-3-x86/198482)
**Author:** [@ConnorRies](https://discuss.elastic.co/u/ConnorRies)\ **Replies:** 1\ **Last updated:** [September 10, 2019, 2:40pm UTC](https://discuss.elastic.co/t/error-build-constraints-exclude-all-go-files-while-building-beats-from-source-for-solaris-11-3-x86/198482 "2019-09-10T14:40:26Z")
My goal is to run Filebeat on a Solaris 11.3 system. Running uname -a shows me: SunOS solaris 5.11 11.3 i86pc i386 i86pc To build Filebeat, I also need to build go because the version found in package manager is too l… --- ## ['PreBuiltTransportClient' doesn't exist in my 6.3.0 library](https://discuss.elastic.co/t/prebuilttransportclient-doesnt-exist-in-my-6-3-0-library/156223)
**Author:** [@byeong\_seok\_park](https://discuss.elastic.co/u/byeong_seok_park)\ **Replies:** 1\ **Last updated:** [November 12, 2018, 8:02am UTC](https://discuss.elastic.co/t/prebuilttransportclient-doesnt-exist-in-my-6-3-0-library/156223 "2018-11-12T08:02:52Z")
Hi, I'm porting my project's library version from 1.7.5 to 6.3.0. The problem is here. In previous code, import org.elasticsearch.client.transport.TransportClient; import org.elasticsearch.common.settin… --- ## [Elasticsearch QueryBuilder with dynamic value in term query](https://discuss.elastic.co/t/elasticsearch-querybuilder-with-dynamic-value-in-term-query/17910)
**Author:** [@bagui](https://discuss.elastic.co/u/bagui)\ **Replies:** 1\ **Last updated:** [June 4, 2014, 6:38pm UTC](https://discuss.elastic.co/t/elasticsearch-querybuilder-with-dynamic-value-in-term-query/17910 "2014-06-04T18:38:54Z")
I have a code like below where I'm doing multiple must in bool query. Here I'm passing the must term queries in field "address". Now the ip address will come to me as a list from other api and I have to pass for a… --- ## [How to automatically delete index data after a few days or after certain size limit](https://discuss.elastic.co/t/how-to-automatically-delete-index-data-after-a-few-days-or-after-certain-size-limit/338511)
**Author:** [@akash-asthana](https://discuss.elastic.co/u/akash-asthana)\ **Replies:** 3\ **Last updated:** [July 17, 2023, 12:14pm UTC](https://discuss.elastic.co/t/how-to-automatically-delete-index-data-after-a-few-days-or-after-certain-size-limit/338511 "2023-07-17T12:14:49Z")
Hello, I have a scenario where i need to clean up the index data after a given number of days or after a certain storage size is occupied. Is there any way of achieving this without deleting the actual index? Thanks --- ## [Embeding dashboards as iframes within a Kibana Application](https://discuss.elastic.co/t/embeding-dashboards-as-iframes-within-a-kibana-application/259608)
**Author:** [@WhiskeyTF](https://discuss.elastic.co/u/WhiskeyTF)\ **Replies:** 8\ **Last updated:** [January 8, 2021, 10:32pm UTC](https://discuss.elastic.co/t/embeding-dashboards-as-iframes-within-a-kibana-application/259608 "2021-01-08T22:32:12Z")
Hello, I am currently working to create a plugin that can be used as a kind of configurable works space for users where they can quickly store and view multiple dashboards together. when I add a Kibana dashboard to the p… --- ## [Help with Logstash xml filter plug in](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 8\ **Last updated:** [January 24, 2020, 2:16pm UTC](https://discuss.elastic.co/t/help-with-logstash-xml-filter-plug-in/216131 "2020-01-24T14:16:24Z")
I'm having trouble parsing out fields from my xml file using the logstash xml filter plugin. Here is my xml file data-- 733812 JVM|Garbage Collection|Number of Minor Collections Per Min Application Infrastructure… --- ## [Get index of item in results set](https://discuss.elastic.co/t/get-index-of-item-in-results-set/151660)
