# Top **URL:** https://discuss.elastic.co/top.md?page=800&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 801 --- ## [Too many files open](https://discuss.elastic.co/t/too-many-files-open/7125)
**Author:** [@thinusp](https://discuss.elastic.co/u/thinusp)\ **Replies:** 5\ **Last updated:** [October 15, 2012, 4:46pm UTC](https://discuss.elastic.co/t/too-many-files-open/7125 "2012-10-15T16:46:53Z")
Could someone perhaps help me troubleshoot this problem... Over the weekend I ran a test on my 5-node cluster, which started failing after a while. After looking at the logs (which came up to be around 9 GB of data.… --- ## [Saved interactive dashboard to drill down and filter logs](https://discuss.elastic.co/t/saved-interactive-dashboard-to-drill-down-and-filter-logs/156337)
**Author:** [@SundarV](https://discuss.elastic.co/u/SundarV)\ **Replies:** 3\ **Last updated:** [November 12, 2018, 11:23pm UTC](https://discuss.elastic.co/t/saved-interactive-dashboard-to-drill-down-and-filter-logs/156337 "2018-11-12T23:23:33Z")
Hi, I' trying to create a dashboard to make it easy for others to look at logs. This involves 2 levels of drill down based on some tags - a higher level group and then components within that group (different groups can… --- ## [Logstash Event Size](https://discuss.elastic.co/t/logstash-event-size/269972)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/logstash-event-size/269972 "2021-04-14T14:43:58Z")
Hi, Can anyone tell me how I can get the size of an entire event using the ruby filter please? Thx D --- ## [How to find the time difference between two documents (rows in sql) in an index (table in sql) with same Id](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782)
**Author:** [@imganeshr](https://discuss.elastic.co/u/imganeshr)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-find-the-time-difference-between-two-documents-rows-in-sql-in-an-index-table-in-sql-with-same-id/268782 "2021-03-31T07:12:13Z")
Hello Everyone, I am new to Elastic Search and Kibana Query Language. I would like to find the time difference between the two documents which have the id as common between them as like below. TimeStamp … --- ## [Elastic Agent Linux Install Directory](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:10pm UTC](https://discuss.elastic.co/t/elastic-agent-linux-install-directory/255595 "2020-11-17T18:10:12Z")
Hi all, I installed Elastic Agent from /tmp/elastic-agent-7.10.0-linux-x86\_64. I now see a metricbeat running from /tmp/elastic-agent-7.10.0-linux-x86\_64/data/elastic-agent-1428d5. Is this intended? Why are downloaded … --- ## [Got error when run simple config file first time](https://discuss.elastic.co/t/got-error-when-run-simple-config-file-first-time/89795)
**Author:** [@Tals](https://discuss.elastic.co/u/Tals)\ **Replies:** 4\ **Last updated:** [June 19, 2017, 4:44am UTC](https://discuss.elastic.co/t/got-error-when-run-simple-config-file-first-time/89795 "2017-06-19T04:44:58Z")
Just install local host Logstash 5.4.1 I ceated the simple config file at the Logstash folder and run c:\\logstash-5.4.1\\bin\>logstash -f logstash-simple.conf and got this: Using JAVA\_HOME=C:\\ProgramData\\Oracle\\Java\\javapa… --- ## [Elasticsearch 2.3.3 : Same Query Yielding different Results with replica](https://discuss.elastic.co/t/elasticsearch-2-3-3-same-query-yielding-different-results-with-replica/63218)
**Author:** [@Pradeep\_B](https://discuss.elastic.co/u/Pradeep_B)\ **Replies:** 4\ **Last updated:** [October 18, 2016, 2:41pm UTC](https://discuss.elastic.co/t/elasticsearch-2-3-3-same-query-yielding-different-results-with-replica/63218 "2016-10-18T14:41:12Z")
Hi, I have seen lot of open topics in the forum which talk about the same issue but do not have a solution identified. We have an index of about 300 million documents (500 GB disk space, 1 TB with replica) spread acros… --- ## [How to set a analyser for all the fields and the "\_all" field](https://discuss.elastic.co/t/how-to-set-a-analyser-for-all-the-fields-and-the--all-field/31498)
