# Top

**URL:** https://discuss.elastic.co/top.md?page=857&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 858

---

## [Out of memorry Error When Using Java Client API](https://discuss.elastic.co/t/out-of-memorry-error-when-using-java-client-api/297038)

<div class="topic-metadata">

**Author:** [@Gandalf](https://discuss.elastic.co/u/Gandalf)\
**Replies:** 3\
**Last updated:** [February 15, 2022, 6:03am UTC](https://discuss.elastic.co/t/out-of-memorry-error-when-using-java-client-api/297038 "2022-02-15T06:03:04Z")

</div>

I'm migrating my code from Java Rest High Level API to Java Client API 7.16 version. Everything goes all right in my local enviroment but got the OutOfMemoryError: Direct buffer memory error when I pull it to the Test E…

---

## [How to write a json values from a field in sql into elasticsearch using logstash](https://discuss.elastic.co/t/how-to-write-a-json-values-from-a-field-in-sql-into-elasticsearch-using-logstash/61514)

<div class="topic-metadata">

**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\
**Replies:** 3\
**Last updated:** [September 26, 2016, 2:35pm UTC](https://discuss.elastic.co/t/how-to-write-a-json-values-from-a-field-in-sql-into-elasticsearch-using-logstash/61514 "2016-09-26T14:35:04Z")

</div>

I have a table in sql server which has json objects as a value in one of the columns. My requirement is to read those objects as it is and write into an index. I would like to know what are the best ways of doing it usin…

---

## [Elasticsearch.py Python API communication over HTTPS](https://discuss.elastic.co/t/elasticsearch-py-python-api-communication-over-https/180075)

<div class="topic-metadata">

**Author:** [@kbrase](https://discuss.elastic.co/u/kbrase)\
**Replies:** 4\
**Last updated:** [May 9, 2019, 2:16am UTC](https://discuss.elastic.co/t/elasticsearch-py-python-api-communication-over-https/180075 "2019-05-09T02:16:18Z")

</div>

My goal is to secure communications between my elasticsearch cluster and my python application that I am creating. I however do not want to pay for a platinum license. Is it possible to use a gold license to secure betwe…

---

## [Get distinct values from "text field" without remapping](https://discuss.elastic.co/t/get-distinct-values-from-text-field-without-remapping/309694)

<div class="topic-metadata">

**Author:** [@lwwalker](https://discuss.elastic.co/u/lwwalker)\
**Replies:** 5\
**Last updated:** [July 15, 2022, 6:23am UTC](https://discuss.elastic.co/t/get-distinct-values-from-text-field-without-remapping/309694 "2022-07-15T06:23:01Z")

</div>

I'm querying ~350 TB of documents. Re-indexing is not an option. Performance, within reason, is not a concern. my documents have a field s3\_filename {"type": "text"}. It doesn't have any subfields. Setting fielddata:…

---

## [Can we have master and ingest nodes set true on same nodes](https://discuss.elastic.co/t/can-we-have-master-and-ingest-nodes-set-true-on-same-nodes/118055)

<div class="topic-metadata">

**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\
**Replies:** 7\
**Last updated:** [February 2, 2018, 5:10am UTC](https://discuss.elastic.co/t/can-we-have-master-and-ingest-nodes-set-true-on-same-nodes/118055 "2018-02-02T05:10:07Z")

</div>

Hi, I have 5 nodes cluster, where i kept 3 nodes , which serve as master and ingest nodes and rest 2 nodes act as only data nodes. Is this good practise? How the flow will be ? and do we need one more node coordinating…

---

## [Elastic-apm-agent.jar on PCF](https://discuss.elastic.co/t/elastic-apm-agent-jar-on-pcf/166137)

<div class="topic-metadata">

**Author:** [@Datta\_Diware](https://discuss.elastic.co/u/Datta_Diware)\
**Replies:** 2\
**Last updated:** [February 12, 2019, 10:56pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-jar-on-pcf/166137 "2019-02-12T22:56:03Z")

</div>

How to add elastic-apm-agent.jar on PCF environment ?