**Author:** [@ambrt](https://discuss.elastic.co/u/ambrt)\ **Replies:** 8\ **Last updated:** [October 28, 2018, 12:22pm UTC](https://discuss.elastic.co/t/get-index-of-item-in-results-set/151660 "2018-10-28T12:22:12Z")
Hi, Is there a way to get index of item in results set? Lets say i have 1000 results of query match\_all, sorted by date created. How to know where is (index of) one specific item in those 1000 results? --- ## [Parsing iis log](https://discuss.elastic.co/t/parsing-iis-log/133700)
**Author:** [@neo](https://discuss.elastic.co/u/neo)\ **Replies:** 3\ **Last updated:** [May 30, 2018, 7:47am UTC](https://discuss.elastic.co/t/parsing-iis-log/133700 "2018-05-30T07:47:28Z")
I am new to grok function, can someone you help me to work this out my log look like : #Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2018-04-25 00:00:00 #Fields: date time s-ip cs-metho… --- ## [Accessing settings in the keystore](https://discuss.elastic.co/t/accessing-settings-in-the-keystore/114763)
**Author:** [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Replies:** 8\ **Last updated:** [January 10, 2018, 1:36am UTC](https://discuss.elastic.co/t/accessing-settings-in-the-keystore/114763 "2018-01-10T01:36:57Z")
How can properties be read from the keystore from inside a plugin? The only current usage in the main repo is the s3 repository, but that code is complex (in terms of the amount of calls) and I rather not have to debug … --- ## [Metricbeat jolokia module: "Cannot unmarshal json response"](https://discuss.elastic.co/t/metricbeat-jolokia-module-cannot-unmarshal-json-response/89744)
**Author:** [@gregbk](https://discuss.elastic.co/u/gregbk)\ **Replies:** 3\ **Last updated:** [June 19, 2017, 1:09pm UTC](https://discuss.elastic.co/t/metricbeat-jolokia-module-cannot-unmarshal-json-response/89744 "2017-06-19T13:09:42Z")
Hello Beats team! I am trying the Jolokia module on 2 different jmx env. I got for both the same error message in kibana: Cannot unmarshal json response: invalid character '\\x00' looking for beginning of value I u… --- ## [ERR Connecting error publishing events (retrying): Get read: connection reset by peer](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-read-connection-reset-by-peer/72330)
**Author:** [@ciscoexp](https://discuss.elastic.co/u/ciscoexp)\ **Replies:** 3\ **Last updated:** [January 21, 2017, 1:41pm UTC](https://discuss.elastic.co/t/err-connecting-error-publishing-events-retrying-get-read-connection-reset-by-peer/72330 "2017-01-21T13:41:56Z")
I am getting these error messages and I have the most basic configuration of Logstash/FileBeat. ERR Connecting error publishing events (retrying): Get http://10.200.21.90:5044: read tcp 10.200.23.167:44340-\>10.200.21.… --- ## [Logstash XPack Password](https://discuss.elastic.co/t/logstash-xpack-password/111149)
**Author:** [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)\ **Replies:** 4\ **Last updated:** [December 13, 2017, 2:03pm UTC](https://discuss.elastic.co/t/logstash-xpack-password/111149 "2017-12-13T14:03:13Z")
So I have installed X Pack on my ELK stack, I am just wondering to put the below (I have set the new username and password this is just the example): xpack.monitoring.elasticsearch.username: logstash\_system xpack.monit… --- ## [Creating New index from filtering existing index](https://discuss.elastic.co/t/creating-new-index-from-filtering-existing-index/231503)
**Author:** [@sarvendras](https://discuss.elastic.co/u/sarvendras)\ **Replies:** 3\ **Last updated:** [May 12, 2020, 8:37am UTC](https://discuss.elastic.co/t/creating-new-index-from-filtering-existing-index/231503 "2020-05-12T08:37:27Z")
HelloTeam, I have a index with large volume fo data.I want to create new subset index by doing some filtering (for example Merchant number="something").How can I do this in elasticsearch. Please suggest. Thanks Sarve… --- ## [Syslog input always dying](https://discuss.elastic.co/t/syslog-input-always-dying/2786)
