# Top **URL:** https://discuss.elastic.co/top.md?page=830&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 831 --- ## [How to force update the field format of kibana index pattern](https://discuss.elastic.co/t/how-to-force-update-the-field-format-of-kibana-index-pattern/233482)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 8\ **Last updated:** [June 8, 2020, 8:36am UTC](https://discuss.elastic.co/t/how-to-force-update-the-field-format-of-kibana-index-pattern/233482 "2020-06-08T08:36:44Z")
Fields including 'pathname' are generated dynamically by apmserver. "transaction.custom.pathname" is already a keyword field in the mapping, I keep creating new index patterns, "transaction.custom.pathname" is always … --- ## [\_datepassefailure](https://discuss.elastic.co/t/-datepassefailure/34180)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 8\ **Last updated:** [November 18, 2015, 1:21pm UTC](https://discuss.elastic.co/t/-datepassefailure/34180 "2015-11-18T13:21:48Z")
Logstash 2.0 I am parsing logs in JSON with date format as: 2015-11-09T17:28:44.978477Z I am using date { match =\> \["ts", "UNIX"\] } I am getting errors that state "\_dateparsefailure" I tried to change… --- ## [Sorting on keyword field with accents](https://discuss.elastic.co/t/sorting-on-keyword-field-with-accents/162830)
**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\ **Replies:** 2\ **Last updated:** [January 3, 2019, 4:00pm UTC](https://discuss.elastic.co/t/sorting-on-keyword-field-with-accents/162830 "2019-01-03T16:00:33Z")
Hi there, My index has a keyword field on which there are documents that contain words with accents, i.e., 'Águas Lindas', and some don't, i.e., 'Aracaju'. I'm using that field to sort my results. The problem is that, … --- ## [Index xlsx files in Elasticsearch](https://discuss.elastic.co/t/index-xlsx-files-in-elasticsearch/140564)
**Author:** [@alexander.tsulin](https://discuss.elastic.co/u/alexander.tsulin)\ **Replies:** 2\ **Last updated:** [July 19, 2018, 3:06am UTC](https://discuss.elastic.co/t/index-xlsx-files-in-elasticsearch/140564 "2018-07-19T03:06:41Z")
Hi all, I'm implementing utility that uses Elasticsearch database and should be able to index excel files with specified file sctructure. For instance, I have file with 3 columns: UserId FirstName LastName 1 … --- ## [Cluster never recovers on baremetal cloud-on-k8s instance](https://discuss.elastic.co/t/cluster-never-recovers-on-baremetal-cloud-on-k8s-instance/189840)
**Author:** [@Alexei\_Smirnov](https://discuss.elastic.co/u/Alexei_Smirnov)\ **Replies:** 4\ **Last updated:** [August 2, 2019, 2:25pm UTC](https://discuss.elastic.co/t/cluster-never-recovers-on-baremetal-cloud-on-k8s-instance/189840 "2019-08-02T14:25:29Z")
tried to install it several times starting from 0.8.0 operator, and 0.8.1, always the same issue. whenever we try to reboot one or few machines, cluster never recovers. all masters become unavailable and it continues to… --- ## [Scale numeric values - Kibana](https://discuss.elastic.co/t/scale-numeric-values-kibana/97547)
**Author:** [@Eran\_H](https://discuss.elastic.co/u/Eran_H)\ **Replies:** 4\ **Last updated:** [August 21, 2017, 6:21pm UTC](https://discuss.elastic.co/t/scale-numeric-values-kibana/97547 "2017-08-21T18:21:51Z")
As described here, I want to implement the “rescaling” method in Kibana. I have a numeric field, which is always \>= 0 . I want it to scale to the range of \[0, 1\]. It seems: Timelion doesn’t support extracting the Ma… --- ## [SSL Handshake Issue](https://discuss.elastic.co/t/ssl-handshake-issue/2303)
