# Top **URL:** https://discuss.elastic.co/top.md?page=849&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 850 --- ## [Searching and sorting dynamic fields](https://discuss.elastic.co/t/searching-and-sorting-dynamic-fields/44134)
**Author:** [@BennoSI](https://discuss.elastic.co/u/BennoSI)\ **Replies:** 3\ **Last updated:** [March 12, 2016, 3:46pm UTC](https://discuss.elastic.co/t/searching-and-sorting-dynamic-fields/44134 "2016-03-12T15:46:46Z")
Hi, I'm new to elasticsearch. At the moment I'm checking whether elasticsearch does fulfill our requirements for searching and sorting on quiet dynamic (broad schema) data. One requirement is, that we need to index arbi… --- ## [Changer le mapping d'un type via Sense](https://discuss.elastic.co/t/changer-le-mapping-dun-type-via-sense/42733)
**Author:** [@Rigobert](https://discuss.elastic.co/u/Rigobert)\ **Replies:** 3\ **Last updated:** [February 26, 2016, 3:54pm UTC](https://discuss.elastic.co/t/changer-le-mapping-dun-type-via-sense/42733 "2016-02-26T15:54:23Z")
Bonjour, Je suis ce qu'on peut appeler un "newbie" dans le monde Elasticsearch/kibana/Logstash. Je m'essaie avec ces outils à partir d'un exemple qui me semble basique : importer les lignes d'un fichier csv. L'ETL es… --- ## [Valid mapping type and field names?](https://discuss.elastic.co/t/valid-mapping-type-and-field-names/6530)
**Author:** [@Eric\_Jain](https://discuss.elastic.co/u/Eric_Jain)\ **Replies:** 3\ **Last updated:** [February 18, 2014, 10:08pm UTC](https://discuss.elastic.co/t/valid-mapping-type-and-field-names/6530 "2014-02-18T22:08:45Z")
What characters (other than \[\\w\]) can I use in in type and field names without causing trouble? Lucene itself doesn't seem to have any restrictions (outside of the QueryParser), but elasticsearch appears to have speci… --- ## [Enable cors in a kibana api in a docker container](https://discuss.elastic.co/t/enable-cors-in-a-kibana-api-in-a-docker-container/195266)
**Author:** [@glaucomorandini](https://discuss.elastic.co/u/glaucomorandini)\ **Replies:** 2\ **Last updated:** [August 19, 2019, 7:14pm UTC](https://discuss.elastic.co/t/enable-cors-in-a-kibana-api-in-a-docker-container/195266 "2019-08-19T19:14:52Z")
Hey guys, I created a docker container with kibana, and I'm trying to access the kibana api from another origin/host through JS, but the api raises an error, because the cors is not enabled. The error: My kibana.yml: … --- ## [Kibana 6.7 cannot connect to elasticsearch](https://discuss.elastic.co/t/kibana-6-7-cannot-connect-to-elasticsearch/174655)
**Author:** [@Mike\_H](https://discuss.elastic.co/u/Mike_H)\ **Replies:** 2\ **Last updated:** [April 1, 2019, 4:14pm UTC](https://discuss.elastic.co/t/kibana-6-7-cannot-connect-to-elasticsearch/174655 "2019-04-01T16:14:06Z")
Hiya, we're upgrading our elastic stack from 6.6.2 to 6.7.0. The stack is run using the official docker images on Kubernetes. Elasticsearch upgraded without issue. However, Kibana 6.7.0 cannot connect to Elasticsearch. … --- ## [What triggers a snapshot repository cleanup?](https://discuss.elastic.co/t/what-triggers-a-snapshot-repository-cleanup/76182)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 2\ **Last updated:** [February 24, 2017, 12:43pm UTC](https://discuss.elastic.co/t/what-triggers-a-snapshot-repository-cleanup/76182 "2017-02-24T12:43:10Z")
I have been taking a daily snapshot using Curator for the last couple of weeks, using curator to target the last 7 days worth of indices. As this is an incremental backup, I wasn't expecting the size of the snapshot repo… --- ## [Snapshot of Dashboard](https://discuss.elastic.co/t/snapshot-of-dashboard/39153)
