# Top **URL:** https://discuss.elastic.co/top.md?page=763&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 764 --- ## [Splunk equivalent for \_index\_earliest and \_index\_latest](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614)
**Author:** [@shahzad](https://discuss.elastic.co/u/shahzad)\ **Replies:** 7\ **Last updated:** [October 18, 2016, 10:29am UTC](https://discuss.elastic.co/t/splunk-equivalent-for--index-earliest-and--index-latest/62614 "2016-10-18T10:29:33Z")
I am currently running a test VM to see if we can migrate from Splunk to ELK stack. I've got the data in the elasticsearch and I can see that data in Kibana. Now my next challenge is to run few searches which we run in S… --- ## [What does indices.indexing.index\_current value mean?](https://discuss.elastic.co/t/what-does-indices-indexing-index-current-value-mean/203408)
**Author:** [@LuckyNemo](https://discuss.elastic.co/u/LuckyNemo)\ **Replies:** 5\ **Last updated:** [October 28, 2019, 10:13am UTC](https://discuss.elastic.co/t/what-does-indices-indexing-index-current-value-mean/203408 "2019-10-28T10:13:19Z")
I am using 'GET /\_nodes/stats' to get the states of a node, does anyone know what 'indices.indexing.index\_current' value mean? For example : "indexing": { "index\_total": 72857515, "index\_time\_in\_milli… --- ## [Specifying Logstash filter workers?](https://discuss.elastic.co/t/specifying-logstash-filter-workers/236089)
**Author:** [@mskadu](https://discuss.elastic.co/u/mskadu)\ **Replies:** 4\ **Last updated:** [June 7, 2020, 6:20pm UTC](https://discuss.elastic.co/t/specifying-logstash-filter-workers/236089 "2020-06-07T18:20:29Z")
I am currently trialling the use of the Aggregated Filter plugin within Logstash v7.7 for a specific use case. I noticed that the description the specific Plugin (here) says: You should be very careful to set Logstash … --- ## [Filebeat on AWS EKS worker node](https://discuss.elastic.co/t/filebeat-on-aws-eks-worker-node/173347)
**Author:** [@reenrik](https://discuss.elastic.co/u/reenrik)\ **Replies:** 4\ **Last updated:** [April 3, 2019, 7:45pm UTC](https://discuss.elastic.co/t/filebeat-on-aws-eks-worker-node/173347 "2019-04-03T19:45:50Z")
I'm an Elastic Cloud subscriber. We are standing up an EKS cluster on AWS, but would like to have filebeat exist outside of Kubernetes, directly on the worker node. I'm having some trouble understanding what to put in t… --- ## [APM Java Agent error java.lang.StackOverflowError](https://discuss.elastic.co/t/apm-java-agent-error-java-lang-stackoverflowerror/145397)
**Author:** [@jibsonline](https://discuss.elastic.co/u/jibsonline)\ **Replies:** 4\ **Last updated:** [August 22, 2018, 10:06am UTC](https://discuss.elastic.co/t/apm-java-agent-error-java-lang-stackoverflowerror/145397 "2018-08-22T10:06:25Z")
We have implemented Java Agent with our springboot applicatiions Springboot : 1.5.10 Java: 1.8.172 APM Server : 6.3 APM Agent : 0.6.2 We are getting the below error in our logs Exception in Token validation f… --- ## [Getsockopt: connection timed out](https://discuss.elastic.co/t/getsockopt-connection-timed-out/143315)
**Author:** [@Sam\_WCL](https://discuss.elastic.co/u/Sam_WCL)\ **Replies:** 4\ **Last updated:** [August 8, 2018, 7:34am UTC](https://discuss.elastic.co/t/getsockopt-connection-timed-out/143315 "2018-08-08T07:34:21Z")
Hello, I am having an issue on a few boxes reporting to my elastic stack, They look to be getting blocked/timing out with the below error in the metricbeat logs, 2018-08-07T12:33:49.810+0100 ERROR pipeline/output… --- ## [Filebeat 5 error when sending to redis](https://discuss.elastic.co/t/filebeat-5-error-when-sending-to-redis/60742)