**Author:** [@ashwgupt](https://discuss.elastic.co/u/ashwgupt)\ **Replies:** 4\ **Last updated:** [June 11, 2015, 8:24am UTC](https://discuss.elastic.co/t/ssl-handshake-issue/2303 "2015-06-11T08:24:29Z")
I am facing a lot of issues to make my Forwarder work even after all steps supposedly followed. Have also been browsing and following tips from - https://github.com/elastic/logstash-forwarder/issues/221 but have not turn… --- ## [Which architecture of logstash forwarder or redis is good in scalable perspective?](https://discuss.elastic.co/t/which-architecture-of-logstash-forwarder-or-redis-is-good-in-scalable-perspective/25134)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 1\ **Last updated:** [July 8, 2015, 10:54am UTC](https://discuss.elastic.co/t/which-architecture-of-logstash-forwarder-or-redis-is-good-in-scalable-perspective/25134 "2015-07-08T10:54:14Z")
In a very large application, what is proposed architecture for whole ELK stack? Is it good to use redis broker between logstash forwarder and logstash indexer? Or will logstash forwarder can scale and send logs directl… --- ## [Getting source code for elasticsearch](https://discuss.elastic.co/t/getting-source-code-for-elasticsearch/10324)
**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\ **Replies:** 6\ **Last updated:** [January 14, 2013, 5:34am UTC](https://discuss.elastic.co/t/getting-source-code-for-elasticsearch/10324 "2013-01-14T05:34:29Z")
Hi, I got the elasticsearch version elasticsearch-0.20.1, I added it to my Eclipse project and I am trying to add Java docs to it under my Eclipse project. For that I need source code. The documentation says… --- ## [How to set total limit field to be other than 1000 by default](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564)
**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564 "2020-08-03T21:30:18Z")
Hi, I would like to increase the limit of total fields for my indices. I know that we can change it in Kibana by sending an API call as such: PUT logstash-\*/\_settings { "index.mapping.total\_fields.limit": 5000 } Bu… --- ## [How to convert long number format datetime to datetime?](https://discuss.elastic.co/t/how-to-convert-long-number-format-datetime-to-datetime/91609)
**Author:** [@sonnguyenit](https://discuss.elastic.co/u/sonnguyenit)\ **Replies:** 3\ **Last updated:** [July 3, 2017, 9:26am UTC](https://discuss.elastic.co/t/how-to-convert-long-number-format-datetime-to-datetime/91609 "2017-07-03T09:26:39Z")
I have a field that is datetime in long value: "action\_date":636346116012468640 So i want to use date filter to convert it to Unix date time: date { match =\> \[ "action\_date", "what is date format?" \] } … --- ## [ConnectionTimeout caused by - ReadTimeoutError using the get method (over element with parent/child relation))](https://discuss.elastic.co/t/connectiontimeout-caused-by-readtimeouterror-using-the-get-method-over-element-with-parent-child-relation/29109)
**Author:** [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\ **Replies:** 0\ **Last updated:** [September 11, 2015, 9:03am UTC](https://discuss.elastic.co/t/connectiontimeout-caused-by-readtimeouterror-using-the-get-method-over-element-with-parent-child-relation/29109 "2015-09-11T09:03:20Z")
Hi, Nowadays I have an elasticsearch cluster and the health of this cluster is correct: epoch timestamp cluster status node.total node.data shards pri relo init unassign 1441960748 10:39:08 juan green 5 4 400 200 0 0… --- ## [Conversion of timeformat](https://discuss.elastic.co/t/conversion-of-timeformat/270961)
