# Top **URL:** https://discuss.elastic.co/top.md?page=873&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 874 --- ## [Time since last event](https://discuss.elastic.co/t/time-since-last-event/157097)
**Author:** [@IndiaSierra](https://discuss.elastic.co/u/IndiaSierra)\ **Replies:** 2\ **Last updated:** [November 16, 2018, 5:17pm UTC](https://discuss.elastic.co/t/time-since-last-event/157097 "2018-11-16T17:17:19Z")
Hi, I'm trying to make some basic monitoring for our test farm (currently evaluating if Kibana is an option for us). Sometimes a test can hang which we currently do not detect. I was hoping to make something with Kiban… --- ## [Metrics -\> Inventory tab shows all zero's, but Metrics -\> Explorer shows data](https://discuss.elastic.co/t/metrics-inventory-tab-shows-all-zeros-but-metrics-explorer-shows-data/254451)
**Author:** [@jmcclelland](https://discuss.elastic.co/u/jmcclelland)\ **Replies:** 6\ **Last updated:** [December 5, 2020, 3:08am UTC](https://discuss.elastic.co/t/metrics-inventory-tab-shows-all-zeros-but-metrics-explorer-shows-data/254451 "2020-12-05T03:08:38Z")
I'm collecting metrics via metricbeat. The inventory shows all 27 servers as boxes, but with 0 as the value for each server and each indicator. However, when I click on the Explorer tab I can create a graph showing data… --- ## [Logstash 6.0 breaks ruby code if running more than 1 worker](https://discuss.elastic.co/t/logstash-6-0-breaks-ruby-code-if-running-more-than-1-worker/109083)
**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\ **Replies:** 6\ **Last updated:** [November 27, 2017, 4:13pm UTC](https://discuss.elastic.co/t/logstash-6-0-breaks-ruby-code-if-running-more-than-1-worker/109083 "2017-11-27T16:13:33Z")
I upgraded Logstash to 6.0. After the upgrade a lot of ruby code stopped to work. Following code worked in Logstash 5, but in Logstash 6 it ofter causes these errors: Ruby exception occurred: org.jruby.RubyNil cannot b… --- ## [Elasticsearch sometimes bulk update fail?](https://discuss.elastic.co/t/elasticsearch-sometimes-bulk-update-fail/199199)
**Author:** [@ElvisLin](https://discuss.elastic.co/u/ElvisLin)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 2:54am UTC](https://discuss.elastic.co/t/elasticsearch-sometimes-bulk-update-fail/199199 "2019-09-16T02:54:22Z")
Elasticsearch version: 7.0.0 I can not reproduce the problem. My system is frequently sync db data to Elasticsearch server through bulk method. The proccess will do update/create/delete in bulk body. I'm using client… --- ## [Logstash syslog issue](https://discuss.elastic.co/t/logstash-syslog-issue/125383)
**Author:** [@cybersecc](https://discuss.elastic.co/u/cybersecc)\ **Replies:** 8\ **Last updated:** [March 26, 2018, 10:11am UTC](https://discuss.elastic.co/t/logstash-syslog-issue/125383 "2018-03-26T10:11:23Z")
Hello, I have configured a remote server to send syslog to logstash.. When I run tcpdump -Xni eth0 I can see that syslog packets are coming to logstash server, but in elasticsearch I see no results. By the way I read a… --- ## [Perfmon Data Visualization](https://discuss.elastic.co/t/perfmon-data-visualization/39320)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 3\ **Last updated:** [January 20, 2016, 7:48am UTC](https://discuss.elastic.co/t/perfmon-data-visualization/39320 "2016-01-20T07:48:45Z")
