# Top

**URL:** https://discuss.elastic.co/top.md?page=831&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 832

---

## [.NET setting field as Date](https://discuss.elastic.co/t/net-setting-field-as-date/126947)

<div class="topic-metadata">

**Author:** [@Neal\_Walters](https://discuss.elastic.co/u/Neal_Walters)\
**Replies:** 6\
**Last updated:** [April 9, 2018, 3:52pm UTC](https://discuss.elastic.co/t/net-setting-field-as-date/126947 "2018-04-09T15:52:03Z")

</div>

I'm trying to define the field createdDate below as a datetime, using .NET: \[Kibana\_CreatedDate\] Here's my existing code; had trouble finding any examples for the .NET classes. Maybe my date format needs to have the m…

---

## [Basic license with Marvel 1.3](https://discuss.elastic.co/t/basic-license-with-marvel-1-3/36958)

<div class="topic-metadata">

**Author:** [@suitingtseng](https://discuss.elastic.co/u/suitingtseng)\
**Replies:** 6\
**Last updated:** [December 11, 2015, 11:22am UTC](https://discuss.elastic.co/t/basic-license-with-marvel-1-3/36958 "2015-12-11T11:22:14Z")

</div>

Basic license works with Marvel 2.X. Is it possible to use Marvel 1.3 with basic license?

---

## [How many shards should I put in a node？](https://discuss.elastic.co/t/how-many-shards-should-i-put-in-a-node/27544)

<div class="topic-metadata">

**Author:** [@shinyke](https://discuss.elastic.co/u/shinyke)\
**Replies:** 6\
**Last updated:** [August 19, 2015, 3:21am UTC](https://discuss.elastic.co/t/how-many-shards-should-i-put-in-a-node/27544 "2015-08-19T03:21:28Z")

</div>

Hi, I'm confused about how many shards should I put in a node(64G mem and 32 processers with 500G disk). Is there a range recommended？Some project also calculate the number of shards by capacity，in their testing, a 20…

---

## [Passing a list of Connections](https://discuss.elastic.co/t/passing-a-list-of-connections/27415)

<div class="topic-metadata">

**Author:** [@Garrett\_Johnson](https://discuss.elastic.co/u/Garrett_Johnson)\
**Replies:** 6\
**Last updated:** [August 17, 2015, 5:49pm UTC](https://discuss.elastic.co/t/passing-a-list-of-connections/27415 "2015-08-17T17:49:51Z")

</div>

I'm using ElasticSearch.net and playing around with Connection Pooling Sniffing etc. Looking at the docs I don't know how to tell it a list of URi's ... If I choose just one URI and it is dead how would it figure ou…

---

## [Failover](https://discuss.elastic.co/t/failover/6663)

<div class="topic-metadata">

**Author:** [@rbrc](https://discuss.elastic.co/u/rbrc)\
**Replies:** 6\
**Last updated:** [May 15, 2012, 12:05pm UTC](https://discuss.elastic.co/t/failover/6663 "2012-05-15T12:05:55Z")

</div>

I'm setting up elasticsearch in AWS and I'm trying to figure out how to deal with a node going down. Specifically, if I have 2 ES servers \[s01, s02\], and my app is configured to always hit s01, how can i get it to fa…

---

## [What is the default value of precision threshold in cardinality aggregation if we dont specify any value explicitly?](https://discuss.elastic.co/t/what-is-the-default-value-of-precision-threshold-in-cardinality-aggregation-if-we-dont-specify-any-value-explicitly/90257)

<div class="topic-metadata">

**Author:** [@madhvi12](https://discuss.elastic.co/u/madhvi12)\
**Replies:** 1\
**Last updated:** [June 23, 2017, 2:22pm UTC](https://discuss.elastic.co/t/what-is-the-default-value-of-precision-threshold-in-cardinality-aggregation-if-we-dont-specify-any-value-explicitly/90257 "2017-06-23T14:22:48Z")

</div>

I am using cardinality aggregation which is giving me wrong values when I am not specifying any value for precision threshol but when specifying any value greater than cardinality result it is givng me the correct value.…

