# Top

**URL:** https://discuss.elastic.co/top.md?page=934&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 935

---

## [Cautionary story about installing X-Pack](https://discuss.elastic.co/t/cautionary-story-about-installing-x-pack/86845)

<div class="topic-metadata">

**Author:** [@Keeper-of-the-Keys](https://discuss.elastic.co/u/Keeper-of-the-Keys)\
**Replies:** 6\
**Last updated:** [May 25, 2017, 7:32pm UTC](https://discuss.elastic.co/t/cautionary-story-about-installing-x-pack/86845 "2017-05-25T19:32:05Z")

</div>

This is a tale of a sysadmin who created a nice proof of concept ELK stack and as a next step wanted to test the alerting feature of X-Pack. The innocent sysadmin downloaded and installed X-Pack as instructed and at fi…

---

## [Different versions of ELK cluster](https://discuss.elastic.co/t/different-versions-of-elk-cluster/336486)

<div class="topic-metadata">

**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\
**Replies:** 5\
**Last updated:** [June 21, 2023, 3:58pm UTC](https://discuss.elastic.co/t/different-versions-of-elk-cluster/336486 "2023-06-21T15:58:30Z")

</div>

Hi All, I was able to create a working cluster using variety of product versions. Please let me know if this is ok: Filebeat: 7.6.2 Logstash: 8.6.2 Elasticsearch: 8.7.0 Kibana: 8.5.3 Thanks in advance!

---

## [Hello elastic team, I want to get some help on dapr + apmserver](https://discuss.elastic.co/t/hello-elastic-team-i-want-to-get-some-help-on-dapr-apmserver/290736)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 5\
**Last updated:** [December 24, 2021, 12:39am UTC](https://discuss.elastic.co/t/hello-elastic-team-i-want-to-get-some-help-on-dapr-apmserver/290736 "2021-12-24T00:39:37Z")

</div>

Our service is based on dapr framework, dapr includes tracing function (based on opentelemetry implementation). I want to replace the dapr sidecar with the elastic apm agent, and then still use the apm server for storage…

---

## [Problem with SQL query when using RLIKE or LIKE function](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689)

<div class="topic-metadata">

**Author:** [@simran96](https://discuss.elastic.co/u/simran96)\
**Replies:** 5\
**Last updated:** [June 1, 2021, 11:48pm UTC](https://discuss.elastic.co/t/problem-with-sql-query-when-using-rlike-or-like-function/274689 "2021-06-01T23:48:27Z")

</div>

Hi I'm trying to write a query where i want to search for a particular pattern but i'm getting errors. I have used the \\ escape as well but still its of no use. My query: curl -XPOST "http://xxxx/\_sql?format=csv" -H 'C…

---

## [Elasticsearch: Unable to start after heavy\[20GB\] data](https://discuss.elastic.co/t/elasticsearch-unable-to-start-after-heavy-20gb-data/46977)

<div class="topic-metadata">

**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Replies:** 5\
**Last updated:** [April 13, 2016, 6:49am UTC](https://discuss.elastic.co/t/elasticsearch-unable-to-start-after-heavy-20gb-data/46977 "2016-04-13T06:49:20Z")

</div>

I am using Elasticsearch, Kibana for monitoring purpose, Yesterday as Elasticsearch was having 15 GB of indexed data, it was taking to much load to return result for the queries by Kibana. It was also showing errors on…

---

## [Exception when trying to use mutate to convert an integer to boolean](https://discuss.elastic.co/t/exception-when-trying-to-use-mutate-to-convert-an-integer-to-boolean/105253)

<div class="topic-metadata">

**Author:** [@jdmcalee](https://discuss.elastic.co/u/jdmcalee)\
**Replies:** 1\
**Last updated:** [October 25, 2017, 2:08pm UTC](https://discuss.elastic.co/t/exception-when-trying-to-use-mutate-to-convert-an-integer-to-boolean/105253 "2017-10-25T14:08:40Z")

</div>

First off, I am using 6.0.0-rc1 in docker. I'm using the jdbc input plugin to fetch some data out of mysql, and I need to convert an integer (tinyint in the schema) to boolean to suit my desired index type. The values in…