---

## [How to get json subfield from input and use it as document\_id elastic?](https://discuss.elastic.co/t/how-to-get-json-subfield-from-input-and-use-it-as-document-id-elastic/52334)

<div class="topic-metadata">

**Author:** [@breezzz](https://discuss.elastic.co/u/breezzz)\
**Replies:** 2\
**Last updated:** [June 10, 2016, 11:33am UTC](https://discuss.elastic.co/t/how-to-get-json-subfield-from-input-and-use-it-as-document-id-elastic/52334 "2016-06-10T11:33:21Z")

</div>

Good day! I have this work config for logstash: input { kafka { zk\_connect =\> "kafka:2181" topic\_id =\> "requests" group\_id =\> "kafka\_requests" consumer\_threads =\> 1 } } output { elasticsearch { codec =\> …

---

## [How to access \_id from Spark SQL?](https://discuss.elastic.co/t/how-to-access--id-from-spark-sql/24403)

<div class="topic-metadata">

**Author:** [@ludonara](https://discuss.elastic.co/u/ludonara)\
**Replies:** 2\
**Last updated:** [June 26, 2015, 11:39am UTC](https://discuss.elastic.co/t/how-to-access--id-from-spark-sql/24403 "2015-06-26T11:39:39Z")

</div>

Hi, i would access elasticsearch \_id field from a SQL request through Spark Shell. I've try this request : \> sqlContext.sql("select \`\_id\`,platform,avg(duration),count(\*) from video group by platform").show(100) B…

---

## [Logstash Reindex Strategy](https://discuss.elastic.co/t/logstash-reindex-strategy/42812)

<div class="topic-metadata">

**Author:** [@James\_Tang](https://discuss.elastic.co/u/James_Tang)\
**Replies:** 3\
**Last updated:** [April 25, 2016, 4:20am UTC](https://discuss.elastic.co/t/logstash-reindex-strategy/42812 "2016-04-25T04:20:27Z")

</div>

Created a Gist documenting my approach to reindexing using logstash. Hopes it helps Reindexing your Elasticsearch indice with limited resource can be a painw when you have limited resources and need it running at the s…

---

## [Logstash 1.5.3 crashes with moderate load](https://discuss.elastic.co/t/logstash-1-5-3-crashes-with-moderate-load/27015)

<div class="topic-metadata">

**Author:** [@Justin\_Schumacher](https://discuss.elastic.co/u/Justin_Schumacher)\
**Replies:** 3\
**Last updated:** [August 8, 2015, 1:32am UTC](https://discuss.elastic.co/t/logstash-1-5-3-crashes-with-moderate-load/27015 "2015-08-08T01:32:05Z")

</div>

We've set up a (r)elk stack in AWS. Everything seems to work without issue until we hit around 10k (100MB) of documents indexed at elastic search per second (noticed in Kopf). At about that point, all of our log stash in…

---

## [Elasticsearch not starting on boot](https://discuss.elastic.co/t/elasticsearch-not-starting-on-boot/211779)

<div class="topic-metadata">

**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\
**Replies:** 1\
**Last updated:** [December 14, 2019, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-on-boot/211779 "2019-12-14T10:32:55Z")

</div>

Team, More often then not, ElasticSearch is not starting after reboot. It is added to systemd =\> at least an attempt is made. But I need to do a manual service eleasticsearch restart to get it up. When researching th…

---

## [FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981)

<div class="topic-metadata">

**Author:** [@guxupeta](https://discuss.elastic.co/u/guxupeta)\
**Replies:** 6\
**Last updated:** [June 8, 2021, 11:39am UTC](https://discuss.elastic.co/t/fatal-error-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/274981 "2021-06-08T11:39:16Z")

</div>

Hello guys I'm having problems running start kibana every time I try to start give does tap of errors FATAL Error: Port 5601 is already in use. Another instance of Kibana may be running! I'm sending an image

---

## [Color in vega map visualization](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565)

<div class="topic-metadata">

**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\
**Replies:** 6\
**Last updated:** [February 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565 "2021-02-09T17:44:28Z")

</div>

{ "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A choropleth map depicting U.S. unemployment rates by county in 2009.", "width": 960, "height": 500, "autosize": "none", "data": \[ …

---

## [Document level security in Kibana with X Pack](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556)

<div class="topic-metadata">

**Author:** [@annette](https://discuss.elastic.co/u/annette)\
**Replies:** 6\
**Last updated:** [June 9, 2017, 12:26pm UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556 "2017-06-09T12:26:47Z")