**Author:** [@Guill](https://discuss.elastic.co/u/Guill)\ **Replies:** 4\ **Last updated:** [October 6, 2015, 8:09pm UTC](https://discuss.elastic.co/t/how-to-set-a-analyser-for-all-the-fields-and-the--all-field/31498 "2015-10-06T20:09:51Z")
Hello, I am using the elasticsearch-analysis-kuromoji, being created like so: public final static String JAPANESE\_LANGUAGE\_ANALYSIS = "japanese\_analyzer"; private void createCustomerIndex() { try { client… --- ## [Kibana lens grouping data by string pattern](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125)
**Author:** [@Realsnack](https://discuss.elastic.co/u/Realsnack)\ **Replies:** 2\ **Last updated:** [January 17, 2022, 6:02am UTC](https://discuss.elastic.co/t/kibana-lens-grouping-data-by-string-pattern/294125 "2022-01-17T06:02:59Z")
Hello, we have some finance transactions saved in Elasticsearch and I would like to create a visualization on the data. All of the records have field "messageType" with a string value and I would need to group the reco… --- ## [Logstash not receiving Docker syslog input](https://discuss.elastic.co/t/logstash-not-receiving-docker-syslog-input/196770)
**Author:** [@jjarzyns](https://discuss.elastic.co/u/jjarzyns)\ **Replies:** 2\ **Last updated:** [August 27, 2019, 8:35am UTC](https://discuss.elastic.co/t/logstash-not-receiving-docker-syslog-input/196770 "2019-08-27T08:35:06Z")
I am facing an issue with the ELK stack and docker syslog. I used tcpdump and confirmed that log entries are being sent to the port exposed by my Logstash container but for some reason they don't show up in the container… --- ## [Kibana Slow Perfomance Script Fields and many fields](https://discuss.elastic.co/t/kibana-slow-perfomance-script-fields-and-many-fields/86541)
**Author:** [@Rodrigo\_Tornis](https://discuss.elastic.co/u/Rodrigo_Tornis)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 11:28am UTC](https://discuss.elastic.co/t/kibana-slow-perfomance-script-fields-and-many-fields/86541 "2017-05-26T11:28:58Z")
Hello Everyone! I am doing a proof of concept with ELK and I have the following doubts regarding specifically Kibana. My hardware Core I5 ​​quad core 16GB RAM Linux OS Ubuntu Server JVM for Elasticsearch 5.4 8GB H… --- ## [ELK Hardware Guidelines](https://discuss.elastic.co/t/elk-hardware-guidelines/66963)
**Author:** [@sivapram](https://discuss.elastic.co/u/sivapram)\ **Replies:** 2\ **Last updated:** [November 23, 2016, 11:37am UTC](https://discuss.elastic.co/t/elk-hardware-guidelines/66963 "2016-11-23T11:37:32Z")
We are working on a ELK Stack for Log Avalysis and pull reports. Daily 20 GB(Raw Data) of logs from different source needs to be stored in Elastic search. With 3 years retention period the total log size would be 20 - … --- ## [ElasticProperty?](https://discuss.elastic.co/t/elasticproperty/419)
**Author:** [@wallajr](https://discuss.elastic.co/u/wallajr)\ **Replies:** 2\ **Last updated:** [May 11, 2015, 3:33pm UTC](https://discuss.elastic.co/t/elasticproperty/419 "2015-05-11T15:33:51Z")
Hi, Can anyone tell me what this means? \[ElasticProperty(Index = FieldIndexOption.Analyzed)\] \[ElasticProperty(Index = FieldIndexOption.NotAnalyzed)\] I've been looking through documentation and I just don't underst… --- ## [Elasticsearch-setup-passwords interactive fails on a new cluster](https://discuss.elastic.co/t/elasticsearch-setup-passwords-interactive-fails-on-a-new-cluster/184250)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 1\ **Last updated:** [June 4, 2019, 11:51pm UTC](https://discuss.elastic.co/t/elasticsearch-setup-passwords-interactive-fails-on-a-new-cluster/184250 "2019-06-04T23:51:50Z")
Trying to provision a new cluster, currently two master nodes on 7.1.0. When I try to setup the initial passwords for the built-in users I get the following error: root@master-node-1:~# /usr/share/elasticsearch/bin/ela… --- ## [Need an analyzer that can split words by dot and reserve numbers](https://discuss.elastic.co/t/need-an-analyzer-that-can-split-words-by-dot-and-reserve-numbers/95663)
