# Top **URL:** https://discuss.elastic.co/top.md?page=775&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 776 --- ## [Event fields missing if renderinginfo is empty](https://discuss.elastic.co/t/event-fields-missing-if-renderinginfo-is-empty/84709)
**Author:** [@ssiws](https://discuss.elastic.co/u/ssiws)\ **Replies:** 5\ **Last updated:** [May 9, 2017, 7:58am UTC](https://discuss.elastic.co/t/event-fields-missing-if-renderinginfo-is-empty/84709 "2017-05-09T07:58:50Z")
Hello, I'm using Winlogbeat to push Forwarded Event to logstash but I have the following problem: It seems that Windows 7 clients can't reliably fill the "RenderingInfo" section of the events: some of them contain on… --- ## [Is there a "standard" way to store result of query into index?](https://discuss.elastic.co/t/is-there-a-standard-way-to-store-result-of-query-into-index/110650)
**Author:** [@aarakelyan](https://discuss.elastic.co/u/aarakelyan)\ **Replies:** 1\ **Last updated:** [December 15, 2017, 9:12am UTC](https://discuss.elastic.co/t/is-there-a-standard-way-to-store-result-of-query-into-index/110650 "2017-12-15T09:12:16Z")
just storing result of search query in index store result of aggregation (specially pipeline) query in index. Is any way to filter aggregated results based on some conditions into index --- ## [Watcher Unable to Alert via Email and Webhook](https://discuss.elastic.co/t/watcher-unable-to-alert-via-email-and-webhook/208001)
**Author:** [@lynkle](https://discuss.elastic.co/u/lynkle)\ **Replies:** 2\ **Last updated:** [November 22, 2019, 2:37am UTC](https://discuss.elastic.co/t/watcher-unable-to-alert-via-email-and-webhook/208001 "2019-11-22T02:37:56Z")
Hi! I have created a webhook to test out altering using some of the new machine learning features and run into some issues when attempting to send test alerts from the Kibana UI. Currently I am not concerned with alerti… --- ## [Integration of kibana widgets in angular app](https://discuss.elastic.co/t/integration-of-kibana-widgets-in-angular-app/298929)
**Author:** [@frank3nst3in](https://discuss.elastic.co/u/frank3nst3in)\ **Replies:** 3\ **Last updated:** [March 9, 2022, 9:15am UTC](https://discuss.elastic.co/t/integration-of-kibana-widgets-in-angular-app/298929 "2022-03-09T09:15:03Z")
Hi Elastic Team, I have a working angular app, a nodejs backend and a privately hosted ELK instance. Currently, everything is going good with kibana dashboard. But, now I want to display widgets generated by the kiban… --- ## [Remove xml-tags during parsing](https://discuss.elastic.co/t/remove-xml-tags-during-parsing/71713)
**Author:** [@Denny](https://discuss.elastic.co/u/Denny)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 1:00pm UTC](https://discuss.elastic.co/t/remove-xml-tags-during-parsing/71713 "2017-01-16T13:00:24Z")
Hello, So far I've only experience with indexing csv-files with Logstash into Elasticsearch. Now I have a couple of xml-files which I want to index and fortunately it was not that difficult. With the most basic conf I'… --- ## [Kibana 7.7 tls enabling with ssl cert from let's encrypt](https://discuss.elastic.co/t/kibana-7-7-tls-enabling-with-ssl-cert-from-lets-encrypt/237205)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 2\ **Last updated:** [June 16, 2020, 8:03pm UTC](https://discuss.elastic.co/t/kibana-7-7-tls-enabling-with-ssl-cert-from-lets-encrypt/237205 "2020-06-16T20:03:18Z")
Hello, In my kibana setup I've secured using elastic ca certs. Chrome, firefox don't like them. Chrome refuses to allow login to my app. I would like to know how to generate certificate from let's encrypt using the car… --- ## [Timelion - Find unique count on multiple conditions](https://discuss.elastic.co/t/timelion-find-unique-count-on-multiple-conditions/195423)
