# Top

**URL:** https://discuss.elastic.co/top.md?page=894&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 895

---

## [Sebp/elk not running on docker with error](https://discuss.elastic.co/t/sebp-elk-not-running-on-docker-with-error/85516)

<div class="topic-metadata">

**Author:** [@omid](https://discuss.elastic.co/u/omid)\
**Replies:** 1\
**Last updated:** [May 14, 2017, 8:17pm UTC](https://discuss.elastic.co/t/sebp-elk-not-running-on-docker-with-error/85516 "2017-05-14T20:17:11Z")

</div>

hello all engineering on the world Im 1 problem to after install ELK stack on docker my infrastructure: 1- Windows 10 New Creators Update 2- my laptop model: N552VX (8Gig RAM) 3- docker toolbox without prerequisites …

---

## [\[@timestamp\] is used by multiple types. Set update\_all\_types to true to update \[format\] across all types](https://discuss.elastic.co/t/timestamp-is-used-by-multiple-types-set-update-all-types-to-true-to-update-format-across-all-types/46465)

<div class="topic-metadata">

**Author:** [@Kramer\_Li](https://discuss.elastic.co/u/Kramer_Li)\
**Replies:** 1\
**Last updated:** [April 6, 2016, 3:30am UTC](https://discuss.elastic.co/t/timestamp-is-used-by-multiple-types-set-update-all-types-to-true-to-update-format-across-all-types/46465 "2016-04-06T03:30:28Z")

</div>

I have a template as below: curl -XPUT localhost:9200/\_template/template\_flow\_detail -d ' { "template" : "flow\_detail\_\*", "mappings" : { "traffic" : { "properties" : { …

---

## [Combine two fields into one via add\_fields](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468)

<div class="topic-metadata">

**Author:** [@bascht](https://discuss.elastic.co/u/bascht)\
**Replies:** 2\
**Last updated:** [February 6, 2021, 12:48pm UTC](https://discuss.elastic.co/t/combine-two-fields-into-one-via-add-fields/263468 "2021-02-06T12:48:07Z")

</div>

Hey everyone. I am trying to achieve something seemingly simple but cannot get this to work with the latest Filebeat 7.10: I want to combine the two fields foo.bar and foo.baz into a single new field that just joins th…

---

## [Location of ILM logs](https://discuss.elastic.co/t/location-of-ilm-logs/174180)

<div class="topic-metadata">

**Author:** [@mikemadden42](https://discuss.elastic.co/u/mikemadden42)\
**Replies:** 2\
**Last updated:** [March 27, 2019, 7:02pm UTC](https://discuss.elastic.co/t/location-of-ilm-logs/174180 "2019-03-27T19:02:51Z")

</div>

We've started setting up ILM in our Elastic Stack 6.6.1 cluster. I was wondering where ILM actions are logged. For example, if I setup ILM to delete certain indices older than 2 weeks, where can I see which indices whe…

---

## [Exporting large set of data from elastic as CSV](https://discuss.elastic.co/t/exporting-large-set-of-data-from-elastic-as-csv/166160)

<div class="topic-metadata">

**Author:** [@Divagar\_Tech](https://discuss.elastic.co/u/Divagar_Tech)\
**Replies:** 2\
**Last updated:** [January 29, 2019, 12:58pm UTC](https://discuss.elastic.co/t/exporting-large-set-of-data-from-elastic-as-csv/166160 "2019-01-29T12:58:02Z")

</div>

Hi experts i need to export huge or entire data from particular index of elastic as csv . Currently i have explored and using ScrollAPI whats my concern in this we need to loop it to get set of data until we get empty h…

---

## [Kibana not working when ssl is enabled](https://discuss.elastic.co/t/kibana-not-working-when-ssl-is-enabled/85552)

<div class="topic-metadata">

**Author:** [@anusha.kadambala](https://discuss.elastic.co/u/anusha.kadambala)\
**Replies:** 2\
**Last updated:** [May 15, 2017, 4:54am UTC](https://discuss.elastic.co/t/kibana-not-working-when-ssl-is-enabled/85552 "2017-05-15T04:54:29Z")

</div>

Hi all, I am using elasticsearch, kibana, logstash and xpack of 5.1.1 version. I enabled ssl following below two links https://www.elastic.co/guide/en/x-pack/current/kibana.html#configure-kibana-ssl https://www.elasti…

