# Top **URL:** https://discuss.elastic.co/top.md?page=869&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 870 --- ## [HTTP header does not include traceparent](https://discuss.elastic.co/t/http-header-does-not-include-traceparent/288649)
**Author:** [@sfischer](https://discuss.elastic.co/u/sfischer)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 3:29pm UTC](https://discuss.elastic.co/t/http-header-does-not-include-traceparent/288649 "2021-11-09T15:29:27Z")
I am trying to use RUM on the spring-boot application https://github.com/spring-projects/spring-petclinic. I would like to link the transactions from the Client side (i.e. JavaScript) to the Server side (i.e. Java). Fro… --- ## [Filebeat stops sending json logs midway. Version: 6.0.0-rc1](https://discuss.elastic.co/t/filebeat-stops-sending-json-logs-midway-version-6-0-0-rc1/105885)
**Author:** [@rohit-smpx](https://discuss.elastic.co/u/rohit-smpx)\ **Replies:** 7\ **Last updated:** [November 2, 2017, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-stops-sending-json-logs-midway-version-6-0-0-rc1/105885 "2017-11-02T12:58:55Z")
I have some test logs in json format. The number of entries are 900+ in the file I'm testing. After a fresh installation, Filebeat starts sending the logs but after some time (a few minute) starts giving this err: ERR … --- ## [Required java version for elasticsearch 5.6 java API?](https://discuss.elastic.co/t/required-java-version-for-elasticsearch-5-6-java-api/158541)
**Author:** [@hym](https://discuss.elastic.co/u/hym)\ **Replies:** 1\ **Last updated:** [November 28, 2018, 10:36am UTC](https://discuss.elastic.co/t/required-java-version-for-elasticsearch-5-6-java-api/158541 "2018-11-28T10:36:11Z")
Hi all, I have a problem with java version (7) using elasticsearch 5.6.7 Caused by: java.lang.UnsupportedClassVersionError: org/elasticsearch/index/query/QueryBuilder : Unsupported major.minor version 52.0 (unable to l… --- ## [Field \[stats.value\] used in expression does not exist in mappings -- but the query does not contain that](https://discuss.elastic.co/t/field-stats-value-used-in-expression-does-not-exist-in-mappings-but-the-query-does-not-contain-that/54795)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 5\ **Last updated:** [July 6, 2016, 11:02am UTC](https://discuss.elastic.co/t/field-stats-value-used-in-expression-does-not-exist-in-mappings-but-the-query-does-not-contain-that/54795 "2016-07-06T11:02:57Z")
I get this error for any use of kibana: Field \[stats.value\] used in expression does not exist in mappings But my kibana query is simply '\*'. What does this mean? What expression is being referred to? --- ## [Using elasticsearch as mysql cache, is frequent index burden ES when documents is massive?](https://discuss.elastic.co/t/using-elasticsearch-as-mysql-cache-is-frequent-index-burden-es-when-documents-is-massive/11894)
**Author:** [@xin\_zhang](https://discuss.elastic.co/u/xin_zhang)\ **Replies:** 5\ **Last updated:** [May 9, 2013, 10:10am UTC](https://discuss.elastic.co/t/using-elasticsearch-as-mysql-cache-is-frequent-index-burden-es-when-documents-is-massive/11894 "2013-05-09T10:10:09Z")
Hi, I have built a mysql cache using ElasticSearch, I am not sure if anybody else using ES in this way, but it really works for me. My motivation is from two concerns in terms of mysql: 1. max connection … --- ## [How to import data from elasticsearch into mongo?](https://discuss.elastic.co/t/how-to-import-data-from-elasticsearch-into-mongo/79255)
**Author:** [@laoyang360](https://discuss.elastic.co/u/laoyang360)\ **Replies:** 2\ **Last updated:** [March 25, 2017, 1:22pm UTC](https://discuss.elastic.co/t/how-to-import-data-from-elasticsearch-into-mongo/79255 "2017-03-25T13:22:22Z")
Now, I have amount of data in elasticsearch, I want to import the all of indexs in elasticsearch into mongodb. I searched google for a long time, but there are many links about import data into elasticsearch from mongo… --- ## [Logstash with Filebeat i/o timeout](https://discuss.elastic.co/t/logstash-with-filebeat-i-o-timeout/121055)
