# Top **URL:** https://discuss.elastic.co/top.md?page=885&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 886 --- ## [Search for String Literal in KQL](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482 "2021-01-07T20:04:21Z")
How do I search for a literal string value? Current example query: Subject : "\[External Sender\] Test" Brings back what I'm looking for, but also the following: \[External Sender\] test-results.pdf \[External Sender\] Te… --- ## [Include only error](https://discuss.elastic.co/t/include-only-error/221282)
**Author:** [@armani\_ani](https://discuss.elastic.co/u/armani_ani)\ **Replies:** 5\ **Last updated:** [March 4, 2020, 7:21am UTC](https://discuss.elastic.co/t/include-only-error/221282 "2020-03-04T07:21:25Z")
Hi , I am using filebeat 7.6 with the below filebeat config logging.level: error filebeat.inputs: type: syslog protocol.tcp.host: "localhost:5000" include\_lines: \['error'\] I would like for example to include only… --- ## [Logstash fingerprint 7.1](https://discuss.elastic.co/t/logstash-fingerprint-7-1/184598)
**Author:** [@pgervais](https://discuss.elastic.co/u/pgervais)\ **Replies:** 5\ **Last updated:** [June 6, 2019, 4:48pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-7-1/184598 "2019-06-06T16:48:31Z")
I want to ensure that the document id are based on the input source. For this i'm using the fingerprint filter in logstash. In previous version i've used it as follows fingerprint { source =\> "message" target =\> "\[@m… --- ## [Connection time out for indexing request - ES 1.0.2](https://discuss.elastic.co/t/connection-time-out-for-indexing-request-es-1-0-2/78485)
**Author:** [@bneelima84](https://discuss.elastic.co/u/bneelima84)\ **Replies:** 5\ **Last updated:** [March 22, 2017, 6:05am UTC](https://discuss.elastic.co/t/connection-time-out-for-indexing-request-es-1-0-2/78485 "2017-03-22T06:05:59Z")
We are facing timeouts while trying to add a document to the index intermittently. We are using elasticsearch 1.0.2 in embedded mode; 2 nodes are configured as data nodes. Any ideas on what could cause connection timeo… --- ## [Kibana docker trying to connect to default ( ignoring env ELASTICSEARCH\_URL )](https://discuss.elastic.co/t/kibana-docker-trying-to-connect-to-default-ignoring-env-elasticsearch-url/185469)
**Author:** [@Merril](https://discuss.elastic.co/u/Merril)\ **Replies:** 2\ **Last updated:** [June 13, 2019, 8:21am UTC](https://discuss.elastic.co/t/kibana-docker-trying-to-connect-to-default-ignoring-env-elasticsearch-url/185469 "2019-06-13T08:21:49Z")
I am desperately trying to connect a docker Kibana instance to my AWS ES. When I try to provide and environment variable in docker-compose with the elasticsearch\_url but docker defaults to the url provided with the image… --- ## [Bootstrap checks failed in es 6.4](https://discuss.elastic.co/t/bootstrap-checks-failed-in-es-6-4/146498)
**Author:** [@amit.patra](https://discuss.elastic.co/u/amit.patra)\ **Replies:** 2\ **Last updated:** [August 29, 2018, 11:32am UTC](https://discuss.elastic.co/t/bootstrap-checks-failed-in-es-6-4/146498 "2018-08-29T11:32:15Z")
Hi, We have upgraded es 5.5 to 6.4 according to https://www.elastic.co/guide/en/elasticsearch/reference/current/restart-upgrade.html But after upgrade below error is there : \[2018-08-29T14:42:44,446\]\[ERROR\]\[o.e.b.B… --- ## [\[Solved\] List of logstash grok data types](https://discuss.elastic.co/t/solved-list-of-logstash-grok-data-types/43355)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 2\ **Last updated:** [March 3, 2016, 9:47am UTC](https://discuss.elastic.co/t/solved-list-of-logstash-grok-data-types/43355 "2016-03-03T09:47:55Z")