---

## [Installing header on ES throwing error](https://discuss.elastic.co/t/installing-header-on-es-throwing-error/46941)

<div class="topic-metadata">

**Author:** [@chichu](https://discuss.elastic.co/u/chichu)\
**Replies:** 8\
**Last updated:** [April 11, 2016, 7:17am UTC](https://discuss.elastic.co/t/installing-header-on-es-throwing-error/46941 "2016-04-11T07:17:40Z")

</div>

Command i run bin/plugin -url http://file/hed.zip --install head ERROR: unknown command \[elasticsearch-head-master.zip\]. Use \[-h\] option to list available commands

---

## [Logstash 7.0 document\_type deprecated setting warning](https://discuss.elastic.co/t/logstash-7-0-document-type-deprecated-setting-warning/176804)

<div class="topic-metadata">

**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\
**Replies:** 0\
**Last updated:** [April 15, 2019, 12:43am UTC](https://discuss.elastic.co/t/logstash-7-0-document-type-deprecated-setting-warning/176804 "2019-04-15T00:43:14Z")

</div>

I've upgraded to 7.0 today and I've been seeing this for a while now in my logstash log. Can someone please tell me what I should do to fix this? \[ 2019-04-15T10:37:11,050\]\[WARN \]\[logstash.outputs.elasticsearch\] You a…

---

## [How to emulate elasticsearch.yml in elasticsearch 5.0](https://discuss.elastic.co/t/how-to-emulate-elasticsearch-yml-in-elasticsearch-5-0/64934)

<div class="topic-metadata">

**Author:** [@jloveric](https://discuss.elastic.co/u/jloveric)\
**Replies:** 5\
**Last updated:** [November 4, 2016, 12:10am UTC](https://discuss.elastic.co/t/how-to-emulate-elasticsearch-yml-in-elasticsearch-5-0/64934 "2016-11-04T00:10:21Z")

</div>

I recently switched to elasticsearch 5.0 and some of the things in elasticsearch.yml from 2.x don't seem to be working. I get an error on startup that warns my to define my index parameters using curl instead of elastic…

---

## [Speeding up elastic search regex filters/query optimization](https://discuss.elastic.co/t/speeding-up-elastic-search-regex-filters-query-optimization/34272)

<div class="topic-metadata">

**Author:** [@abhijith\_reddy](https://discuss.elastic.co/u/abhijith_reddy)\
**Replies:** 1\
**Last updated:** [November 11, 2015, 6:44am UTC](https://discuss.elastic.co/t/speeding-up-elastic-search-regex-filters-query-optimization/34272 "2015-11-11T06:44:16Z")

</div>

We are currently using regex filters to support contains query for an application, as expected the performance is pretty abysmal since the regex doesn't have any leading prefix. Below is an example query that we are usin…

---

## [KEYSTORE\_PASSWORD\_FILE](https://discuss.elastic.co/t/keystore-password-file/339627)

<div class="topic-metadata">

**Author:** [@toughcoding](https://discuss.elastic.co/u/toughcoding)\
**Replies:** 3\
**Last updated:** [August 1, 2023, 7:27pm UTC](https://discuss.elastic.co/t/keystore-password-file/339627 "2023-08-01T19:27:39Z")

</div>

Running Elasticsearch as docker container with --env KEYSTORE\_PASSWORD\_FILE=/run/secrets/keystore\_password does not setup password for elasticsearch keystore. Although I am successfull with Elasticsearch password itse…

---

## [Failed to load elasticsearch nodes](https://discuss.elastic.co/t/failed-to-load-elasticsearch-nodes/220107)

<div class="topic-metadata">

**Author:** [@shivsandeep](https://discuss.elastic.co/u/shivsandeep)\
**Replies:** 3\
**Last updated:** [February 20, 2020, 9:42am UTC](https://discuss.elastic.co/t/failed-to-load-elasticsearch-nodes/220107 "2020-02-20T09:42:45Z")

</div>

hi, i have setup elasticsearch 5.6.3 using docker but when i am trying to access that using my local spring application i am getting below error: " failed to load elasticsearch nodes : org.elasticsearch.client.transpo…