**Author:** [@thomasdang](https://discuss.elastic.co/u/thomasdang)\ **Replies:** 2\ **Last updated:** [August 19, 2019, 8:49pm UTC](https://discuss.elastic.co/t/timelion-find-unique-count-on-multiple-conditions/195423 "2019-08-19T20:49:30Z")
Hi Experts, I need to calculate the unique number of string values in a field with multiple query conditions. Here's an example: There are 2 fields: CUSTOMER\_NAME (with values like "John", "Jack", "Marie", etc.) BOUG… --- ## [Memory problem ( \[WARN \]\[monitor.jvm\] .... )?](https://discuss.elastic.co/t/memory-problem-warn-monitor-jvm/17637)
**Author:** [@Tanguy\_Bernard](https://discuss.elastic.co/u/Tanguy_Bernard)\ **Replies:** 4\ **Last updated:** [July 29, 2014, 12:48pm UTC](https://discuss.elastic.co/t/memory-problem-warn-monitor-jvm/17637 "2014-07-29T12:48:31Z")
Hello I try to index data in Elasticsearch, everything find until this \[WARN \]\[monitor.jvm\] .... ? This is the first time it happens to me. Can you help me to solve my problem ? PUT /my\_index/ { "mappings" : { "… --- ## [Calculating the difference between datetime cells for an average](https://discuss.elastic.co/t/calculating-the-difference-between-datetime-cells-for-an-average/343225)
**Author:** [@SpicyS](https://discuss.elastic.co/u/SpicyS)\ **Replies:** 8\ **Last updated:** [September 19, 2023, 8:46am UTC](https://discuss.elastic.co/t/calculating-the-difference-between-datetime-cells-for-an-average/343225 "2023-09-19T08:46:54Z")
Hello, I'm new to kibana and I would like to know if it is possible to calculate the difference between 2 datetime fields named: "start\_date" and "end\_date", the reason for this is the fact I want to show the average du… --- ## [Sorting issue with space](https://discuss.elastic.co/t/sorting-issue-with-space/106461)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 8\ **Last updated:** [November 13, 2017, 3:34am UTC](https://discuss.elastic.co/t/sorting-issue-with-space/106461 "2017-11-13T03:34:18Z")
After Sort I am getting result like this Adfgsdh Bhdfaf Dbsdf Z Edfghf Mkjldfhd Zdhgj Word Z Edfghf came on wrong place. When I removed space it came on proper place ElasticsearchResponse objElasticResponse = obj… --- ## [Problem with start Kibana 4.3](https://discuss.elastic.co/t/problem-with-start-kibana-4-3/36676)
**Author:** [@seedar](https://discuss.elastic.co/u/seedar)\ **Replies:** 3\ **Last updated:** [December 9, 2015, 9:13pm UTC](https://discuss.elastic.co/t/problem-with-start-kibana-4-3/36676 "2015-12-09T21:13:58Z")
Hi everyone, At the beginning I want to say that the software ELK is completely new for me. At the moment already I started the Logstash and Elasticsearch and everything looks ok but when trying to run Kibana I have th… --- ## [Autodiscover - docker - catch all others](https://discuss.elastic.co/t/autodiscover-docker-catch-all-others/127868)
**Author:** [@setiseta](https://discuss.elastic.co/u/setiseta)\ **Replies:** 5\ **Last updated:** [April 14, 2018, 10:00am UTC](https://discuss.elastic.co/t/autodiscover-docker-catch-all-others/127868 "2018-04-14T10:00:38Z")
Hello, I want to setup autodiscover of type docker, do some special configs for some images and at the end I want to catch all other containers to log as is. But i haven't found how to configure the 'catch all others'. … --- ## [Using Painless Scripted Field](https://discuss.elastic.co/t/using-painless-scripted-field/108328)
