# Top **URL:** https://discuss.elastic.co/top.md?page=846&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 847 --- ## [Filebeat Netflow Module || Kibana Dashboard Extremly Slow](https://discuss.elastic.co/t/filebeat-netflow-module-kibana-dashboard-extremly-slow/269926)
**Author:** [@albertosoares](https://discuss.elastic.co/u/albertosoares)\ **Replies:** 6\ **Last updated:** [April 21, 2021, 1:18am UTC](https://discuss.elastic.co/t/filebeat-netflow-module-kibana-dashboard-extremly-slow/269926 "2021-04-21T01:18:16Z")
I've deployed the Netflow module and when I go to the Filebeat Netflow Dashboards and I query for 24 hours, today or 4 hours the query is extremely slow. Environment ELK 7.12 3 data nodes (12 vCPU, 10 RAM -Xms5g m / -… --- ## [Only few hit content files are showing the correct results - custom analyzer](https://discuss.elastic.co/t/only-few-hit-content-files-are-showing-the-correct-results-custom-analyzer/229330)
**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\ **Replies:** 8\ **Last updated:** [April 30, 2020, 8:58pm UTC](https://discuss.elastic.co/t/only-few-hit-content-files-are-showing-the-correct-results-custom-analyzer/229330 "2020-04-30T20:58:10Z")
Hi, I have created a custom analyzer to recognize special characters in my files such as @,-, /, etc Here is my custom analyzer when i am creating the index: PUT /s3/ { "settings": { "index": { "number\_… --- ## [Attempted to resurrect connection to dead ES instance](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/358120)
**Author:** [@samsu](https://discuss.elastic.co/u/samsu)\ **Replies:** 5\ **Last updated:** [April 24, 2024, 2:19pm UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance/358120 "2024-04-24T14:19:24Z")
i have this error : \[2024-04-24T12:24:55,861\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\] Failed to perform request {:message=\>"Connect to localhost:9200 \[localhost/127.0.0.1\] failed: Connection refused (Connection ref… --- ## [Kibana LogFile Rotation or LogFile Rolling Appender](https://discuss.elastic.co/t/kibana-logfile-rotation-or-logfile-rolling-appender/93610)
**Author:** [@kiranilla](https://discuss.elastic.co/u/kiranilla)\ **Replies:** 2\ **Last updated:** [July 20, 2017, 5:26am UTC](https://discuss.elastic.co/t/kibana-logfile-rotation-or-logfile-rolling-appender/93610 "2017-07-20T05:26:04Z")
I tried logging the kibana console output to a file for that I have done some configuration setting in kibana.yml file as shown below: #logging.dest: stdout logging.dest: C:\\ELK\\ELK5.4\\ELK5.4Backup\\logs\\kibana\\kibana.log … --- ## [Group by data in data table](https://discuss.elastic.co/t/group-by-data-in-data-table/56639)
**Author:** [@jpry](https://discuss.elastic.co/u/jpry)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 2:48am UTC](https://discuss.elastic.co/t/group-by-data-in-data-table/56639 "2016-08-02T02:48:26Z")
Hi there, I would like to group my data using data table visualization so that, if I take the example attached, for each same hostname I could have all the categories gathered in a raw and the corresponding count values… --- ## [Filebeat Not Capturing "hostname" as full FQDN on Windows](https://discuss.elastic.co/t/filebeat-not-capturing-hostname-as-full-fqdn-on-windows/55204)
**Author:** [@l33man24](https://discuss.elastic.co/u/l33man24)\ **Replies:** 2\ **Last updated:** [July 11, 2016, 9:06pm UTC](https://discuss.elastic.co/t/filebeat-not-capturing-hostname-as-full-fqdn-on-windows/55204 "2016-07-11T21:06:58Z")
Hello, I am having an issue with Filebeat v 1.2.3 (but probably others as well as an older one had the same issue) where the host value returns only the hostname and not the full FQDN on Windows clients (E.g. server01 … --- ## [Filebeat exclude lines that start with '+'](https://discuss.elastic.co/t/filebeat-exclude-lines-that-start-with/54466)
