# Top **URL:** https://discuss.elastic.co/top.md?page=83&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 84 --- ## [How to send ingest pipeline output to a index alias name](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 11\ **Last updated:** [May 23, 2021, 2:26pm UTC](https://discuss.elastic.co/t/how-to-send-ingest-pipeline-output-to-a-index-alias-name/273697 "2021-05-23T14:26:15Z")
Hi , I am trying to send ingest pipeline output to a index alias name , so that the index rollovers correctly. what is the required processor or how do we do this ? --- ## [Email configuration in logstash](https://discuss.elastic.co/t/email-configuration-in-logstash/1760)
**Author:** [@gaurav2090](https://discuss.elastic.co/u/gaurav2090)\ **Replies:** 12\ **Last updated:** [May 11, 2016, 9:27pm UTC](https://discuss.elastic.co/t/email-configuration-in-logstash/1760 "2016-05-11T21:27:59Z")
Hi, Below is my configuration file filter { if \[type\] == "sftp\_authlog" { grok { pattern =\> "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host\_target} sshd\[%{BASE10NUM}\]: Failed password for (invalid user |)%{USERNAME:… --- ## [Mutate beats field](https://discuss.elastic.co/t/mutate-beats-field/74940)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 9\ **Last updated:** [February 14, 2017, 5:55pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940 "2017-02-14T17:55:57Z")
I cannot seem to get this to work: mutate { add\_field =\> { "hostname" =\> "%{beat.hostname}" } } I used this template of code quite a bit and it is working just fine for other items. --- ## [Multiline filter fails on one record when handling a large file](https://discuss.elastic.co/t/multiline-filter-fails-on-one-record-when-handling-a-large-file/27401)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 11\ **Last updated:** [September 29, 2015, 1:50pm UTC](https://discuss.elastic.co/t/multiline-filter-fails-on-one-record-when-handling-a-large-file/27401 "2015-09-29T13:50:34Z")
Hi Logstasher's, I'm seeing some odd behaviour with Logstash when trying to read files with a multiline filter enabled. I noticed that occasionally I'll see a multiline log entry fail to get detected/tagged as multilin… --- ## [Vega: Handle a situation where data-set returned is empty](https://discuss.elastic.co/t/vega-handle-a-situation-where-data-set-returned-is-empty/262210)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 14\ **Last updated:** [January 30, 2021, 3:10pm UTC](https://discuss.elastic.co/t/vega-handle-a-situation-where-data-set-returned-is-empty/262210 "2021-01-30T15:10:06Z")
When querying for data, there are situations where the returned data-set is empty for certain time ranges. Such a situation occurred in Vega (returned an empty array) and I tried to create a condition using expressions t… --- ## [Use API of elasticsearch ? Change settings](https://discuss.elastic.co/t/use-api-of-elasticsearch-change-settings/80971)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 13\ **Last updated:** [April 5, 2017, 1:08pm UTC](https://discuss.elastic.co/t/use-api-of-elasticsearch-change-settings/80971 "2017-04-05T13:08:07Z")
Hello, I want increase performance of indexing, usage disk of elasticsearch. I don't know elk API Some questions stay without response (after reading the official doc) How Use bulk requests (I have for the moment,… --- ## [Search preference](https://discuss.elastic.co/t/search-preference/92147)
**Author:** [@Raul\_Uria](https://discuss.elastic.co/u/Raul_Uria)\ **Replies:** 9\ **Last updated:** [July 7, 2017, 11:44am UTC](https://discuss.elastic.co/t/search-preference/92147 "2017-07-07T11:44:53Z")
Hi, we´re facing strange behaviour in our two data nodes cluster. Using kibana, we monitor that only one node is involved in search (say node1). All queries are routed to that one! Monitoring kibana´s serach queries, '… --- ## [Apply grok pattern based on the log file path](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 40\ **Last updated:** [June 15, 2023, 4:29pm UTC](https://discuss.elastic.co/t/apply-grok-pattern-based-on-the-log-file-path/334395 "2023-06-15T16:29:21Z")
