# Top **URL:** https://discuss.elastic.co/top.md?page=936&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 937 --- ## [Any risks with temporarily disable rebalancing?](https://discuss.elastic.co/t/any-risks-with-temporarily-disable-rebalancing/63315)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [October 18, 2016, 7:43pm UTC](https://discuss.elastic.co/t/any-risks-with-temporarily-disable-rebalancing/63315 "2016-10-18T19:43:33Z")
I just added several new nodes to my cluster. It kicked of a ton of rebalancing jobs which I think are slowing performance, since some of them are on large indices. I found the api call to disable and control rebalanci… --- ## [ES\_JAVA\_OPTS ignored](https://discuss.elastic.co/t/es-java-opts-ignored/9960)
**Author:** [@Hans1](https://discuss.elastic.co/u/Hans1)\ **Replies:** 3\ **Last updated:** [December 6, 2012, 11:18pm UTC](https://discuss.elastic.co/t/es-java-opts-ignored/9960 "2012-12-06T23:18:32Z")
1. Installed ES 0.20.0.RC1 from .deb 2. Starting up, the log shows a warning (~ "JVM should be configured with -server flag") So I tried exporting ES\_JAVA\_OPTS="-server", echo $ES\_JAVA\_OPTS shows "-server" But t… --- ## [Elastic Search on google App engine](https://discuss.elastic.co/t/elastic-search-on-google-app-engine/2916)
**Author:** [@user515](https://discuss.elastic.co/u/user515)\ **Replies:** 3\ **Last updated:** [April 17, 2010, 7:15am UTC](https://discuss.elastic.co/t/elastic-search-on-google-app-engine/2916 "2010-04-17T07:15:54Z")
Is elastic search compatible with google appengine? Are any examples available? --- ## [No logstash pipeline](https://discuss.elastic.co/t/no-logstash-pipeline/276620)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 4\ **Last updated:** [June 23, 2021, 9:55am UTC](https://discuss.elastic.co/t/no-logstash-pipeline/276620 "2021-06-23T09:55:33Z")
Hello everyone, I followed this tutorial to enable tls on elasticsearch, kibana, logstash and filebeat : I think logstash don't send logs to kibana but I don't know where to find the information Thank you in advance … --- ## [Can I trust a PIT id once it has been replaced by a new PIT id?](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054)
**Author:** [@Snav](https://discuss.elastic.co/u/Snav)\ **Replies:** 4\ **Last updated:** [April 27, 2021, 3:39pm UTC](https://discuss.elastic.co/t/can-i-trust-a-pit-id-once-it-has-been-replaced-by-a-new-pit-id/271054 "2021-04-27T15:39:06Z")
Hello there, I was wondering how the Point In Time works internally and if it is trustable for parallelization. Context Given this implementation: I have a search request to retrieve a list of offers. It may return … --- ## [Logstash Ruby filter error](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 4\ **Last updated:** [August 17, 2020, 3:29pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-error/245216 "2020-08-17T15:29:17Z")
Hello all, Running Logstash v7.8.1. Ruby codec v3.1.5. Been playing around using the ruby filter plugin. Great filter plugin btw!! I have a couple of logstash confs that have small ruby script filters. While all the f… --- ## [Shard rebalance issue](https://discuss.elastic.co/t/shard-rebalance-issue/191656)
**Author:** [@vangogh94](https://discuss.elastic.co/u/vangogh94)\ **Replies:** 4\ **Last updated:** [July 23, 2019, 11:47am UTC](https://discuss.elastic.co/t/shard-rebalance-issue/191656 "2019-07-23T11:47:40Z")
Running ES v7.2.0. We excluded data from node 'es-dbs-022' using cluster.routing.allocation.exclude.\_name because of some unrelated reasons. After some time we returned the node back to cluster using the same API (setti… --- ## [Postgresql Module?](https://discuss.elastic.co/t/postgresql-module/150633)
**Author:** [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Replies:** 4\ **Last updated:** [October 5, 2018, 4:15am UTC](https://discuss.elastic.co/t/postgresql-module/150633 "2018-10-05T04:15:47Z")
Hi, I was wondering if someone could shed some light. currently have Kibana 6 with logstash and elasticsearch. The idea is one VM which has the postgresql to send the logs using filebeat to another VM which has ELK, I … --- ## [Pipeline was Ignoring Logstash](https://discuss.elastic.co/t/pipeline-was-ignoring-logstash/221343)