---

## [Kibana or elastic url not working after applying xpack -- redirected you too many times](https://discuss.elastic.co/t/kibana-or-elastic-url-not-working-after-applying-xpack-redirected-you-too-many-times/79099)

<div class="topic-metadata">

**Author:** [@Bob\_Metelsky](https://discuss.elastic.co/u/Bob_Metelsky)\
**Replies:** 1\
**Last updated:** [March 18, 2017, 2:48am UTC](https://discuss.elastic.co/t/kibana-or-elastic-url-not-working-after-applying-xpack-redirected-you-too-many-times/79099 "2017-03-18T02:48:20Z")

</div>

4 node physical cluster running redhat 6.5 all components 5.2 from elastics repository Installing xpack from this guide https://www.elastic.co/downloads/x-pack installed xpack on ES - seemed clean installed xpack o…

---

## [Heartbeat Config advice](https://discuss.elastic.co/t/heartbeat-config-advice/155611)

<div class="topic-metadata">

**Author:** [@Francois\_013](https://discuss.elastic.co/u/Francois_013)\
**Replies:** 5\
**Last updated:** [November 17, 2018, 3:21am UTC](https://discuss.elastic.co/t/heartbeat-config-advice/155611 "2018-11-17T03:21:08Z")

</div>

Hi, I’m trying to configure a heartbeat http monitor to monitor a https URL protected by a client certificate. But it seems that I cannot get it working in a proper way. I’ve tried serval configs listed below: Config …

---

## [File input not updating](https://discuss.elastic.co/t/file-input-not-updating/126979)

<div class="topic-metadata">

**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Replies:** 5\
**Last updated:** [April 9, 2018, 10:39am UTC](https://discuss.elastic.co/t/file-input-not-updating/126979 "2018-04-09T10:39:34Z")

</div>

Hi, I've got a small issue with the updating of an index from a csv. The PowerShell script I've written to convert a xml file into a csv file works by copying the xml file to the local storage, converting it and writing…

---

## [Monitoring multiple kibana instances](https://discuss.elastic.co/t/monitoring-multiple-kibana-instances/122554)

<div class="topic-metadata">

**Author:** [@alepuccetti](https://discuss.elastic.co/u/alepuccetti)\
**Replies:** 5\
**Last updated:** [March 8, 2018, 11:28am UTC](https://discuss.elastic.co/t/monitoring-multiple-kibana-instances/122554 "2018-03-08T11:28:41Z")

</div>

Hi everyone, I have a production cluster (version 5.6.4) and a separate monitoring cluster (version 6.2). I noticed that if I enter in the monitoring section and select the production cluster i the Kibana section I see …

---

## [Workaround for Network Volume](https://discuss.elastic.co/t/workaround-for-network-volume/100717)

<div class="topic-metadata">

**Author:** [@alhbs](https://discuss.elastic.co/u/alhbs)\
**Replies:** 5\
**Last updated:** [September 15, 2017, 8:29pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717 "2017-09-15T20:29:21Z")

</div>

According to the FAQ (https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes) , it's recommended not to use network volumes. How can I work around this? I'm considering setting up a V…

---

## [Backup snapshot using curator older than 30days](https://discuss.elastic.co/t/backup-snapshot-using-curator-older-than-30days/76151)

<div class="topic-metadata">

**Author:** [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\
**Replies:** 5\
**Last updated:** [March 7, 2017, 3:55pm UTC](https://discuss.elastic.co/t/backup-snapshot-using-curator-older-than-30days/76151 "2017-03-07T15:55:29Z")

</div>

Hi, Kindly correct this command curator --host localhost --port 9200 snapshot indices --skip-repo-validation --repository backups --time-unit days --older-than 30 --timestring '%Y.%m.%d' …

---

## [Licensing Model and Pricing for Elastic search](https://discuss.elastic.co/t/licensing-model-and-pricing-for-elastic-search/202016)

<div class="topic-metadata">

**Author:** [@premreddy](https://discuss.elastic.co/u/premreddy)\
**Replies:** 2\
**Last updated:** [October 13, 2019, 3:51pm UTC](https://discuss.elastic.co/t/licensing-model-and-pricing-for-elastic-search/202016 "2019-10-13T15:51:58Z")