**Author:** [@CreateChen](https://discuss.elastic.co/u/CreateChen)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 3:53pm UTC](https://discuss.elastic.co/t/need-an-analyzer-that-can-split-words-by-dot-and-reserve-numbers/95663 "2017-08-03T15:53:39Z")
Hi, Standard analyzer can’t split words by a dot, and simple analyzer filter out the numbers. I want to split words by dot and reserve numbers, which analyzer should I use? Example: “google.com 123” =\> \[“google”, “co… --- ## [Logstash 6.4.1 Ignoring Netflow 10](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 6\ **Last updated:** [October 4, 2018, 10:09am UTC](https://discuss.elastic.co/t/logstash-6-4-1-ignoring-netflow-10/149488 "2018-10-04T10:09:57Z")
Hi, I have installed Logstash 6.4.1 and I have enabled the netflow module but I'm getting "Ignoring Netflow version v10". As far as I understand, netflow 10 is supported in this version. Am I correct? Here is the error … --- ## [Read-Only Maintenance on June 16th at 9AM EST](https://discuss.elastic.co/t/read-only-maintenance-on-june-16th-at-9am-est/2716)
**Author:** [@tylerjl](https://discuss.elastic.co/u/tylerjl)\ **Replies:** 5\ **Last updated:** [June 16, 2015, 4:55pm UTC](https://discuss.elastic.co/t/read-only-maintenance-on-june-16th-at-9am-est/2716 "2015-06-16T16:55:17Z")
On June 16th at 9AM EST, we will be importing our Google Groups mailing list archives into Discourse. This will allow us to better centralize discussions and archives. The site will be in read-only mode for the duratio… --- ## [Slow or stalled pipeline](https://discuss.elastic.co/t/slow-or-stalled-pipeline/56701)
**Author:** [@sderungs](https://discuss.elastic.co/u/sderungs)\ **Replies:** 2\ **Last updated:** [July 29, 2016, 12:36pm UTC](https://discuss.elastic.co/t/slow-or-stalled-pipeline/56701 "2016-07-29T12:36:46Z")
Hi We are using the ELK Stack (ES, LS, Kibana, Filebeat) for a big customer project. Currently we're still using it with an hourly-scheduled file-input configuration (where we read from the logfiles over network shares… --- ## [Logstash-plugin list display Gem errors](https://discuss.elastic.co/t/logstash-plugin-list-display-gem-errors/71755)
**Author:** [@smutel](https://discuss.elastic.co/u/smutel)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-plugin-list-display-gem-errors/71755 "2017-01-16T15:05:24Z")
Hello, When I execute the command "/usr/share/logstash/bin/logstash-plugin list", I have the error below: Gem::LoadError: You have already activated json 1.8.6, but your Gemfile requires json 1.8.3. Prepending bundle … --- ## [Parsing issues with nested data](https://discuss.elastic.co/t/parsing-issues-with-nested-data/115608)
**Author:** [@ataustin](https://discuss.elastic.co/u/ataustin)\ **Replies:** 7\ **Last updated:** [January 16, 2018, 4:05pm UTC](https://discuss.elastic.co/t/parsing-issues-with-nested-data/115608 "2018-01-16T16:05:35Z")
Hello ES experts, We are running into an issue with certain documents that are ingested in by transport-couchbase. The doc is and error is listed below. Any ideas \[ { "poc": { "cas": 1511944677515919400, "docType": "… --- ## [Setting the max-value of Timelion's Y-axis dynamically](https://discuss.elastic.co/t/setting-the-max-value-of-timelions-y-axis-dynamically/95671)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 1\ **Last updated:** [August 3, 2017, 1:43pm UTC](https://discuss.elastic.co/t/setting-the-max-value-of-timelions-y-axis-dynamically/95671 "2017-08-03T13:43:17Z")
Hi, I am using the below Timelion expression to plot a Timelion Chart in Kibana for metricbeat data: .es(index=metricbeat-\*, timefield=’@timestamp’, metric=‘avg:system.memory.used.bytes’).divide(1073741824).label('Memo… --- ## [Logstash plugin elasticsearch performance issue](https://discuss.elastic.co/t/logstash-plugin-elasticsearch-performance-issue/87775)
