# Top **URL:** https://discuss.elastic.co/top.md?page=788&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 789 --- ## [Logstash Beats Error \[ELK Stack 6.5.4\]](https://discuss.elastic.co/t/logstash-beats-error-elk-stack-6-5-4/164965)
**Author:** [@elkonator](https://discuss.elastic.co/u/elkonator)\ **Replies:** 4\ **Last updated:** [January 21, 2019, 2:24pm UTC](https://discuss.elastic.co/t/logstash-beats-error-elk-stack-6-5-4/164965 "2019-01-21T14:24:00Z")
Hey folks, after a long time away from the elk stack I wanted to set up another testing scenario. I followed the latest stack guide from here: https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-starte… --- ## [Log time doesnot match the @timestamp](https://discuss.elastic.co/t/log-time-doesnot-match-the-timestamp/151015)
**Author:** [@souravtyson](https://discuss.elastic.co/u/souravtyson)\ **Replies:** 4\ **Last updated:** [October 12, 2018, 2:59pm UTC](https://discuss.elastic.co/t/log-time-doesnot-match-the-timestamp/151015 "2018-10-12T14:59:38Z")
Hi team, I am trying to send the log from filebeat to elasticsearch. The log format is 0 0 37096 1198332 0 5635848 0 0 0 0 346 332 0 0 100 0 0 2018-09-28 15:52:100 POST \_ingest/pipeline/\_… --- ## [Bad Request when using scroll API](https://discuss.elastic.co/t/bad-request-when-using-scroll-api/265702)
**Author:** [@nara1](https://discuss.elastic.co/u/nara1)\ **Replies:** 6\ **Last updated:** [March 1, 2021, 10:19pm UTC](https://discuss.elastic.co/t/bad-request-when-using-scroll-api/265702 "2021-03-01T22:19:33Z")
I'm using JestClient to execute scrolling in my service (I know JestClient is outdated but for various reasons we are stuck with it for now). In my initial request, I do receive a scroll ID and my results successfully. … --- ## [Unable to send Watcher E-mail using Microsoft Exchange](https://discuss.elastic.co/t/unable-to-send-watcher-e-mail-using-microsoft-exchange/180352)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 5\ **Last updated:** [May 9, 2019, 1:19pm UTC](https://discuss.elastic.co/t/unable-to-send-watcher-e-mail-using-microsoft-exchange/180352 "2019-05-09T13:19:45Z")
Hello Guys, I'm trying out X-Pack's Watcher and I have stumbled upon an error for which I'm unable to find a resolution. Here's the elasticsearch.yml snippet set for this purpose: xpack.notification.email.account: … --- ## [Filebeat: secure/messages for centos](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496)
**Author:** [@eureka](https://discuss.elastic.co/u/eureka)\ **Replies:** 5\ **Last updated:** [March 20, 2018, 11:39pm UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496 "2018-03-20T23:39:32Z")
Hello, I'm new to the stack. I have a bunch of logs I wanted to try out, I was only able to get auditd module working (commented out below) filebeat.yml filebeat.modules: - module: system syslog: enabled: t… --- ## [COPY - PASTE from KIBANA without "ROW" and "COLUMN" information](https://discuss.elastic.co/t/copy-paste-from-kibana-without-row-and-column-information/320048)
**Author:** [@Marian\_Ovidiu\_Pistol](https://discuss.elastic.co/u/Marian_Ovidiu_Pistol)\ **Replies:** 7\ **Last updated:** [December 2, 2022, 6:02pm UTC](https://discuss.elastic.co/t/copy-paste-from-kibana-without-row-and-column-information/320048 "2022-12-02T18:02:17Z")
Hello everybody, Has anyone encountered the following "issue" let's say? I want to copy some info from Kibana, and when I paste it in my notebook for example, it copy-pastes the info with the "row and column" also. It… --- ## [Index rollover issues](https://discuss.elastic.co/t/index-rollover-issues/290669)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 7\ **Last updated:** [December 14, 2021, 2:31pm UTC](https://discuss.elastic.co/t/index-rollover-issues/290669 "2021-12-14T14:31:19Z")
Suppose I'm creating the ES index using beat system or logstash with date time interpolation. how do I configure rolling over of index if size reaches at certain GBs in a single day? I did the following but I'm doing … --- ## [🎉 Elastic Stack 7.12.0 released](https://discuss.elastic.co/t/elastic-stack-7-12-0-released/268153)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 1:30am UTC](https://discuss.elastic.co/t/elastic-stack-7-12-0-released/268153 "2021-03-24T01:30:43Z")