**Author:** [@seanshandy](https://discuss.elastic.co/u/seanshandy)\ **Replies:** 5\ **Last updated:** [November 23, 2017, 3:41am UTC](https://discuss.elastic.co/t/using-painless-scripted-field/108328 "2017-11-23T03:41:06Z")
I have some question about using scripted field with painless, so i have some set of data that look like this, One Document can only contain identifier (MWStart or MWEnd), and i want to get like: if the identifier is M… --- ## [\_score inside function is NaN](https://discuss.elastic.co/t/score-inside-function-is-nan/154847)
**Author:** [@saturn](https://discuss.elastic.co/u/saturn)\ **Replies:** 6\ **Last updated:** [November 1, 2018, 11:59am UTC](https://discuss.elastic.co/t/score-inside-function-is-nan/154847 "2018-11-01T11:59:11Z")
I have a simple query: { "size": 10, "\_source": "email\_id", "query": { "function\_score": { "query": { "bool": { "must": { "match\_phrase": { "message": { … --- ## [How to sory array type field using the length](https://discuss.elastic.co/t/how-to-sory-array-type-field-using-the-length/344210)
**Author:** [@Anand\_Konagala](https://discuss.elastic.co/u/Anand_Konagala)\ **Replies:** 7\ **Last updated:** [October 3, 2023, 8:59am UTC](https://discuss.elastic.co/t/how-to-sory-array-type-field-using-the-length/344210 "2023-10-03T08:59:59Z")
Hi, I want to create an index having with one array field.. Then, how can I give mapping for that array field which is available to sort using the length of that array. One more thing that it supports that the array hav… --- ## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias \[cisco-switch\] does not point to index \[cisco-switch-2022.07.27\]](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-cisco-switch-does-not-point-to-index-cisco-switch-2022-07-27/310719)
**Author:** [@MADxHAWK](https://discuss.elastic.co/u/MADxHAWK)\ **Replies:** 7\ **Last updated:** [July 28, 2022, 6:26am UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-cisco-switch-does-not-point-to-index-cisco-switch-2022-07-27/310719 "2022-07-28T06:26:19Z")
Hello, after trying to figure out some stuff about ILM i need some help now. I have about 400 Cisco-Devices sending their logs to a syslog-ng server from where they are send to Elasticsearch via Filebeat / Logstash. T… --- ## [Master not discovered exception](https://discuss.elastic.co/t/master-not-discovered-exception/256215)
**Author:** [@nandinireddy](https://discuss.elastic.co/u/nandinireddy)\ **Replies:** 7\ **Last updated:** [November 24, 2020, 7:26am UTC](https://discuss.elastic.co/t/master-not-discovered-exception/256215 "2020-11-24T07:26:55Z")
Hi, i have configured Elasticsearch through docker swarm. When i do deploy of swarm every container in nodes are up and running but when i checked elastic search from browser getting master not discovered exception. Help… --- ## [How to configure username and password in kibana in docker-compose.yml](https://discuss.elastic.co/t/how-to-configure-username-and-password-in-kibana-in-docker-compose-yml/207103)
**Author:** [@Aditya\_kumar\_kar](https://discuss.elastic.co/u/Aditya_kumar_kar)\ **Replies:** 1\ **Last updated:** [November 9, 2019, 5:20pm UTC](https://discuss.elastic.co/t/how-to-configure-username-and-password-in-kibana-in-docker-compose-yml/207103 "2019-11-09T17:20:57Z")
version: '2.2' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.4.1 container\_name: elasticsearch environment: - node.name=elasticsearch - discovery.seed\_hosts=elasticsearch2 - clus… --- ## [6.2.1: Unrecognized option: -server](https://discuss.elastic.co/t/6-2-1-unrecognized-option-server/128017)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 7\ **Last updated:** [April 20, 2018, 12:04am UTC](https://discuss.elastic.co/t/6-2-1-unrecognized-option-server/128017 "2018-04-20T00:04:59Z")