Hello, I there anywhere some list of basic types usable by grok like %{NUMBER:number:int} I should be part of grok documentation but is not there! With thanks and wishes of great day AM --- ## [Avaya IP Office 500 R11 SMDR -\> Logstash](https://discuss.elastic.co/t/avaya-ip-office-500-r11-smdr-logstash/215340)
**Author:** [@Adrien\_Carlyle](https://discuss.elastic.co/u/Adrien_Carlyle)\ **Replies:** 3\ **Last updated:** [January 28, 2020, 11:09pm UTC](https://discuss.elastic.co/t/avaya-ip-office-500-r11-smdr-logstash/215340 "2020-01-28T23:09:03Z")
Just wanted to share my configuration with the community after refining it for the better part of a week. Being new to the ELK stack it took a bit of time to understand how to get tcp flows into the platform. There was… --- ## [Rolling restart possible when root certificate changed?](https://discuss.elastic.co/t/rolling-restart-possible-when-root-certificate-changed/97530)
**Author:** [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\ **Replies:** 3\ **Last updated:** [August 26, 2017, 4:01am UTC](https://discuss.elastic.co/t/rolling-restart-possible-when-root-certificate-changed/97530 "2017-08-26T04:01:17Z")
We are currently evaluating x-pack security and there is an open question where i cannot find any answer: For transport TLS we need to change the root certificate from time to time but we have to avoid a full cluster re… --- ## [Index-Switch](https://discuss.elastic.co/t/index-switch/156683)
**Author:** [@Animesh\_singh](https://discuss.elastic.co/u/Animesh_singh)\ **Replies:** 8\ **Last updated:** [November 16, 2018, 7:29am UTC](https://discuss.elastic.co/t/index-switch/156683 "2018-11-16T07:29:17Z")
Can anyone help me with switching of indexes with reindexing old one without loosing new data that is indexed on old index during the time of reindexing . --- ## [Accessing \_score in the filter of aggregations](https://discuss.elastic.co/t/accessing-score-in-the-filter-of-aggregations/166877)
**Author:** [@eddig](https://discuss.elastic.co/u/eddig)\ **Replies:** 3\ **Last updated:** [February 22, 2019, 7:11am UTC](https://discuss.elastic.co/t/accessing-score-in-the-filter-of-aggregations/166877 "2019-02-22T07:11:34Z")
There is an unexpected situation in how the filter aggregation works with the \_score of a document. It seems that the \_score is not accessible in the script inside of filter aggregation but in the same time, ES doesn't p… --- ## [Logstash error when dictionary(CSV) has \\r or \\n at end of line](https://discuss.elastic.co/t/logstash-error-when-dictionary-csv-has-r-or-n-at-end-of-line/131703)
**Author:** [@Toni\_Riera](https://discuss.elastic.co/u/Toni_Riera)\ **Replies:** 3\ **Last updated:** [May 16, 2018, 8:25am UTC](https://discuss.elastic.co/t/logstash-error-when-dictionary-csv-has-r-or-n-at-end-of-line/131703 "2018-05-16T08:25:50Z")
Hello there, I'm developing a .conf related to security analysis with ELK Stack, and saw the article that Blueliv made on January '18. What i'm trying to do is load a csv file wich will serve as a dictionary to match ma… --- ## [Indexing problem when missing milliseconds for strict\_date\_time field](https://discuss.elastic.co/t/indexing-problem-when-missing-milliseconds-for-strict-date-time-field/51028)
**Author:** [@pdevalck](https://discuss.elastic.co/u/pdevalck)\ **Replies:** 3\ **Last updated:** [May 28, 2016, 12:55am UTC](https://discuss.elastic.co/t/indexing-problem-when-missing-milliseconds-for-strict-date-time-field/51028 "2016-05-28T00:55:34Z")
We have a problem with Elasticsearch 2.3.2. When indexing a document that contains a Java Instant date with zero milliseconds (eg. Instant.now().truncatedTo(ChronoUnit.SECONDS) ) using the DateTimeFormatter.ISO\_INSTANT… --- ## [Many Conditional Checks in Logstash Conf](https://discuss.elastic.co/t/many-conditional-checks-in-logstash-conf/183934)