</div>

Hello, Can you please let me know how the Licensing Model of elastic search and Logstash works. We are looking at bundling Elastic search as an Appliance that will be deployed as part of our Product. We need some of Xp…

---

## [Rollup index pattern bug with erroneously detected multiple histograms?](https://discuss.elastic.co/t/rollup-index-pattern-bug-with-erroneously-detected-multiple-histograms/176021)

<div class="topic-metadata">

**Author:** [@Bankert](https://discuss.elastic.co/u/Bankert)\
**Replies:** 1\
**Last updated:** [April 12, 2019, 11:08am UTC](https://discuss.elastic.co/t/rollup-index-pattern-bug-with-erroneously-detected-multiple-histograms/176021 "2019-04-12T11:08:19Z")

</div>

note: this question is obviously similar to this post, but it was closed without any replies. When I want to create an index pattern on a rollup job I get the message "Rollup index pattern error: Multiple date histogram…

---

## [Getting Error : ( Unable to fetch mapping.Do you have indices matching the pattern?)](https://discuss.elastic.co/t/getting-error-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/101273)

<div class="topic-metadata">

**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\
**Replies:** 4\
**Last updated:** [September 21, 2017, 10:09am UTC](https://discuss.elastic.co/t/getting-error-unable-to-fetch-mapping-do-you-have-indices-matching-the-pattern/101273 "2017-09-21T10:09:40Z")

</div>

I have logstash (V - 5.4.0) installed on a local server and elasticsearch and kibana on another server (both of V - 5.4.3). I have installed X-pack (V - 5.4.3) on elasticsearch and kibana. but when i'm trying to load …

---

## [Filtering data in logstash config file for couchdb](https://discuss.elastic.co/t/filtering-data-in-logstash-config-file-for-couchdb/29144)

<div class="topic-metadata">

**Author:** [@imad](https://discuss.elastic.co/u/imad)\
**Replies:** 4\
**Last updated:** [September 15, 2015, 6:10pm UTC](https://discuss.elastic.co/t/filtering-data-in-logstash-config-file-for-couchdb/29144 "2015-09-15T18:10:45Z")

</div>

I have views in my couchdb databases. WIth logstash config file, can I filter to get only valid documents in my indices in ElasticSearch and not the the views? I have multiple databases in couchdb and I have created indi…

---

## [Logstash Under Windows Server - Questions](https://discuss.elastic.co/t/logstash-under-windows-server-questions/24000)

<div class="topic-metadata">

**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Replies:** 4\
**Last updated:** [June 22, 2015, 4:22am UTC](https://discuss.elastic.co/t/logstash-under-windows-server-questions/24000 "2015-06-22T04:22:10Z")

</div>

Hi all, I have a few questions about using logstash under Windows Server. How LogStash implemented on Windows servers? As a windows service (application running in the background like a daemon)? As a plug-in to t…

---

## [Logstash config for parsing ASA logs](https://discuss.elastic.co/t/logstash-config-for-parsing-asa-logs/262563)

<div class="topic-metadata">

**Author:** [@psycadelicgecko](https://discuss.elastic.co/u/psycadelicgecko)\
**Replies:** 2\
**Last updated:** [February 11, 2021, 5:00pm UTC](https://discuss.elastic.co/t/logstash-config-for-parsing-asa-logs/262563 "2021-02-11T17:00:27Z")

</div>

So I am brand new to ELK/Elastic so I'm sure I'm doing at least a few things wrong. I was able to find a couple examples of Logstash config files for parsing ASA logs. They are similar to what I've seen on this forum. S…

---

## [Rollback documents and index](https://discuss.elastic.co/t/rollback-documents-and-index/105835)

<div class="topic-metadata">

**Author:** [@nkdev89](https://discuss.elastic.co/u/nkdev89)\
**Replies:** 2\
**Last updated:** [October 31, 2017, 8:36am UTC](https://discuss.elastic.co/t/rollback-documents-and-index/105835 "2017-10-31T08:36:14Z")

</div>

Hi , I'm new to ES , I'm looking for Rollback functionality to rollback new index and a document from another index if any exception occurred during the process. How can i do this ? , Can you please help me with this . …

---

## [Create A Watcher to watch for changes in a fields](https://discuss.elastic.co/t/create-a-watcher-to-watch-for-changes-in-a-fields/32396)

<div class="topic-metadata">

**Author:** [@melaleuca5](https://discuss.elastic.co/u/melaleuca5)\
**Replies:** 2\
**Last updated:** [March 12, 2017, 11:30pm UTC](https://discuss.elastic.co/t/create-a-watcher-to-watch-for-changes-in-a-fields/32396 "2017-03-12T23:30:56Z")

</div>

Anybody have an example of a watcher that will monitor lets say the changes in prices for a specific product.