---

## [How i can use logstash to convert json data into a csv file?](https://discuss.elastic.co/t/how-i-can-use-logstash-to-convert-json-data-into-a-csv-file/52226)

<div class="topic-metadata">

**Author:** [@abrkreddy](https://discuss.elastic.co/u/abrkreddy)\
**Replies:** 1\
**Last updated:** [June 8, 2016, 6:26pm UTC](https://discuss.elastic.co/t/how-i-can-use-logstash-to-convert-json-data-into-a-csv-file/52226 "2016-06-08T18:26:33Z")

</div>

strong text

---

## [Edge nGram token filter doesn't seem to work](https://discuss.elastic.co/t/edge-ngram-token-filter-doesnt-seem-to-work/28346)

<div class="topic-metadata">

**Author:** [@havetobe\_unknown](https://discuss.elastic.co/u/havetobe_unknown)\
**Replies:** 1\
**Last updated:** [August 31, 2015, 12:32pm UTC](https://discuss.elastic.co/t/edge-ngram-token-filter-doesnt-seem-to-work/28346 "2015-08-31T12:32:31Z")

</div>

Hi everyone, I'm trying to get the Edge nGram token filter working based on the following documentation: https://www.elastic.co/guide/en/elasticsearch/guide/current/\_index\_time\_search\_as\_you\_type.html I'm using versi…

---

## [Exception occurring when try to query a local elasticsearch node](https://discuss.elastic.co/t/exception-occurring-when-try-to-query-a-local-elasticsearch-node/26657)

<div class="topic-metadata">

**Author:** [@apanimesh061](https://discuss.elastic.co/u/apanimesh061)\
**Replies:** 1\
**Last updated:** [July 31, 2015, 11:43pm UTC](https://discuss.elastic.co/t/exception-occurring-when-try-to-query-a-local-elasticsearch-node/26657 "2015-07-31T23:43:48Z")

</div>

public class EsNode { private static File tempFile; private static File homeDir ; private static File confDir ; private static File dataDir ; private static Settings defaultSettings; private Node…

---

## [Split string into array and then into key value pairs](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741)

<div class="topic-metadata">

**Author:** [@edster](https://discuss.elastic.co/u/edster)\
**Replies:** 2\
**Last updated:** [February 18, 2021, 7:06pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741 "2021-02-18T19:06:18Z")

</div>

Is there a way to split a string into an array and then turn each of those values into key value pairs within the array using logstash. For example: Turning this: SomeField -\> "key1:value1;key2:value2;key3:value3" In…

---

## [Snapshot is very very slow](https://discuss.elastic.co/t/snapshot-is-very-very-slow/86525)

<div class="topic-metadata">

**Author:** [@Balamurali](https://discuss.elastic.co/u/Balamurali)\
**Replies:** 2\
**Last updated:** [May 22, 2017, 4:44am UTC](https://discuss.elastic.co/t/snapshot-is-very-very-slow/86525 "2017-05-22T04:44:49Z")

</div>

Hii all, We are using ES 1.3.7 cluster with 6GB heap and we are on ES upgradation process Snapshot taking duration is very very slow last few days FYI , our snapshot repo has more than 1000 snapshots in it . Wh…

---

## [Collecting log files in addition to Windows event logs](https://discuss.elastic.co/t/collecting-log-files-in-addition-to-windows-event-logs/59998)

<div class="topic-metadata">

**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Replies:** 2\
**Last updated:** [September 7, 2016, 8:16pm UTC](https://discuss.elastic.co/t/collecting-log-files-in-addition-to-windows-event-logs/59998 "2016-09-07T20:16:07Z")

</div>

Hi, all. I'm tasked with trying to get certain application logs captured by ELK. I have Winlogbeat working on a test server, and it's forwarding Event Logs. Is there a way (as with Filebeat) to capture logs from, say…

---

## [【Windows】pipe\\\\elastic-agent-system: Access is denied](https://discuss.elastic.co/t/windows-pipe-elastic-agent-system-access-is-denied/316344)

