# Top **URL:** https://discuss.elastic.co/top.md?page=819&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 820 --- ## [Beats writing logs to messages](https://discuss.elastic.co/t/beats-writing-logs-to-messages/205144)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [November 13, 2019, 1:59pm UTC](https://discuss.elastic.co/t/beats-writing-logs-to-messages/205144 "2019-11-13T13:59:16Z")
Hi Team, Even though I've setting for writing beat logs to file its still writing the logs to messages only. Below is the config for metricbeat i have the same for filebeat too. But both writing ton of logs to /var/logs… --- ## [\[WINLOGBEAT\] - Event :Delete folder or file](https://discuss.elastic.co/t/winlogbeat-event-delete-folder-or-file/224401)
**Author:** [@ekaduk](https://discuss.elastic.co/u/ekaduk)\ **Replies:** 3\ **Last updated:** [March 23, 2020, 10:06am UTC](https://discuss.elastic.co/t/winlogbeat-event-delete-folder-or-file/224401 "2020-03-23T10:06:13Z")
Hi, I'm a newbie user. I'd like to know if it could be possible to register a deletion of a file/folder in Windows, and then register it with winlogbeat. I've read the documentation about winlogbeat and I can't find so… --- ## [Aggregate query count having count](https://discuss.elastic.co/t/aggregate-query-count-having-count/206769)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [November 12, 2019, 3:43pm UTC](https://discuss.elastic.co/t/aggregate-query-count-having-count/206769 "2019-11-12T15:43:32Z")
I need to create visualisation 4 lines (I want to identify how many customers in time are using how many devices) count (unique customer) having count(uniqued deviceid) = 2 count (unique customer) having count(uniqu… --- ## [Vega doesn't show/visualize any data from elasticsearch](https://discuss.elastic.co/t/vega-doesnt-show-visualize-any-data-from-elasticsearch/178443)
**Author:** [@LjupchoStefanov](https://discuss.elastic.co/u/LjupchoStefanov)\ **Replies:** 3\ **Last updated:** [April 26, 2019, 7:50am UTC](https://discuss.elastic.co/t/vega-doesnt-show-visualize-any-data-from-elasticsearch/178443 "2019-04-26T07:50:45Z")
Kibana version: 6.7.0 Elasticsearch version: 6.7.0 Original install method (e.g. download page, yum, from source, etc.): docker Information about experience and what I am trying to achive: I do not have a lot of exper… --- ## [ElasticSearch service will not stay running after rolling upgrade to 6.2.2-1](https://discuss.elastic.co/t/elasticsearch-service-will-not-stay-running-after-rolling-upgrade-to-6-2-2-1/121536)
**Author:** [@msterne](https://discuss.elastic.co/u/msterne)\ **Replies:** 3\ **Last updated:** [February 27, 2018, 6:21pm UTC](https://discuss.elastic.co/t/elasticsearch-service-will-not-stay-running-after-rolling-upgrade-to-6-2-2-1/121536 "2018-02-27T18:21:42Z")
So, I'd like to start this off by making perfectly clear that I am very inexperienced with Linux (we have CentOS7) and Elasticsearch. I have inherited a complete ElasticSearch, Logstash and Kibana environment and have be… --- ## [Java API\[5.0\] Multiple range queries](https://discuss.elastic.co/t/java-api-5-0-multiple-range-queries/68554)
**Author:** [@girish\_pathak](https://discuss.elastic.co/u/girish_pathak)\ **Replies:** 3\ **Last updated:** [December 12, 2016, 2:34pm UTC](https://discuss.elastic.co/t/java-api-5-0-multiple-range-queries/68554 "2016-12-12T14:34:36Z")
Is it possible to add multiple range queries using the Java API\[5.0\] ? --- ## [Graph returns Unauthorized!](https://discuss.elastic.co/t/graph-returns-unauthorized/65463)
**Author:** [@S\_M](https://discuss.elastic.co/u/S_M)\ **Replies:** 3\ **Last updated:** [November 9, 2016, 1:02pm UTC](https://discuss.elastic.co/t/graph-returns-unauthorized/65463 "2016-11-09T13:02:12Z")
Hi every one, Regarding my last installation and integration of Graph for my Elastic software stack (including elasticsearch 2.3.5, kibana 4.5.4 and logstash 2.3.3)​, I get an Unauthorized exception for any call in Gra… --- ## [Optimal Index size](https://discuss.elastic.co/t/optimal-index-size/4084)