**Author:** [@sepibe](https://discuss.elastic.co/u/sepibe)\ **Replies:** 7\ **Last updated:** [June 12, 2017, 2:23pm UTC](https://discuss.elastic.co/t/logstash-plugin-elasticsearch-performance-issue/87775 "2017-06-12T14:23:45Z")
Hello, I'm using a Filebeat-\>Logstash-\>Elasticsearch configuration to monitor and keep trace of different logs in my system. Everythin works correctly and CPU usage is around 20%. There are 4 different types of log f… --- ## [Docker elasticsearch container : FileSystemException : Not a directory](https://discuss.elastic.co/t/docker-elasticsearch-container-filesystemexception-not-a-directory/330204)
**Author:** [@JackieLaFrite](https://discuss.elastic.co/u/JackieLaFrite)\ **Replies:** 4\ **Last updated:** [June 16, 2023, 8:33am UTC](https://discuss.elastic.co/t/docker-elasticsearch-container-filesystemexception-not-a-directory/330204 "2023-06-16T08:33:10Z")
I tried to modify the port the docker container of elasticsearch from 9200:9200 to 9201:9200 and since I did that I got this error in the docker container : "message": "uncaught exception in thread \[main\]", "stacktrace… --- ## [Function beat is for x-pack only](https://discuss.elastic.co/t/function-beat-is-for-x-pack-only/156832)
**Author:** [@shahid](https://discuss.elastic.co/u/shahid)\ **Replies:** 3\ **Last updated:** [November 28, 2018, 7:06am UTC](https://discuss.elastic.co/t/function-beat-is-for-x-pack-only/156832 "2018-11-28T07:06:03Z")
Hi Team, First of all , i would like to say "Good work" to all funcationbeat tech team. my question is . 1 - Is this only for X-pack users? 2 - do i need to install this beat on my ELK and shipper servers? I am us… --- ## [How to hide controls like Saved Filter Menu and Add Filter Menu, Options Menu when embedding Kibana IFrame URL in the web application](https://discuss.elastic.co/t/how-to-hide-controls-like-saved-filter-menu-and-add-filter-menu-options-menu-when-embedding-kibana-iframe-url-in-the-web-application/332640)
**Author:** [@ramanm](https://discuss.elastic.co/u/ramanm)\ **Replies:** 1\ **Last updated:** [June 1, 2023, 12:22am UTC](https://discuss.elastic.co/t/how-to-hide-controls-like-saved-filter-menu-and-add-filter-menu-options-menu-when-embedding-kibana-iframe-url-in-the-web-application/332640 "2023-06-01T00:22:33Z")
We are embedding kibana iframe url in our web application. We wanted to hide controls like Saved Filter Menu Add Filter Menu Options Menu Some of the above filters exposes the index names under Data View that are ava… --- ## [Permission to read SIEM signal index](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [June 10, 2020, 4:02pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308 "2020-06-10T16:02:55Z")
Attempting to adjust our read-only role for SIEM viewers, but users fails to get permission to the signal index, wondering how to allow read/search access to this? When Users access the SIEM app thay get this error: \[s… --- ## [Elastic Search Repository possibility to get more than 10000 results](https://discuss.elastic.co/t/elastic-search-repository-possibility-to-get-more-than-10000-results/238832)
**Author:** [@Naveena1](https://discuss.elastic.co/u/Naveena1)\ **Replies:** 1\ **Last updated:** [June 26, 2020, 11:18am UTC](https://discuss.elastic.co/t/elastic-search-repository-possibility-to-get-more-than-10000-results/238832 "2020-06-26T11:18:19Z")
Hi, I am using ElasticSearchRepository and fetching search results using SearchQuery. like below :- Employee class represents documents of Employee index in ElasticSearch and EmployeeRepository is elasticsearch reposi… --- ## [Missing authentication ceredentials for rest request](https://discuss.elastic.co/t/missing-authentication-ceredentials-for-rest-request/204859)
**Author:** [@Krypton8](https://discuss.elastic.co/u/Krypton8)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 8:14am UTC](https://discuss.elastic.co/t/missing-authentication-ceredentials-for-rest-request/204859 "2019-10-24T08:14:23Z")
Hello guys, I have put in place a LDAP realm on my ES cluster. I enabled the xpack.security.enabled to true on all of my cluster nodes (3). I have modified my elasticsearch.yml to set the LDAP realm with user\_search a… --- ## [Reload pipeline from docker image](https://discuss.elastic.co/t/reload-pipeline-from-docker-image/169599)
