# Top **URL:** https://discuss.elastic.co/top.md?page=817&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 818 --- ## [Java 8 & recommended version?](https://discuss.elastic.co/t/java-8-recommended-version/20283)
**Author:** [@Jilles\_van\_Gurp](https://discuss.elastic.co/u/Jilles_van_Gurp)\ **Replies:** 2\ **Last updated:** [January 2, 2015, 10:37pm UTC](https://discuss.elastic.co/t/java-8-recommended-version/20283 "2015-01-02T22:37:17Z")
I know JDK 7u55 was labeled as OK some time ago and this is still listed as the official requirement: http://www.elasticsearch.org/guide/en/elasticsearch/hadoop/current/requirements.html However, time has moved on… --- ## [How to clean up curator messages about system indices being queried](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233)
**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 2:04pm UTC](https://discuss.elastic.co/t/how-to-clean-up-curator-messages-about-system-indices-being-queried/275233 "2021-06-08T14:04:02Z")
I'm using curator to manage my indices currently. I'm suffering from cron spam due to the following: /usr/local/lib/curator/venv/lib64/python3.8/site-packages/elasticsearch/connection/base.py:200: ElasticsearchWarning:… --- ## [High CPU and Memory Usage](https://discuss.elastic.co/t/high-cpu-and-memory-usage/265898)
**Author:** [@duck](https://discuss.elastic.co/u/duck)\ **Replies:** 1\ **Last updated:** [March 2, 2021, 7:10pm UTC](https://discuss.elastic.co/t/high-cpu-and-memory-usage/265898 "2021-03-02T19:10:25Z")
Hi, I've setup Elasticsearch and Kibana on Docker. For testing purpose, I've used "eCommerce Dashboard" example from Kibana(which has one index and almost 5,000 documents.). My Ubuntu server shows me Elasticsearch uses … --- ## [Script painless: null pointer exception](https://discuss.elastic.co/t/script-painless-null-pointer-exception/126109)
**Author:** [@Zsullivan](https://discuss.elastic.co/u/Zsullivan)\ **Replies:** 1\ **Last updated:** [March 29, 2018, 7:42pm UTC](https://discuss.elastic.co/t/script-painless-null-pointer-exception/126109 "2018-03-29T19:42:05Z")
I'm getting a null pointer exception when using null safe (?.) and after checking that the value is not null CALL POST mac\_docs/mac\_doc/\_update\_by\_query?pretty=true&refresh=true { "script":{ "source":"if (params.mac… --- ## [Delete by query - Error invalid\_type\_name\_exception](https://discuss.elastic.co/t/delete-by-query-error-invalid-type-name-exception/119629)
**Author:** [@abdujaparov](https://discuss.elastic.co/u/abdujaparov)\ **Replies:** 1\ **Last updated:** [March 12, 2018, 6:38am UTC](https://discuss.elastic.co/t/delete-by-query-error-invalid-type-name-exception/119629 "2018-03-12T06:38:59Z")
Hi, I am trying to delete some elements with delete\_by\_query. I should remove 5 elements: curl -XGET 'localhost:9200/product\_metadata/\_count?pretty' -d '{"query": {"match":{"type.identifier": "plastic"}}}' If I execu… --- ## [Fresh Install if ELK 7.10 floods deprecation log](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259821)
**Author:** [@JSylvia007](https://discuss.elastic.co/u/JSylvia007)\ **Replies:** 8\ **Last updated:** [December 31, 2020, 4:38pm UTC](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259821 "2020-12-31T16:38:49Z")
A fresh install of ELK 7.10 fills the deprecation log once Kibana is installed. \[2020-12-29T14:12:46,624\]\[DEPRECATION\]\[o.e.d.a.a.i.a.g.TransportGetAliasesAction\] \[app01\] this request accesses system indices: \[.kibana\_1\]… --- ## [I need to generate a co-occurrence graph](https://discuss.elastic.co/t/i-need-to-generate-a-co-occurrence-graph/150655)
**Author:** [@DieMal](https://discuss.elastic.co/u/DieMal)\ **Replies:** 8\ **Last updated:** [October 4, 2018, 7:17am UTC](https://discuss.elastic.co/t/i-need-to-generate-a-co-occurrence-graph/150655 "2018-10-04T07:17:31Z")
Hi there ! What is the best way (performance) for implements a co-occurrence search on a couple of fields ? I found this solution, but I'm not sure that this is the best way: { "size": 0, "aggs": { "cooccurrencePC… --- ## [Unable to create Kafka consumer from given configuration after upgrade to 8.4.0](https://discuss.elastic.co/t/unable-to-create-kafka-consumer-from-given-configuration-after-upgrade-to-8-4-0/313254)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [August 30, 2022, 12:48pm UTC](https://discuss.elastic.co/t/unable-to-create-kafka-consumer-from-given-configuration-after-upgrade-to-8-4-0/313254 "2022-08-30T12:48:02Z")