**Author:** [@sjabiulla](https://discuss.elastic.co/u/sjabiulla)\ **Replies:** 6\ **Last updated:** [June 11, 2019, 3:50pm UTC](https://discuss.elastic.co/t/many-conditional-checks-in-logstash-conf/183934 "2019-06-11T15:50:06Z")
Hi, Will it be a performance impact If I have many conditional statements in Logstash config ? My idea was to create a single Logstash setup whose input is FileBeat, WinLogBeat and HeartBeat. Based on the beat type an… --- ## [Monitor beat's publisher request to Elastic Search](https://discuss.elastic.co/t/monitor-beats-publisher-request-to-elastic-search/42220)
**Author:** [@rvlander](https://discuss.elastic.co/u/rvlander)\ **Replies:** 6\ **Last updated:** [February 21, 2016, 5:08pm UTC](https://discuss.elastic.co/t/monitor-beats-publisher-request-to-elastic-search/42220 "2016-02-21T17:08:57Z")
Hi, I am writing a new beat for a corporate service. I have generated the index template, added it to ElasticSearch. I have my beat running publishing event, everything seem to be ok with no error in debug level lo… --- ## [Unable to process multiple logs](https://discuss.elastic.co/t/unable-to-process-multiple-logs/38577)
**Author:** [@hw96](https://discuss.elastic.co/u/hw96)\ **Replies:** 6\ **Last updated:** [January 7, 2016, 10:31am UTC](https://discuss.elastic.co/t/unable-to-process-multiple-logs/38577 "2016-01-07T10:31:43Z")
Hi, I'm relatively new to Filebeat in general and I'm currently facing the problem of being unable to process multiple logs under a single "paths" segment. In my case, only the first log is processed whereas the rest are… --- ## [Can't rename index](https://discuss.elastic.co/t/cant-rename-index/229448)
**Author:** [@My\_Google\_Account](https://discuss.elastic.co/u/My_Google_Account)\ **Replies:** 5\ **Last updated:** [May 10, 2020, 3:39pm UTC](https://discuss.elastic.co/t/cant-rename-index/229448 "2020-05-10T15:39:08Z")
Good day! i using elasticsearch & kibana & filebeat agent latest versions, and i can't setup index name, every time the index call "filebeat-7.6.2" and i don't understand why... i tried setup my agent from the documentat… --- ## [Is there any plugin in kibana for creating sequence diagram/flow diagram?](https://discuss.elastic.co/t/is-there-any-plugin-in-kibana-for-creating-sequence-diagram-flow-diagram/126522)
**Author:** [@garima](https://discuss.elastic.co/u/garima)\ **Replies:** 1\ **Last updated:** [April 4, 2018, 12:35am UTC](https://discuss.elastic.co/t/is-there-any-plugin-in-kibana-for-creating-sequence-diagram-flow-diagram/126522 "2018-04-04T00:35:56Z")
I have a query regarding Kibana, is there any method or plugin in kibana to create sequence/flow diagram by analyzing the logs. --- ## [Logstash: Output fails](https://discuss.elastic.co/t/logstash-output-fails/143818)
**Author:** [@jogoinar10](https://discuss.elastic.co/u/jogoinar10)\ **Replies:** 7\ **Last updated:** [August 10, 2018, 11:26am UTC](https://discuss.elastic.co/t/logstash-output-fails/143818 "2018-08-10T11:26:41Z")
I have two output, kafka and elasticsearch. I want to have a fail safe with my setup. If one of them stops, the other one can still index a data. I tried to stop my elasticsearch while the kafka is still running and I … --- ## [Filebeat input not showing in elastic indices & Kibana](https://discuss.elastic.co/t/filebeat-input-not-showing-in-elastic-indices-kibana/119715)