**Author:** [@kd5dbl](https://discuss.elastic.co/u/kd5dbl)\ **Replies:** 2\ **Last updated:** [July 1, 2016, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-that-start-with/54466 "2016-07-01T13:55:58Z")
Hi all... i'm trying to use Filebeat (v1.2.3) to exclude all log lines that start with a '+' (plus sign)... I've tried; exclude\_lines: \["^\\+"\] I get the error; Loading config file error: YAML config parsing fail… --- ## [Logstash ruby plugin to get the value from file and append](https://discuss.elastic.co/t/logstash-ruby-plugin-to-get-the-value-from-file-and-append/29895)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 2\ **Last updated:** [September 24, 2015, 6:39am UTC](https://discuss.elastic.co/t/logstash-ruby-plugin-to-get-the-value-from-file-and-append/29895 "2015-09-24T06:39:02Z")
Hi, I was trying to get the first line from the file and try to append the line into my logs,I am able to get the value from file but not able to append the value .. I am doing like if\[classname\] == "java.io.NotSeria… --- ## [Settings SSL/TLS setup with PKCS8 keys](https://discuss.elastic.co/t/settings-ssl-tls-setup-with-pkcs8-keys/127496)
**Author:** [@souf\_el\_badraoui](https://discuss.elastic.co/u/souf_el_badraoui)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 2:27pm UTC](https://discuss.elastic.co/t/settings-ssl-tls-setup-with-pkcs8-keys/127496 "2018-04-10T14:27:37Z")
Hi, I'm trying to set up SSL/TLS with x-pack and running into this on all nodes Caused by: java.lang.IllegalArgumentException: parsed an unsupported object \[PKCS8EncryptedPrivateKeyInfo\] My configuration elasticsearch.… --- ## [PUT API request hangs](https://discuss.elastic.co/t/put-api-request-hangs/5443)
**Author:** [@searchersteve](https://discuss.elastic.co/u/searchersteve)\ **Replies:** 3\ **Last updated:** [September 25, 2011, 12:32am UTC](https://discuss.elastic.co/t/put-api-request-hangs/5443 "2011-09-25T00:32:00Z")
I have process that routinely submits content to ElasticSearch via cURL and the PUT method: curl -XPUT 'http://localhost:9200/twitter/tweets/\_bulk' -d 'XYZ INDEX STUFF' This has worked fine for several months. Re… --- ## [Cumulative Sum Regardless of Time Interval - ES](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval-es/100237)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 4\ **Last updated:** [June 24, 2019, 11:33pm UTC](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval-es/100237 "2019-06-24T23:33:45Z")
Hi, I posted the following in the Kibana category, and it was suggest that it might belong here in Elasticsearch: --- ## [Is there way to get current/default value of config parameters?](https://discuss.elastic.co/t/is-there-way-to-get-current-default-value-of-config-parameters/68927)
**Author:** [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)\ **Replies:** 4\ **Last updated:** [December 14, 2016, 1:39am UTC](https://discuss.elastic.co/t/is-there-way-to-get-current-default-value-of-config-parameters/68927 "2016-12-14T01:39:20Z")
In elasticsearch, is there a way to get the current value for all config parameters? like show variabes in mysql. The issue is, when I set a variable in elasticsearch.yml file I cannot retrieve the new value through ap… --- ## [How to pick another cluster in Marvel](https://discuss.elastic.co/t/how-to-pick-another-cluster-in-marvel/51401)