**Author:** [@Hyllegaard](https://discuss.elastic.co/u/Hyllegaard)\ **Replies:** 2\ **Last updated:** [March 21, 2019, 1:06pm UTC](https://discuss.elastic.co/t/reload-pipeline-from-docker-image/169599 "2019-03-21T13:06:18Z")
Hi. we are using the Docker version of logstash. Is it possible to make it reload the configuration from the docker mounted volume. i tried using -e "CONFIG\_RELOAD\_AUTOMATiC=true" on the docker run command, but that doe… --- ## [Range vs Terms / Date vs Integer what is the speediest?](https://discuss.elastic.co/t/range-vs-terms-date-vs-integer-what-is-the-speediest/87915)
**Author:** [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 7:05am UTC](https://discuss.elastic.co/t/range-vs-terms-date-vs-integer-what-is-the-speediest/87915 "2017-06-02T07:05:09Z")
Hi guys, I'm trying to super-optimize somes queries, but when trying to change a RangeQuery on a Date field, I'm very surprised to do not have a better time using an Integer with TermsQuery. I have one field: a Date … --- ## [Error While Updating Array using painless script](https://discuss.elastic.co/t/error-while-updating-array-using-painless-script/81047)
**Author:** [@Gautam\_Vanani](https://discuss.elastic.co/u/Gautam_Vanani)\ **Replies:** 2\ **Last updated:** [April 5, 2017, 2:08am UTC](https://discuss.elastic.co/t/error-while-updating-array-using-painless-script/81047 "2017-04-05T02:08:26Z")
Hi, I'm facing issue while updating array field { "error": { "root\_cause": \[ { "type": "remote\_transport\_exception", "reason": "\[3BcGP3Y\]\[127.0.0.1:9300\]\[indices:data/write/update\[s\]\]" } \], "type": "illega… --- ## [Unable to see logs when sending through Logstash](https://discuss.elastic.co/t/unable-to-see-logs-when-sending-through-logstash/110687)
**Author:** [@fab](https://discuss.elastic.co/u/fab)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 11:12am UTC](https://discuss.elastic.co/t/unable-to-see-logs-when-sending-through-logstash/110687 "2017-12-12T11:12:34Z")
Hi, i'm trying to send windows logs through winlogbeat directly to logstash. Everything is done locally from Windows 10 to a VM with Centos 7. winlogbeat.yml file in windows output.logstash: hosts: \["192.168.88.129:50… --- ## [How to export data from saved search](https://discuss.elastic.co/t/how-to-export-data-from-saved-search/92473)
**Author:** [@sandesh\_patil](https://discuss.elastic.co/u/sandesh_patil)\ **Replies:** 3\ **Last updated:** [July 12, 2017, 8:33am UTC](https://discuss.elastic.co/t/how-to-export-data-from-saved-search/92473 "2017-07-12T08:33:21Z")
I want to export all the documents from saved search to csv and excel. How to achieved it. I dont want to export summarized data as given in below link. If not possible, then how to create visualization where i can … --- ## [Failing to index a JSON object](https://discuss.elastic.co/t/failing-to-index-a-json-object/47229)
**Author:** [@Dror\_Atariah](https://discuss.elastic.co/u/Dror_Atariah)\ **Replies:** 3\ **Last updated:** [April 14, 2016, 5:33am UTC](https://discuss.elastic.co/t/failing-to-index-a-json-object/47229 "2016-04-14T05:33:42Z")
I have a file that contains JSON objects, one object per line. Following is an example of one (prettified) object. My intention is to do the following, in order to index the objects in ES: cat foo.json | jq -c '. | {"i… --- ## [Tomcat logs in filebeat](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 5\ **Last updated:** [July 1, 2021, 11:03am UTC](https://discuss.elastic.co/t/tomcat-logs-in-filebeat/277313 "2021-07-01T11:03:26Z")
If I add a tomcat log paths in tomcat.yml..why is it not showing in discover section..could you pls give the solution on this case?? --- ## [Unable to generate reports using watcher](https://discuss.elastic.co/t/unable-to-generate-reports-using-watcher/91192)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [June 30, 2017, 3:41pm UTC](https://discuss.elastic.co/t/unable-to-generate-reports-using-watcher/91192 "2017-06-30T15:41:28Z")