**Author:** [@anujitbhu](https://discuss.elastic.co/u/anujitbhu)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 3:57am UTC](https://discuss.elastic.co/t/filebeat-input-not-showing-in-elastic-indices-kibana/119715 "2018-02-14T03:57:23Z")
Hi I have got a server installed with ELK kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2018-02-14 06:48:43 IST;… --- ## [Bulk Partial update of a Nested object List by condition](https://discuss.elastic.co/t/bulk-partial-update-of-a-nested-object-list-by-condition/308948)
**Author:** [@krishnapss](https://discuss.elastic.co/u/krishnapss)\ **Replies:** 2\ **Last updated:** [July 8, 2022, 7:28am UTC](https://discuss.elastic.co/t/bulk-partial-update-of-a-nested-object-list-by-condition/308948 "2022-07-08T07:28:08Z")
Hi, I have an index which has nested list object. I need to only update certain values based on a condition. List of history with dates and values I need to update only certain dates values. In the below example I only … --- ## [Failed to initialize http input channel](https://discuss.elastic.co/t/failed-to-initialize-http-input-channel/144416)
**Author:** [@meetdave2611997](https://discuss.elastic.co/u/meetdave2611997)\ **Replies:** 2\ **Last updated:** [August 15, 2018, 12:35pm UTC](https://discuss.elastic.co/t/failed-to-initialize-http-input-channel/144416 "2018-08-15T12:35:04Z")
Hi, We keep seeing this error in log files of logstash nodes when we start logstash with http input. \[2018-08-14T22:03:50,292\]\[WARN \]\[io.netty.channel.ChannelInitializer\] Failed to initialize a channel. Closing: \[id: 0… --- ## [ERROR logstash.agent - Cannot load an invalid configuration](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441)
**Author:** [@teejayuu](https://discuss.elastic.co/u/teejayuu)\ **Replies:** 2\ **Last updated:** [May 19, 2017, 3:34pm UTC](https://discuss.elastic.co/t/error-logstash-agent-cannot-load-an-invalid-configuration/86441 "2017-05-19T15:34:11Z")
Hi ELK installed on Windows 2012 R2 and trying to capture Exchange message tracking. Everything is in D:\\ELK and have ELK 5.3.2. Running the command: D:\\ELK\\logstash-5.3.2\\bin\\logstash -f D:\\ELK\\logstash-5.3.2\\01-in… --- ## [Visualization show date format have day of week in Kibana](https://discuss.elastic.co/t/visualization-show-date-format-have-day-of-week-in-kibana/257301)
**Author:** [@thuhaa](https://discuss.elastic.co/u/thuhaa)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 7:22am UTC](https://discuss.elastic.co/t/visualization-show-date-format-have-day-of-week-in-kibana/257301 "2020-12-04T07:22:33Z")
My index have date time type attribute. I want to create visualize use date histogram aggregation with interval days. It will be show date format like 2020-12-02. But I want to date show format have day of week like 2020… --- ## [Connect Kibana Workplace Search](https://discuss.elastic.co/t/connect-kibana-workplace-search/253601)
**Author:** [@JorgeL-TI](https://discuss.elastic.co/u/JorgeL-TI)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 10:18pm UTC](https://discuss.elastic.co/t/connect-kibana-workplace-search/253601 "2020-11-11T22:18:16Z")
Hello, I have discovered the option that connects Kibana and workplace, but I do not how to configure it. I added this line enterpriseSearch.host: 'http://localhost:3002' in the kibana´s YAML like this link says but it… --- ## [Failed to parse error for certain records](https://discuss.elastic.co/t/failed-to-parse-error-for-certain-records/184784)