</div>

i am trying to set up roles for users to log in but only see documents that is related to them. This is the role that i created: { "events\_admin": { "cluster": \[\], "indices": \[ { …

---

## [Index / update performance with elasticsearch Java plugin?](https://discuss.elastic.co/t/index-update-performance-with-elasticsearch-java-plugin/74169)

<div class="topic-metadata">

**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\
**Replies:** 6\
**Last updated:** [February 8, 2017, 7:38am UTC](https://discuss.elastic.co/t/index-update-performance-with-elasticsearch-java-plugin/74169 "2017-02-08T07:38:55Z")

</div>

Hi, in our project we use a Java Plugin to be able to merge exisiting documents with new ones. Now I saw that the whole index performance is getting really slow. It seems that the performance trip traces back to the ca…

---

## [Host showing as %{host2} in kibana web](https://discuss.elastic.co/t/host-showing-as-host2-in-kibana-web/49092)

<div class="topic-metadata">

**Author:** [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\
**Replies:** 6\
**Last updated:** [May 9, 2016, 12:39pm UTC](https://discuss.elastic.co/t/host-showing-as-host2-in-kibana-web/49092 "2016-05-09T12:39:33Z")

</div>

hello, when I open Kibana, the host mapping field in a search is showing as %{host2} and not the host name, I am not sure what config to look in to resolve this.

---

## [Is logstash necessarily](https://discuss.elastic.co/t/is-logstash-necessarily/328833)

<div class="topic-metadata">

**Author:** [@LilBaloche](https://discuss.elastic.co/u/LilBaloche)\
**Replies:** 8\
**Last updated:** [March 30, 2023, 8:30pm UTC](https://discuss.elastic.co/t/is-logstash-necessarily/328833 "2023-03-30T20:30:36Z")

</div>

Hi everyone I'm testing ELK in a virtual environment (WinServer AD + DNS, Ubuntu Server 22.04, Ubuntu Client 22.04 and Win 10 Client) I've installed ELK stack on an Ubuntu Server 22.04 (I've been helped by a youtube vi…

---

## [Cannot visualise data!](https://discuss.elastic.co/t/cannot-visualise-data/145117)

<div class="topic-metadata">

**Author:** [@Rafal\_Radziejewski](https://discuss.elastic.co/u/Rafal_Radziejewski)\
**Replies:** 8\
**Last updated:** [August 22, 2018, 8:34am UTC](https://discuss.elastic.co/t/cannot-visualise-data/145117 "2018-08-22T08:34:50Z")

</div>

Hello i am new into kibana i was looking at this forum for solution but couldn't find solution. I found a similar question and topic but it didn't helped me: Similar problem So i have EFK stack with fluentd or fluentb…

---

## [JSON parsing depth in logstash](https://discuss.elastic.co/t/json-parsing-depth-in-logstash/245205)

<div class="topic-metadata">

**Author:** [@rakesh15](https://discuss.elastic.co/u/rakesh15)\
**Replies:** 4\
**Last updated:** [August 20, 2020, 11:02am UTC](https://discuss.elastic.co/t/json-parsing-depth-in-logstash/245205 "2020-08-20T11:02:37Z")

</div>

Hi All, Im trying to index the camel logs by using grok pattern and json filter in logstash and then push the same to ES. Below is the sample log snippet that I'm trying to parse. 07:32:49.805 \[Camel (MyCamel) thread …

---

## [Doc\_count type cast error while using bucket aggregations](https://discuss.elastic.co/t/doc-count-type-cast-error-while-using-bucket-aggregations/182185)

<div class="topic-metadata">

**Author:** [@TEJASWI\_CHUNDURI](https://discuss.elastic.co/u/TEJASWI_CHUNDURI)\
**Replies:** 4\
**Last updated:** [May 28, 2019, 1:57pm UTC](https://discuss.elastic.co/t/doc-count-type-cast-error-while-using-bucket-aggregations/182185 "2019-05-28T13:57:08Z")

</div>

Using kibana 6.5.4 When checking the doc\_count . it is replying with cast issue .. I need the results only doc\_count \<2 { "error": { "root\_cause": \[\], "type": "search\_phase\_execution\_exception", "reason…

