# Top **URL:** https://discuss.elastic.co/top.md?page=942&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 943 --- ## [ElasticSearch storage needs grows fast](https://discuss.elastic.co/t/elasticsearch-storage-needs-grows-fast/60288)
**Author:** [@TheFireCookie](https://discuss.elastic.co/u/TheFireCookie)\ **Replies:** 7\ **Last updated:** [October 3, 2016, 7:02pm UTC](https://discuss.elastic.co/t/elasticsearch-storage-needs-grows-fast/60288 "2016-10-03T19:02:22Z")
Hello everyone, I encounter a strange behavior I'm trying to understand. We have an SQL Server with some data and index it all in ElasticSearch. After this operation, the space needed on the drive is 11GB. The workfl… --- ## [Extracting multiple schema and multiple tables data to Elasticsearch. And using spring data to form a join query](https://discuss.elastic.co/t/extracting-multiple-schema-and-multiple-tables-data-to-elasticsearch-and-using-spring-data-to-form-a-join-query/43568)
**Author:** [@prashanthrd](https://discuss.elastic.co/u/prashanthrd)\ **Replies:** 1\ **Last updated:** [March 6, 2016, 8:25pm UTC](https://discuss.elastic.co/t/extracting-multiple-schema-and-multiple-tables-data-to-elasticsearch-and-using-spring-data-to-form-a-join-query/43568 "2016-03-06T20:25:26Z")
Hi Friends, I have a problem extracting data from MySQL to Elasticsearch via Logstash. 1)Suppose I have two different schemas and one table in each of them. Now, we search data from those tables using a LEFT OUTER JOIN… --- ## [Date Maths in Kibana Query Language](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556)
**Author:** [@Marcos\_Ivan\_Robles\_H](https://discuss.elastic.co/u/Marcos_Ivan_Robles_H)\ **Replies:** 2\ **Last updated:** [October 7, 2023, 2:25am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556 "2023-10-07T02:25:40Z")
I am trying to use date math in my query without success. When I paste a KQL query on the web explorer's address bar I got a successful result with an example like this: base url + time:(from:'2023-10-06T20:44:13.558Z… --- ## [Question: Non-Productive Licence?](https://discuss.elastic.co/t/question-non-productive-licence/305260)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [May 20, 2022, 8:39am UTC](https://discuss.elastic.co/t/question-non-productive-licence/305260 "2022-05-20T08:39:26Z")
Dear Elastic, what is the common proceedings in such cases related to licences: We will (again) buy a bunch of licences (this time platinum ones) for our production environments. In the past we also got non-production l… --- ## [Xpack watcher : - Get Index name in action's email body](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639)
**Author:** [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\ **Replies:** 3\ **Last updated:** [January 9, 2018, 9:17am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639 "2018-01-09T09:17:54Z")
Hi, I want to set a watcher to read last 3 indices name start with "logstash-\*" with number of documents per index.Then send a alert to admin user. Indices are created with current data format.For example index name for… --- ## [Integrating Panorama (Palo Alto tool) logs to ElasticSearch](https://discuss.elastic.co/t/integrating-panorama-palo-alto-tool-logs-to-elasticsearch/353476)
**Author:** [@anoman](https://discuss.elastic.co/u/anoman)\ **Replies:** 0\ **Last updated:** [February 16, 2024, 3:02pm UTC](https://discuss.elastic.co/t/integrating-panorama-palo-alto-tool-logs-to-elasticsearch/353476 "2024-02-16T15:02:39Z")
Hello, I have been looking for documentation or steps on how to integrate firewall log from palo alto product panorama. I have tried the steps i found for integration for palo alto next generation firewall but that didn… --- ## [Elasticsearch docker environment variables prefix](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 18, 2022, 4:08pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-environment-variables-prefix/294711 "2022-01-18T16:08:58Z")