**Author:** [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\ **Replies:** 3\ **Last updated:** [June 22, 2015, 6:25am UTC](https://discuss.elastic.co/t/syslog-input-always-dying/2786 "2015-06-22T06:25:25Z")
Hi there! We configured multiple syslog inputs for different incoming log types (switches, firewalls, etc), each of them with a dedicated port, like this: input { syslog { host =\> "0.0.0.0" type =\> "switche… --- ## [Having trouble to get ELK working on the Logstash part](https://discuss.elastic.co/t/having-trouble-to-get-elk-working-on-the-logstash-part/205396)
**Author:** [@NewHere](https://discuss.elastic.co/u/NewHere)\ **Replies:** 4\ **Last updated:** [October 28, 2019, 11:48pm UTC](https://discuss.elastic.co/t/having-trouble-to-get-elk-working-on-the-logstash-part/205396 "2019-10-28T23:48:32Z")
I am trying out the ELK to pipe a tomcat log to ES via Logstash and view it in Kibana. After running "docker-compose up" I can visit ES via http://localhost:9200/\_cat/health. Also Kibana via http://localhost:5601. Howeve… --- ## [Getting nested data into proper form for vega](https://discuss.elastic.co/t/getting-nested-data-into-proper-form-for-vega/182948)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 4\ **Last updated:** [June 4, 2019, 4:21am UTC](https://discuss.elastic.co/t/getting-nested-data-into-proper-form-for-vega/182948 "2019-06-04T04:21:59Z")
Am hoping to make charts using vega but am struggling to get data formatted properly. Data in question is usage patterns for postgresql. Specific example: "postgresql" : { "database" : { "rows" : {… --- ## [Dynamic topics for kafka output plugin](https://discuss.elastic.co/t/dynamic-topics-for-kafka-output-plugin/56429)
**Author:** [@ronnysh](https://discuss.elastic.co/u/ronnysh)\ **Replies:** 4\ **Last updated:** [August 4, 2016, 5:25pm UTC](https://discuss.elastic.co/t/dynamic-topics-for-kafka-output-plugin/56429 "2016-08-04T17:25:54Z")
Hi guys, assuming that i have the following json input: { "user": "1", "compay\_id": "100" } can i set compay\_id to kafka output topic\_id? thanks in advance, ronnysh --- ## [Read error looking for ack: EOF](https://discuss.elastic.co/t/read-error-looking-for-ack-eof/26880)
**Author:** [@anilmaddukuri](https://discuss.elastic.co/u/anilmaddukuri)\ **Replies:** 4\ **Last updated:** [August 7, 2015, 9:22am UTC](https://discuss.elastic.co/t/read-error-looking-for-ack-eof/26880 "2015-08-07T09:22:40Z")
I am new to ELK stack. My configuration contains logstash-forwarder pushing my server logs to logstash residing in a seperate instance. But recently i found two issues. Logstash-forwarder is able to connect to logstash… --- ## [No handler found for uri for /\_search/scroll?](https://discuss.elastic.co/t/no-handler-found-for-uri-for--search-scroll/99695)
**Author:** [@MarioZ](https://discuss.elastic.co/u/MarioZ)\ **Replies:** 2\ **Last updated:** [September 8, 2017, 7:22am UTC](https://discuss.elastic.co/t/no-handler-found-for-uri-for--search-scroll/99695 "2017-09-08T07:22:17Z")
Hello, I am a newbe. When I try to use the rest interface with scroll and scroll\_id, I receive this error: HTTP protocol error 400 (Bad Request): No handler found for uri \[/…/…/\_search/scroll? My goal to archive is to… --- ## [🎉 Elastic Stack 7.10.0 released](https://discuss.elastic.co/t/elastic-stack-7-10-0-released/255130)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 9:17pm UTC](https://discuss.elastic.co/t/elastic-stack-7-10-0-released/255130 "2020-11-11T21:17:46Z")
:tada: Elastic Stack 7.10.0 released The journey to searchable S3 begins! Elastic 7.10 introduces the beta of searchable snapshots on low-cost object stores, a new User Experience app to monitor web performance, GA of K… --- ## [Winlogbeat to syslog](https://discuss.elastic.co/t/winlogbeat-to-syslog/69048)