:tada: Elastic Stack 7.12.0 released Elastic 7.12 is available now on Elastic Cloud — the only hosted Elasticsearch offering to include all of the new features in this latest release. You can also download the Elastic… --- ## [Elasticsearch.service: main process exited, code=exited, status=1/FAILURE](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure/237215)
**Author:** [@bhargav7](https://discuss.elastic.co/u/bhargav7)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 4:54am UTC](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure/237215 "2020-06-16T04:54:31Z")
Kindly help me to relove the issuse, update ELK from 7.5.2 to 7.7.7 after updating facing below error. root@hydelkapp /\]# rpm -Uvh --force elasticsearch-7.7.1-x86\_64.rpm Preparing... #########… --- ## [Brute Force Attack - Watcher using Windows Event id's](https://discuss.elastic.co/t/brute-force-attack-watcher-using-windows-event-ids/99374)
**Author:** [@suchand](https://discuss.elastic.co/u/suchand)\ **Replies:** 3\ **Last updated:** [September 7, 2017, 11:53am UTC](https://discuss.elastic.co/t/brute-force-attack-watcher-using-windows-event-ids/99374 "2017-09-07T11:53:47Z")
Hi, Please share sample watcher to alert Brute Force Attack using windows Event id. (with throttling\_period). I need to show Source IP,Destination IP ,Computer name and User name in watcher history dashboard. --- ## [Compare two different indexes and create new ones](https://discuss.elastic.co/t/compare-two-different-indexes-and-create-new-ones/152696)
**Author:** [@JohnOllhorn](https://discuss.elastic.co/u/JohnOllhorn)\ **Replies:** 4\ **Last updated:** [October 19, 2018, 6:46am UTC](https://discuss.elastic.co/t/compare-two-different-indexes-and-create-new-ones/152696 "2018-10-19T06:46:03Z")
HI people, I'm just starting to analyze my data with Elasticsearch, so I have practically no idea -\_- I would like to try text mining based on all the data I have stored. Is the following possible, and if so where do … --- ## [Metricbeat watch](https://discuss.elastic.co/t/metricbeat-watch/90466)
**Author:** [@as\_neocase](https://discuss.elastic.co/u/as_neocase)\ **Replies:** 4\ **Last updated:** [July 6, 2017, 7:38am UTC](https://discuss.elastic.co/t/metricbeat-watch/90466 "2017-07-06T07:38:20Z")
Hello, I'm trying to implement a watch trigger to be aware when my disk used space is greater than 80 % . In order to simulate i used the following querie but everytime the result.met is always false. Did someone c… --- ## [Architecturally should filebeat handle nested json parsing or should it be moved to logstash?](https://discuss.elastic.co/t/architecturally-should-filebeat-handle-nested-json-parsing-or-should-it-be-moved-to-logstash/59385)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 11:19am UTC](https://discuss.elastic.co/t/architecturally-should-filebeat-handle-nested-json-parsing-or-should-it-be-moved-to-logstash/59385 "2016-09-01T11:19:38Z")
We're trying to parse docker json file logger produces logs in the following format : {"log":"{\\"msg\\":\\"Event started\\", \\"ts\\":\\"2016-08-30:01:02:03.000\\"}"} If you have 1000s of docker containers all writing logs i… --- ## [ElasticSearch 5 - Nodes not being discovered](https://discuss.elastic.co/t/elasticsearch-5-nodes-not-being-discovered/70708)
**Author:** [@jnavarro](https://discuss.elastic.co/u/jnavarro)\ **Replies:** 1\ **Last updated:** [January 8, 2017, 8:47am UTC](https://discuss.elastic.co/t/elasticsearch-5-nodes-not-being-discovered/70708 "2017-01-08T08:47:20Z")
I have a small baremetal cluster with 9 workers and 3 master nodes. This is the elasticsearch.yml for the master nodes: cluster.name: baremetal\_elastic node.name: "${HOSTNAME}" path.conf: "/etc/elasticsearch" path.da… --- ## [Logstash nlp error cannot create pipeline](https://discuss.elastic.co/t/logstash-nlp-error-cannot-create-pipeline/90432)
