# Top

**URL:** https://discuss.elastic.co/top.md?page=785&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 786

---

## [ELK LATEST - illegal\_argument\_exception during loading template manually](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724)

<div class="topic-metadata">

**Author:** [@Krishna\_Sharma](https://discuss.elastic.co/u/Krishna_Sharma)\
**Replies:** 3\
**Last updated:** [January 24, 2018, 9:46am UTC](https://discuss.elastic.co/t/elk-latest-illegal-argument-exception-during-loading-template-manually/116724 "2018-01-24T09:46:53Z")

</div>

Hi Team, I am getting error while configuring filebeat: {"error":{"root\_cause":\[{"type":"remote\_transport\_exception","reason":"\[servername\]\[ESIP:9300\]\[indices:admin/template/put\]"}\],"type":"illegal\_argument\_exception",…

---

## [Elasticsearch 6.0: how to install license plugin](https://discuss.elastic.co/t/elasticsearch-6-0-how-to-install-license-plugin/109455)

<div class="topic-metadata">

**Author:** [@bradley](https://discuss.elastic.co/u/bradley)\
**Replies:** 3\
**Last updated:** [November 28, 2017, 10:04pm UTC](https://discuss.elastic.co/t/elasticsearch-6-0-how-to-install-license-plugin/109455 "2017-11-28T22:04:21Z")

</div>

See my question here: https://stackoverflow.com/questions/47539110/elasticsearch-6-0-how-to-install-license-plugin I can't seem to install the license plugin from the guide. It is not clear from the documentation what E…

---

## [Custom template in config/templates](https://discuss.elastic.co/t/custom-template-in-config-templates/51168)

<div class="topic-metadata">

**Author:** [@mgohin](https://discuss.elastic.co/u/mgohin)\
**Replies:** 3\
**Last updated:** [May 31, 2016, 8:52am UTC](https://discuss.elastic.co/t/custom-template-in-config-templates/51168 "2016-05-31T08:52:01Z")

</div>

Hi, Is it still possible in 2.3.3 to use config/templates folder to store custom templates ? I saw in 1.6 doc that it was possible : https://www.elastic.co/guide/en/elasticsearch/reference/1.6/indices-templates.html F…

---

## [Kibana 4.4 memory leak and getting wack by OOM](https://discuss.elastic.co/t/kibana-4-4-memory-leak-and-getting-wack-by-oom/41205)

<div class="topic-metadata">

**Author:** [@mnhan](https://discuss.elastic.co/u/mnhan)\
**Replies:** 3\
**Last updated:** [February 8, 2016, 8:09pm UTC](https://discuss.elastic.co/t/kibana-4-4-memory-leak-and-getting-wack-by-oom/41205 "2016-02-08T20:09:52Z")

</div>

Restarted Kibana 4.4, with ES 2.2 fresh on RHEL6 vmware installation with 4gigs of ram. No browser accessing kibana. Nothing is talking to kibana. node\_options is set to --max-old-space-size=512, but kibana does n…

---

## [How to retrieve JSON object from log in logstash confuguration?](https://discuss.elastic.co/t/how-to-retrieve-json-object-from-log-in-logstash-confuguration/153375)

<div class="topic-metadata">

**Author:** [@Vyankatesh\_S\_Repal](https://discuss.elastic.co/u/Vyankatesh_S_Repal)\
**Replies:** 4\
**Last updated:** [October 23, 2018, 11:50am UTC](https://discuss.elastic.co/t/how-to-retrieve-json-object-from-log-in-logstash-confuguration/153375 "2018-10-23T11:50:59Z")

</div>

I am creating an application where I need to retrieve key value pairs from json object in logs with the help of logstash configuraition. Here is my configuration: input{ file{ path =\> "D:\\ELK\_Info\\TestLogs\_Upd…

---

## [Filebeat 1rc1 Windows does not work with Logstash 2](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817)

<div class="topic-metadata">

**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\
**Replies:** 4\
**Last updated:** [December 8, 2015, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-1rc1-windows-does-not-work-with-logstash-2/34817 "2015-12-08T12:40:53Z")