---

## [Error-Failed version compatibility check with elasticsearch: tls: failed to verify certificate: x509: certificate signed by unknown authority](https://discuss.elastic.co/t/error-failed-version-compatibility-check-with-elasticsearch-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/349711)

<div class="topic-metadata">

**Author:** [@Austin1](https://discuss.elastic.co/u/Austin1)\
**Replies:** 6\
**Last updated:** [January 5, 2024, 5:26am UTC](https://discuss.elastic.co/t/error-failed-version-compatibility-check-with-elasticsearch-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/349711 "2024-01-05T05:26:41Z")

</div>

Hi all , Please help me with setting up elastic agent container! I got below error when I used podman run command followed: Error-Failed version compatibility check with elasticsearch: tls: failed to verify certificat…

---

## [Insert and Update records in Elasticsearch](https://discuss.elastic.co/t/insert-and-update-records-in-elasticsearch/271459)

<div class="topic-metadata">

**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\
**Replies:** 6\
**Last updated:** [May 14, 2021, 2:12am UTC](https://discuss.elastic.co/t/insert-and-update-records-in-elasticsearch/271459 "2021-05-14T02:12:22Z")

</div>

Hi, I am looping through each record in elasticsearch and inserting the new records and updating the existing records. Say for example, i have a csv file which has 5000 records, only few are updated in the index and the…

---

## [Append to an existing field (String)](https://discuss.elastic.co/t/append-to-an-existing-field-string/192478)

<div class="topic-metadata">

**Author:** [@bobsmith](https://discuss.elastic.co/u/bobsmith)\
**Replies:** 6\
**Last updated:** [July 26, 2019, 4:59pm UTC](https://discuss.elastic.co/t/append-to-an-existing-field-string/192478 "2019-07-26T16:59:29Z")

</div>

I have to be able to index very large files and part of that includes indexing on their content. For the sake of this post let's assume all of my files are just .txt files. If my file is 1GB I will have trouble indexing …

---

## [Need help with Elasticsearch query](https://discuss.elastic.co/t/need-help-with-elasticsearch-query/218399)

<div class="topic-metadata">

**Author:** [@ankitwandx](https://discuss.elastic.co/u/ankitwandx)\
**Replies:** 8\
**Last updated:** [February 11, 2020, 9:41am UTC](https://discuss.elastic.co/t/need-help-with-elasticsearch-query/218399 "2020-02-11T09:41:58Z")

</div>

I am fairly new with ES queries. Need urgent help with this:

---

## [Add docker metadata not working even after trying all possible combinations](https://discuss.elastic.co/t/add-docker-metadata-not-working-even-after-trying-all-possible-combinations/158075)

<div class="topic-metadata">

**Author:** [@diya](https://discuss.elastic.co/u/diya)\
**Replies:** 8\
**Last updated:** [November 27, 2018, 12:19am UTC](https://discuss.elastic.co/t/add-docker-metadata-not-working-even-after-trying-all-possible-combinations/158075 "2018-11-27T00:19:28Z")

</div>

Am able to visualise the docker logs on kibana but with container id. I want to add container name to my logs for easy filtering.I have tried add\_docker\_metadata: ~ but in vain.I have tried differnt possible combinations…

---

## [Not able to see filebeat-\* index pattern in kibana](https://discuss.elastic.co/t/not-able-to-see-filebeat-index-pattern-in-kibana/127072)

<div class="topic-metadata">

**Author:** [@Parthgandhi](https://discuss.elastic.co/u/Parthgandhi)\
**Replies:** 8\
**Last updated:** [April 19, 2018, 10:02am UTC](https://discuss.elastic.co/t/not-able-to-see-filebeat-index-pattern-in-kibana/127072 "2018-04-19T10:02:06Z")