Hi All, I created a watch for reporting and am getting this message when am executing it ,please do let me know what has to done "actions": \[ { "id": "email\_admin", "type": "email", "status":… --- ## [How to get the IP address of the HTTP request sender](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender/235289)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 4\ **Last updated:** [June 2, 2020, 3:18pm UTC](https://discuss.elastic.co/t/how-to-get-the-ip-address-of-the-http-request-sender/235289 "2020-06-02T15:18:49Z")
Hi, I need to get the ip address, the person who hits our server URL then his machine ip should capture in elk output.(In kibana discover page through Logstash output) Can anybody please help me using Logstash --- ## [Datafeed has been retrieving no data for a while](https://discuss.elastic.co/t/datafeed-has-been-retrieving-no-data-for-a-while/224119)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 4\ **Last updated:** [March 19, 2020, 7:20am UTC](https://discuss.elastic.co/t/datafeed-has-been-retrieving-no-data-for-a-while/224119 "2020-03-19T07:20:29Z")
hi, I've created an anomaly detection job, and after the creation it wont update anymore: attached the json: { "job\_id": "ml-test", "job\_type": "anomaly\_detector", "job\_version": "7.6.1", "groups": \[ "forti… --- ## [CSV Logstash filter for big files](https://discuss.elastic.co/t/csv-logstash-filter-for-big-files/109265)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 4\ **Last updated:** [December 6, 2017, 3:18pm UTC](https://discuss.elastic.co/t/csv-logstash-filter-for-big-files/109265 "2017-12-06T15:18:34Z")
Hi Guys, I have a big CSV file that has about 500+ csv columns, I managed to get them into the LS CSV filter, but those fields/columns will be dynamic. Meaning that sometimes we may get more/less columns produced by the… --- ## [Can't send email from x-pack to gmail](https://discuss.elastic.co/t/cant-send-email-from-x-pack-to-gmail/108257)
**Author:** [@tran\_canh\_khanh](https://discuss.elastic.co/u/tran_canh_khanh)\ **Replies:** 4\ **Last updated:** [November 27, 2017, 7:02am UTC](https://discuss.elastic.co/t/cant-send-email-from-x-pack-to-gmail/108257 "2017-11-27T07:02:08Z")
Hi guys. I'm using x-pack to alert but i can't send email from x-pack to gmail.When it send email it had error "MessagingException\[failed to send email with subject \[Watcher Notification\] via account \[gmail\_account\]\]; n… --- ## [Run time field generates error when trying tutorial](https://discuss.elastic.co/t/run-time-field-generates-error-when-trying-tutorial/330158)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [April 29, 2023, 9:38pm UTC](https://discuss.elastic.co/t/run-time-field-generates-error-when-trying-tutorial/330158 "2023-04-29T21:38:03Z")
I'm trying to learn how to create run time fields by following the instructions on this page: I tried my own variation with these queries: PUT rfield POST rfield/\_doc { "Favourite Food": "My fave food is" } GET r… --- ## [Is it possible to change document id?](https://discuss.elastic.co/t/is-it-possible-to-change-document-id/284842)
**Author:** [@vovakor1](https://discuss.elastic.co/u/vovakor1)\ **Replies:** 2\ **Last updated:** [September 22, 2021, 4:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-document-id/284842 "2021-09-22T16:23:50Z")
Could someone help, please? How can I change document id which is used in URL: \/\_doc/\ --- ## [Best way to delete all the documents of an Engine](https://discuss.elastic.co/t/best-way-to-delete-all-the-documents-of-an-engine/233640)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 2\ **Last updated:** [May 21, 2020, 7:14pm UTC](https://discuss.elastic.co/t/best-way-to-delete-all-the-documents-of-an-engine/233640 "2020-05-21T19:14:47Z")
Hello, I need to delete all the documents (30k) on an Engine. I saw another post suggesting to list/query all of them and then call DELETE. I tried that but it's veeery slow, even sending bulks of 200 documents in each … --- ## [How to use split on script field on kibana](https://discuss.elastic.co/t/how-to-use-split-on-script-field-on-kibana/106487)