</div>

When I configure filebeat on Windows, my Logstash gives the following error: {:timestamp=\>"2015-11-17T14:50:30.766000+0000", :message=\>"Beats input: unhandled exception", :exception=\>#\<RuntimeError: unsupported protoco…

---

## [Unable to add new field with values of nested fields](https://discuss.elastic.co/t/unable-to-add-new-field-with-values-of-nested-fields/233403)

<div class="topic-metadata">

**Author:** [@Feedy](https://discuss.elastic.co/u/Feedy)\
**Replies:** 7\
**Last updated:** [May 20, 2020, 3:59pm UTC](https://discuss.elastic.co/t/unable-to-add-new-field-with-values-of-nested-fields/233403 "2020-05-20T15:59:00Z")

</div>

I am attempting to create a geo-point data type so that I can utilize the map features in kibana. My index will not show as an option when I attempt to add a layer and I believe its because I do not have a geo-point data…

---

## [Edge NGrams with Aggregations on Indexed chess games](https://discuss.elastic.co/t/edge-ngrams-with-aggregations-on-indexed-chess-games/38824)

<div class="topic-metadata">

**Author:** [@Jack\_Shannon](https://discuss.elastic.co/u/Jack_Shannon)\
**Replies:** 7\
**Last updated:** [January 11, 2016, 6:42pm UTC](https://discuss.elastic.co/t/edge-ngrams-with-aggregations-on-indexed-chess-games/38824 "2016-01-11T18:42:10Z")

</div>

Hi, I am indexing chess games to create a game explorer. I have a database of millions of games and I will need to index them. The aim is to be able to query a some opening moves (e.g. "e4 e5 Nf3 Nc6"), and get a res…

---

## [New to ES – count words when indexing documents](https://discuss.elastic.co/t/new-to-es-count-words-when-indexing-documents/14087)

<div class="topic-metadata">

**Author:** [@Isabella](https://discuss.elastic.co/u/Isabella)\
**Replies:** 7\
**Last updated:** [November 4, 2013, 8:47am UTC](https://discuss.elastic.co/t/new-to-es-count-words-when-indexing-documents/14087 "2013-11-04T08:47:29Z")

</div>

Hi. I am new to ES and I have to write a simple plugin, which should count all words in all documents, that are indexed. This word count should then added in a new field to the document. The jdbc-river-plugin …

---

## [Настройка Filebeat](https://discuss.elastic.co/t/filebeat/249510)

<div class="topic-metadata">

**Author:** [@freezzze](https://discuss.elastic.co/u/freezzze)\
**Replies:** 5\
**Last updated:** [September 24, 2020, 2:40pm UTC](https://discuss.elastic.co/t/filebeat/249510 "2020-09-24T14:40:05Z")

</div>

Есть некие девайсы входящие в систему умного дома. На них стоит кастомный Linux. На каждом девайсе есть smb шара /var/log/. От руководства прилетела задача используя только smb шары пересылать логи в elastic. Пробовал р…

---

## [How to configure Kafka Connect Group Id in Beats Kafka Output](https://discuss.elastic.co/t/how-to-configure-kafka-connect-group-id-in-beats-kafka-output/67334)

<div class="topic-metadata">

**Author:** [@patrick.vonsteht](https://discuss.elastic.co/u/patrick.vonsteht)\
**Replies:** 5\
**Last updated:** [November 30, 2016, 12:49pm UTC](https://discuss.elastic.co/t/how-to-configure-kafka-connect-group-id-in-beats-kafka-output/67334 "2016-11-30T12:49:13Z")

</div>

The Beats Kafka Output plugin seems to be based on Kafka Connect and seems to use the standard group.id Kafka Connect setting (group.id=connect-cluster). I have looked into the documentation if there was an option to cha…

---

## [Using a @timestamp field in elasticsearch-dsl-py](https://discuss.elastic.co/t/using-a-timestamp-field-in-elasticsearch-dsl-py/20364)

<div class="topic-metadata">

**Author:** [@Antonio\_Augusto\_Sant](https://discuss.elastic.co/u/Antonio_Augusto_Sant)\
**Replies:** 2\
**Last updated:** [October 21, 2014, 4:46pm UTC](https://discuss.elastic.co/t/using-a-timestamp-field-in-elasticsearch-dsl-py/20364 "2014-10-21T16:46:28Z")