I'm trying to run ES in docker with specific env variables such as discovery.type=single-node, but my hosting provider prohibits . characters in env variable names. This is discussed here: Install Elasticsearch with Doc… --- ## [Collecting logs using docker.container.labels condition with filebeat:8.5.3](https://discuss.elastic.co/t/collecting-logs-using-docker-container-labels-condition-with-filebeat-8-5-3/324158)
**Author:** [@Viktor\_Herman](https://discuss.elastic.co/u/Viktor_Herman)\ **Replies:** 1\ **Last updated:** [January 30, 2023, 10:48am UTC](https://discuss.elastic.co/t/collecting-logs-using-docker-container-labels-condition-with-filebeat-8-5-3/324158 "2023-01-30T10:48:24Z")
I'm having some problems configuring filebeat to only ingest the logs from the containers that I want. I exhausted all of the resources and documentation doesn't have any examples on this exact issue. Filebeat version is… --- ## [Multi-fields vs Nested data type](https://discuss.elastic.co/t/multi-fields-vs-nested-data-type/307664)
**Author:** [@Illidan](https://discuss.elastic.co/u/Illidan)\ **Replies:** 1\ **Last updated:** [June 20, 2022, 7:38pm UTC](https://discuss.elastic.co/t/multi-fields-vs-nested-data-type/307664 "2022-06-20T19:38:07Z")
Hey, Trying to understand difference between "fields" and "nested". For example, I have an array of objects, each one having the following fields: name name\_hash First (and probably obvious) option is to map this as … --- ## [UnicodeDecodeError: 'ascii' codec can't decode byte 0xd0 in position 139: ordinal not in range(128)](https://discuss.elastic.co/t/unicodedecodeerror-ascii-codec-cant-decode-byte-0xd0-in-position-139-ordinal-not-in-range-128/80514)
**Author:** [@Bhavana](https://discuss.elastic.co/u/Bhavana)\ **Replies:** 1\ **Last updated:** [March 29, 2017, 3:56pm UTC](https://discuss.elastic.co/t/unicodedecodeerror-ascii-codec-cant-decode-byte-0xd0-in-position-139-ordinal-not-in-range-128/80514 "2017-03-29T15:56:31Z")
Hello Everyone, I am getting the following error while pushing data from python client to ES using helpers.bulk API, "In processbulk\_chunk , resp = client.bulk('\\n'.join(bulk\_actions) + '\\n', \*\*kwargs) UnicodeDecodeE… --- ## [Inserts in Ver 2.0.0 extremly slow](https://discuss.elastic.co/t/inserts-in-ver-2-0-0-extremly-slow/34523)
**Author:** [@ajay\_bh111](https://discuss.elastic.co/u/ajay_bh111)\ **Replies:** 8\ **Last updated:** [November 13, 2015, 7:44pm UTC](https://discuss.elastic.co/t/inserts-in-ver-2-0-0-extremly-slow/34523 "2015-11-13T19:44:42Z")
I ran a Jmeter test to insert 2k size documents in version 1.6.0 and 2.0.0 and difference in insert rates is quite significant. Cluster had 5 data nodes with 8 cores 16GB, 3 master nodes with same cpu/memory/storage and… --- ## [How to know user who log into Kibana](https://discuss.elastic.co/t/how-to-know-user-who-log-into-kibana/294568)
