# Top **URL:** https://discuss.elastic.co/top.md?page=953&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 954 --- ## [FileBeat decode\_json\_fields processor max\_depth option not working](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948)
**Author:** [@Vitaliy\_Kravchenko](https://discuss.elastic.co/u/Vitaliy_Kravchenko)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 12:14pm UTC](https://discuss.elastic.co/t/filebeat-decode-json-fields-processor-max-depth-option-not-working/240948 "2020-07-13T12:14:44Z")
decode\_json\_fields -\> max\_depth option not working or documentation misunderstanding. To prevent creating tons of document fields in an Elasticsearch log index I want to control nested JSON parsing depth. Filebeat vers… --- ## [Transforming array of objects](https://discuss.elastic.co/t/transforming-array-of-objects/234366)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [June 1, 2020, 4:16pm UTC](https://discuss.elastic.co/t/transforming-array-of-objects/234366 "2020-06-01T16:16:20Z")
Hi all, we are trying to process an event with Logstash that is generated by http\_poller input. The event has the following structure: { "data": \[ { "name": "key1", "value": "A" }, { "name": "key2", … --- ## [Custom add\_field storing as an array with value duplicated in Elasticsearch](https://discuss.elastic.co/t/custom-add-field-storing-as-an-array-with-value-duplicated-in-elasticsearch/117277)
**Author:** [@nodesocket](https://discuss.elastic.co/u/nodesocket)\ **Replies:** 2\ **Last updated:** [January 28, 2018, 8:40pm UTC](https://discuss.elastic.co/t/custom-add-field-storing-as-an-array-with-value-duplicated-in-elasticsearch/117277 "2018-01-28T20:40:38Z")
Hello. I am trying to add a custom field msgid and while the groc and field is working, the result is an array with the value duplicated twice. Here is an example raw message: Jan 26 22:58:01 ip-172-31-23-201 mailqueue… --- ## [Generating multiple events from a single message](https://discuss.elastic.co/t/generating-multiple-events-from-a-single-message/108772)
**Author:** [@pri](https://discuss.elastic.co/u/pri)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 9:05pm UTC](https://discuss.elastic.co/t/generating-multiple-events-from-a-single-message/108772 "2017-11-22T21:05:00Z")
Hi, I have a csv file that looks like this: The first line is the header column Item, Type, Category, Q1, Q2, Q3, Q4 Tools, License, Cost Saving, 15000, 0, 6000, 899 I am trying to consume this in Logstash and … --- ## [Kibana\_task\_manager docs getting deleted. Kibana not starting](https://discuss.elastic.co/t/kibana-task-manager-docs-getting-deleted-kibana-not-starting/203993)
**Author:** [@akshatBais](https://discuss.elastic.co/u/akshatBais)\ **Replies:** 3\ **Last updated:** [October 18, 2019, 3:31pm UTC](https://discuss.elastic.co/t/kibana-task-manager-docs-getting-deleted-kibana-not-starting/203993 "2019-10-18T15:31:50Z")
I am getting this error while running , elasticsearch , logstash and kibana via docker compose : {"type":"error","@timestamp":"2019-10-17T12:48:31Z","tags":\["warning","stats-collection"\],"pid":1,"level":"error","error":… --- ## [Feed HTTP response body to Elasticsearch](https://discuss.elastic.co/t/feed-http-response-body-to-elasticsearch/92288)
**Author:** [@owulff](https://discuss.elastic.co/u/owulff)\ **Replies:** 3\ **Last updated:** [July 7, 2017, 3:41pm UTC](https://discuss.elastic.co/t/feed-http-response-body-to-elasticsearch/92288 "2017-07-07T15:41:25Z")
Hi there Is it planned to support sending the http response body to Elasticsearch if it is in JSON format? Thanks Oli --- ## [HIPAA compliant ElasticSearch application](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch-application/13417)
**Author:** [@Charitha\_Sathkumara](https://discuss.elastic.co/u/Charitha_Sathkumara)\ **Replies:** 3\ **Last updated:** [September 2, 2013, 7:27pm UTC](https://discuss.elastic.co/t/hipaa-compliant-elasticsearch-application/13417 "2013-09-02T19:27:43Z")
I am trying to implement a logging solution as part of an application that handles sensitive medical data. I intend on using Elasticsearch + Searchbox.io Jest for storage and retrieval of this data. HIPAA rule… --- ## [Query not executing in Elasticsearch input plugin for logstash](https://discuss.elastic.co/t/query-not-executing-in-elasticsearch-input-plugin-for-logstash/326362)