**Author:** [@pittoch](https://discuss.elastic.co/u/pittoch)\ **Replies:** 2\ **Last updated:** [January 15, 2016, 6:49pm UTC](https://discuss.elastic.co/t/snapshot-of-dashboard/39153 "2016-01-15T18:49:12Z")
Hi, It is possible to take a snapshot dashboards ( image or recording of the web page format) ? The idea is this: All 15 days I have to publish statistics in a powerpoint and comment on problem performance. The idea … --- ## [How to change the legend color in kibana 4](https://discuss.elastic.co/t/how-to-change-the-legend-color-in-kibana-4/36523)
**Author:** [@SureshSala](https://discuss.elastic.co/u/SureshSala)\ **Replies:** 2\ **Last updated:** [December 9, 2015, 4:28am UTC](https://discuss.elastic.co/t/how-to-change-the-legend-color-in-kibana-4/36523 "2015-12-09T04:28:31Z")
In kibana, I have created a dashboard for aws logins, but for failed login attempts I want legend to be red. How can i customized the legend colors. --- ## [ILM in 7.7.0 not applying - 0 linked indices](https://discuss.elastic.co/t/ilm-in-7-7-0-not-applying-0-linked-indices/235201)
**Author:** [@taa](https://discuss.elastic.co/u/taa)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 5:11pm UTC](https://discuss.elastic.co/t/ilm-in-7-7-0-not-applying-0-linked-indices/235201 "2020-06-05T17:11:05Z")
I have a 7.7.0 cluster which reports 0 linked indices for every ILM policy and no ILM is being performed on any index. I have a similarly configured 7.5.0 cluster in which ILM is working as expected. Is there something… --- ## [Logstash Failed to Parse Date (6 milliseconds)](https://discuss.elastic.co/t/logstash-failed-to-parse-date-6-milliseconds/299271)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 4\ **Last updated:** [March 10, 2022, 4:23pm UTC](https://discuss.elastic.co/t/logstash-failed-to-parse-date-6-milliseconds/299271 "2022-03-10T16:23:13Z")
"reason"=\>"failed to parse date field \[Sun Feb 20 03:36:11.782065 2022\] with format \[strict\_date\_optional\_time||epoch\_millis\]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"Failed to parse with all enclo… --- ## [Create index template with K8S CRD](https://discuss.elastic.co/t/create-index-template-with-k8s-crd/285143)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 4\ **Last updated:** [September 26, 2021, 6:01pm UTC](https://discuss.elastic.co/t/create-index-template-with-k8s-crd/285143 "2021-09-26T18:01:50Z")
Is there a CRD to create an index template? I know rabbitMQ operator allow to declare queue like this: apiVersion: rabbitmq.com/v1beta1 kind: Queue metadata: name: test namespace: rabbitmq-system spec: name: test… --- ## [How to send same data to multiple elastic clusters with logstash output](https://discuss.elastic.co/t/how-to-send-same-data-to-multiple-elastic-clusters-with-logstash-output/206196)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 4\ **Last updated:** [November 1, 2019, 5:39pm UTC](https://discuss.elastic.co/t/how-to-send-same-data-to-multiple-elastic-clusters-with-logstash-output/206196 "2019-11-01T17:39:07Z")
All, We have requirement where we need to read data from kafka topics from logstash and send all data to cluster 1 and few data to cluster 2. Please let us know is it possible and it would really help us if any one prov… --- ## [Failed to parse value \[1\] as only \[true\] or \[false\] are allowed."}\] Error when upgrade from 5.6 to 6.8](https://discuss.elastic.co/t/failed-to-parse-value-1-as-only-true-or-false-are-allowed-error-when-upgrade-from-5-6-to-6-8/191069)