---

## [Process ignoring parts of logstash.yml?](https://discuss.elastic.co/t/process-ignoring-parts-of-logstash-yml/97821)

<div class="topic-metadata">

**Author:** [@suboptimalprime](https://discuss.elastic.co/u/suboptimalprime)\
**Replies:** 3\
**Last updated:** [August 21, 2017, 8:21pm UTC](https://discuss.elastic.co/t/process-ignoring-parts-of-logstash-yml/97821 "2017-08-21T20:21:33Z")

</div>

Hoping someone can explain this, was unable to find relative posts. Running into an issue where my logstash.yml settings are only partially being read when I start my logstash service. Hostname is read, but nearly all …

---

## [Problems with Apache reverse proxy and elasticsearch bigdesk plugin](https://discuss.elastic.co/t/problems-with-apache-reverse-proxy-and-elasticsearch-bigdesk-plugin/28763)

<div class="topic-metadata">

**Author:** [@dfaropennetwork](https://discuss.elastic.co/u/dfaropennetwork)\
**Replies:** 3\
**Last updated:** [May 19, 2016, 2:04pm UTC](https://discuss.elastic.co/t/problems-with-apache-reverse-proxy-and-elasticsearch-bigdesk-plugin/28763 "2016-05-19T14:04:52Z")

</div>

I've problems with elasticsearch plugin in general, bigdesk, head, HQ etc... i need not port open 9200 port to the outside. I put my apache configuration for the kibana side: ProxyRequests On ProxyPreserveHost On /#…

---

## [Tile Map doesn't show results on map using geopoint](https://discuss.elastic.co/t/tile-map-doesnt-show-results-on-map-using-geopoint/46550)

<div class="topic-metadata">

**Author:** [@frazer84](https://discuss.elastic.co/u/frazer84)\
**Replies:** 3\
**Last updated:** [April 6, 2016, 7:08pm UTC](https://discuss.elastic.co/t/tile-map-doesnt-show-results-on-map-using-geopoint/46550 "2016-04-06T19:08:16Z")

</div>

Hi, I'm trying to create a Tile Map using my geopoint data in ES. This is how I've set up the map: As you can see, the map has no results. Looking in the details section, the ES request body looks like this: { …

---

## [Hide or Modify button on SearchBox](https://discuss.elastic.co/t/hide-or-modify-button-on-searchbox/228451)

<div class="topic-metadata">

**Author:** [@georgina](https://discuss.elastic.co/u/georgina)\
**Replies:** 4\
**Last updated:** [May 19, 2020, 5:37am UTC](https://discuss.elastic.co/t/hide-or-modify-button-on-searchbox/228451 "2020-05-19T05:37:18Z")

</div>

Hi, I'm using search-ui and am attempting to make a simple modification of the SearchBox to change the search button ( replace "search" with an icon). I see from the docs https://github.com/elastic/search-ui/blob/mas…

---

## [Sanitize\_field\_names confusion, and minimizing payload size](https://discuss.elastic.co/t/sanitize-field-names-confusion-and-minimizing-payload-size/221813)

<div class="topic-metadata">

**Author:** [@tadgh](https://discuss.elastic.co/u/tadgh)\
**Replies:** 4\
**Last updated:** [March 5, 2020, 5:56pm UTC](https://discuss.elastic.co/t/sanitize-field-names-confusion-and-minimizing-payload-size/221813 "2020-03-05T17:56:15Z")

</div>

Elasticsearch version: Kibana version: APM Server version: 7.5.1 APM Agent language and version: Java Agent 1.13.0 Fresh install or upgraded from other version? Fresh Docker-compose Description of the problem inc…

---

## [Why the index is included in a square bracket in the payload of search request?](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197)

<div class="topic-metadata">

**Author:** [@ahrtr](https://discuss.elastic.co/u/ahrtr)\
**Replies:** 4\
**Last updated:** [April 10, 2018, 11:44pm UTC](https://discuss.elastic.co/t/why-the-index-is-included-in-a-square-bracket-in-the-payload-of-search-request/127197 "2018-04-10T23:44:34Z")

</div>

For example, when I search log data on the discover page, then the browser POST the following request to kibana server, POST /elasticsearch/\_msearch {"index":\["logstash\*"\],"ignore\_unavailable":true,"preference":15231…

---

## [Math on triggered time in Kibana watcher](https://discuss.elastic.co/t/math-on-triggered-time-in-kibana-watcher/126019)