Hi all, Today Elastic and Kibana was upgraded from 7.17.3 to 8.4.0 without problems. This is an DEV/QA environment. After that, I upgrade logstash also from 7.17.3 to 8.4.0. Since logstash upgrade it can't connect to K… --- ## [Kibana - What privileges required for Save Search option?](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952)
**Author:** [@brapnda23](https://discuss.elastic.co/u/brapnda23)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/kibana-what-privileges-required-for-save-search-option/254952 "2020-11-10T16:55:50Z")
I am using a basic license. Created a few spaces and assigned folks to those spaces. What least index/cluster privilege I need to enable the Save search option for a user in a particular space. I have already given rep… --- ## [Ruby to expand nested array field into nested JSON objects](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753)
**Author:** [@dx123](https://discuss.elastic.co/u/dx123)\ **Replies:** 5\ **Last updated:** [October 30, 2018, 9:33am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753 "2018-10-30T09:33:36Z")
This is an example format of a JSON field that I have now and wish to convert: { "target": \[ "Sector1 - Subsector1", "Sector2 - Subsector2" \] } The end result desired JSON Objects Output format that I need: { … --- ## [Storage/Performance optimization](https://discuss.elastic.co/t/storage-performance-optimization/152393)
**Author:** [@Neha\_Sharma1](https://discuss.elastic.co/u/Neha_Sharma1)\ **Replies:** 5\ **Last updated:** [October 18, 2018, 7:33am UTC](https://discuss.elastic.co/t/storage-performance-optimization/152393 "2018-10-18T07:33:02Z")
We receive approx. 1TB of data everyday(including replica) for 100+ indexes. We currently have 16TB storage spread which stores data for 15 days. Out ES cluster has 2 dedicates MI nodes and 6 Di nodes and 1 MDI node. (M … --- ## [How to save Query JSON as it is in an Index?](https://discuss.elastic.co/t/how-to-save-query-json-as-it-is-in-an-index/15059)
**Author:** [@search](https://discuss.elastic.co/u/search)\ **Replies:** 5\ **Last updated:** [February 3, 2014, 9:11am UTC](https://discuss.elastic.co/t/how-to-save-query-json-as-it-is-in-an-index/15059 "2014-02-03T09:11:48Z")
I want to save the query JSON as it as in a field in an ES index. I should be able to retrieve queries and run it at a later time. I don't need features like percolator. I am using Java client to index and retrieve. … --- ## [Elastic Cloud Kibana SAML Okta not working with groups](https://discuss.elastic.co/t/elastic-cloud-kibana-saml-okta-not-working-with-groups/193571)
**Author:** [@Gavin\_Hardy](https://discuss.elastic.co/u/Gavin_Hardy)\ **Replies:** 6\ **Last updated:** [August 5, 2019, 12:21pm UTC](https://discuss.elastic.co/t/elastic-cloud-kibana-saml-okta-not-working-with-groups/193571 "2019-08-05T12:21:21Z")
Hello, I have setup ES and Kibana to use xpack, and have got it all working. When I create the kibana users like so { "enabled": true, "roles": \[ "kibana\_user" \], "rules": { "field": { "realm.name"… --- ## [Logstash configuration is not giving value to add\_field](https://discuss.elastic.co/t/logstash-configuration-is-not-giving-value-to-add-field/140291)
**Author:** [@satendr](https://discuss.elastic.co/u/satendr)\ **Replies:** 6\ **Last updated:** [July 19, 2018, 11:24am UTC](https://discuss.elastic.co/t/logstash-configuration-is-not-giving-value-to-add-field/140291 "2018-07-19T11:24:08Z")
I am trying to Parse XMl file , and adding extra field for test status . file is getting parsed but for New field , instead of getting value , its displaying filter itself. please suggest.. logstash.config file: input {… --- ## [FIlter in the rule interface](https://discuss.elastic.co/t/filter-in-the-rule-interface/382408)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 4, 2025, 11:49am UTC](https://discuss.elastic.co/t/filter-in-the-rule-interface/382408 "2025-10-04T11:49:42Z")
