# Top **URL:** https://discuss.elastic.co/top.md?page=891&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 892 --- ## [Fortigate Integrations](https://discuss.elastic.co/t/fortigate-integrations/366211)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 8\ **Last updated:** [September 12, 2024, 6:36pm UTC](https://discuss.elastic.co/t/fortigate-integrations/366211 "2024-09-12T18:36:51Z")
Hi there, I'm a beginner with Elastic and I'm trying to add the "Fortinet FortiGate Firewall Logs" integration to my Elastic setup. I have configured my firewall to send syslog messages to UDP port 9004 on host 192.168.… --- ## [How to control the "\_indexed\_chars" value on a Ingest Attachment pipeline?](https://discuss.elastic.co/t/how-to-control-the-indexed-chars-value-on-a-ingest-attachment-pipeline/123073)
**Author:** [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\ **Replies:** 8\ **Last updated:** [March 15, 2018, 11:40am UTC](https://discuss.elastic.co/t/how-to-control-the-indexed-chars-value-on-a-ingest-attachment-pipeline/123073 "2018-03-15T11:40:18Z")
Hi, I created a pipeline to ingest office/pdf files using the Ingest Attachment pipeline without defining a value for "indexed\_chars" (so I guess that the default value of 100k chars is used). PUT \_ingest/pipeline/atta… --- ## [Parse PostgreSQL CSV log](https://discuss.elastic.co/t/parse-postgresql-csv-log/259688)
**Author:** [@azlev](https://discuss.elastic.co/u/azlev)\ **Replies:** 3\ **Last updated:** [December 27, 2020, 5:52pm UTC](https://discuss.elastic.co/t/parse-postgresql-csv-log/259688 "2020-12-27T17:52:33Z")
Hello. At work we are consuming the PostgreSQL CSV log instead of plain log. This poses some advantages, like a better formatted input file, stable format, and easy to turn it on. To achieve it, we are using the filebe… --- ## [Conditional index + pipeline in output?](https://discuss.elastic.co/t/conditional-index-pipeline-in-output/138163)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 3\ **Last updated:** [July 3, 2018, 9:12am UTC](https://discuss.elastic.co/t/conditional-index-pipeline-in-output/138163 "2018-07-03T09:12:52Z")
I noticed here that you can do conditional selection of indices in the output. I was trying to carry that over to also use a specific pipeline when sending to that index as well. Here's what I have; output.elasticsearc… --- ## [Visual Builder - time range for count?](https://discuss.elastic.co/t/visual-builder-time-range-for-count/100858)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [September 19, 2017, 8:38am UTC](https://discuss.elastic.co/t/visual-builder-time-range-for-count/100858 "2017-09-19T08:38:29Z")
Hi, I have created in Visual Builder chart. I just want count all events in my selected time range. My time range is last 5 minutes. But when I change chart from Time series to Metric, it doesn't shows count of all value… --- ## [Как получить получить ранжирование значениея поля по уникальным записям](https://discuss.elastic.co/t/topic/39395)
**Author:** [@rero](https://discuss.elastic.co/u/rero)\ **Replies:** 3\ **Last updated:** [January 18, 2016, 5:02pm UTC](https://discuss.elastic.co/t/topic/39395 "2016-01-18T17:02:04Z")
Индекс содержит записи о прыжках спортсменов. Попыток у одного спортсмена может быть множество. Структура документа: { 'event\_at' : '2015-01-01T12:12:10', - дата прыжка 'user\_id' : 2142, - id спортсмена 'dis… --- ## [Authenticate Elasticsearch from spring boot](https://discuss.elastic.co/t/authenticate-elasticsearch-from-spring-boot/226196)