**Author:** [@jasmineL](https://discuss.elastic.co/u/jasmineL)\ **Replies:** 4\ **Last updated:** [July 18, 2019, 5:41pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-1-as-only-true-or-false-are-allowed-error-when-upgrade-from-5-6-to-6-8/191069 "2019-07-18T17:41:50Z")
Hi Elastic Team, We are trying to upgrade our Elasticsearch from 5.6 to 6.8.1. We first migrated our ES cluster from 5.6 to 6.8.1 and when we are trying to create new index from curl command we alway get error saying … --- ## [How may I get only ERROR related logs from my stack trace?](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329)
**Author:** [@Vyankatesh\_S\_Repal](https://discuss.elastic.co/u/Vyankatesh_S_Repal)\ **Replies:** 4\ **Last updated:** [August 20, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-may-i-get-only-error-related-logs-from-my-stack-trace/144329 "2018-08-20T07:11:31Z")
Currently I am developing an application where I need to retrieve only "ERROR" related logs and put them to elasticsearch index. Here is my sample log: 2018-07-05 19:37:15,888 \[6\] ERROR \ - Error while Proc… --- ## [How to load winlogbeat dashboard --\> KIB/ES](https://discuss.elastic.co/t/how-to-load-winlogbeat-dashboard-kib-es/123410)
**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\ **Replies:** 4\ **Last updated:** [March 13, 2018, 7:28pm UTC](https://discuss.elastic.co/t/how-to-load-winlogbeat-dashboard-kib-es/123410 "2018-03-13T19:28:14Z")
Hi. I'm having difficulty trying to load my default Kibana Dashboard because my ES stack is on a separate system compared to where I have installed winlogbeat. Does anybody have the correct syntax that I can follow.... … --- ## [Double wildcard in string query causes incorrect highlighting for plain and fast vectors highlighters](https://discuss.elastic.co/t/double-wildcard-in-string-query-causes-incorrect-highlighting-for-plain-and-fast-vectors-highlighters/45939)
**Author:** [@Shaolin](https://discuss.elastic.co/u/Shaolin)\ **Replies:** 4\ **Last updated:** [April 4, 2016, 6:56am UTC](https://discuss.elastic.co/t/double-wildcard-in-string-query-causes-incorrect-highlighting-for-plain-and-fast-vectors-highlighters/45939 "2016-04-04T06:56:57Z")
Hi, After indexing mapping: PUT http://localhost:9200/index/\_mapping/sometype { "properties" : { "sometext" : { "type" : "string", "term\_vector" : "with\_positions\_offsets" } … --- ## [Kibana 4.2 reverse proxy](https://discuss.elastic.co/t/kibana-4-2-reverse-proxy/33649)
**Author:** [@Carlos\_Vega\_Moreno](https://discuss.elastic.co/u/Carlos_Vega_Moreno)\ **Replies:** 4\ **Last updated:** [November 13, 2015, 12:02pm UTC](https://discuss.elastic.co/t/kibana-4-2-reverse-proxy/33649 "2015-11-13T12:02:54Z")
I updated kibana to the newest version and now the paths are relative instead of absolute so my reverse proxy is broken. Is there any way to fix it? Is like this issue but none fixed it My previous nginx conf was: … --- ## [Elasticsearch mapping - cannot index a field having name starting with a dot](https://discuss.elastic.co/t/elasticsearch-mapping-cannot-index-a-field-having-name-starting-with-a-dot/163804)
**Author:** [@amitnegi6190](https://discuss.elastic.co/u/amitnegi6190)\ **Replies:** 7\ **Last updated:** [January 11, 2019, 8:47am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-cannot-index-a-field-having-name-starting-with-a-dot/163804 "2019-01-11T08:47:57Z")
Hi, I am trying to send some JSON data into elasticsearch using logstash: My logstash configuration looks like this: test.config input{ file{ path =\> "/Users/bob/data/test.json" codec =\> json sincedb\_path =\> … --- ## [Configuring multiple paths in http module](https://discuss.elastic.co/t/configuring-multiple-paths-in-http-module/121564)