**Author:** [@muhjaury](https://discuss.elastic.co/u/muhjaury)\ **Replies:** 5\ **Last updated:** [February 29, 2020, 3:38pm UTC](https://discuss.elastic.co/t/pipeline-was-ignoring-logstash/221343 "2020-02-29T15:38:43Z")
I'm newbie for using Logstash and Elasticsearch. I wanted to sync my MongoDB data into Elasticsearch using Logstash Plugin (logstash-input-mongodb). In my mongodata.conf is input { uri =\> 'mongodb://127.0.0.1:27017/f… --- ## [How to get data in Painless script variable](https://discuss.elastic.co/t/how-to-get-data-in-painless-script-variable/84960)
**Author:** [@cnallapati](https://discuss.elastic.co/u/cnallapati)\ **Replies:** 5\ **Last updated:** [May 8, 2017, 9:38pm UTC](https://discuss.elastic.co/t/how-to-get-data-in-painless-script-variable/84960 "2017-05-08T21:38:52Z")
Hi, One of a field(url) stores 'url' information and I am trying to get it's value from painless script by doc\['url.keyword'\].value .Sometimes if the value is less then 100 characters it's getting but not for more than… --- ## [How can backup all Logs of elk server](https://discuss.elastic.co/t/how-can-backup-all-logs-of-elk-server/122688)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 1\ **Last updated:** [March 6, 2018, 2:03pm UTC](https://discuss.elastic.co/t/how-can-backup-all-logs-of-elk-server/122688 "2018-03-06T14:03:17Z")
I install elk server on a new pc. all configuration are same. How can I back up 6 months logs of elk-server to transfer new elk-server. Thanks --- ## [Elasticsearch script doesn't work](https://discuss.elastic.co/t/elasticsearch-script-doesnt-work/77248)
**Author:** [@dd.ho](https://discuss.elastic.co/u/dd.ho)\ **Replies:** 1\ **Last updated:** [March 3, 2017, 4:02am UTC](https://discuss.elastic.co/t/elasticsearch-script-doesnt-work/77248 "2017-03-03T04:02:39Z")
I use elasticsearch head plugin to search, as this: { "query": { "filtered": { "filter": { "script": { "script": "doc\[\\"indexTime\\"\].value \< param1", "params" : { "param1" : 80 } } }, "query": { "match\_all": {} } } } } … --- ## [Disable field index](https://discuss.elastic.co/t/disable-field-index/153950)
**Author:** [@hitesh-inbetween](https://discuss.elastic.co/u/hitesh-inbetween)\ **Replies:** 6\ **Last updated:** [November 6, 2018, 9:53am UTC](https://discuss.elastic.co/t/disable-field-index/153950 "2018-11-06T09:53:39Z")
Is it possible to toggle searchable field. My index contains around 3000 fields and 1200k documents, at times I see memory issues. On further analysis, I found that due to large number of fields, not all fields are avai… --- ## [Filebeat Error while initializing input](https://discuss.elastic.co/t/filebeat-error-while-initializing-input/188791)
**Author:** [@bizomb](https://discuss.elastic.co/u/bizomb)\ **Replies:** 2\ **Last updated:** [July 10, 2019, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-error-while-initializing-input/188791 "2019-07-10T16:23:43Z")
I am trying to get data to send logs to kibana and when try to run filebeat -e -c filebeat.yml -d "publish" or filebeat -e I get error Exiting: Error interpreting the template of the input: template: text:3:22: executing… --- ## [Can i have 0 shards?](https://discuss.elastic.co/t/can-i-have-0-shards/148226)
**Author:** [@ana1](https://discuss.elastic.co/u/ana1)\ **Replies:** 2\ **Last updated:** [September 12, 2018, 3:45am UTC](https://discuss.elastic.co/t/can-i-have-0-shards/148226 "2018-09-12T03:45:07Z")
Hi guys, Sorry i am new in elastic and i didnt find my question, what happen if i only have one node and the size of my indices are small. Can i put 0 shards? i mean i didnt see the reason to put more, because if i put … --- ## [Split event by an object of objects into separate events](https://discuss.elastic.co/t/split-event-by-an-object-of-objects-into-separate-events/90382)