**Author:** [@AshishUser](https://discuss.elastic.co/u/AshishUser)\ **Replies:** 1\ **Last updated:** [April 2, 2020, 1:00pm UTC](https://discuss.elastic.co/t/authenticate-elasticsearch-from-spring-boot/226196 "2020-04-02T13:00:58Z")
I have setup open distro version 1.4, ES version 7.4 with LDAP authentication and authorization and it is working perfectly fine. Kibana/logstash able to connect to my elasticsearch using ldap service account (which has… --- ## [Get Hardware Stats like CPU utilization , Disk Uage For Windows & Linux](https://discuss.elastic.co/t/get-hardware-stats-like-cpu-utilization-disk-uage-for-windows-linux/28432)
**Author:** [@rameeelastic](https://discuss.elastic.co/u/rameeelastic)\ **Replies:** 1\ **Last updated:** [September 1, 2015, 6:09pm UTC](https://discuss.elastic.co/t/get-hardware-stats-like-cpu-utilization-disk-uage-for-windows-linux/28432 "2015-09-01T18:09:44Z")
Hi All I am using ELK stack for couple of months now and the primary Input so far I have is the WebServer logs and ATG logs from Apache and IIS server. Using the logs I have been able to do all possible visualizations … --- ## [How to avoid warning when starting with discovery.type set to single node](https://discuss.elastic.co/t/how-to-avoid-warning-when-starting-with-discovery-type-set-to-single-node/334087)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 4\ **Last updated:** [June 15, 2023, 1:55pm UTC](https://discuss.elastic.co/t/how-to-avoid-warning-when-starting-with-discovery-type-set-to-single-node/334087 "2023-06-15T13:55:02Z")
Hello; I have upgraded a single-node Elasticsearch from version 7.17 to 8.7. When the node starts up it logs this warning: \[WARN \]\[o.e.c.c.ClusterBootstrapService\] \[elasticsearch\] this node is locked into cluster UUID … --- ## [Kibana is helpful but interface is very horrible](https://discuss.elastic.co/t/kibana-is-helpful-but-interface-is-very-horrible/281117)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 4\ **Last updated:** [August 12, 2021, 2:30pm UTC](https://discuss.elastic.co/t/kibana-is-helpful-but-interface-is-very-horrible/281117 "2021-08-12T14:30:20Z")
Hello, I've been using Kibana for months but something that really irritates me is the value limit for Lens. Dashboard lens is super intuitive and I love it but its very disappointing to see how the value limit is only … --- ## [Acces to elastic cloud for managing deployments with multiple accounts](https://discuss.elastic.co/t/acces-to-elastic-cloud-for-managing-deployments-with-multiple-accounts/245204)
**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\ **Replies:** 4\ **Last updated:** [August 17, 2020, 9:20am UTC](https://discuss.elastic.co/t/acces-to-elastic-cloud-for-managing-deployments-with-multiple-accounts/245204 "2020-08-17T09:20:00Z")
Dear community, Right now we have 2 cloud environments at Elastic (T and P). To manage these deployments we can now only have one account to login and manage these deployments. Is it possible to create more accounts wit… --- ## [Kibana did not load properly in iframe (Spring MVC)](https://discuss.elastic.co/t/kibana-did-not-load-properly-in-iframe-spring-mvc/87527)
**Author:** [@Sylfaen](https://discuss.elastic.co/u/Sylfaen)\ **Replies:** 4\ **Last updated:** [June 2, 2017, 8:37am UTC](https://discuss.elastic.co/t/kibana-did-not-load-properly-in-iframe-spring-mvc/87527 "2017-06-02T08:37:18Z")
Hey, I'm adding dashboards from Kibana in my website but I have a constraint : the end user doesn't have to get access to the Kibana platform! In order to deny this access, I retrieve the iframe server side by creating … --- ## [DummyQueryParserPlugin doesn't compile out of package](https://discuss.elastic.co/t/dummyqueryparserplugin-doesnt-compile-out-of-package/70171)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Replies:** 1\ **Last updated:** [December 29, 2016, 12:22am UTC](https://discuss.elastic.co/t/dummyqueryparserplugin-doesnt-compile-out-of-package/70171 "2016-12-29T00:22:08Z")