**Author:** [@xdzhou](https://discuss.elastic.co/u/xdzhou)\ **Replies:** 4\ **Last updated:** [June 30, 2016, 4:30am UTC](https://discuss.elastic.co/t/how-to-pick-another-cluster-in-marvel/51401 "2016-06-30T04:30:53Z")
This sounds so odd, I have configured two different cluster to sent statistics to the same server. Now when I open marvel, it always go to the Overview page of one cluster. But I want to pick the other cluster, I simp… --- ## [Listing stored snapshots - RepositoryMissingException - New, empty cluster](https://discuss.elastic.co/t/listing-stored-snapshots-repositorymissingexception-new-empty-cluster/15962)
**Author:** [@Tony\_Su](https://discuss.elastic.co/u/Tony_Su)\ **Replies:** 4\ **Last updated:** [February 22, 2014, 8:33am UTC](https://discuss.elastic.co/t/listing-stored-snapshots-repositorymissingexception-new-empty-cluster/15962 "2014-02-22T08:33:47Z")
Am testing on a lab cluster 5 nodes. Repository name = "Snapshots" Immediately after creating the snapshots, listing the snapshots returned the snapshots and the indices they contained. Now, am attempting to … --- ## [Snapshot to S3 partially failed with error Unable to execute HTTP request: \.s3.us-west-2.amazonaws.com](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657)
**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\ **Replies:** 7\ **Last updated:** [October 30, 2021, 3:14am UTC](https://discuss.elastic.co/t/snapshot-to-s3-partially-failed-with-error-unable-to-execute-http-request-bucket-name-s3-us-west-2-amazonaws-com/287657 "2021-10-30T03:14:32Z")
20 out of 90 shards failed to complete the snapshot with the following archive output. { "snapshot": { "snapshot": "exabeam-2021.08.10", "uuid": "fRjaWFFfQDK7bHbJRR0yHw", "version\_id": 608019… --- ## [App Search Filter Array limitation](https://discuss.elastic.co/t/app-search-filter-array-limitation/282330)
**Author:** [@SriAkash](https://discuss.elastic.co/u/SriAkash)\ **Replies:** 3\ **Last updated:** [September 8, 2021, 6:53am UTC](https://discuss.elastic.co/t/app-search-filter-array-limitation/282330 "2021-09-08T06:53:28Z")
I need to query App Search only for selected documents. I am aware of search API filter options Search API filters and hence I am using filters, say id. The challenge here is: App Search has a limitation of 1024 values … --- ## [Benchmarking Remote Cluster Stalls in Preparing](https://discuss.elastic.co/t/benchmarking-remote-cluster-stalls-in-preparing/204253)
**Author:** [@toneyalexander](https://discuss.elastic.co/u/toneyalexander)\ **Replies:** 6\ **Last updated:** [October 21, 2019, 7:03pm UTC](https://discuss.elastic.co/t/benchmarking-remote-cluster-stalls-in-preparing/204253 "2019-10-21T19:03:06Z")
I was following the instructions here https://esrally.readthedocs.io/en/stable/recipes.html to benchmark a remote cluster. I have 2 EC2 instances with everything set up to run rally. The esrallyd commands run without any… --- ## [Why doesn't this document match?](https://discuss.elastic.co/t/why-doesnt-this-document-match/143583)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 6\ **Last updated:** [August 10, 2018, 2:26pm UTC](https://discuss.elastic.co/t/why-doesnt-this-document-match/143583 "2018-08-10T14:26:37Z")
I create a document in 6.3.1 using output { elasticsearch { hosts =\> "localhost" index =\> "deleteme8" } } input { generator { count =\> 1 message =\> "Foo: 'UserID:xx0001'" } } If in Kibana I request "message: UserID" it… --- ## [Dns reverse lookup in elasticsearch 5.0.1](https://discuss.elastic.co/t/dns-reverse-lookup-in-elasticsearch-5-0-1/75743)