**Author:** [@Alexander\_Fichel](https://discuss.elastic.co/u/Alexander_Fichel)\ **Replies:** 4\ **Last updated:** [September 20, 2016, 6:57am UTC](https://discuss.elastic.co/t/filebeat-5-error-when-sending-to-redis/60742 "2016-09-20T06:57:33Z")
Getting the following errors when having filebeats send to redis: Filebeats version: filebeat-5.0.0-alpha5-windows-x86\_64 Windows where filebeats is installed: 64 bit win server 2008 Redis version in AWS (Worked with o… --- ## [TypeMissingException: type\[\_all\] missing](https://discuss.elastic.co/t/typemissingexception-type--all-missing/6300)
**Author:** [@Richard\_Marr](https://discuss.elastic.co/u/Richard_Marr)\ **Replies:** 4\ **Last updated:** [January 9, 2012, 12:40pm UTC](https://discuss.elastic.co/t/typemissingexception-type--all-missing/6300 "2012-01-09T12:40:19Z")
Hi all, Has anyone come across this kind of exception before? I'm getting this when running the automated tests for the node\_elastical project, but I can also repeat it in my browser. org.elasticsearch.indices.Ty… --- ## [Elasticsearch High Availability (HA) functionality test](https://discuss.elastic.co/t/elasticsearch-high-availability-ha-functionality-test/87246)
**Author:** [@Abhijit\_Paul](https://discuss.elastic.co/u/Abhijit_Paul)\ **Replies:** 6\ **Last updated:** [May 26, 2017, 11:40am UTC](https://discuss.elastic.co/t/elasticsearch-high-availability-ha-functionality-test/87246 "2017-05-26T11:40:24Z")
How to verify Elasticsearch High Availability (HA) functionality working fine? I mean what all check points are there to verify the same? --- ## [How to query hdfs data from elasticsearch using es-hadoop.?](https://discuss.elastic.co/t/how-to-query-hdfs-data-from-elasticsearch-using-es-hadoop/42339)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 6\ **Last updated:** [August 29, 2016, 2:05pm UTC](https://discuss.elastic.co/t/how-to-query-hdfs-data-from-elasticsearch-using-es-hadoop/42339 "2016-08-29T14:05:09Z")
I have data in hdfs and how can i retried the hdfs data and perform realtime queries on hdfs data.? @magnusbaeck Could you please help me out.? @zachary\_tong Could you please help me out.? This will be very import… --- ## [Migrating Splunk query to Elastic](https://discuss.elastic.co/t/migrating-splunk-query-to-elastic/174155)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 3\ **Last updated:** [April 3, 2019, 10:27am UTC](https://discuss.elastic.co/t/migrating-splunk-query-to-elastic/174155 "2019-04-03T10:27:31Z")
Currently we are using Splunk and planning to migrate to Elastic. We are in the process of deciding how data needs to be ingested into Elastic Cluster. In this topic I will give provide Sample log data. Current Splunk… --- ## [WARNING: Could not find logstash.yml cannot found](https://discuss.elastic.co/t/warning-could-not-find-logstash-yml-cannot-found/131013)
**Author:** [@sayed\_mohamed](https://discuss.elastic.co/u/sayed_mohamed)\ **Replies:** 3\ **Last updated:** [May 8, 2018, 6:34pm UTC](https://discuss.elastic.co/t/warning-could-not-find-logstash-yml-cannot-found/131013 "2018-05-08T18:34:41Z")
i have a problem that i run file as command : sudo bin/logstash --path.data sensor38 -f /home/sayed/logstash/sayed.conf and i have an warning that i set some configuration on it WARNING: Could not find logstash.yml wh… --- ## [Query Match text starting with exclamation mark (!)](https://discuss.elastic.co/t/query-match-text-starting-with-exclamation-mark/89237)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 3\ **Last updated:** [June 13, 2017, 5:07pm UTC](https://discuss.elastic.co/t/query-match-text-starting-with-exclamation-mark/89237 "2017-06-13T17:07:53Z")