I've been working on a custom query / custom query builder. As a starting point, I copy/pasted DummyQueryBuilder and DummyQueryParserPlugin out of Elasticsearch's source and into my package. I've only changed the package… --- ## [How can i insert multiple records through 1 querry in elasticsearch](https://discuss.elastic.co/t/how-can-i-insert-multiple-records-through-1-querry-in-elasticsearch/321615)
**Author:** [@Ali5](https://discuss.elastic.co/u/Ali5)\ **Replies:** 2\ **Last updated:** [December 21, 2022, 6:20pm UTC](https://discuss.elastic.co/t/how-can-i-insert-multiple-records-through-1-querry-in-elasticsearch/321615 "2022-12-21T18:20:23Z")
my index name is "products" that have fields of name,description,id,price it has 40 records i want to create automatically add 1000 records in it can anyone help i am new to it --- ## [Escape backslash logstash configuration](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 4:06pm UTC](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855 "2020-09-16T16:06:12Z")
Hi, I'm experiencing some troubles trying to split a string using backslash with the split plugin. XXX\\YYY I'd like to use split =\> \["field","\\"\] Quickly ran into escape problems as expected, according to the documen… --- ## [Timeout on metricbeat setup](https://discuss.elastic.co/t/timeout-on-metricbeat-setup/174018)
**Author:** [@ricwhitney](https://discuss.elastic.co/u/ricwhitney)\ **Replies:** 2\ **Last updated:** [March 27, 2019, 2:58pm UTC](https://discuss.elastic.co/t/timeout-on-metricbeat-setup/174018 "2019-03-27T14:58:58Z")
I know I'm missing some setup of elasticsearch or something like that but can't find it in Kibana pages Here is the output of :# metricbeat setup Exiting: Couldn't connect to any of the configured Elasticsearch hosts.… --- ## [Set "ssl" parameter for jdbc input plugin](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin/91676)
**Author:** [@Sergey\_Demidenko](https://discuss.elastic.co/u/Sergey_Demidenko)\ **Replies:** 2\ **Last updated:** [July 3, 2017, 5:31pm UTC](https://discuss.elastic.co/t/set-ssl-parameter-for-jdbc-input-plugin/91676 "2017-07-03T17:31:27Z")
Hi. My Postgres connection requires setting two parameters: ssl=true sslmode=require I can't find any options to set these parameters. Is it possible to use jdbc input plugin in this case? --- ## [How to do \_cat/indices/\ in JAVA](https://discuss.elastic.co/t/how-to-do--cat-indices-index-name-with-reg-ex-in-java/79936)
**Author:** [@sholavanalli](https://discuss.elastic.co/u/sholavanalli)\ **Replies:** 2\ **Last updated:** [March 24, 2017, 7:59pm UTC](https://discuss.elastic.co/t/how-to-do--cat-indices-index-name-with-reg-ex-in-java/79936 "2017-03-24T19:59:10Z")
I have some indexes with name test-1-in, test-2-in, test-3-in. I want to do \_cat/indices/test-\*-in from JAVA API. How to do this? --- ## [Exception when re-balancing shadow replica index shards - unable to determine if root directory exists](https://discuss.elastic.co/t/exception-when-re-balancing-shadow-replica-index-shards-unable-to-determine-if-root-directory-exists/47983)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 2\ **Last updated:** [April 25, 2016, 2:06am UTC](https://discuss.elastic.co/t/exception-when-re-balancing-shadow-replica-index-shards-unable-to-determine-if-root-directory-exists/47983 "2016-04-25T02:06:40Z")
I am experimenting shadow replica on my ES 1.7.5 cluster with 3 data nodes. Following is what I did: 1. Add following settings to elasticsearch.yml node.enable\_custom\_paths: true node.add\_id\_to\_custom\_path: false path.… --- ## [SubContracts in US](https://discuss.elastic.co/t/subcontracts-in-us/152125)