**Author:** [@berg](https://discuss.elastic.co/u/berg)\ **Replies:** 2\ **Last updated:** [June 22, 2017, 11:43pm UTC](https://discuss.elastic.co/t/split-event-by-an-object-of-objects-into-separate-events/90382 "2017-06-22T23:43:19Z")
I am attempting to use the logstash-filter-metric plugin to produce metrics split by the source \[host\] of the events. We have \> 1000 different log sources, and being able to track where all the logs are coming from acros… --- ## [Starting a continuous Transform](https://discuss.elastic.co/t/starting-a-continuous-transform/248839)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [September 17, 2020, 6:20am UTC](https://discuss.elastic.co/t/starting-a-continuous-transform/248839 "2020-09-17T06:20:17Z")
I'm setting up a new ELK instance and want to have some continuous transforms running on it. So I load up may table definitions, my transform definitions, bootstrap the transfrom datasets and tell ELK to start them runn… --- ## [Query using array values against String value](https://discuss.elastic.co/t/query-using-array-values-against-string-value/227851)
**Author:** [@ngr](https://discuss.elastic.co/u/ngr)\ **Replies:** 8\ **Last updated:** [April 17, 2020, 6:01am UTC](https://discuss.elastic.co/t/query-using-array-values-against-string-value/227851 "2020-04-17T06:01:16Z")
version : "6.5.4" I have mapping like : { "examples" : { "mappings" : { "example" : { "properties" : { // ... "petGender" : { "type" : "text" } … --- ## [Extract a timestamp between square brackets \[SOLVED\]](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 3\ **Last updated:** [June 8, 2018, 12:55pm UTC](https://discuss.elastic.co/t/extract-a-timestamp-between-square-brackets-solved/135014 "2018-06-08T12:55:52Z")
I need to extract the timestamp from this line: \[Tue, 07 Jun 2018 15:53:29 +0200\] codedeploy-agent started 1)) I've tried the following filter: mutate { copy =\> { "message" =\> "ts" } gsub =\> \[ "ts", "\\\[", "" \] … --- ## [Installation Woes on Ubuntu/Linux](https://discuss.elastic.co/t/installation-woes-on-ubuntu-linux/125482)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 8\ **Last updated:** [March 29, 2018, 9:26am UTC](https://discuss.elastic.co/t/installation-woes-on-ubuntu-linux/125482 "2018-03-29T09:26:16Z")
Tried out installing Elastic, Logstash and Kibana on Ubuntu 17.6 (running on VMWare Player on Windows 10) and it was a bit difficult. Not sure if it's because I'm not a Linux guru or what. Installing elasticsearch via… --- ## [Performance difference between \_source and fields with store](https://discuss.elastic.co/t/performance-difference-between--source-and-fields-with-store/4324)
**Author:** [@Mustafa\_Sener](https://discuss.elastic.co/u/Mustafa_Sener)\ **Replies:** 3\ **Last updated:** [June 27, 2017, 2:18pm UTC](https://discuss.elastic.co/t/performance-difference-between--source-and-fields-with-store/4324 "2017-06-27T14:18:20Z")
Hi, I use ES with version 0.16.0. I tested performance using two mapping configuration with a document having 50 string properties. 1. \_source property is disabled, \_all property is disabled and specified … --- ## [Launch simultaneous multiples logtsatash's files configuration](https://discuss.elastic.co/t/launch-simultaneous-multiples-logtsatashs-files-configuration/40108)
**Author:** [@Diyal](https://discuss.elastic.co/u/Diyal)\ **Replies:** 8\ **Last updated:** [January 27, 2016, 3:00pm UTC](https://discuss.elastic.co/t/launch-simultaneous-multiples-logtsatashs-files-configuration/40108 "2016-01-27T15:00:00Z")
Hi, I need to launch simultaneous multiples logtsatash's files configuration . Is it possible with this only command ? =\> bin/logstash agent -f logstashfile1.conf logstashfile2.conf logstashfile3.conf Thanks, --- ## [Health always yellow status](https://discuss.elastic.co/t/health-always-yellow-status/9258)