**Author:** [@aelam](https://discuss.elastic.co/u/aelam)\ **Replies:** 6\ **Last updated:** [February 28, 2023, 3:55pm UTC](https://discuss.elastic.co/t/query-not-executing-in-elasticsearch-input-plugin-for-logstash/326362 "2023-02-28T15:55:15Z")
I'm new to the stack, and am trying to execute simple queries in logstash via the elasticsearch input plugin. I have worked through some initial errors and now have only a couple of notable warnings, but am not getting a… --- ## [Update Elasticsearch and Kibana](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 16, 2022, 11:55am UTC](https://discuss.elastic.co/t/update-elasticsearch-and-kibana/319027 "2022-11-16T11:55:48Z")
Hello, I am running on a local server Elasticsearch in version 7.16 and Kibana in version 7.17 I want both to be updated to version 8.5. I have read, that I should use the Update Assistance in the wiki However, when I… --- ## [ES Cluster not importing dangled indices after restart](https://discuss.elastic.co/t/es-cluster-not-importing-dangled-indices-after-restart/163371)
**Author:** [@KevinK](https://discuss.elastic.co/u/KevinK)\ **Replies:** 6\ **Last updated:** [January 9, 2019, 11:07am UTC](https://discuss.elastic.co/t/es-cluster-not-importing-dangled-indices-after-restart/163371 "2019-01-09T11:07:17Z")
Hi, I'm running an ES cluster version 6.3.0 in Kubernetes (composed of 3 master nodes, 2 ingest nodes and 4 data nodes). I needed to move the cluster to new servers with more memory, but after I restarted the cluster, i… --- ## [Omit\_norms on \_all field](https://discuss.elastic.co/t/omit-norms-on--all-field/8828)
**Author:** [@dilshan](https://discuss.elastic.co/u/dilshan)\ **Replies:** 6\ **Last updated:** [October 22, 2012, 6:33am UTC](https://discuss.elastic.co/t/omit-norms-on--all-field/8828 "2012-10-22T06:33:28Z")
Hi, It seems like when I set "omit\_norms : true" on a field, it affects the results only when I search on that field directly. It doesn't work when I search on \_all field. Also, after setting "omit\_norms : true" … --- ## [How to create Machine Learning job using two indices from kibana UI Version 7.8.0](https://discuss.elastic.co/t/how-to-create-machine-learning-job-using-two-indices-from-kibana-ui-version-7-8-0/239049)
**Author:** [@prabhu\_c](https://discuss.elastic.co/u/prabhu_c)\ **Replies:** 8\ **Last updated:** [July 6, 2020, 3:49am UTC](https://discuss.elastic.co/t/how-to-create-machine-learning-job-using-two-indices-from-kibana-ui-version-7-8-0/239049 "2020-07-06T03:49:05Z")
Hi, I have to create advanced machine learning job using Kibana 7.3 by pulling data from two indices. I am creating job using Kibana UI. I am not able to understand how to pull data from two indices? while creating ML … --- ## [Getting error while configuring mcqueen as a S3 alternative for storing snapshots for elasticsearch](https://discuss.elastic.co/t/getting-error-while-configuring-mcqueen-as-a-s3-alternative-for-storing-snapshots-for-elasticsearch/181790)
**Author:** [@Ronnie16](https://discuss.elastic.co/u/Ronnie16)\ **Replies:** 8\ **Last updated:** [May 27, 2019, 8:52am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-mcqueen-as-a-s3-alternative-for-storing-snapshots-for-elasticsearch/181790 "2019-05-27T08:52:08Z")
I'm trying to configure mcqueen for storing elasticsearch snapshots. I have created a bucket ./s3curl.pl --id=test --createBucket -- http://store-test.blobstore.xxx.com/snapshots But when I'm trying to create a reposit… --- ## [Kubernetes autodiscover sending logs from only some of the identical nodes in one of our clusters](https://discuss.elastic.co/t/kubernetes-autodiscover-sending-logs-from-only-some-of-the-identical-nodes-in-one-of-our-clusters/162520)
**Author:** [@benbertrands](https://discuss.elastic.co/u/benbertrands)\ **Replies:** 8\ **Last updated:** [January 3, 2019, 1:14pm UTC](https://discuss.elastic.co/t/kubernetes-autodiscover-sending-logs-from-only-some-of-the-identical-nodes-in-one-of-our-clusters/162520 "2019-01-03T13:14:49Z")
Hi, We're running filebeat as a deamonset on all nodes of our on-premises kubernetes clusters. (Filebeat sends logs to logstash, logstash does some processesing and sends them on to elasticsearch.) On one of our clust… --- ## [GC time cost rise on time in elastic 2.1.1](https://discuss.elastic.co/t/gc-time-cost-rise-on-time-in-elastic-2-1-1/58526)