**Author:** [@drfuka](https://discuss.elastic.co/u/drfuka)\ **Replies:** 0\ **Last updated:** [October 11, 2018, 8:12pm UTC](https://discuss.elastic.co/t/subcontracts-in-us/152125 "2018-10-11T20:12:06Z")
Aloha folks, First, Sorry for those outside of the US, but I believe this is USA companies/institutions only. I am sharing this as I think the ElasticStack would make an ideal foundation for each of the two subawards o… --- ## [Updating data](https://discuss.elastic.co/t/updating-data/143186)
**Author:** [@Olha1](https://discuss.elastic.co/u/Olha1)\ **Replies:** 5\ **Last updated:** [August 7, 2018, 11:15am UTC](https://discuss.elastic.co/t/updating-data/143186 "2018-08-07T11:15:21Z")
Hi! I have a problem with updating my data in elasticsearch. I use a postgresql. When I transfer the data from database to elasticsearch through logstash, I have problem with update my data again and again. If I have, … --- ## [How to iterate over all fields with new Event API](https://discuss.elastic.co/t/how-to-iterate-over-all-fields-with-new-event-api/112514)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 1\ **Last updated:** [December 20, 2017, 4:50am UTC](https://discuss.elastic.co/t/how-to-iterate-over-all-fields-with-new-event-api/112514 "2017-12-20T04:50:16Z")
With the new Event API that provides getter and setter and hides the hash, how do I iterate over all the fields in a ruby filter in logstash? Stuff like .each and .values appear not to work (not surprising if it is no l… --- ## [How can I get rid off "org.elasticsearch.ElasticsearchException: Security must be explicitly enabled when using a \[basic\] license" message](https://discuss.elastic.co/t/how-can-i-get-rid-off-org-elasticsearch-elasticsearchexception-security-must-be-explicitly-enabled-when-using-a-basic-license-message/250647)
**Author:** [@masber](https://discuss.elastic.co/u/masber)\ **Replies:** 6\ **Last updated:** [October 7, 2020, 9:19am UTC](https://discuss.elastic.co/t/how-can-i-get-rid-off-org-elasticsearch-elasticsearchexception-security-must-be-explicitly-enabled-when-using-a-basic-license-message/250647 "2020-10-07T09:19:43Z")
Hi, I am testing elasticsearch in a test environment (no production) and I see this message in the logs: org.elasticsearch.ElasticsearchException: Security must be explicitly enabled when using a \[basic\] license How … --- ## [Problems with mapping data as geo\_point datatype](https://discuss.elastic.co/t/problems-with-mapping-data-as-geo-point-datatype/70064)
**Author:** [@olliewardman](https://discuss.elastic.co/u/olliewardman)\ **Replies:** 3\ **Last updated:** [December 28, 2016, 8:31pm UTC](https://discuss.elastic.co/t/problems-with-mapping-data-as-geo-point-datatype/70064 "2016-12-28T20:31:20Z")
Hi. elasticsearch 5.1.1 kibana 5.1.1 logstash 5.1.1 I am capturing tweets using the logstash twitter input plugin and passing them to elasticsearch using the elasticsearch output plugin. All works well except I seem… --- ## [Performance of term query with sorting](https://discuss.elastic.co/t/performance-of-term-query-with-sorting/11448)
**Author:** [@Ankit\_Jain](https://discuss.elastic.co/u/Ankit_Jain)\ **Replies:** 3\ **Last updated:** [April 4, 2013, 1:06pm UTC](https://discuss.elastic.co/t/performance-of-term-query-with-sorting/11448 "2013-04-04T13:06:31Z")
Hi All, we are using 0.20.2 version of ES and running five nodes of ES each has 32 GB RAM and 8 cores. we have indexed 60 millions(100 GB data) records into ES. We need to fire a term query with sorting. If we… --- ## [Handling multiple date formats in logstash](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238)