**Author:** [@zkidkid](https://discuss.elastic.co/u/zkidkid)\ **Replies:** 3\ **Last updated:** [October 7, 2012, 8:08am UTC](https://discuss.elastic.co/t/health-always-yellow-status/9258 "2012-10-07T08:08:33Z")
Hi, I start the ES with bellow config. node.master: true node.data: true index.number\_of\_shards: 5 index.number\_of\_replicas: 1 index: analysis: analyzer: default: tokenizer: lo… --- ## [Is it possible to install multiple agents concurrently on the same host?](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [April 4, 2024, 8:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646 "2024-04-04T08:37:16Z")
Hi, We are planning to start monitoring our appliances (Windows server based) installed at customers sites using elastic-agent. However, some of our clients have their own elastic-agent already running on our appliance,… --- ## [Working with key:value arrays](https://discuss.elastic.co/t/working-with-key-value-arrays/283772)
**Author:** [@awer1967](https://discuss.elastic.co/u/awer1967)\ **Replies:** 4\ **Last updated:** [September 10, 2021, 1:06am UTC](https://discuss.elastic.co/t/working-with-key-value-arrays/283772 "2021-09-10T01:06:04Z")
Good day ! Accordingly to my logstash configuration I get a message with an array consists of key:value pairs. I have to mutate it on a very special way adding two fields and put there the key and the value . For examp… --- ## [\[Multiline\]Data following newline is ignored](https://discuss.elastic.co/t/multiline-data-following-newline-is-ignored/193733)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 4\ **Last updated:** [August 6, 2019, 1:33am UTC](https://discuss.elastic.co/t/multiline-data-following-newline-is-ignored/193733 "2019-08-06T01:33:34Z")
Hi, I have a csv file that contains a double quoted field with a empty line. I am trying to convert this to a single line using the multiline codec so I can filter it later on using the csv filter. csv example number… --- ## [Should we remove "delete" feature for users?](https://discuss.elastic.co/t/should-we-remove-delete-feature-for-users/57982)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 4\ **Last updated:** [August 14, 2016, 12:39pm UTC](https://discuss.elastic.co/t/should-we-remove-delete-feature-for-users/57982 "2016-08-14T12:39:02Z")
Continuing the discussion from Post deleted by author: I think we should not allow people to remove content. Thoughts? --- ## [Is there a Hadoop Inputformat to read ES snapshot files in Hadoop?](https://discuss.elastic.co/t/is-there-a-hadoop-inputformat-to-read-es-snapshot-files-in-hadoop/36817)
**Author:** [@bewang.tech](https://discuss.elastic.co/u/bewang.tech)\ **Replies:** 4\ **Last updated:** [June 3, 2016, 7:56am UTC](https://discuss.elastic.co/t/is-there-a-hadoop-inputformat-to-read-es-snapshot-files-in-hadoop/36817 "2016-06-03T07:56:35Z")
I need to import the data in an ElasticSearch cluster, but I may not read the cluster directly. I knew I could restore the snapshot into a cluster. I just wondering if I can read the sanpshot file directly from Hadoop. … --- ## [Word matching (partial and full)](https://discuss.elastic.co/t/word-matching-partial-and-full/48618)
**Author:** [@ASN](https://discuss.elastic.co/u/ASN)\ **Replies:** 4\ **Last updated:** [April 28, 2016, 6:03am UTC](https://discuss.elastic.co/t/word-matching-partial-and-full/48618 "2016-04-28T06:03:42Z")
Lets say I have a document indexed to ES with content: "Tim Cook revealed during the earnings call that iPhone sales in India grew by 56% on a yearly basis, despite the company's first global sales decline in 13 years.… --- ## [Filebeat service wont start even after 'test output' and 'setup -e' shows positive results](https://discuss.elastic.co/t/filebeat-service-wont-start-even-after-test-output-and-setup-e-shows-positive-results/322416)