Hi , Please help me plotting graph for CPU ,Memory & other parameters(Y-axis) with time(X-axis). I am not able able to plot the graphs as getting warning for analysed field. Please suggest where I am missing. PFB log… --- ## [Kibana errors after changing encryptionKey - Failed to decrypt "apiKey" attribute: Unsupported state or unable to authenticate data](https://discuss.elastic.co/t/kibana-errors-after-changing-encryptionkey-failed-to-decrypt-apikey-attribute-unsupported-state-or-unable-to-authenticate-data/344492)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 1\ **Last updated:** [October 5, 2023, 2:21pm UTC](https://discuss.elastic.co/t/kibana-errors-after-changing-encryptionkey-failed-to-decrypt-apikey-attribute-unsupported-state-or-unable-to-authenticate-data/344492 "2023-10-05T14:21:07Z")
I use elasticstack 8.5.3 and have 2 Logstash, 5 ELS and 1 Kibana nodes. I was cleaning the older kibana system indices ( upgraded from 7.17.7) and deleted .security\_7 index also and had to create all built in users agai… --- ## ["Strange" behaviour multimatch with fuzziness](https://discuss.elastic.co/t/strange-behaviour-multimatch-with-fuzziness/98867)
**Author:** [@barry1](https://discuss.elastic.co/u/barry1)\ **Replies:** 1\ **Last updated:** [August 30, 2017, 2:34pm UTC](https://discuss.elastic.co/t/strange-behaviour-multimatch-with-fuzziness/98867 "2017-08-30T14:34:52Z")
So I have 3 documents with 2 fields: title and brand Title: Björn Borg R400 Low SNB schoenen heren marine/groen/wit, Brand: Björn Borg Title: Baby Born Schoenen 2-Pack Assorti, Brand: Baby Born Title: Born In The Echoe… --- ## [Creaing dashboard from non timeseries data](https://discuss.elastic.co/t/creaing-dashboard-from-non-timeseries-data/50235)
**Author:** [@manizzzz](https://discuss.elastic.co/u/manizzzz)\ **Replies:** 1\ **Last updated:** [May 17, 2016, 4:02pm UTC](https://discuss.elastic.co/t/creaing-dashboard-from-non-timeseries-data/50235 "2016-05-17T16:02:59Z")
Team, I am new to Kibana. I am trying to check if is it possible to create dashboard graphs from non time series data. My json data contains multiple key value where timestamp is not one of them. I like to use some com… --- ## [User/role management best practices](https://discuss.elastic.co/t/user-role-management-best-practices/187197)
**Author:** [@t0ffel](https://discuss.elastic.co/u/t0ffel)\ **Replies:** 4\ **Last updated:** [January 20, 2020, 9:28am UTC](https://discuss.elastic.co/t/user-role-management-best-practices/187197 "2020-01-20T09:28:53Z")
What is the best practice for the user and role management with the operator? Is it preferable to create users k8s resources or is it better to create users via Kibana? is there a way to do custom roles via k8s resourc… --- ## [WARN log in Elasticsearch every time i enable refresh interval in Kibana](https://discuss.elastic.co/t/warn-log-in-elasticsearch-every-time-i-enable-refresh-interval-in-kibana/190463)
**Author:** [@maasid](https://discuss.elastic.co/u/maasid)\ **Replies:** 4\ **Last updated:** [July 24, 2019, 10:38am UTC](https://discuss.elastic.co/t/warn-log-in-elasticsearch-every-time-i-enable-refresh-interval-in-kibana/190463 "2019-07-24T10:38:29Z")
Hello, Since I upgraded my cluster to version 7.2.0 I've been seeing this log in Elasticsearch every time I enabled refresh interval in Kibana. \[interval\] on \[date\_histogram\] is deprecated, use \[fixed\_interval\] or \[cal… --- ## [Filebeat alternative on RHEL5](https://discuss.elastic.co/t/filebeat-alternative-on-rhel5/162658)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 4\ **Last updated:** [January 3, 2019, 8:12am UTC](https://discuss.elastic.co/t/filebeat-alternative-on-rhel5/162658 "2019-01-03T08:12:34Z")
Hi, I am introducing the elastic stack into different project in our company. Unfortunately we are using here some older versions of redhat (5.6), where filebeat is currently not running because the kernel is too old. … --- ## [Kibana tilemap not showing any results](https://discuss.elastic.co/t/kibana-tilemap-not-showing-any-results/51074)