**Author:** [@lleatherby](https://discuss.elastic.co/u/lleatherby)\ **Replies:** 2\ **Last updated:** [July 14, 2017, 9:17pm UTC](https://discuss.elastic.co/t/handling-multiple-date-formats-in-logstash/93238 "2017-07-14T21:17:00Z")
I have a dataset with multiple date formats. if I use this filter: grok { match =\> \[ "message", "(?%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day}T%{TIME:time})%{SPACE}%{GREEDYDATA:text}" … --- ## [Can i plot an cumulative average line in timelion?](https://discuss.elastic.co/t/can-i-plot-an-cumulative-average-line-in-timelion/78828)
**Author:** [@kiran\_kumar\_sukumar](https://discuss.elastic.co/u/kiran_kumar_sukumar)\ **Replies:** 2\ **Last updated:** [March 16, 2017, 1:21pm UTC](https://discuss.elastic.co/t/can-i-plot-an-cumulative-average-line-in-timelion/78828 "2017-03-16T13:21:39Z")
Hi, We have 100 test instances to execute over a period of 10 days. Im currently following up the execution using a time series in Timelion. Can i have a sort of average line in Timelion that says that we must be exe… --- ## [Help with JSON Input in KIbana](https://discuss.elastic.co/t/help-with-json-input-in-kibana/62203)
**Author:** [@bhumi](https://discuss.elastic.co/u/bhumi)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 8:30pm UTC](https://discuss.elastic.co/t/help-with-json-input-in-kibana/62203 "2016-10-04T20:30:06Z")
Hi, I have recently started using Kibana for visualization purposes. I am exploring field JSON Input. Can anyone help me in understanding how we can actually utilize JSON Input field. Basically I am trying to get … --- ## [How to Specifying ES option via Shell environment variables for discovery.zen.ping.unicast.hosts](https://discuss.elastic.co/t/how-to-specifying-es-option-via-shell-environment-variables-for-discovery-zen-ping-unicast-hosts/56293)
**Author:** [@Brad\_Jungsu\_Heo](https://discuss.elastic.co/u/Brad_Jungsu_Heo)\ **Replies:** 2\ **Last updated:** [July 28, 2016, 12:43am UTC](https://discuss.elastic.co/t/how-to-specifying-es-option-via-shell-environment-variables-for-discovery-zen-ping-unicast-hosts/56293 "2016-07-28T00:43:40Z")
Hello. I'm using ES 2.3.2 I've decided to use Shell Env. Variables in elasticsearch.yml because I want to maintain ONLY 1 elasticsearch.yml file even though I have many type of nodes in many clusters. Most of configs… --- ## [Unable to start logstash: ERROR: Unknown command '�f'](https://discuss.elastic.co/t/unable-to-start-logstash-error-unknown-command-i-f/198783)
**Author:** [@chinmay.parkar](https://discuss.elastic.co/u/chinmay.parkar)\ **Replies:** 4\ **Last updated:** [September 9, 2019, 9:12pm UTC](https://discuss.elastic.co/t/unable-to-start-logstash-error-unknown-command-i-f/198783 "2019-09-09T21:12:54Z")
\[root@localhost logstash-6.3.0\]# ./bin/logstash –f logstash.conf ERROR: Unknown command '�f' See: 'bin/logstash --help' \[ERROR\] 2019-09-09 11:27:30.255 \[main\] Logstash - java.lang.IllegalStateException: Logstash sto… --- ## [Syntax for item URL to redirect to another dashboard](https://discuss.elastic.co/t/syntax-for-item-url-to-redirect-to-another-dashboard/185752)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 4\ **Last updated:** [July 1, 2019, 12:38am UTC](https://discuss.elastic.co/t/syntax-for-item-url-to-redirect-to-another-dashboard/185752 "2019-07-01T00:38:58Z")
Hello, How can I edit the item URL to redirect onclick URL to the correct dashboard? Currently, it is redirecting back to the default summary page of the host but I have a new dashboard for each host. I would like to … --- ## [Frequently failed to start elasticsearch service](https://discuss.elastic.co/t/frequently-failed-to-start-elasticsearch-service/182730)