</div>

Hi, I'm trying to start using ES-DSL-PY to do some quick tests on my environment and I've faced one problem. Whats the correct way to use it in a range filter? I plain json the Syntax would be something like: …

---

## [Getting CLA not signed error on my PR, when I have signed it](https://discuss.elastic.co/t/getting-cla-not-signed-error-on-my-pr-when-i-have-signed-it/256973)

<div class="topic-metadata">

**Author:** [@baba\_yaga](https://discuss.elastic.co/u/baba_yaga)\
**Replies:** 6\
**Last updated:** [February 28, 2021, 2:26am UTC](https://discuss.elastic.co/t/getting-cla-not-signed-error-on-my-pr-when-i-have-signed-it/256973 "2021-02-28T02:26:56Z")

</div>

Hi, I submitted a pull request for adding a feature requested in the issue.I have signed the CLA for Elastic already but the bot still hasn't detected that and it prevents me from requesting a review and get my pull req…

---

## [Load balancer for multi logstash](https://discuss.elastic.co/t/load-balancer-for-multi-logstash/277071)

<div class="topic-metadata">

**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\
**Replies:** 2\
**Last updated:** [June 27, 2021, 8:16pm UTC](https://discuss.elastic.co/t/load-balancer-for-multi-logstash/277071 "2021-06-27T20:16:17Z")

</div>

Hi, We have 2 Logstash servers. I want to put them behind a load balancer and push the data to the logstash over the HTTPS. But now, I am using the HTTP input plugin without a load balancer. Let me show you my HTTPS co…

---

## [Send Logstash JSON to python](https://discuss.elastic.co/t/send-logstash-json-to-python/147758)

<div class="topic-metadata">

**Author:** [@neslog](https://discuss.elastic.co/u/neslog)\
**Replies:** 2\
**Last updated:** [September 8, 2018, 10:30pm UTC](https://discuss.elastic.co/t/send-logstash-json-to-python/147758 "2018-09-08T22:30:12Z")

</div>

I'm trying to take the JSON output form Logstash and read it in with Python. Specifically I have the following configuration. WinLogBeat --\> JSON --\> Logstash Beats receiver --\> output to file That all works well. Wh…

---

## [Watcher 500 Server Error](https://discuss.elastic.co/t/watcher-500-server-error/111371)

<div class="topic-metadata">

**Author:** [@cadab](https://discuss.elastic.co/u/cadab)\
**Replies:** 3\
**Last updated:** [January 4, 2018, 9:10pm UTC](https://discuss.elastic.co/t/watcher-500-server-error/111371 "2018-01-04T21:10:48Z")

</div>

I've upgraded es and Kibana from 5.6.4 to 6.0.1, when attempting to view the 'watcher' from within Kibana\>Management I get a 'Watcher: Error 500 Internal Server Error: An internal server error occurred' error. Kibana lo…

---

## [Reduce duplicate or similar log entries](https://discuss.elastic.co/t/reduce-duplicate-or-similar-log-entries/29029)

<div class="topic-metadata">

**Author:** [@pdcleyn](https://discuss.elastic.co/u/pdcleyn)\
**Replies:** 3\
**Last updated:** [August 24, 2016, 8:56pm UTC](https://discuss.elastic.co/t/reduce-duplicate-or-similar-log-entries/29029 "2016-08-24T20:56:47Z")

</div>

I would like to setup a logstash configuation which acts similar to the rsyslog repeated message reduction. Basically, based on parsing I would like to ship to elasticsearch only one message stating that in the previous …

---

## [Shut down, change IP and rejoin the cluster?](https://discuss.elastic.co/t/shut-down-change-ip-and-rejoin-the-cluster/46330)

<div class="topic-metadata">

**Author:** [@boreal](https://discuss.elastic.co/u/boreal)\
**Replies:** 3\
**Last updated:** [April 7, 2016, 5:37am UTC](https://discuss.elastic.co/t/shut-down-change-ip-and-rejoin-the-cluster/46330 "2016-04-07T05:37:18Z")

</div>

I need to change IP of one of the nodes in a cluster from public to private. On that node, will I be able to shut down elasticsearch service, change IP in the elasticsearch.yml, and restart elasticsearch service and join…