Hello, So is there a way to search or filter on severity of the rule? Grtz --- ## [Querying distinct sub message from elastic search](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665)
**Author:** [@vinodvenugopal](https://discuss.elastic.co/u/vinodvenugopal)\ **Replies:** 3\ **Last updated:** [April 6, 2020, 12:01pm UTC](https://discuss.elastic.co/t/querying-distinct-sub-message-from-elastic-search/226665 "2020-04-06T12:01:36Z")
Hi, I am new to ELK stack and trying to create dashboard in Kibana for my project. I want to query distinct values in message. For example, I want to display number to messages received in Kafka topic. "\_inde… --- ## [Add average value of data in existing chart elasticsearch kibana](https://discuss.elastic.co/t/add-average-value-of-data-in-existing-chart-elasticsearch-kibana/115605)
**Author:** [@EditAxha](https://discuss.elastic.co/u/EditAxha)\ **Replies:** 2\ **Last updated:** [January 17, 2018, 9:06am UTC](https://discuss.elastic.co/t/add-average-value-of-data-in-existing-chart-elasticsearch-kibana/115605 "2018-01-17T09:06:18Z")
I have a project in Kibana integrated with elastic search. In Kibana page I am displaying a chart with X(months) and Y(Euro) values. I want to show a line in the chart that will show the average Euro value of all data. … --- ## [Filebeat ignoring Path with Wildcard(s)](https://discuss.elastic.co/t/filebeat-ignoring-path-with-wildcard-s/101253)
**Author:** [@allenfin](https://discuss.elastic.co/u/allenfin)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 9:31am UTC](https://discuss.elastic.co/t/filebeat-ignoring-path-with-wildcard-s/101253 "2017-09-21T09:31:40Z")
I'm using Filebeat as a docker container and I keep having problems with trying make sure that nginx error logs and access logs go to the right place. It seems that they just go to both places. I setup a different logsta… --- ## [Kv filter with empty value](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267)
**Author:** [@sebGA](https://discuss.elastic.co/u/sebGA)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 10:21am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267 "2015-12-03T10:21:46Z")
Hi, When using the logstash kv filter with default parameters ( kv { } ), i have problem when parsing a message with empty values. See the following examples. The result in the first one is not good as the value associ… --- ## [Sort multi\_match query by exact matches first](https://discuss.elastic.co/t/sort-multi-match-query-by-exact-matches-first/15468)
**Author:** [@morninlark](https://discuss.elastic.co/u/morninlark)\ **Replies:** 2\ **Last updated:** [January 29, 2014, 1:58pm UTC](https://discuss.elastic.co/t/sort-multi-match-query-by-exact-matches-first/15468 "2014-01-29T13:58:57Z")
Hi there, I am executing the following query: { "from":0, "size":5, "explain": "true", "query":{ "bool":{ "must":\[ { "multi\_match":{ … --- ## [Fail-over strategy and avoid duplication of events for multiple winlogbeat sending same events to elasticsearch using Windows Event Collector](https://discuss.elastic.co/t/fail-over-strategy-and-avoid-duplication-of-events-for-multiple-winlogbeat-sending-same-events-to-elasticsearch-using-windows-event-collector/239095)
**Author:** [@sid159](https://discuss.elastic.co/u/sid159)\ **Replies:** 3\ **Last updated:** [July 1, 2020, 7:08am UTC](https://discuss.elastic.co/t/fail-over-strategy-and-avoid-duplication-of-events-for-multiple-winlogbeat-sending-same-events-to-elasticsearch-using-windows-event-collector/239095 "2020-07-01T07:08:49Z")
Background (Infrastructure) Events were collected from about thousands of machine on centralize Windows Event Collector (WEC) server. Windows Event Forwarder configure using GPO to collect events of each machine on WEC.… --- ## [Max shard size for a very large single index](https://discuss.elastic.co/t/max-shard-size-for-a-very-large-single-index/222751)