<div class="topic-metadata">

**Author:** [@Preetiv](https://discuss.elastic.co/u/Preetiv)\
**Replies:** 4\
**Last updated:** [March 30, 2018, 5:14pm UTC](https://discuss.elastic.co/t/math-on-triggered-time-in-kibana-watcher/126019 "2018-03-30T17:14:39Z")

</div>

I need to get the watcher's triggered time and subtract a random time (e.g. 5mins from it) I am trying something on the following lines but with no success. Input: "transform": { "script": { "source": "ret…

---

## [Decimal precision removed in Data Table visualization](https://discuss.elastic.co/t/decimal-precision-removed-in-data-table-visualization/106799)

<div class="topic-metadata">

**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Replies:** 4\
**Last updated:** [November 8, 2017, 6:53pm UTC](https://discuss.elastic.co/t/decimal-precision-removed-in-data-table-visualization/106799 "2017-11-08T18:53:02Z")

</div>

Hi, I am trying to plot a "value" field in Kibana which is a numeric field. Similar issue with this post: Visualized precision doesn't match field precision however i am still struggling with the missing decimals.

---

## [Nested data with two level](https://discuss.elastic.co/t/nested-data-with-two-level/83849)

<div class="topic-metadata">

**Author:** [@abhishek5678](https://discuss.elastic.co/u/abhishek5678)\
**Replies:** 4\
**Last updated:** [May 3, 2017, 10:06am UTC](https://discuss.elastic.co/t/nested-data-with-two-level/83849 "2017-05-03T10:06:21Z")

</div>

Hi Guys, In this data when i am trying with one level nested data then it's working fine but when i am adding one more nested data then it's not working if anybody will be knows about that then please reply me.I am sendi…

---

## [Kibana/ELK geo problem](https://discuss.elastic.co/t/kibana-elk-geo-problem/66403)

<div class="topic-metadata">

**Author:** [@xon](https://discuss.elastic.co/u/xon)\
**Replies:** 4\
**Last updated:** [November 17, 2016, 7:30pm UTC](https://discuss.elastic.co/t/kibana-elk-geo-problem/66403 "2016-11-17T19:30:07Z")

</div>

I want to add geoloc info on my apache logs. I am new in this and I have the following setup (apache, redis, logstash, elastic, kibana): filebeat: filebeat.prospectors: input\_type: log paths: /var/log/apache2/\*.l…

---

## [Questions about Non-Java (C) Elasticsearch Native Clients](https://discuss.elastic.co/t/questions-about-non-java-c-elasticsearch-native-clients/50719)

<div class="topic-metadata">

**Author:** [@unknownunknown](https://discuss.elastic.co/u/unknownunknown)\
**Replies:** 4\
**Last updated:** [May 23, 2016, 6:56pm UTC](https://discuss.elastic.co/t/questions-about-non-java-c-elasticsearch-native-clients/50719 "2016-05-23T18:56:14Z")

</div>

I was talking to someone recently about my attempts to drive indexing performance on a single node higher, and their recommendation was to basically use C to write the ingestion code (for the sake of discussion and every…

---

## [HEAP Size in ESXi\`s VM](https://discuss.elastic.co/t/heap-size-in-esxi-s-vm/26852)

<div class="topic-metadata">

**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\
**Replies:** 6\
**Last updated:** [August 5, 2015, 10:26am UTC](https://discuss.elastic.co/t/heap-size-in-esxi-s-vm/26852 "2015-08-05T10:26:19Z")

</div>

Hi everybody, Should I dedicate for JAVA HEAP size a half of memory like in real machines if I use elasticsearch in VM under ESXi? Or I can use all of memory for JAVA HEAP size?

---

## [Boost performance for nodes/cluster](https://discuss.elastic.co/t/boost-performance-for-nodes-cluster/907)

<div class="topic-metadata">

**Author:** [@andimak](https://discuss.elastic.co/u/andimak)\
**Replies:** 6\
**Last updated:** [May 25, 2015, 12:38pm UTC](https://discuss.elastic.co/t/boost-performance-for-nodes-cluster/907 "2015-05-25T12:38:13Z")

</div>

Hi, I ran into some performance problems with elasticsearch. We are at the development/test stage. We used the "kopf" plugin and it doesn't work proper anymore and some api calls like "\_cat/nodes" run into a timeout. …