Hi! Trying to upgrade from 6.1.2 to 6.2.3 on Windows. We have JAVA\_HOME and am using jre 1.8.0.111 ES\_PATH\_CONF is set to a directory outside of the Elastic installation directory. Getting this error when trying to s… --- ## [How Can i get max id of indexed documents](https://discuss.elastic.co/t/how-can-i-get-max-id-of-indexed-documents/110403)
**Author:** [@pamara](https://discuss.elastic.co/u/pamara)\ **Replies:** 1\ **Last updated:** [December 5, 2017, 11:25pm UTC](https://discuss.elastic.co/t/how-can-i-get-max-id-of-indexed-documents/110403 "2017-12-05T23:25:16Z")
I am new to elastic search. I indexed few of documents and i want to find the max id which ever inserted across the documents. My URL something like ":/books/dramabooks/\_search?size=0" { "aggs" : { "max\_id" : { "max"… --- ## [Use Random\_score along with multiple filter](https://discuss.elastic.co/t/use-random-score-along-with-multiple-filter/93264)
**Author:** [@Mads\_Odgaard](https://discuss.elastic.co/u/Mads_Odgaard)\ **Replies:** 1\ **Last updated:** [July 21, 2017, 2:28pm UTC](https://discuss.elastic.co/t/use-random-score-along-with-multiple-filter/93264 "2017-07-21T14:28:54Z")
Hello. I am quite new to Elasticsearch, and I've been trying my way around, but I just can't seem to get this to work exactly the way I want. I wish to to retrieve 3 random documents based on filters. Lets just take … --- ## [Json: cannot unmarshal string into Go value of type map\[string\]interface {}](https://discuss.elastic.co/t/json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/208660)
**Author:** [@sur1029](https://discuss.elastic.co/u/sur1029)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 12:36pm UTC](https://discuss.elastic.co/t/json-cannot-unmarshal-string-into-go-value-of-type-map-string-interface/208660 "2019-12-09T12:36:21Z")
Hi, We are pushing json logs from application and have configured filebeat to push same logs to es. I am getting below error in logs: 2019/11/20 06:12:59.971200 json .go:32: ERR Error decoding JSON: json : cannot unma… --- ## [How can wildcard be used in a phrase query?](https://discuss.elastic.co/t/how-can-wildcard-be-used-in-a-phrase-query/104042)
**Author:** [@esuser1027](https://discuss.elastic.co/u/esuser1027)\ **Replies:** 2\ **Last updated:** [October 17, 2017, 4:15am UTC](https://discuss.elastic.co/t/how-can-wildcard-be-used-in-a-phrase-query/104042 "2017-10-17T04:15:10Z")
What are the possible options for a phrase query to include wildcards using query\_string ? Without the wildcard below query returns some result. However, adding wildcard in any part of the query will no longer work. I… --- ## [Storage setup questions - JBOD or not? - node availability on disk failure](https://discuss.elastic.co/t/storage-setup-questions-jbod-or-not-node-availability-on-disk-failure/39135)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 2\ **Last updated:** [January 14, 2016, 8:09pm UTC](https://discuss.elastic.co/t/storage-setup-questions-jbod-or-not-node-availability-on-disk-failure/39135 "2016-01-14T20:09:35Z")
Hello, I know, this kind of questions has already been asked, but the information that I've found is scattered and almost old. We're on buying our nodes (5 to begin) and we don't want to make bad choices regarding t… --- ## [Understanding the custom rescore plugin execution flow](https://discuss.elastic.co/t/understanding-the-custom-rescore-plugin-execution-flow/127776)
**Author:** [@pere.urbon](https://discuss.elastic.co/u/pere.urbon)\ **Replies:** 2\ **Last updated:** [April 14, 2018, 1:05pm UTC](https://discuss.elastic.co/t/understanding-the-custom-rescore-plugin-execution-flow/127776 "2018-04-14T13:05:03Z")
Hi, my name is Pere Urbon, I am currently building a plugin for elasticsearch to implement fair ranking/search strategies. My initial idea has been to build this as a recore plugin due to the fact that the original pape… --- ## [Understanding the Explain Query](https://discuss.elastic.co/t/understanding-the-explain-query/8892)