**Author:** [@vaishnavi](https://discuss.elastic.co/u/vaishnavi)\ **Replies:** 6\ **Last updated:** [February 22, 2017, 4:00am UTC](https://discuss.elastic.co/t/dns-reverse-lookup-in-elasticsearch-5-0-1/75743 "2017-02-22T04:00:57Z")
Hi I am using elasticsearch version 5.0.1 and centos 7.0 I want to resolve IP address to dns host name of my elasticsearch data. Is there any way to do it while uploading files to elasticsearch I want to convert IP … --- ## [When relocating/initializing 3 or more shards, ES is overloaded, REST API is very slow, Kibana and es-exporter cannot reach ES](https://discuss.elastic.co/t/when-relocating-initializing-3-or-more-shards-es-is-overloaded-rest-api-is-very-slow-kibana-and-es-exporter-cannot-reach-es/246323)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 5\ **Last updated:** [August 28, 2020, 3:52pm UTC](https://discuss.elastic.co/t/when-relocating-initializing-3-or-more-shards-es-is-overloaded-rest-api-is-very-slow-kibana-and-es-exporter-cannot-reach-es/246323 "2020-08-28T15:52:36Z")
Hello, I am running a TLS-enabled Elastic Stack 7.6.2 (currently running on EKS with kubernetes nodes on AWS m5.4xlarge machines 16CPUs 64GB - these are NOT SSD s) and whenever Elasticsearch relocates/initia… --- ## [Kibana not finding filebeat-\* index. Direct search on Elasticsearch works](https://discuss.elastic.co/t/kibana-not-finding-filebeat-index-direct-search-on-elasticsearch-works/131632)
**Author:** [@srirang](https://discuss.elastic.co/u/srirang)\ **Replies:** 5\ **Last updated:** [May 14, 2018, 1:21pm UTC](https://discuss.elastic.co/t/kibana-not-finding-filebeat-index-direct-search-on-elasticsearch-works/131632 "2018-05-14T13:21:40Z")
I am trying to get a simple log analysis system setup to push the logs of my Rails application to Elasticsearch. I have setup Elasticsearch, Filebeat and Kibana as per the docs on a Ubuntu 16.04 server (using the apt rep… --- ## [Calculate Date difference in LOGSTASH based on conditional text](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759)
**Author:** [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Replies:** 5\ **Last updated:** [May 24, 2017, 3:47am UTC](https://discuss.elastic.co/t/calculate-date-difference-in-logstash-based-on-conditional-text/86759 "2017-05-24T03:47:04Z")
I have a condition here: I have a series of logs where it starts from startTransaction and ends at endtransaction. Now between there two events there are other logs. My requirement is to capture the log time for the ab… --- ## [Kibana connection without enrollment token](https://discuss.elastic.co/t/kibana-connection-without-enrollment-token/330728)
**Author:** [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\ **Replies:** 3\ **Last updated:** [April 25, 2023, 2:58pm UTC](https://discuss.elastic.co/t/kibana-connection-without-enrollment-token/330728 "2023-04-25T14:58:07Z")
Can we connect to elasticsearch using Kibana without the enrollment token and username-password? I tried sometime back, then it was not mandatory to provide enrollment token. Even tried setting xpack.security.enrollmen… --- ## [How to add the document id as currentdatetime in transform](https://discuss.elastic.co/t/how-to-add-the-document-id-as-currentdatetime-in-transform/264620)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 8\ **Last updated:** [March 2, 2021, 2:50pm UTC](https://discuss.elastic.co/t/how-to-add-the-document-id-as-currentdatetime-in-transform/264620 "2021-03-02T14:50:31Z")
the transforma is running on every 5 sec, and the document is overwritng in the group by combination. Can you please suggest to create the record as separate one for each 5 sec. is it possible to add \_id with current d… --- ## [Import Saved Objects from Newer Version (ndjson) to Older Version (json)](https://discuss.elastic.co/t/import-saved-objects-from-newer-version-ndjson-to-older-version-json/209025)