**Author:** [@diavel](https://discuss.elastic.co/u/diavel)\ **Replies:** 7\ **Last updated:** [March 29, 2018, 5:12am UTC](https://discuss.elastic.co/t/configuring-multiple-paths-in-http-module/121564 "2018-03-29T05:12:12Z")
I am trying to use http module to collect jmx metrics instead of the jolokia module because of the lack of wild card in the queries. I am having trouble configuring multiple paths. - module: http metricsets: \["jso… --- ## [Exception on parsing user agent with 5.4.2](https://discuss.elastic.co/t/exception-on-parsing-user-agent-with-5-4-2/90576)
**Author:** [@Joelp](https://discuss.elastic.co/u/Joelp)\ **Replies:** 7\ **Last updated:** [June 29, 2017, 5:59pm UTC](https://discuss.elastic.co/t/exception-on-parsing-user-agent-with-5-4-2/90576 "2017-06-29T17:59:52Z")
after update logstash to 5.4.2, I have an issue with parsing and performance of course: \[2017-06-22T09:46:42,039\]\[ERROR\]\[logstash.filters.useragent\] Uknown error while parsing user agent data {:exception=\>java.lang.Str… --- ## [AWS, es-hadoop and 429](https://discuss.elastic.co/t/aws-es-hadoop-and-429/310124)
**Author:** [@matze79](https://discuss.elastic.co/u/matze79)\ **Replies:** 5\ **Last updated:** [July 21, 2022, 12:18pm UTC](https://discuss.elastic.co/t/aws-es-hadoop-and-429/310124 "2022-07-21T12:18:51Z")
Hi forum, I'm on AWS and trying to write ~ 1.2mio documents from an AWS Glue job Python / pyspark job to a managed ElasticSearch. To be fair mentioning that I'm using AWS OpenSearch 1.2 but my question is more or less … --- ## [Finding Sum Aggregation for the properties from a Nested Document](https://discuss.elastic.co/t/finding-sum-aggregation-for-the-properties-from-a-nested-document/188611)
**Author:** [@Thilak](https://discuss.elastic.co/u/Thilak)\ **Replies:** 2\ **Last updated:** [July 8, 2019, 6:15am UTC](https://discuss.elastic.co/t/finding-sum-aggregation-for-the-properties-from-a-nested-document/188611 "2019-07-08T06:15:02Z")
Hello I was trying to find the aggregate inside the nested document (interactionInfo) only for the title : segments { "interactionId": "a26617a0-0530-4b41-9db6-4ca53e83e63e", "interactionInfo": \[ { … --- ## [Kibana is stock on “Kibana server is not ready yet”](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021 "2020-11-11T13:49:10Z")
Hi everyone After installing Inhanced-Table plugin, my Kibana is stock on following message "Kibana server is not ready yet" However after some minutes it completely became out of reach and I face with "Unable to co… --- ## [Processor add\_kubernetes\_metadata not working](https://discuss.elastic.co/t/processor-add-kubernetes-metadata-not-working/232544)
**Author:** [@iulian7](https://discuss.elastic.co/u/iulian7)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 10:17am UTC](https://discuss.elastic.co/t/processor-add-kubernetes-metadata-not-working/232544 "2020-05-15T10:17:13Z")
Using Metricbeat 7.7.0 as a sidecar to scrape Prometheus metrics in a Kubernetes (GKE) pod. The configuration is very simple: metricbeat.modules: - module: prometheus period: ${PERIOD} host: ${NODE\_NAME} h… --- ## [Elasticsearch Bandwidth](https://discuss.elastic.co/t/elasticsearch-bandwidth/168271)
**Author:** [@rgupta152](https://discuss.elastic.co/u/rgupta152)\ **Replies:** 3\ **Last updated:** [February 14, 2019, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-bandwidth/168271 "2019-02-14T08:16:42Z")
I am new to elasticsearch and have been trying to introduce in my company. Many colleagues have asked a question: how much bandwidth is required and, due to this, our production environment can impact. Please advise how … --- ## [Custom css in Kibana 7.6.2](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 1\ **Last updated:** [October 7, 2020, 4:51pm UTC](https://discuss.elastic.co/t/custom-css-in-kibana-7-6-2/251213 "2020-10-07T16:51:25Z")