**Author:** [@mschuster](https://discuss.elastic.co/u/mschuster)\ **Replies:** 1\ **Last updated:** [March 21, 2018, 7:33am UTC](https://discuss.elastic.co/t/logstash-with-filebeat-i-o-timeout/121055 "2018-03-21T07:33:42Z")
Hi all, i got some problems with filebeat and logstash. When i start logstash, all informations are going into elasticsearch, but after a short time i don´t see (most) informations from filebeat in kibana. In the logf… --- ## [Filebeat on RHEL5.x?](https://discuss.elastic.co/t/filebeat-on-rhel5-x/115306)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [January 16, 2018, 4:19am UTC](https://discuss.elastic.co/t/filebeat-on-rhel5-x/115306 "2018-01-16T04:19:48Z")
Hi, I saw that filebeat is not available for RHEL 5.x. Is it just not tested or does it not work? We are planing to introduce elastics stack to an older project. Unfortunately some machines are still running on RHEL 5… --- ## [\[reindexing\] my\_index is much more larger after a re\_indexing](https://discuss.elastic.co/t/reindexing-my-index-is-much-more-larger-after-a-re-indexing/184726)
**Author:** [@Derrar](https://discuss.elastic.co/u/Derrar)\ **Replies:** 2\ **Last updated:** [June 7, 2019, 9:57am UTC](https://discuss.elastic.co/t/reindexing-my-index-is-much-more-larger-after-a-re-indexing/184726 "2019-06-07T09:57:22Z")
Hello Everyone, I encounter the following issue: my\_index is much more larger after a re\_indexing and I've no idea why. What I want to do: do a simple reindexing, keeping the same mapping, the destination index has 1 … --- ## [Reporting Error: Access for Kibana -\>Share -\> CSV Report -\> Generate CSV](https://discuss.elastic.co/t/reporting-error-access-for-kibana-share-csv-report-generate-csv/262658)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 4\ **Last updated:** [February 2, 2021, 1:48pm UTC](https://discuss.elastic.co/t/reporting-error-access-for-kibana-share-csv-report-generate-csv/262658 "2021-02-02T13:48:12Z")
Hi I have a user with the guest\_role which can "read" access on an index, I have also assigned a Kibana's reporting\_user role, but when the user tries to Share the content of and index using Share -\> CSV Report -\> Gen… --- ## [I didnt get suricata eve.json](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058)
**Author:** [@jiangyanjun](https://discuss.elastic.co/u/jiangyanjun)\ **Replies:** 4\ **Last updated:** [August 1, 2019, 5:50am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058 "2019-08-01T05:50:53Z")
kibana 7.2 elasticsearch 7.2 filebeat 6.7.2 filebeat modules enable suricata suricata.yaml filebeat.yml filebeat -e -d "publish" we can see that the content of eve.json has read out, but can not display in ki… --- ## [How to fix @timestamp at metricbeat alert](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981)
**Author:** [@Thanadol\_Thadasade](https://discuss.elastic.co/u/Thanadol_Thadasade)\ **Replies:** 4\ **Last updated:** [July 17, 2017, 10:11am UTC](https://discuss.elastic.co/t/how-to-fix-timestamp-at-metricbeat-alert/92981 "2017-07-17T10:11:15Z")
Hi, @spinscale I having a new problems with @timestamp, because this output doesn't match my computer times (date is match, but times doesn't match) . This output from ctx.trigger.scheduled\_time And this my computer… --- ## [Grok pattern for '|' character](https://discuss.elastic.co/t/grok-pattern-for-character/224333)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 3\ **Last updated:** [March 20, 2020, 8:15pm UTC](https://discuss.elastic.co/t/grok-pattern-for-character/224333 "2020-03-20T20:15:45Z")
I have 4 log files and a sample line from each of them is below. All these log files are under one index. How can i make one grok pattern that works for these two different format of log files? The grok i have at the en… --- ## [Rebuild/restart kibana](https://discuss.elastic.co/t/rebuild-restart-kibana/72990)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [January 27, 2017, 9:43am UTC](https://discuss.elastic.co/t/rebuild-restart-kibana/72990 "2017-01-27T09:43:43Z")
We are having kibana 5.1. I've found out that kibana after restart process doesn't rebuild the code again. Is there any way how to do it? --- ## [Output workers in elastic search plugin](https://discuss.elastic.co/t/output-workers-in-elastic-search-plugin/66478)