---

## [Logstash start error](https://discuss.elastic.co/t/logstash-start-error/122485)

<div class="topic-metadata">

**Author:** [@abc965432](https://discuss.elastic.co/u/abc965432)\
**Replies:** 1\
**Last updated:** [March 5, 2018, 11:41am UTC](https://discuss.elastic.co/t/logstash-start-error/122485 "2018-03-05T11:41:46Z")

</div>

\[es@localhost logstash-6.2.2\]$ ./bin/logstash -e 'input { stdin { } } output { elasticsearch { host =\> localhost } }' Sending Logstash's logs to /home/soft/logstash/logstash-6.2.2/logs which is now configured via log4j2…

---

## [Dependency Error while using Java High Level Rest Client](https://discuss.elastic.co/t/dependency-error-while-using-java-high-level-rest-client/131088)

<div class="topic-metadata">

**Author:** [@Littlestay](https://discuss.elastic.co/u/Littlestay)\
**Replies:** 2\
**Last updated:** [May 9, 2018, 3:46am UTC](https://discuss.elastic.co/t/dependency-error-while-using-java-high-level-rest-client/131088 "2018-05-09T03:46:40Z")

</div>

Hi, I am trying to develop a spring boot based elasticsearch project and I am trying to use Java High Level Rest Client in the same. I am initializing the client like this: Caused by: java.lang.BootstrapMethodError: …

---

## [Logstash insufficient memory for java runtime env](https://discuss.elastic.co/t/logstash-insufficient-memory-for-java-runtime-env/276705)

<div class="topic-metadata">

**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\
**Replies:** 5\
**Last updated:** [July 7, 2021, 9:23pm UTC](https://discuss.elastic.co/t/logstash-insufficient-memory-for-java-runtime-env/276705 "2021-07-07T21:23:10Z")

</div>

Hi ELK Users, I am wondering if anyone has come across this issue when running logstash PS C:\\Program Files\\ELK\\logstash-7.13.1\\bin\> .\\logstash.bat -f C:\\Program Files\\ELK\\logstash-7.13.1\\config\\logstash-test-std.conf …

---

## [Reading mysql database: You have an error in your SQL syntax;](https://discuss.elastic.co/t/reading-mysql-database-you-have-an-error-in-your-sql-syntax/129107)

<div class="topic-metadata">

**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\
**Replies:** 5\
**Last updated:** [April 23, 2018, 2:19pm UTC](https://discuss.elastic.co/t/reading-mysql-database-you-have-an-error-in-your-sql-syntax/129107 "2018-04-23T14:19:50Z")

</div>

I have a mysql fake database which I would like to read as input to logstash & then send the data to elasticsearch. The database IP, the password, the port, the database and the table are correct As well as the query: …

---

## [UnavailableShardsException When Creating Index With Settings](https://discuss.elastic.co/t/unavailableshardsexception-when-creating-index-with-settings/4291)

<div class="topic-metadata">

**Author:** [@timscott](https://discuss.elastic.co/u/timscott)\
**Replies:** 5\
**Last updated:** [May 2, 2011, 12:20pm UTC](https://discuss.elastic.co/t/unavailableshardsexception-when-creating-index-with-settings/4291 "2011-05-02T12:20:11Z")

</div>

In 0.16 when you create an index with settings, you can't PUT to it. You get UnavailableShardsException. https://gist.github.com/941463

---

## [Disable "Add data" tab in kibana](https://discuss.elastic.co/t/disable-add-data-tab-in-kibana/259914)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 1\
**Last updated:** [December 30, 2020, 8:52pm UTC](https://discuss.elastic.co/t/disable-add-data-tab-in-kibana/259914 "2020-12-30T20:52:56Z")

</div>

I have user and associated roles with it. these users are only allowed to read some index and create visulization and dashboard. but on main screen it has "Add Data" which then shows what kind of logs and metric you ca…

---

## [Es-stack 8.1.0 - \[security\_exception\] action \[indices:data/read/search\]](https://discuss.elastic.co/t/es-stack-8-1-0-security-exception-action-indices-data-read-search/300097)