**Author:** [@jkhere](https://discuss.elastic.co/u/jkhere)\ **Replies:** 4\ **Last updated:** [March 10, 2020, 3:44pm UTC](https://discuss.elastic.co/t/max-shard-size-for-a-very-large-single-index/222751 "2020-03-10T15:44:42Z")
I am planning to develop an elasticsearch cluster to stand up a very massive index. The main usecase is to index documents and search using keywords. We estimate the size of the index to be 16TB. So if I keep single sha… --- ## [Logstashにて、シスログ結合について](https://discuss.elastic.co/t/logstash/184293)
**Author:** [@Negi700](https://discuss.elastic.co/u/Negi700)\ **Replies:** 4\ **Last updated:** [June 6, 2019, 9:11am UTC](https://discuss.elastic.co/t/logstash/184293 "2019-06-06T09:11:27Z")
違うサーバのsyslogを1つに、結合させたいのですが、Logstashのfilterで可能でしょうか？ Logstashのバージョン6.5.3 目的 複数のシスログを1つにまとめて、1つのgrok\_exporterで対応させたいです。 シスログごとに、複数のgrok\_exporter、起動させたくないため。 よろしくお願いします。 --- ## [Possible to override beat.hostname in local metricbeat](https://discuss.elastic.co/t/possible-to-override-beat-hostname-in-local-metricbeat/115116)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [January 16, 2018, 9:27am UTC](https://discuss.elastic.co/t/possible-to-override-beat-hostname-in-local-metricbeat/115116 "2018-01-16T09:27:02Z")
I wondered if I could override default value of beat.hostname in metricbeat.yml as I have classing short hostnames? --- ## [Will Elasticsearch run on 0.5gb memory?](https://discuss.elastic.co/t/will-elasticsearch-run-on-0-5gb-memory/97309)
**Author:** [@mortenbock](https://discuss.elastic.co/u/mortenbock)\ **Replies:** 4\ **Last updated:** [August 17, 2017, 10:56am UTC](https://discuss.elastic.co/t/will-elasticsearch-run-on-0-5gb-memory/97309 "2017-08-17T10:56:41Z")
Hi. I am running a low budget website, that is sitting on a windows VM with 2gb of ram. The current memory footprint of the OS and website in total is around 1.3 gb. The reason I want to use Elasticsearch is to have f… --- ## [No geoip points in kibana map](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 8\ **Last updated:** [September 14, 2022, 11:38am UTC](https://discuss.elastic.co/t/no-geoip-points-in-kibana-map/314145 "2022-09-14T11:38:16Z")
Hello everyone and welcome to another rooky question :smiley: In a very simple logstash pipeline, I want to enter via stdin an ipv4 address and ship it to elasticsearch...than get the geoip location drawn on a map. How… --- ## [Inconsistent response code from heartbeat and curl command from same machine](https://discuss.elastic.co/t/inconsistent-response-code-from-heartbeat-and-curl-command-from-same-machine/211793)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 8\ **Last updated:** [December 16, 2019, 7:34pm UTC](https://discuss.elastic.co/t/inconsistent-response-code-from-heartbeat-and-curl-command-from-same-machine/211793 "2019-12-16T19:34:50Z")
Hi, I'm facing an issue where heartbeat 7.5 reports a different response code (500) value than cUrl (302) reports on the same target URL I believe the heartbeat can me mimicked through curl -Iv. Below the heartbeat conf… --- ## [Help: How to filter unwanted metadata and fields from filebeats](https://discuss.elastic.co/t/help-how-to-filter-unwanted-metadata-and-fields-from-filebeats/245685)
**Author:** [@Moksha20](https://discuss.elastic.co/u/Moksha20)\ **Replies:** 6\ **Last updated:** [September 10, 2020, 6:18am UTC](https://discuss.elastic.co/t/help-how-to-filter-unwanted-metadata-and-fields-from-filebeats/245685 "2020-09-10T06:18:10Z")
I am very new to this filebeat shipping thing. Once I ship the log to kibana I am getting so many meta data field both for kibana and filebeat...now I can filter it in kibana visualization but is there any way to filter… --- ## [Strange Fluent-Bit logs](https://discuss.elastic.co/t/strange-fluent-bit-logs/167881)
**Author:** [@JDev](https://discuss.elastic.co/u/JDev)\ **Replies:** 2\ **Last updated:** [February 12, 2019, 1:03pm UTC](https://discuss.elastic.co/t/strange-fluent-bit-logs/167881 "2019-02-12T13:03:38Z")
As a log collector, I installed fluent-bit. It is installed on each node of the cluster. All right. He sends logs to elastic. I see them. All OK! But if i look in the log of fluent-bit pod, then I see the following. I… --- ## [Is there anyway collect logs from HP-UX hosts?](https://discuss.elastic.co/t/is-there-anyway-collect-logs-from-hp-ux-hosts/81505)