Hi, I am trying to look for values in a free form text field which may start with the exclamation mark (!) and exclude it from the results. But I can’t figure out what to put in the query input in the Kibana Discover. … --- ## [Logstash 5.0.0-alpha4 - Can't install any plugins](https://discuss.elastic.co/t/logstash-5-0-0-alpha4-cant-install-any-plugins/54496)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 6:05pm UTC](https://discuss.elastic.co/t/logstash-5-0-0-alpha4-cant-install-any-plugins/54496 "2016-07-11T18:05:38Z")
Having an issue with LS 5 alpha4: Trying to install any plugins throws an install error, resulting in a retry loop. I tried to do this first of all with a local .gem, however packaged plugins are also producing the sam… --- ## [Faire un ET sur plusieurs champs commençant par](https://discuss.elastic.co/t/faire-un-et-sur-plusieurs-champs-commencant-par/26621)
**Author:** [@Thibaut\_Tropardy](https://discuss.elastic.co/u/Thibaut_Tropardy)\ **Replies:** 3\ **Last updated:** [July 31, 2015, 11:20am UTC](https://discuss.elastic.co/t/faire-un-et-sur-plusieurs-champs-commencant-par/26621 "2015-07-31T11:20:20Z")
Je cherche à faire une recherche sur plusieurs champs de type commençant par (en java) Si l'utilisateur fait un espace, je veux faire un ou. J'ai fait plusieurs essai de requêtes, et je ne comprend pas toujours la logiqu… --- ## [Logstash grok regex threw exception](https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106)
**Author:** [@Dee](https://discuss.elastic.co/u/Dee)\ **Replies:** 0\ **Last updated:** [March 8, 2018, 3:16pm UTC](https://discuss.elastic.co/t/logstash-grok-regex-threw-exception/123106 "2018-03-08T15:16:44Z")
Hi, I'm migrating grok patterns from logstash 2.3 to logstash 6.2, so far its going well, except for my syslog logs. This is the grok pattern I have: if \[type\] == "syslog" { grok { break\_on\_match =\> false … --- ## [Error in installing xpack plugin for elasticsearch](https://discuss.elastic.co/t/error-in-installing-xpack-plugin-for-elasticsearch/119194)
**Author:** [@Gaurav\_Agarwal](https://discuss.elastic.co/u/Gaurav_Agarwal)\ **Replies:** 0\ **Last updated:** [February 9, 2018, 9:08am UTC](https://discuss.elastic.co/t/error-in-installing-xpack-plugin-for-elasticsearch/119194 "2018-02-09T09:08:18Z")
C:\\Users\\gagarwal3\\Downloads\\Elastic\\Elasticsearch\\6.1.1\\bin\>elasticsearch-plugin install x-pack -\> Downloading x-pack from elastic \[=================================================\] 100% Exception in thread "main" j… --- ## [Filebeat Multiline problem with Logstash](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logstash/95997)
**Author:** [@madou23](https://discuss.elastic.co/u/madou23)\ **Replies:** 1\ **Last updated:** [August 6, 2017, 11:27am UTC](https://discuss.elastic.co/t/filebeat-multiline-problem-with-logstash/95997 "2017-08-06T11:27:15Z")
Hi all, I am trying to use multiline pattern in filebeat to append multiline code in jenkins log Below is a sample of log file: Aug 06, 2017 12:18:19 AM hudson.UDPBroadcastThread run INFO: Cannot listen to UDP port 33… --- ## [Elasticsearch: Service Unavailable in Kibana 4.3](https://discuss.elastic.co/t/elasticsearch-service-unavailable-in-kibana-4-3/36589)