<div class="topic-metadata">

**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\
**Replies:** 4\
**Last updated:** [November 18, 2022, 8:09am UTC](https://discuss.elastic.co/t/windows-pipe-elastic-agent-system-access-is-denied/316344 "2022-11-18T08:09:59Z")

</div>

I am installing Elastic Agent 8.4.1 on a Win10 system using the command line and I get the following error and the server fleet keeps showing updates, how do I fix it? The error is displayed： Error: failed to communica…

---

## [Get Raw JSON file with half a million lines into elasticsearch](https://discuss.elastic.co/t/get-raw-json-file-with-half-a-million-lines-into-elasticsearch/80499)

<div class="topic-metadata">

**Author:** [@shookshank](https://discuss.elastic.co/u/shookshank)\
**Replies:** 4\
**Last updated:** [March 29, 2017, 5:07pm UTC](https://discuss.elastic.co/t/get-raw-json-file-with-half-a-million-lines-into-elasticsearch/80499 "2017-03-29T17:07:51Z")

</div>

Hi guys, I feel like 'ive tried just about everything to achieve this to no success, so I won't bother going into great detail about all my tests. So far ive attempted getting my Raw JSON file into elasticsearch using …

---

## [Extend Mapping](https://discuss.elastic.co/t/extend-mapping/9431)

<div class="topic-metadata">

**Author:** [@Christopher\_Jennewei](https://discuss.elastic.co/u/Christopher_Jennewei)\
**Replies:** 4\
**Last updated:** [October 22, 2012, 5:23pm UTC](https://discuss.elastic.co/t/extend-mapping/9431 "2012-10-22T17:23:32Z")

</div>

Hi, I'm new to ES and just joined a project that's been using it for awhile, so they have everything up and running. I'm now trying to extend the mapping of one of their indices, but having a hard time figuring how t…

---

## [Multiple filebeat instances in single docker container?](https://discuss.elastic.co/t/multiple-filebeat-instances-in-single-docker-container/177335)

<div class="topic-metadata">

**Author:** [@JJB](https://discuss.elastic.co/u/JJB)\
**Replies:** 3\
**Last updated:** [April 17, 2019, 9:10pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-in-single-docker-container/177335 "2019-04-17T21:10:05Z")

</div>

I am running 4 docker containers for ELKB. I have a Filebeat set up to bring in log files from a volume folder and a logstash filter to process the log files (they're of the same format). I now have another set of log f…

---

## [Adding keyword field to existing index text field for term agg / word autocomplete](https://discuss.elastic.co/t/adding-keyword-field-to-existing-index-text-field-for-term-agg-word-autocomplete/164475)

<div class="topic-metadata">

**Author:** [@justinmoser](https://discuss.elastic.co/u/justinmoser)\
**Replies:** 0\
**Last updated:** [January 16, 2019, 1:27pm UTC](https://discuss.elastic.co/t/adding-keyword-field-to-existing-index-text-field-for-term-agg-word-autocomplete/164475 "2019-01-16T13:27:08Z")

</div>

Hi, I want to be able to search two text fields on both full text search and keyword based for aggregation so that I can implement single word autocomplete, similar to the discussion here: However when i created the …

---

## [Certutil does not produce keystore with 3 files but only 2](https://discuss.elastic.co/t/certutil-does-not-produce-keystore-with-3-files-but-only-2/115585)

<div class="topic-metadata">

**Author:** [@mpetronic](https://discuss.elastic.co/u/mpetronic)\
**Replies:** 3\
**Last updated:** [January 17, 2018, 3:12pm UTC](https://discuss.elastic.co/t/certutil-does-not-produce-keystore-with-3-files-but-only-2/115585 "2018-01-17T15:12:17Z")

</div>

Trying to setup and secure a new cluster for first time with x-pack. Running 6.1.1 all around. I generated my own ca.crt and ca.key using: /usr/share/elasticsearch/bin/x-pack/certutil ca --ca-dn CN=Quasar --days 3650 -…

---

## [Error on indexing remote es cluster using spark on ES 5 alpha3](https://discuss.elastic.co/t/error-on-indexing-remote-es-cluster-using-spark-on-es-5-alpha3/53164)