**Author:** [@davrob](https://discuss.elastic.co/u/davrob)\ **Replies:** 3\ **Last updated:** [March 12, 2011, 6:56pm UTC](https://discuss.elastic.co/t/optimal-index-size/4084 "2011-03-12T18:56:40Z")
Hi, I have read some threads about spliting indexes up and giving them all the same alias in order to improve refresh and other performance. Does anyone have an indication of an ideal index size for best performa… --- ## [How to test malware protection?](https://discuss.elastic.co/t/how-to-test-malware-protection/249850)
**Author:** [@0xDECAFBAD](https://discuss.elastic.co/u/0xDECAFBAD)\ **Replies:** 2\ **Last updated:** [September 28, 2020, 2:20am UTC](https://discuss.elastic.co/t/how-to-test-malware-protection/249850 "2020-09-28T02:20:01Z")
From what I read it sounds like Endgame malware protection is definition-less? Is that correct? Is it based solely on behavioral analysis? I'm testing out Elastic Security, just pushed my first Elastic Endpoint deploymen… --- ## [What does size\_in\_bytes include?](https://discuss.elastic.co/t/what-does-size-in-bytes-include/40237)
**Author:** [@Pat\_Humphreys](https://discuss.elastic.co/u/Pat_Humphreys)\ **Replies:** 2\ **Last updated:** [January 27, 2016, 2:15pm UTC](https://discuss.elastic.co/t/what-does-size-in-bytes-include/40237 "2016-01-27T14:15:26Z")
Does the "size\_in\_bytes" value returned from \_stats include replicas or is it just primary data? --- ## [Can we fill up some variable dynamically using jSON field?](https://discuss.elastic.co/t/can-we-fill-up-some-variable-dynamically-using-json-field/116765)
**Author:** [@jpereira](https://discuss.elastic.co/u/jpereira)\ **Replies:** 5\ **Last updated:** [January 29, 2018, 7:47pm UTC](https://discuss.elastic.co/t/can-we-fill-up-some-variable-dynamically-using-json-field/116765 "2018-01-29T19:47:39Z")
Hi there, In my system, we have several log types/levels that are based on the name "log\_type", e.g: "python\_log", "cache\_log", ... that are coming to the single log file "mylog.log" I am wondering to do something like… --- ## [ILM phase don't delete indexes, only clean up](https://discuss.elastic.co/t/ilm-phase-dont-delete-indexes-only-clean-up/261440)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 7\ **Last updated:** [January 27, 2021, 12:12pm UTC](https://discuss.elastic.co/t/ilm-phase-dont-delete-indexes-only-clean-up/261440 "2021-01-27T12:12:09Z")
I cretaed ILM policy for two steps. It's hot and delete. full template PUT \_ilm/policy/logstash-f-lb { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": {… --- ## [Elasticsearch - Poor cluster performance and stability](https://discuss.elastic.co/t/elasticsearch-poor-cluster-performance-and-stability/184846)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 7\ **Last updated:** [June 20, 2019, 8:48am UTC](https://discuss.elastic.co/t/elasticsearch-poor-cluster-performance-and-stability/184846 "2019-06-20T08:48:54Z")
Hello, I'm running a 27 nodes cluster (21 data nodes, 3 masters 3 kibanas) which stores around 60TB (10k total shards). Data nodes+kibanas 30GB heap, masters 8GB. RPM based installed cluster on physical Centos 7 serve… --- ## [Issues installing Auditbeat on Oracle Linux and Red Hat](https://discuss.elastic.co/t/issues-installing-auditbeat-on-oracle-linux-and-red-hat/147847)
**Author:** [@homood](https://discuss.elastic.co/u/homood)\ **Replies:** 1\ **Last updated:** [September 10, 2018, 7:26pm UTC](https://discuss.elastic.co/t/issues-installing-auditbeat-on-oracle-linux-and-red-hat/147847 "2018-09-10T19:26:27Z")
I am trying to install Auditbeat on Oracle Linux 6.8 and Red Hat 7.5 but I can't run the service after installation. The following are the error messages I get: On Oracle Linux: 2018-09-03T09:04:49.775+0300 INFO … --- ## [Problème d'affichage des points dans Kibana](https://discuss.elastic.co/t/probleme-daffichage-des-points-dans-kibana/50706)