Hi Here is my logstash config file input { beats { port =\> 5044 } } output { elasticsearch { hosts =\> "http://ip:9200" index =\> "%{type}-%{+YYYY.MM.dd}" user =\> "elastic" password =\> "pwd" } … --- ## [Logstash Lookup Fields](https://discuss.elastic.co/t/logstash-lookup-fields/289357)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 35\ **Last updated:** [November 18, 2021, 6:30pm UTC](https://discuss.elastic.co/t/logstash-lookup-fields/289357 "2021-11-18T18:30:57Z")
i wanted to use a lookup table in Logstash to check if account id exisits in lookub table then it will grab the output location from the lookup file. e--g Lookup File account\_id, output\_location, secrets, 123, s3, abcde… --- ## [Unable to install plugin analysis-icu in elasticsearch/plugin](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935)
**Author:** [@Sharad\_Jain](https://discuss.elastic.co/u/Sharad_Jain)\ **Replies:** 13\ **Last updated:** [May 31, 2022, 9:50am UTC](https://discuss.elastic.co/t/unable-to-install-plugin-analysis-icu-in-elasticsearch-plugin/305935 "2022-05-31T09:50:13Z")
\< '$ Elasticsearch-7.14.0/bin/Elasticsearch-plugin install' 'file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-icu-7.14.0.zip' '-\> Installing file:///scratch/fccs812/Elasticsearch-7.14.0/plugins/analysis-ic… --- ## [Distributed locking within elasticsearch](https://discuss.elastic.co/t/distributed-locking-within-elasticsearch/5414)
**Author:** [@Steff](https://discuss.elastic.co/u/Steff)\ **Replies:** 11\ **Last updated:** [September 21, 2011, 7:43am UTC](https://discuss.elastic.co/t/distributed-locking-within-elasticsearch/5414 "2011-09-21T07:43:07Z")
Hi Does elasticsearch nodes have some kind of distributed locking framework running, so that they can take locks to prevent other processes (potentially on other nodes) from getting that same lock, and therefore … --- ## [Not sending logs to logstash](https://discuss.elastic.co/t/not-sending-logs-to-logstash/112278)
**Author:** [@Nich240](https://discuss.elastic.co/u/Nich240)\ **Replies:** 17\ **Last updated:** [January 18, 2018, 9:14pm UTC](https://discuss.elastic.co/t/not-sending-logs-to-logstash/112278 "2018-01-18T21:14:49Z")
We are having issue sending logs from filebeat to logstash. We do not see the network connections being made, nor errors. There is no firewall between the two components. Filebeat registry is showing files being inges… --- ## [Stack monitoring Error fetching alert status](https://discuss.elastic.co/t/stack-monitoring-error-fetching-alert-status/257240)
**Author:** [@dedi27](https://discuss.elastic.co/u/dedi27)\ **Replies:** 10\ **Last updated:** [December 15, 2020, 5:30pm UTC](https://discuss.elastic.co/t/stack-monitoring-error-fetching-alert-status/257240 "2020-12-15T17:30:15Z")
Hello, I have an Elasticsearch cluster that is in version 7.10, and a few days ago started to display the message "Error fetching alert status" on the Stack monitoring screen. At the time I was still on version 7.9.3 of… --- ## [APM 7.6.2: Error 503: Queue is full but server is sleeping](https://discuss.elastic.co/t/apm-7-6-2-error-503-queue-is-full-but-server-is-sleeping/232683)
**Author:** [@Emanuel\_Velzi](https://discuss.elastic.co/u/Emanuel_Velzi)\ **Replies:** 12\ **Last updated:** [May 26, 2020, 6:41pm UTC](https://discuss.elastic.co/t/apm-7-6-2-error-503-queue-is-full-but-server-is-sleeping/232683 "2020-05-26T18:41:31Z")
I have a problem with my APM Server. Kibana version: 7.6.2 Elasticsearch version: 7.6.2 APM Server version: 7.6.2 Original install method (e.g. download page, yum, deb, from source, etc.) and version: download page I… --- ## [Unable to setup Metricbeat dashboards](https://discuss.elastic.co/t/unable-to-setup-metricbeat-dashboards/220852)
**Author:** [@tristan1](https://discuss.elastic.co/u/tristan1)\ **Replies:** 13\ **Last updated:** [March 3, 2020, 7:10am UTC](https://discuss.elastic.co/t/unable-to-setup-metricbeat-dashboards/220852 "2020-03-03T07:10:54Z")
Hi, I am unable to setup Metricbeat dashboards. I'm trying the following: metricbeat setup --dashboards And getting this error: Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to … --- ## [Can't start elasticsearch. please help](https://discuss.elastic.co/t/cant-start-elasticsearch-please-help/249720)