**Author:** [@qutach](https://discuss.elastic.co/u/qutach)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 4:51pm UTC](https://discuss.elastic.co/t/winlogbeat-to-syslog/69048 "2016-12-14T16:51:59Z")
Hi, Is it possible to send windows event logs with winlogbeats direct to logstash syslog service (or other syslog servers udp/tcp 514)? I can't find how to specifiy the server hostname/ip. Only how to enable logging s… --- ## [Kibana 6.3 Reporting option not available](https://discuss.elastic.co/t/kibana-6-3-reporting-option-not-available/144640)
**Author:** [@Marct](https://discuss.elastic.co/u/Marct)\ **Replies:** 3\ **Last updated:** [August 20, 2018, 6:35am UTC](https://discuss.elastic.co/t/kibana-6-3-reporting-option-not-available/144640 "2018-08-20T06:35:24Z")
I have just installed ELK via apt-get on Ubuntu 16.04, I am unable to see the reporting option when looking at the dashboards. Is there something I may have missed in my installation ? Many Thanks M --- ## [Unable to get elasticsearch-hadoop working with Hive/Beeline](https://discuss.elastic.co/t/unable-to-get-elasticsearch-hadoop-working-with-hive-beeline/23454)
**Author:** [@Rasmus\_Aveskogh](https://discuss.elastic.co/u/Rasmus_Aveskogh)\ **Replies:** 3\ **Last updated:** [April 29, 2015, 12:33pm UTC](https://discuss.elastic.co/t/unable-to-get-elasticsearch-hadoop-working-with-hive-beeline/23454 "2015-04-29T12:33:29Z")
Hi! I've followed the various guides to get going with the elasticsearch-hadoop-integration in Hive, but I run into some issue: add jar hdfs://host:9000//lib/elasticsearch-hadoop-hive-2.1.0.Beta4.jar; INFO : conver… --- ## [Elasticsearch upgrade assistant](https://discuss.elastic.co/t/elasticsearch-upgrade-assistant/349447)
**Author:** [@jaykb77](https://discuss.elastic.co/u/jaykb77)\ **Replies:** 2\ **Last updated:** [December 16, 2023, 11:26pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-assistant/349447 "2023-12-16T23:26:59Z")
Hi all, We are trying to upgrade our Elasticsearch cluster from 7.17 to 8.X and found that its recommended to use Upgrade assistant for this. But we do not use Kibana in our cluster. The ES is acting as a search backend… --- ## [Visualize day between two dates on kibana](https://discuss.elastic.co/t/visualize-day-between-two-dates-on-kibana/120452)
**Author:** [@Timotius\_Pamungkas](https://discuss.elastic.co/u/Timotius_Pamungkas)\ **Replies:** 2\ **Last updated:** [February 23, 2018, 4:44am UTC](https://discuss.elastic.co/t/visualize-day-between-two-dates-on-kibana/120452 "2018-02-23T04:44:55Z")
I have date with following fields ... ... branch\_id: 909 agent\_id: 909A01234 first\_call\_date: date A, can be empty (no call made yet) final\_call\_date: date B, can be empty (no call made yet) … --- ## [Count of phrase matches per document](https://discuss.elastic.co/t/count-of-phrase-matches-per-document/96762)
**Author:** [@swleighton](https://discuss.elastic.co/u/swleighton)\ **Replies:** 1\ **Last updated:** [August 15, 2017, 2:27pm UTC](https://discuss.elastic.co/t/count-of-phrase-matches-per-document/96762 "2017-08-15T14:27:59Z")
Hi, I’m using this query to search a field for occurrences of phrases. "query": { "match\_phrase": { "content": "my test phrase" } } I need to calculate how many matches occurred for each phrase per docum… --- ## [\_discover\_file\_glob: glob is: \[\]{:level=\>:debug, :file=\>"", :line=\>"117"}](https://discuss.elastic.co/t/-discover-file-glob-glob-is-level-debug-file-line-117/26965)
**Author:** [@vhdevera](https://discuss.elastic.co/u/vhdevera)\ **Replies:** 6\ **Last updated:** [August 11, 2015, 12:08pm UTC](https://discuss.elastic.co/t/-discover-file-glob-glob-is-level-debug-file-line-117/26965 "2015-08-11T12:08:39Z")
hi, i'm new with ELK and is to be able to configure it to receive syslog messages. Ultimately we would like logstash to receive cloudtrail files, to do this I tried to follow Parsing Amazon CloudTrail JSON Logs with a … --- ## [Scroll Infinite in datatable](https://discuss.elastic.co/t/scroll-infinite-in-datatable/2135)