**Author:** [@Peter\_Schroder](https://discuss.elastic.co/u/Peter_Schroder)\ **Replies:** 4\ **Last updated:** [September 15, 2012, 6:37pm UTC](https://discuss.elastic.co/t/understanding-the-explain-query/8892 "2012-09-15T18:37:05Z")
i am trying to debug a scoring issue, but i did not find a proper guide to how one would read the explain results. there is a query that has custom field boosts: curl -X GET "http://localhost:9200/test-headings… --- ## [How to convert/wrap a BooleanQuery to/in a BoolQueryBuilder object?](https://discuss.elastic.co/t/how-to-convert-wrap-a-booleanquery-to-in-a-boolquerybuilder-object/8619)
**Author:** [@bilash](https://discuss.elastic.co/u/bilash)\ **Replies:** 4\ **Last updated:** [August 4, 2012, 2:26am UTC](https://discuss.elastic.co/t/how-to-convert-wrap-a-booleanquery-to-in-a-boolquerybuilder-object/8619 "2012-08-04T02:26:20Z")
My application creates BoolQueryBuilder objects using Java API. Now I need to cache these in Jedis for reuse. Jedis only allows String type objects to be stored in it. So I convert the BoolQueryBuilder objects to Str… --- ## [How to find Documents where specific field is NULL](https://discuss.elastic.co/t/how-to-find-documents-where-specific-field-is-null/39483)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 1\ **Last updated:** [January 18, 2016, 11:19pm UTC](https://discuss.elastic.co/t/how-to-find-documents-where-specific-field-is-null/39483 "2016-01-18T23:19:15Z")
I would like to find all records where the custInfo field (String type) is null. How can I specify a query in Kibana (4.3) to retrieve only those records? Also, any records where custInfo is not null - regardless of … --- ## [Elasticsearch failed node exception (Negative longs unsupported) since 7.5 -7.6 upgrade](https://discuss.elastic.co/t/elasticsearch-failed-node-exception-negative-longs-unsupported-since-7-5-7-6-upgrade/222305)
**Author:** [@james.garside](https://discuss.elastic.co/u/james.garside)\ **Replies:** 3\ **Last updated:** [March 6, 2020, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-failed-node-exception-negative-longs-unsupported-since-7-5-7-6-upgrade/222305 "2020-03-06T11:04:09Z")
Since upgrading from 7.5 to 7.6 we have been getting an error on two of our master nodes which is causing them to fail. It seems something is trying to insert a negative long where one is not supported causing failure. I… --- ## [Current token (START\_OBJECT) not of boolean type](https://discuss.elastic.co/t/current-token-start-object-not-of-boolean-type/162333)
**Author:** [@burakkilic](https://discuss.elastic.co/u/burakkilic)\ **Replies:** 3\ **Last updated:** [December 31, 2018, 9:43pm UTC](https://discuss.elastic.co/t/current-token-start-object-not-of-boolean-type/162333 "2018-12-31T21:43:50Z")
Hi, I'm getting this error: ERROR 2018/12/28 09:47:00 Bulk response item: {"\_index":"events","\_type":"\_doc","\_id":"5bff91647395d80013fa5f8e","status":400,"error":{"type":"mapper\_parsing\_exception","reason":"failed to p… --- ## [Performance issue when working with large array](https://discuss.elastic.co/t/performance-issue-when-working-with-large-array/60970)
**Author:** [@cju](https://discuss.elastic.co/u/cju)\ **Replies:** 3\ **Last updated:** [October 14, 2016, 3:07pm UTC](https://discuss.elastic.co/t/performance-issue-when-working-with-large-array/60970 "2016-10-14T15:07:46Z")
Hello, I face a huge drop in performance when I work with huge arrays (thousand elements). Is it something expected ? Is there a way to understand how arrays are internally handled by elasticsearch ? --- ## [How to format, yyyymmdd to yyyy-mm-dd in a log file?](https://discuss.elastic.co/t/how-to-format-yyyymmdd-to-yyyy-mm-dd-in-a-log-file/58666)