**Author:** [@bkasrai](https://discuss.elastic.co/u/bkasrai)\ **Replies:** 4\ **Last updated:** [June 11, 2019, 4:29pm UTC](https://discuss.elastic.co/t/failed-to-parse-error-for-certain-records/184784 "2019-06-11T16:29:10Z")
Good morning all, I am ingesting some logs and while specific records make it over, I am seeing errors in the logs and they are not making it over to Kibana outside of your standard fields (doc\_id, index, time, etc) I ha… --- ## [Machine Learning](https://discuss.elastic.co/t/machine-learning/107654)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 4\ **Last updated:** [November 15, 2017, 7:26pm UTC](https://discuss.elastic.co/t/machine-learning/107654 "2017-11-15T19:26:07Z")
In the 'Analyzing Script Attacks' lesson the the teacher adds keyword to by\_field\_name and over\_field\_name, where can I read more about this? Also, keep getting this error Save failed: \[status\_exception\] This job wou… --- ## [Kibana/iframe for dashboard: disable interactivity](https://discuss.elastic.co/t/kibana-iframe-for-dashboard-disable-interactivity/53886)
**Author:** [@sen](https://discuss.elastic.co/u/sen)\ **Replies:** 4\ **Last updated:** [June 28, 2016, 8:26am UTC](https://discuss.elastic.co/t/kibana-iframe-for-dashboard-disable-interactivity/53886 "2016-06-28T08:26:16Z")
Hellow everyone, I know I can export my dashboard thanks to the iframe link and to add to my web page. However, it is still possible through my web page to modify my dashboard. I would like to know if there is a parame… --- ## [Elasticsearch 7.16 use S3-compatible API setting return Failed to connect to service endpoint](https://discuss.elastic.co/t/elasticsearch-7-16-use-s3-compatible-api-setting-return-failed-to-connect-to-service-endpoint/303208)
**Author:** [@forget6](https://discuss.elastic.co/u/forget6)\ **Replies:** 5\ **Last updated:** [April 26, 2022, 9:32am UTC](https://discuss.elastic.co/t/elasticsearch-7-16-use-s3-compatible-api-setting-return-failed-to-connect-to-service-endpoint/303208 "2022-04-26T09:32:20Z")
elasticsearch version: 7.16.2 s3 setting: elasticsearch.yml s3.client.default.endpoint: ${our own s3} bin/elasticsearch-keystore list keystore.seed s3.client.default.access\_key s3.client.default.secret\_key =========… --- ## [Keyword field update with existing value](https://discuss.elastic.co/t/keyword-field-update-with-existing-value/261522)
**Author:** [@rajaraman](https://discuss.elastic.co/u/rajaraman)\ **Replies:** 5\ **Last updated:** [January 21, 2021, 11:29am UTC](https://discuss.elastic.co/t/keyword-field-update-with-existing-value/261522 "2021-01-21T11:29:53Z")
Hi, is it possible to update value in TEAM (keyword field) with existing value in the form ("NETWORK TEAM","DBA TEAM") when, i update , it updates as whole text.("NETWORK TEAM,DBA TEAM") please, help --- ## [KIBANA 7.6.0 - FATAL TypeError: Cannot read property 'length' of undefined](https://discuss.elastic.co/t/kibana-7-6-0-fatal-typeerror-cannot-read-property-length-of-undefined/220910)
**Author:** [@jessicalh](https://discuss.elastic.co/u/jessicalh)\ **Replies:** 5\ **Last updated:** [March 12, 2020, 7:52pm UTC](https://discuss.elastic.co/t/kibana-7-6-0-fatal-typeerror-cannot-read-property-length-of-undefined/220910 "2020-03-12T19:52:23Z")
Kibana version: 7.6.0 Elasticsearch version: 7.6.0 Server OS version: Centos 7 Original install method (e.g. download page, yum, from source, etc.): YUM Describe the bug: After the elk update from version 7.5 to… --- ## [Need help with update operations in elastic search](https://discuss.elastic.co/t/need-help-with-update-operations-in-elastic-search/122972)