**Author:** [@Zany](https://discuss.elastic.co/u/Zany)\ **Replies:** 3\ **Last updated:** [November 25, 2019, 2:58pm UTC](https://discuss.elastic.co/t/import-saved-objects-from-newer-version-ndjson-to-older-version-json/209025 "2019-11-25T14:58:36Z")
The following error message appears when I tried to import saved objects that were in ndjson format into a Kibana version that accepts only json format. Sorry, there was an error. The file could not be processed. In … --- ## [Drop last bucket not working](https://discuss.elastic.co/t/drop-last-bucket-not-working/195373)
**Author:** [@cbmurphy87](https://discuss.elastic.co/u/cbmurphy87)\ **Replies:** 3\ **Last updated:** [August 15, 2019, 11:07pm UTC](https://discuss.elastic.co/t/drop-last-bucket-not-working/195373 "2019-08-15T23:07:26Z")
I am seeing a lot of zero values using metricbeat, causing readings to be wrong. I have "drop last bucket" selected on the visualization, but it doesn't seem to be working correctly. That feature is supposed to eliminate… --- ## [Is it possible to use if else conditional within elastic serach output plugin?](https://discuss.elastic.co/t/is-it-possible-to-use-if-else-conditional-within-elastic-serach-output-plugin/153541)
**Author:** [@Panda8](https://discuss.elastic.co/u/Panda8)\ **Replies:** 3\ **Last updated:** [October 23, 2018, 9:19am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-if-else-conditional-within-elastic-serach-output-plugin/153541 "2018-10-23T09:19:22Z")
Hi Can following configuration : output { if(\[type\] == "A"){ elasticsearch{ hosts =\> \["localhost:9200"\] index =\> "aaa" document\_type =\> "\_doc" document\_id =\> "11" http\_compression =\> true manage\_template =\> tru… --- ## [Extracting issues and slow down of watches](https://discuss.elastic.co/t/extracting-issues-and-slow-down-of-watches/77030)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 3\ **Last updated:** [March 2, 2017, 10:48am UTC](https://discuss.elastic.co/t/extracting-issues-and-slow-down-of-watches/77030 "2017-03-02T10:48:17Z")
I have two questions that I haven't been able to figure out from the resources available: 1) I'm trying to use extract as described in the documentation to extract one field from the input. I'm not taking out the total… --- ## [Watcher log return code 401](https://discuss.elastic.co/t/watcher-log-return-code-401/28806)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 3\ **Last updated:** [September 9, 2015, 2:16am UTC](https://discuss.elastic.co/t/watcher-log-return-code-401/28806 "2015-09-09T02:16:39Z")
Hi all, I am new to use Watcher to monitor log, I create by elasticsearch documents $curl -XPUT -u es\_admin:iiiiii 'http://localhost:9200/\_watcher/watch/log\_error\_watch' -d '{ "trigger": { "schedule": { … --- ## [Enabling fingerprint file\_identiy](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780)
**Author:** [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\ **Replies:** 4\ **Last updated:** [November 23, 2023, 3:55pm UTC](https://discuss.elastic.co/t/enabling-fingerprint-file-identiy/347780 "2023-11-23T15:55:09Z")
Hey all, I'm stuck with getting the fingerprint file\_identity working. I have a few nfs mounts from which I'm reading log files. I tried enabling the fingerprint option in the scanner but it seems like it's not really b… --- ## [After update to logstash 7.6.0, it won't start](https://discuss.elastic.co/t/after-update-to-logstash-7-6-0-it-wont-start/218861)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 4\ **Last updated:** [February 12, 2020, 6:40am UTC](https://discuss.elastic.co/t/after-update-to-logstash-7-6-0-it-wont-start/218861 "2020-02-12T06:40:18Z")
Hi, I updated from 7.5.2 to 7.6.0 (debian stretch). The log gves me the following error, I struggle to see where this comes from: \[2020-02-11T21:30:28,078\]\[ERROR\]\[logstash.agent \] Failed to execute action {:a… --- ## [Still able to delete index with wildcard](https://discuss.elastic.co/t/still-able-to-delete-index-with-wildcard/78889)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 4\ **Last updated:** [March 27, 2017, 1:41pm UTC](https://discuss.elastic.co/t/still-able-to-delete-index-with-wildcard/78889 "2017-03-27T13:41:46Z")