**Author:** [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 9:32am UTC](https://discuss.elastic.co/t/output-workers-in-elastic-search-plugin/66478 "2016-12-14T09:32:00Z")
In the document of elastic search output plugin (document link), it is mentioned under 'workers' that "Output workers are no longer supported. Please use plugin workers". I did not understand the meaning of it. What do… --- ## [Bootstrapping Elasticsearch 7.2.0 on AWS ECS](https://discuss.elastic.co/t/bootstrapping-elasticsearch-7-2-0-on-aws-ecs/193422)
**Author:** [@Suryatej\_Mukkamalla](https://discuss.elastic.co/u/Suryatej_Mukkamalla)\ **Replies:** 0\ **Last updated:** [August 1, 2019, 11:16pm UTC](https://discuss.elastic.co/t/bootstrapping-elasticsearch-7-2-0-on-aws-ecs/193422 "2019-08-01T23:16:56Z")
Hello, I am trying to get a cluster up and running on AWS. I have the ECS cluster created, containers assigned, but whenever the Elasticsearch tasks try to begin, it fails on the bootstrapping section with the following… --- ## [Monitoring SAP applications using APM](https://discuss.elastic.co/t/monitoring-sap-applications-using-apm/158233)
**Author:** [@arik89](https://discuss.elastic.co/u/arik89)\ **Replies:** 0\ **Last updated:** [November 26, 2018, 7:03pm UTC](https://discuss.elastic.co/t/monitoring-sap-applications-using-apm/158233 "2018-11-26T19:03:08Z")
Hi guys. I would like to know how would you configure SAP application monitoring using the elastic APM. Where would you start? Thanks. --- ## [How does apm-server set service.name?](https://discuss.elastic.co/t/how-does-apm-server-set-service-name/296556)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 5:52am UTC](https://discuss.elastic.co/t/how-does-apm-server-set-service-name/296556 "2022-02-11T05:52:38Z")
I have deployed apm-server on multiple public cloud kubernetes clusters, but when they send health metrics to elasticsearch, the service.name is all called apm-server , is there any way to distinguish it? I checked the a… --- ## [Monitore mikrotik router logs with ELK](https://discuss.elastic.co/t/monitore-mikrotik-router-logs-with-elk/266026)
**Author:** [@NZHP](https://discuss.elastic.co/u/NZHP)\ **Replies:** 2\ **Last updated:** [March 8, 2021, 7:48pm UTC](https://discuss.elastic.co/t/monitore-mikrotik-router-logs-with-elk/266026 "2021-03-08T19:48:37Z")
Hi everybody, I installed ELK on my infrastructure, now i want to monitor logs data of my routers and switch with elk stack. So how can process it please ? Thank advance --- ## [Not able to populate @timestamp value to a table in html file](https://discuss.elastic.co/t/not-able-to-populate-timestamp-value-to-a-table-in-html-file/39070)
**Author:** [@vivc](https://discuss.elastic.co/u/vivc)\ **Replies:** 8\ **Last updated:** [January 14, 2016, 10:13am UTC](https://discuss.elastic.co/t/not-able-to-populate-timestamp-value-to-a-table-in-html-file/39070 "2016-01-14T10:13:21Z")
I'm trying to populate @timestamp value to a table using the following code. // $(row).html(item.\_source.message); $(row).html(item.source.timestamp); this is not workin… --- ## [Missing authentication credentials for REST request \[/\_cluster/health?pretty\] In minimal security set up](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162 "2021-07-08T09:36:57Z")
Hi! I'm trying to set up basic security on elastic cluster. my elasticsearch.yml: cluster.name: ELK-CLUSTER node.name: $HOSTNAME node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: … --- ## [How to pick the previous value when current value is undefined?](https://discuss.elastic.co/t/how-to-pick-the-previous-value-when-current-value-is-undefined/177828)
**Author:** [@fernsrea](https://discuss.elastic.co/u/fernsrea)\ **Replies:** 5\ **Last updated:** [May 4, 2019, 1:37am UTC](https://discuss.elastic.co/t/how-to-pick-the-previous-value-when-current-value-is-undefined/177828 "2019-05-04T01:37:31Z")
I want to pick the previous value when my current value is undefined. The below code works fine when only 1 value is missing. But when multiple consecutive values are missing in my dataset, I cannot replace them with t… --- ## [Is it possible to delete a document from a script?](https://discuss.elastic.co/t/is-it-possible-to-delete-a-document-from-a-script/42343)