**Author:** [@mansa](https://discuss.elastic.co/u/mansa)\ **Replies:** 5\ **Last updated:** [April 29, 2021, 5:58pm UTC](https://discuss.elastic.co/t/conversion-of-timeformat/270961 "2021-04-29T17:58:53Z")
Hi Folks we have few logs which comes into time format "2021-04-05 08:04:24+07:00" and i want to convert this time into format "Sep 15 18:58:48" because i am sending logs to different SIEM which reads only syslog time st… --- ## [Metatrader, how parse this?](https://discuss.elastic.co/t/metatrader-how-parse-this/201982)
**Author:** [@immo](https://discuss.elastic.co/u/immo)\ **Replies:** 5\ **Last updated:** [October 3, 2019, 1:27pm UTC](https://discuss.elastic.co/t/metatrader-how-parse-this/201982 "2019-10-03T13:27:03Z")
Hello! Iam new there, and have some problems with log. Main problem - log have not only same lines, so i just cant grok it. Here is an example: EL 0 4 23:36:56.041 Glfx mt5 live\_capital\_m datafeed process start compl… --- ## [Error-org.elasticsearch.common.inject.CreationException: Guice creation errors:](https://discuss.elastic.co/t/error-org-elasticsearch-common-inject-creationexception-guice-creation-errors/60580)
**Author:** [@Rajan\_Gabriel\_Anbu](https://discuss.elastic.co/u/Rajan_Gabriel_Anbu)\ **Replies:** 5\ **Last updated:** [September 21, 2016, 12:28pm UTC](https://discuss.elastic.co/t/error-org-elasticsearch-common-inject-creationexception-guice-creation-errors/60580 "2016-09-21T12:28:22Z")
Im getting this exception under Guice Creation errors 1) Error injecting constructor, java.lang.NullPointerException at org.elasticsearch.common.network.NetworkService.(Unknown Source) while locating org.elasticsear… --- ## [Dealing with large index collection strategy?](https://discuss.elastic.co/t/dealing-with-large-index-collection-strategy/26258)
**Author:** [@eeveaud](https://discuss.elastic.co/u/eeveaud)\ **Replies:** 5\ **Last updated:** [July 29, 2015, 2:25pm UTC](https://discuss.elastic.co/t/dealing-with-large-index-collection-strategy/26258 "2015-07-29T14:25:28Z")
Hi, we would like to deal with one year of various source of logs. that range from 80^6 events per day to 1000 per day with kibana on top to have reporting and dashbord of activity from those different sources. we p… --- ## [Forming Elasticsearch Cluster (v. 7.0.1)](https://discuss.elastic.co/t/forming-elasticsearch-cluster-v-7-0-1/186006)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 7\ **Last updated:** [June 17, 2019, 9:34am UTC](https://discuss.elastic.co/t/forming-elasticsearch-cluster-v-7-0-1/186006 "2019-06-17T09:34:22Z")
Hi Elasticians, I am trying to form 1 cluster of 3 nodes. Could someone explain me why a cluster is not formed of this 3 nodes? PART 1: Intro I am working with ES 7.0.1 with 3 nodes. All nodes are master-eligible nod… --- ## [Kibana 6.1.0 visualization](https://discuss.elastic.co/t/kibana-6-1-0-visualization/111999)
**Author:** [@seanshandy](https://discuss.elastic.co/u/seanshandy)\ **Replies:** 7\ **Last updated:** [December 19, 2017, 6:54am UTC](https://discuss.elastic.co/t/kibana-6-1-0-visualization/111999 "2017-12-19T06:54:28Z")
im using kibana 6.1.0 how can i get this scroll bar removed if i only pick 3 data with this visualization size? \[Untitled\] and one more thing, so im using metric visualization and split by term, and this happen \[asda… --- ## [Dynamic template causing "Mixing up field types" error only for certain fields names!](https://discuss.elastic.co/t/dynamic-template-causing-mixing-up-field-types-error-only-for-certain-fields-names/57661)