**Author:** [@PCO](https://discuss.elastic.co/u/PCO)\ **Replies:** 4\ **Last updated:** [June 9, 2016, 3:08pm UTC](https://discuss.elastic.co/t/kibana-tilemap-not-showing-any-results/51074 "2016-06-09T15:08:10Z")
Hi there, I have an ELK stack running correctly without geo data. I started to add a new kind of data with geo data and unfortunately I can not visualize any data. Logstash receives data from filebeat (data source is… --- ## [Aliases API : error deleting index](https://discuss.elastic.co/t/aliases-api-error-deleting-index/325265)
**Author:** [@quentin.renoux](https://discuss.elastic.co/u/quentin.renoux)\ **Replies:** 2\ **Last updated:** [February 20, 2023, 12:36pm UTC](https://discuss.elastic.co/t/aliases-api-error-deleting-index/325265 "2023-02-20T12:36:06Z")
Hi everyone, TL;DR : the \_aliases API throw error trying to remove index saying it doesn't exist but it does. I'm using the aliases API to swap two indices behind an alias in a single atomic operation. I'm following th… --- ## [How to use VisualVM remote moniter Es 5.5](https://discuss.elastic.co/t/how-to-use-visualvm-remote-moniter-es-5-5/101284)
**Author:** [@zhongyi8307](https://discuss.elastic.co/u/zhongyi8307)\ **Replies:** 1\ **Last updated:** [October 5, 2017, 9:40am UTC](https://discuss.elastic.co/t/how-to-use-visualvm-remote-moniter-es-5-5/101284 "2017-10-05T09:40:01Z")
in my jvm.option -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=8105 -Dcom.sun.management.jmxremote.authenticate=false #-Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxrem… --- ## [What is the difference between interval and span queries?](https://discuss.elastic.co/t/what-is-the-difference-between-interval-and-span-queries/189348)
**Author:** [@princesahu04](https://discuss.elastic.co/u/princesahu04)\ **Replies:** 0\ **Last updated:** [July 8, 2019, 1:07pm UTC](https://discuss.elastic.co/t/what-is-the-difference-between-interval-and-span-queries/189348 "2019-07-08T13:07:02Z")
In both the query we control over the order and proximity of matching terms then what is the actual difference between them? --- ## [Covariant type search in NEST v6.x and Elasticsearch v6.x](https://discuss.elastic.co/t/covariant-type-search-in-nest-v6-x-and-elasticsearch-v6-x/130355)
**Author:** [@nmartins](https://discuss.elastic.co/u/nmartins)\ **Replies:** 0\ **Last updated:** [May 3, 2018, 3:42am UTC](https://discuss.elastic.co/t/covariant-type-search-in-nest-v6-x-and-elasticsearch-v6-x/130355 "2018-05-03T03:42:10Z")
Hi, We're trying to upgrade our cluster from v5 to v6 - doing so we're also upgrading to v6 for our NEST/Elasticsearch.net libraries. Since types are now removed (or will be removed in v7) - I'm trying to use the TypeN… --- ## [Change time zone of output to ES index](https://discuss.elastic.co/t/change-time-zone-of-output-to-es-index/86048)
**Author:** [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\ **Replies:** 2\ **Last updated:** [May 18, 2017, 5:47am UTC](https://discuss.elastic.co/t/change-time-zone-of-output-to-es-index/86048 "2017-05-18T05:47:46Z")
Hi, I am outputting to Elasticsearch with date specific indices. My server time zone is in IST but problem I am facing is my Elasticsearch index changes as per UTC time zone. How can i change timezone or ES index creat… --- ## [Elasticsearch \> logstash \> Elasticsearch failing - illegal latitude value](https://discuss.elastic.co/t/elasticsearch-logstash-elasticsearch-failing-illegal-latitude-value/83432)