**Author:** [@windaubes](https://discuss.elastic.co/u/windaubes)\ **Replies:** 7\ **Last updated:** [May 24, 2016, 10:16am UTC](https://discuss.elastic.co/t/probleme-daffichage-des-points-dans-kibana/50706 "2016-05-24T10:16:43Z")
Bonjour, Je suis débutant sur ELK. J'ai actuellement une infra: logstash /redis logstash/elasticsearch/kibana Hors dans kibana, je me retrouve avec le champ message dont tous les "." remplacé par des "," Je n'ai… --- ## [Logstash.conf for Docker, Logspout, journal, syslog?](https://discuss.elastic.co/t/logstash-conf-for-docker-logspout-journal-syslog/23874)
**Author:** [@cgswong](https://discuss.elastic.co/u/cgswong)\ **Replies:** 1\ **Last updated:** [August 20, 2015, 5:47pm UTC](https://discuss.elastic.co/t/logstash-conf-for-docker-logspout-journal-syslog/23874 "2015-08-20T17:47:17Z")
I'm creating a logstash.conf file to filter input from Docker logs, Logspout, CoreOS systemd journal and syslog and was hoping if anyone could share their validated logstash.conf file which does any of these please? I … --- ## [Fine-grained security for ES-based API](https://discuss.elastic.co/t/fine-grained-security-for-es-based-api/7844)
**Author:** [@Shane\_Witbeck](https://discuss.elastic.co/u/Shane_Witbeck)\ **Replies:** 7\ **Last updated:** [November 20, 2013, 9:18am UTC](https://discuss.elastic.co/t/fine-grained-security-for-es-based-api/7844 "2013-11-20T09:18:23Z")
I'm building a minimal abstraction around ES to accomplish fine-grained security control around searches based on indexed fields. The requirements are: 1. allow users to query ES via search but only return inde… --- ## [\[Theory\] Improving search result relevance?](https://discuss.elastic.co/t/theory-improving-search-result-relevance/9855)
**Author:** [@polyfractal](https://discuss.elastic.co/u/polyfractal)\ **Replies:** 7\ **Last updated:** [February 12, 2013, 8:28am UTC](https://discuss.elastic.co/t/theory-improving-search-result-relevance/9855 "2013-02-12T08:28:33Z")
I'm curious about some practical tips to improve search result relevance. Currently, I'm tokenizing my fields with shingles and performing a simple "text" search on the shingled field. I've found this gives better … --- ## [Writing of registry returned error:](https://discuss.elastic.co/t/writing-of-registry-returned-error/216651)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 4\ **Last updated:** [January 28, 2020, 10:10am UTC](https://discuss.elastic.co/t/writing-of-registry-returned-error/216651 "2020-01-28T10:10:13Z")
Hi, I get the following error constantly no matter what I do: Writing of registry returned error: rename /var/lib/filebeat/registry/filebeat/data.json.new /var/lib/filebeat/registry/filebeat/data.json: no such file or … --- ## [Cannot get nodes to join same cluster](https://discuss.elastic.co/t/cannot-get-nodes-to-join-same-cluster/183796)
**Author:** [@perezjasonr](https://discuss.elastic.co/u/perezjasonr)\ **Replies:** 4\ **Last updated:** [June 1, 2019, 11:24am UTC](https://discuss.elastic.co/t/cannot-get-nodes-to-join-same-cluster/183796 "2019-06-01T11:24:57Z")
Ive been going in circles for days now cannot get these two nodes to join the same cluster, any help would be appreciated: config for node 1: cluster.name: my-elastic node.name: node-1 path.data: /var/lib/elasticsearch… --- ## [Plot time vs data](https://discuss.elastic.co/t/plot-time-vs-data/43470)
**Author:** [@hursto75](https://discuss.elastic.co/u/hursto75)\ **Replies:** 4\ **Last updated:** [March 4, 2016, 6:08pm UTC](https://discuss.elastic.co/t/plot-time-vs-data/43470 "2016-03-04T18:08:12Z")
I am having a hard time getting kibana to plot a very simple graph timstamp vs value of a point. All I can get it to do is plot the number of data points with that value. I have a data set that was brought in from a csv … --- ## [Scroll/Scan API, pockets of slow responses while scrolling](https://discuss.elastic.co/t/scroll-scan-api-pockets-of-slow-responses-while-scrolling/24571)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 4\ **Last updated:** [June 30, 2015, 1:46pm UTC](https://discuss.elastic.co/t/scroll-scan-api-pockets-of-slow-responses-while-scrolling/24571 "2015-06-30T13:46:18Z")