<div class="topic-metadata">

**Author:** [@skahdi12](https://discuss.elastic.co/u/skahdi12)\
**Replies:** 1\
**Last updated:** [March 26, 2022, 8:54pm UTC](https://discuss.elastic.co/t/es-stack-8-1-0-security-exception-action-indices-data-read-search/300097 "2022-03-26T20:54:24Z")

</div>

Hello, I'm using Elasticsearch 8.1.0. I configured a es cluster and logged in to kibana as a superuser elastic. However, there is an error that never been seen in the previous version. kibana error message : Respo…

---

## [Updating Elasticsearch Document](https://discuss.elastic.co/t/updating-elasticsearch-document/265705)

<div class="topic-metadata">

**Author:** [@vstevenson](https://discuss.elastic.co/u/vstevenson)\
**Replies:** 1\
**Last updated:** [February 27, 2021, 10:46pm UTC](https://discuss.elastic.co/t/updating-elasticsearch-document/265705 "2021-02-27T22:46:43Z")

</div>

I am running into trouble when I try to update a field within my document. Here's my JSON call: POST vs-users/\_update/bwMNiyZZMg4jZVMdueaZ6m { "name": "abc" } I get this error: { "error" :…

---

## [Kibana User with diferent GMT time](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917)

<div class="topic-metadata">

**Author:** [@Samuel\_Amico](https://discuss.elastic.co/u/Samuel_Amico)\
**Replies:** 7\
**Last updated:** [December 1, 2020, 11:39pm UTC](https://discuss.elastic.co/t/kibana-user-with-diferent-gmt-time/256917 "2020-12-01T23:39:43Z")

</div>

Ok guys this is very IMPORTANT !!! I have my admin Space with my elastic superuser and I put this setting: Advance Settings -\> Timezone for date formatting = America/Belem I the other Space (Supervisor space) that has…

---

## [How to search using only month and year (or only date) in date field?](https://discuss.elastic.co/t/how-to-search-using-only-month-and-year-or-only-date-in-date-field/218332)

<div class="topic-metadata">

**Author:** [@franzisk](https://discuss.elastic.co/u/franzisk)\
**Replies:** 1\
**Last updated:** [February 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-search-using-only-month-and-year-or-only-date-in-date-field/218332 "2020-02-07T14:51:41Z")

</div>

Hi, I am using Spring Boot Elasticsearch and I have something like this: Optional\<List\<Evento\>\> findByClienteIdAndDataEqualsAndLogLike(Integer id, String eventDate, String log, Pageable pageable); This eventDate has t…

---

## [How to use Geo-Server with Kibana](https://discuss.elastic.co/t/how-to-use-geo-server-with-kibana/114971)

<div class="topic-metadata">

**Author:** [@rpendela](https://discuss.elastic.co/u/rpendela)\
**Replies:** 1\
**Last updated:** [January 11, 2018, 1:02am UTC](https://discuss.elastic.co/t/how-to-use-geo-server-with-kibana/114971 "2018-01-11T01:02:48Z")

</div>

Hello community, I am following the article (https://www.elastic.co/blog/custom-region-maps-in-kibana-6-0), I would like to add the US\_counties in vector map with join field as county-name in kibana with the help of geo…

---

## [Upgraded to 90.6 : RemoteTransportException: Failed to deserialize response of type \[org.elasticsearch.search.query.QuerySearchResult\]](https://discuss.elastic.co/t/upgraded-to-90-6-remotetransportexception-failed-to-deserialize-response-of-type-org-elasticsearch-search-query-querysearchresult/14410)

<div class="topic-metadata">

**Author:** [@Mark\_Conlin](https://discuss.elastic.co/u/Mark_Conlin)\
**Replies:** 7\
**Last updated:** [November 29, 2014, 12:58pm UTC](https://discuss.elastic.co/t/upgraded-to-90-6-remotetransportexception-failed-to-deserialize-response-of-type-org-elasticsearch-search-query-querysearchresult/14410 "2014-11-29T12:58:38Z")

</div>

I have a mini cluster of two nodes running 90.6 Both contain data, one is the master. I have written two custom faceting plugins against 90.6. - the first worked against 90.3 and I have upgraded it - the second …