</div>

Hi, I did a fresh installation of ELK stack on a single server and installed filebeat on the same server to view and analyze the syslog. http://robwillis.info/2017/04/elk-5-on-ubuntu-pt-2-installing-and-configuring-ela…

---

## [Timestamps are getting merged when ingesting old data using filebeat](https://discuss.elastic.co/t/timestamps-are-getting-merged-when-ingesting-old-data-using-filebeat/97975)

<div class="topic-metadata">

**Author:** [@Manikanth\_Reddy](https://discuss.elastic.co/u/Manikanth_Reddy)\
**Replies:** 8\
**Last updated:** [August 25, 2017, 8:32pm UTC](https://discuss.elastic.co/t/timestamps-are-getting-merged-when-ingesting-old-data-using-filebeat/97975 "2017-08-25T20:32:34Z")

</div>

vmstat Log File 1: Fri Mar 17 15:00:37 CDT 2017 kthr memory page disk faults cpu r b w swap free re mf pi po fr de sr m0 m1 m2 m3 in sy cs us sy id 3 0 0 113340 8…

---

## [Sending apache logs to elastic search](https://discuss.elastic.co/t/sending-apache-logs-to-elastic-search/93012)

<div class="topic-metadata">

**Author:** [@rkpotdar](https://discuss.elastic.co/u/rkpotdar)\
**Replies:** 3\
**Last updated:** [July 13, 2017, 2:00pm UTC](https://discuss.elastic.co/t/sending-apache-logs-to-elastic-search/93012 "2017-07-13T14:00:27Z")

</div>

Is it mandatory to have logstash installed to send the logs to elastic search? Can the filbeat not send apache logs directly to elasticsearch?

---

## [One of the Shard stuck at INITIALIZING state](https://discuss.elastic.co/t/one-of-the-shard-stuck-at-initializing-state/58522)

<div class="topic-metadata">

**Author:** [@Sriranga](https://discuss.elastic.co/u/Sriranga)\
**Replies:** 3\
**Last updated:** [August 22, 2016, 5:35am UTC](https://discuss.elastic.co/t/one-of-the-shard-stuck-at-initializing-state/58522 "2016-08-22T05:35:51Z")

</div>

I have a Master + 2 Data nodes type cluster. One of the shards related to one of the indices is INITIALIZING in state since a long time. what can be done to get rid of this and make the cluster Green

---

## [How to parse docker logs (nested serialized JSON)](https://discuss.elastic.co/t/how-to-parse-docker-logs-nested-serialized-json/85940)

<div class="topic-metadata">

**Author:** [@hunterchris](https://discuss.elastic.co/u/hunterchris)\
**Replies:** 1\
**Last updated:** [May 17, 2017, 12:14pm UTC](https://discuss.elastic.co/t/how-to-parse-docker-logs-nested-serialized-json/85940 "2017-05-17T12:14:34Z")

</div>

Hello, I have an AWS Beanstalk environment with docker and I'm sending different logs to logstash, however I'm finding problems parsing the /var/lib/docker/containers//-json.log which has the following format: {"log":"…

---

## [Retrieving all records from query search without having to use .size -ElasticsSearch](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440)

<div class="topic-metadata">

**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\
**Replies:** 5\
**Last updated:** [July 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440 "2021-07-12T16:53:33Z")

</div>

I noticed that when running the following dsl query search on the cli console for ElasticSearch that it will only return a few of the records. If I add a "size": 3000, then I will be able to retrieve more than I original…

---

## [Elasticsearch query search sort return null](https://discuss.elastic.co/t/elasticsearch-query-search-sort-return-null/256064)

<div class="topic-metadata">

**Author:** [@magesh\_kumar](https://discuss.elastic.co/u/magesh_kumar)\
**Replies:** 5\
**Last updated:** [December 8, 2020, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-query-search-sort-return-null/256064 "2020-12-08T10:19:25Z")

</div>

I'm recently upgrade elasticsearch to 7.9.3 version. All are good but sort not working in one of my index called user\_products. searched query curl -X GET "localhost:9200/user\_products/\_search?pretty" -H 'Content-Typ…