Using ES 1.6.0 I have the following query using Transport Client client.prepareSearch("my-index").setTypes("my-type") .setQuery(query.getBytes()) .setSearchType(SearchType.SCAN) .addFields( "my-fiel… --- ## [What Does '0-all' Mean?](https://discuss.elastic.co/t/what-does-0-all-mean/6574)
**Author:** [@Kenneth\_Loafman](https://discuss.elastic.co/u/Kenneth_Loafman)\ **Replies:** 4\ **Last updated:** [February 5, 2012, 4:03pm UTC](https://discuss.elastic.co/t/what-does-0-all-mean/6574 "2012-02-05T16:03:54Z")
Hi, What does the setting '0-all' mean as a value to auto\_expand\_replicas? Is there a '1-all'? 'N-all'? BTW, '0-all' makes a lousy search term. Too much noise. ...Thanks, ...Ken --- ## [Logstash log4j2.properties configuration for pipeline logs](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-pipeline-logs/278612)
**Author:** [@Kshema](https://discuss.elastic.co/u/Kshema)\ **Replies:** 3\ **Last updated:** [July 19, 2021, 11:11am UTC](https://discuss.elastic.co/t/logstash-log4j2-properties-configuration-for-pipeline-logs/278612 "2021-07-19T11:11:10Z")
In our application, logstash.yml is configured to produce separate log files for each pipeline with the help of below property pipeline.separate\_logs: true This configuration setup is creating the below mentioned logs: … --- ## [Analyzer \[default\_analyzer\] not found for field \[stateNames\]](https://discuss.elastic.co/t/analyzer-default-analyzer-not-found-for-field-statenames/220595)
**Author:** [@Raady\_s](https://discuss.elastic.co/u/Raady_s)\ **Replies:** 3\ **Last updated:** [February 25, 2020, 8:17am UTC](https://discuss.elastic.co/t/analyzer-default-analyzer-not-found-for-field-statenames/220595 "2020-02-25T08:17:23Z")
I am trying to copy data from my old elastic to a new elastic. So, I was copy the mapping and setting of the index. {"mappings":{"profile":{"properties":{"Address":{"type":"text","analyzer":"default\_analyzer"},"Candidat… --- ## [Logstash is losing messages](https://discuss.elastic.co/t/logstash-is-losing-messages/44359)
**Author:** [@woytekm](https://discuss.elastic.co/u/woytekm)\ **Replies:** 3\ **Last updated:** [March 14, 2016, 9:16pm UTC](https://discuss.elastic.co/t/logstash-is-losing-messages/44359 "2016-03-14T21:16:50Z")
Hello, i have built ELK solution for processing/storing/visualizing syslog data from certain number of highly utilized Cisco ASA firewalls. My elasticsearch cluster setup is: 6 data nodes, one master and one client node.… --- ## [Grok parse error](https://discuss.elastic.co/t/grok-parse-error/33909)
**Author:** [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\ **Replies:** 3\ **Last updated:** [November 5, 2015, 9:05pm UTC](https://discuss.elastic.co/t/grok-parse-error/33909 "2015-11-05T21:05:46Z")
So I'm getting a parse error on my grok filter. I have gone to the following url to debug it: http://grokdebug.herokuapp.com/ My input is this: 66.249.69.48|-|2015-11-05T10:57:51-06:00|/northwest-a-tacs-camo-seat-cov… --- ## [Elasticsearch-jdbc plugin fetching only part of data when nesting documents](https://discuss.elastic.co/t/elasticsearch-jdbc-plugin-fetching-only-part-of-data-when-nesting-documents/600)
**Author:** [@askawinska](https://discuss.elastic.co/u/askawinska)\ **Replies:** 3\ **Last updated:** [May 13, 2015, 12:07pm UTC](https://discuss.elastic.co/t/elasticsearch-jdbc-plugin-fetching-only-part-of-data-when-nesting-documents/600 "2015-05-13T12:07:47Z")
Hi everyone, I have successfully employed elasticsearch-jdbc plugin to pump my data (in river mode) from a Postgres db. Everything ran smoothly until I tried to map my data from joined tables into nested documents - I… --- ## [Regex matching expression to exclude line](https://discuss.elastic.co/t/regex-matching-expression-to-exclude-line/157527)