**Author:** [@Nusrath](https://discuss.elastic.co/u/Nusrath)\ **Replies:** 6\ **Last updated:** [June 24, 2017, 5:18am UTC](https://discuss.elastic.co/t/logstash-nlp-error-cannot-create-pipeline/90432 "2017-06-24T05:18:32Z")
http://blog.jaywayco.co.uk/analyze-sentiment-and-log-all-the-things/ i have used this blog ,and followed the steps to download NLP jars. my logstash.conf file is look like as follow input { stdin {} } filter { … --- ## [Grok pattern match but replace a character from result](https://discuss.elastic.co/t/grok-pattern-match-but-replace-a-character-from-result/209084)
**Author:** [@GaryD007](https://discuss.elastic.co/u/GaryD007)\ **Replies:** 2\ **Last updated:** [November 22, 2019, 4:22pm UTC](https://discuss.elastic.co/t/grok-pattern-match-but-replace-a-character-from-result/209084 "2019-11-22T16:22:27Z")
Hi all I am trying to extract the timestamp from a log file but the date and time are separated by a semicolon. Is there a way I can make my Grok pattern work but replace the semicolon with a space ? Here is a sample f… --- ## [How to kill a single pipeline and restart it in a multiple pipelined logstash](https://discuss.elastic.co/t/how-to-kill-a-single-pipeline-and-restart-it-in-a-multiple-pipelined-logstash/192031)
**Author:** [@bharatwaj](https://discuss.elastic.co/u/bharatwaj)\ **Replies:** 2\ **Last updated:** [July 25, 2019, 11:46am UTC](https://discuss.elastic.co/t/how-to-kill-a-single-pipeline-and-restart-it-in-a-multiple-pipelined-logstash/192031 "2019-07-25T11:46:03Z")
I am running a multiple pipelined logstash and wish to kill a single pipeline if it throws error and restart after fixing it. How do I do that ? --- ## [Watcher payload modification converts list to object](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 6:19pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760 "2018-04-23T18:19:44Z")
I create a watch, The watch action transform tries to replace the payload. I'm partially successful, but several items do not work as I expected The payload is replaced, but I want to create a list of name-value pai… --- ## [Help! Multiple inputs -\>filters-\>outputs?](https://discuss.elastic.co/t/help-multiple-inputs-filters-outputs/82553)
**Author:** [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Replies:** 2\ **Last updated:** [April 17, 2017, 10:43pm UTC](https://discuss.elastic.co/t/help-multiple-inputs-filters-outputs/82553 "2017-04-17T22:43:39Z")
I'm testing logstash, and my test.conf is as below: input { exec { command =\> "tail /var/log/testx.log" interval =\> 5 type =\> "testx" } exec { … --- ## [Using filters in ElasticSearch - PHP](https://discuss.elastic.co/t/using-filters-in-elasticsearch-php/1961)
**Author:** [@rgonzalez](https://discuss.elastic.co/u/rgonzalez)\ **Replies:** 2\ **Last updated:** [June 5, 2015, 6:40pm UTC](https://discuss.elastic.co/t/using-filters-in-elasticsearch-php/1961 "2015-06-05T18:40:57Z")
I have set up an ELK server. I want to create some graphs with some data from ElasticSearch. I was trying something like: $filters = array(); $query = array(); $filter = array(); $filters\['not'\]\['term… --- ## [Delete by datetime range query](https://discuss.elastic.co/t/delete-by-datetime-range-query/8040)
**Author:** [@dkoum](https://discuss.elastic.co/u/dkoum)\ **Replies:** 2\ **Last updated:** [June 12, 2012, 9:52am UTC](https://discuss.elastic.co/t/delete-by-datetime-range-query/8040 "2012-06-12T09:52:30Z")
Hi all, I am trying to delete documents based on their datetime. datetime field is defined in the mapping as: "dt":{"type":"date","format":"basic\_date\_time\_no\_millis"} when I query for documents in a sp… --- ## [Kibana suggestion api not showing all values](https://discuss.elastic.co/t/kibana-suggestion-api-not-showing-all-values/250905)
**Author:** [@Ankur\_Mahajan](https://discuss.elastic.co/u/Ankur_Mahajan)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 9:52am UTC](https://discuss.elastic.co/t/kibana-suggestion-api-not-showing-all-values/250905 "2020-10-05T09:52:43Z")
I've recently upgraded to ELK stack (Kibana) 7.9.2 from 7.8.0. I am facing a weird issue which was not in the older version. The filter doesn't populate all the values of a field in discover or dashboards. Let say a fie… --- ## [How to update query on multiple indexes](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724)