**Author:** [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\ **Replies:** 2\ **Last updated:** [May 4, 2017, 1:48pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-elasticsearch-failing-illegal-latitude-value/83432 "2017-05-04T13:48:26Z")
Dumping from an ES 1.7.6 server to 2.4.4 with the logstash elasticsearch input I see the following message for the majority of my documents: "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"=\>"faile… --- ## [Pipeline aggregation \[Only sibling pipeline aggregations are allowed at the top level\]](https://discuss.elastic.co/t/pipeline-aggregation-only-sibling-pipeline-aggregations-are-allowed-at-the-top-level/35894)
**Author:** [@vladmiller](https://discuss.elastic.co/u/vladmiller)\ **Replies:** 2\ **Last updated:** [June 17, 2016, 6:59pm UTC](https://discuss.elastic.co/t/pipeline-aggregation-only-sibling-pipeline-aggregations-are-allowed-at-the-top-level/35894 "2016-06-17T18:59:03Z")
Hi friends, I am trying to do some calculations over existing bucket. The goal is to generate average pageviews per session, therefore I first get the number of unique sessions, then I read number of unique sessions and… --- ## [How to set field type to "ip"?](https://discuss.elastic.co/t/how-to-set-field-type-to-ip/24659)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 9:07pm UTC](https://discuss.elastic.co/t/how-to-set-field-type-to-ip/24659 "2015-06-30T21:07:44Z")
I've used the date filter to set a target field as a date type. I don't see a filter to set a target field type to "ip". I'm looking to do this so I can use the IPv4 Range Aggregation, but haven't been able to find th… --- ## [Problem when changing resources](https://discuss.elastic.co/t/problem-when-changing-resources/323408)
**Author:** [@ccaillet](https://discuss.elastic.co/u/ccaillet)\ **Replies:** 5\ **Last updated:** [January 23, 2023, 1:44pm UTC](https://discuss.elastic.co/t/problem-when-changing-resources/323408 "2023-01-23T13:44:28Z")
Hi all, When I change resources like cpu and memory on limits ECK does nothing, the only way for me to have the sts to be update with my changes is to edit the sts manifest with kubectl edit for applying new values to t… --- ## [How to import CSV files, where couple of fields have multiline content](https://discuss.elastic.co/t/how-to-import-csv-files-where-couple-of-fields-have-multiline-content/280453)
**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\ **Replies:** 5\ **Last updated:** [August 11, 2021, 2:00am UTC](https://discuss.elastic.co/t/how-to-import-csv-files-where-couple-of-fields-have-multiline-content/280453 "2021-08-11T02:00:43Z")
Hello, how to accurately import CSV where lines contain fields with multiline content? Default separator is comma, but multiline content is surrounded with double-quotes. For example: Summary,Issue key,Issue id,Parent … --- ## [How to get part of a field of parsed json message in logstash](https://discuss.elastic.co/t/how-to-get-part-of-a-field-of-parsed-json-message-in-logstash/109737)
**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\ **Replies:** 5\ **Last updated:** [December 1, 2017, 6:46am UTC](https://discuss.elastic.co/t/how-to-get-part-of-a-field-of-parsed-json-message-in-logstash/109737 "2017-12-01T06:46:08Z")
I am trying to get just the date part from @report\_timestamp field of a parsed json message in logstash configuration so that I can name the output log file name based on date, say request\_2017\_08\_01.log my message look… --- ## [Logstash version 5 Service commands are not working](https://discuss.elastic.co/t/logstash-version-5-service-commands-are-not-working/70359)