**Author:** [@Somnath\_Pal](https://discuss.elastic.co/u/Somnath_Pal)\ **Replies:** 4\ **Last updated:** [August 17, 2016, 5:17am UTC](https://discuss.elastic.co/t/dynamic-template-causing-mixing-up-field-types-error-only-for-certain-fields-names/57661 "2016-08-17T05:17:28Z")
On Es 2.3.3 cluster (3 node) I have following mapping on a index, please note dynamic mapping for timestamp field (field names ending with \_ts) { "logs-pc-2016-08-09": { "mappings": { … --- ## [Filebeat Stops sending logs once logstash stops responding for sometime](https://discuss.elastic.co/t/filebeat-stops-sending-logs-once-logstash-stops-responding-for-sometime/39001)
**Author:** [@naga1](https://discuss.elastic.co/u/naga1)\ **Replies:** 4\ **Last updated:** [April 26, 2016, 7:38am UTC](https://discuss.elastic.co/t/filebeat-stops-sending-logs-once-logstash-stops-responding-for-sometime/39001 "2016-04-26T07:38:34Z")
Filebeat stops sending logs if logstash goes down for sometime and comes back eventually. It doesnt start sending logs until we bounce the filebeat server. Any idea why its stops sending logs. Any help other than adding … --- ## [Testing custom plugin to Packetbeat](https://discuss.elastic.co/t/testing-custom-plugin-to-packetbeat/70677)
**Author:** [@sumit419](https://discuss.elastic.co/u/sumit419)\ **Replies:** 8\ **Last updated:** [January 16, 2017, 4:09pm UTC](https://discuss.elastic.co/t/testing-custom-plugin-to-packetbeat/70677 "2017-01-16T16:09:04Z")
Hi I have written a plugin for a TCP application the packets contain plain TCP data. I want to integrate with the packetbeat and use it in debug mode. To see if the new plugin is doing. I'm new to packetbeat. Thanks. --- ## [Java JDK old version](https://discuss.elastic.co/t/java-jdk-old-version/253383)
**Author:** [@dfoot](https://discuss.elastic.co/u/dfoot)\ **Replies:** 3\ **Last updated:** [October 30, 2020, 12:44am UTC](https://discuss.elastic.co/t/java-jdk-old-version/253383 "2020-10-30T00:44:25Z")
ELK version 7.1.1... vulnerability scanning shows Java old version found on elasticsearch nodes path for ELK cluster and logstash Java JDK installation on Elasticsearch nodes path /usr/share/elasticsearch/jdk/ version … --- ## [Merge data fer two indices with foreign key](https://discuss.elastic.co/t/merge-data-fer-two-indices-with-foreign-key/116863)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 3\ **Last updated:** [January 25, 2018, 9:23am UTC](https://discuss.elastic.co/t/merge-data-fer-two-indices-with-foreign-key/116863 "2018-01-25T09:23:18Z")
Hi, Can I get the merged data from two different indices? For example: Index1 : Name, Id , Type Index2: Type, TypeData1 Type, TypeData2 I want data to be returned in single query like Name,Id,Type:\[TypeData1,TypeDat… --- ## [Error in Search Guard issue tracker](https://discuss.elastic.co/t/error-in-search-guard-issue-tracker/109197)
**Author:** [@dimalini](https://discuss.elastic.co/u/dimalini)\ **Replies:** 0\ **Last updated:** [November 27, 2017, 10:25am UTC](https://discuss.elastic.co/t/error-in-search-guard-issue-tracker/109197 "2017-11-27T10:25:08Z")
Hi, We are using ES5.4.1. In one of our production environment, a node left out of cluster and after it rejoined we are seeing master nodes giving these warning messages. Could anyone please take a look and clarify how … --- ## [Rate limit exceeded](https://discuss.elastic.co/t/rate-limit-exceeded/203867)
**Author:** [@Patrick\_Simard](https://discuss.elastic.co/u/Patrick_Simard)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 8:02pm UTC](https://discuss.elastic.co/t/rate-limit-exceeded/203867 "2019-10-22T20:02:44Z")
I currently have a demo account. I am trying to make a POC using SwifType for my employer. We have a very big database that is indexec every 1h and creates a JSON file. I thought the integration with Elastic would be ver… --- ## [Ingest node disc usage keeps rising](https://discuss.elastic.co/t/ingest-node-disc-usage-keeps-rising/284431)