**Author:** [@Tomz](https://discuss.elastic.co/u/Tomz)\ **Replies:** 16\ **Last updated:** [September 24, 2020, 3:56am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-please-help/249720 "2020-09-24T03:56:45Z")
when I try run "sudo systemctl start elasticsearch" show me Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for … --- ## [APM UI Kibana Internal Server Error](https://discuss.elastic.co/t/apm-ui-kibana-internal-server-error/223601)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 20\ **Last updated:** [March 18, 2020, 11:26pm UTC](https://discuss.elastic.co/t/apm-ui-kibana-internal-server-error/223601 "2020-03-18T23:26:07Z")
Kibana version : 7.5.2 Elasticsearch version : 7.5.2 APM Server version : 7.6.0 APM Agent language and version : Java 1.12.0 We have 6 ES data instances each with 7 VCPUs and 62 GIB of RAM, with 23 GIB of HEAP. We a… --- ## [Logstash s3 input error](https://discuss.elastic.co/t/logstash-s3-input-error/68356)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 12\ **Last updated:** [December 29, 2016, 2:29pm UTC](https://discuss.elastic.co/t/logstash-s3-input-error/68356 "2016-12-29T14:29:56Z")
I am using logstash input plugin to fetch logs from s3. Below is my config. input { s3 { type =\> "redshift-access-log" bucket =\> "xxxxxxxxxxxxx" prefix =\> "xxxxxxxxxxxxx" proxy\_uri =\> "xxxxxxxxxxxxx… --- ## [Logstash doesn't send any emails](https://discuss.elastic.co/t/logstash-doesnt-send-any-emails/91967)
**Author:** [@Bob04](https://discuss.elastic.co/u/Bob04)\ **Replies:** 14\ **Last updated:** [July 11, 2017, 5:52pm UTC](https://discuss.elastic.co/t/logstash-doesnt-send-any-emails/91967 "2017-07-11T17:52:54Z")
I am using Logstash-email output with the following configuration: email { to =\> "..." subject =\> "..." port =\> 25 via =\> "smtp" body =\> "%{message}" } But I didn't receive any email. telnet … --- ## [Elasticsearch 5.1.1 keep dying after 20 minutes](https://discuss.elastic.co/t/elasticsearch-5-1-1-keep-dying-after-20-minutes/70384)
**Author:** [@nathan.tivaci](https://discuss.elastic.co/u/nathan.tivaci)\ **Replies:** 14\ **Last updated:** [January 9, 2017, 12:08pm UTC](https://discuss.elastic.co/t/elasticsearch-5-1-1-keep-dying-after-20-minutes/70384 "2017-01-09T12:08:17Z")
Hi there, I hope somebody can help me. I have an instance of ELK in Ubuntu 16.04 (2GB of RAM, 30GB of HDD). I can setup visualisation, dashboard and all. BUT, the elasticsearch instance keep dying after 20 minutes … --- ## [Unable to start auditbeat on docker](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-docker/132609)
**Author:** [@obudiman](https://discuss.elastic.co/u/obudiman)\ **Replies:** 9\ **Last updated:** [May 29, 2018, 7:40pm UTC](https://discuss.elastic.co/t/unable-to-start-auditbeat-on-docker/132609 "2018-05-29T19:40:47Z")
Hi, I've been trying to deploy the official auditbeat:6.2.4 container on our centos 7.4 but I'm stuck with the following error log: 2018-05-21T03:53:08.825Z INFO instance/beat.go:468 Home path: \[/usr/share… --- ## [Display concurency in Kibana 5.x](https://discuss.elastic.co/t/display-concurency-in-kibana-5-x/110217)
**Author:** [@zahodi](https://discuss.elastic.co/u/zahodi)\ **Replies:** 25\ **Last updated:** [January 15, 2018, 3:59pm UTC](https://discuss.elastic.co/t/display-concurency-in-kibana-5-x/110217 "2018-01-15T15:59:05Z")
Has anyone been able to successfully replicate and visualize concurrency in data in Kibana 5.x? I have start, end, and duration timestamps in each message and I'm trying to follow directions in the post from 2015 but ge… --- ## [Configuracion logstash para indexar en un cluster elasticsearch](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496)