**Author:** [@udit.agg89](https://discuss.elastic.co/u/udit.agg89)\ **Replies:** 5\ **Last updated:** [March 8, 2018, 1:21am UTC](https://discuss.elastic.co/t/need-help-with-update-operations-in-elastic-search/122972 "2018-03-08T01:21:54Z")
In the below given use case, I want to update the name field and change its value to “My name is Mathews Fox” "\_index": "log", "\_type": "info log", "\_id": "7715ed0b-853e-4d28-b2e3-99156d6dcb3a", "\_score": 5.93148, "… --- ## [Trigger Logstash JDBC Plugin](https://discuss.elastic.co/t/trigger-logstash-jdbc-plugin/111913)
**Author:** [@Sahul\_Hameed\_B](https://discuss.elastic.co/u/Sahul_Hameed_B)\ **Replies:** 5\ **Last updated:** [December 15, 2017, 10:28am UTC](https://discuss.elastic.co/t/trigger-logstash-jdbc-plugin/111913 "2017-12-15T10:28:27Z")
Once the new record is updated or insterted, i need to call this command logstash -f JDBCConnector.conf --debug again. Other than schedule command. is it possible to do that?? --- ## [How to give multiple files in different paths as input to logstash](https://discuss.elastic.co/t/how-to-give-multiple-files-in-different-paths-as-input-to-logstash/228094)
**Author:** [@poddraj](https://discuss.elastic.co/u/poddraj)\ **Replies:** 1\ **Last updated:** [April 15, 2020, 2:35pm UTC](https://discuss.elastic.co/t/how-to-give-multiple-files-in-different-paths-as-input-to-logstash/228094 "2020-04-15T14:35:28Z")
Hi All, I have a scenario where two log files are in different directory paths but the log structure of them is same. I want to pass both of them as input files in a single config file so that the filter in it will pars… --- ## [Elasticsearch Cluster Sizing](https://discuss.elastic.co/t/elasticsearch-cluster-sizing/329703)
**Author:** [@Darshan\_J](https://discuss.elastic.co/u/Darshan_J)\ **Replies:** 4\ **Last updated:** [April 11, 2023, 9:57am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-sizing/329703 "2023-04-11T09:57:00Z")
The webinar above showcases bunch of formulas for Elasticsearch cluster sizing. There are discussions where responses show unfamiliarity with the formulas or techniques given in the webinar. The discussion also follows… --- ## [Plugin Logstash-codec-nmap updated 3/17/17](https://discuss.elastic.co/t/plugin-logstash-codec-nmap-updated-3-17-17/79082)
**Author:** [@Dark\_Light](https://discuss.elastic.co/u/Dark_Light)\ **Replies:** 4\ **Last updated:** [March 28, 2017, 4:24pm UTC](https://discuss.elastic.co/t/plugin-logstash-codec-nmap-updated-3-17-17/79082 "2017-03-28T16:24:26Z")
The Logstash-codec-nmap plugin was updated and merged with master this morning. It does not appear that when installing using the logstash plugin manager that the update is available to logstash as the install still fa… --- ## [How to tell the state of an IIS app pool via the IIS metrics from Metricbeat](https://discuss.elastic.co/t/how-to-tell-the-state-of-an-iis-app-pool-via-the-iis-metrics-from-metricbeat/294171)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 6\ **Last updated:** [February 8, 2022, 8:15pm UTC](https://discuss.elastic.co/t/how-to-tell-the-state-of-an-iis-app-pool-via-the-iis-metrics-from-metricbeat/294171 "2022-02-08T20:15:19Z")
Hi All, I'm trying to determine the state of an IIS app pool (running/stopped/disabled/etc...) that is monitor by Metricbeat. However, it doesn't appear that Metricbeat includes the state of the app pool in its metric … --- ## [Configuration if \[path\] =~ "access" not working](https://discuss.elastic.co/t/configuration-if-path-access-not-working/197570)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [September 5, 2019, 12:59pm UTC](https://discuss.elastic.co/t/configuration-if-path-access-not-working/197570 "2019-09-05T12:59:44Z")