**Author:** [@zaka](https://discuss.elastic.co/u/zaka)\ **Replies:** 8\ **Last updated:** [September 1, 2016, 8:36am UTC](https://discuss.elastic.co/t/gc-time-cost-rise-on-time-in-elastic-2-1-1/58526 "2016-09-01T08:36:15Z")
We are running a 3 nodes ES cluster. Every node have 16G Memory, ES\_HEAP is set to 8G. After Cluster started 30 hours, GC cost from 5ms up to 200ms, CPU utilization from 10% up to 50%, then cause many requests time out.… --- ## [Security index is unavailable](https://discuss.elastic.co/t/security-index-is-unavailable/274731)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [June 2, 2021, 10:42am UTC](https://discuss.elastic.co/t/security-index-is-unavailable/274731 "2021-06-02T10:42:51Z")
Hi there, I have installed a single node node on linux (role: monitoring node) (v. 7.8.1 // elastisearch + Kibana + redis) If in the elasticsearch.yml I give this: xpack.security.enabled: false then for example a cur… --- ## [Kibana Keystore No Such Directory Error](https://discuss.elastic.co/t/kibana-keystore-no-such-directory-error/215549)
**Author:** [@kiyapedia](https://discuss.elastic.co/u/kiyapedia)\ **Replies:** 2\ **Last updated:** [January 18, 2020, 2:04pm UTC](https://discuss.elastic.co/t/kibana-keystore-no-such-directory-error/215549 "2020-01-18T14:04:21Z")
Hello — I've got Elasticsearch and Kibana running with docker-compose with no issues. In my kibana.yml file, my password is exposed as such: server.name: kibana server.host: "0" elasticsearch.hosts: \[ "http://elasticse… --- ## [New metric Percent based on a total](https://discuss.elastic.co/t/new-metric-percent-based-on-a-total/166486)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\ **Replies:** 2\ **Last updated:** [February 1, 2019, 12:39pm UTC](https://discuss.elastic.co/t/new-metric-percent-based-on-a-total/166486 "2019-02-01T12:39:07Z")
Hi there, Thank you in advance for your time, I was wondering if doing this table below is still impossible using Kibana : values | count | % aaaaa | 10 | 50 bbbbb | 5 | 25 cccccc … --- ## [Is it safe to use filebeat.registry\_flush in the filebeat 6.21](https://discuss.elastic.co/t/is-it-safe-to-use-filebeat-registry-flush-in-the-filebeat-6-21/121983)
**Author:** [@RishiSingh](https://discuss.elastic.co/u/RishiSingh)\ **Replies:** 2\ **Last updated:** [March 12, 2018, 5:00pm UTC](https://discuss.elastic.co/t/is-it-safe-to-use-filebeat-registry-flush-in-the-filebeat-6-21/121983 "2018-03-12T17:00:29Z")
Hi, I am making use of filebeat 6.21, there are some cases when the include pattern does not match any line in the log file and hence the registry file is being updated frequently. By looking into the code I came ac… --- ## [Config error](https://discuss.elastic.co/t/config-error/118721)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 10:59am UTC](https://discuss.elastic.co/t/config-error/118721 "2018-02-07T10:59:39Z")
Hello, I am trying to parse a java log file with grok but the config test is telling me that: The given configuration is invalid. Reason: no implicit conversion of Array into Hash. Putting the config into debug mode I g… --- ## [Cluster Red - unallocated shards in a index](https://discuss.elastic.co/t/cluster-red-unallocated-shards-in-a-index/113741)
**Author:** [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Replies:** 2\ **Last updated:** [January 2, 2018, 11:10am UTC](https://discuss.elastic.co/t/cluster-red-unallocated-shards-in-a-index/113741 "2018-01-02T11:10:45Z")
My cluster suddenly went to red. Because of an index shard allocation fail. when i run GET /\_cluster/allocation/explain { "index": "my\_index", "shard": 0, "primary": true } output: { "shard": { "index": "t… --- ## [Nested json field mutate string to number](https://discuss.elastic.co/t/nested-json-field-mutate-string-to-number/110846)
**Author:** [@fpunzo](https://discuss.elastic.co/u/fpunzo)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 2:38pm UTC](https://discuss.elastic.co/t/nested-json-field-mutate-string-to-number/110846 "2017-12-08T14:38:05Z")
Hello, I'm trying to convert a nested json field from a string to an integer. I've tried everything I've found on the web. I'm hoping you can give me some direction as to what I'm doing wrong. I'm trying to convert the r… --- ## [Search and index analyzer not working as expected](https://discuss.elastic.co/t/search-and-index-analyzer-not-working-as-expected/5554)