---

## [Elastichsearch CDH Hadoop Integration](https://discuss.elastic.co/t/elastichsearch-cdh-hadoop-integration/23030)

<div class="topic-metadata">

**Author:** [@saikumar](https://discuss.elastic.co/u/saikumar)\
**Replies:** 6\
**Last updated:** [April 6, 2015, 5:08am UTC](https://discuss.elastic.co/t/elastichsearch-cdh-hadoop-integration/23030 "2015-04-06T05:08:18Z")

</div>

I have the problem with elastichsearch integrating with hadoop. I am new to elasticsearch. I have installed on CDH Single node cluster. Please someone suggest me what should we keep at path.data: /path to data tha…

---

## [Cannot upgrade to 8.x; cannot find incompatible indices](https://discuss.elastic.co/t/cannot-upgrade-to-8-x-cannot-find-incompatible-indices/301526)

<div class="topic-metadata">

**Author:** [@Todd\_Sayers](https://discuss.elastic.co/u/Todd_Sayers)\
**Replies:** 3\
**Last updated:** [April 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/cannot-upgrade-to-8-x-cannot-find-incompatible-indices/301526 "2022-04-07T13:56:57Z")

</div>

I'm not able to upgrade my cluster to 8.x. The Upgrade Assistant (via Kibana) does not identify any indices that need to be migrated (I additionally clicked the "migrate button," regardless). I'm stuck. After upgrading…

---

## [Updating winlogbeat.yml and adding more event logs](https://discuss.elastic.co/t/updating-winlogbeat-yml-and-adding-more-event-logs/148246)

<div class="topic-metadata">

**Author:** [@popa](https://discuss.elastic.co/u/popa)\
**Replies:** 3\
**Last updated:** [September 12, 2018, 6:36am UTC](https://discuss.elastic.co/t/updating-winlogbeat-yml-and-adding-more-event-logs/148246 "2018-09-12T06:36:30Z")

</div>

I'm currently running a Windows Event Forwarding / Windows Event Collector setup. All of our endpoints send logs to the WEC server where Winlogbeat is installed. I'm currently sending Sysmon logs (WEC6-Sysmon) centrally…

---

## [Logstash 6.2 multiple input confused](https://discuss.elastic.co/t/logstash-6-2-multiple-input-confused/144636)

<div class="topic-metadata">

**Author:** [@Haitianisgood](https://discuss.elastic.co/u/Haitianisgood)\
**Replies:** 8\
**Last updated:** [August 20, 2018, 8:06am UTC](https://discuss.elastic.co/t/logstash-6-2-multiple-input-confused/144636 "2018-08-20T08:06:04Z")

</div>

env：logstash 6.2 I touch two config files in /etc/logstash/conf.d , eg：a.conf b.conf a.conf input from kafka, setting type is 'aa' b.conf input from file, setting type is 'bb' Both output are same ES The question …

---

## [CORS and other settings with AWS ES](https://discuss.elastic.co/t/cors-and-other-settings-with-aws-es/127145)

<div class="topic-metadata">

**Author:** [@Jackson\_Pollock](https://discuss.elastic.co/u/Jackson_Pollock)\
**Replies:** 3\
**Last updated:** [April 10, 2018, 12:41am UTC](https://discuss.elastic.co/t/cors-and-other-settings-with-aws-es/127145 "2018-04-10T00:41:12Z")

</div>

In my local elasticsearch.yml I am able to set: http.cors.enabled : true http.cors.allow-origin : "\*" http.cors.allow-methods : OPTIONS, HEAD, GET, POST, PUT, DELETE http.cors.allow-headers : X-Requested-With,X-Auth-…

---

## [Can someone please help me with Geo filter on said logstash conf](https://discuss.elastic.co/t/can-someone-please-help-me-with-geo-filter-on-said-logstash-conf/98366)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 8\
**Last updated:** [August 28, 2017, 7:12am UTC](https://discuss.elastic.co/t/can-someone-please-help-me-with-geo-filter-on-said-logstash-conf/98366 "2017-08-28T07:12:24Z")

</div>

Hi Guys, I am not expert in logstash and I need help regarding indexing my opencanary data with geo tags. I already have below conf but I am sure it does not have geo tag. Can someone please help me with appropriate co…

---

## [Whether log stash parsed log file completely](https://discuss.elastic.co/t/whether-log-stash-parsed-log-file-completely/24055)

<div class="topic-metadata">

**Author:** [@Siddhant\_Agarwal](https://discuss.elastic.co/u/Siddhant_Agarwal)\
**Replies:** 8\
**Last updated:** [June 23, 2015, 11:00am UTC](https://discuss.elastic.co/t/whether-log-stash-parsed-log-file-completely/24055 "2015-06-23T11:00:34Z")

</div>

I want to run a script when log stash has finished parsing log file completely. Can anyone suggest a way to do that?