**Author:** [@Tadija](https://discuss.elastic.co/u/Tadija)\ **Replies:** 6\ **Last updated:** [September 20, 2021, 6:05am UTC](https://discuss.elastic.co/t/ingest-node-disc-usage-keeps-rising/284431 "2021-09-20T06:05:42Z")
I've created a new elastic cloud deployment 7.14.x - Hot tier contains 1 node with 2 GB disc, Warm tier 1 node 320 GB disc. I wont do any document/index updating, a human will occasionally check logs via Kibana. I've se… --- ## [Self-hosted App Search limited to one ES Node?](https://discuss.elastic.co/t/self-hosted-app-search-limited-to-one-es-node/215211)
**Author:** [@fred\_wang](https://discuss.elastic.co/u/fred_wang)\ **Replies:** 6\ **Last updated:** [January 23, 2020, 8:46pm UTC](https://discuss.elastic.co/t/self-hosted-app-search-limited-to-one-es-node/215211 "2020-01-23T20:46:52Z")
I tried to configure a multi-node Elasticsearch (3 nodes) and an app search engine using Docker compose. I finally got what I think is a working docker-compose.yml for this (The documentation on using Docker compose wit… --- ## [How to Rotate X Tick Label in Canvas/CSS?](https://discuss.elastic.co/t/how-to-rotate-x-tick-label-in-canvas-css/197179)
**Author:** [@Carlos.limaElaw](https://discuss.elastic.co/u/Carlos.limaElaw)\ **Replies:** 2\ **Last updated:** [August 29, 2019, 1:01pm UTC](https://discuss.elastic.co/t/how-to-rotate-x-tick-label-in-canvas-css/197179 "2019-08-29T13:01:13Z")
Hi, there! I'm trying to rotate the X Tick Label using CSS, but without sucess This is my chart: And the expression: filters | essql query="SELECT acao, count(id\_do\_processo) AS conta FROM "mercado\_157\_processo… --- ## [Kibana 6.7 Enable Reporting](https://discuss.elastic.co/t/kibana-6-7-enable-reporting/175074)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [April 3, 2019, 8:44pm UTC](https://discuss.elastic.co/t/kibana-6-7-enable-reporting/175074 "2019-04-03T20:44:27Z")
Hi all, What's needed at a minimum to enable reporting in Kibana? I've tried adding this to kibana.yml xpack.reporting.enabled: true \> {"type":"log","@timestamp":"2019-04-02T21:01:34Z","tags":\["reporting","warning"\]… --- ## [Rollback or downgrade Kibana](https://discuss.elastic.co/t/rollback-or-downgrade-kibana/156918)
**Author:** [@jenyphur](https://discuss.elastic.co/u/jenyphur)\ **Replies:** 2\ **Last updated:** [November 16, 2018, 2:39pm UTC](https://discuss.elastic.co/t/rollback-or-downgrade-kibana/156918 "2018-11-16T14:39:42Z")
I just upgraded our lower environment Kibana to the newest version 6.5 and we are having all kinds of issues. How can I rollback to our last version ? Or downgrade? --- ## [Kibana 5 IIS reverse proxy](https://discuss.elastic.co/t/kibana-5-iis-reverse-proxy/82479)
**Author:** [@FR-TheS](https://discuss.elastic.co/u/FR-TheS)\ **Replies:** 2\ **Last updated:** [April 18, 2017, 8:02am UTC](https://discuss.elastic.co/t/kibana-5-iis-reverse-proxy/82479 "2017-04-18T08:02:57Z")
Hi everyone, I'm blocked about the configuration of kibana5 behind a IIS reverse proxy. I'm trying to redirect myserver/kibana5/ to localhost:5602 (my kibana is cfg with this port because we have two kibana for moment)… --- ## [Is there any way for custom colors and themes in Kibana 4.3.0?](https://discuss.elastic.co/t/is-there-any-way-for-custom-colors-and-themes-in-kibana-4-3-0/36172)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 2\ **Last updated:** [November 17, 2016, 4:45pm UTC](https://discuss.elastic.co/t/is-there-any-way-for-custom-colors-and-themes-in-kibana-4-3-0/36172 "2016-11-17T16:45:21Z")