**Author:** [@sdsunjay](https://discuss.elastic.co/u/sdsunjay)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 3:18am UTC](https://discuss.elastic.co/t/elasticsearch-service-unavailable-in-kibana-4-3/36589 "2015-12-08T03:18:59Z")
I'm running 4 instances of Elasticsearch 2.1. 1 of the instances, named "superman\_172\_31\_5\_65", runs with Kibana 4.3 (Apache is the proxy) and has node.data and node.master set to false. Whenever I start Kibana I get th… --- ## [Spool size on filebeat](https://discuss.elastic.co/t/spool-size-on-filebeat/33771)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 1\ **Last updated:** [November 5, 2015, 2:04am UTC](https://discuss.elastic.co/t/spool-size-on-filebeat/33771 "2015-11-05T02:04:55Z")
Hello all! Would someone mind explaining to me how the spool\_size parameter affects the beats output? Does it make it faster? Is it the amount of lines per transmission? Thanks --- ## [Vega HeatMap](https://discuss.elastic.co/t/vega-heatmap/161528)
**Author:** [@Mike\_CC](https://discuss.elastic.co/u/Mike_CC)\ **Replies:** 4\ **Last updated:** [September 9, 2019, 5:15pm UTC](https://discuss.elastic.co/t/vega-heatmap/161528 "2019-09-09T17:15:01Z")
Hi everyone, I'm trying to build a heatmap in Vega. I can't build it in the normal heatmap visualization because I need each cell to be a ratio. I have 3 fields, X from 0 to 9, Y from 0 to 9 and Z with values 0 or 1. M… --- ## [Logstash 2.3.x how to load nested objects in elasticsearch index using logstash-jdbc plugin](https://discuss.elastic.co/t/logstash-2-3-x-how-to-load-nested-objects-in-elasticsearch-index-using-logstash-jdbc-plugin/180988)
**Author:** [@vinay\_rawat](https://discuss.elastic.co/u/vinay_rawat)\ **Replies:** 4\ **Last updated:** [May 14, 2019, 5:38pm UTC](https://discuss.elastic.co/t/logstash-2-3-x-how-to-load-nested-objects-in-elasticsearch-index-using-logstash-jdbc-plugin/180988 "2019-05-14T17:38:25Z")
Hi, I am currently using elasticsearch 2.3.4 and logstash 2.3.4 I am trying to load relational data from Oracle db into my elasticsearch index using jdbc plugin. As suggested in various posts, I am using aggregate filt… --- ## [Alternative River](https://discuss.elastic.co/t/alternative-river/784)
**Author:** [@Jeje\_Pinot](https://discuss.elastic.co/u/Jeje_Pinot)\ **Replies:** 5\ **Last updated:** [June 23, 2015, 9:08am UTC](https://discuss.elastic.co/t/alternative-river/784 "2015-06-23T09:08:04Z")
Bonjour, Je viens de découvrir Elasticsearch il y a quelques semaines et après quelques tests, je suis devenu totalement fan. Je compte d'ailleurs proposer cette technologie à la boite dans laquelle je fais actuellemen… --- ## ["The connection is broken and recovery is not possible" after MSSQL reboot](https://discuss.elastic.co/t/the-connection-is-broken-and-recovery-is-not-possible-after-mssql-reboot/338793)
**Author:** [@mr18](https://discuss.elastic.co/u/mr18)\ **Replies:** 1\ **Last updated:** [July 19, 2023, 4:02pm UTC](https://discuss.elastic.co/t/the-connection-is-broken-and-recovery-is-not-possible-after-mssql-reboot/338793 "2023-07-19T16:02:50Z")
Hi all ! I use a jdbc input plugin to get MS SQL data. Everything works fine, but when my SQL server reboots for maintenance, the queries don't work anymore, and I have the following error: \[ERROR\]\[logstash.inputs.jdb… --- ## [Kubernetes module not getting resource limits](https://discuss.elastic.co/t/kubernetes-module-not-getting-resource-limits/167210)