**Author:** [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Replies:** 5\ **Last updated:** [February 28, 2016, 7:54pm UTC](https://discuss.elastic.co/t/is-it-possible-to-delete-a-document-from-a-script/42343 "2016-02-28T19:54:11Z")
Hi, I would like to delete the document which a script is called upon. The use case for this is I have a list of resources in the doc, which can grow or shrink, according to their availability. I want the doc to disapp… --- ## [Logstash -\> Kafka output preferred settings](https://discuss.elastic.co/t/logstash-kafka-output-preferred-settings/41941)
**Author:** [@malonej7](https://discuss.elastic.co/u/malonej7)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 5:51pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-preferred-settings/41941 "2016-02-18T17:51:27Z")
Are there any preferred, non-default settings for using the kafka output in logstash? Any specific Kafka-side settings that should be checked as well? I'm running into the issue of logstash seemingly not being able to… --- ## [Where do incoming events go when Logstash is cpu-bound?](https://discuss.elastic.co/t/where-do-incoming-events-go-when-logstash-is-cpu-bound/65197)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/where-do-incoming-events-go-when-logstash-is-cpu-bound/65197 "2016-11-07T13:19:02Z")
Hi, I have a logstash instance which is taking in quite a bit of traffic via the tcp input. Logstash is currently cpu-bound on this particular server, which I understand is not at all an unusual situation. By cpu-bound… --- ## [Payload content length greater than maximum allowed: 3000000](https://discuss.elastic.co/t/payload-content-length-greater-than-maximum-allowed-3000000/236780)
**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\ **Replies:** 1\ **Last updated:** [June 18, 2020, 3:26pm UTC](https://discuss.elastic.co/t/payload-content-length-greater-than-maximum-allowed-3000000/236780 "2020-06-18T15:26:35Z")
I have an index pattern that will not retrieve documents in Kibana. I have researched and know about the server.maxPayloadBytes. I have used the Elasticsearch API to query the documents in the index pattern and examine… --- ## [Discover: Fielddata is disabled on text fields by default. Set fielddata=true on \[user\] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field …](https://discuss.elastic.co/t/discover-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-user-in-order-to-load-fielddata-in-memory-by-uninverting-the-inverted-index-note-that-this-can-however-use-significant-memory-alternatively-use-a-keyword-field/93214)
**Author:** [@sudi\_2611](https://discuss.elastic.co/u/sudi_2611)\ **Replies:** 1\ **Last updated:** [July 14, 2017, 4:02pm UTC](https://discuss.elastic.co/t/discover-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true-on-user-in-order-to-load-fielddata-in-memory-by-uninverting-the-inverted-index-note-that-this-can-however-use-significant-memory-alternatively-use-a-keyword-field/93214 "2017-07-14T16:02:01Z")
Hi, I am new to kibana and when trying the save the data in discover field i am getting the above error --- ## [Json Array of geo locations, get distance of all the location in json array of a Document](https://discuss.elastic.co/t/json-array-of-geo-locations-get-distance-of-all-the-location-in-json-array-of-a-document/55974)
**Author:** [@Saikrishna\_Rangineni](https://discuss.elastic.co/u/Saikrishna_Rangineni)\ **Replies:** 3\ **Last updated:** [March 30, 2017, 9:10pm UTC](https://discuss.elastic.co/t/json-array-of-geo-locations-get-distance-of-all-the-location-in-json-array-of-a-document/55974 "2017-03-30T21:10:22Z")
i have and document which contains array of locations with address and lat / long( geo\_point). { "practiceLocations":\[ { "city":"ELKO", "state":"NV", "zipCode":"89801", "location… --- ## [Dropdown with fixed list](https://discuss.elastic.co/t/dropdown-with-fixed-list/271395)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 4\ **Last updated:** [April 30, 2021, 1:56pm UTC](https://discuss.elastic.co/t/dropdown-with-fixed-list/271395 "2021-04-30T13:56:56Z")