---

## [At least once delivery setup with logstash kafka](https://discuss.elastic.co/t/at-least-once-delivery-setup-with-logstash-kafka/167998)

<div class="topic-metadata">

**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\
**Replies:** 4\
**Last updated:** [February 12, 2019, 9:54am UTC](https://discuss.elastic.co/t/at-least-once-delivery-setup-with-logstash-kafka/167998 "2019-02-12T09:54:18Z")

</div>

Hi, Recently, we had an issue where all our servers, including kafka + logstash where restarted at the same time. I was hoping that after restart we would get all messages but unfortunately some messages where lost. Aft…

---

## [Snapshots not showing](https://discuss.elastic.co/t/snapshots-not-showing/125986)

<div class="topic-metadata">

**Author:** [@Butterfly](https://discuss.elastic.co/u/Butterfly)\
**Replies:** 4\
**Last updated:** [April 3, 2018, 9:47am UTC](https://discuss.elastic.co/t/snapshots-not-showing/125986 "2018-04-03T09:47:01Z")

</div>

I have two clusters A and B, the repos on both are pointing to the same location. A on 2.4.4 B on 5.6.8 snapshots on cluster A showed up before on cluster B, but today new snapshots on A won't show on B anymore. What…

---

## [Why timelion .sum() is not working](https://discuss.elastic.co/t/why-timelion-sum-is-not-working/123670)

<div class="topic-metadata">

**Author:** [@jerrychen](https://discuss.elastic.co/u/jerrychen)\
**Replies:** 4\
**Last updated:** [March 15, 2018, 2:23am UTC](https://discuss.elastic.co/t/why-timelion-sum-is-not-working/123670 "2018-03-15T02:23:27Z")

</div>

env: es 6.2, kibana 6.2 I what to graph the total disk io bandwidth. First,I get the graph group by ipaddr. \[2018-03-13%2009\_53\_58-Timelion%20-%20Kibana-1\] Then, when i do .sum(),it return nothing. \[2018-03-13%2009\_…

---

## [Truncated String field is not showing in kibana visalisation](https://discuss.elastic.co/t/truncated-string-field-is-not-showing-in-kibana-visalisation/97658)

<div class="topic-metadata">

**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\
**Replies:** 4\
**Last updated:** [August 22, 2017, 4:01am UTC](https://discuss.elastic.co/t/truncated-string-field-is-not-showing-in-kibana-visalisation/97658 "2017-08-22T04:01:06Z")

</div>

i trucated the string format in kibana, but the field is not showing in visualisation… my example log file: {"LogLevel":"ERROR","Msg":"{\\"itemId\\":0,\\"module\\":\\"/curie/attendance\\",\\"action\\":\\"/getByDate/{organizatio…

---

## [Failed to execute \[webhook\] action, error: handshake alert: unrecognized\_name"](https://discuss.elastic.co/t/failed-to-execute-webhook-action-error-handshake-alert-unrecognized-name/23861)

<div class="topic-metadata">

**Author:** [@sandhya](https://discuss.elastic.co/u/sandhya)\
**Replies:** 4\
**Last updated:** [June 18, 2015, 11:58am UTC](https://discuss.elastic.co/t/failed-to-execute-webhook-action-error-handshake-alert-unrecognized-name/23861 "2015-06-18T11:58:39Z")

</div>

I am not able to post request to external source.i always gets error: handshake alert: unrecognized\_name"

---

## [PacketBeat (Elasticsearch) mostly shows zero as response time for queries](https://discuss.elastic.co/t/packetbeat-elasticsearch-mostly-shows-zero-as-response-time-for-queries/70483)

<div class="topic-metadata">

**Author:** [@Akashi\_Seih](https://discuss.elastic.co/u/Akashi_Seih)\
**Replies:** 2\
**Last updated:** [January 4, 2017, 1:15pm UTC](https://discuss.elastic.co/t/packetbeat-elasticsearch-mostly-shows-zero-as-response-time-for-queries/70483 "2017-01-04T13:15:27Z")

</div>

I've installed PacketBeat & ElasticSearch on 1 WildFly server running some simple servlets. The problem that I have is that I see a lot of queries/http requests having "0" as responsetime. Not always, but very often. W…