**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\ **Replies:** 5\ **Last updated:** [January 2, 2017, 2:11pm UTC](https://discuss.elastic.co/t/logstash-version-5-service-commands-are-not-working/70359 "2017-01-02T14:11:56Z")
Hi Team, I have upgraded the Logstash Version from 2.x to 5.x. But our service script is not working. The start command which we are using in the script is: /opt/logstash/bin/logstash agent -f /opt/logstash/conf… --- ## [Failed to merge - There is not enough space on the disk](https://discuss.elastic.co/t/failed-to-merge-there-is-not-enough-space-on-the-disk/18384)
**Author:** [@Ophir\_Michaeli](https://discuss.elastic.co/u/Ophir_Michaeli)\ **Replies:** 5\ **Last updated:** [June 30, 2014, 12:48am UTC](https://discuss.elastic.co/t/failed-to-merge-there-is-not-enough-space-on-the-disk/18384 "2014-06-30T00:48:11Z")
Hi, I get an error - failed to merge java.io.IOException: There is not enough space on the disk. The disk was full, cleaned it now. What is the best way not to loose what I already indexed? Or does this error m… --- ## [Geo\_point expected - Elasticsearch version 7.3.2](https://discuss.elastic.co/t/geo-point-expected-elasticsearch-version-7-3-2/201495)
**Author:** [@lmariselvam](https://discuss.elastic.co/u/lmariselvam)\ **Replies:** 7\ **Last updated:** [October 4, 2019, 9:11am UTC](https://discuss.elastic.co/t/geo-point-expected-elasticsearch-version-7-3-2/201495 "2019-10-04T09:11:28Z")
I'm trying to index a document with a valid "geo\_point" data, but I got an error saying "geo\_point expected". Can someone please advise? Request: curl -X PUT "10.80.0.78:9200/production-index/mytype/mydocument1?pretty"… --- ## [Aggs with painless script on an object containing an array](https://discuss.elastic.co/t/aggs-with-painless-script-on-an-object-containing-an-array/67136)
**Author:** [@TeePee](https://discuss.elastic.co/u/TeePee)\ **Replies:** 3\ **Last updated:** [November 28, 2016, 9:49am UTC](https://discuss.elastic.co/t/aggs-with-painless-script-on-an-object-containing-an-array/67136 "2016-11-28T09:49:36Z")
Hi guys, I'm using ES 5.0 and how can I represent an object containing an array using painless script, since doc.extra\_data.nID\_deals.value doesn't seem to do the job? Take a look: "inline":"doc.deal\_id.value == para… --- ## [Applying ILM to existing time-series indices](https://discuss.elastic.co/t/applying-ilm-to-existing-time-series-indices/240069)
**Author:** [@vanessa](https://discuss.elastic.co/u/vanessa)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 11:24pm UTC](https://discuss.elastic.co/t/applying-ilm-to-existing-time-series-indices/240069 "2020-07-10T23:24:24Z")
Hello! I feel as though I've been on a wild goose chase today. Would appreciate any guidance here. As context, when I originally set up ILM in my index templates, I missed the step where you have to specify a rollover\_al… --- ## [Dead connection to ES](https://discuss.elastic.co/t/dead-connection-to-es/200597)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 4\ **Last updated:** [October 17, 2019, 3:58pm UTC](https://discuss.elastic.co/t/dead-connection-to-es/200597 "2019-10-17T15:58:09Z")
Preformatted textI am trying to send some logs to Elastic search service which i have configured in AWS console , below is my sample config file input { file { path =\> "/var/log/logstash/\*.log" start\_position =\> "be… --- ## [Unable to write existing json from HDFS to elasticsearch using MapReduce](https://discuss.elastic.co/t/unable-to-write-existing-json-from-hdfs-to-elasticsearch-using-mapreduce/85263)
**Author:** [@JustUse](https://discuss.elastic.co/u/JustUse)\ **Replies:** 4\ **Last updated:** [May 11, 2017, 4:06am UTC](https://discuss.elastic.co/t/unable-to-write-existing-json-from-hdfs-to-elasticsearch-using-mapreduce/85263 "2017-05-11T04:06:02Z")
Well, I try to write exist json from hdfs to elasticsearch but is raising error... Have any one met such a problem，help me. Thank you in advance. Error: org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: Found unrec… --- ## [Kibana does not recognize indexed fields](https://discuss.elastic.co/t/kibana-does-not-recognize-indexed-fields/65415)