**Author:** [@pk5859](https://discuss.elastic.co/u/pk5859)\ **Replies:** 3\ **Last updated:** [January 19, 2022, 12:08pm UTC](https://discuss.elastic.co/t/how-to-update-query-on-multiple-indexes/294724 "2022-01-19T12:08:49Z")
I have 3 indexes A, B & C i want to update on all three indexes. However python client.update() syntax won't allow it. \_index="A","B","C" query = {"doc": {"cluster":"1" }} client.update(index=\_index, id=id, body=quer… --- ## [How to check/query only the first element of a nested field?](https://discuss.elastic.co/t/how-to-check-query-only-the-first-element-of-a-nested-field/231311)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-check-query-only-the-first-element-of-a-nested-field/231311 "2020-05-06T14:58:17Z")
Elasticsearch version ( bin/elasticsearch --version ): 5.6.11 Plugins installed : JVM version ( java -version ): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubuntu1~16.04.1-b1… --- ## [How to use custom GeoIP2 database in elasticsearch?](https://discuss.elastic.co/t/how-to-use-custom-geoip2-database-in-elasticsearch/196507)
**Author:** [@icamys](https://discuss.elastic.co/u/icamys)\ **Replies:** 3\ **Last updated:** [August 28, 2019, 9:47am UTC](https://discuss.elastic.co/t/how-to-use-custom-geoip2-database-in-elasticsearch/196507 "2019-08-28T09:47:35Z")
Hello! I'm using dockerized elasticsearch7.3 on my local machine and I'm trying to use my GeoIP2-City.mmdb to add geoip info. I've read the length and breadth of the official geoip processor description and I still can… --- ## [Save time range in link](https://discuss.elastic.co/t/save-time-range-in-link/73177)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [February 13, 2017, 10:52am UTC](https://discuss.elastic.co/t/save-time-range-in-link/73177 "2017-02-13T10:52:55Z")
I made a link in data table with parameter from one dashboard to another through scripted fields -\> translate string to url. But the time change according my time in link. If I don't set it at all it used some default… --- ## [Getting the last value from an ElasticSearch index](https://discuss.elastic.co/t/getting-the-last-value-from-an-elasticsearch-index/359800)
**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\ **Replies:** 7\ **Last updated:** [May 24, 2024, 1:05pm UTC](https://discuss.elastic.co/t/getting-the-last-value-from-an-elasticsearch-index/359800 "2024-05-24T13:05:05Z")
Hello, I'm trying to get the latest value from my Elasticsearch index but when I execute this, it prints everything in the index on the console. I have also tried doing it using the "DateTime" field but every time I get … --- ## [AnomalyDetection: Last bucket is not processed (bug?)](https://discuss.elastic.co/t/anomalydetection-last-bucket-is-not-processed-bug/268715)
**Author:** [@eudaco](https://discuss.elastic.co/u/eudaco)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 1:48pm UTC](https://discuss.elastic.co/t/anomalydetection-last-bucket-is-not-processed-bug/268715 "2021-04-12T13:48:51Z")
Hello everybody. I have faced, as it seems to me, with strange behavior of anomaly detection jobs. The last bucket is not processed when the model\_plot\_config is enabled. For example, when I use a bucket size "1d", th… --- ## [No emails received from logstash for email output plugin](https://discuss.elastic.co/t/no-emails-received-from-logstash-for-email-output-plugin/143432)
**Author:** [@naga\_kunchala](https://discuss.elastic.co/u/naga_kunchala)\ **Replies:** 7\ **Last updated:** [August 8, 2018, 1:01pm UTC](https://discuss.elastic.co/t/no-emails-received-from-logstash-for-email-output-plugin/143432 "2018-08-08T13:01:01Z")
I do not get any emails from logstash for the below config. Could anyone please help me what is going wrong, also please let me know where can I trace the email logs. There is no any error on running the the config file. … --- ## [Yii Framework Elastica Elasticsearch](https://discuss.elastic.co/t/yii-framework-elastica-elasticsearch/83766)