**Author:** [@harith](https://discuss.elastic.co/u/harith)\ **Replies:** 2\ **Last updated:** [January 21, 2022, 11:37pm UTC](https://discuss.elastic.co/t/how-to-know-user-who-log-into-kibana/294568 "2022-01-21T23:37:17Z")
Hi guys, I'm new here. Sorry if I'm in wrong category. My question: How can I know user who log into my Kibana? Kibana: Free version 7.4.0 Elasticsearch: Free version 7.4.0 What I've already done: I set \ **Author:** [@AmyChou](https://discuss.elastic.co/u/AmyChou)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 6:11am UTC](https://discuss.elastic.co/t/replace-kibana-title-in-web-page-tab/105323 "2017-10-30T06:11:25Z") I had referenced lots of similar topics, but only can find how to replace the kibana logo. Does anyone know how to replace the word "Kibana" in the web page tab? \[image\] Thanks! --- ## [JDBC Sqlserver to elastic search : one input to different output?](https://discuss.elastic.co/t/jdbc-sqlserver-to-elastic-search-one-input-to-different-output/99126)
**Author:** [@Chesters](https://discuss.elastic.co/u/Chesters)\ **Replies:** 2\ **Last updated:** [September 1, 2017, 1:37pm UTC](https://discuss.elastic.co/t/jdbc-sqlserver-to-elastic-search-one-input-to-different-output/99126 "2017-09-01T13:37:36Z")
Hello, I am quite new to logstash configuration, in fact I learned about logstash altogether yesterday. Please feel free to direct me to documentation if my question is excessively obvious, here it goes : I have a sql… --- ## [Why ES remove TTL and how it is replaced?](https://discuss.elastic.co/t/why-es-remove-ttl-and-how-it-is-replaced/60449)
**Author:** [@makeyang](https://discuss.elastic.co/u/makeyang)\ **Replies:** 2\ **Last updated:** [September 14, 2016, 9:33am UTC](https://discuss.elastic.co/t/why-es-remove-ttl-and-how-it-is-replaced/60449 "2016-09-14T09:33:46Z")
I guess there must be some issues cased by TTL, can anybody share them(like github issue links) to me? and how it is replaced? --- ## [Logstash - Multiple Log Sources 'Syslog'](https://discuss.elastic.co/t/logstash-multiple-log-sources-syslog/35743)
**Author:** [@inzanez](https://discuss.elastic.co/u/inzanez)\ **Replies:** 2\ **Last updated:** [December 2, 2015, 8:29am UTC](https://discuss.elastic.co/t/logstash-multiple-log-sources-syslog/35743 "2015-12-02T08:29:47Z")
Hi! I'm in the process of planning an ELK setup to have a central log collection and monitoring system. I've got a few Linux clusters, firewalls and Microsoft Windows servers I would like to collect logs from. Firew… --- ## [Multiple Grok Filters](https://discuss.elastic.co/t/multiple-grok-filters/90501)
**Author:** [@Kevin\_Wiegand](https://discuss.elastic.co/u/Kevin_Wiegand)\ **Replies:** 4\ **Last updated:** [June 28, 2017, 10:02am UTC](https://discuss.elastic.co/t/multiple-grok-filters/90501 "2017-06-28T10:02:14Z")
Hey there i got a question about my grok filter... I'm dealing with Logfiles which are looking like this: 2017-05-23 14:41:09 DEBUG \[09-exec-38\] PreparedStatement (27 ) - {pstm-100637} Executing Statement:… --- ## [How to create a single index when using with filebeats](https://discuss.elastic.co/t/how-to-create-a-single-index-when-using-with-filebeats/86342)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 4\ **Last updated:** [May 19, 2017, 4:50pm UTC](https://discuss.elastic.co/t/how-to-create-a-single-index-when-using-with-filebeats/86342 "2017-05-19T16:50:41Z")
I'm using filebeats to ship application logs from a server with index name created "iis\_logs". I want to create a single index as "iis\_logs" in elastic search but its creating new indexes daily adding the date to the ind… --- ## [Searching for APM services](https://discuss.elastic.co/t/searching-for-apm-services/345599)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 2\ **Last updated:** [October 24, 2023, 1:52pm UTC](https://discuss.elastic.co/t/searching-for-apm-services/345599 "2023-10-24T13:52:27Z")
Hello, I was wondering why it seems so hard to search for specific services: We have quite a bit of APM services. Full Text Search on the service name does not give any results in the above searchbar.. Or am I miss… --- ## [.logstash\_jdbc\_last\_run not created when running logstash as a service](https://discuss.elastic.co/t/logstash-jdbc-last-run-not-created-when-running-logstash-as-a-service/313008)