Hi, Is it possible to add a predefined list of fields to a dropdown without extracting them from a query? Thank you --- ## [Combine IIS userAgent values](https://discuss.elastic.co/t/combine-iis-useragent-values/99491)
**Author:** [@hburnswell](https://discuss.elastic.co/u/hburnswell)\ **Replies:** 4\ **Last updated:** [September 7, 2017, 5:24pm UTC](https://discuss.elastic.co/t/combine-iis-useragent-values/99491 "2017-09-07T17:24:25Z")
Hi, I am trying to create a simple pie chart of IIS userAgent data in Kibana and I'm curious if there is a way to combine 'like' values. For example, I receive: Microsoft+Office/14.0 Microsoft+Office/16.0 Apple-Iph… --- ## [Issue: Index Patterns: In order to visualize and explore data in Kibana, you'll need to create an index pattern to retrieve data from Elasticsearch](https://discuss.elastic.co/t/issue-index-patterns-in-order-to-visualize-and-explore-data-in-kibana-youll-need-to-create-an-index-pattern-to-retrieve-data-from-elasticsearch/123350)
**Author:** [@g-man](https://discuss.elastic.co/u/g-man)\ **Replies:** 2\ **Last updated:** [March 11, 2018, 11:37pm UTC](https://discuss.elastic.co/t/issue-index-patterns-in-order-to-visualize-and-explore-data-in-kibana-youll-need-to-create-an-index-pattern-to-retrieve-data-from-elasticsearch/123350 "2018-03-11T23:37:49Z")
The past few days, we've experienced issues in Kibana where our indexes are not available with an informational message at the top stating 'Index Patterns: In order to visualize and explore data in Kibana, you'll need to… --- ## [Kibana - list an event which is happened after another event based on time stamp](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602)
**Author:** [@Faisal\_Karakunnel\_Mo](https://discuss.elastic.co/u/Faisal_Karakunnel_Mo)\ **Replies:** 2\ **Last updated:** [October 4, 2017, 10:10am UTC](https://discuss.elastic.co/t/kibana-list-an-event-which-is-happened-after-another-event-based-on-time-stamp/102602 "2017-10-04T10:10:43Z")
Hi, I am a new to Kibana and my main use is for even analysis reported from different components. My question is on the usage level. Assume that all the entries has time stamps and a field which represents some events.… --- ## [How to delete a document in Elasticsearch using Logstash](https://discuss.elastic.co/t/how-to-delete-a-document-in-elasticsearch-using-logstash/196326)
**Author:** [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Replies:** 0\ **Last updated:** [August 22, 2019, 12:58pm UTC](https://discuss.elastic.co/t/how-to-delete-a-document-in-elasticsearch-using-logstash/196326 "2019-08-22T12:58:10Z")
My ETL Stack is JSON File =\> Filebeat =\> Logstash =\> Elasticsearch I am trying to specify an action in my JSON object that is either update or delete Here's a partial of my current JSON { "key":123,"index\_name":"compa… --- ## [Rally 1.1.0 released](https://discuss.elastic.co/t/rally-1-1-0-released/180020)
**Author:** [@dliappis](https://discuss.elastic.co/u/dliappis)\ **Replies:** 1\ **Last updated:** [May 7, 2019, 4:19pm UTC](https://discuss.elastic.co/t/rally-1-1-0-released/180020 "2019-05-07T16:19:53Z")
We have just released Rally 1.1.0. This release contains several improvements and bug fixes and we have improved stability in several areas. See the 1.1.0 release page for all details. How to...? ... upgrade: pip3 ins… --- ## [No permissions for user | Security Exception](https://discuss.elastic.co/t/no-permissions-for-user-security-exception/335499)
**Author:** [@Faisal\_Umer](https://discuss.elastic.co/u/Faisal_Umer)\ **Replies:** 6\ **Last updated:** [June 20, 2023, 8:52am UTC](https://discuss.elastic.co/t/no-permissions-for-user-security-exception/335499 "2023-06-20T08:52:58Z")
I have to delay the shards assignment after a failure and running this command for that PUT \_all/\_settings { "settings": { "index.unassigned.node\_left.delayed\_timeout": "5m" } } Getting the following error whi… --- ## [Composite Aggregation - Too many buckets](https://discuss.elastic.co/t/composite-aggregation-too-many-buckets/270962)