---

## [Elasticsearch-spark connector failing to save data with an Illegal Argument Exception : "No class name given"](https://discuss.elastic.co/t/elasticsearch-spark-connector-failing-to-save-data-with-an-illegal-argument-exception-no-class-name-given/59024)

<div class="topic-metadata">

**Author:** [@eliasah](https://discuss.elastic.co/u/eliasah)\
**Replies:** 2\
**Last updated:** [August 29, 2016, 6:51am UTC](https://discuss.elastic.co/t/elasticsearch-spark-connector-failing-to-save-data-with-an-illegal-argument-exception-no-class-name-given/59024 "2016-08-29T06:51:01Z")

</div>

Exception in thread "main" org.elasticsearch.hadoop.EsHadoopIllegalArgumentException: No class name given at org.elasticsearch.hadoop.util.Assert.hasText(Assert.java:30) at org.elasticsearch.hadoop.util.ObjectUtils.ins…

---

## [Elasticsearch on Kubernetes - cluster red, one node cannot start](https://discuss.elastic.co/t/elasticsearch-on-kubernetes-cluster-red-one-node-cannot-start/212738)

<div class="topic-metadata">

**Author:** [@dmge](https://discuss.elastic.co/u/dmge)\
**Replies:** 5\
**Last updated:** [December 22, 2019, 10:55pm UTC](https://discuss.elastic.co/t/elasticsearch-on-kubernetes-cluster-red-one-node-cannot-start/212738 "2019-12-22T22:55:37Z")

</div>

Hello, Could you please help me to take back my cluster and shards green? I am using Elastisearch on Kubernetes pods. Have cluster with 3 nodes. After some restarts of the pods/nodes the 3th node does not start, cluste…

---

## [Would like to programmatically create indices with mappings in java: 6.1.3 HighLevelRestClient](https://discuss.elastic.co/t/would-like-to-programmatically-create-indices-with-mappings-in-java-6-1-3-highlevelrestclient/118144)

<div class="topic-metadata">

**Author:** [@jackpark](https://discuss.elastic.co/u/jackpark)\
**Replies:** 5\
**Last updated:** [February 4, 2018, 7:43pm UTC](https://discuss.elastic.co/t/would-like-to-programmatically-create-indices-with-mappings-in-java-6-1-3-highlevelrestclient/118144 "2018-02-04T19:43:11Z")

</div>

In the past (ES 2+) I could assign mappings to index names programmatically. In 6.3.1, there is a CreateIndexRequest/Response pair, but the documentation online says to use it with an API which does not exist. Most ES d…

---

## [Order of the elements does matter?](https://discuss.elastic.co/t/order-of-the-elements-does-matter/15436)

<div class="topic-metadata">

**Author:** [@Nikolay\_Chankov](https://discuss.elastic.co/u/Nikolay_Chankov)\
**Replies:** 7\
**Last updated:** [January 28, 2014, 1:00pm UTC](https://discuss.elastic.co/t/order-of-the-elements-does-matter/15436 "2014-01-28T13:00:07Z")

</div>

Hi guys, today I've noticed that order of the elements in the request does matter for example: curl -XGET 'http://localhost:9200/search/\_search'-d ' { "sort" : {...}, "size" : 100, "query" : {...} }…

---

## [Timestamp disabled in Kibana Alert and Actions after 7.9.0 update](https://discuss.elastic.co/t/timestamp-disabled-in-kibana-alert-and-actions-after-7-9-0-update/245900)

<div class="topic-metadata">

**Author:** [@msszafar](https://discuss.elastic.co/u/msszafar)\
**Replies:** 3\
**Last updated:** [August 24, 2020, 7:43am UTC](https://discuss.elastic.co/t/timestamp-disabled-in-kibana-alert-and-actions-after-7-9-0-update/245900 "2020-08-24T07:43:30Z")

</div>

Hi, Elasticstack is latest 7.9.0. Before update, we were able to save timestamp when alert was getting triggered but now it's disable. we are unable to save timestamp in alert content being saved on index. Highlighte…