**Author:** [@Kowsalya\_Mouttou](https://discuss.elastic.co/u/Kowsalya_Mouttou)\ **Replies:** 6\ **Last updated:** [August 26, 2022, 4:08pm UTC](https://discuss.elastic.co/t/logstash-jdbc-last-run-not-created-when-running-logstash-as-a-service/313008 "2022-08-26T16:08:05Z")
Hi, My problem is when I run logstash as a service. I'm working with centos6 and ELK 7.9.2 For a same config file with logstash-input-jdbc, evrything works fine when running logstash with the command line : /usr/shar… --- ## [How to understand snapshot repositories on s3?](https://discuss.elastic.co/t/how-to-understand-snapshot-repositories-on-s3/107665)
**Author:** [@lhong1](https://discuss.elastic.co/u/lhong1)\ **Replies:** 5\ **Last updated:** [November 15, 2017, 3:19pm UTC](https://discuss.elastic.co/t/how-to-understand-snapshot-repositories-on-s3/107665 "2017-11-15T15:19:22Z")
Hello, We have our ES snapshot stored on S3 currently via repository-s3 plugin. Per this post: I'd like to copy repository data of certain indices to local disk. I see each snapshot has an UUID ( /\_snapshot/REPOSITO… --- ## [Elasticsearch 7.1 index shards getting assigned on warm nodes](https://discuss.elastic.co/t/elasticsearch-7-1-index-shards-getting-assigned-on-warm-nodes/184466)
**Author:** [@ElkNovice](https://discuss.elastic.co/u/ElkNovice)\ **Replies:** 3\ **Last updated:** [June 6, 2019, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-7-1-index-shards-getting-assigned-on-warm-nodes/184466 "2019-06-06T07:43:20Z")
Using Elastic 7.1 stack. Trying to use hot-warm architecture. I have started all my nodes with node.attr.data set to hot or warm, depending on the node. However, I have observed that the current/active index shards are g… --- ## [Does ElasticSearch for Hadoop work with highlighting?](https://discuss.elastic.co/t/does-elasticsearch-for-hadoop-work-with-highlighting/896)
**Author:** [@drippel](https://discuss.elastic.co/u/drippel)\ **Replies:** 3\ **Last updated:** [August 8, 2016, 8:56am UTC](https://discuss.elastic.co/t/does-elasticsearch-for-hadoop-work-with-highlighting/896 "2016-08-08T08:56:08Z")
We observed that EsRDD returns only the \_source field instead of the whole Hit, so the highlighting field stays outside the result. --- ## [Elasticsearch Index with INDEX\_CREATED status progress](https://discuss.elastic.co/t/elasticsearch-index-with-index-created-status-progress/257872)
**Author:** [@mohamedshokry](https://discuss.elastic.co/u/mohamedshokry)\ **Replies:** 7\ **Last updated:** [December 8, 2020, 4:30pm UTC](https://discuss.elastic.co/t/elasticsearch-index-with-index-created-status-progress/257872 "2020-12-08T16:30:42Z")
Hello, I have a simple question: Is there an API to show current progress on an Elasticsearch index during different phases like 'INDEX\_CREATED'? I know that there is an API to check current recovery, but since the ind… --- ## [Using cluster settings to reduce log level on a package](https://discuss.elastic.co/t/using-cluster-settings-to-reduce-log-level-on-a-package/184566)
**Author:** [@Rajiv](https://discuss.elastic.co/u/Rajiv)\ **Replies:** 1\ **Last updated:** [June 6, 2019, 11:02am UTC](https://discuss.elastic.co/t/using-cluster-settings-to-reduce-log-level-on-a-package/184566 "2019-06-06T11:02:21Z")
Hello: We run on ES cluster (version 6.6.2) with the following log settings (I will post the complete log4j properties file separately due to size restrictions): logger.action.level = debug rootLogger.level = info logg… --- ## [Custom logstash index name output to ES](https://discuss.elastic.co/t/custom-logstash-index-name-output-to-es/88608)