**Author:** [@vands](https://discuss.elastic.co/u/vands)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 1:26pm UTC](https://discuss.elastic.co/t/composite-aggregation-too-many-buckets/270962 "2021-04-22T13:26:58Z")
Hi All , Facing the below issue while using composite aggregation and get buckets data \[Elasticsearch exception \[type=too\_many\_buckets\_exception, reason=Trying to create too many buckets. Must be less than or equal to:… --- ## [Vertical Bar Graph not showing accurate data](https://discuss.elastic.co/t/vertical-bar-graph-not-showing-accurate-data/189821)
**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Replies:** 7\ **Last updated:** [July 12, 2019, 5:26pm UTC](https://discuss.elastic.co/t/vertical-bar-graph-not-showing-accurate-data/189821 "2019-07-12T17:26:18Z")
Hi I am using ELK 7.2. I have configured kibana to monitor number of users hitting our internal environments on both windows and linux. The issue am having here is. if I set the time frame to see all the environments … --- ## [Issue with saving an object to ES](https://discuss.elastic.co/t/issue-with-saving-an-object-to-es/117179)
**Author:** [@Nikita\_Krasnov](https://discuss.elastic.co/u/Nikita_Krasnov)\ **Replies:** 7\ **Last updated:** [January 26, 2018, 11:27am UTC](https://discuss.elastic.co/t/issue-with-saving-an-object-to-es/117179 "2018-01-26T11:27:12Z")
Try to save object due to such json: { "header": "test Header", "timeStamp":"2018-01-26T09:45:00.000+02:00", "message":"test message 3", "level":"INFO", "node": "first node", "system": "super system 1", "port": 9… --- ## [How to set default mapping for string as "not\_analyzed"? No luck with dynamic\_templates](https://discuss.elastic.co/t/how-to-set-default-mapping-for-string-as-not-analyzed-no-luck-with-dynamic-templates/381)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 1\ **Last updated:** [May 8, 2015, 11:04am UTC](https://discuss.elastic.co/t/how-to-set-default-mapping-for-string-as-not-analyzed-no-luck-with-dynamic-templates/381 "2015-05-08T11:04:53Z")
How to set default mapping for string as "not\_analyzed"? No luck with dynamic\_templates I tried running this below template first in my CURL PUT /my\_index { "mappings": { "my\_type": { "dynamic\_templates":… --- ## [Elasticsearch get all unique Ids](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 5\ **Last updated:** [December 21, 2021, 9:08pm UTC](https://discuss.elastic.co/t/elasticsearch-get-all-unique-ids/292589 "2021-12-21T21:08:12Z")
Thanks to all who read this for your help. Background: I have a job that when executing inserts a document. The job can fail and run again, inserting a second document. Both have the same linkId- so I know there is o… --- ## [Elasticsearch 7.4 Netflow questions Logstash or filebeat WTF?](https://discuss.elastic.co/t/elasticsearch-7-4-netflow-questions-logstash-or-filebeat-wtf/202171)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 5\ **Last updated:** [October 4, 2019, 7:33am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-netflow-questions-logstash-or-filebeat-wtf/202171 "2019-10-04T07:33:58Z")
Hello, I am trying to figure out ElasticSearch and the NetFlow module. I use to think that I would send logs from my firewalls to via UDP to logstash https://www.elastic.co/guide/en/logstash/current/netflow-module.ht… --- ## [Creating new types in 6.0](https://discuss.elastic.co/t/creating-new-types-in-6-0/111350)
**Author:** [@percona.jayj](https://discuss.elastic.co/u/percona.jayj)\ **Replies:** 5\ **Last updated:** [December 12, 2017, 6:16pm UTC](https://discuss.elastic.co/t/creating-new-types-in-6-0/111350 "2017-12-12T18:16:46Z")
I can appreciate the decision to remove mapping types going forward in ES, I can also appreciate that version 6 has support for existing indexes with types, but we have until version 7 to totally remove the types. As I … --- ## [Tunning Watcher](https://discuss.elastic.co/t/tunning-watcher/47958)
**Author:** [@mario\_carmona](https://discuss.elastic.co/u/mario_carmona)\ **Replies:** 5\ **Last updated:** [June 13, 2016, 7:11am UTC](https://discuss.elastic.co/t/tunning-watcher/47958 "2016-06-13T07:11:34Z")
I have created the below watcher that looks in my proxy index, it currently works however I would like to tune it. Would like to only send events to the SIEM that exceed 20 hits for "deviceAction:TCP\_AUTH\_REDIRECT" from … --- ## [Can I register snapshot repo without path.repo property in elasticsearch.yml?](https://discuss.elastic.co/t/can-i-register-snapshot-repo-without-path-repo-property-in-elasticsearch-yml/274427)