---

## [Logstash: parsing snmp traps](https://discuss.elastic.co/t/logstash-parsing-snmp-traps/103208)

<div class="topic-metadata">

**Author:** [@Robert.I](https://discuss.elastic.co/u/Robert.I)\
**Replies:** 3\
**Last updated:** [October 12, 2017, 5:14am UTC](https://discuss.elastic.co/t/logstash-parsing-snmp-traps/103208 "2017-10-12T05:14:17Z")

</div>

Hello All, At this moment, all the traps that i received in Logstash that have the error code, will write in elastic and in a file: output { if \[type\] == "snmptrap" { elasticsearch { hosts =\> \["myhost.domain.com:9200"…

---

## [Can't get Windows winlogbeat 8.0 to run- The system cannot find the path](https://discuss.elastic.co/t/cant-get-windows-winlogbeat-8-0-to-run-the-system-cannot-find-the-path/298670)

<div class="topic-metadata">

**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\
**Replies:** 2\
**Last updated:** [March 3, 2022, 1:08pm UTC](https://discuss.elastic.co/t/cant-get-windows-winlogbeat-8-0-to-run-the-system-cannot-find-the-path/298670 "2022-03-03T13:08:48Z")

</div>

I upgraded my Elastic Stack on Windows from 7.17.0 to 8.0. I installed both metricbeat and winlogbeat 8.0 using the .msi files. Metricbeat runs fine. I cannot get winlogbeat to start. Winlogbeat fails because it cannot f…

---

## [Problems after trying to setup realms](https://discuss.elastic.co/t/problems-after-trying-to-setup-realms/172222)

<div class="topic-metadata">

**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Replies:** 2\
**Last updated:** [March 14, 2019, 1:34am UTC](https://discuss.elastic.co/t/problems-after-trying-to-setup-realms/172222 "2019-03-14T01:34:21Z")

</div>

On elasticsearch 6.6.1, we were trying to add a realm for our active directory environment. We first added something similar to this: xpack: security: authc: realms: native1: type: native order: 0 ldap1: type:…

---

## [Range for id](https://discuss.elastic.co/t/range-for-id/9754)

<div class="topic-metadata">

**Author:** [@sada](https://discuss.elastic.co/u/sada)\
**Replies:** 2\
**Last updated:** [November 18, 2012, 8:45pm UTC](https://discuss.elastic.co/t/range-for-id/9754 "2012-11-18T20:45:52Z")

</div>

Hello My need is to find the documents which \_id \> "50792fa924cc1e5028003fc0" I'm trying to, for example: {"query": {"range": {"\_uid": {"gt": "50792fa924cc1e5028003fc0"}}}} and ... {"query": {"range": …

---

## [Aggregation on previous aggregation's result](https://discuss.elastic.co/t/aggregation-on-previous-aggregations-result/207414)

<div class="topic-metadata">

**Author:** [@hi\_there](https://discuss.elastic.co/u/hi_there)\
**Replies:** 6\
**Last updated:** [November 27, 2019, 3:54pm UTC](https://discuss.elastic.co/t/aggregation-on-previous-aggregations-result/207414 "2019-11-27T15:54:45Z")

</div>

Hi first time poster, probably won't be last =D. I think Elasticsearch is cool, but I am stuck in trying to translate SQL to DSL and I was wondering if I could get some help. Nutshell is the following (using random sch…

---

## [Convert a field value from Decimal to Hexa](https://discuss.elastic.co/t/convert-a-field-value-from-decimal-to-hexa/176054)

<div class="topic-metadata">

**Author:** [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Replies:** 6\
**Last updated:** [April 9, 2019, 4:51pm UTC](https://discuss.elastic.co/t/convert-a-field-value-from-decimal-to-hexa/176054 "2019-04-09T16:51:32Z")

</div>

Hello, So after applying the GROK filter ,i have a field that it's value is in decimal. I need to convert it to Hexa. i tried this : ruby { code =\> "event.set('%{AgentID}', event.get('%{AgentID}').to\_s.hex)" } t…

---

## ["Invalid format" message for a date format that always worked. Why the sudden date parsing error?](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966)

<div class="topic-metadata">

**Author:** [@dorj1234](https://discuss.elastic.co/u/dorj1234)\
**Replies:** 6\
**Last updated:** [January 25, 2018, 2:38pm UTC](https://discuss.elastic.co/t/invalid-format-message-for-a-date-format-that-always-worked-why-the-sudden-date-parsing-error/114966 "2018-01-25T14:38:05Z")