**Author:** [@Marian\_Valero](https://discuss.elastic.co/u/Marian_Valero)\ **Replies:** 6\ **Last updated:** [June 11, 2015, 11:03am UTC](https://discuss.elastic.co/t/scroll-infinite-in-datatable/2135 "2015-06-11T11:03:27Z")
Hi, I'm doing a search with scroll in java and I add this results, size = 20, in a datatable but I want do that dynamically, that is to say when I do scrolling to datatable add the next 20 results to datatable. How can I… --- ## [Searching aggregation to calculate the status of running processes](https://discuss.elastic.co/t/searching-aggregation-to-calculate-the-status-of-running-processes/121853)
**Author:** [@sasa0103](https://discuss.elastic.co/u/sasa0103)\ **Replies:** 4\ **Last updated:** [March 8, 2018, 12:22pm UTC](https://discuss.elastic.co/t/searching-aggregation-to-calculate-the-status-of-running-processes/121853 "2018-03-08T12:22:09Z")
The simplified scenario is like this: There are some processes, that are writing a new entry in Elastic every few minutes. This entry contains a status flag which shows if the process is finished or running. If the proc… --- ## [Misleading type attribute in filebeat config](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 4\ **Last updated:** [November 6, 2015, 12:08pm UTC](https://discuss.elastic.co/t/misleading-type-attribute-in-filebeat-config/33221 "2015-11-06T12:08:11Z")
Hi all I've set up FileBeat with Logstash and followed the documentation here: https://www.elastic.co/guide/en/beats/libbeat/master/configuration.html#configuration-output The doc states do configure the following ma… --- ## [Not to able to create new node](https://discuss.elastic.co/t/not-to-able-to-create-new-node/271537)
**Author:** [@hussshe](https://discuss.elastic.co/u/hussshe)\ **Replies:** 5\ **Last updated:** [April 30, 2021, 2:38am UTC](https://discuss.elastic.co/t/not-to-able-to-create-new-node/271537 "2021-04-30T02:38:13Z")
Hello Elastic Members, ES Version: 7.12.0 OS: Windows 10 I am following an udemy course on ES. The trainer has given a task to add an additional node to the cluster(contains only 1 node) that runs on a same machine. S… --- ## [Filebeat log collection stops when the container is restarted](https://discuss.elastic.co/t/filebeat-log-collection-stops-when-the-container-is-restarted/236596)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 10:11am UTC](https://discuss.elastic.co/t/filebeat-log-collection-stops-when-the-container-is-restarted/236596 "2020-06-17T10:11:18Z")
We collect the logs of the container of Tomcat on Kubernetes with the container of Filebeat. After restarting the Tomcat container, the log collection instance is updated, but the log collection instance is It seems th… --- ## [Kibana timestamp showing UTC and not browser time in 7.6.0](https://discuss.elastic.co/t/kibana-timestamp-showing-utc-and-not-browser-time-in-7-6-0/222587)
**Author:** [@f.Cavenaghi](https://discuss.elastic.co/u/f.Cavenaghi)\ **Replies:** 5\ **Last updated:** [March 10, 2020, 10:17am UTC](https://discuss.elastic.co/t/kibana-timestamp-showing-utc-and-not-browser-time-in-7-6-0/222587 "2020-03-10T10:17:17Z")
Hello, i have an ELK setup where in the discover pane the timestamp is wrong. the timestamp is different from event time for some reason. the timezone setting is: and the logstash setup is (from logstash/conf.d/\*… --- ## [Using sAMAccountName instead of CN in role mapping file?](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 5\ **Last updated:** [July 21, 2017, 6:56am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563 "2017-07-21T06:56:22Z")
Hello. I would like to ask question for role\_mapping file. Our environment uses LDAP authentication module First I understand that you will need to map distinguished name (User or Group object ) to kibana roles. … [Previous page](https://discuss.elastic.co/top.md?page=738&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=740&per_page=50&period=all)