Hi, How to change the css style i.e color codes , themes, images and text in Kibana 7.6.2 using elastic EUI. --- ## [/usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/149935)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 1\ **Last updated:** [September 26, 2018, 9:14pm UTC](https://discuss.elastic.co/t/usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/149935 "2018-09-26T21:14:57Z")
I deployed filebeat container through ansible. The container went in restarting loop. Below is the output of 'docker logs filebeat' /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found /usr/local/bin/doc… --- ## [Logstash on Solaris - stat.st\_gid unsupported or native support failed to load \[SOLVED\]](https://discuss.elastic.co/t/logstash-on-solaris-stat-st-gid-unsupported-or-native-support-failed-to-load-solved/24166)
**Author:** [@Thorsten\_Nickel](https://discuss.elastic.co/u/Thorsten_Nickel)\ **Replies:** 1\ **Last updated:** [June 23, 2015, 9:09am UTC](https://discuss.elastic.co/t/logstash-on-solaris-stat-st-gid-unsupported-or-native-support-failed-to-load-solved/24166 "2015-06-23T09:09:34Z")
Dear all, as I am using Logstash only swith Solaris SPARC environment, I really had the hope that with the freshly released V1.5.1 I would no more run across this error. But I still did, as this example shows: … --- ## [Ingesting Windows events forwarded by Splunk heavy forwarders](https://discuss.elastic.co/t/ingesting-windows-events-forwarded-by-splunk-heavy-forwarders/323460)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 5\ **Last updated:** [February 12, 2023, 2:41pm UTC](https://discuss.elastic.co/t/ingesting-windows-events-forwarded-by-splunk-heavy-forwarders/323460 "2023-02-12T14:41:05Z")
Hiya We are currently moving our SIEM from Splunk to Elastic. Due to a tight deadline and network/firewall configuration we will be adding the Elastic endpoint to our current Splunk Heavy Forwarders. This approach wor… --- ## [Date format interchangeable](https://discuss.elastic.co/t/date-format-interchangeable/127935)
**Author:** [@Varan](https://discuss.elastic.co/u/Varan)\ **Replies:** 6\ **Last updated:** [April 13, 2018, 1:16pm UTC](https://discuss.elastic.co/t/date-format-interchangeable/127935 "2018-04-13T13:16:37Z")
Hi, I'm using ES 6.2.2 I have multiple date format, so I have precised them in the format like this: "format": "date|| basic\_date", So 20060606 can be indexed via "basic\_date" and 2005-05-05 can be indexed via "date"… --- ## [Compare two field of different date](https://discuss.elastic.co/t/compare-two-field-of-different-date/123476)
**Author:** [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\ **Replies:** 6\ **Last updated:** [April 2, 2018, 6:27am UTC](https://discuss.elastic.co/t/compare-two-field-of-different-date/123476 "2018-04-02T06:27:36Z")
Hi, I'm Cem. I have a problem with Kibana. We want to compare two fields on one screen or one graph. But we cannot do that. Can you explain to us? Thanks, Cem. --- ## [How to balance shards based on disk space utilization](https://discuss.elastic.co/t/how-to-balance-shards-based-on-disk-space-utilization/108052)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 1\ **Last updated:** [November 17, 2017, 3:45am UTC](https://discuss.elastic.co/t/how-to-balance-shards-based-on-disk-space-utilization/108052 "2017-11-17T03:45:29Z")