---

## [Issues connecting to App Search hosted on Elasticsearch service through Python API](https://discuss.elastic.co/t/issues-connecting-to-app-search-hosted-on-elasticsearch-service-through-python-api/236975)

<div class="topic-metadata">

**Author:** [@coding\_martian](https://discuss.elastic.co/u/coding_martian)\
**Replies:** 2\
**Last updated:** [June 17, 2020, 7:31pm UTC](https://discuss.elastic.co/t/issues-connecting-to-app-search-hosted-on-elasticsearch-service-through-python-api/236975 "2020-06-17T19:31:10Z")

</div>

I'm trying to index a document on my App Search Instance running on Elasticsearch Service, using the python API. My code is as follows from elastic\_app\_search import Client client = Client( base\_endpoin…

---

## [Timelion - add timelion chart to kibana dashboard](https://discuss.elastic.co/t/timelion-add-timelion-chart-to-kibana-dashboard/47725)

<div class="topic-metadata">

**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\
**Replies:** 2\
**Last updated:** [October 28, 2016, 2:01pm UTC](https://discuss.elastic.co/t/timelion-add-timelion-chart-to-kibana-dashboard/47725 "2016-10-28T14:01:26Z")

</div>

Hello, I would like to know if there is a way to add a timelion chart to a kibana dashboard... Thank you!

---

## [Does the data input filter work on nested fields?](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765)

<div class="topic-metadata">

**Author:** [@mormor1971](https://discuss.elastic.co/u/mormor1971)\
**Replies:** 2\
**Last updated:** [July 19, 2016, 3:25pm UTC](https://discuss.elastic.co/t/does-the-data-input-filter-work-on-nested-fields/55765 "2016-07-19T15:25:45Z")

</div>

Hello All, I'm trying to get logstash to parse the date from a nested field in a JSON blob and are having some issues doing so. Here is what the JSON blob looks like: { "count"27, "data":\[{ "hotspotIdentifier":…

---

## [High system CPU usage with Elasticsearch on Kubernetes (using ECK) using ES v7.10.0+ (but not in v7.6.1)](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904)

<div class="topic-metadata">

**Author:** [@YannV](https://discuss.elastic.co/u/YannV)\
**Replies:** 5\
**Last updated:** [December 9, 2021, 10:20pm UTC](https://discuss.elastic.co/t/high-system-cpu-usage-with-elasticsearch-on-kubernetes-using-eck-using-es-v7-10-0-but-not-in-v7-6-1/290904 "2021-12-09T22:20:19Z")

</div>

Elasticsearch version: 7.10.0 & 7.14.2 (but not reproduced in ES v7.6.1) Plugins installed: None JVM version: Bundled in official Elasticsearch docker image OS version: Reproduced on CentOS 7.9 with kernel 3.10.0 and …

---

## [Change Visualization source from Index-Pattern to Saved Search](https://discuss.elastic.co/t/change-visualization-source-from-index-pattern-to-saved-search/247255)

<div class="topic-metadata">

**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\
**Replies:** 5\
**Last updated:** [September 2, 2020, 8:29pm UTC](https://discuss.elastic.co/t/change-visualization-source-from-index-pattern-to-saved-search/247255 "2020-09-02T20:29:09Z")

</div>

In Nov 2019, someone asked the same question and the answer was that it was not possible. Was there any change about that? I would like to modify an existing visualization that uses an index pattern and use a saved sear…

---

## [Kibana not seeing ES logs insterted via HTTP POST](https://discuss.elastic.co/t/kibana-not-seeing-es-logs-insterted-via-http-post/210398)

<div class="topic-metadata">

**Author:** [@maxstone9](https://discuss.elastic.co/u/maxstone9)\
**Replies:** 4\
**Last updated:** [December 31, 2019, 8:39pm UTC](https://discuss.elastic.co/t/kibana-not-seeing-es-logs-insterted-via-http-post/210398 "2019-12-31T20:39:28Z")