<div class="topic-metadata">

**Author:** [@deepakas](https://discuss.elastic.co/u/deepakas)\
**Replies:** 3\
**Last updated:** [March 1, 2017, 6:58am UTC](https://discuss.elastic.co/t/error-on-indexing-remote-es-cluster-using-spark-on-es-5-alpha3/53164 "2017-03-01T06:58:32Z")

</div>

Hi , I am getting the following error when I try to index a remote cluster using spark. It works fine locally in my Mac when I try to index on the elasticsearch instance on the Mac.I tried passing the es.nodes.wan.only a…

---

## [How to apply multiple geo\_distance filters to match any of multiple locations?](https://discuss.elastic.co/t/how-to-apply-multiple-geo-distance-filters-to-match-any-of-multiple-locations/6947)

<div class="topic-metadata">

**Author:** [@Jim\_2](https://discuss.elastic.co/u/Jim_2)\
**Replies:** 3\
**Last updated:** [March 14, 2012, 2:33pm UTC](https://discuss.elastic.co/t/how-to-apply-multiple-geo-distance-filters-to-match-any-of-multiple-locations/6947 "2012-03-14T14:33:07Z")

</div>

I've indexed a document like below: curl -XPUT 'http://localhost:9200/people/person/1' -d' { "locations": \[ { "location": "51.0587013,-2.9499066", "id": 1 }, …

---

## [The index pattern associated with this object no longer exists](https://discuss.elastic.co/t/the-index-pattern-associated-with-this-object-no-longer-exists/157967)

<div class="topic-metadata">

**Author:** [@godfather7](https://discuss.elastic.co/u/godfather7)\
**Replies:** 1\
**Last updated:** [November 23, 2018, 10:44pm UTC](https://discuss.elastic.co/t/the-index-pattern-associated-with-this-object-no-longer-exists/157967 "2018-11-23T22:44:48Z")

</div>

Whenever i Save the graph, it is showing that There is a problem with this saved object. the error is The index pattern associated with this object no longer exists. i am sending winlogbeat data to kibana.

---

## [Logstash webhdfs example with Kerberos enabled hadoop cluster](https://discuss.elastic.co/t/logstash-webhdfs-example-with-kerberos-enabled-hadoop-cluster/51941)

<div class="topic-metadata">

**Author:** [@wuka1](https://discuss.elastic.co/u/wuka1)\
**Replies:** 1\
**Last updated:** [September 14, 2016, 7:50am UTC](https://discuss.elastic.co/t/logstash-webhdfs-example-with-kerberos-enabled-hadoop-cluster/51941 "2016-09-14T07:50:44Z")

</div>

configured the webhdfs\_helper.rb that client.kerberos = true /client.kerberos\_keytab="xxx" and installed the gssapi but still have such problem: Webhdfs check request failed. (namenode: 10.0.0.37:14000, Exception: undef…

---

## [Upload Billions data to ES in less time](https://discuss.elastic.co/t/upload-billions-data-to-es-in-less-time/188925)

<div class="topic-metadata">

**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\
**Replies:** 6\
**Last updated:** [July 8, 2019, 1:13pm UTC](https://discuss.elastic.co/t/upload-billions-data-to-es-in-less-time/188925 "2019-07-08T13:13:54Z")

</div>

Suppose I have 2 billion data in another database i.e. MySQL. I want to upload this amount of data to ES. The calculation is showing almost 10 days it will take to upload. But I need to do this task within a few hours. …

---

## [Logstash 2.4 - S3 output strange ${message} in file](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059)

<div class="topic-metadata">

**Author:** [@rbgeno7](https://discuss.elastic.co/u/rbgeno7)\
**Replies:** 6\
**Last updated:** [November 9, 2016, 12:08am UTC](https://discuss.elastic.co/t/logstash-2-4-s3-output-strange-message-in-file/65059 "2016-11-09T00:08:26Z")

</div>

Hi - The S3 output seems to be working in that I'm getting messages, but instead of the parsed output I'm getting a message variable ${message}. This happens in both the temp location and in S3. Output - root@ip-xx…