**Author:** [@ajeevpk](https://discuss.elastic.co/u/ajeevpk)\ **Replies:** 2\ **Last updated:** [April 7, 2017, 4:14pm UTC](https://discuss.elastic.co/t/is-there-anyway-collect-logs-from-hp-ux-hosts/81505 "2017-04-07T16:14:08Z")
As far as i know, beats not supported in HP-UX... i need to send logs from HP-UX hosts to Logstash/ES server... What is the best approach? please suggest, thanks in advance... Regards, Ajeev --- ## [COMMONAPACHELOG vs Explicit replacement](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318)
**Author:** [@jmota](https://discuss.elastic.co/u/jmota)\ **Replies:** 3\ **Last updated:** [April 17, 2019, 3:41pm UTC](https://discuss.elastic.co/t/commonapachelog-vs-explicit-replacement/177318 "2019-04-17T15:41:24Z")
gi, can some1 help with this one ? ( ES 7, LS 7) if i use COMMONAPACHELOG logstash works ... if i replace it for its "long version" gives me an error... ( i only use 1 at a time, cant edit the coments) full pattern… --- ## [@timestamp long vs. string format](https://discuss.elastic.co/t/timestamp-long-vs-string-format/345663)
**Author:** [@tlacuache](https://discuss.elastic.co/u/tlacuache)\ **Replies:** 7\ **Last updated:** [October 24, 2023, 9:37pm UTC](https://discuss.elastic.co/t/timestamp-long-vs-string-format/345663 "2023-10-24T21:37:43Z")
I'm working on a project that has a few different components that both write documents to the same indices. One of these components is Arkime, which writes its documents' @timestamp date as UNIX milliseconds value. This … --- ## [Discoverにおけるハイフンを含む文字列の検索について](https://discuss.elastic.co/t/discover/299817)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [March 22, 2022, 9:13am UTC](https://discuss.elastic.co/t/discover/299817 "2022-03-22T09:13:23Z")
ドキュメント内のあるフィールドに、ハイフンを含む文字列があります。 フィールド名：fieldA 値：su su-l su-a Discover画面にて前方一致で「su-」から始まるものを検索したいのですが、想定通りの検索が出来ませんでした。 下記、Discoverでの指定条件と結果になります。 fieldA:"su-l" →su-lのフィールドのみマッチ fieldA:"su\*" →su、su-l、su-aがマッチ f… --- ## [How to get the recent snapshot of my dashboard as a picture/pdf to send to Slack?](https://discuss.elastic.co/t/how-to-get-the-recent-snapshot-of-my-dashboard-as-a-picture-pdf-to-send-to-slack/210585)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 7\ **Last updated:** [January 15, 2020, 8:58pm UTC](https://discuss.elastic.co/t/how-to-get-the-recent-snapshot-of-my-dashboard-as-a-picture-pdf-to-send-to-slack/210585 "2020-01-15T20:58:23Z")
I would like to receive the recent picture of my graphs (not manually; automated) and post the image URL to my slack for my team to view. Is that possible to do using Elasticsearch Watcher? I am also working with Slack … --- ## [Spring Boot instrumentation only discovers @Controller classes](https://discuss.elastic.co/t/spring-boot-instrumentation-only-discovers-controller-classes/178934)
**Author:** [@tiagoveigalazaro](https://discuss.elastic.co/u/tiagoveigalazaro)\ **Replies:** 7\ **Last updated:** [May 8, 2019, 1:12pm UTC](https://discuss.elastic.co/t/spring-boot-instrumentation-only-discovers-controller-classes/178934 "2019-05-08T13:12:34Z")
Hi all, We are evaluating Elastic APM as the APM solution for a newly built project at a customer. The experience so far has been great, with a small nuance. We are using Spring Boot with a three-tier approach: @Contro… --- ## [Failed to decode scrollId](https://discuss.elastic.co/t/failed-to-decode-scrollid/43663)
**Author:** [@rraghuvittal](https://discuss.elastic.co/u/rraghuvittal)\ **Replies:** 1\ **Last updated:** [March 9, 2016, 9:14am UTC](https://discuss.elastic.co/t/failed-to-decode-scrollid/43663 "2016-03-09T09:14:24Z")
Hi All, I have to retrieve all the id's using single query. I am trying to use the scroll functionality it is giving me "Failed to decode Scroll Id". Getting the scroll Id by using the below GET gfrc\_v0c\_001/\_sear… --- ## [Filebeat and CentOS 5](https://discuss.elastic.co/t/filebeat-and-centos-5/43308)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 12:10pm UTC](https://discuss.elastic.co/t/filebeat-and-centos-5/43308 "2016-03-03T12:10:57Z")