**Author:** [@Brandon\_Reeves](https://discuss.elastic.co/u/Brandon_Reeves)\ **Replies:** 1\ **Last updated:** [June 7, 2017, 6:37pm UTC](https://discuss.elastic.co/t/custom-logstash-index-name-output-to-es/88608 "2017-06-07T18:37:27Z")
We would like to create a custom index in ES using hostname, date, and a variable from a file if possible. Here is our current output output { elasticsearch { hosts =\> "127.0.0.1" index =\> "logstash-%{+YY… --- ## [Parsing difficulties filters/plugin](https://discuss.elastic.co/t/parsing-difficulties-filters-plugin/79484)
**Author:** [@zbay](https://discuss.elastic.co/u/zbay)\ **Replies:** 7\ **Last updated:** [March 22, 2017, 1:03am UTC](https://discuss.elastic.co/t/parsing-difficulties-filters-plugin/79484 "2017-03-22T01:03:11Z")
hello everyone, I've been having a little difficulty dealing with this collection of files I'm trying to get indexed into the elk stack. As of the current conf file the system is parsing everything into the system and ad… --- ## [Malformed action/metadata line \[1\], expected START\_OBJECT or END\_OBJECT but found \[VALUE\_NUMBER\]](https://discuss.elastic.co/t/malformed-action-metadata-line-1-expected-start-object-or-end-object-but-found-value-number/170815)
**Author:** [@Pawan](https://discuss.elastic.co/u/Pawan)\ **Replies:** 2\ **Last updated:** [March 6, 2019, 9:52am UTC](https://discuss.elastic.co/t/malformed-action-metadata-line-1-expected-start-object-or-end-object-but-found-value-number/170815 "2019-03-06T09:52:08Z")
Hi, can someone help wts i am doing wrong, basically i am reading data from aws s3 and sending to elasticsearch via lambda. Python code: https://pastebin.com/qeDRQ0hQ Getting Json: https://pastebin.com/tM4jZStB Error… --- ## [Fluent Bit Filter for by PODs (calico-pod) in kubernetes?](https://discuss.elastic.co/t/fluent-bit-filter-for-by-pods-calico-pod-in-kubernetes/168975)
**Author:** [@JDev](https://discuss.elastic.co/u/JDev)\ **Replies:** 2\ **Last updated:** [February 19, 2019, 10:31am UTC](https://discuss.elastic.co/t/fluent-bit-filter-for-by-pods-calico-pod-in-kubernetes/168975 "2019-02-19T10:31:09Z")
Hi, I installed fluentbit with default settings. I like that the fluent bit adds additional information (the name of the container). But he writes in the index everything. How do I do better? How to add a filter so that… --- ## [How to convert nanoseconds to milliseconds](https://discuss.elastic.co/t/how-to-convert-nanoseconds-to-milliseconds/131895)
**Author:** [@stevebeattie](https://discuss.elastic.co/u/stevebeattie)\ **Replies:** 2\ **Last updated:** [May 15, 2018, 11:56am UTC](https://discuss.elastic.co/t/how-to-convert-nanoseconds-to-milliseconds/131895 "2018-05-15T11:56:40Z")
Hi, I have a timestamp as nanoseconds in an access log that I want to store in ES. I understand that the timestamp in ES is stored as milliseconds and that I'll need to convert. Will I have to use mutate and gsub to t… --- ## [Partial updates of nested documents](https://discuss.elastic.co/t/partial-updates-of-nested-documents/90055)
**Author:** [@Amol\_Sonawane](https://discuss.elastic.co/u/Amol_Sonawane)\ **Replies:** 2\ **Last updated:** [June 23, 2017, 5:02am UTC](https://discuss.elastic.co/t/partial-updates-of-nested-documents/90055 "2017-06-23T05:02:40Z")
I would like to know how Elasticsearch handles partial updates of nested documents internally? If there is any update to nested documents, does it still reindex the complete parent document or smartly just updates the r… --- ## [Slow percentile aggregation: Is it unusual or normal?](https://discuss.elastic.co/t/slow-percentile-aggregation-is-it-unusual-or-normal/47418)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 2\ **Last updated:** [April 19, 2016, 5:11am UTC](https://discuss.elastic.co/t/slow-percentile-aggregation-is-it-unusual-or-normal/47418 "2016-04-19T05:11:15Z")