Is there any way for custom colors and themes in Kibana 4.3.0? I want to customize bar colors....any help? --- ## [Filebeat unable to send data to logstash which results in empty data in elastic & kibana](https://discuss.elastic.co/t/filebeat-unable-to-send-data-to-logstash-which-results-in-empty-data-in-elastic-kibana/230918)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 5\ **Last updated:** [May 8, 2020, 3:03pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-send-data-to-logstash-which-results-in-empty-data-in-elastic-kibana/230918 "2020-05-08T15:03:27Z")
I am trying to deploy ELK stack in openshift platform (OKD - v3.11) and using filebeat to automatically detect the logs. ELK stack versions: FIlebeat - 6.4.1 Logstash - 6.3.1 elastic - 6.5.4 & kibana - 6.5.4 Please… --- ## ["Discover" URL without UUID?](https://discuss.elastic.co/t/discover-url-without-uuid/169379)
**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\ **Replies:** 5\ **Last updated:** [February 22, 2019, 3:23pm UTC](https://discuss.elastic.co/t/discover-url-without-uuid/169379 "2019-02-22T15:23:44Z")
I would like to be able to generate Kibana URLs to include in alert messages that a user can click on to see the filtered data related to the alert. If you construct a filter using the Kibana "discover" GUI the URL it b… --- ## [How much heap size would be good for a machine having 120GB Ram](https://discuss.elastic.co/t/how-much-heap-size-would-be-good-for-a-machine-having-120gb-ram/118814)
**Author:** [@Nitish\_Goyal](https://discuss.elastic.co/u/Nitish_Goyal)\ **Replies:** 5\ **Last updated:** [February 11, 2018, 3:37am UTC](https://discuss.elastic.co/t/how-much-heap-size-would-be-good-for-a-machine-having-120gb-ram/118814 "2018-02-11T03:37:48Z")
I am running elasticsearch 5.4 on a 120 GB machine in production env What should be a good heap size for the machine? Shall we keep the heap size below 32GB as mentioned in the elasticsearch documentation or shall we i… --- ## [X-Pack et logstash](https://discuss.elastic.co/t/x-pack-et-logstash/82739)
**Author:** [@David\_ROELANDT](https://discuss.elastic.co/u/David_ROELANDT)\ **Replies:** 5\ **Last updated:** [April 19, 2017, 8:16am UTC](https://discuss.elastic.co/t/x-pack-et-logstash/82739 "2017-04-19T08:16:04Z")
Bonjour, je viens d'installer X-PACK sur un POC Elasticsuite. Je n'arrive plus à faire communiquer logstash avec ES. J'ai pourtant mis à jour les mots de passe pour les comptes logstash\_system, ainsi que logstash … --- ## [Need help to push pm2 logs into ELK server](https://discuss.elastic.co/t/need-help-to-push-pm2-logs-into-elk-server/329176)
**Author:** [@SUNA](https://discuss.elastic.co/u/SUNA)\ **Replies:** 7\ **Last updated:** [April 4, 2023, 9:16am UTC](https://discuss.elastic.co/t/need-help-to-push-pm2-logs-into-elk-server/329176 "2023-04-04T09:16:55Z")
Hi Team, Could you please help to push pm2 service logs for nodejs application into ELK server. --- ## [Filtering option for Elasticsearch datasource](https://discuss.elastic.co/t/filtering-option-for-elasticsearch-datasource/216194)
**Author:** [@karthick2020](https://discuss.elastic.co/u/karthick2020)\ **Replies:** 7\ **Last updated:** [January 27, 2020, 10:18am UTC](https://discuss.elastic.co/t/filtering-option-for-elasticsearch-datasource/216194 "2020-01-27T10:18:16Z")
Hi Team, For metricbeat agent, a new field is added via metricbeat.yml with below config fields: application: \[“exxS-e11”,“eBxxxxH-e11”,“exxS-e10”\] fields\_under\_root: true So in kibana, the app info is displayed as … --- ## [A problem when I search data from "now-24h" to "now"](https://discuss.elastic.co/t/a-problem-when-i-search-data-from-now-24h-to-now/136843)