As described in this post (https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801), neither filebeat nor logstash work with CentOS 5 kernel 2.6.18-408. I have several machines with this ker… --- ## [Range queries with custom format dates](https://discuss.elastic.co/t/range-queries-with-custom-format-dates/292852)
**Author:** [@vincen.zo](https://discuss.elastic.co/u/vincen.zo)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 10:31am UTC](https://discuss.elastic.co/t/range-queries-with-custom-format-dates/292852 "2022-01-14T10:31:07Z")
Hi, I am having some troubles using single and multiple range clauses in queries with date fields that use dynamic mappings. I frist create an empty index with the following dynamic mappings, including a custom date fo… --- ## [Create automatic indexes per client per day automatically](https://discuss.elastic.co/t/create-automatic-indexes-per-client-per-day-automatically/289148)
**Author:** [@stasya](https://discuss.elastic.co/u/stasya)\ **Replies:** 4\ **Last updated:** [November 15, 2021, 5:14am UTC](https://discuss.elastic.co/t/create-automatic-indexes-per-client-per-day-automatically/289148 "2021-11-15T05:14:38Z")
Hi All, I am writing the following documents structure into my Elasticsearch: { "date":"2021-11-03", "clientId":"123", ... \ } What I would like to happen, is that whenever a document is written to E… --- ## [Modify documents of a datastream index](https://discuss.elastic.co/t/modify-documents-of-a-datastream-index/271490)
**Author:** [@Reggaeny](https://discuss.elastic.co/u/Reggaeny)\ **Replies:** 4\ **Last updated:** [May 3, 2021, 10:47pm UTC](https://discuss.elastic.co/t/modify-documents-of-a-datastream-index/271490 "2021-05-03T22:47:45Z")
Coming from classic SQL and NoSql databases, I thought it must be possible to change documents in Elasticsearch datastream indexes. The first attempt via update\_by\_query (REST-Api) worked in the test but not in productiv… --- ## [Trouble with AD group mappings](https://discuss.elastic.co/t/trouble-with-ad-group-mappings/77887)
**Author:** [@cisaksen](https://discuss.elastic.co/u/cisaksen)\ **Replies:** 4\ **Last updated:** [March 8, 2017, 10:35pm UTC](https://discuss.elastic.co/t/trouble-with-ad-group-mappings/77887 "2017-03-08T22:35:15Z")
I have successfully add a AD realm to elastic search and I'm able to login into kibana with an AD account but I'm having trouble with the group mappings. I have created a group in kibana "its-admin" with all privilege… --- ## [Beat not creating index on start](https://discuss.elastic.co/t/beat-not-creating-index-on-start/65696)
**Author:** [@tostasqb](https://discuss.elastic.co/u/tostasqb)\ **Replies:** 4\ **Last updated:** [November 11, 2016, 12:34pm UTC](https://discuss.elastic.co/t/beat-not-creating-index-on-start/65696 "2016-11-11T12:34:26Z")
Just started using Beats and Version 5. After installing filebeat and metricbeat on my mac, when starting either one I'm getting the following systematic error: 2016/11/10 15:50:37.490503 client.go:420: WARN Can not … --- ## [Logstash timestamp - not reading timestamp from log files](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256)
**Author:** [@bgrzinic](https://discuss.elastic.co/u/bgrzinic)\ **Replies:** 4\ **Last updated:** [February 23, 2016, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256 "2016-02-23T13:16:51Z")
Hi guys, wandering if anybody can help with advice, suggestion on configuring logstash for properly reading timestamp from custom log files. I use logstash to read custom logs and forward to Elasticssearch - in the end… --- ## [Can I create a visualization using a list of specific values for a field?](https://discuss.elastic.co/t/can-i-create-a-visualization-using-a-list-of-specific-values-for-a-field/95898)