Hi All, I have a dashboard about Netflow data. The dashboard has 10 visualization of different types. 9 visualizations took under 2s to load while 1 percentile aggregation took 21s which is too slow for users. More… --- ## [Index patterns keep disappearing](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 1\ **Last updated:** [September 28, 2020, 10:15am UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/249965 "2020-09-28T10:15:49Z")
Hi I was experiencing this issue, I see it has been reported previously. As it seems there were no solutions I though I would post my findings. I determined that the cause was that I had defined a catchall index-templ… --- ## [Elasstic search insertion failing](https://discuss.elastic.co/t/elasstic-search-insertion-failing/99788)
**Author:** [@guthurti](https://discuss.elastic.co/u/guthurti)\ **Replies:** 1\ **Last updated:** [September 12, 2017, 3:38pm UTC](https://discuss.elastic.co/t/elasstic-search-insertion-failing/99788 "2017-09-12T15:38:41Z")
While inserting the data into elastic search using spark am getting the following exception. I am completely blocked here ,Can anybody help here Setting the following properties to ES "es.nodes" es.net.http.auth.user… --- ## [Filebeat AWS Module problem](https://discuss.elastic.co/t/filebeat-aws-module-problem/233141)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 4\ **Last updated:** [May 19, 2020, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-aws-module-problem/233141 "2020-05-19T16:10:14Z")
Hi I am trying to use the Filebeat AWS module to retrieve data from AWS. My Elastic environment is running v7.7 and I have a single server running Kibana, Elasticsearch, Filebeat and Logstash (Logstash not relevant for… --- ## [Filtering queryStringQuery by exact match first (Nest)](https://discuss.elastic.co/t/filtering-querystringquery-by-exact-match-first-nest/169267)
**Author:** [@Abderrahmane\_Saadoun](https://discuss.elastic.co/u/Abderrahmane_Saadoun)\ **Replies:** 4\ **Last updated:** [February 21, 2019, 1:42pm UTC](https://discuss.elastic.co/t/filtering-querystringquery-by-exact-match-first-nest/169267 "2019-02-21T13:42:58Z")
Hello im new to elasticsearch and .net. im trying to filter my results and show exact match first. Here is my mapping "formationContinues": { "properties": { "dateObtention": { … --- ## [Kibana Spaces Create Permissions](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 4\ **Last updated:** [December 10, 2018, 9:41pm UTC](https://discuss.elastic.co/t/kibana-spaces-create-permissions/159978 "2018-12-10T21:41:16Z")
In Kibana 6.5, is there any way to prevent kibana users from creating new spaces? I know once a space is created, you can set read/write permissions within it, but what is to prevent users from creating more spaces? --- ## [Migrating created users from ELK cluster to another](https://discuss.elastic.co/t/migrating-created-users-from-elk-cluster-to-another/194228)
**Author:** [@ruthvicsd](https://discuss.elastic.co/u/ruthvicsd)\ **Replies:** 1\ **Last updated:** [August 8, 2019, 1:33pm UTC](https://discuss.elastic.co/t/migrating-created-users-from-elk-cluster-to-another/194228 "2019-08-08T13:33:13Z")
Hi, Where does kibana save all the created users? Will it be in a file in local system or in elasticsearch index? Can we migrate the users created in primary cluster to secondary cluster without recreating them in the s… --- ## [Service Now Integration with Elastic plugin Watcher](https://discuss.elastic.co/t/service-now-integration-with-elastic-plugin-watcher/55097)