**Author:** [@Kevin.Wu](https://discuss.elastic.co/u/Kevin.Wu)\ **Replies:** 1\ **Last updated:** [June 29, 2018, 11:05am UTC](https://discuss.elastic.co/t/a-problem-when-i-search-data-from-now-24h-to-now/136843 "2018-06-29T11:05:12Z")
Hey, I'm trying to search some data from ES, here's my curl command from kibana: GET filebeat\*/\_search?size=0 { "query":{ "bool": { "filter": { "range": { "@timestamp": { "gte": "now-24h", "lte": "now" } } } … --- ## [Add logstash custom pattern error](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 7\ **Last updated:** [November 10, 2016, 3:44am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447 "2016-11-10T03:44:38Z")
hi all, i am beginner with logstash, i have a question about custom pattern for logstash. I want to define new pattern for file\_type like this: DEFGH (?:asd?|bat|chm|cmd|com|dll|do|exe|hlp|hta|js|jse|lnk|ocx|pif|reg|s… --- ## [S3 input plungin config](https://discuss.elastic.co/t/s3-input-plungin-config/25104)
**Author:** [@bsjin](https://discuss.elastic.co/u/bsjin)\ **Replies:** 1\ **Last updated:** [July 29, 2015, 11:00am UTC](https://discuss.elastic.co/t/s3-input-plungin-config/25104 "2015-07-29T11:00:19Z")
Hello. I want input data from S3 bucket to elasticsearch when using logstash So, I don't know Why this Error jbs01@jbs01:~/logstash-1.4.2$ ./bin/logstash -f conf/s3.conf Using milestone 1 input plugin 's3'. This … --- ## [Logstash ruby code DateTime fails](https://discuss.elastic.co/t/logstash-ruby-code-datetime-fails/301137)
**Author:** [@scottfred](https://discuss.elastic.co/u/scottfred)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 8:19pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-datetime-fails/301137 "2022-03-30T20:19:16Z")
I've tried parsing this date string, "2022-01-25 08:30:22.126714" a few different ways in Logstash, but I keep coming up short. I don't want to use filter { date {} }... I should be able to use this ruby code because i… --- ## [Calculate elapsed time without "start" or "end" message](https://discuss.elastic.co/t/calculate-elapsed-time-without-start-or-end-message/89734)
**Author:** [@abrejuin](https://discuss.elastic.co/u/abrejuin)\ **Replies:** 4\ **Last updated:** [June 22, 2017, 10:21am UTC](https://discuss.elastic.co/t/calculate-elapsed-time-without-start-or-end-message/89734 "2017-06-22T10:21:02Z")
Hello, I have some logs generated by a jobs. Each job occur have a unique id but there is no specific start message and no specific end message. I am wondering how can I measured elapsed time between first and last l… --- ## [Dynamic pattern matching over a sequence of events](https://discuss.elastic.co/t/dynamic-pattern-matching-over-a-sequence-of-events/15198)
**Author:** [@Andr\_e](https://discuss.elastic.co/u/Andr_e)\ **Replies:** 4\ **Last updated:** [June 7, 2017, 9:41am UTC](https://discuss.elastic.co/t/dynamic-pattern-matching-over-a-sequence-of-events/15198 "2017-06-07T09:41:21Z")
I'm new to ES and i'm trying to figure out if a certain scenario is possible before making a decision on using ES. Here is the scenario: I have millions of events that are tied to employees, each event also contains … --- ## [=\>"Unsupported Netflow version v10" warning using ipt-netflow](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456)