---

## [Max\_score anyone?](https://discuss.elastic.co/t/max-score-anyone/16313)

<div class="topic-metadata">

**Author:** [@george\_monroe](https://discuss.elastic.co/u/george_monroe)\
**Replies:** 1\
**Last updated:** [March 12, 2014, 11:40am UTC](https://discuss.elastic.co/t/max-score-anyone/16313 "2014-03-12T11:40:09Z")

</div>

Hi guys, I've been beating my head against this one for a while. Any help is really appreciated. I have a Parent / Child relationship that is 1 to Many - each parent has lots of children. My use case is to only …

---

## [Superuser doesn't have access to read a document?](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128)

<div class="topic-metadata">

**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\
**Replies:** 3\
**Last updated:** [August 2, 2021, 1:43pm UTC](https://discuss.elastic.co/t/superuser-doesnt-have-access-to-read-a-document/280128 "2021-08-02T13:43:26Z")

</div>

This is my user's privileges { "cluster" : \[ "all" \], "global" : \[ \], "indices" : \[ { "names" : \[ "\*" \], "privileges" : \[ "all" \], "allow\_restricted\_indices"…

---

## [Strange visualisation behaviour with floating point numbers](https://discuss.elastic.co/t/strange-visualisation-behaviour-with-floating-point-numbers/147449)

<div class="topic-metadata">

**Author:** [@smilin\_stan](https://discuss.elastic.co/u/smilin_stan)\
**Replies:** 8\
**Last updated:** [September 6, 2018, 4:58pm UTC](https://discuss.elastic.co/t/strange-visualisation-behaviour-with-floating-point-numbers/147449 "2018-09-06T16:58:35Z")

</div>

I am using the jolokia module in metricbeats which is capturing (amongst other things) the following system stats: I am trying to graph the maximum CPU idle percentage (the system.cpu.idle.pct field), which is a float…

---

## [Manual run elasticsearch 5.4](https://discuss.elastic.co/t/manual-run-elasticsearch-5-4/84981)

<div class="topic-metadata">

**Author:** [@rob1](https://discuss.elastic.co/u/rob1)\
**Replies:** 3\
**Last updated:** [May 9, 2017, 12:49pm UTC](https://discuss.elastic.co/t/manual-run-elasticsearch-5-4/84981 "2017-05-09T12:49:36Z")

</div>

Hi I'm trying to run elasticsearch 5,4 manually by entering (exact line created by service elasticsearch start): /usr/bin/java -Xms200m -Xmx200m -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+Use…

---

## [Logstash 2.0 Monitoring API?](https://discuss.elastic.co/t/logstash-2-0-monitoring-api/33551)

<div class="topic-metadata">

**Author:** [@natefox](https://discuss.elastic.co/u/natefox)\
**Replies:** 8\
**Last updated:** [November 2, 2015, 9:32pm UTC](https://discuss.elastic.co/t/logstash-2-0-monitoring-api/33551 "2015-11-02T21:32:53Z")

</div>

I kept seeing mentions of a monitoring API when LS 2.0 hit, but cant seem to find any mention of it in the current docs. Did it get implemented?

---

## [Need help with conditional only if field contains a period](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126)

<div class="topic-metadata">

**Author:** [@pcharles1](https://discuss.elastic.co/u/pcharles1)\
**Replies:** 2\
**Last updated:** [September 14, 2021, 1:04pm UTC](https://discuss.elastic.co/t/need-help-with-conditional-only-if-field-contains-a-period/284126 "2021-09-14T13:04:44Z")

</div>

I'm trying to grok the host name field only if it contains a period using the conditional below: if (\[host\]\[name\] =~ ".") { grok host.name field } For some reason, when the host name field doesn't contain a period, I g…

---

## [Has Child Query on Nested Object field](https://discuss.elastic.co/t/has-child-query-on-nested-object-field/24736)

<div class="topic-metadata">

**Author:** [@bevans88](https://discuss.elastic.co/u/bevans88)\
**Replies:** 2\
**Last updated:** [July 1, 2015, 3:25pm UTC](https://discuss.elastic.co/t/has-child-query-on-nested-object-field/24736 "2015-07-01T15:25:01Z")