in our current 2.4 es cluster all nodes has equal no. of shards. But, there are nodes which has very less disk space utilization (25% of nodes). Rest of the nodes (75%) has high disk utilization. Is there a settings tha… --- ## [Logstash did not listen to port 5044 after startup，but listened to port 9600](https://discuss.elastic.co/t/logstash-did-not-listen-to-port-5044-after-startup-but-listened-to-port-9600/312595)
**Author:** [@YodHao](https://discuss.elastic.co/u/YodHao)\ **Replies:** 4\ **Last updated:** [August 23, 2022, 1:41am UTC](https://discuss.elastic.co/t/logstash-did-not-listen-to-port-5044-after-startup-but-listened-to-port-9600/312595 "2022-08-23T01:41:26Z")
Hello, I would like to ask what is wrong with my logstash configuration. I configured the port to listen to 5044 in the pipeline.yml file, but only 9600 is monitored after logstash is started; the port 5044 is not monito… --- ## [Data tiers, searcheable snapshots and the frozen tier](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:01pm UTC](https://discuss.elastic.co/t/data-tiers-searcheable-snapshots-and-the-frozen-tier/285928 "2021-10-05T14:01:48Z")
Hello I need some help figuring out data tiers, searcheable snapshots and the frozen tier. Consider this: GET \_cat/nodes?v&h=name,node.role&s=name name node.role es01 hms es02 mw es03 cm es04 fm POST \_snapshot/orde… --- ## [Multiple regex matches in a single line](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126)
**Author:** [@Ayush\_Rastogi](https://discuss.elastic.co/u/Ayush_Rastogi)\ **Replies:** 4\ **Last updated:** [August 17, 2016, 9:44am UTC](https://discuss.elastic.co/t/multiple-regex-matches-in-a-single-line/58126 "2016-08-17T09:44:09Z")
Hi All, I want to do multiple regex searches in a single line via logstash. My log file DEBUG - PerfLogging input\_count:1 ,className:value,date:16-Aug-2016 07:13:40 ,TimeTaken:0.428 ,output\_count:1 I want to get the … --- ## [Elasticsearch picking wrong port](https://discuss.elastic.co/t/elasticsearch-picking-wrong-port/318978)
**Author:** [@harijld](https://discuss.elastic.co/u/harijld)\ **Replies:** 8\ **Last updated:** [November 16, 2022, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-picking-wrong-port/318978 "2022-11-16T07:57:37Z")
Hi Team, I am facing strange behavior in prod environment. I used same configuration in prod and DR servers but in prod its working fine, in DR elasticserch is not connecting to different node when I am configuring clu… --- ## [SIEM detection signals not showing up](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700)
**Author:** [@Darren\_G](https://discuss.elastic.co/u/Darren_G)\ **Replies:** 8\ **Last updated:** [August 3, 2020, 4:00pm UTC](https://discuss.elastic.co/t/siem-detection-signals-not-showing-up/241700 "2020-08-03T16:00:02Z")
I am trying to run detections in 7.8 on historical data by changing the time stamps to be recent and reindexing. The data is ECS compliant. The index is in the siem defaultIndex. I have the Additional look-back time set … --- ## [\[Logstash\] Replace the @timestamp with a rsyslog ISO8691 timestamp from Filebeat log lines](https://discuss.elastic.co/t/logstash-replace-the-timestamp-with-a-rsyslog-iso8691-timestamp-from-filebeat-log-lines/237344)
**Author:** [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)\ **Replies:** 8\ **Last updated:** [June 17, 2020, 6:53am UTC](https://discuss.elastic.co/t/logstash-replace-the-timestamp-with-a-rsyslog-iso8691-timestamp-from-filebeat-log-lines/237344 "2020-06-17T06:53:18Z")
Hi Elastic users, I'm forwarding logs from host to an ELK's logstash instance via filebeat. I'm using @timestamp as the time for the index pattern for my logs. The original @timestamp from filebeat while processing the … --- ## [\[APM AGENT\]\[JAVA\] HTTP body size](https://discuss.elastic.co/t/apm-agent-java-http-body-size/192698)