</div>

Hey all, I got Kibana and ES working together and data flowing from Winston without any issues. I have a mobile app that I am trying to hook up to ES and wanted to do it via an HTTP POST call. POST /logs-2019.12.03/\_d…

---

## [I am currently using windows, instance/beat.go:743 Exiting: error initializing publisher: No outputs are defined. Please define one under the output section](https://discuss.elastic.co/t/i-am-currently-using-windows-instance-beat-go-743-exiting-error-initializing-publisher-no-outputs-are-defined-please-define-one-under-the-output-section/150953)

<div class="topic-metadata">

**Author:** [@rohit\_kumar\_Jain](https://discuss.elastic.co/u/rohit_kumar_Jain)\
**Replies:** 4\
**Last updated:** [October 9, 2018, 10:58am UTC](https://discuss.elastic.co/t/i-am-currently-using-windows-instance-beat-go-743-exiting-error-initializing-publisher-no-outputs-are-defined-please-define-one-under-the-output-section/150953 "2018-10-09T10:58:22Z")

</div>

I am currently using windows while running filebeat -e -c filebeat.yml -d "publish" command in order to post logs to ES, I am getting this error: instance/beat.go:743 Exiting: error initializing publisher: No outputs…

---

## [Sorting by nested fields](https://discuss.elastic.co/t/sorting-by-nested-fields/20118)

<div class="topic-metadata">

**Author:** [@Elke](https://discuss.elastic.co/u/Elke)\
**Replies:** 4\
**Last updated:** [December 10, 2014, 10:54am UTC](https://discuss.elastic.co/t/sorting-by-nested-fields/20118 "2014-12-10T10:54:58Z")

</div>

Hi. I have a question about sorting by nested fields. This is just an small example of the hierarchy level (The marketplaces and the prices are mapped as nested documents): { id: "doc1", name : "test", m…

---

## [Data Formatter in TSVB visualization](https://discuss.elastic.co/t/data-formatter-in-tsvb-visualization/245982)

<div class="topic-metadata">

**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\
**Replies:** 1\
**Last updated:** [August 22, 2020, 2:14pm UTC](https://discuss.elastic.co/t/data-formatter-in-tsvb-visualization/245982 "2020-08-22T14:14:09Z")

</div>

Hi , i use kibana 7.7.0. i create a TSVB visualization : X-axis: sum of credit and sum of debit Y-axis: date per day . in my index the fields "credit" and "debit" are a number with a format string. i like to dis…

---

## [How to backup spaces and user,roles of elasticsearch](https://discuss.elastic.co/t/how-to-backup-spaces-and-user-roles-of-elasticsearch/231742)

<div class="topic-metadata">

**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\
**Replies:** 1\
**Last updated:** [May 10, 2020, 11:21pm UTC](https://discuss.elastic.co/t/how-to-backup-spaces-and-user-roles-of-elasticsearch/231742 "2020-05-10T23:21:15Z")

</div>

when i bounce elasticsearch and launch new application every time i need to create user,roles,and spaces in elasticsearch . i follow saved objects like dashboards using export ndjson file it is very helpful . so like …

---

## [Backward regex replacement with gsub filter option](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426)

<div class="topic-metadata">

**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Replies:** 1\
**Last updated:** [May 16, 2019, 2:37pm UTC](https://discuss.elastic.co/t/backward-regex-replacement-with-gsub-filter-option/181426 "2019-05-16T14:37:29Z")

</div>

I want to match a text and replace it with matched value using gsub regex. we ususally do it using $1 which is regex backward reference. the below code contain my requirement filter { mutate { gsub…

---

## [Spooling Queue](https://discuss.elastic.co/t/spooling-queue/142797)

<div class="topic-metadata">

**Author:** [@BrandonF](https://discuss.elastic.co/u/BrandonF)\
**Replies:** 7\
**Last updated:** [August 8, 2018, 6:05pm UTC](https://discuss.elastic.co/t/spooling-queue/142797 "2018-08-08T18:05:04Z")

</div>

Attempting to play with the new spooling queue but we're having issues with the config around it. The most prevalent error when testing the config: spool.dat can not be locked right now Current config section: spool: …