This is using elasticsearch 2.4 . I added the action.destructive\_requires\_name: true to the yml and did a restart of the cluster. It seems we are still able to do delete using \_all. Is there something I am missing? --- ## [Painless script in Kibana to convert timestamp array in Date format](https://discuss.elastic.co/t/painless-script-in-kibana-to-convert-timestamp-array-in-date-format/121285)
**Author:** [@Karanushah.1992](https://discuss.elastic.co/u/Karanushah.1992)\ **Replies:** 2\ **Last updated:** [February 25, 2018, 3:29pm UTC](https://discuss.elastic.co/t/painless-script-in-kibana-to-convert-timestamp-array-in-date-format/121285 "2018-02-25T15:29:19Z")
Hi, I have an array of of Epoch time in timestamp field. I want to use painless script to convert this array field in Date field which can be used by Kibana. Following is my painless script LocalDateTime date; for (i… --- ## [ILM action - lifecycle action \[migrate\] waiting for \[1\] shards to be moved to the \[data\_cold\] tier](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574)
**Author:** [@Kmalik19](https://discuss.elastic.co/u/Kmalik19)\ **Replies:** 1\ **Last updated:** [June 1, 2021, 8:40am UTC](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-1-shards-to-be-moved-to-the-data-cold-tier/274574 "2021-06-01T08:40:44Z")
Hello Everyone, We have configured ILM policy but it's stucked in warm phase.Here is the details: ILM Policy definition { "km\_ilm" : { "version" : 3, "modified\_date" : "2021-05-31T14:28:26.359Z", "policy… --- ## [javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/237674)
**Author:** [@Alvaro\_Sanz](https://discuss.elastic.co/u/Alvaro_Sanz)\ **Replies:** 1\ **Last updated:** [June 23, 2020, 3:34am UTC](https://discuss.elastic.co/t/javax-net-ssl-sslhandshakeexception-received-fatal-alert-bad-certificate/237674 "2020-06-23T03:34:33Z")
Hello, Since I have enabled and made the configuration for x-pack security, the following message keeps appearing at my elasticsearch log: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate at … --- ## [Elasticsearch does not start without any logs](https://discuss.elastic.co/t/elasticsearch-does-not-start-without-any-logs/108448)
**Author:** [@rpazhyannur](https://discuss.elastic.co/u/rpazhyannur)\ **Replies:** 1\ **Last updated:** [November 21, 2017, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-start-without-any-logs/108448 "2017-11-21T08:53:00Z")
I am having trouble starting elasticsearch. I had to restart my amazon === instance running ES 5.5. This is what I see. systemctl status elasticsearch elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/… --- ## [Generating filebeat dynamic custom fields](https://discuss.elastic.co/t/generating-filebeat-dynamic-custom-fields/46749)
**Author:** [@Shachar\_Ashkenazi](https://discuss.elastic.co/u/Shachar_Ashkenazi)\ **Replies:** 1\ **Last updated:** [April 11, 2016, 11:29am UTC](https://discuss.elastic.co/t/generating-filebeat-dynamic-custom-fields/46749 "2016-04-11T11:29:19Z")
I have an elasticsearch cluster (ELK) and some nodes sending logs to the logstash using filebeat. All the servers in my environment are CentOS 6.5. The filebeat.yml file in each server is enforced by a Puppet module (b… --- ## [New json filter crashing logstash](https://discuss.elastic.co/t/new-json-filter-crashing-logstash/2014)