**Author:** [@fr0der1c](https://discuss.elastic.co/u/fr0der1c)\ **Replies:** 7\ **Last updated:** [February 16, 2019, 1:25am UTC](https://discuss.elastic.co/t/kubernetes-module-not-getting-resource-limits/167210 "2019-02-16T01:25:25Z")
I enabled the Kubernetes module (https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html) and everything works fine. But the kubernetes.pod.memory.usage.limit.pct field is falling back to tota… --- ## [Extract on various lines with logstash](https://discuss.elastic.co/t/extract-on-various-lines-with-logstash/45916)
**Author:** [@oth1113](https://discuss.elastic.co/u/oth1113)\ **Replies:** 7\ **Last updated:** [March 31, 2016, 2:22pm UTC](https://discuss.elastic.co/t/extract-on-various-lines-with-logstash/45916 "2016-03-31T14:22:08Z")
so I just discovered logstash and I managed to extract data from log files. This time, I have to extract information on MULTIlines, I show you an example: 2016-03-07 14:09:11,613 INFO \[\]\[com.ole.ecom.jms.crm.JmsCrmSen… --- ## [How to include %{} variable in the gsub](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482)
**Author:** [@darshan](https://discuss.elastic.co/u/darshan)\ **Replies:** 7\ **Last updated:** [January 4, 2016, 4:57am UTC](https://discuss.elastic.co/t/how-to-include-variable-in-the-gsub/37482 "2016-01-04T04:57:46Z")
Hi, I am new to logstash, and i stuck in parsin some antivirus log . Can any one please tell me how to use dynamic variable like %{} in the gsub to replace. Thank you -Regards darshan --- ## [Filter query gives empty result](https://discuss.elastic.co/t/filter-query-gives-empty-result/75140)
**Author:** [@thiru](https://discuss.elastic.co/u/thiru)\ **Replies:** 2\ **Last updated:** [February 21, 2017, 2:29pm UTC](https://discuss.elastic.co/t/filter-query-gives-empty-result/75140 "2017-02-21T14:29:06Z")
I have created a following mapping and I loaded and indexed some documents . I ran the following query but I am not getting any results I am filtering data on the text field . Does filter works on the text field ? If … --- ## [Zeek/Bro to ECS Field Mappings](https://discuss.elastic.co/t/zeek-bro-to-ecs-field-mappings/324120)
**Author:** [@3weekwhiskers](https://discuss.elastic.co/u/3weekwhiskers)\ **Replies:** 3\ **Last updated:** [January 30, 2023, 12:41pm UTC](https://discuss.elastic.co/t/zeek-bro-to-ecs-field-mappings/324120 "2023-01-30T12:41:47Z")
Is there a Zeek field to ECS field mapping document? Other than the logtype.yml files which actually do the conversion and renames, I have not been able to find anything. I'm avoiding having to build this mapping from sc… --- ## [Default Kibana Index Not Working](https://discuss.elastic.co/t/default-kibana-index-not-working/232075)
**Author:** [@grantcurell](https://discuss.elastic.co/u/grantcurell)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 6:27pm UTC](https://discuss.elastic.co/t/default-kibana-index-not-working/232075 "2020-05-11T18:27:51Z")
I'm running in Docker with no permanent storage currently. This seems like it would be related to: however I've tried the mentioned fixes without luck. I load in a random point with something simple like: curl -X PUT… --- ## [Deleted Rollup Job but cannot re-create it](https://discuss.elastic.co/t/deleted-rollup-job-but-cannot-re-create-it/146294)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 4\ **Last updated:** [August 29, 2018, 6:06pm UTC](https://discuss.elastic.co/t/deleted-rollup-job-but-cannot-re-create-it/146294 "2018-08-29T18:06:46Z")
After creating a rollup job and deleting it we are unable to create a job again with the same id. POST /\_xpack/rollup/job/foo { "error": { "root\_cause": \[ { "type": "status\_except… --- ## [Mapping Geo-location From Database](https://discuss.elastic.co/t/mapping-geo-location-from-database/42553)