**Author:** [@ea1987](https://discuss.elastic.co/u/ea1987)\ **Replies:** 8\ **Last updated:** [August 5, 2019, 3:42pm UTC](https://discuss.elastic.co/t/apm-agent-java-http-body-size/192698 "2019-08-05T15:42:50Z")
Hi guys, I noticed that body saved inside http.request.body.original field has been trunkated. Are there some options to manage this field size? Thanks, Andrea --- ## [Public/Private Index architecture](https://discuss.elastic.co/t/public-private-index-architecture/9293)
**Author:** [@Jerome\_Gagnon](https://discuss.elastic.co/u/Jerome_Gagnon)\ **Replies:** 8\ **Last updated:** [October 12, 2012, 6:59pm UTC](https://discuss.elastic.co/t/public-private-index-architecture/9293 "2012-10-12T18:59:55Z")
First of all, greetings everyone, I am working for a company that actually use Sphinx, but I have the job to migrate from Sphinx to Elastic Search since it can't handle well the amount of data that we have. We … --- ## [Logstash6.5: It seems your ruby installation is missing psych](https://discuss.elastic.co/t/logstash6-5-it-seems-your-ruby-installation-is-missing-psych/160062)
**Author:** [@kevink00](https://discuss.elastic.co/u/kevink00)\ **Replies:** 1\ **Last updated:** [December 17, 2018, 1:34pm UTC](https://discuss.elastic.co/t/logstash6-5-it-seems-your-ruby-installation-is-missing-psych/160062 "2018-12-17T13:34:57Z")
Following steps exactly as noted here: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html I'm on CentOS 7.5 (3.10.0-862.14.4.el7.x86\_64). New OS installed. I've installed elasticsearch,… --- ## [Index delete using curator 5.1](https://discuss.elastic.co/t/index-delete-using-curator-5-1/90454)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 7\ **Last updated:** [June 27, 2017, 1:43pm UTC](https://discuss.elastic.co/t/index-delete-using-curator-5-1/90454 "2017-06-27T13:43:20Z")
Hi , I'm using curator to delete my index by time basic, but in my index name doesn't contain timestring. How could i perform this delete operation. ACTION.YMl --- # Remember, leave a key empty if there is no valu… --- ## [How to fetch a field value in an elasticsearch document and then parse other documents based on this same value](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690)
**Author:** [@jpry](https://discuss.elastic.co/u/jpry)\ **Replies:** 7\ **Last updated:** [March 1, 2016, 2:05pm UTC](https://discuss.elastic.co/t/how-to-fetch-a-field-value-in-an-elasticsearch-document-and-then-parse-other-documents-based-on-this-same-value/42690 "2016-03-01T14:05:31Z")
I've got several lines of logs forwarded to Elasticsearch. One line of log corresponds to one ES document. Each line is identified by a connection session id, and a connection session is described by several lines of … --- ## [Can't start Elasticsearch with Full disk Space](https://discuss.elastic.co/t/cant-start-elasticsearch-with-full-disk-space/248808)
**Author:** [@Juicy45](https://discuss.elastic.co/u/Juicy45)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 1:01pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-with-full-disk-space/248808 "2020-09-16T13:01:28Z")
Hello, I have an elastic on a single server. I know, it's bad but I didn't pay so much attention to the Disk space. The /var filesystem is full at 100%. I want to properly delete the oldest data, if I can with elastic … --- ## [Graph / Bar chart without Aggregation](https://discuss.elastic.co/t/graph-bar-chart-without-aggregation/134752)