**Author:** [@vernal](https://discuss.elastic.co/u/vernal)\ **Replies:** 4\ **Last updated:** [May 26, 2019, 7:31am UTC](https://discuss.elastic.co/t/frequently-failed-to-start-elasticsearch-service/182730 "2019-05-26T07:31:47Z")
It was running well. Since one week ago, we kept getting this kind of error as shown below. What is the cause for this? ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.servi… --- ## [Moving @timestamp in an optionnal new field](https://discuss.elastic.co/t/moving-timestamp-in-an-optionnal-new-field/49628)
**Author:** [@ericpietro](https://discuss.elastic.co/u/ericpietro)\ **Replies:** 4\ **Last updated:** [May 11, 2016, 2:33pm UTC](https://discuss.elastic.co/t/moving-timestamp-in-an-optionnal-new-field/49628 "2016-05-11T14:33:29Z")
hi, i want to add a new field in my config filebeat and put in it the @timestamp value : fields: harvest\_timestamp: @timestamp but it doesn't work ... my goal, at the end, is to delete the field @timestamp a… --- ## [\[ Threshold Rule \]: Unexpected result](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 3:53pm UTC](https://discuss.elastic.co/t/threshold-rule-unexpected-result/260956 "2021-01-14T15:53:47Z")
Hello, I would like to create a Threshold rule to detect files downloaded more than 1 Go. So in my firewall logs I have the field rcvd where I can find this value, and I to test that, I tested to download a file with 1… --- ## [Gaps in machine learning data when reverting to snapshot with high query delay](https://discuss.elastic.co/t/gaps-in-machine-learning-data-when-reverting-to-snapshot-with-high-query-delay/106549)
**Author:** [@tvannet](https://discuss.elastic.co/u/tvannet)\ **Replies:** 8\ **Last updated:** [November 10, 2017, 12:50pm UTC](https://discuss.elastic.co/t/gaps-in-machine-learning-data-when-reverting-to-snapshot-with-high-query-delay/106549 "2017-11-10T12:50:44Z")
Hi, I have a job running with a fairly high query delay (30 minutes). The bucket size itself is only 15 minutes, although I don't believe that's relevant. Occasionally, I have to revert the model to a previous state du… --- ## [How to compile filebeat for solaris](https://discuss.elastic.co/t/how-to-compile-filebeat-for-solaris/81642)
**Author:** [@akshat\_kashyap](https://discuss.elastic.co/u/akshat_kashyap)\ **Replies:** 1\ **Last updated:** [April 8, 2017, 11:05pm UTC](https://discuss.elastic.co/t/how-to-compile-filebeat-for-solaris/81642 "2017-04-08T23:05:10Z")
hi, we are using solaris11.3/sparc T5 in our environment. we want to use filebeat to ship the logs to logstash. is there a way we can use filebeat on solaris? --- ## [Setup lifecycle of "infra" plugin wasn't completed in 10sec. Consider disabling the plugin and re-start](https://discuss.elastic.co/t/setup-lifecycle-of-infra-plugin-wasnt-completed-in-10sec-consider-disabling-the-plugin-and-re-start/294679)
**Author:** [@abhijeet\_k](https://discuss.elastic.co/u/abhijeet_k)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 6:46pm UTC](https://discuss.elastic.co/t/setup-lifecycle-of-infra-plugin-wasnt-completed-in-10sec-consider-disabling-the-plugin-and-re-start/294679 "2022-01-25T18:46:35Z")
I have integrated kibana charts in react web app using an iframe tag, I want to render multiple charts on the same page of my react app. I am facing the issue if I render multiple charts, please refer to the attached ima… --- ## [Cluster service failed to start if node missing license plugin](https://discuss.elastic.co/t/cluster-service-failed-to-start-if-node-missing-license-plugin/26200)