**Author:** [@Yitzchak\_Lockerman](https://discuss.elastic.co/u/Yitzchak_Lockerman)\ **Replies:** 4\ **Last updated:** [November 11, 2016, 6:42pm UTC](https://discuss.elastic.co/t/kibana-does-not-recognize-indexed-fields/65415 "2016-11-11T18:42:59Z")
I am trying to use Kibana 4.5.4 with elasticsearch 2.4.1 to visualize log data in elasticsearch. However, Kibana seems to be having problems detecting which fields are indexed. In particular, it appears to be unable to d… --- ## [Fleet apply pipelines](https://discuss.elastic.co/t/fleet-apply-pipelines/291288)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 6\ **Last updated:** [December 10, 2021, 10:22pm UTC](https://discuss.elastic.co/t/fleet-apply-pipelines/291288 "2021-12-10T22:22:51Z")
Hello, I have two questions about ingest pipelines on Fleet. I want to enrich a field in an existent integration (IIS) I know its not recommended to directly edit ingest pipelines on the integrations but the advance… --- ## [ML job error : Failed to launch autodetect for job](https://discuss.elastic.co/t/ml-job-error-failed-to-launch-autodetect-for-job/260243)
**Author:** [@kimi89](https://discuss.elastic.co/u/kimi89)\ **Replies:** 6\ **Last updated:** [January 6, 2021, 9:30pm UTC](https://discuss.elastic.co/t/ml-job-error-failed-to-launch-autodetect-for-job/260243 "2021-01-06T21:30:00Z")
Unexpected job state \[failed\] while waiting for job to be opened Error Log: " Failed to launch autodetect for job jobname" --- ## [Kibana: Field collapsing and inner hits not working for visualizations](https://discuss.elastic.co/t/kibana-field-collapsing-and-inner-hits-not-working-for-visualizations/124743)
**Author:** [@fakenine](https://discuss.elastic.co/u/fakenine)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 2:07pm UTC](https://discuss.elastic.co/t/kibana-field-collapsing-and-inner-hits-not-working-for-visualizations/124743 "2018-03-20T14:07:25Z")
Hello, In Kibana, I have created a search that returns the last status for each servers, using field collapsing and inner hits. { "query": { "match": { "event\_name": "server\_status" } }, "collapse":… --- ## [FileBeat is sending the data to LogStash but nothing appears on logstash logs/kibana/elastic log](https://discuss.elastic.co/t/filebeat-is-sending-the-data-to-logstash-but-nothing-appears-on-logstash-logs-kibana-elastic-log/132796)
**Author:** [@Suraj\_Sharma1](https://discuss.elastic.co/u/Suraj_Sharma1)\ **Replies:** 8\ **Last updated:** [May 23, 2018, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-is-sending-the-data-to-logstash-but-nothing-appears-on-logstash-logs-kibana-elastic-log/132796 "2018-05-23T13:11:07Z")
Hi All, Am very new to ELK stack and we are implementing this in our project because of huge efforts involved in debugging and seeing the logs. I have configured the filebeat on one of our servers and configuration goe… --- ## [Lucene 6.2 version in final 5.0?](https://discuss.elastic.co/t/lucene-6-2-version-in-final-5-0/55181)
**Author:** [@byronvoorbach](https://discuss.elastic.co/u/byronvoorbach)\ **Replies:** 8\ **Last updated:** [September 8, 2016, 3:13pm UTC](https://discuss.elastic.co/t/lucene-6-2-version-in-final-5-0/55181 "2016-09-08T15:13:37Z")
Hi all, Will Lucene 6.2 be part of the 5.0 release?? I'm mentioning this because I just noticed that https://issues.apache.org/jira/browse/LUCENE-2605 has been resolved a couple of days ago. Would really love to see th… --- ## [Issue with type geo\_pont](https://discuss.elastic.co/t/issue-with-type-geo-pont/39585)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 8\ **Last updated:** [January 20, 2016, 7:59pm UTC](https://discuss.elastic.co/t/issue-with-type-geo-pont/39585 "2016-01-20T19:59:18Z")