**Author:** [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)\ **Replies:** 3\ **Last updated:** [August 23, 2016, 11:26am UTC](https://discuss.elastic.co/t/how-to-format-yyyymmdd-to-yyyy-mm-dd-in-a-log-file/58666 "2016-08-23T11:26:30Z")
I've started working around with the ELK tool stack since few weeks. What I need is to get the timestamp of the log event which includes date and the time and show it in a different field (ie: log\_timestamp). I've tried … --- ## [What is your best practice to access a cluster by a Java client?](https://discuss.elastic.co/t/what-is-your-best-practice-to-access-a-cluster-by-a-java-client/7865)
**Author:** [@jprante](https://discuss.elastic.co/u/jprante)\ **Replies:** 3\ **Last updated:** [May 29, 2012, 7:49pm UTC](https://discuss.elastic.co/t/what-is-your-best-practice-to-access-a-cluster-by-a-java-client/7865 "2012-05-29T19:49:59Z")
Hi, I'd like to learn how you use the Java client API for Elasticsearch and what your experiences are so far. My scenario is a web app (\*.war or similar) running on an app server ( e.g. Glassfish, JBoss etc.) i… --- ## [\[Solved\] Elastic agent as fleet server auto shutdown for no reason in K8S](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724)
**Author:** [@SaigyoujiYuyuko233](https://discuss.elastic.co/u/SaigyoujiYuyuko233)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 9:26am UTC](https://discuss.elastic.co/t/solved-elastic-agent-as-fleet-server-auto-shutdown-for-no-reason-in-k8s/277724 "2021-07-04T09:26:05Z")
Contextualization I'm trying to run a fleet server using elastic agent in k8s Using docker img: docker.elastic.co/beats/elastic-agent:7.13.2 Elasticsearch Ver: 7.13.2 Kibana Ver: 7.13.2 What happened When the fleet s… --- ## [Beats processors: else if?](https://discuss.elastic.co/t/beats-processors-else-if/197608)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [September 7, 2019, 12:39am UTC](https://discuss.elastic.co/t/beats-processors-else-if/197608 "2019-09-07T00:39:39Z")
In https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html we can see that processors have "if then else", but no word if it supports the "if then else if then else" I need to do multiple checks … --- ## [Filebeat decode\_json\_fields Can not index event](https://discuss.elastic.co/t/filebeat-decode-json-fields-can-not-index-event/85074)
**Author:** [@Jeff](https://discuss.elastic.co/u/Jeff)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 9:56am UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-can-not-index-event/85074 "2017-05-26T09:56:48Z")
I have a log event where the field "log" has the value (JSON): {“caller”:“server.go:53",“msg”:“server starting”,“port”:8080} In our filebeat configuration, we have the config: processors: - decode\_json\_fields: f… --- ## [Logstash conf with stdin input not pushing data into elasticsearch](https://discuss.elastic.co/t/logstash-conf-with-stdin-input-not-pushing-data-into-elasticsearch/123485)
**Author:** [@Mohan\_M](https://discuss.elastic.co/u/Mohan_M)\ **Replies:** 6\ **Last updated:** [March 12, 2018, 8:07am UTC](https://discuss.elastic.co/t/logstash-conf-with-stdin-input-not-pushing-data-into-elasticsearch/123485 "2018-03-12T08:07:23Z")
Hello all, I am new to elastic stack I have configured a elastic stack with xpack. when it tried to run a simple logstash conf with stdin input and elasticsearch output. it is not getting inserted into elasticsearch but… --- ## [Does First Input First Output in logstash](https://discuss.elastic.co/t/does-first-input-first-output-in-logstash/107850)