**Author:** [@Miguel\_Leite](https://discuss.elastic.co/u/Miguel_Leite)\ **Replies:** 2\ **Last updated:** [November 20, 2018, 2:03pm UTC](https://discuss.elastic.co/t/regex-matching-expression-to-exclude-line/157527 "2018-11-20T14:03:40Z")
Hey! I want to exclude a line with filebeat, that is the following: (ERROR) Can't find TpTag 'TagUid' in TpPin Anyone knows how to match that full line with regular expressions? Those apostrophes aren't letting me sta… --- ## [How to use the .max() in timelion](https://discuss.elastic.co/t/how-to-use-the-max-in-timelion/102286)
**Author:** [@Cristian](https://discuss.elastic.co/u/Cristian)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 11:39am UTC](https://discuss.elastic.co/t/how-to-use-the-max-in-timelion/102286 "2017-10-06T11:39:54Z")
Hi All, I use this expression: Exp1 .es(\_exists\_:candles.highMid, timefield=candles.time,offset=-1d).if(eq, 0, null, .es(timefield=candles.time,offset=-1d,metric=sum:candles.highMid)).fit(average) and this expression… --- ## [Reason for Scale 1000000 for IIS event.duration](https://discuss.elastic.co/t/reason-for-scale-1000000-for-iis-event-duration/273762)
**Author:** [@danielw](https://discuss.elastic.co/u/danielw)\ **Replies:** 6\ **Last updated:** [May 24, 2021, 5:43pm UTC](https://discuss.elastic.co/t/reason-for-scale-1000000-for-iis-event-duration/273762 "2021-05-24T17:43:26Z")
I'm trying to figure out what is the reason for the scale of 1000000 when using the filebeat module for iis for the duration field. Seems a bit strange when trying to build a dashboard for Reponse Times where every value… --- ## [Soft\_deletes enabled maybe slow down the index performance](https://discuss.elastic.co/t/soft-deletes-enabled-maybe-slow-down-the-index-performance/254520)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 6\ **Last updated:** [November 6, 2020, 2:28pm UTC](https://discuss.elastic.co/t/soft-deletes-enabled-maybe-slow-down-the-index-performance/254520 "2020-11-06T14:28:32Z")
Hi, Our elasticsearch is on 6.8.0 when we use soft\_delete is enabled, we find that the index which indexing requests is mainly updates, so the segments bytes grow up more and more bigger, and docs.deleted count is more… --- ## [Unable to perform search query after 14 days](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487)
**Author:** [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\ **Replies:** 6\ **Last updated:** [December 6, 2018, 6:43am UTC](https://discuss.elastic.co/t/unable-to-perform-search-query-after-14-days/159487 "2018-12-06T06:43:25Z")
Hi All, I am able to search logs till 14 days in graylog but if I search for 30 days or 60 days it prompt could not execute search error. Please help me to solve this problem. Graylog version - 2.4.6 Elasticsearch… --- ## [Nested JSON flattened in Logstash Filter](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [August 16, 2021, 8:11am UTC](https://discuss.elastic.co/t/nested-json-flattened-in-logstash-filter/281502 "2021-08-16T08:11:47Z")
Hi, I am able to flatten at fields present in nested JSON excluding 3 fields that are present in double nested JSON. I need to flatten these fields so that I can create viz based on that such as Fields-"quantity", "rate… --- ## [ECE - license cost](https://discuss.elastic.co/t/ece-license-cost/162725)
**Author:** [@pinkesh.valdria](https://discuss.elastic.co/u/pinkesh.valdria)\ **Replies:** 1\ **Last updated:** [January 2, 2019, 11:37pm UTC](https://discuss.elastic.co/t/ece-license-cost/162725 "2019-01-02T23:37:47Z")
If I want to deploy ECE in a private cloud (on-prem or my own cloud account like Oracle OCI, AWS, GCP), is there a licensing fee or subscription free or its Apache open source free ? Also is there a separate support/ma… --- ## [How to add custom fields with eventlog on winlogbeat](https://discuss.elastic.co/t/how-to-add-custom-fields-with-eventlog-on-winlogbeat/49855)
**Author:** [@Muhasin\_Cm](https://discuss.elastic.co/u/Muhasin_Cm)\ **Replies:** 1\ **Last updated:** [May 12, 2016, 2:43pm UTC](https://discuss.elastic.co/t/how-to-add-custom-fields-with-eventlog-on-winlogbeat/49855 "2016-05-12T14:43:30Z")
Hi, I have added custom fields for eventlog security but the custom fields are not showing when it send to the logstash server. AM sending the data using winlogbeat from windows 10 home edition. --- ## [.nodes.process.cpu.percent meaning](https://discuss.elastic.co/t/nodes-process-cpu-percent-meaning/69071)