**Author:** [@Prabaharan\_Kathiresa](https://discuss.elastic.co/u/Prabaharan_Kathiresa)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 7:24am UTC](https://discuss.elastic.co/t/can-i-register-snapshot-repo-without-path-repo-property-in-elasticsearch-yml/274427 "2021-06-02T07:24:08Z")
Hi Team, We are using elasticsearch 6.8.5 version in production with 3 Master and 8 data nodes. There is no path.repo property present in the production. I can't update elasticsearch.yml and restart nodes in production. … --- ## [How can I use facets in Vega-lite with sub aggregations?](https://discuss.elastic.co/t/how-can-i-use-facets-in-vega-lite-with-sub-aggregations/260920)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 8\ **Last updated:** [January 14, 2021, 4:29pm UTC](https://discuss.elastic.co/t/how-can-i-use-facets-in-vega-lite-with-sub-aggregations/260920 "2021-01-14T16:29:24Z")
Hi all! I am trying to make this sub aggregation turn into a Vega-lite bar visualization in Kibana: GET index\_do/\_search { "size" : 0, "aggs": { "sube": { "terms": { … --- ## [Use logstash\_checksum as tracking\_column](https://discuss.elastic.co/t/use-logstash-checksum-as-tracking-column/209269)
**Author:** [@WalterLeff](https://discuss.elastic.co/u/WalterLeff)\ **Replies:** 8\ **Last updated:** [November 25, 2019, 4:51pm UTC](https://discuss.elastic.co/t/use-logstash-checksum-as-tracking-column/209269 "2019-11-25T16:51:22Z")
Hi all Logstash creates perfectly a checksum from my row data { "\_index": "rel", "\_type": "\_doc", "\_id": "2", "\_version": 5, "\_score": 0, "\_source": { "datecreated": "2016-06-09T00:00:00.000Z", … --- ## [Retrying failed action with response code: 500](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-500/184813)
**Author:** [@Debasish\_Rath](https://discuss.elastic.co/u/Debasish_Rath)\ **Replies:** 3\ **Last updated:** [June 9, 2019, 11:26am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-500/184813 "2019-06-09T11:26:31Z")
Hi All, My config file was working in logstash before installing XPACK. After installation, I am getting below error in Logstash. retrying failed action with response code: 500 ({"type"=\>"illegal\_state\_exception", "re… --- ## [Aggregation giving inconsistent results](https://discuss.elastic.co/t/aggregation-giving-inconsistent-results/20502)
**Author:** [@Jay\_Hilden](https://discuss.elastic.co/u/Jay_Hilden)\ **Replies:** 3\ **Last updated:** [November 1, 2014, 8:51am UTC](https://discuss.elastic.co/t/aggregation-giving-inconsistent-results/20502 "2014-11-01T08:51:14Z")
I'm running an aggregation and getting the top 5 results. When I run the exact same aggregation on the top 50 results I'm getting totally different results. I expect that when asking for 50 the top 5 should remain … --- ## [Jvm.option file issue](https://discuss.elastic.co/t/jvm-option-file-issue/215553)
**Author:** [@Sergey\_Mucha](https://discuss.elastic.co/u/Sergey_Mucha)\ **Replies:** 2\ **Last updated:** [January 18, 2020, 1:28pm UTC](https://discuss.elastic.co/t/jvm-option-file-issue/215553 "2020-01-18T13:28:25Z")
Hi Elastic 7.5.1 was installed from tar.gz Config is : export ES\_HOME=/var/vcap/jobs/elasticsearch export ES\_PATH\_CONF=${ES\_HOME}/config I have following issue Exception in thread "main" java.nio.file.NoSuchFileExc… --- ## [How to add back a node after excluding it from cluster](https://discuss.elastic.co/t/how-to-add-back-a-node-after-excluding-it-from-cluster/90097)
**Author:** [@lekhasy](https://discuss.elastic.co/u/lekhasy)\ **Replies:** 2\ **Last updated:** [June 25, 2017, 7:07am UTC](https://discuss.elastic.co/t/how-to-add-back-a-node-after-excluding-it-from-cluster/90097 "2017-06-25T07:07:36Z")
I have used this command to exclude one of my node from my cluster: PUT \_cluster/settings { "transient": {"cluster": {"routing": {"allocation.exclude": {"\_name": "node\_2"}}}} } it works as expected, but when i use th… [Previous page](https://discuss.elastic.co/top.md?page=868&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=870&per_page=50&period=all)