**Author:** [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)\ **Replies:** 11\ **Last updated:** [October 19, 2015, 4:50pm UTC](https://discuss.elastic.co/t/configuracion-logstash-para-indexar-en-un-cluster-elasticsearch/32496 "2015-10-19T16:50:42Z")
Hola, tengo funcionando finalmente un cluster ES y varias instancias de logstash almacenando datos en el. Sin embargo, con una de las instancias me surge un inconveniente que no logro resolver. El error que me indica es … --- ## [How to deal with building huge bulk load indices fast without impacting prod queries or paying a fortune to over-provision the cluster](https://discuss.elastic.co/t/how-to-deal-with-building-huge-bulk-load-indices-fast-without-impacting-prod-queries-or-paying-a-fortune-to-over-provision-the-cluster/46586)
**Author:** [@Adam\_Brown](https://discuss.elastic.co/u/Adam_Brown)\ **Replies:** 9\ **Last updated:** [April 7, 2016, 3:58pm UTC](https://discuss.elastic.co/t/how-to-deal-with-building-huge-bulk-load-indices-fast-without-impacting-prod-queries-or-paying-a-fortune-to-over-provision-the-cluster/46586 "2016-04-07T15:58:18Z")
I sent the following slack to a colleague today. He does elasticsearch consulting and usually keeps pretty current on all things elasticsearch. Then I thought maybe other people would have ideas too. Here it is: Man, e… --- ## [Second ES Instance Unable to Discover Other Nodes](https://discuss.elastic.co/t/second-es-instance-unable-to-discover-other-nodes/103438)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 9\ **Last updated:** [November 3, 2017, 4:55pm UTC](https://discuss.elastic.co/t/second-es-instance-unable-to-discover-other-nodes/103438 "2017-11-03T16:55:31Z")
ES/Kibana/Logstash v5.6.2 I have three problematic machines in a 12 node cluster. These machines run two instances of ES, one is pointed to SSDs, and the other is pointed towards HDDs on the same machine. This is setup … --- ## [Aggregate Score for Hybrid Search](https://discuss.elastic.co/t/aggregate-score-for-hybrid-search/325205)
**Author:** [@Kok\_Gin\_Xian](https://discuss.elastic.co/u/Kok_Gin_Xian)\ **Replies:** 21\ **Last updated:** [February 17, 2023, 1:12am UTC](https://discuss.elastic.co/t/aggregate-score-for-hybrid-search/325205 "2023-02-17T01:12:37Z")
Hi, I'm new to Elasticsearch and am trying out the new hybrid search by specifying the "knn" and "query" parameters in my search. I set k=100 in knn, size=k=100 in the search request. For pure vector search (omitting t… --- ## [Two different partitions in the same elaticsearch server](https://discuss.elastic.co/t/two-different-partitions-in-the-same-elaticsearch-server/31280)
**Author:** [@ananthanaidu](https://discuss.elastic.co/u/ananthanaidu)\ **Replies:** 11\ **Last updated:** [October 14, 2015, 8:37pm UTC](https://discuss.elastic.co/t/two-different-partitions-in-the-same-elaticsearch-server/31280 "2015-10-14T20:37:28Z")
Hi Support, How to manage two different partitions in the same elaticsearch server and both partitions should talk to kibana dashboard. How to move indexes to the new partition in the same server by using an Elastic … --- ## [Kibana Install Error - should not run as root](https://discuss.elastic.co/t/kibana-install-error-should-not-run-as-root/220929)
**Author:** [@Technolust](https://discuss.elastic.co/u/Technolust)\ **Replies:** 13\ **Last updated:** [March 3, 2020, 9:17pm UTC](https://discuss.elastic.co/t/kibana-install-error-should-not-run-as-root/220929 "2020-03-03T21:17:21Z")
Elk Stack newbie here... When I install Kibana on Centos 8 I get an error on install saying that I should not run ./bin/kibana as root. Do I need to create a specific user called "Kibana" instead of running as sudo? When… --- ## [Object mapping issue](https://discuss.elastic.co/t/object-mapping-issue/195739)
**Author:** [@Osama\_Tariq](https://discuss.elastic.co/u/Osama_Tariq)\ **Replies:** 20\ **Last updated:** [September 22, 2019, 12:54am UTC](https://discuss.elastic.co/t/object-mapping-issue/195739 "2019-09-22T00:54:27Z")
Hi, I am getting following issue in elasticsearch. Object mapping for \[ClientIP\] tried to parse field \[ClientIP\] as object. How do I fixed configuration to adjust the mapping ? \[2019-08-19T16:03:30,213\]\[DEBUG\]\[o.e.a.b.… --- ## [Logstash configuration to process 1M events per second](https://discuss.elastic.co/t/logstash-configuration-to-process-1m-events-per-second/288989)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 11\ **Last updated:** [January 21, 2022, 7:23am UTC](https://discuss.elastic.co/t/logstash-configuration-to-process-1m-events-per-second/288989 "2022-01-21T07:23:56Z")