**Author:** [@Brandon\_Metcalf](https://discuss.elastic.co/u/Brandon_Metcalf)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 7:03pm UTC](https://discuss.elastic.co/t/nodes-process-cpu-percent-meaning/69071 "2016-12-14T19:03:50Z")
I'm trying to understand the meaning of the following: curl -s 'https://\/\_cluster/stats' | jq '. | {percent: .nodes.process.cpu.percent}' { "percent": 192 } How can this be larger than 100? Thanks. --- ## [Log4j input plugin](https://discuss.elastic.co/t/log4j-input-plugin/100104)
**Author:** [@xiaopeng\_zhang](https://discuss.elastic.co/u/xiaopeng_zhang)\ **Replies:** 5\ **Last updated:** [September 12, 2017, 12:55pm UTC](https://discuss.elastic.co/t/log4j-input-plugin/100104 "2017-09-12T12:55:10Z")
I know it's deprecated.i just wang to use it Conveniently. when i use it.it run normally.it doesn/t accept any log. input { log4j { mode =\> "server" port =\> 80 } } but when i use tcp .it get log and there are man… --- ## [Bucket\_script location](https://discuss.elastic.co/t/bucket-script-location/148366)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 2\ **Last updated:** [September 13, 2018, 5:02pm UTC](https://discuss.elastic.co/t/bucket-script-location/148366 "2018-09-13T17:02:59Z")
I would like to construct a query that would calculate a moving average. The working query is below. I need to do an initial query for the specific function to be analyzed. After that I am doing a four week from present … --- ## [Query string on float](https://discuss.elastic.co/t/query-string-on-float/91941)
**Author:** [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 3:59pm UTC](https://discuss.elastic.co/t/query-string-on-float/91941 "2017-07-05T15:59:58Z")
Hi all, I have documents with a float field defined as follows: "amount": { "type": "float" } When I get a document, I can see the field as follows: "amount": 9250 But if I do a query string like the followi… --- ## [Elasticsearch cause linux kernel crash](https://discuss.elastic.co/t/elasticsearch-cause-linux-kernel-crash/187461)
**Author:** [@john\_am](https://discuss.elastic.co/u/john_am)\ **Replies:** 8\ **Last updated:** [June 26, 2019, 8:09am UTC](https://discuss.elastic.co/t/elasticsearch-cause-linux-kernel-crash/187461 "2019-06-26T08:09:18Z")
Hi,guys, thanks for your reading my poor english. I got a situation that elasticsearch cause my linux kernel crash.However, what information i got from logs(linux messsage log) is Garbled. What's worse i found nothing … --- ## [\[solved\] Kubernetes – autodiscover and add\_kubermetes\_metadata only working partially](https://discuss.elastic.co/t/solved-kubernetes-autodiscover-and-add-kubermetes-metadata-only-working-partially/185438)
**Author:** [@c\_g](https://discuss.elastic.co/u/c_g)\ **Replies:** 3\ **Last updated:** [June 13, 2019, 10:46am UTC](https://discuss.elastic.co/t/solved-kubernetes-autodiscover-and-add-kubermetes-metadata-only-working-partially/185438 "2019-06-13T10:46:11Z")
Hi! Basically I'm trying to ship all logs from my k8s cluster, while adding kubernetes metadata to all containers and joining some multiline output on some of them. I only get the kubernetes: {}-data on some log lines,… --- ## [Scripted Field Percentage Calculation](https://discuss.elastic.co/t/scripted-field-percentage-calculation/144721)
**Author:** [@MichaelN](https://discuss.elastic.co/u/MichaelN)\ **Replies:** 3\ **Last updated:** [August 17, 2018, 5:53pm UTC](https://discuss.elastic.co/t/scripted-field-percentage-calculation/144721 "2018-08-17T17:53:11Z")
Hi all, I am trying to make a % calculation based on two fields. I made the following script: if (doc\['doc.contextMap.totalErrors.keyword'\].value != null && doc\['doc.contextMap.totalInput.keyword'\].value != null) { r… --- ## [Marvel reporting incorrect free disk space?](https://discuss.elastic.co/t/marvel-reporting-incorrect-free-disk-space/15515)