**Author:** [@megaforce1020](https://discuss.elastic.co/u/megaforce1020)\ **Replies:** 1\ **Last updated:** [July 8, 2016, 9:18pm UTC](https://discuss.elastic.co/t/service-now-integration-with-elastic-plugin-watcher/55097 "2016-07-08T21:18:13Z")
We are using ELK to monitor the system performance and our application logs. If there is an error in the logs, we want to create an issue in ServiceNow from ELK. Is there a way to do this? Any pointers would help --- ## [Best Practices for Filebeat](https://discuss.elastic.co/t/best-practices-for-filebeat/208704)
**Author:** [@akhil](https://discuss.elastic.co/u/akhil)\ **Replies:** 3\ **Last updated:** [November 21, 2019, 4:31am UTC](https://discuss.elastic.co/t/best-practices-for-filebeat/208704 "2019-11-21T04:31:23Z")
Dear Elastic Team, I want to know the best practices for Filebeat configuration. Actually, there is one Production server where I have to setup filebeat. I want to configure the filebeat in that way so that when I will … --- ## [How To delete/migrate old data from an index](https://discuss.elastic.co/t/how-to-delete-migrate-old-data-from-an-index/77210)
**Author:** [@mrognone](https://discuss.elastic.co/u/mrognone)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 3:09pm UTC](https://discuss.elastic.co/t/how-to-delete-migrate-old-data-from-an-index/77210 "2017-03-21T15:09:28Z")
Hi people ! My situation: I have 2 logstash-forwarders sending network devices logs to an ELK server. In the past I did create the needed indexes based on time ( YYYY+MM+DD), but I detected that the performance of th… --- ## [How to parse bluecoat proxyAV logs](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520)
**Author:** [@riconeo](https://discuss.elastic.co/u/riconeo)\ **Replies:** 3\ **Last updated:** [October 2, 2015, 7:10am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520 "2015-10-02T07:10:02Z")
Format string from Bluecoat ProxyAV c-dns, -, -, N, date, time, 1, -, -, s-dns, s-ip, s-port, time-taken, sc-bytes, cs-bytes, cs-protocol, -, cs-method, cs-uri, sc-mimetype, cache, sc-status Output in the logstash mess… --- ## [Dynamic template for complex types](https://discuss.elastic.co/t/dynamic-template-for-complex-types/205059)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 5\ **Last updated:** [September 11, 2020, 2:58pm UTC](https://discuss.elastic.co/t/dynamic-template-for-complex-types/205059 "2020-09-11T14:58:27Z")
Hello, is it possible to have a complex type (like a geopoint) dinamically recognized using the dynamic\_templates section of a template/index mapping? Sort of: PUT test\_loc/doc/1 { "position" : \[-64, -19.4\] } resu… --- ## [I installed elasticsearch and then change the es\_home path but now its not working.....this is the error i am getting after running, service elasticsearch status](https://discuss.elastic.co/t/i-installed-elasticsearch-and-then-change-the-es-home-path-but-now-its-not-working-this-is-the-error-i-am-getting-after-running-service-elasticsearch-status/189931)
**Author:** [@Ayush\_Verma](https://discuss.elastic.co/u/Ayush_Verma)\ **Replies:** 6\ **Last updated:** [July 12, 2019, 6:20am UTC](https://discuss.elastic.co/t/i-installed-elasticsearch-and-then-change-the-es-home-path-but-now-its-not-working-this-is-the-error-i-am-getting-after-running-service-elasticsearch-status/189931 "2019-07-12T06:20:25Z")
this is the error i am getting : elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Thu 20… --- ## [Unable to extract hostname with Grok using NOTSPACE](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607)