I have events of around 1M (real time), logstash is proecessing 40K at one instances and one pipeline, if I increase the logstash instance to two it goes around 30K each (60K cummulative) but increasing the logstash inst… --- ## [Elasticsearch java interaction](https://discuss.elastic.co/t/elasticsearch-java-interaction/16375)
**Author:** [@Venu\_Krishna](https://discuss.elastic.co/u/Venu_Krishna)\ **Replies:** 20\ **Last updated:** [March 24, 2014, 8:20pm UTC](https://discuss.elastic.co/t/elasticsearch-java-interaction/16375 "2014-03-24T20:20:32Z")
Hi, I am Y.Venu,i am totally new to this elasticsearch,now i am trying to communicate java elastisearch,i have gone through the elasticsearch java api's 1st i came across maven repositry. i have crea… --- ## [Error 400 when creating Watcher with Slack action](https://discuss.elastic.co/t/error-400-when-creating-watcher-with-slack-action/51627)
**Author:** [@Mike\_Wurtz](https://discuss.elastic.co/u/Mike_Wurtz)\ **Replies:** 9\ **Last updated:** [September 5, 2016, 3:50pm UTC](https://discuss.elastic.co/t/error-400-when-creating-watcher-with-slack-action/51627 "2016-09-05T15:50:42Z")
ES 5.0 Alpha 3 I was able to create an alert like this in Alpha 1 and Alpha 2, but not any more. This request: "notify-slack" : { "throttle\_period" : "15m", "slack" : { "account" : "monitoring", "… --- ## [NumberFormatException stops logstash from working](https://discuss.elastic.co/t/numberformatexception-stops-logstash-from-working/71973)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 14\ **Last updated:** [January 23, 2017, 8:04am UTC](https://discuss.elastic.co/t/numberformatexception-stops-logstash-from-working/71973 "2017-01-23T08:04:38Z")
Hi, We have logstash running for a while now, but yesterday something happened that stopped it from working. \[2017-01-18T10:56:16,553\]\[DEBUG\]\[logstash.inputs.beats \] config LogStash::Inputs::Beats/@client\_inacti… --- ## [Monitoring an Elastic Search cluster](https://discuss.elastic.co/t/monitoring-an-elastic-search-cluster/25074)
**Author:** [@linlma](https://discuss.elastic.co/u/linlma)\ **Replies:** 11\ **Last updated:** [July 15, 2015, 7:05pm UTC](https://discuss.elastic.co/t/monitoring-an-elastic-search-cluster/25074 "2015-07-15T19:05:27Z")
Hello Elastic experts, Any existing built-in tools to monitor a local setup Elastic Search cluster? Also, if the tool could send alert if cluster is not stable/has issues, it will be great. thanks in advance, Lin --- ## [Sending request to one index, writing to multiple indices](https://discuss.elastic.co/t/sending-request-to-one-index-writing-to-multiple-indices/338079)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 23\ **Last updated:** [July 12, 2023, 7:19pm UTC](https://discuss.elastic.co/t/sending-request-to-one-index-writing-to-multiple-indices/338079 "2023-07-12T19:19:13Z")
I have a index named index1. I want to configure it such that any write/update request that comes to index1 gets written to both index1 and index2 but any search request still uses index1. Is this possible with some exis… --- ## [Multiple configurations (ubuntu 14.04 using apt-get)](https://discuss.elastic.co/t/multiple-configurations-ubuntu-14-04-using-apt-get/80866)
**Author:** [@ipl2004](https://discuss.elastic.co/u/ipl2004)\ **Replies:** 12\ **Last updated:** [April 3, 2017, 10:05pm UTC](https://discuss.elastic.co/t/multiple-configurations-ubuntu-14-04-using-apt-get/80866 "2017-04-03T22:05:32Z")
apt-get update is giving me the following warnings. should I be concerned? W: Target Translations (main/i18n/Translation-en) is configured multiple times in /etc/apt/sources.list:52 and /etc/apt/sources.list.d/elastic-… --- ## [Getting TransportError: TransportError(500, 'exception', 'java.io.OptionalDataException' while posting to AWS managed elastic stack](https://discuss.elastic.co/t/getting-transporterror-transporterror-500-exception-java-io-optionaldataexception-while-posting-to-aws-managed-elastic-stack/257713)