---

## [\[SOLVED\] Issue with runtime field](https://discuss.elastic.co/t/solved-issue-with-runtime-field/320618)

<div class="topic-metadata">

**Author:** [@abkrim](https://discuss.elastic.co/u/abkrim)\
**Replies:** 2\
**Last updated:** [December 6, 2022, 7:27pm UTC](https://discuss.elastic.co/t/solved-issue-with-runtime-field/320618 "2022-12-06T19:27:42Z")

</div>

If create a runtime field for searches with aggregations. PUT /work-analyzers/\_mapping { "runtime": { "total\_consumption": { "type": "double", "script": { "source": """ emit(doc\['pa1\_w'…

---

## [Cannot resolve method 'index' in 'RestClient'](https://discuss.elastic.co/t/cannot-resolve-method-index-in-restclient/259188)

<div class="topic-metadata">

**Author:** [@Murigipudi\_Revanth](https://discuss.elastic.co/u/Murigipudi_Revanth)\
**Replies:** 2\
**Last updated:** [December 20, 2020, 8:23am UTC](https://discuss.elastic.co/t/cannot-resolve-method-index-in-restclient/259188 "2020-12-20T08:23:50Z")

</div>

Hello, I'm using ElasticSearch 7.10 and trying to index a very sample document following the documentation from here - https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java-rest-high-document-index…

---

## [2 Node cluster questions](https://discuss.elastic.co/t/2-node-cluster-questions/114510)

<div class="topic-metadata">

**Author:** [@cosmo](https://discuss.elastic.co/u/cosmo)\
**Replies:** 2\
**Last updated:** [January 10, 2018, 2:21pm UTC](https://discuss.elastic.co/t/2-node-cluster-questions/114510 "2018-01-10T14:21:54Z")

</div>

Hello Appreciate this topic has lots of topics already, but I have a few specific (but general) questions; Use case: Web logs, cron logs, other logs into an elastic stack so devs can look at logs, spot problems etc. …

---

## [Logstash not able to reach Elasticsearch](https://discuss.elastic.co/t/logstash-not-able-to-reach-elasticsearch/82089)

<div class="topic-metadata">

**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\
**Replies:** 2\
**Last updated:** [April 14, 2017, 2:58am UTC](https://discuss.elastic.co/t/logstash-not-able-to-reach-elasticsearch/82089 "2017-04-14T02:58:02Z")

</div>

I am trying to run ELK in 3 separate docker containers but every time I get errors that Logstash is not able to reach Elasticsearch. The configuration is very simple, this is my logstash.conf file: input { file { …

---

## [Kibana unavailable](https://discuss.elastic.co/t/kibana-unavailable/316552)

<div class="topic-metadata">

**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\
**Replies:** 8\
**Last updated:** [October 14, 2022, 1:26pm UTC](https://discuss.elastic.co/t/kibana-unavailable/316552 "2022-10-14T13:26:45Z")

</div>

Hi, I am running into an issue: the kibana is not available. When I check the log it gives me the error that kibana version is not compliant with the version of elasticsearch. It looks like I have to downgrade it in ord…

---

## [Intercept transport client/http client actions](https://discuss.elastic.co/t/intercept-transport-client-http-client-actions/4108)

<div class="topic-metadata">

**Author:** [@Mustafa\_Sener](https://discuss.elastic.co/u/Mustafa_Sener)\
**Replies:** 8\
**Last updated:** [March 17, 2011, 7:50am UTC](https://discuss.elastic.co/t/intercept-transport-client-http-client-actions/4108 "2011-03-17T07:50:44Z")

</div>

Hi, Is it possible to intercept transport client actions? Basically we want to intercept action such as index to make some modifications on data before inserted. There will be many client around ES and we don't want t…

---

## [Elasticsearch terms aggregation with partition does not retuning equal bucket](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-retuning-equal-bucket/299346)

<div class="topic-metadata">

**Author:** [@truptir](https://discuss.elastic.co/u/truptir)\
**Replies:** 5\
**Last updated:** [March 14, 2022, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-partition-does-not-retuning-equal-bucket/299346 "2022-03-14T20:03:56Z")

</div>

I have an ES index and I fetch data using term aggregation and partition. I am using the cardinality aggregation to get the total number of buckets and calculating num\_partitions, using default size values 10. E.g. Ca…