**Author:** [@Croos](https://discuss.elastic.co/u/Croos)\ **Replies:** 4\ **Last updated:** [February 29, 2016, 9:53am UTC](https://discuss.elastic.co/t/mapping-geo-location-from-database/42553 "2016-02-29T09:53:37Z")
I have a table and want to visualize on kibana. lead\_id | longitude | latitude When I import it to elastic search using logstash, How can I map it on elasticsearch? --- ## [Parse AWS CloudTrail and CloudWatch Logs in Logstash](https://discuss.elastic.co/t/parse-aws-cloudtrail-and-cloudwatch-logs-in-logstash/208419)
**Author:** [@A\_P](https://discuss.elastic.co/u/A_P)\ **Replies:** 2\ **Last updated:** [November 21, 2019, 10:13pm UTC](https://discuss.elastic.co/t/parse-aws-cloudtrail-and-cloudwatch-logs-in-logstash/208419 "2019-11-21T22:13:51Z")
By default, CloudTrail logs are aggregated per region and then redirected to an S3 bucket (compressed JSON files). Cloudtrail delivers log files to s3 bucket, approximately every 5 minutes. We can use the Logstash S3 inp… --- ## [Migration timeout when upgrading Kibana from 7.15.1 to 7.15.2 or 7.16.0](https://discuss.elastic.co/t/migration-timeout-when-upgrading-kibana-from-7-15-1-to-7-15-2-or-7-16-0/291338)
**Author:** [@calve](https://discuss.elastic.co/u/calve)\ **Replies:** 3\ **Last updated:** [December 31, 2021, 5:10pm UTC](https://discuss.elastic.co/t/migration-timeout-when-upgrading-kibana-from-7-15-1-to-7-15-2-or-7-16-0/291338 "2021-12-31T17:10:39Z")
Hi, my kibana installation fails to upgrade from 7.15.1 to 7.15.2 and 7.16.0 during the CLONE\_TEMP\_TO\_TARGET -\> CLONE\_TEMP\_TO\_TARGET step. Also had the exact same problem from 7.13.1 to 7.13.2 but cant remember how I f… --- ## [CSS Elements in TSVB Markdown](https://discuss.elastic.co/t/css-elements-in-tsvb-markdown/205134)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 10:02pm UTC](https://discuss.elastic.co/t/css-elements-in-tsvb-markdown/205134 "2019-10-24T22:02:09Z")
I have a very basic understanding of HTML and CSS, but I was wondering, how do I determine what elements in the TSVB Markdown visualization that I can apply styling to? --- ## [Error with basic geo\_point setup in logstash](https://discuss.elastic.co/t/error-with-basic-geo-point-setup-in-logstash/82175)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 3\ **Last updated:** [April 12, 2017, 4:10pm UTC](https://discuss.elastic.co/t/error-with-basic-geo-point-setup-in-logstash/82175 "2017-04-12T16:10:24Z")
I am trying use a basic geo\_point/geoip setup in logstash. My template for ES has the following field: "source\_geoip" : { "type" : "geo\_point" } Then, in my logstash config, I am trying the following: ge… --- ## [Bad Password Characters in Logstash Config file](https://discuss.elastic.co/t/bad-password-characters-in-logstash-config-file/78036)
**Author:** [@ccampbell](https://discuss.elastic.co/u/ccampbell)\ **Replies:** 3\ **Last updated:** [March 9, 2017, 8:43pm UTC](https://discuss.elastic.co/t/bad-password-characters-in-logstash-config-file/78036 "2017-03-09T20:43:17Z")
In testing out a Windows Eventlog collection system using the Elastic stack, I discovered a curious problem with the password I was using for connecting through Xpack. I had used a system generated password that used sev… --- ## [Elasticsearch 7.8 does not stat Java problem](https://discuss.elastic.co/t/elasticsearch-7-8-does-not-stat-java-problem/245902)