Hi Team, I am trying to filter apache logs messages, but its always goes to random\_logs than the apache\_access or apache\_error. When i tried to run as adhoc its parsing properly. # Logstash configuration # Beats -\> Log… --- ## [How to update the state/props of a custom visualisation component after the initial render?](https://discuss.elastic.co/t/how-to-update-the-state-props-of-a-custom-visualisation-component-after-the-initial-render/181242)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 6\ **Last updated:** [June 6, 2019, 1:35pm UTC](https://discuss.elastic.co/t/how-to-update-the-state-props-of-a-custom-visualisation-component-after-the-initial-render/181242 "2019-06-06T13:35:43Z")
I have been trying to create a custom visulaisation for Kibana 6.5.4. I have written a custom component, request and response handler. I get the data for my visualisation from the props.visData attribute. However this da… --- ## [Centos 7 / rsyslog / logstash 6.3.0 - on logstash output always severity code 5 and facility code 1 (2)](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265)
**Author:** [@pge](https://discuss.elastic.co/u/pge)\ **Replies:** 6\ **Last updated:** [July 30, 2018, 10:06am UTC](https://discuss.elastic.co/t/centos-7-rsyslog-logstash-6-3-0-on-logstash-output-always-severity-code-5-and-facility-code-1-2/140265 "2018-07-30T10:06:25Z")
Update from previous post: logstash output: always severity code 5 and facility code 1 After some researches I found one interesting discussion about rsyslog and logstash v.5: Support RFC5424 message format Just for … --- ## [Highlighting on \`match\_phrase\` with \`index\_phrases\` enabled does not seem to work](https://discuss.elastic.co/t/highlighting-on-match-phrase-with-index-phrases-enabled-does-not-seem-to-work/171552)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 0\ **Last updated:** [March 8, 2019, 8:14pm UTC](https://discuss.elastic.co/t/highlighting-on-match-phrase-with-index-phrases-enabled-does-not-seem-to-work/171552 "2019-03-08T20:14:13Z")
I'm experimenting with the index\_phrases functionality introduced in 6.4.0. When I use a match\_phrase query and try to highlight the result, no highlights are returned. If I use match, I get highlights. Example: DELETE … --- ## [How to install watcher on elasticsearch 7.1.1](https://discuss.elastic.co/t/how-to-install-watcher-on-elasticsearch-7-1-1/186965)
**Author:** [@proxx](https://discuss.elastic.co/u/proxx)\ **Replies:** 2\ **Last updated:** [June 22, 2019, 7:18pm UTC](https://discuss.elastic.co/t/how-to-install-watcher-on-elasticsearch-7-1-1/186965 "2019-06-22T19:18:52Z")
Guys i need help here, i have elasticseach,kibana and logstash setup And i need to setup my alerting and reporting plugin, so i came across watcher but i'm getting this error when installing --- ## [Reconciler error: auth secret key default-quickstart-kibana-user doesn't exist](https://discuss.elastic.co/t/reconciler-error-auth-secret-key-default-quickstart-kibana-user-doesnt-exist/307136)
**Author:** [@oliverrahner](https://discuss.elastic.co/u/oliverrahner)\ **Replies:** 7\ **Last updated:** [June 15, 2022, 2:07pm UTC](https://discuss.elastic.co/t/reconciler-error-auth-secret-key-default-quickstart-kibana-user-doesnt-exist/307136 "2022-06-15T14:07:40Z")
I am currently upgrading my sandbox ECK installation from 7.14.0 to 8.2.2, via 7.17, as required. I managed to finish this for Elasticsearch, but during the 7.14 -\> 7.17 step for Kibana, I stumbled across an issue. The… --- ## [Is there a procedure on integrating wazuh with ldap?](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632)