**Author:** [@khan.imran.m](https://discuss.elastic.co/u/khan.imran.m)\ **Replies:** 2\ **Last updated:** [June 8, 2018, 7:12am UTC](https://discuss.elastic.co/t/graph-bar-chart-without-aggregation/134752 "2018-06-08T07:12:34Z")
I have two columns X and Y, with simple values as below. X: 2 , 3, 4, 5, 7, 8, Y: 1, 2, 3, 4, 5, 6 I simply want a vertical bar or a line graph with X values against Y values. I don't want any aggregation to happen.… --- ## [NEST Driver compatibility](https://discuss.elastic.co/t/nest-driver-compatibility/104076)
**Author:** [@Stefano\_Ghisaura](https://discuss.elastic.co/u/Stefano_Ghisaura)\ **Replies:** 2\ **Last updated:** [October 17, 2017, 12:46pm UTC](https://discuss.elastic.co/t/nest-driver-compatibility/104076 "2017-10-17T12:46:39Z")
Hi, I'm going crazy looking for any documentation about drivers versions and compatibility with Elastic. Is there anywhere something about this? Like "NEST version 2.4 is compatible with Elastic 2.5"... Thanks in advan… --- ## [Difference between \_source and fields projections](https://discuss.elastic.co/t/difference-between--source-and-fields-projections/22927)
**Author:** [@Udi\_Ben\_Amitai](https://discuss.elastic.co/u/Udi_Ben_Amitai)\ **Replies:** 2\ **Last updated:** [July 14, 2015, 11:03pm UTC](https://discuss.elastic.co/t/difference-between--source-and-fields-projections/22927 "2015-07-14T23:03:44Z")
Hi, My question is about the performance (or other) impact of the difference between \_source and fields projection. These 2 queries return (at least in my perspective) an equivalent result: {"\_source":{"include":\["n… --- ## [ES 7.0.1 : Unassigned Shards : Clarifications on how reroute API with retry\_failed parameter works and its side-effects](https://discuss.elastic.co/t/es-7-0-1-unassigned-shards-clarifications-on-how-reroute-api-with-retry-failed-parameter-works-and-its-side-effects/219740)
**Author:** [@Muthukumaran\_Kothand](https://discuss.elastic.co/u/Muthukumaran_Kothand)\ **Replies:** 5\ **Last updated:** [February 21, 2020, 7:57pm UTC](https://discuss.elastic.co/t/es-7-0-1-unassigned-shards-clarifications-on-how-reroute-api-with-retry-failed-parameter-works-and-its-side-effects/219740 "2020-02-21T19:57:52Z")
ES Version : 7.0.1 Cluster Details: 3 physical nodes each running 4 instances of ES - total 12 instances of Cluster Problem description: As part of testing, performed a full cluster-reboot, noticed that some shards (… --- ## [Problem in Elastic Stack: Logging Lab 4](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294)
**Author:** [@Alice](https://discuss.elastic.co/u/Alice)\ **Replies:** 5\ **Last updated:** [September 30, 2017, 3:41pm UTC](https://discuss.elastic.co/t/problem-in-elastic-stack-logging-lab-4/102294 "2017-09-30T15:41:51Z")
Hi Elastic Team, Hi Elastic Team, When I implemented Elastic Stack: Logging Lab4, I encounter a problem by following page 7 in the Lab4. I added the following code as stated in the lab: grok{ match =\> '%{HTTPDATE:tim… --- ## [Marvel: Error 400 Bad Request: Cannot assign to read only property 'type' of green](https://discuss.elastic.co/t/marvel-error-400-bad-request-cannot-assign-to-read-only-property-type-of-green/62658)
**Author:** [@indokarthi](https://discuss.elastic.co/u/indokarthi)\ **Replies:** 5\ **Last updated:** [October 11, 2016, 2:43pm UTC](https://discuss.elastic.co/t/marvel-error-400-bad-request-cannot-assign-to-read-only-property-type-of-green/62658 "2016-10-11T14:43:22Z")
Has anyone facing this issue ? It happens as soon as I hit http://localhost:5601/app/marvel. Here are details of our cluster. ES - 2.3.2 Marvel agent - 2.3.2 Kibana - 4.5 Marvel - 2.3.2 Marvel is pointing to sep… [Previous page](https://discuss.elastic.co/top.md?page=848&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=850&per_page=50&period=all)