</div>

Hoping someone can help here and tell me if the query I'm attempting to run is possible/supported by Elasticsearch (I've read through the docs and forums and been unable to find any answer). I have a child document (C…

---

## [Screenshots in Kibana](https://discuss.elastic.co/t/screenshots-in-kibana/214961)

<div class="topic-metadata">

**Author:** [@Nickita1608](https://discuss.elastic.co/u/Nickita1608)\
**Replies:** 3\
**Last updated:** [January 15, 2020, 11:02am UTC](https://discuss.elastic.co/t/screenshots-in-kibana/214961 "2020-01-15T11:02:18Z")

</div>

Hello! Previously, I took screenshots using pageres in Kibana v6. \* (I also tried other utilities). After updating to v7.2-7.5, the screenshot returns a white screen. It is as if something is limiting and does not allow …

---

## [Elasticsearch snapshot on more than one shared filesystem](https://discuss.elastic.co/t/elasticsearch-snapshot-on-more-than-one-shared-filesystem/107184)

<div class="topic-metadata">

**Author:** [@Arvind\_Rao](https://discuss.elastic.co/u/Arvind_Rao)\
**Replies:** 3\
**Last updated:** [November 13, 2017, 4:07pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-on-more-than-one-shared-filesystem/107184 "2017-11-13T16:07:44Z")

</div>

We have a multi-node ES 5.2.2 cluster running on Centos 6.x. We want to register a shared filesystem repository to take a snapshot. However due to some infra constraints, we are unable to provide a single volume of the…

---

## [How to debug elastic search in an IDE](https://discuss.elastic.co/t/how-to-debug-elastic-search-in-an-ide/53159)

<div class="topic-metadata">

**Author:** [@adityasinghraghav](https://discuss.elastic.co/u/adityasinghraghav)\
**Replies:** 5\
**Last updated:** [March 8, 2019, 2:50pm UTC](https://discuss.elastic.co/t/how-to-debug-elastic-search-in-an-ide/53159 "2019-03-08T14:50:41Z")

</div>

I'm trying to learn the internal workings of ES. How can I get ES running on the IDEA ide ?

---

## [Import to SQL server](https://discuss.elastic.co/t/import-to-sql-server/162123)

<div class="topic-metadata">

**Author:** [@saeed](https://discuss.elastic.co/u/saeed)\
**Replies:** 5\
**Last updated:** [December 30, 2018, 10:24am UTC](https://discuss.elastic.co/t/import-to-sql-server/162123 "2018-12-30T10:24:46Z")

</div>

Is it possible to import data from file into sql server and use logstash?

---

## [Nginx Module](https://discuss.elastic.co/t/nginx-module/145547)

<div class="topic-metadata">

**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Replies:** 5\
**Last updated:** [August 27, 2018, 8:08am UTC](https://discuss.elastic.co/t/nginx-module/145547 "2018-08-27T08:08:18Z")

</div>

Hello All, I have configured metricbeat and enabled the system and Nginx module. The system module is working fine and able to see the metrics on metricbeat dashboard. But no data is available for Nginx. Config file of…

---

## [Elasticsearch sink - Send data to Logstash](https://discuss.elastic.co/t/elasticsearch-sink-send-data-to-logstash/48625)

<div class="topic-metadata">

**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Replies:** 5\
**Last updated:** [May 3, 2016, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-sink-send-data-to-logstash/48625 "2016-05-03T07:35:23Z")

</div>

I am using ElasticSearch sink to capture all the event logs. Currently, it is capturing the data and It is sending it to ES directly. But I want the sink to send the data to logstash for processing. I need to rename, …

---

## [Error : There are no external requests known to support wildcards that don't support replacing their indices](https://discuss.elastic.co/t/error-there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/208881)

<div class="topic-metadata">

**Author:** [@shahab](https://discuss.elastic.co/u/shahab)\
**Replies:** 2\
**Last updated:** [November 22, 2019, 8:28am UTC](https://discuss.elastic.co/t/error-there-are-no-external-requests-known-to-support-wildcards-that-dont-support-replacing-their-indices/208881 "2019-11-22T08:28:34Z")