**Author:** [@aurimas](https://discuss.elastic.co/u/aurimas)\ **Replies:** 2\ **Last updated:** [August 27, 2020, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-does-not-stat-java-problem/245902 "2020-08-27T12:18:49Z")
Hi, I am trying to fresh install and launch Elasticsearch 7.8 on RHEL 7.8 but I am getting into some kind of Java problems. I want it to run standalone. Tried various ways I found on internet to fix it. But none helpe… --- ## [How to write output to avro file from logstash using avro codec](https://discuss.elastic.co/t/how-to-write-output-to-avro-file-from-logstash-using-avro-codec/42406)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 12:00am UTC](https://discuss.elastic.co/t/how-to-write-output-to-avro-file-from-logstash-using-avro-codec/42406 "2016-02-23T00:00:08Z")
Hi. I have file input that is in json format. How can i write to avro file output using elasticsearch.? --- ## [Timestamp is ingest timestamp, not event timestamp](https://discuss.elastic.co/t/timestamp-is-ingest-timestamp-not-event-timestamp/248351)
**Author:** [@batninja24601](https://discuss.elastic.co/u/batninja24601)\ **Replies:** 5\ **Last updated:** [September 13, 2020, 4:03am UTC](https://discuss.elastic.co/t/timestamp-is-ingest-timestamp-not-event-timestamp/248351 "2020-09-13T04:03:52Z")
I am using Filebeat to send single line ELFF formatted logs from a Bluecoat proxy to Logstash. I believe I am grokking out the timestamp field correctly from the message, but the timestamp in ElasticSearch for all these… --- ## [Logstash shut down and stopped processing because of an error: (SystemExit)](https://discuss.elastic.co/t/logstash-shut-down-and-stopped-processing-because-of-an-error-systemexit/354280)
**Author:** [@Mad\_User](https://discuss.elastic.co/u/Mad_User)\ **Replies:** 7\ **Last updated:** [February 28, 2024, 2:28am UTC](https://discuss.elastic.co/t/logstash-shut-down-and-stopped-processing-because-of-an-error-systemexit/354280 "2024-02-28T02:28:24Z")
Let me say right away that I am not a professional. I have a problem with Logstash. A few days ago it stopped collecting data and I found an error in the logs. Before it stopped collecting data, changes were made to logs… --- ## [Msearch performance decreases when increasing the number of shards](https://discuss.elastic.co/t/msearch-performance-decreases-when-increasing-the-number-of-shards/142724)
**Author:** [@vincent.arnaud90](https://discuss.elastic.co/u/vincent.arnaud90)\ **Replies:** 7\ **Last updated:** [September 3, 2018, 11:47am UTC](https://discuss.elastic.co/t/msearch-performance-decreases-when-increasing-the-number-of-shards/142724 "2018-09-03T11:47:23Z")
Elasticsearch version: 6.1.1 Plugins installed: \[analysis-icu, analysis-phonetic\] Description of the problem: I am testing the msearch capability on the rally's geonames set with quite a lot of basic match queries (15… --- ## [Error parsing CSV - Illegal quoting with non-ascii (default)](https://discuss.elastic.co/t/error-parsing-csv-illegal-quoting-with-non-ascii-default/83279)
**Author:** [@niels1189](https://discuss.elastic.co/u/niels1189)\ **Replies:** 1\ **Last updated:** [April 22, 2017, 3:37pm UTC](https://discuss.elastic.co/t/error-parsing-csv-illegal-quoting-with-non-ascii-default/83279 "2017-04-22T15:37:57Z")
CSV Line: "Mañe"###"email@gmail.com"###"3563454"###"255.255.255.255" :source=\>"\\\\\\"Man\\\\xF1e\\\\\\"###\\\\\\"email@gmail.com\\\\\\"###\\\\\\"3563454\\\\\\"###\\\\\\"255.255.255.255\\\\\\"",:exception=\># CSV::MalformedCSVError: Illegal quot… --- ## [How to extract xml data?](https://discuss.elastic.co/t/how-to-extract-xml-data/82557)