**Author:** [@nour.megahed](https://discuss.elastic.co/u/nour.megahed)\ **Replies:** 1\ **Last updated:** [November 26, 2021, 6:22pm UTC](https://discuss.elastic.co/t/is-there-a-procedure-on-integrating-wazuh-with-ldap/289632 "2021-11-26T18:22:23Z")
is there a procedure on integrating wazuh with ldap? --- ## [ELK - single node vs multinode](https://discuss.elastic.co/t/elk-single-node-vs-multinode/229567)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 1\ **Last updated:** [April 24, 2020, 3:59am UTC](https://discuss.elastic.co/t/elk-single-node-vs-multinode/229567 "2020-04-24T03:59:52Z")
Hi , I am currently using single node ELK cluster for monitoring capability . I would like understand what's the pros and cons of single node vs multi node cluster ? Thanks, --- ## [Logstash bulk request](https://discuss.elastic.co/t/logstash-bulk-request/91049)
**Author:** [@sharongur](https://discuss.elastic.co/u/sharongur)\ **Replies:** 1\ **Last updated:** [June 28, 2017, 7:07am UTC](https://discuss.elastic.co/t/logstash-bulk-request/91049 "2017-06-28T07:07:52Z")
Hi, I understand that Logstash sends to ES bulk requests and manages it. My question is, is there a way to send bulks TO Logstash? At the moment im sending only single requests, which can turn to be thousands of requ… --- ## [Changing ip address of our elasticsearch server](https://discuss.elastic.co/t/changing-ip-address-of-our-elasticsearch-server/75380)
**Author:** [@tonyb61](https://discuss.elastic.co/u/tonyb61)\ **Replies:** 1\ **Last updated:** [February 16, 2017, 9:50pm UTC](https://discuss.elastic.co/t/changing-ip-address-of-our-elasticsearch-server/75380 "2017-02-16T21:50:14Z")
HI we are running elasticsearch on a windows server machine. I have recently changed the ip address of the server, and now I'm getting lots of messages in the log file containing lines such as org.elasticsearch.transport… --- ## [Using median (percetiles 50) in timelion](https://discuss.elastic.co/t/using-median-percetiles-50-in-timelion/64915)
**Author:** [@acs](https://discuss.elastic.co/u/acs)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 5:15pm UTC](https://discuss.elastic.co/t/using-median-percetiles-50-in-timelion/64915 "2016-11-03T17:15:59Z")
For getting the metric average time series in timelion, it is pretty easy: .es(metric='avg:time\_to\_close\_days') which is equivalent to: "aggs": { "1": { "avg": { "field": "time\_to\_clo… --- ## [Kibana reports Shard Failures from external links](https://discuss.elastic.co/t/kibana-reports-shard-failures-from-external-links/43384)
**Author:** [@jsps](https://discuss.elastic.co/u/jsps)\ **Replies:** 7\ **Last updated:** [March 3, 2016, 5:10pm UTC](https://discuss.elastic.co/t/kibana-reports-shard-failures-from-external-links/43384 "2016-03-03T17:10:42Z")
Version 4.3.1. Build 9517 I'm creating a link to kibana in a web app, when I click on the link invariably I get a weird "Shard Failure" error message with templates placeholders, which then refreshes to show the actua… --- ## [Converting String to Geo Point](https://discuss.elastic.co/t/converting-string-to-geo-point/42422)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 6:59pm UTC](https://discuss.elastic.co/t/converting-string-to-geo-point/42422 "2016-02-22T18:59:52Z")
Hi All, I was able to get my data imported from JDBC into Elasticsearch and can query using Kibana. However, the geo data is being imported as a string. Please could I get some help in converting it. Below is a snap… [Previous page](https://discuss.elastic.co/top.md?page=884&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=886&per_page=50&period=all)