**Author:** [@Hari\_Krishnan1](https://discuss.elastic.co/u/Hari_Krishnan1)\ **Replies:** 5\ **Last updated:** [January 4, 2023, 6:03am UTC](https://discuss.elastic.co/t/filebeat-service-wont-start-even-after-test-output-and-setup-e-shows-positive-results/322416 "2023-01-04T06:03:59Z")
Hello community! , I am quite new to filebeat and logstash and I am looking to append logs from a node application into kibana using filebeat and logstash. I have tried the following steps from the documentation provid… --- ## [CSV Export not available when xpack.reporting.roles.enabled set to false](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 5\ **Last updated:** [September 15, 2022, 1:49pm UTC](https://discuss.elastic.co/t/csv-export-not-available-when-xpack-reporting-roles-enabled-set-to-false/313445 "2022-09-15T13:49:48Z")
Hi, since the xpack.reporting.roles settings are deprecated since v7.14.0, I have disabled the use of the reporting role in our 7.17.6 environment by setting: xpack.reporting.roles.enabled: false The new subfeatures … --- ## [Grok filter 2 different logs](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 5\ **Last updated:** [June 9, 2016, 8:00pm UTC](https://discuss.elastic.co/t/grok-filter-2-different-logs/51818 "2016-06-09T20:00:58Z")
Hi, I am trying to use the following grok filter to extract fields from log file, The log file contains 2 different style of logs, hence I wrote 2 different queries to tackle the 2 logs. However, it's failing on one of t… --- ## [Updating unicast node list without restarting](https://discuss.elastic.co/t/updating-unicast-node-list-without-restarting/40533)
**Author:** [@agp](https://discuss.elastic.co/u/agp)\ **Replies:** 5\ **Last updated:** [February 3, 2016, 7:23pm UTC](https://discuss.elastic.co/t/updating-unicast-node-list-without-restarting/40533 "2016-02-03T19:23:54Z")
Hi, I have gone through a lot of threads around this topic and it seems like the answer is No, but just wanted to confirm. Here are the details: 1) Can't use multicast 2) Most common scenario will have only 2 nodes (he… --- ## [Index Naming](https://discuss.elastic.co/t/index-naming/126584)
**Author:** [@mmethe](https://discuss.elastic.co/u/mmethe)\ **Replies:** 6\ **Last updated:** [April 4, 2018, 7:14pm UTC](https://discuss.elastic.co/t/index-naming/126584 "2018-04-04T19:14:27Z")
How do I get my index named properly? I have an index appearing as: %{\[@metadata\]\[beat\]}-2018.04.03 While my beats appear properly as: winlogbeat-2017.12.19 winlogbeat-2017.12.20 My conf: input { beats { port =\> … --- ## [Live config reload](https://discuss.elastic.co/t/live-config-reload/39611)
**Author:** [@TigranTsat](https://discuss.elastic.co/u/TigranTsat)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 6:36pm UTC](https://discuss.elastic.co/t/live-config-reload/39611 "2016-01-20T18:36:35Z")
Hello. Looks like currently there is no way for config live reload (please, correct me if I am wrong). And the only option is to shutdown logstash and start it again. In that case, question - how much logs I will loose… --- ## [Date fields not being treated as timestamp fields in Kibana index patterns](https://discuss.elastic.co/t/date-fields-not-being-treated-as-timestamp-fields-in-kibana-index-patterns/295310)
**Author:** [@abhinav\_chourasia](https://discuss.elastic.co/u/abhinav_chourasia)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 8:17pm UTC](https://discuss.elastic.co/t/date-fields-not-being-treated-as-timestamp-fields-in-kibana-index-patterns/295310 "2022-01-25T20:17:44Z")
I have been trying to get the mapping correct for my date values in my documents. I have come down to doing a lot of hit and trial now with it. Every time and no matter what option I try, I am not getting the date field … --- ## [Getting errors after Logstash upgrade from 7.6.2 to 7.9.2](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370)
**Author:** [@yummycake](https://discuss.elastic.co/u/yummycake)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 7:33am UTC](https://discuss.elastic.co/t/getting-errors-after-logstash-upgrade-from-7-6-2-to-7-9-2/251370 "2020-10-08T07:33:11Z")
I recently upgraded my Logstash from 7.6.2 to the latest version 7.9.2. When I tested my configuration file, I received the output below. I did not get the error below output when I tested with version 7.6.2 May I know … --- ## [Backing up a multi-node cluster with \_snapshot](https://discuss.elastic.co/t/backing-up-a-multi-node-cluster-with--snapshot/62291)