**Author:** [@laptop\_data](https://discuss.elastic.co/u/laptop_data)\ **Replies:** 7\ **Last updated:** [April 20, 2017, 11:06am UTC](https://discuss.elastic.co/t/how-to-extract-xml-data/82557 "2017-04-20T11:06:41Z")
Hi, I have XML data shown below, how to extract it. Using XML filter. \ \ \ \ **Author:** [@sudaraka007](https://discuss.elastic.co/u/sudaraka007)\ **Replies:** 6\ **Last updated:** [January 5, 2016, 7:37am UTC](https://discuss.elastic.co/t/configuring-elastic-search-nodes-to-talk-to-each-other-in-digital-ocean-droplets/38289 "2016-01-05T07:37:06Z") I'm a student researching on elastic search and i am trying to configure my elastic nodes to work with each other which are hosted in digital ocean droplets. Can anyone help me? thanks in advance. --- ## [Do Doc Values allow for sorted scrolling over a billion of documents?](https://discuss.elastic.co/t/do-doc-values-allow-for-sorted-scrolling-over-a-billion-of-documents/2596)
**Author:** [@lisak](https://discuss.elastic.co/u/lisak)\ **Replies:** 6\ **Last updated:** [June 17, 2015, 7:17pm UTC](https://discuss.elastic.co/t/do-doc-values-allow-for-sorted-scrolling-over-a-billion-of-documents/2596 "2015-06-17T19:17:58Z")
Hi, I need to perform scrolling over a billion of docs, sorted by just one field Foo. If I format this single field Foo (+ possibly but I guess not necessarily all those fields retrieved by scroll) as "doc\_values", is it… --- ## [How to get \_id in search API in java high level rest client](https://discuss.elastic.co/t/how-to-get-id-in-search-api-in-java-high-level-rest-client/222164)
**Author:** [@hemamalini](https://discuss.elastic.co/u/hemamalini)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 2:27pm UTC](https://discuss.elastic.co/t/how-to-get-id-in-search-api-in-java-high-level-rest-client/222164 "2020-03-12T14:27:52Z")
Hi I am using Elastic search 5.6 . As of now i cannot upgrade to higher versions. I am using Java High level rest client to fetch documents . I need to get \_id in search response. I am not getting document id in search r… --- ## [Error fetching fields in kibana](https://discuss.elastic.co/t/error-fetching-fields-in-kibana/211910)
**Author:** [@111228](https://discuss.elastic.co/u/111228)\ **Replies:** 2\ **Last updated:** [December 18, 2019, 4:48pm UTC](https://discuss.elastic.co/t/error-fetching-fields-in-kibana/211910 "2019-12-18T16:48:27Z")
Good day I have a problem. Anyone had such a problem? how to resolve it? --- ## [Loading Oracle into Elastic with Logstash](https://discuss.elastic.co/t/loading-oracle-into-elastic-with-logstash/242957)
**Author:** [@Queyon](https://discuss.elastic.co/u/Queyon)\ **Replies:** 4\ **Last updated:** [July 29, 2020, 12:02am UTC](https://discuss.elastic.co/t/loading-oracle-into-elastic-with-logstash/242957 "2020-07-29T00:02:13Z")
I'm trying to load Oracle data into Elastic with Logstash. The query returns a number of rows, but it only loaded one record into Elastic. Is there anything wrong with my config file? input { jdbc { jdbc\_driver\_libr… --- ## [How to install Elasticsearch-head without internet](https://discuss.elastic.co/t/how-to-install-elasticsearch-head-without-internet/40821)
**Author:** [@Lovika\_Jain](https://discuss.elastic.co/u/Lovika_Jain)\ **Replies:** 4\ **Last updated:** [September 16, 2016, 1:50pm UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-head-without-internet/40821 "2016-09-16T13:50:02Z")
I have downloaded the .zip file from mobz/elasticsearch-head for the installation of elasticsearch-head but don't know how to install it and where to place it in Linux server. Can somebody help! [Previous page](https://discuss.elastic.co/top.md?page=762&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=764&per_page=50&period=all)