**Author:** [@Melpheos](https://discuss.elastic.co/u/Melpheos)\ **Replies:** 7\ **Last updated:** [September 19, 2015, 2:02pm UTC](https://discuss.elastic.co/t/new-json-filter-crashing-logstash/2014 "2015-09-19T14:02:32Z")
We are filtering sflow data with logstash with the following filter filter { json { source =\> "message" type =\> "json" } } Which works fine. However, it seems it's deprecated. But if we use the supported 1.5 json… --- ## [7.14 - Windows agent deployed with Fleet, but not sending data](https://discuss.elastic.co/t/7-14-windows-agent-deployed-with-fleet-but-not-sending-data/281347)
**Author:** [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Replies:** 6\ **Last updated:** [August 13, 2021, 6:02pm UTC](https://discuss.elastic.co/t/7-14-windows-agent-deployed-with-fleet-but-not-sending-data/281347 "2021-08-13T18:02:47Z")
I am using self-generated certs created on the ES master node, running a brand new install of 7.14 - all the server components (Es, Kibana, LS, MB & FB) are talking and working well with each other. After deploying the … --- ## [Filebeat data.json missing after minor upgrade](https://discuss.elastic.co/t/filebeat-data-json-missing-after-minor-upgrade/250518)
**Author:** [@CWelsh](https://discuss.elastic.co/u/CWelsh)\ **Replies:** 6\ **Last updated:** [December 7, 2020, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-data-json-missing-after-minor-upgrade/250518 "2020-12-07T12:56:33Z")
Hi there. After upgrading from filebeat v7.7.0 to v7.9.2 on a windows 2012 server I no longer have a data.json file in my registry folder. This has been replaced with a file named 'X.json' where X is an almost continuou… --- ## [Define upload fields from json file](https://discuss.elastic.co/t/define-upload-fields-from-json-file/42938)
**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\ **Replies:** 6\ **Last updated:** [March 2, 2016, 2:30pm UTC](https://discuss.elastic.co/t/define-upload-fields-from-json-file/42938 "2016-03-02T14:30:11Z")
Hi , In the conf file , how can I define which fields I want to upload to the ElasticSearch ? My Json file contain one row that need to be uploaded to the ElasticSearch , So after the upload I would like to see I row… --- ## [Error changing certificate in Elasticsearch](https://discuss.elastic.co/t/error-changing-certificate-in-elasticsearch/303675)
**Author:** [@jorge.visentini](https://discuss.elastic.co/u/jorge.visentini)\ **Replies:** 3\ **Last updated:** [May 2, 2022, 2:29pm UTC](https://discuss.elastic.co/t/error-changing-certificate-in-elasticsearch/303675 "2022-05-02T14:29:11Z")
I'm trying to change Elasticsearch SSL certificates but I'm getting some errors and it's not starting. I would like to change the CA and certificate to one generated by me, which I use for testing, to learn how to chang… --- ## [Hadoop-Elasticsearch - Avro Support](https://discuss.elastic.co/t/hadoop-elasticsearch-avro-support/25050)
**Author:** [@ajaybhatnagar](https://discuss.elastic.co/u/ajaybhatnagar)\ **Replies:** 3\ **Last updated:** [July 9, 2015, 9:27am UTC](https://discuss.elastic.co/t/hadoop-elasticsearch-avro-support/25050 "2015-07-09T09:27:04Z")
Hi, I am looking into possible integration of Elasticsearch and Hadoop using es-hadoop. Would like to know if it can support Avro format from/to Hadoop and Elasticsearch ? If yes, are there any requirements / plugins… --- ## [Convert gb mb kb to bytes](https://discuss.elastic.co/t/convert-gb-mb-kb-to-bytes/149126)
**Author:** [@Arun\_Murugappan](https://discuss.elastic.co/u/Arun_Murugappan)\ **Replies:** 5\ **Last updated:** [September 21, 2018, 6:13am UTC](https://discuss.elastic.co/t/convert-gb-mb-kb-to-bytes/149126 "2018-09-21T06:13:08Z")
The below script works fine only if there is no whitespace in the data. Firstly, example 20mb, 2gb. it works fine. What if 20 mb or 2 gb. Secondly, what if the given data itself is in bytes, how do i include that?\`\`\` sp… --- ## [How to do multiple text search in same field](https://discuss.elastic.co/t/how-to-do-multiple-text-search-in-same-field/45872)