Hi, I am trying to configure multiple logs in a single conf file. Though all things are coming to kibana but geoip fields are as string rather than geo\_point While configuring separate conf file, geo\_point is there and… --- ## [請教如何令filebeat做到多個indexes配上不同template和ilm](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106)
**Author:** [@cecil](https://discuss.elastic.co/u/cecil)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 3:33am UTC](https://discuss.elastic.co/t/filebeat-indexes-template-ilm/277106 "2021-07-21T03:33:45Z")
我是新手，已測試了filebeat如何取得多個不同log源，也試了單一ilm是怎樣發生，也稍為明白template的用途。 現在有一個以下問題，目標是在同一伺服器上，把/var/log/syslog和/var/log/auth.log經filebeat分別套用在不同template上，然後各自也配不同ilm 例如syslog的ilm是hot 1day, delete 30days，而auth.log的ilm是hot 30 day, … --- ## [Logstash Plugin Install](https://discuss.elastic.co/t/logstash-plugin-install/25827)
**Author:** [@Dilip2610](https://discuss.elastic.co/u/Dilip2610)\ **Replies:** 2\ **Last updated:** [July 20, 2015, 3:43pm UTC](https://discuss.elastic.co/t/logstash-plugin-install/25827 "2015-07-20T15:43:09Z")
Hi, can some one share the steps to install logstash-filter-aggregate plugin on Windows where i don't have access to gem. Thanks, Dilip --- ## [Loading astronomical data with Logstash](https://discuss.elastic.co/t/loading-astronomical-data-with-logstash/129959)
**Author:** [@Marcel-Jan](https://discuss.elastic.co/u/Marcel-Jan)\ **Replies:** 7\ **Last updated:** [May 21, 2018, 10:02pm UTC](https://discuss.elastic.co/t/loading-astronomical-data-with-logstash/129959 "2018-05-21T22:02:47Z")
Hi, I've only just done a course on Elasticsearch, Kibana and Logstash. I have a Ubuntu 64-bit in VirtualBox with Elasticsearch 6.2.3 and Logstash And I thought it would be a good idea to do a little project to see what… --- ## [Problem with expression scripts through inline updates](https://discuss.elastic.co/t/problem-with-expression-scripts-through-inline-updates/67908)
**Author:** [@larry521](https://discuss.elastic.co/u/larry521)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 9:02am UTC](https://discuss.elastic.co/t/problem-with-expression-scripts-through-inline-updates/67908 "2016-12-05T09:02:04Z")
Hey Guys, I'm trying to use expression scripts through inline updates vs using groovy through a file and ran into some issues. I'm testing with curl. Here is the code: POST /aggregateusersearchterm\_v2/aggregate\_user… --- ## [ML: how to find anomaly from ip address](https://discuss.elastic.co/t/ml-how-to-find-anomaly-from-ip-address/239996)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 12:48am UTC](https://discuss.elastic.co/t/ml-how-to-find-anomaly-from-ip-address/239996 "2020-07-09T00:48:38Z")
Hi, I have been trying to figure out how to use the multi metric to find anomaly in IP address. Objective is to do something like gmail login notification if IP address or device type are different. I created sample da… --- ## [Mutiline pattern Filebeat](https://discuss.elastic.co/t/mutiline-pattern-filebeat/91277)
**Author:** [@Sam67000](https://discuss.elastic.co/u/Sam67000)\ **Replies:** 5\ **Last updated:** [June 30, 2017, 12:53pm UTC](https://discuss.elastic.co/t/mutiline-pattern-filebeat/91277 "2017-06-30T12:53:27Z")
Hello EveryOne, I send data with filebeat and I want to use mutiline. Every event start with date like this : 2017-06-12T15:52:56.201\_I\_I\_01de02a1ec3d0b28 \[07:48\] func will be continued(0,0000000001800094) In logs… --- ## [Index not creating](https://discuss.elastic.co/t/index-not-creating/55016)