**Author:** [@sumithub](https://discuss.elastic.co/u/sumithub)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 3:53pm UTC](https://discuss.elastic.co/t/cluster-service-failed-to-start-if-node-missing-license-plugin/26200 "2016-12-13T15:53:44Z")
Hi, Today I faced with an issue where one of the newly added node was missing elastic latest license. The other nodes in the cluster has watcher evaluation plugin installed along with latest elastic license plugin. Whe… --- ## [How to create a complex detection rule (indicator + correlation)?](https://discuss.elastic.co/t/how-to-create-a-complex-detection-rule-indicator-correlation/337249)
**Author:** [@VellayLoket](https://discuss.elastic.co/u/VellayLoket)\ **Replies:** 7\ **Last updated:** [August 3, 2023, 2:07am UTC](https://discuss.elastic.co/t/how-to-create-a-complex-detection-rule-indicator-correlation/337249 "2023-08-03T02:07:04Z")
For example, i have list with malware domains. I save logs from my DNS servers. I want to create alert when any client of my network has request for malware domain name. And with this, i need to aggregate this request… --- ## [Kibana Visualizeの異なる条件指定について](https://discuss.elastic.co/t/kibana-visualize/219299)
**Author:** [@harue](https://discuss.elastic.co/u/harue)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 7:30am UTC](https://discuss.elastic.co/t/kibana-visualize/219299 "2020-03-02T07:30:50Z")
お世話になっております。 Visualizeについて質問させて頂きます。 対象機能：Data table、bar 以下の異なる条件の合計値を1つの表またはグラフに表示することは可能でしょうか？ ▼例 index AAAにfield IDにA,B,C,D,Eの値が存在するとする ・IDがA,Bの場合、名前「test」に合計値を表示 ・IDがC,D,Eの場合、名前「testtest」に合計値を表示 (「名前」はfieldにあ… --- ## [X-pack after install not working!](https://discuss.elastic.co/t/x-pack-after-install-not-working/129115)
**Author:** [@omid](https://discuss.elastic.co/u/omid)\ **Replies:** 5\ **Last updated:** [April 23, 2018, 2:14pm UTC](https://discuss.elastic.co/t/x-pack-after-install-not-working/129115 "2018-04-23T14:14:45Z")
install xpack and enter address kibana in browser this error msg: {"statusCode":404,"error":"Not Found","message":"\[index\_not\_found\_exception\] no such index, with { resource.type=\\"index\_expression\\" & resource.id=\\"\_… --- ## [Any open source plugin for alerting elastic search instability or issues](https://discuss.elastic.co/t/any-open-source-plugin-for-alerting-elastic-search-instability-or-issues/73256)
**Author:** [@nethis](https://discuss.elastic.co/u/nethis)\ **Replies:** 5\ **Last updated:** [February 1, 2017, 6:39am UTC](https://discuss.elastic.co/t/any-open-source-plugin-for-alerting-elastic-search-instability-or-issues/73256 "2017-02-01T06:39:09Z")
Hi There, Could you please suggest us any plugins/tools available for monitoring and elastic search unstability/ unavailability/cluster health status other than green. etc.. We are primary looking for open source to… --- ## [Extracting first few digits from a long number through filters](https://discuss.elastic.co/t/extracting-first-few-digits-from-a-long-number-through-filters/51862)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 5\ **Last updated:** [November 12, 2016, 5:29pm UTC](https://discuss.elastic.co/t/extracting-first-few-digits-from-a-long-number-through-filters/51862 "2016-11-12T17:29:23Z")
Hi, I am looking for a logstash filter that would enable me to extract the most accurate matching result starting from left hand side of the number. Here is an example of a IMSI number has 15 digits, the first three digi… --- ## [Filebeat (5.0.0Alpha4) and filter](https://discuss.elastic.co/t/filebeat-5-0-0alpha4-and-filter/57287)