---

## [Deprecation log - how to find source?](https://discuss.elastic.co/t/deprecation-log-how-to-find-source/111084)

<div class="topic-metadata">

**Author:** [@imehl](https://discuss.elastic.co/u/imehl)\
**Replies:** 1\
**Last updated:** [December 11, 2017, 5:07pm UTC](https://discuss.elastic.co/t/deprecation-log-how-to-find-source/111084 "2017-12-11T17:07:01Z")

</div>

Hi, I've an ES 5.6 cluster and want to prepare it for an upgrade to 6. I have multiple types of deprecation logs: \[WARN \]\[o.e.d.r.RestController \] Content type detection for rest requests is deprecated. Specify the…

---

## [Loading iostat.disk, iostat.cpu, sar.disk, sar.cpu, etc file to Elasticsearch](https://discuss.elastic.co/t/loading-iostat-disk-iostat-cpu-sar-disk-sar-cpu-etc-file-to-elasticsearch/60944)

<div class="topic-metadata">

**Author:** [@Vara](https://discuss.elastic.co/u/Vara)\
**Replies:** 1\
**Last updated:** [September 20, 2016, 7:09am UTC](https://discuss.elastic.co/t/loading-iostat-disk-iostat-cpu-sar-disk-sar-cpu-etc-file-to-elasticsearch/60944 "2016-09-20T07:09:12Z")

</div>

I got iostat.disk, iostat.cpu, sar.disk, sar.cpu, etc files captured from testing/production servers and I would like to analyze these data offline by loading into elasticsearch. But I don't find option to load these fil…

---

## [File is inactive: Closing because close\_inactive of 5m0s reached](https://discuss.elastic.co/t/file-is-inactive-closing-because-close-inactive-of-5m0s-reached/271057)

<div class="topic-metadata">

**Author:** [@San9](https://discuss.elastic.co/u/San9)\
**Replies:** 0\
**Last updated:** [April 23, 2021, 9:17am UTC](https://discuss.elastic.co/t/file-is-inactive-closing-because-close-inactive-of-5m0s-reached/271057 "2021-04-23T09:17:08Z")

</div>

Hi Team! I, like many, have a problem with the filebeat. Data is not reaching to logstash. Before opening the request, I read many posts, but did not find a clear solution to this problem? Pocheiu it doesn't work? Che…

---

## [Declaring runtime fields when creating transforms](https://discuss.elastic.co/t/declaring-runtime-fields-when-creating-transforms/305169)

<div class="topic-metadata">

**Author:** [@Silver137](https://discuss.elastic.co/u/Silver137)\
**Replies:** 2\
**Last updated:** [May 19, 2022, 11:51am UTC](https://discuss.elastic.co/t/declaring-runtime-fields-when-creating-transforms/305169 "2022-05-19T11:51:14Z")

</div>

I would like to add runtime fields against the index that is created when creating a transformation. I saw that the kibana transform gui offers a text box to work with runtime fields but not sure about how it works. S…

---

## [Master nodes lost](https://discuss.elastic.co/t/master-nodes-lost/243075)

<div class="topic-metadata">

**Author:** [@Marcus\_Simonsen](https://discuss.elastic.co/u/Marcus_Simonsen)\
**Replies:** 2\
**Last updated:** [July 30, 2020, 12:40pm UTC](https://discuss.elastic.co/t/master-nodes-lost/243075 "2020-07-30T12:40:26Z")

</div>

Hello Users + Experts. Due to unfortunate operator error the PVs of the master nodes were deleted, due to a out of disk error from the master nodes. We had 3 dedicated master nodes and 12 data nodes. The data nodes ar…

---

## [Es.update.script.inline and es.write.operation](https://discuss.elastic.co/t/es-update-script-inline-and-es-write-operation/152192)

<div class="topic-metadata">

**Author:** [@werowe](https://discuss.elastic.co/u/werowe)\
**Replies:** 2\
**Last updated:** [October 15, 2018, 6:37pm UTC](https://discuss.elastic.co/t/es-update-script-inline-and-es-write-operation/152192 "2018-10-15T18:37:41Z")

</div>

Trying to update a document using the elasticsearch-hadoop jar and Spark. This works find: ´´´ curl -XPOST --header 'Content-Type: application/json' http://localhost:9200/walker\_pandas/\_doc/1/\_update -d '{ curl -XPOS…

[Previous page](https://discuss.elastic.co/top.md?page=893&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=895&per_page=50&period=all)