**Author:** [@JoeyMarinello](https://discuss.elastic.co/u/JoeyMarinello)\ **Replies:** 1\ **Last updated:** [August 4, 2017, 7:42pm UTC](https://discuss.elastic.co/t/can-i-create-a-visualization-using-a-list-of-specific-values-for-a-field/95898 "2017-08-04T19:42:48Z")
Hi all, I have a subset of ID’s (700 out of 4000 users) that I am trying to return. Is there a way I can make a data table visualization using specific values for a field instead of all of them? Thank you for your time… --- ## [Calculate and visualize from two indices](https://discuss.elastic.co/t/calculate-and-visualize-from-two-indices/139690)
**Author:** [@someOne](https://discuss.elastic.co/u/someOne)\ **Replies:** 6\ **Last updated:** [July 18, 2018, 2:20pm UTC](https://discuss.elastic.co/t/calculate-and-visualize-from-two-indices/139690 "2018-07-18T14:20:37Z")
In my use case One index is sales history like: BranchID ItemID Prices Sale\_date PA1100 O18740 75 4/11/2018 PA6840 P25400 100 4/11/2018 .. .. .. .. And the other is … --- ## [Array, Object ou Nested, lequel apporte de meilleures performance?](https://discuss.elastic.co/t/array-object-ou-nested-lequel-apporte-de-meilleures-performance/32021)
**Author:** [@Christophe\_Rosko](https://discuss.elastic.co/u/Christophe_Rosko)\ **Replies:** 6\ **Last updated:** [October 15, 2015, 10:51am UTC](https://discuss.elastic.co/t/array-object-ou-nested-lequel-apporte-de-meilleures-performance/32021 "2015-10-15T10:51:20Z")
Hello ! J'ai dans mon index un champ qui représente les pays dans lesquels nos vidéos peuvent être diffusées. Pour chaque pays la valeur peut être 0, 1 ou 2. Tous les pays ne sont pas inclus dans le champ. Par exemple … --- ## [Alerting if a beat is down](https://discuss.elastic.co/t/alerting-if-a-beat-is-down/252308)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 3\ **Last updated:** [October 23, 2020, 6:26am UTC](https://discuss.elastic.co/t/alerting-if-a-beat-is-down/252308 "2020-10-23T06:26:04Z")
Hello, I have many beats running in different hosts. I need to monitor these agents so I' ve enabled the xpack.monitoring and now I can see event rate, fail rate, cpu util etc. in Kibana. Can I Somehow create alerts for… --- ## [Any better solution to make elastic agent DaemonSet collect log smoothly?](https://discuss.elastic.co/t/any-better-solution-to-make-elastic-agent-daemonset-collect-log-smoothly/334763)
**Author:** [@Kelvin\_Chan](https://discuss.elastic.co/u/Kelvin_Chan)\ **Replies:** 8\ **Last updated:** [June 18, 2023, 12:41pm UTC](https://discuss.elastic.co/t/any-better-solution-to-make-elastic-agent-daemonset-collect-log-smoothly/334763 "2023-06-18T12:41:42Z")
I deployed a elastic agent DaemonSet to monitor elasticsearch cluster, but elastic agent mounts /var/log/containers, /var/log/pods, /var/lib/docker/containers to read container log, but these log files are only contain c… --- ## [Filebeat dashboard creation via Docker errors on Kibana host](https://discuss.elastic.co/t/filebeat-dashboard-creation-via-docker-errors-on-kibana-host/110951)
**Author:** [@claflico](https://discuss.elastic.co/u/claflico)\ **Replies:** 3\ **Last updated:** [December 11, 2017, 3:49pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-creation-via-docker-errors-on-kibana-host/110951 "2017-12-11T15:49:53Z")
Trying to setup an ELK:6.0.1 stack and \*beat:6.0.1 via CentOS 7, Docker 17.09, & Rancher 1.6.12 for a presentation I'm giving this week at a DevOps MeetUp. Am trying to set everything up without having to create custom i… --- ## [Authentication of \[elastic\] was terminated by realm \[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235)
**Author:** [@Pablo\_Andres\_Santama](https://discuss.elastic.co/u/Pablo_Andres_Santama)\ **Replies:** 0\ **Last updated:** [May 6, 2021, 3:43am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/272235 "2021-05-06T03:43:01Z")
Hello All I have a cluster which was running in 7.7.0 version without issues and I just update it to 7.12.1 version and when I scale out the cluster the new instance is able to join the cluster but after a minute shows … [Previous page](https://discuss.elastic.co/top.md?page=816&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=818&per_page=50&period=all)