**Author:** [@logstash\_user](https://discuss.elastic.co/u/logstash_user)\ **Replies:** 5\ **Last updated:** [August 7, 2016, 3:32am UTC](https://discuss.elastic.co/t/filebeat-5-0-0alpha4-and-filter/57287 "2016-08-07T03:32:36Z")
Our present setup is: FileBeat (5.0.0 Alpha4) -\> Kafka -\> Logstash -\> Elasticsearch We were looking into the option of filtering (dropping) un-needed event logs at the source that is using FileBeat. Our typical Log … --- ## [My Elastic Stack Observability Wishlist](https://discuss.elastic.co/t/my-elastic-stack-observability-wishlist/276168)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 10:14am UTC](https://discuss.elastic.co/t/my-elastic-stack-observability-wishlist/276168 "2021-06-17T10:14:52Z")
(Note, these are my personal wishes, not my workplace's.) Since we started a trial at my workplace, I've been digging into everything the Elastic Stack has to offer. Mostly focused on Observability. Here are some ideas… --- ## [Search performance improovment by adding replicas shards](https://discuss.elastic.co/t/search-performance-improovment-by-adding-replicas-shards/208732)
**Author:** [@Loris](https://discuss.elastic.co/u/Loris)\ **Replies:** 3\ **Last updated:** [November 21, 2019, 3:23pm UTC](https://discuss.elastic.co/t/search-performance-improovment-by-adding-replicas-shards/208732 "2019-11-21T15:23:42Z")
Hi, Elasticsearch documentation reports that increasing the number of replicas shards will lead to search and read performance improvements. Can you, please, explain it better? According to the following scenarios, I ha… --- ## [Java HotSpot(TM) 64-Bit Server VM warning: Cannot open file logs/gc.log due to No such file or directory](https://discuss.elastic.co/t/java-hotspot-tm-64-bit-server-vm-warning-cannot-open-file-logs-gc-log-due-to-no-such-file-or-directory/136250)
**Author:** [@Yong\_Rhee](https://discuss.elastic.co/u/Yong_Rhee)\ **Replies:** 0\ **Last updated:** [June 18, 2018, 7:22am UTC](https://discuss.elastic.co/t/java-hotspot-tm-64-bit-server-vm-warning-cannot-open-file-logs-gc-log-due-to-no-such-file-or-directory/136250 "2018-06-18T07:22:09Z")
I re-installed elasticsearch but still the previous node is running. How do I disconnect and delete previous one? This is a Window machine PS C:\\Program Files\\Elastic\\Elasticsearch\\6.3.0\> .\\bin\\elasticsearch.exe \[2018… --- ## [Adding new node in cluster](https://discuss.elastic.co/t/adding-new-node-in-cluster/91408)
**Author:** [@Kisshor\_Kumar](https://discuss.elastic.co/u/Kisshor_Kumar)\ **Replies:** 3\ **Last updated:** [July 12, 2017, 10:21pm UTC](https://discuss.elastic.co/t/adding-new-node-in-cluster/91408 "2017-07-12T22:21:40Z")
I am running elasticsearch-5.0.0-beta1 in my laptop, I want to add one more new node to my elasticsearch cluster. In total I want to have 2 nodes. How do I do this? My elasticsearch.yml cluster.name: my-application nod… --- ## [Elasticsearch - One node](https://discuss.elastic.co/t/elasticsearch-one-node/59339)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 3\ **Last updated:** [August 30, 2016, 8:20pm UTC](https://discuss.elastic.co/t/elasticsearch-one-node/59339 "2016-08-30T20:20:15Z")
Hello, I just read the article https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html and it is not very clear to me, what configuration we should have for a cluster with one machine (the sam… --- ## [Filebeat loses connection to Kafka](https://discuss.elastic.co/t/filebeat-loses-connection-to-kafka/47660)
**Author:** [@gossu](https://discuss.elastic.co/u/gossu)\ **Replies:** 3\ **Last updated:** [April 19, 2016, 12:41pm UTC](https://discuss.elastic.co/t/filebeat-loses-connection-to-kafka/47660 "2016-04-19T12:41:24Z")
I am using the latest nightly build of Filebeat to output logs from /var/log/messages to Kafka (single node). The whole thing is working fine for about 30mins and after that Filebeat suddenly stops being able to commun… [Previous page](https://discuss.elastic.co/top.md?page=890&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=892&per_page=50&period=all)