---

## [New field to filebeat.tempalte.default.json](https://discuss.elastic.co/t/new-field-to-filebeat-tempalte-default-json/104285)

<div class="topic-metadata">

**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\
**Replies:** 5\
**Last updated:** [November 20, 2017, 11:11pm UTC](https://discuss.elastic.co/t/new-field-to-filebeat-tempalte-default-json/104285 "2017-11-20T23:11:24Z")

</div>

Hi guys, i am new to elk architecture and trying to understand how can i add extra fields to my default filebeat.tempalte.default.json search pattern that i loaded on ELK server by executing: curl -XPUT 'http://localhos…

---

## [Runtime Fields in Detection Rule](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669)

<div class="topic-metadata">

**Author:** [@beijo](https://discuss.elastic.co/u/beijo)\
**Replies:** 4\
**Last updated:** [January 31, 2022, 5:53pm UTC](https://discuss.elastic.co/t/runtime-fields-in-detection-rule/295669 "2022-01-31T17:53:07Z")

</div>

Hello, I created a runtime field which I need to use in a detection rule, but I get no alerts. For the detection rule I used "Custom Query" (KQL) and I made sure to use the correct index pattern (the one where the runti…

---

## [Curl Xdelete with ELASTICSEARCH 6.1](https://discuss.elastic.co/t/curl-xdelete-with-elasticsearch-6-1/114461)

<div class="topic-metadata">

**Author:** [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Replies:** 4\
**Last updated:** [January 8, 2018, 8:33am UTC](https://discuss.elastic.co/t/curl-xdelete-with-elasticsearch-6-1/114461 "2018-01-08T08:33:17Z")

</div>

Hello Do you know how I can delete document in one curl command ? I have a index called "myindex". I want to delete all document where the field prediction is like "yes" With Elasticsearch 2.1, I use: curl.exe -XDE…

---

## [How industrialize a Kibana solution?](https://discuss.elastic.co/t/how-industrialize-a-kibana-solution/24802)

<div class="topic-metadata">

**Author:** [@cherah30](https://discuss.elastic.co/u/cherah30)\
**Replies:** 4\
**Last updated:** [July 6, 2015, 12:25pm UTC](https://discuss.elastic.co/t/how-industrialize-a-kibana-solution/24802 "2015-07-06T12:25:26Z")

</div>

My usage scenario is the following: I have n customers. I want to create one dashboard per customer. First, i create a dashboard for my 1st customer. Then, I want to generate a script from this dashboard to generate a da…

---

## [Is it possible to override the tile map tooltip to display something other than lat/lon?](https://discuss.elastic.co/t/is-it-possible-to-override-the-tile-map-tooltip-to-display-something-other-than-lat-lon/65050)

<div class="topic-metadata">

**Author:** [@Tom\_Davidson](https://discuss.elastic.co/u/Tom_Davidson)\
**Replies:** 1\
**Last updated:** [November 4, 2016, 7:36pm UTC](https://discuss.elastic.co/t/is-it-possible-to-override-the-tile-map-tooltip-to-display-something-other-than-lat-lon/65050 "2016-11-04T19:36:38Z")

</div>

I am trying to create a dashboard that shows a geo aggregation by zip code. I have a table that converts zip codes to geo points and I can create a tile map just fine, but I want the visualization to show you the zip cod…

---

## [Action export selected signals to csv](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 7\
**Last updated:** [January 29, 2021, 4:04pm UTC](https://discuss.elastic.co/t/action-export-selected-signals-to-csv/262497 "2021-01-29T16:04:29Z")

</div>

hello, Just a thought for a SIEM feature. We have colleagues with limited or no acces to Elastic / Kibana. But sometimes they do need to get a list of some signals. Imho it would be super handy to be able to quickly exp…

---

## [Elasticsearch cluster with AWS ELB randomly disconnects from applications](https://discuss.elastic.co/t/elasticsearch-cluster-with-aws-elb-randomly-disconnects-from-applications/133217)