**Author:** [@bala1](https://discuss.elastic.co/u/bala1)\ **Replies:** 5\ **Last updated:** [July 8, 2016, 11:35am UTC](https://discuss.elastic.co/t/index-not-creating/55016 "2016-07-08T11:35:46Z")
I have started ES and trying to fetch indices on kibana-4 but getting error while fire command on powershell command: Output: 2016/07/08 05:12:35.119557 client.go:302: DBG Ping request failed with: Head http://search… --- ## [Use of saveToEsWithMeta and performance for idempotence writing](https://discuss.elastic.co/t/use-of-savetoeswithmeta-and-performance-for-idempotence-writing/45106)
**Author:** [@vincent\_gromakowski](https://discuss.elastic.co/u/vincent_gromakowski)\ **Replies:** 5\ **Last updated:** [April 5, 2016, 4:15pm UTC](https://discuss.elastic.co/t/use-of-savetoeswithmeta-and-performance-for-idempotence-writing/45106 "2016-04-05T16:15:42Z")
Hi all, I am looking for a method to index lots of small documents from Spark using a specific ID to manage idempotence and deduplication (case of failure, case of at least once processing...). The problem is that I get … --- ## [SentinelOne Integration](https://discuss.elastic.co/t/sentinelone-integration/310378)
**Author:** [@Medel](https://discuss.elastic.co/u/Medel)\ **Replies:** 3\ **Last updated:** [July 22, 2022, 11:20am UTC](https://discuss.elastic.co/t/sentinelone-integration/310378 "2022-07-22T11:20:21Z")
Hello , I'm trying to integrate SentinelOne API to Elastic for the purpose of collecting logs but unfortunatly i can't find any tutorial or information on how to use the API token generated from the used and integrate i… --- ## [Downgrade from es version 8.15.0 to 8.13.4](https://discuss.elastic.co/t/downgrade-from-es-version-8-15-0-to-8-13-4/366905)
**Author:** [@hamedheidarian](https://discuss.elastic.co/u/hamedheidarian)\ **Replies:** 7\ **Last updated:** [September 23, 2024, 4:36pm UTC](https://discuss.elastic.co/t/downgrade-from-es-version-8-15-0-to-8-13-4/366905 "2024-09-23T16:36:43Z")
Hi, Is there any possibility for doing such downgrade without data loss? I have seen this topic and this one before. but I don't have a snapshot before the 8.15.0 version and tried snapshot of 8.15.0 on elastic cluster … --- ## [Is there way to sort graphs in visualization?](https://discuss.elastic.co/t/is-there-way-to-sort-graphs-in-visualization/258425)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 7\ **Last updated:** [December 30, 2020, 9:10pm UTC](https://discuss.elastic.co/t/is-there-way-to-sort-graphs-in-visualization/258425 "2020-12-30T21:10:48Z")
Hi. I have a heatmap in one visualization. I have 3 sources, so I split chart by column by source, which creates 3 heatmaps. Let's say source A, B, and C. Currently, order is A,B,C. I can change using Order, but it onl… --- ## [Index data from MSSQL server to Elasticsearch using Logstash as nested documents](https://discuss.elastic.co/t/index-data-from-mssql-server-to-elasticsearch-using-logstash-as-nested-documents/217179)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 7\ **Last updated:** [February 4, 2020, 7:23am UTC](https://discuss.elastic.co/t/index-data-from-mssql-server-to-elasticsearch-using-logstash-as-nested-documents/217179 "2020-02-04T07:23:33Z")
Hi All i am new to elasticsearch i am trying to index data from MSSQL server to elasticsearch using logstash as nested documents i am having some issues while creating a topic so i have created the issue in stack overflo… [Previous page](https://discuss.elastic.co/top.md?page=872&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=874&per_page=50&period=all)