**Author:** [@thanigaivelan19](https://discuss.elastic.co/u/thanigaivelan19)\ **Replies:** 4\ **Last updated:** [April 8, 2016, 9:09am UTC](https://discuss.elastic.co/t/how-to-do-multiple-text-search-in-same-field/45872 "2016-04-08T09:09:08Z")
Hi, I want to do multiple text search in same field for example in sub\_cat\_seo\_url field i want to get 'english-news' and 'business-news' filter by language and region when i tried like below code it is not working … --- ## [Parent Child link in dashboard](https://discuss.elastic.co/t/parent-child-link-in-dashboard/39786)
**Author:** [@warper](https://discuss.elastic.co/u/warper)\ **Replies:** 4\ **Last updated:** [January 28, 2016, 3:34pm UTC](https://discuss.elastic.co/t/parent-child-link-in-dashboard/39786 "2016-01-28T15:34:01Z")
Hello everyone I have a parent child relationship in my data and on my dashboard I would like to display the parents in a data table and below it I would like to display the children related to that parent. How can I… --- ## [Just warnings or something I should be concerned with?](https://discuss.elastic.co/t/just-warnings-or-something-i-should-be-concerned-with/36483)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 4\ **Last updated:** [December 7, 2015, 3:16pm UTC](https://discuss.elastic.co/t/just-warnings-or-something-i-should-be-concerned-with/36483 "2015-12-07T15:16:08Z")
Here is a sample output when I run topbeats for a few seconds. Will continue to test: \[2015-12-06 18:49:14,027\]\[DEBUG\]\[action.admin.indices.mapping.put\] \[Inferno\] failed to put mappings on indices \[\[topbeat-2015.12.06\]… --- ## [\[solved\] Logstash-Forwarder, json codec and multiline issue](https://discuss.elastic.co/t/solved-logstash-forwarder-json-codec-and-multiline-issue/31824)
**Author:** [@jeroentbt](https://discuss.elastic.co/u/jeroentbt)\ **Replies:** 4\ **Last updated:** [October 9, 2015, 9:29am UTC](https://discuss.elastic.co/t/solved-logstash-forwarder-json-codec-and-multiline-issue/31824 "2015-10-09T09:29:51Z")
Hey, I'm seeing a lot of issues with certain specific multiline log entries. Here's a log entry: D, \[2015-10-07T16:11:53.434110 #20457\] DEBUG -- : Error occurred while parsing request parameters. Contents: { "payl… --- ## [Ignore lost shards and make cluster health from RED to GREEN](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433)
**Author:** [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Replies:** 4\ **Last updated:** [October 1, 2015, 9:29am UTC](https://discuss.elastic.co/t/ignore-lost-shards-and-make-cluster-health-from-red-to-green/31433 "2015-10-01T09:29:14Z")
Hello. Recently some of shards disappeared and can not be recovered.( 4 shard lost of 6 month logstash with 5 shard + 1replica) I have changed replica from 1 to 0 due to storage shortage. but I don't know why this made… --- ## [Elasticsearch starts with errors](https://discuss.elastic.co/t/elasticsearch-starts-with-errors/24451)
**Author:** [@samding](https://discuss.elastic.co/u/samding)\ **Replies:** 4\ **Last updated:** [June 30, 2015, 2:56pm UTC](https://discuss.elastic.co/t/elasticsearch-starts-with-errors/24451 "2015-06-30T14:56:57Z")
Hello, I downloaded elasticsearch-1.5.1.tar.gz on RHEL 6 on x86. When it starts, repeated error msgs like: Is this related to configuration? I used Java 7 " java -version java version "1.7.0\_65" " Thanks, Sam [Previous page](https://discuss.elastic.co/top.md?page=845&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=847&per_page=50&period=all)