<div class="topic-metadata">

**Author:** [@mabidi](https://discuss.elastic.co/u/mabidi)\
**Replies:** 7\
**Last updated:** [June 12, 2018, 9:17pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-aws-elb-randomly-disconnects-from-applications/133217 "2018-06-12T21:17:36Z")

</div>

We have elasticsearch 5.5.3 cluster with an ELB to load balance the traffic to the cluster but every so often our search microservices that connect to the cluster via ELB FQDN (fully qualified domain name) throw this exc…

---

## [How to parse the log using grok to get the key value pairs from the log, and have the key as a new field](https://discuss.elastic.co/t/how-to-parse-the-log-using-grok-to-get-the-key-value-pairs-from-the-log-and-have-the-key-as-a-new-field/82623)

<div class="topic-metadata">

**Author:** [@sanju090](https://discuss.elastic.co/u/sanju090)\
**Replies:** 1\
**Last updated:** [April 17, 2017, 7:53pm UTC](https://discuss.elastic.co/t/how-to-parse-the-log-using-grok-to-get-the-key-value-pairs-from-the-log-and-have-the-key-as-a-new-field/82623 "2017-04-17T19:53:35Z")

</div>

{"apiResponse":"{\\"errors\\":\[{\\"code\\":\\"APP-1007\\",\\"message\\":\\"Session has Expired.\\",\\"fields\\":null}\],\\"warnings\\":null}","requestUrl":"http://localhost:8082/checkSessionValidity"} This is how the message looks li…

---

## [Can we use MinIO with NFS for snapshot/restore repo +50TB?](https://discuss.elastic.co/t/can-we-use-minio-with-nfs-for-snapshot-restore-repo-50tb/315426)

<div class="topic-metadata">

**Author:** [@markn](https://discuss.elastic.co/u/markn)\
**Replies:** 2\
**Last updated:** [September 29, 2022, 7:03am UTC](https://discuss.elastic.co/t/can-we-use-minio-with-nfs-for-snapshot-restore-repo-50tb/315426 "2022-09-29T07:03:09Z")

</div>

Hi all, we cannot backup outside our data center. Hence we want to use MinIO according to the documentation: Only our cheapest storage is NFSv3 but MinIO recommends not to use that: https://min.io/docs/minio/containe…

---

## [Pie chart aggregating elements of an array field](https://discuss.elastic.co/t/pie-chart-aggregating-elements-of-an-array-field/157107)

<div class="topic-metadata">

**Author:** [@guilherme\_maranhao](https://discuss.elastic.co/u/guilherme_maranhao)\
**Replies:** 2\
**Last updated:** [November 16, 2018, 10:38pm UTC](https://discuss.elastic.co/t/pie-chart-aggregating-elements-of-an-array-field/157107 "2018-11-16T22:38:31Z")

</div>

Hi there, I have the following situation: 1 - My index mapping contains: "my\_array": { "properties": { "desc": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 2…

---

## [Kibana Logstashmonitoringが表示されない](https://discuss.elastic.co/t/kibana-logstashmonitoring/193934)

<div class="topic-metadata">

**Author:** [@harue](https://discuss.elastic.co/u/harue)\
**Replies:** 3\
**Last updated:** [August 21, 2019, 1:57am UTC](https://discuss.elastic.co/t/kibana-logstashmonitoring/193934 "2019-08-21T01:57:01Z")

</div>

Kibana Logstash monitoringの画面表示について 以下の設定を行いLogstashを起動しましたが monitoriongのインデックス作成・画面表示が行われません。 Kibanaバージョン：7.1 Logstashバージョン：7.1 ①下記URLに則り、ymlとconfigを設定 →NG https://www.elastic.co/guide/en/logstash/current/configur…

---

## [Logstash file input](https://discuss.elastic.co/t/logstash-file-input/58076)

<div class="topic-metadata">

**Author:** [@datadude](https://discuss.elastic.co/u/datadude)\
**Replies:** 3\
**Last updated:** [August 16, 2016, 3:15pm UTC](https://discuss.elastic.co/t/logstash-file-input/58076 "2016-08-16T15:15:01Z")

</div>

Trying to figure out an issue with file input It just doesn't seem to be reading the file. It is a suricata eve.json file - permissions look fine (world readable) - verbose output says it registers the file - …