**Author:** [@lsyoung](https://discuss.elastic.co/u/lsyoung)\ **Replies:** 6\ **Last updated:** [November 17, 2017, 3:23am UTC](https://discuss.elastic.co/t/does-first-input-first-output-in-logstash/107850 "2017-11-17T03:23:56Z")
Can logstash ensure the message first read by input-plugin can be output firstly with output-plugin? AND If if the output-plugin is elasticsearch, does the the docs write into elasticsearch by the same sequence with … --- ## [Microsoft sqlserver and logstash](https://discuss.elastic.co/t/microsoft-sqlserver-and-logstash/199864)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [September 17, 2019, 5:58pm UTC](https://discuss.elastic.co/t/microsoft-sqlserver-and-logstash/199864 "2019-09-17T17:58:15Z")
I have try following config and it works with java 8 and sqljdbc4.2 jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_driver\_library =\> "/root/sqljdbc\_4.2/enu/jre8/sqljdbc42.jar" what I want to… --- ## [Splunk query to Kibana](https://discuss.elastic.co/t/splunk-query-to-kibana/187118)
**Author:** [@m.sereda](https://discuss.elastic.co/u/m.sereda)\ **Replies:** 1\ **Last updated:** [June 24, 2019, 5:45pm UTC](https://discuss.elastic.co/t/splunk-query-to-kibana/187118 "2019-06-24T17:45:43Z")
How to convert this to kibana query language? index=visiona "field id=\\"0\\" value=\\"0110\\"" | rex max\_match=0 "field id=\\"39\\" value=\\"(?\(\[0-9A-Z\]+))\\"" | where code = "00" OR code="N0" OR code="91" | timechart co… --- ## [Vizualize values in array](https://discuss.elastic.co/t/vizualize-values-in-array/46544)
**Author:** [@geoffroya](https://discuss.elastic.co/u/geoffroya)\ **Replies:** 4\ **Last updated:** [April 7, 2016, 6:55am UTC](https://discuss.elastic.co/t/vizualize-values-in-array/46544 "2016-04-07T06:55:56Z")
Hello I have data coming from Burrow (metrics from kafka), that I poll using logstash http\_poller. It gives me nice JSON that I store directly in ES (default mapping for the moment). For my test, I have a single kafk… --- ## [Filebeat send json format log, kibana can't recognize filed](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658)
**Author:** [@lijin\_liu](https://discuss.elastic.co/u/lijin_liu)\ **Replies:** 2\ **Last updated:** [March 12, 2019, 11:21am UTC](https://discuss.elastic.co/t/filebeat-send-json-format-log-kibana-cant-recognize-filed/171658 "2019-03-12T11:21:27Z")
Hello, I'm new to filebeat/elk. My problem is the Kibana can't recognize the field in my log. The log content looks(via less log.log): ... {"@timestamp":"2019-03-11T03:01:53.205+00:00","@version":"1","message":"spread… --- ## [Using term position to re-score](https://discuss.elastic.co/t/using-term-position-to-re-score/105415)
**Author:** [@angelcab](https://discuss.elastic.co/u/angelcab)\ **Replies:** 0\ **Last updated:** [October 26, 2017, 11:17am UTC](https://discuss.elastic.co/t/using-term-position-to-re-score/105415 "2017-10-26T11:17:50Z")
Hi I'm trying to create a script to modify the score of my queries. I want to access the position of a word in the results I am obtaining. For example the word: "global" in the string name= "Global corporation". So I … --- ## [How to plot a graph using data from two filters?](https://discuss.elastic.co/t/how-to-plot-a-graph-using-data-from-two-filters/254186)
**Author:** [@I\_Hathout](https://discuss.elastic.co/u/I_Hathout)\ **Replies:** 3\ **Last updated:** [November 5, 2020, 5:26am UTC](https://discuss.elastic.co/t/how-to-plot-a-graph-using-data-from-two-filters/254186 "2020-11-05T05:26:25Z")
I've two filters each of which gets data from a database query. I wanna have a single visualization vertical bar which has data histograms monthly on X axis and for the Y-axis, I need to (count transfer failures from… --- ## [Drop/cancel events with a timestamp older than a given amount of seconds](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608)