---

## [Vega - rename layer/legend value names](https://discuss.elastic.co/t/vega-rename-layer-legend-value-names/254350)

<div class="topic-metadata">

**Author:** [@rbergen](https://discuss.elastic.co/u/rbergen)\
**Replies:** 5\
**Last updated:** [November 7, 2020, 5:55pm UTC](https://discuss.elastic.co/t/vega-rename-layer-legend-value-names/254350 "2020-11-07T17:55:40Z")

</div>

Hello, I'm trying to figure out how to rename my layer names from "\_source.checks\_total.policies\_checks\_result.passing" to just "Passing" and "\_source.checks\_total.policies\_checks\_result.failing" to just "Failing". I've…

---

## [Where to download predefined dashboard?](https://discuss.elastic.co/t/where-to-download-predefined-dashboard/208097)

<div class="topic-metadata">

**Author:** [@ashadp](https://discuss.elastic.co/u/ashadp)\
**Replies:** 1\
**Last updated:** [November 15, 2019, 6:15pm UTC](https://discuss.elastic.co/t/where-to-download-predefined-dashboard/208097 "2019-11-15T18:15:30Z")

</div>

I have installed ELK stack but don't see any predefined dashboard. Is there any place where I can just download only these dashboard? Thanks!

---

## [Not able to delete Kibana Index](https://discuss.elastic.co/t/not-able-to-delete-kibana-index/82044)

<div class="topic-metadata">

**Author:** [@jamesl](https://discuss.elastic.co/u/jamesl)\
**Replies:** 1\
**Last updated:** [April 12, 2017, 12:06am UTC](https://discuss.elastic.co/t/not-able-to-delete-kibana-index/82044 "2017-04-12T00:06:13Z")

</div>

Hi. I have a few index patterns which don't have any indices in Elasticsearch (it did but curl has deleted them out as they were old). Seems like a strange one because with 2.4 I was able to delete Kibana indexes with no…

---

## [Failed signature check](https://discuss.elastic.co/t/failed-signature-check/290046)

<div class="topic-metadata">

**Author:** [@WookWook](https://discuss.elastic.co/u/WookWook)\
**Replies:** 4\
**Last updated:** [November 25, 2021, 10:02am UTC](https://discuss.elastic.co/t/failed-signature-check/290046 "2021-11-25T10:02:01Z")

</div>

Hello, I got an extended trial license for "Elastic Cloud on Kubernetes". At least I expect the license is for that product. Following the instructions out of the mail for ECK. To install the license, please follow t…

---

## [Kibana "Discover Unknown error"](https://discuss.elastic.co/t/kibana-discover-unknown-error/122484)

<div class="topic-metadata">

**Author:** [@GustavoBalbino](https://discuss.elastic.co/u/GustavoBalbino)\
**Replies:** 4\
**Last updated:** [March 19, 2018, 2:33pm UTC](https://discuss.elastic.co/t/kibana-discover-unknown-error/122484 "2018-03-19T14:33:21Z")

</div>

Hello, i'm having trouble with kibana and i don't know what i have to do to keep this running. Kibana is giving me an error 'Discover:Unknown error'. \[imagem\] I'm using nginx as a proxy and https communication. When …

---

## [Multiple Group By in Time Series](https://discuss.elastic.co/t/multiple-group-by-in-time-series/149504)

<div class="topic-metadata">

**Author:** [@jproulx](https://discuss.elastic.co/u/jproulx)\
**Replies:** 3\
**Last updated:** [September 24, 2018, 6:22pm UTC](https://discuss.elastic.co/t/multiple-group-by-in-time-series/149504 "2018-09-24T18:22:26Z")

</div>

Hello all, I have something like a pub/sub system where an entry is added to Elasticsearch every time a subscriber is subscribed to a topic. The SubscriberAdded entry would look something like: { TopicId: "room1", Su…