**Author:** [@skynardo](https://discuss.elastic.co/u/skynardo)\ **Replies:** 2\ **Last updated:** [October 5, 2016, 6:21pm UTC](https://discuss.elastic.co/t/backing-up-a-multi-node-cluster-with--snapshot/62291 "2016-10-05T18:21:30Z")
I'm thinking this is a "dumb" question but I have not been able to find the answer online. I have setup and tested using \_snapshot to backup and restore my single node ES test cluster. I need to set this up for our produ… --- ## [An unknown error occurred sending a bulk request to Elasticsearch. We will retry indefinitely {:error\_message=\>"\\"\\\\xB0\\" from ASCII-8BIT to UTF-8"](https://discuss.elastic.co/t/an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch-we-will-retry-indefinitely-error-message-xb0-from-ascii-8bit-to-utf-8/220906)
**Author:** [@m.a\_farazuddin](https://discuss.elastic.co/u/m.a_farazuddin)\ **Replies:** 1\ **Last updated:** [February 26, 2020, 9:42pm UTC](https://discuss.elastic.co/t/an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch-we-will-retry-indefinitely-error-message-xb0-from-ascii-8bit-to-utf-8/220906 "2020-02-26T21:42:07Z")
I am trying to query v$active\_session\_history table from logstash with below config file and I bump into the error due to column XID of RAW Type - I am also using container to set up my ELK configuration I am trying to… --- ## [Aggregating Source IP and Destination IP pairs on Firewall logs](https://discuss.elastic.co/t/aggregating-source-ip-and-destination-ip-pairs-on-firewall-logs/186007)
**Author:** [@dushank](https://discuss.elastic.co/u/dushank)\ **Replies:** 1\ **Last updated:** [June 21, 2019, 2:21pm UTC](https://discuss.elastic.co/t/aggregating-source-ip-and-destination-ip-pairs-on-firewall-logs/186007 "2019-06-21T14:21:06Z")
Our SIEM collects logs from many firewall and stores in a Elasticsearch 5.6 repository. We want to retrieve data for Source and destination IP communication on certain ports. The idea is to find the top communicators and… --- ## [Problem with 'not\_x\_content\_exception'](https://discuss.elastic.co/t/problem-with-not-x-content-exception/169713)
**Author:** [@edwardke](https://discuss.elastic.co/u/edwardke)\ **Replies:** 1\ **Last updated:** [February 25, 2019, 9:30am UTC](https://discuss.elastic.co/t/problem-with-not-x-content-exception/169713 "2019-02-25T09:30:13Z")
Hi, I'm trying to put some data into my elastic cloud instance using Postman. I set the headers to be 'Content-Type' - 'application/json', and the body is a valid json object. I am trying to do a PUT request to a new i… --- ## [All shards failing error](https://discuss.elastic.co/t/all-shards-failing-error/266303)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [March 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/all-shards-failing-error/266303 "2021-03-06T23:02:55Z")
I am having problems with an application (Arkime) which uses ES to store its data. When it does long searches these time out and on looking at the logs I find errors from ES. The same errors are in the ES logs and I hav… --- ## [APM Server has still not connected to Elasticsearch"](https://discuss.elastic.co/t/apm-server-has-still-not-connected-to-elasticsearch/244069)
**Author:** [@mdamera](https://discuss.elastic.co/u/mdamera)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 6:57am UTC](https://discuss.elastic.co/t/apm-server-has-still-not-connected-to-elasticsearch/244069 "2020-08-12T06:57:42Z")
Hi Guys, We have installed APM server and config it to connect to my elastic, when i click " APM Server status" button i get the following message: "APM Server has still not connected to Elasticsearch" this is what I … --- ## [Mapping conflict on deleted indices?](https://discuss.elastic.co/t/mapping-conflict-on-deleted-indices/207003)