**Author:** [@James\_Wilson](https://discuss.elastic.co/u/James_Wilson)\ **Replies:** 2\ **Last updated:** [October 12, 2011, 8:54pm UTC](https://discuss.elastic.co/t/search-and-index-analyzer-not-working-as-expected/5554 "2011-10-12T20:54:44Z")
Short description: searching by the stem word works ("meet") but using the word in the source document ("meeting") doesn't. I'm missing something here that's probably fundamental, but it's not explained anywhere. I… --- ## [How to keep segment count of active index small?](https://discuss.elastic.co/t/how-to-keep-segment-count-of-active-index-small/76375)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 4\ **Last updated:** [February 24, 2017, 10:26am UTC](https://discuss.elastic.co/t/how-to-keep-segment-count-of-active-index-small/76375 "2017-02-24T10:26:10Z")
We have a index contains around 1 million documents, each time after the full re-indexing, the segment count of each shard is general around 20-30. And we found that if we optimize the index (forcemerge?maxnum\_segments… --- ## [Problems with performance in ElasticSearch 2.3.2](https://discuss.elastic.co/t/problems-with-performance-in-elasticsearch-2-3-2/49035)
**Author:** [@Guillermo\_Ortiz](https://discuss.elastic.co/u/Guillermo_Ortiz)\ **Replies:** 4\ **Last updated:** [May 19, 2016, 7:58pm UTC](https://discuss.elastic.co/t/problems-with-performance-in-elasticsearch-2-3-2/49035 "2016-05-19T19:58:21Z")
I have migrated ES 2.2.1 to 2.3.2 and I'm having so problems with performance. I have one master node and five data nodes. Before I indexed 25K-30K/sec, now I index about 5K. I use Spark with es-hadoop to index the docu… --- ## [Recovering Cluster when state files are corrupt](https://discuss.elastic.co/t/recovering-cluster-when-state-files-are-corrupt/230714)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 5\ **Last updated:** [May 6, 2020, 7:49pm UTC](https://discuss.elastic.co/t/recovering-cluster-when-state-files-are-corrupt/230714 "2020-05-06T19:49:54Z")
Over the weekend, the 3 master nodes in a 7 node cluster would not start up due to lack of space in the data path and the logs path. Only one of the mast nodes came up. But the data nodes started to complain about bad s… --- ## [How to export beat name instead of hostname for beat.name field](https://discuss.elastic.co/t/how-to-export-beat-name-instead-of-hostname-for-beat-name-field/56026)
**Author:** [@bklise](https://discuss.elastic.co/u/bklise)\ **Replies:** 5\ **Last updated:** [July 24, 2016, 9:01pm UTC](https://discuss.elastic.co/t/how-to-export-beat-name-instead-of-hostname-for-beat-name-field/56026 "2016-07-24T21:01:33Z")
I apologize if this is a duplicate, but I was unable to find a solution. For the beat.name field of my beat's output, it is using my hostname instead of the beat name: "beat":{ "hostname":"bklise", "name":… --- ## [Attempted to send a bulk request to Elasticsearch failed ClientProtocolException](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720)
**Author:** [@makinda](https://discuss.elastic.co/u/makinda)\ **Replies:** 3\ **Last updated:** [October 27, 2021, 1:43pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-failed-clientprotocolexception/287720 "2021-10-27T13:43:05Z")
I am using Elasticsearch-2.3.1 and logstash-2.3.4 since quite long. Today I found a following warning in Elastic Search. I was trying to copy the logs but I think I press Ctrl+C and then an option appear to stop a job, I… --- ## [Regexp for Mac Addresses](https://discuss.elastic.co/t/regexp-for-mac-addresses/185622)
**Author:** [@thomas.heuberger](https://discuss.elastic.co/u/thomas.heuberger)\ **Replies:** 3\ **Last updated:** [June 13, 2019, 1:57pm UTC](https://discuss.elastic.co/t/regexp-for-mac-addresses/185622 "2019-06-13T13:57:14Z")
So, I have a keyword field (yes, type is keyword as well, not just the name) that I want to match against MAC addresses. The field contains just the MAC address and nothing else, so anchoring is not a problem. However,… --- ## [WARNING: The following packages cannot be authenticated](https://discuss.elastic.co/t/warning-the-following-packages-cannot-be-authenticated/81737)