</div>

Hello, I have had csv files for a long time parsing correctly, but something changed and I get the error below. My "run\_date" is a simple field that looks like this in the data files: "2017-12-28" It always worked. I …

---

## [Connect Elasticsearch in AWS with Cognito autnetication enabled](https://discuss.elastic.co/t/connect-elasticsearch-in-aws-with-cognito-autnetication-enabled/183146)

<div class="topic-metadata">

**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Replies:** 4\
**Last updated:** [June 18, 2019, 9:44am UTC](https://discuss.elastic.co/t/connect-elasticsearch-in-aws-with-cognito-autnetication-enabled/183146 "2019-06-18T09:44:01Z")

</div>

Hi everyone, I just testing elasticsearch service on AWS. In my environment, i enabled Cognito authentication for kibana. Now i want access ES via http call (because i need excute some query from outsite to ES by http…

---

## [Why are we told to copy the data folder when upgrading?](https://discuss.elastic.co/t/why-are-we-told-to-copy-the-data-folder-when-upgrading/168951)

<div class="topic-metadata">

**Author:** [@gyau](https://discuss.elastic.co/u/gyau)\
**Replies:** 4\
**Last updated:** [February 19, 2019, 7:32am UTC](https://discuss.elastic.co/t/why-are-we-told-to-copy-the-data-folder-when-upgrading/168951 "2019-02-19T07:32:46Z")

</div>

I was reading the snapshot and restore section from the documentation and it said that it isn't recommended to just copy and paste the folder because there might be some data loss. It is not possible to back up an Elas…

---

## [Java transport client do not work after upgrade to 6.5.3](https://discuss.elastic.co/t/java-transport-client-do-not-work-after-upgrade-to-6-5-3/161726)

<div class="topic-metadata">

**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\
**Replies:** 4\
**Last updated:** [December 27, 2018, 9:53am UTC](https://discuss.elastic.co/t/java-transport-client-do-not-work-after-upgrade-to-6-5-3/161726 "2018-12-27T09:53:01Z")

</div>

We have a Java transport client which worked fine with 6.2 jars on a 6.2 cluster but cannot connect anymore after 6.5.3 upgrade of both client and server. We did the following upgrade jars to 6.5.3 recompiled our clie…

---

## [(Plugin Kuromoji) Can you help me resolve config elasticsearch.yml create analyzer?](https://discuss.elastic.co/t/plugin-kuromoji-can-you-help-me-resolve-config-elasticsearch-yml-create-analyzer/34943)

<div class="topic-metadata">

**Author:** [@NgocPham](https://discuss.elastic.co/u/NgocPham)\
**Replies:** 4\
**Last updated:** [November 20, 2015, 10:42am UTC](https://discuss.elastic.co/t/plugin-kuromoji-can-you-help-me-resolve-config-elasticsearch-yml-create-analyzer/34943 "2015-11-20T10:42:36Z")

</div>

Sorry for my newbie question ,My Japanese not good and i will start by English i have one issue in elasticsearch 1.7.3 i want creat new analyzer use this https://github.com/elastic/elasticsearch-analysis-kuromoji af…

---

## [5.0.0-alpha2: how to set index.query.bool.max\_clause\_count?](https://discuss.elastic.co/t/5-0-0-alpha2-how-to-set-index-query-bool-max-clause-count/49816)

<div class="topic-metadata">

**Author:** [@jimyoo](https://discuss.elastic.co/u/jimyoo)\
**Replies:** 1\
**Last updated:** [March 24, 2017, 7:26pm UTC](https://discuss.elastic.co/t/5-0-0-alpha2-how-to-set-index-query-bool-max-clause-count/49816 "2017-03-24T19:26:02Z")

</div>

Index level setting is not allowed in elastic search.yml with 5.0.0. And with \_setting or \_template { "error": { "root\_cause": \[ { "type": "illegal\_argument\_exception", "reason":…