**Author:** [@Evan\_Ravenelle](https://discuss.elastic.co/u/Evan_Ravenelle)\ **Replies:** 3\ **Last updated:** [November 16, 2019, 11:32am UTC](https://discuss.elastic.co/t/mapping-conflict-on-deleted-indices/207003 "2019-11-16T11:32:31Z")
I am seeing a mapping conflict on "message" field because in some older indices, "message" data type was set to "text" while in others it is "string." This is preventing me from using the field in any sort of analysis i… --- ## [Sort single doc buckets by an aggregation on a nested collection](https://discuss.elastic.co/t/sort-single-doc-buckets-by-an-aggregation-on-a-nested-collection/107365)
**Author:** [@hetzer-fastec](https://discuss.elastic.co/u/hetzer-fastec)\ **Replies:** 3\ **Last updated:** [November 27, 2017, 3:53pm UTC](https://discuss.elastic.co/t/sort-single-doc-buckets-by-an-aggregation-on-a-nested-collection/107365 "2017-11-27T15:53:22Z")
Hi everyone, I am working on data modeling restaurants. A restaurants can have employees (which is a nested array of Employee) and an employee has a profession. The idea behind the following query attempt is to return … --- ## [Add Tooltip in timelion visualization](https://discuss.elastic.co/t/add-tooltip-in-timelion-visualization/83810)
**Author:** [@mehdichilla](https://discuss.elastic.co/u/mehdichilla)\ **Replies:** 3\ **Last updated:** [May 2, 2017, 10:11am UTC](https://discuss.elastic.co/t/add-tooltip-in-timelion-visualization/83810 "2017-05-02T10:11:02Z")
Hello, I have a visualization created with timelion, and I need to display a tooltip indicating the value of the X axis (time index) on the flyover of the graph. Area 2 on the screenshot I did not find out if this w… --- ## [Marvel Plugin Install elasticsearch 2.2.0](https://discuss.elastic.co/t/marvel-plugin-install-elasticsearch-2-2-0/44454)
**Author:** [@cmbrown](https://discuss.elastic.co/u/cmbrown)\ **Replies:** 3\ **Last updated:** [March 17, 2016, 9:41pm UTC](https://discuss.elastic.co/t/marvel-plugin-install-elasticsearch-2-2-0/44454 "2016-03-17T21:41:56Z")
Hi I have tried to install marvel on both ubuntu and windows. Both times I have run the bin\\plugin install licence and I constantly get back a message telling me "Error: failed to download out of all possible locations… --- ## [Index does not appear in kibana](https://discuss.elastic.co/t/index-does-not-appear-in-kibana/273079)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 4\ **Last updated:** [May 15, 2021, 7:45pm UTC](https://discuss.elastic.co/t/index-does-not-appear-in-kibana/273079 "2021-05-15T19:45:07Z")
Hi Community, I'm a total newbie in ELK and so far learning and loving it. I need some help as my index is not appearing in kibana index management area. For your information I'm using Elastic Cloud and Im able to su… --- ## [ECE Allocator install with new data directory](https://discuss.elastic.co/t/ece-allocator-install-with-new-data-directory/85304)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 4\ **Last updated:** [May 23, 2017, 7:41pm UTC](https://discuss.elastic.co/t/ece-allocator-install-with-new-data-directory/85304 "2017-05-23T19:41:07Z")
I'm building a ECE cluster at AWS. I'm using the AMIs provided by Elastic. I'm trying to create my allocator EC2 instances with 4TB of disk. I have done this in cloud formation, with the following parameters. BlockD… --- ## [HTTPS input to Logstash](https://discuss.elastic.co/t/https-input-to-logstash/65331)
**Author:** [@shakticouple](https://discuss.elastic.co/u/shakticouple)\ **Replies:** 7\ **Last updated:** [November 8, 2016, 10:42am UTC](https://discuss.elastic.co/t/https-input-to-logstash/65331 "2016-11-08T10:42:10Z")
Hi, I am new to ELK. I am using Logstash Version: 2.4.0 I need to configure my Logstash to accept HTTPS Input only. I don't need any certificate Validation. I have tried some configuration with HTTP Input. But, was una… [Previous page](https://discuss.elastic.co/top.md?page=935&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=937&per_page=50&period=all)