**Author:** [@DRW](https://discuss.elastic.co/u/DRW)\ **Replies:** 4\ **Last updated:** [July 7, 2016, 2:12pm UTC](https://discuss.elastic.co/t/unsupported-netflow-version-v10-warning-using-ipt-netflow/54456 "2016-07-07T14:12:53Z")
Hi. I'm using ipt-netflow (https://github.com/aabc/ipt-netflow) to send netflow data at logstash. I am getting this. {:timestamp=\>"2016-06-30T17:26:06.068000+0000", :message=\>"Pipeline main started"} {:timestamp=\>"… --- ## [Why is the advanced setting \`state:storeInSessionStorage\` turned off by default?](https://discuss.elastic.co/t/why-is-the-advanced-setting-state-storeinsessionstorage-turned-off-by-default/247308)
**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Replies:** 3\ **Last updated:** [September 4, 2020, 1:39am UTC](https://discuss.elastic.co/t/why-is-the-advanced-setting-state-storeinsessionstorage-turned-off-by-default/247308 "2020-09-04T01:39:39Z")
I have a Vega which has too large URLs and will be access error by default setting. Therefore I want to change the advanced setting state:storeInSessionStorage turn on to able to load the Dashboard with Vega. However I… --- ## [Additional Variable adding in Detection EMAIL body](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 4\ **Last updated:** [May 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/additional-variable-adding-in-detection-email-body/273290 "2021-05-23T10:14:25Z")
Hi, I am trying to add additional fields in EMAIL message in my detection email alert action. {{#context.alerts}} Message : {{message}} port: {{port}} URL Host : {{url.host}} Http Connect: {{http.connect.host}} {… --- ## [Kibana health check for ingress health check?](https://discuss.elastic.co/t/kibana-health-check-for-ingress-health-check/289553)
**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\ **Replies:** 2\ **Last updated:** [November 23, 2021, 9:08am UTC](https://discuss.elastic.co/t/kibana-health-check-for-ingress-health-check/289553 "2021-11-23T09:08:19Z")
What's a lightweight endpoint that I can specify for a health check (to be used for alb.ingress.kubernetes.io/healthcheck-path)? I've seen /health suggested, but that takes a quarter of a second to send vast quantities … --- ## [Aggregating array of objects](https://discuss.elastic.co/t/aggregating-array-of-objects/160745)
**Author:** [@sp90](https://discuss.elastic.co/u/sp90)\ **Replies:** 2\ **Last updated:** [December 14, 2018, 8:20am UTC](https://discuss.elastic.co/t/aggregating-array-of-objects/160745 "2018-12-14T08:20:18Z")
Im trying to figure out what im doing wrong, i have collected the following, "Sub set of data", "Current query", "Current output" & "Desired output" if more is required please let me know. This is how my data objects lo… --- ## [Elasticsearch 2.0, Kibana 4.2, Logstash 2.0, Shield + Watcher 2.0, & more are now available!](https://discuss.elastic.co/t/elasticsearch-2-0-kibana-4-2-logstash-2-0-shield-watcher-2-0-more-are-now-available/33175)
**Author:** [@michelle](https://discuss.elastic.co/u/michelle)\ **Replies:** 2\ **Last updated:** [November 24, 2015, 6:34pm UTC](https://discuss.elastic.co/t/elasticsearch-2-0-kibana-4-2-logstash-2-0-shield-watcher-2-0-more-are-now-available/33175 "2015-11-24T18:34:30Z")
Elasticsearch 2.0, Kibana 4.2, Logstash 2.0, Shield + Watcher 2.0, & more are now available! Learn the details about all the new goodness on the blog, watch the Elasticsearch 2.0 Overview & Demo video, and download the… [Previous page](https://discuss.elastic.co/top.md?page=829&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=831&per_page=50&period=all)