**Author:** [@yackoa](https://discuss.elastic.co/u/yackoa)\ **Replies:** 12\ **Last updated:** [January 4, 2021, 6:41am UTC](https://discuss.elastic.co/t/getting-transporterror-transporterror-500-exception-java-io-optionaldataexception-while-posting-to-aws-managed-elastic-stack/257713 "2021-01-04T06:41:46Z")
I am getting 'occasional' 500 Transport errors on AWS managed ES stack when posting JSONS from our python based lambdas. This was working flawlessly until today's upgrade to ES 7.9. We have tried increasing the cluster … --- ## [Multiline filter and dateparse issue in production](https://discuss.elastic.co/t/multiline-filter-and-dateparse-issue-in-production/44927)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 11\ **Last updated:** [March 21, 2016, 3:16pm UTC](https://discuss.elastic.co/t/multiline-filter-and-dateparse-issue-in-production/44927 "2016-03-21T15:16:18Z")
Hi I am using logstash-1.5.3 as indexer my configuration is filter{ multiline { pattern =\> "^%{TIMESTAMP\_ISO8601}" # negate =\> true what =\> previous } multiline { pattern =\> "^\\s" … --- ## [Filebeat character encoding problem!](https://discuss.elastic.co/t/filebeat-character-encoding-problem/136486)
**Author:** [@Pratik.Lal](https://discuss.elastic.co/u/Pratik.Lal)\ **Replies:** 9\ **Last updated:** [June 19, 2018, 4:57pm UTC](https://discuss.elastic.co/t/filebeat-character-encoding-problem/136486 "2018-06-19T16:57:56Z")
It looks like filebeat didn't handle \> character properly and displayed the Unicode hex equivalent i.e. \\u003c142 in output. Other fields are displayed just fine. Any recommendations? Filebeat version: 6.3 Input: SYSL… --- ## [Unable to get nginx messages to kibana through filebeat](https://discuss.elastic.co/t/unable-to-get-nginx-messages-to-kibana-through-filebeat/96024)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 14\ **Last updated:** [August 9, 2017, 11:48am UTC](https://discuss.elastic.co/t/unable-to-get-nginx-messages-to-kibana-through-filebeat/96024 "2017-08-09T11:48:47Z")
Hi Guys, I am unable to get the proper messages in elastic through filebeat. I have nginx reverse proxy with at least 50 sites catering to and I just configured or first time gave a try with ELK and filebeat. I am someh… --- ## [Помогите составить агрегирующий запрос с фильтром](https://discuss.elastic.co/t/topic/59429)
**Author:** [@Alkalit](https://discuss.elastic.co/u/Alkalit)\ **Replies:** 17\ **Last updated:** [October 1, 2016, 2:58am UTC](https://discuss.elastic.co/t/topic/59429 "2016-10-01T02:58:09Z")
Здравствуйте. Я уже задавал этот вопрос неделю назад на английском языке, но ответа не получил, а он очень нужен. Мне надо составить запрос на агрегирование с фильтрованием. Дано - есть 3 таблицы базы данных - Объявлен… --- ## [No alert form array results](https://discuss.elastic.co/t/no-alert-form-array-results/40352)
**Author:** [@carmelom](https://discuss.elastic.co/u/carmelom)\ **Replies:** 13\ **Last updated:** [February 1, 2016, 2:45pm UTC](https://discuss.elastic.co/t/no-alert-form-array-results/40352 "2016-02-01T14:45:48Z")
I am trying to create a watcher condition, the result of my query is: { 0= {\_type=test, \_source= {timetaken=46, \[...\] } }, 1={\_type=test, … --- ## [Filebeat modules vs filestream input](https://discuss.elastic.co/t/filebeat-modules-vs-filestream-input/342871)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 29\ **Last updated:** [September 27, 2023, 6:45pm UTC](https://discuss.elastic.co/t/filebeat-modules-vs-filestream-input/342871 "2023-09-27T18:45:19Z")
Hello, I'm trying to configure filebeat to read a Linux system and auth log file. when I'm using datastream input, the data isn't parsed well; everything is let into the message field without any processing. When I use… --- ## [How to check the tags values in logstash](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474)