**Author:** [@Mariana](https://discuss.elastic.co/u/Mariana)\ **Replies:** 7\ **Last updated:** [September 25, 2017, 12:59pm UTC](https://discuss.elastic.co/t/yii-framework-elastica-elasticsearch/83766 "2017-09-25T12:59:11Z")
Hola a todos!! estoy tratando de hacer un crud en yii 1.1.17 con elasticsearch 2.4.4 por medio de ajax, tengo los datos en un array y trato de mandarlos al controlador pero no llega al mismo.. alguien ha intentado hacer … --- ## [Question on Elasticsearch upgrade using Ansible](https://discuss.elastic.co/t/question-on-elasticsearch-upgrade-using-ansible/282519)
**Author:** [@Arunlal\_A](https://discuss.elastic.co/u/Arunlal_A)\ **Replies:** 4\ **Last updated:** [August 31, 2021, 10:49am UTC](https://discuss.elastic.co/t/question-on-elasticsearch-upgrade-using-ansible/282519 "2021-08-31T10:49:47Z")
Hi, A quick basic question to the community. I have one three node Elasticsearch cluster (version 7.6.2) which was setup using the official Ansible role GitHub - elastic/ansible-elasticsearch: Ansible playbook for Elas… --- ## [Elasticsearch Dedicated Master Node](https://discuss.elastic.co/t/elasticsearch-dedicated-master-node/163193)
**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\ **Replies:** 4\ **Last updated:** [January 7, 2019, 3:02pm UTC](https://discuss.elastic.co/t/elasticsearch-dedicated-master-node/163193 "2019-01-07T15:02:12Z")
Hi, I have a cluster with one dedicated master node and two data nodes. I use my master node URL to search my documents. What is the advantage and disadvantage of using dedicated master node? Also, Is it better to use… --- ## [Scaling Elastic on Azure](https://discuss.elastic.co/t/scaling-elastic-on-azure/115801)
**Author:** [@jdm1983](https://discuss.elastic.co/u/jdm1983)\ **Replies:** 4\ **Last updated:** [January 19, 2018, 3:21pm UTC](https://discuss.elastic.co/t/scaling-elastic-on-azure/115801 "2018-01-19T15:21:22Z")
I recently deployed an Elastic cluster to Azure using the template in the marketplace, but we need to add a couple more data nodes to the cluster. Is there an easy way to do this? I had attempted it on a previous cluste… --- ## [Kibana 4 Visualization returning IP addresses in decimal format](https://discuss.elastic.co/t/kibana-4-visualization-returning-ip-addresses-in-decimal-format/58862)
**Author:** [@datadude](https://discuss.elastic.co/u/datadude)\ **Replies:** 4\ **Last updated:** [August 25, 2016, 11:42pm UTC](https://discuss.elastic.co/t/kibana-4-visualization-returning-ip-addresses-in-decimal-format/58862 "2016-08-25T23:42:50Z")
Setting up a visualization in kibana4 and found it is returning IP addresses in decimal format. Is there a way to get this to display in dotted-decimal (or normal IPv4) format? If relevant I am using a Data Table visua… --- ## [Kibana + DateTime issues](https://discuss.elastic.co/t/kibana-datetime-issues/52662)
**Author:** [@sarthak2016](https://discuss.elastic.co/u/sarthak2016)\ **Replies:** 4\ **Last updated:** [June 15, 2016, 9:38pm UTC](https://discuss.elastic.co/t/kibana-datetime-issues/52662 "2016-06-15T21:38:30Z")
I am using logstash and collect CSV data and import into Elastic Search, CSV Data 02/06/2016 01:01:32 Import to Elastic Search in Json format "Timestamp": "02/06/2016 01:01:32", Kibana Json: "Timestamp": "0… --- ## [ES Query returns results that doesn't not fit the query](https://discuss.elastic.co/t/es-query-returns-results-that-doesnt-not-fit-the-query/82932)
**Author:** [@jac1241](https://discuss.elastic.co/u/jac1241)\ **Replies:** 2\ **Last updated:** [April 20, 2017, 7:57am UTC](https://discuss.elastic.co/t/es-query-returns-results-that-doesnt-not-fit-the-query/82932 "2017-04-20T07:57:56Z")
Hi all, I've stumbled upon weird behavior in ES, where it returns results that does not match the query. We are on ES 2.4 with tribe, and i was wondering if anyone encountered such behavior. Query { "query": { … --- ## [Logstash Date Filter, UNIX date format parse error, date is malformed](https://discuss.elastic.co/t/logstash-date-filter-unix-date-format-parse-error-date-is-malformed/63647)