**Author:** [@jcaballero](https://discuss.elastic.co/u/jcaballero)\ **Replies:** 3\ **Last updated:** [March 30, 2019, 7:40pm UTC](https://discuss.elastic.co/t/drop-cancel-events-with-a-timestamp-older-than-a-given-amount-of-seconds/174608 "2019-03-30T19:40:55Z")
LogStash 6.6 My log files have lines like this 01/07/19 18:31:33.452 blah blah blah where the time is local. I need to discard all lines older than a given amount of time. Let's say, for example, 24 hours. I have a … --- ## [How to create a line (threshold/benchmark) to a vertical bar graph](https://discuss.elastic.co/t/how-to-create-a-line-threshold-benchmark-to-a-vertical-bar-graph/152568)
**Author:** [@peter\_brv](https://discuss.elastic.co/u/peter_brv)\ **Replies:** 3\ **Last updated:** [October 17, 2018, 10:45pm UTC](https://discuss.elastic.co/t/how-to-create-a-line-threshold-benchmark-to-a-vertical-bar-graph/152568 "2018-10-17T22:45:29Z")
Hello, I am stuck on my project. I need to find a way to create a simple horisontal line (threshold/benchmark) on my vertical bar chart. I can't seem to find a solution. Please help --- ## [How to index my eCommerce website](https://discuss.elastic.co/t/how-to-index-my-ecommerce-website/107948)
**Author:** [@saurabhbhatt](https://discuss.elastic.co/u/saurabhbhatt)\ **Replies:** 3\ **Last updated:** [November 20, 2017, 11:25am UTC](https://discuss.elastic.co/t/how-to-index-my-ecommerce-website/107948 "2017-11-20T11:25:33Z")
My Requirement: I am using .NET C# for coding preference using Visual Studio 2017 and working to integrate Elasticsearch with my eCommerce website so that my website users can easily search my website. My Current Unders… --- ## [Keys\_under\_root option in configuration](https://discuss.elastic.co/t/keys-under-root-option-in-configuration/79602)
**Author:** [@krhubert](https://discuss.elastic.co/u/krhubert)\ **Replies:** 3\ **Last updated:** [March 23, 2017, 12:07pm UTC](https://discuss.elastic.co/t/keys-under-root-option-in-configuration/79602 "2017-03-23T12:07:42Z")
Hi, Just wonder how to put keys\_under\_root like filebeat do in my own beat? Is this supported or documented somewhere? --- ## [File open mode](https://discuss.elastic.co/t/file-open-mode/54840)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 7:05pm UTC](https://discuss.elastic.co/t/file-open-mode/54840 "2016-07-11T19:05:43Z")
Hello, While troubleshooting an issue on our Windows servers, we saw that Filebeat is opening files in read/write mode. Should it be read only mode? There's no reason to be other than readonly. O:\\Outils\\Sysinterna… --- ## [How can I add a count of entries which has an attribute greater than certain values in Kibana?](https://discuss.elastic.co/t/how-can-i-add-a-count-of-entries-which-has-an-attribute-greater-than-certain-values-in-kibana/118559)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [February 7, 2018, 5:28pm UTC](https://discuss.elastic.co/t/how-can-i-add-a-count-of-entries-which-has-an-attribute-greater-than-certain-values-in-kibana/118559 "2018-02-07T17:28:48Z")
Hi, I am using ELK GA 5.0.0. I have an index which contain Name, Gender and Age of people. I would like to create a visualization like below; \[age\] I was able to create first 3 columns. I would like to know if it is p… [Previous page](https://discuss.elastic.co/top.md?page=774&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=776&per_page=50&period=all)