**Author:** [@Sripal](https://discuss.elastic.co/u/Sripal)\ **Replies:** 24\ **Last updated:** [January 3, 2019, 6:14am UTC](https://discuss.elastic.co/t/how-to-check-the-tags-values-in-logstash/162474 "2019-01-03T06:14:15Z")
Dear All, I'm trying to read my access log but i'm getting below error. Please help Log lines: \[1047:3a80:421:319:7e91:ac89:eda5:8c9d\], 10.10.10.10:10 - - - \[26/Dec/2018:02:31:14 +0530\] "POST /my/app/path/android/quer… --- ## [Missing index issue in a cluster](https://discuss.elastic.co/t/missing-index-issue-in-a-cluster/95210)
**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\ **Replies:** 12\ **Last updated:** [August 3, 2017, 3:52pm UTC](https://discuss.elastic.co/t/missing-index-issue-in-a-cluster/95210 "2017-08-03T15:52:20Z")
I have a 5 node cluster , what I noticed is that when I create the ES external table on node1 , the index is being created on node5 (where hive is not installed) , and then when I try to select from this table I get the … --- ## [ElasticFleet randomly missing logs](https://discuss.elastic.co/t/elasticfleet-randomly-missing-logs/284949)
**Author:** [@RichardMatthews](https://discuss.elastic.co/u/RichardMatthews)\ **Replies:** 14\ **Last updated:** [October 8, 2021, 6:35am UTC](https://discuss.elastic.co/t/elasticfleet-randomly-missing-logs/284949 "2021-10-08T06:35:55Z")
Hey, We are running the Elasticsearch Operator on Kubernetes using Elasticsearch (7.14.1), Kibana (7.14.1) and ElasticAgent (7.14.1) in Fleet mode. We have noticed that we are missing logs intermittently from the agents… --- ## [Getting Error-Cannot delete files/directories outside the current working directory when i wants to generate visualization report in pdf](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633)
**Author:** [@syed0510](https://discuss.elastic.co/u/syed0510)\ **Replies:** 28\ **Last updated:** [September 20, 2021, 4:21am UTC](https://discuss.elastic.co/t/getting-error-cannot-delete-files-directories-outside-the-current-working-directory-when-i-wants-to-generate-visualization-report-in-pdf/283633 "2021-09-20T04:21:49Z")
Kibana Version: 7.6.1 ElasticSearch version- 6.4.0 Getting address invalid error when wants to generate visualization report in pdf{attaching screenshot of error }. Attaching log files details also. log file is sh… --- ## [How to Sort Date in Kibana Visualization](https://discuss.elastic.co/t/how-to-sort-date-in-kibana-visualization/209221)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 12\ **Last updated:** [December 3, 2019, 5:28am UTC](https://discuss.elastic.co/t/how-to-sort-date-in-kibana-visualization/209221 "2019-12-03T05:28:51Z")
Hi i am using kibana interface for visualization while i have a column date which contain 2 month dates but when i sort date ascending it does not sort the date in order wise. Can someone help me how to sort the date in … --- ## [Why is my Elasticsearch index using so much disk space?](https://discuss.elastic.co/t/why-is-my-elasticsearch-index-using-so-much-disk-space/202117)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 13\ **Last updated:** [October 8, 2019, 8:10am UTC](https://discuss.elastic.co/t/why-is-my-elasticsearch-index-using-so-much-disk-space/202117 "2019-10-08T08:10:21Z")
Elasticsearch version (bin/elasticsearch --version): 5.6.11 Plugins installed: JVM version (java -version): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubuntu1~16.04.1-b10) … --- ## [Incompatible types found in multi-mapping](https://discuss.elastic.co/t/incompatible-types-found-in-multi-mapping/170066)
**Author:** [@bob28](https://discuss.elastic.co/u/bob28)\ **Replies:** 11\ **Last updated:** [March 12, 2019, 4:54pm UTC](https://discuss.elastic.co/t/incompatible-types-found-in-multi-mapping/170066 "2019-03-12T16:54:24Z")
Hi All, I have elasticsearch index named as dataInfo-yyyy.mm.dd. I am querying elasticsearch thru spark scala to get the data by searching index as dataInfo\* and its throwing error as follows: catch exceptionorg.elast… [Previous page](https://discuss.elastic.co/top.md?page=82&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=84&per_page=50&period=all)