**Author:** [@Dark\_Light](https://discuss.elastic.co/u/Dark_Light)\ **Replies:** 2\ **Last updated:** [October 24, 2016, 4:09pm UTC](https://discuss.elastic.co/t/logstash-date-filter-unix-date-format-parse-error-date-is-malformed/63647 "2016-10-24T16:09:32Z")
I am trying to parse the Unix date from Squid logs with the Date plugin using UNIX date format. The date does not convert and there are errors in the Logstash log stating the date is malformed at the last number in the … --- ## [Warning: "Redis connection problem" even after removing Redis from config](https://discuss.elastic.co/t/warning-redis-connection-problem-even-after-removing-redis-from-config/338)
**Author:** [@Vikram\_Nair](https://discuss.elastic.co/u/Vikram_Nair)\ **Replies:** 2\ **Last updated:** [May 8, 2015, 4:53am UTC](https://discuss.elastic.co/t/warning-redis-connection-problem-even-after-removing-redis-from-config/338 "2015-05-08T04:53:58Z")
Hi all, /etc/logstash/conf.d/logstash.conf is a below input { udp { port =\> 5000 type =\> syslog } } filter { kv { } } output { elasticsearch { cluster =\> LogStore } } I still keep getti… --- ## [Match Phrase Suffix option, similar to Match Phrase Prefix?](https://discuss.elastic.co/t/match-phrase-suffix-option-similar-to-match-phrase-prefix/69189)
**Author:** [@tdicken73](https://discuss.elastic.co/u/tdicken73)\ **Replies:** 1\ **Last updated:** [December 15, 2016, 4:15pm UTC](https://discuss.elastic.co/t/match-phrase-suffix-option-similar-to-match-phrase-prefix/69189 "2016-12-15T16:15:11Z")
Hi all, I'm looking for a solution where I need to match a query phrase against multiple fields, represented below as companyField1, companyField2, and companyField3. I currently am using the following query in my J… --- ## [Kibana ENOSPC no space left to write to disk:](https://discuss.elastic.co/t/kibana-enospc-no-space-left-to-write-to-disk/134309)
**Author:** [@zied\_boufaden](https://discuss.elastic.co/u/zied_boufaden)\ **Replies:** 3\ **Last updated:** [June 4, 2018, 2:18am UTC](https://discuss.elastic.co/t/kibana-enospc-no-space-left-to-write-to-disk/134309 "2018-06-04T02:18:39Z")
I am using kibana and i got the following error when trying to start kibana: // journalctl -xe | grep kibana // fs.js: 796 // return binding.writeBuffer(fd, buffer, offset, length, position) // ^ // Error: ENOSPC: n… --- ## [Windows server is almost not generating logs after winlogbeat installation](https://discuss.elastic.co/t/windows-server-is-almost-not-generating-logs-after-winlogbeat-installation/53275)
**Author:** [@sumeshms](https://discuss.elastic.co/u/sumeshms)\ **Replies:** 6\ **Last updated:** [June 23, 2016, 9:42am UTC](https://discuss.elastic.co/t/windows-server-is-almost-not-generating-logs-after-winlogbeat-installation/53275 "2016-06-23T09:42:48Z")
Hello Am facing a wired issue, After the installation of winlogbeat on two servers , both of them are generating only a few number of logs. Most of the time the servers are not logging anything. Any idea ? Regards S… --- ## [Heartbeat ask for unnecessary cluster privileges at startup](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 5\ **Last updated:** [June 15, 2021, 2:28pm UTC](https://discuss.elastic.co/t/heartbeat-ask-for-unnecessary-cluster-privileges-at-startup/275814 "2021-06-15T14:28:43Z")
Hi all, I'm using Heartbeat 7.13.1. I first setup templates and ILM policy with elastic superuser, and then I start heartbeat using a ristrected "apikey" user. However, I have this error at startup: {"log.level":"err… --- ## [Winlogbeat 5.0.0 stops sending data to Logstash (EOF)](https://discuss.elastic.co/t/winlogbeat-5-0-0-stops-sending-data-to-logstash-eof/64898)