**Author:** [@xcl3721](https://discuss.elastic.co/u/xcl3721)\ **Replies:** 2\ **Last updated:** [November 24, 2017, 5:09am UTC](https://discuss.elastic.co/t/how-to-use-split-on-script-field-on-kibana/106487 "2017-11-24T05:09:16Z")
hi. i wrote the painless script field on the kibana 5.6.1 it's not work /&/.split(param) how to use the split on script field on new version --- ## [DHCP audit using ELK stack](https://discuss.elastic.co/t/dhcp-audit-using-elk-stack/239962)
**Author:** [@zkhanfur](https://discuss.elastic.co/u/zkhanfur)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 7:35am UTC](https://discuss.elastic.co/t/dhcp-audit-using-elk-stack/239962 "2020-07-07T07:35:37Z")
We were interested in monitoring DHCP leases in our environment using ELK stack. As we do currently not have Beats, we are forced to use Windows logs and either forward these or copy these. We found a very good blog desc… --- ## [Grok pattern is not working](https://discuss.elastic.co/t/grok-pattern-is-not-working/65976)
**Author:** [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\ **Replies:** 3\ **Last updated:** [November 16, 2016, 1:01pm UTC](https://discuss.elastic.co/t/grok-pattern-is-not-working/65976 "2016-11-16T13:01:06Z")
Hi All, I need help on grok patterns. I have a log file where few fields are missing(several fields actually), based on that I have come up with below grok patterns but its not working. In the grok contructor - it sho… --- ## [Daily indices for a period of 1 month with wildcard search taking long time](https://discuss.elastic.co/t/daily-indices-for-a-period-of-1-month-with-wildcard-search-taking-long-time/56470)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 8\ **Last updated:** [July 31, 2016, 7:45am UTC](https://discuss.elastic.co/t/daily-indices-for-a-period-of-1-month-with-wildcard-search-taking-long-time/56470 "2016-07-31T07:45:17Z")
Hi Team, i am having 1TB of data over the span of 1 month where we create daily indices and currently we are creating around 20 daily indices with total data of 30-35 GB per day . Field-stats api is taking 50 secs to get… --- ## [False number of nodes detected](https://discuss.elastic.co/t/false-number-of-nodes-detected/24350)
**Author:** [@egrimisu](https://discuss.elastic.co/u/egrimisu)\ **Replies:** 3\ **Last updated:** [June 26, 2015, 7:17am UTC](https://discuss.elastic.co/t/false-number-of-nodes-detected/24350 "2015-06-26T07:17:08Z")
I have made a basic ELK install about a month ago, i had some performance problems but they were fixed as soon i have disabled swapping and increased heap size. I'm still wondering: - why LS report 2 nodes, and in fact… --- ## [Shard waiting for node even though the node is back](https://discuss.elastic.co/t/shard-waiting-for-node-even-though-the-node-is-back/289108)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 3\ **Last updated:** [November 14, 2021, 9:35am UTC](https://discuss.elastic.co/t/shard-waiting-for-node-even-though-the-node-is-back/289108 "2021-11-14T09:35:44Z")
We have a patching run that is hitting our servers. I don't want relocation to happen during the patching, so I set the delay to a window longer than the patching takes. This generally works as the node goes down, then a… --- ## [Missing fields in Kibana](https://discuss.elastic.co/t/missing-fields-in-kibana/227974)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 6\ **Last updated:** [April 17, 2020, 3:34pm UTC](https://discuss.elastic.co/t/missing-fields-in-kibana/227974 "2020-04-17T15:34:27Z")
Hello, After I imported my CSV data in ES and when I search for my fields in devtools I couldn't find them all. This is my conf file : input{ file{ path =\> "C:/Users/Asus/Dropbox/PFE\_part2/MOOV\_ALEPE\_Data.csv" … [Previous page](https://discuss.elastic.co/top.md?page=799&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=801&per_page=50&period=all)