---

## [Logstash syslog output to Arcsight](https://discuss.elastic.co/t/logstash-syslog-output-to-arcsight/64084)

<div class="topic-metadata">

**Author:** [@s802645](https://discuss.elastic.co/u/s802645)\
**Replies:** 3\
**Last updated:** [October 27, 2016, 8:31am UTC](https://discuss.elastic.co/t/logstash-syslog-output-to-arcsight/64084 "2016-10-27T08:31:35Z")

</div>

We are using LS to collect syslogs from a firewall and forwarding to siem. this is our config syslog { appname =\> "" host =\> "x.x.x.x" port =\> "5…

---

## [Json target based field value (or tag)?](https://discuss.elastic.co/t/json-target-based-field-value-or-tag/49350)

<div class="topic-metadata">

**Author:** [@robinpblanchard](https://discuss.elastic.co/u/robinpblanchard)\
**Replies:** 3\
**Last updated:** [June 12, 2016, 2:05pm UTC](https://discuss.elastic.co/t/json-target-based-field-value-or-tag/49350 "2016-06-12T14:05:16Z")

</div>

Hi, I'd like to dynamically set the json target based on a field value. I tried: target =\> "%{field}" with no success. Is there an easy way to accomplish this?

---

## [Distributed Transaction Tracing using Elastic Search](https://discuss.elastic.co/t/distributed-transaction-tracing-using-elastic-search/17057)

<div class="topic-metadata">

**Author:** [@Nitin\_Agarwal](https://discuss.elastic.co/u/Nitin_Agarwal)\
**Replies:** 0\
**Last updated:** [April 17, 2014, 6:27am UTC](https://discuss.elastic.co/t/distributed-transaction-tracing-using-elastic-search/17057 "2014-04-17T06:27:47Z")

</div>

Sometime back i did a basic Proof of Concept of Distributed Tracing, based on Google Dapper(http://research.google.com/pubs/pub36356.html ), using Elastic Search. Here is the Github link https://github.com/nitinka/D…

---

## [How to show multi field value in discover table](https://discuss.elastic.co/t/how-to-show-multi-field-value-in-discover-table/205863)

<div class="topic-metadata">

**Author:** [@prakhara](https://discuss.elastic.co/u/prakhara)\
**Replies:** 2\
**Last updated:** [November 1, 2019, 5:55pm UTC](https://discuss.elastic.co/t/how-to-show-multi-field-value-in-discover-table/205863 "2019-11-01T17:55:35Z")

</div>

I have created a field as multi field in elastic mapping, originalfield as text and originalfield.keyword as keyword for aggregation but while showing the data in discover table only I get the value in originalfield and …

---

## [Logstash to run in background services in Windows](https://discuss.elastic.co/t/logstash-to-run-in-background-services-in-windows/123604)

<div class="topic-metadata">

**Author:** [@vaishali1](https://discuss.elastic.co/u/vaishali1)\
**Replies:** 2\
**Last updated:** [March 13, 2018, 1:46pm UTC](https://discuss.elastic.co/t/logstash-to-run-in-background-services-in-windows/123604 "2018-03-13T13:46:50Z")

</div>

How to run the logstash automatically "Services" in Windows, once when the system restarted?

---

## [Can check data type before output?](https://discuss.elastic.co/t/can-check-data-type-before-output/67452)

<div class="topic-metadata">

**Author:** [@tao\_hiko](https://discuss.elastic.co/u/tao_hiko)\
**Replies:** 2\
**Last updated:** [November 29, 2016, 10:17am UTC](https://discuss.elastic.co/t/can-check-data-type-before-output/67452 "2016-11-29T10:17:49Z")

</div>

I'm using Logstash 5.0 and migrate data from ES 1.7 to ES 5.0 but I have a problem about conflicted data type on the same filed name but different type. How to check data type of each field? Because I cannot change …

---

## [Installing topbeats on a windows machine](https://discuss.elastic.co/t/installing-topbeats-on-a-windows-machine/33079)

<div class="topic-metadata">

**Author:** [@aviv.ratzon](https://discuss.elastic.co/u/aviv.ratzon)\
**Replies:** 2\
**Last updated:** [November 5, 2015, 9:36am UTC](https://discuss.elastic.co/t/installing-topbeats-on-a-windows-machine/33079 "2015-11-05T09:36:48Z")