</div>

Hi, I was wondering if anyone could help me with my problem: I have a template and number of indices are mapped using the template. i.e. cdr\_xyz\_1234 cdr\_xyz\_5689 cdr\_xyz\_9876 I run a search query on all the indi…

---

## [X-pack security enabled fails to start elastic search](https://discuss.elastic.co/t/x-pack-security-enabled-fails-to-start-elastic-search/154705)

<div class="topic-metadata">

**Author:** [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Replies:** 2\
**Last updated:** [October 31, 2018, 12:29pm UTC](https://discuss.elastic.co/t/x-pack-security-enabled-fails-to-start-elastic-search/154705 "2018-10-31T12:29:08Z")

</div>

Enabling x-pack.security fails to connect to elastic search and closes the elastic search connection by throwing the following error \[2018-10-30T12:54:36,196\]\[INFO \]\[o.e.n.Node \] \[elk\] initialized \[2018-1…

---

## [How to use dismax query with filter](https://discuss.elastic.co/t/how-to-use-dismax-query-with-filter/84656)

<div class="topic-metadata">

**Author:** [@ManuAc](https://discuss.elastic.co/u/ManuAc)\
**Replies:** 2\
**Last updated:** [May 5, 2017, 6:43pm UTC](https://discuss.elastic.co/t/how-to-use-dismax-query-with-filter/84656 "2017-05-05T18:43:03Z")

</div>

I am having hard time to figure out how to use elsticsearch dis\_max query with filters. When I do this: { "query": { "dis\_max": { "queries": \[{ "multi\_match": {} },…

---

## [Where are Keystore and Truststore: How can Spark communicate with ECK by using SSL](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029)

<div class="topic-metadata">

**Author:** [@YaSe](https://discuss.elastic.co/u/YaSe)\
**Replies:** 4\
**Last updated:** [March 14, 2020, 12:38pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029 "2020-03-14T12:38:40Z")

</div>

Hello, I followed this link to install ECK and now I want to use Spark with ECK by using SSL. I read the following documentation. However for the following configuration I don't know where to find the keystore and trust…

---

## [Any way to use binding.pry in the logstash shell?](https://discuss.elastic.co/t/any-way-to-use-binding-pry-in-the-logstash-shell/26594)

<div class="topic-metadata">

**Author:** [@cheeseandpepper](https://discuss.elastic.co/u/cheeseandpepper)\
**Replies:** 1\
**Last updated:** [July 30, 2015, 9:18pm UTC](https://discuss.elastic.co/t/any-way-to-use-binding-pry-in-the-logstash-shell/26594 "2015-07-30T21:18:33Z")

</div>

I'm curious to know if anyone knows if it's possible to pause the execution of logstash with a pry binding so that I can better debug my conf file. This would greatly speed up development and allow me to understand more…

---

## [Multi\_match Vs match \_all](https://discuss.elastic.co/t/multi-match-vs-match--all/10548)

<div class="topic-metadata">

**Author:** [@Giorgos\_Tsiftsis](https://discuss.elastic.co/u/Giorgos_Tsiftsis)\
**Replies:** 4\
**Last updated:** [January 30, 2013, 12:08pm UTC](https://discuss.elastic.co/t/multi-match-vs-match--all/10548 "2013-01-30T12:08:51Z")

</div>

hi, If N fields (and only these) included in \_all field then a multi\_match query in N fields should be the same with a match query in \_all field (with the same options) ? In which situations the above could be fal…

---

## [Help with grok pattern for haproxy](https://discuss.elastic.co/t/help-with-grok-pattern-for-haproxy/215441)

<div class="topic-metadata">

**Author:** [@mmikulic](https://discuss.elastic.co/u/mmikulic)\
**Replies:** 3\
**Last updated:** [January 22, 2020, 12:02pm UTC](https://discuss.elastic.co/t/help-with-grok-pattern-for-haproxy/215441 "2020-01-22T12:02:55Z")

</div>

Hi,please assit with creating custom grok pattern for logstash. I've created a custom log format in haproxy conf for purpose of logging mutual ssl authentication details for client certificates. log-format %ci:%cp\\ \[%t…

[Previous page](https://discuss.elastic.co/top.md?page=784&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=786&per_page=50&period=all)