---

## [Filebeat Modules and Parsing, with Logstash - Cisco Related](https://discuss.elastic.co/t/filebeat-modules-and-parsing-with-logstash-cisco-related/246027)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 5\
**Last updated:** [September 15, 2020, 10:12am UTC](https://discuss.elastic.co/t/filebeat-modules-and-parsing-with-logstash-cisco-related/246027 "2020-09-15T10:12:13Z")

</div>

From what I can glean from https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html and Problems parsing Cisco ASA logs using filebeat, using the filebeat cisco module with logstash successfully looks l…

---

## [Logstash error {:reason=\>"Expected one of #, \\", ', }](https://discuss.elastic.co/t/logstash-error-reason-expected-one-of/107752)

<div class="topic-metadata">

**Author:** [@Gaoo\_Nin\_Rice](https://discuss.elastic.co/u/Gaoo_Nin_Rice)\
**Replies:** 5\
**Last updated:** [November 16, 2017, 10:51am UTC](https://discuss.elastic.co/t/logstash-error-reason-expected-one-of/107752 "2017-11-16T10:51:47Z")

</div>

hi, I have a problem for my logstash config. Need to help what's happen from my config my config input { file { \["host", "127.0.0.1"\] path =\> "/drives/d/logstash-5.6.3/bin/data/Topping/Trigger/\*.csv" } } filter …

---

## [Error de salida con Logstash](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246)

<div class="topic-metadata">

**Author:** [@Erick\_Garcia\_Perez](https://discuss.elastic.co/u/Erick_Garcia_Perez)\
**Replies:** 5\
**Last updated:** [September 25, 2017, 12:49pm UTC](https://discuss.elastic.co/t/error-de-salida-con-logstash/101246 "2017-09-25T12:49:36Z")

</div>

Buenas tardes, alguien que me diga como trabajar con logs remotos apoyado de rsync junto con logstash, ando trabajando con logstash y logs remotos pero a la hora de insertar un registro en un log, la salida(output) de lo…

---

## [How to use port 443 to access Kibana. legacy-multitenancy error](https://discuss.elastic.co/t/how-to-use-port-443-to-access-kibana-legacy-multitenancy-error/282567)

<div class="topic-metadata">

**Author:** [@shharukh](https://discuss.elastic.co/u/shharukh)\
**Replies:** 3\
**Last updated:** [August 30, 2021, 1:13am UTC](https://discuss.elastic.co/t/how-to-use-port-443-to-access-kibana-legacy-multitenancy-error/282567 "2021-08-30T01:13:02Z")

</div>

Hi Shahrukh here, I have unique problem which is has been solved. I have successfully installed elasticsearch over HTTPS but I want to use the port 443.I have followed these steps given in the previous blog \` \` bu…

---

## [Invalid FieldReference: \`\[\]\`](https://discuss.elastic.co/t/invalid-fieldreference/273834)

<div class="topic-metadata">

**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\
**Replies:** 3\
**Last updated:** [May 25, 2021, 1:02pm UTC](https://discuss.elastic.co/t/invalid-fieldreference/273834 "2021-05-25T13:02:43Z")

</div>

Hi all, i receive from logstash error this kind of error: :exception=\>#\<RuntimeError: Invalid FieldReference: \[\] this pipeline transform a csv , in the line i've \[ \] value a couple of field. for exaple the line can …

---

## [Elastic storage path](https://discuss.elastic.co/t/elastic-storage-path/105412)

<div class="topic-metadata">

**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\
**Replies:** 3\
**Last updated:** [October 26, 2017, 12:21pm UTC](https://discuss.elastic.co/t/elastic-storage-path/105412 "2017-10-26T12:21:14Z")

</div>

Hi..I want to change elastic default index documents data to another drive....can u suggest me exact path

---

## [Copying Files to Central Remote Server Using Beats/LogStash](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746)

<div class="topic-metadata">

**Author:** [@arpitwanchoo](https://discuss.elastic.co/u/arpitwanchoo)\
**Replies:** 3\
**Last updated:** [April 19, 2017, 5:33am UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746 "2017-04-19T05:33:40Z")

</div>

Hi I am trying to design the centralized logging structure for our org. I was looking for a following pipeline : RemoteServers(FileBeat) =\> Central Server (LogStash) =\> ElasticSearch I want FileBeat to copy files …

[Previous page](https://discuss.elastic.co/top.md?page=856&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=858&per_page=50&period=all)