---

## [Synonym not working for some entry](https://discuss.elastic.co/t/synonym-not-working-for-some-entry/14863)

<div class="topic-metadata">

**Author:** [@paul1](https://discuss.elastic.co/u/paul1)\
**Replies:** 3\
**Last updated:** [December 14, 2013, 3:09pm UTC](https://discuss.elastic.co/t/synonym-not-working-for-some-entry/14863 "2013-12-14T15:09:42Z")

</div>

The synonym entries marked in yellow does not work When i search mit it does not show any results but it works for other entries ES version 0.90.0 Java Version "1.7.0\_45" my synonym .txt russia, ussr, russian…

---

## [Logstash does not send data to elastic search](https://discuss.elastic.co/t/logstash-does-not-send-data-to-elastic-search/60321)

<div class="topic-metadata">

**Author:** [@manishsh](https://discuss.elastic.co/u/manishsh)\
**Replies:** 3\
**Last updated:** [September 13, 2016, 2:12pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-data-to-elastic-search/60321 "2016-09-13T14:12:58Z")

</div>

I am trying to run elastic search to send data to Amazon ES. Have configured everything including Amazon Plugin but it is not sending anything to Amazon ES. After Pipeline Main Started nothing happpen

---

## [Cannot Find elasticsearch.yml from ElasticStack in Azure](https://discuss.elastic.co/t/cannot-find-elasticsearch-yml-from-elasticstack-in-azure/138613)

<div class="topic-metadata">

**Author:** [@nenjotsu](https://discuss.elastic.co/u/nenjotsu)\
**Replies:** 5\
**Last updated:** [July 18, 2018, 7:38am UTC](https://discuss.elastic.co/t/cannot-find-elasticsearch-yml-from-elasticstack-in-azure/138613 "2018-07-18T07:38:07Z")

</div>

I've created an ElasticStack from Azure but I cannot find the elasticsearch.yml file to edit. I have an access via ssh but there's no any file in it. Where can I find the elasticsearch.yml. Thanks

---

## [Unable to filter on data\_stream.namespace via Log Stream in Dashboard](https://discuss.elastic.co/t/unable-to-filter-on-data-stream-namespace-via-log-stream-in-dashboard/298736)

<div class="topic-metadata">

**Author:** [@Josh\_G](https://discuss.elastic.co/u/Josh_G)\
**Replies:** 4\
**Last updated:** [March 10, 2022, 9:11am UTC](https://discuss.elastic.co/t/unable-to-filter-on-data-stream-namespace-via-log-stream-in-dashboard/298736 "2022-03-10T09:11:49Z")

</div>

When selecting Log Stream when creating a Dashboard there are no available data stream or namespace fields to filter on only event.dataset and we'd rather not have to use unique datasets (due to the additional indicies t…

---

## [Kibana4.6.1 Map visualization is showing blank/white background?](https://discuss.elastic.co/t/kibana4-6-1-map-visualization-is-showing-blank-white-background/62737)

<div class="topic-metadata">

**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\
**Replies:** 4\
**Last updated:** [October 13, 2016, 4:12pm UTC](https://discuss.elastic.co/t/kibana4-6-1-map-visualization-is-showing-blank-white-background/62737 "2016-10-13T16:12:48Z")

</div>

Hi Experts, Initially I was working on kibana 4.3 and I got to know since june map API has been stopped so I migrated my solution to Kibana 4.6 . Now I am facing a new problem with kibana map , it shows dots as per sou…

---

## [Metric's meter.count ruby variable name?](https://discuss.elastic.co/t/metrics-meter-count-ruby-variable-name/2051)

<div class="topic-metadata">

**Author:** [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\
**Replies:** 4\
**Last updated:** [June 6, 2015, 11:33pm UTC](https://discuss.elastic.co/t/metrics-meter-count-ruby-variable-name/2051 "2015-06-06T23:33:43Z")

</div>

I am trying to edit the metric's meter.count value with the ruby filter. Does anyone know the variable name of the metric? I know it isn't Event\['meter\_name.count'\]

[Previous page](https://discuss.elastic.co/top.md?page=830&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=832&per_page=50&period=all)