**Author:** [@drivera](https://discuss.elastic.co/u/drivera)\ **Replies:** 6\ **Last updated:** [January 22, 2019, 4:20pm UTC](https://discuss.elastic.co/t/unable-to-extract-hostname-with-grok-using-notspace/161607 "2019-01-22T16:20:58Z")
Hello, trying to extract a hostname from a log. I test my Grok filter in the Grok debugger using the NOTSPACE pattern and I can extract the hostname "DEV-1010-1010-D-B1F6R01". But in Kibana, I get a "invalid" message for… --- ## [Change color based on the dynamic threshold in Metric or Guage visulization](https://discuss.elastic.co/t/change-color-based-on-the-dynamic-threshold-in-metric-or-guage-visulization/221129)
**Author:** [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Replies:** 2\ **Last updated:** [March 2, 2020, 2:04am UTC](https://discuss.elastic.co/t/change-color-based-on-the-dynamic-threshold-in-metric-or-guage-visulization/221129 "2020-03-02T02:04:31Z")
Hi, I want to visualize the number of requests with the color code to represent whether it's within the expected range as per the current time. Based on the time, max and min thresholds will be changed. Sample documents… --- ## [How to reindex from an frozen index?](https://discuss.elastic.co/t/how-to-reindex-from-an-frozen-index/208801)
**Author:** [@stone\_xy](https://discuss.elastic.co/u/stone_xy)\ **Replies:** 2\ **Last updated:** [November 23, 2019, 6:04am UTC](https://discuss.elastic.co/t/how-to-reindex-from-an-frozen-index/208801 "2019-11-23T06:04:08Z")
ES Version: 7.4.2 Steps: create index and post some data: PUT logs { "settings": { "number\_of\_shards": 2, "number\_of\_replicas": 1 } } POST logs/\_doc { "msg": "hello there" } POST logs/\_doc { "msg": "hel… --- ## [【logstash】一部のファイルがPermission deniedで開けない](https://discuss.elastic.co/t/logstash-permission-denied/89871)
**Author:** [@tr8](https://discuss.elastic.co/u/tr8)\ **Replies:** 2\ **Last updated:** [June 19, 2017, 8:14am UTC](https://discuss.elastic.co/t/logstash-permission-denied/89871 "2017-06-19T08:14:37Z")
inputするlogファイルはすべて下記の通り権限が付与されています。 -rw-rw-r-- 1 user123 root 3797 Jun 8 01:04 xxxxxxxx.log これらをelasticsearchへoutputしているのですが、 一部ファイルは開けていないようです。 \[2017-06-19T01:29:33,168\]\[WARN \]\[logstash.inputs.file \] failed to… --- ## [Logstash parsing for rich text documents](https://discuss.elastic.co/t/logstash-parsing-for-rich-text-documents/40640)
**Author:** [@Meenal.Luktuke](https://discuss.elastic.co/u/Meenal.Luktuke)\ **Replies:** 2\ **Last updated:** [April 22, 2016, 8:00am UTC](https://discuss.elastic.co/t/logstash-parsing-for-rich-text-documents/40640 "2016-04-22T08:00:38Z")
Hi, Can Logstash parse rich text documents? I have a use-case where the input is not logs, but some documents instead and then build some KPI in Kibana. I have 2 questions: 1) Can logstash do it with some plugin or I… --- ## [Trying to connect to mssql server with JDBC](https://discuss.elastic.co/t/trying-to-connect-to-mssql-server-with-jdbc/57003)
**Author:** [@valky05](https://discuss.elastic.co/u/valky05)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 12:02pm UTC](https://discuss.elastic.co/t/trying-to-connect-to-mssql-server-with-jdbc/57003 "2016-08-02T12:02:52Z")
I'm currently trying to connect to a remote MSsql server with the JDBC plugin of Logstash. For the config file, I use the syntax proposed by mick66 on this thread: https://discuss.elastic.co/t/jdbc-mssql-server-connect… [Previous page](https://discuss.elastic.co/top.md?page=941&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=943&per_page=50&period=all)