**Author:** [@hailaeos.troy](https://discuss.elastic.co/u/hailaeos.troy)\ **Replies:** 5\ **Last updated:** [November 4, 2016, 7:50pm UTC](https://discuss.elastic.co/t/winlogbeat-5-0-0-stops-sending-data-to-logstash-eof/64898 "2016-11-04T19:50:04Z")
Winlogbeat stops sending data to logstash 5 or 2.4, I have been been able to reproduce this consistently and haven't ruled out user error. What I have done is the following: write an event log every 2 minutes using pow… --- ## [Ignoring phrases or using negative lookbehind in regexp](https://discuss.elastic.co/t/ignoring-phrases-or-using-negative-lookbehind-in-regexp/33573)
**Author:** [@andyofb](https://discuss.elastic.co/u/andyofb)\ **Replies:** 1\ **Last updated:** [November 2, 2015, 11:33pm UTC](https://discuss.elastic.co/t/ignoring-phrases-or-using-negative-lookbehind-in-regexp/33573 "2015-11-02T23:33:30Z")
Is it possible to do a negative look behind in regexp query or filter? There may also be a better way to do this so I am open to suggestions. I would like to match the word maps but not the term apple maps. If it on… --- ## [Is it possible to use regexp or wildcard when adding exception to detection rules?](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204 "2021-04-15T20:22:02Z")
Hi, when adding exceptions to detection rules, is it possible to use regular expressions or wildcards? sometimes executable are started in directories created with random names, or have parameters with other variable p… --- ## [How to merge aggregation bucket in Elasticsearch?](https://discuss.elastic.co/t/how-to-merge-aggregation-bucket-in-elasticsearch/290230)
**Author:** [@hyun](https://discuss.elastic.co/u/hyun)\ **Replies:** 7\ **Last updated:** [November 30, 2021, 9:04am UTC](https://discuss.elastic.co/t/how-to-merge-aggregation-bucket-in-elasticsearch/290230 "2021-11-30T09:04:53Z")
Query GET /\_search { "size" : 0, "query" : { "ids" : { "types" : \[ \], "values" : \[ "someId1", "someId2", "someId3" ... \] } }, "aggregations" : { "how\_to\_merge" : { "terms" : { … --- ## [Kafka sink Connector to Elasticsearch](https://discuss.elastic.co/t/kafka-sink-connector-to-elasticsearch/328361)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [March 23, 2023, 3:20pm UTC](https://discuss.elastic.co/t/kafka-sink-connector-to-elasticsearch/328361 "2023-03-23T15:20:15Z")
I am trying to set up ingestion pipeline to elasticsearch cluster via kafka sink connector. A question I have is if I have a doc that haas multiple json objects like this: \[ {"name":"abc", "company":"123","dept":"test"… --- ## [Kibana dashboard filters that recognize multiple views?](https://discuss.elastic.co/t/kibana-dashboard-filters-that-recognize-multiple-views/333507)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 4\ **Last updated:** [May 16, 2023, 6:31pm UTC](https://discuss.elastic.co/t/kibana-dashboard-filters-that-recognize-multiple-views/333507 "2023-05-16T18:31:01Z")
I created a dashboard that shows visualizations . Each visualization references a different Kibana data view. And each kibana data view references a different index. For example, let's say I have two indices with the f… --- ## [How to rename filebeat fields](https://discuss.elastic.co/t/how-to-rename-filebeat-fields/135155)
**Author:** [@springCkWyy](https://discuss.elastic.co/u/springCkWyy)\ **Replies:** 4\ **Last updated:** [June 13, 2018, 6:14pm UTC](https://discuss.elastic.co/t/how-to-rename-filebeat-fields/135155 "2018-06-13T18:14:19Z")
how to rename filebeat fields? I need 'rename' source to 'path'. and need to rename 'beat.hostname' to 'host'. Beacause I use ‘path’ and 'host' in es. thank you @@@ --- ## [Problem with Aggregate Filter](https://discuss.elastic.co/t/problem-with-aggregate-filter/216908)
**Author:** [@codecounselor](https://discuss.elastic.co/u/codecounselor)\ **Replies:** 5\ **Last updated:** [January 29, 2020, 2:50pm UTC](https://discuss.elastic.co/t/problem-with-aggregate-filter/216908 "2020-01-29T14:50:57Z")
I am trying to aggregate all of the log entries for database deadlocks into a single entry. Right now I'm focusing on MySQL's log output, but I need to so something very similar for MSSQL. In comments I have the first … [Previous page](https://discuss.elastic.co/top.md?page=787&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=789&per_page=50&period=all)