**Author:** [@Tony\_Su](https://discuss.elastic.co/u/Tony_Su)\ **Replies:** 8\ **Last updated:** [January 31, 2014, 10:54pm UTC](https://discuss.elastic.co/t/marvel-reporting-incorrect-free-disk-space/15515 "2014-01-31T22:54:14Z")
Deployed in a VMware environment. Data is being consumed and is successful from source to ES source \> logstash shipper(and parser) \> redis \> logstash \> es cluster ES Cluster All openSUSE 13.1 Machine 1 - 4GB … --- ## [Filebeat don't send send proper multiline messages on logstash](https://discuss.elastic.co/t/filebeat-dont-send-send-proper-multiline-messages-on-logstash/141323)
**Author:** [@mladen](https://discuss.elastic.co/u/mladen)\ **Replies:** 4\ **Last updated:** [July 26, 2018, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-dont-send-send-proper-multiline-messages-on-logstash/141323 "2018-07-26T12:20:09Z")
Hello, I have a problem with sending multiline log messages to Logstash using Filebeat. This is my Filebeat.yml configuration: filebeat.inputs: - type: log paths: - "/home/mladen/Desktop/qmraz2.log" fields: … --- ## [Filtering multiple logs](https://discuss.elastic.co/t/filtering-multiple-logs/68685)
**Author:** [@ilalorel](https://discuss.elastic.co/u/ilalorel)\ **Replies:** 4\ **Last updated:** [December 12, 2016, 11:01am UTC](https://discuss.elastic.co/t/filtering-multiple-logs/68685 "2016-12-12T11:01:21Z")
Hello i'm fairly new to logstash, so far i've managed to set up 2 servers, one is running the elastic stack and the other one is sending logs with beats to my elk stack. Now I have 2 different logs that i'm filtering bot… --- ## [Decode ascii hex from string or Convert Charset of a Field on the fly (filters)](https://discuss.elastic.co/t/decode-ascii-hex-from-string-or-convert-charset-of-a-field-on-the-fly-filters/51540)
**Author:** [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 10:14am UTC](https://discuss.elastic.co/t/decode-ascii-hex-from-string-or-convert-charset-of-a-field-on-the-fly-filters/51540 "2016-06-01T10:14:17Z")
I have a case, that a numb cliente sends me a http request with all UTF-8 chaset, but the payload comes with ascii hex, like: "\\x22", "\\xC3" "\\xA2", and so on... How can I DECODE only this string field, so I can procee… --- ## [Get number of days in a month to aggregate data](https://discuss.elastic.co/t/get-number-of-days-in-a-month-to-aggregate-data/206028)
**Author:** [@Quang\_D\_Tr\_n](https://discuss.elastic.co/u/Quang_D_Tr_n)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 7:40am UTC](https://discuss.elastic.co/t/get-number-of-days-in-a-month-to-aggregate-data/206028 "2019-11-06T07:40:59Z")
I am trying to get the number of days of a month from a timestamp field, and then, divide the one numeric field by this number of days. Right now, my implementation is like this: { "query" : {...}, "script\_fiel… --- ## [Need Help / Suggestion with Deleted Documents](https://discuss.elastic.co/t/need-help-suggestion-with-deleted-documents/42392)
**Author:** [@apmalik80](https://discuss.elastic.co/u/apmalik80)\ **Replies:** 6\ **Last updated:** [February 26, 2016, 8:40am UTC](https://discuss.elastic.co/t/need-help-suggestion-with-deleted-documents/42392 "2016-02-26T08:40:07Z")
Currently one of the index that we have shows the following stats The stats show that the total documents count is 2081 whereas a considerable amount of documents are marked as deleted. This has happened I think due… --- ## [Splunk vs Elastic Timechart \[Line/area\]](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 2\ **Last updated:** [April 10, 2019, 9:42am UTC](https://discuss.elastic.co/t/splunk-vs-elastic-timechart-line-area/175184 "2019-04-10T09:42:45Z")
We are migrating from Splunk to ELK. During this migration, I was transforming Splunk time chart into Kibana area chart. I found below basic difference between splunk and Elastic implementation for this. I am explaining … [Previous page](https://discuss.elastic.co/top.md?page=818&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=820&per_page=50&period=all)