</div>

Hi, I'm trying to install topbeats, but when I run the command in power shell it doesn't ouput anything and when trying to start the service it says it can't find it. The only thing the installation does is replace the …

---

## [Delete all entries from a type](https://discuss.elastic.co/t/delete-all-entries-from-a-type/16642)

<div class="topic-metadata">

**Author:** [@bruskie24](https://discuss.elastic.co/u/bruskie24)\
**Replies:** 2\
**Last updated:** [March 27, 2014, 2:28pm UTC](https://discuss.elastic.co/t/delete-all-entries-from-a-type/16642 "2014-03-27T14:28:38Z")

</div>

Is there a method of deleting all entries in a specific type in an Index without deleting the whole type and also preserving the mapping for that type? I want to clear out a type without having to reindex or remove the t…

---

## [Reporting / watcher - Request Timeout after 30000ms](https://discuss.elastic.co/t/reporting-watcher-request-timeout-after-30000ms/161348)

<div class="topic-metadata">

**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Replies:** 1\
**Last updated:** [December 19, 2018, 4:52pm UTC](https://discuss.elastic.co/t/reporting-watcher-request-timeout-after-30000ms/161348 "2018-12-19T16:52:38Z")

</div>

Hi All, I recently upgraded from ELK 6.2.4 to 6.5.3 and my watchers are getting a timeout error. We have platinum license install on this cluster. The error I am getting in this one: { "type": "error", "@timestamp":…

---

## [Connection Error from Java client](https://discuss.elastic.co/t/connection-error-from-java-client/88923)

<div class="topic-metadata">

**Author:** [@jpardi](https://discuss.elastic.co/u/jpardi)\
**Replies:** 1\
**Last updated:** [June 10, 2017, 8:05pm UTC](https://discuss.elastic.co/t/connection-error-from-java-client/88923 "2017-06-10T20:05:58Z")

</div>

Config: Ubuntu host running ES 5.3.2 in docker container. Ports 9200 and 9300 exposed. using Spring Boot Data (Java) as the client, running on the Ubuntu host from host, telnet to port 9200 works fine from host, curl …

---

## [Recent data missing in dashboard/visualizations](https://discuss.elastic.co/t/recent-data-missing-in-dashboard-visualizations/124119)

<div class="topic-metadata">

**Author:** [@Malachi](https://discuss.elastic.co/u/Malachi)\
**Replies:** 6\
**Last updated:** [March 16, 2018, 3:06pm UTC](https://discuss.elastic.co/t/recent-data-missing-in-dashboard-visualizations/124119 "2018-03-16T15:06:12Z")

</div>

Hello, I seem to have an issue with recent data not being available for visualizations or dashboards in Kibana. I have winlogbeats data from several servers that goes into my ELK stack. I have saved searches for this da…

---

## [Using ES as a primary datastore](https://discuss.elastic.co/t/using-es-as-a-primary-datastore/19839)

<div class="topic-metadata">

**Author:** [@P\_Suman](https://discuss.elastic.co/u/P_Suman)\
**Replies:** 6\
**Last updated:** [November 24, 2014, 8:43pm UTC](https://discuss.elastic.co/t/using-es-as-a-primary-datastore/19839 "2014-11-24T20:43:26Z")

</div>

Hello, We are planning to use ES as a primary datastore. Here is my usecase We receive a million transactions per day (all are inserts). Each transaction is around 500KB size, transaction has 10 fields we sh…

---

## [No histogram in Discover](https://discuss.elastic.co/t/no-histogram-in-discover/155308)

<div class="topic-metadata">

**Author:** [@danielkhan](https://discuss.elastic.co/u/danielkhan)\
**Replies:** 5\
**Last updated:** [November 5, 2018, 7:13pm UTC](https://discuss.elastic.co/t/no-histogram-in-discover/155308 "2018-11-05T19:13:25Z")

</div>

Hello, I am using kibana to browse data from syslog. I previous setups I always got a histogram on the Discover tab. For unknown reasons, it does not show up in my latest deployment. I have a time field in my log messa…

[Previous page](https://discuss.elastic.co/top.md?page=933&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=935&per_page=50&period=all)