**Author:** [@johnlinp](https://discuss.elastic.co/u/johnlinp)\ **Replies:** 3\ **Last updated:** [April 13, 2017, 6:58am UTC](https://discuss.elastic.co/t/warning-the-following-packages-cannot-be-authenticated/81737 "2017-04-13T06:58:12Z")
I am using Ubuntu 16.04 and trying to install Elasticsearch 5.3 with this instruction: https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html After I apt-key and put file at /etc/apt/sources.list.d, I… --- ## [Disk full, cannot add more disk, snapshot needs space](https://discuss.elastic.co/t/disk-full-cannot-add-more-disk-snapshot-needs-space/239373)
**Author:** [@dhruv2204](https://discuss.elastic.co/u/dhruv2204)\ **Replies:** 7\ **Last updated:** [July 2, 2020, 8:27am UTC](https://discuss.elastic.co/t/disk-full-cannot-add-more-disk-snapshot-needs-space/239373 "2020-07-02T08:27:45Z")
Hi Team We have some 1.8TB data in a single index. The disk storage on this machine is 2TB and already reached 95%. We have increased the flood limit to 98%, but that will only allow for 3-4 days of data more. We cann… --- ## [Packetbeat HighCPU monitoring memcache](https://discuss.elastic.co/t/packetbeat-highcpu-monitoring-memcache/86811)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 7\ **Last updated:** [May 30, 2017, 1:55pm UTC](https://discuss.elastic.co/t/packetbeat-highcpu-monitoring-memcache/86811 "2017-05-30T13:55:25Z")
Hi, I have been monitoring our memcached servers with packetbeat. This was noticed after deploying packetbeat 5.4.0, it may have been happening before, but I'm not 100% sure. I will consistently get packetbeat taking … --- ## [Pre-filter KNN vector search](https://discuss.elastic.co/t/pre-filter-knn-vector-search/341585)
**Author:** [@veesahni](https://discuss.elastic.co/u/veesahni)\ **Replies:** 1\ **Last updated:** [August 24, 2023, 7:01pm UTC](https://discuss.elastic.co/t/pre-filter-knn-vector-search/341585 "2023-08-24T19:01:59Z")
I'm trying to understand how to best implement a pre-filtered KNN vector search. To be clear: I'd like to pre-filter the total number of docs down to a smaller set, and then run a vector search that leverages a vector in… --- ## [Skipped responses](https://discuss.elastic.co/t/skipped-responses/220671)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 2:08pm UTC](https://discuss.elastic.co/t/skipped-responses/220671 "2020-02-24T14:08:28Z")
Hi, I am using ES 7.1.1 and elasticsearchjs. When I do msearch for the first time, it return "skipped" responses. But when I do the same msearch again (click F5 in gui), I finally get my data. Timerange is correct (last … --- ## [How to filter out elements from an array that doesn't match the query?](https://discuss.elastic.co/t/how-to-filter-out-elements-from-an-array-that-doesnt-match-the-query/29899)
**Author:** [@Alexander\_Skiller](https://discuss.elastic.co/u/Alexander_Skiller)\ **Replies:** 0\ **Last updated:** [September 24, 2015, 7:49am UTC](https://discuss.elastic.co/t/how-to-filter-out-elements-from-an-array-that-doesnt-match-the-query/29899 "2015-09-24T07:49:43Z")
Hi dear elasticsearch community, Here is my index POST /products { "settings": { "analysis": { "filter": { "nGram\_filter": { "type": "nGram", "min\_gram": 2,… --- ## [Why is a version conflict excpetion thrown when no versioning is used or required?](https://discuss.elastic.co/t/why-is-a-version-conflict-excpetion-thrown-when-no-versioning-is-used-or-required/201343)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 7:51am UTC](https://discuss.elastic.co/t/why-is-a-version-conflict-excpetion-thrown-when-no-versioning-is-used-or-required/201343 "2019-09-27T07:51:35Z")
version\_conflict\_engine\_exception We're using ElasticSearch as a Cache and when we run a stress test with 10 processes simultaneously accessing and writing to ES we occasionally get a version\_conflict\_engine\_exception ex… --- ## [Accessing fields from Watcher search condition](https://discuss.elastic.co/t/accessing-fields-from-watcher-search-condition/162473)
**Author:** [@Sanj](https://discuss.elastic.co/u/Sanj)\ **Replies:** 2\ **Last updated:** [January 24, 2019, 12:22pm UTC](https://discuss.elastic.co/t/accessing-fields-from-watcher-search-condition/162473 "2019-01-24T12:22:44Z")
Hi Team, I'm trying to develop a watcher comparing some fields from two different search conditions. Since I'm new to watcher, I could figure out exact way to access the fields of the records obtained from the search re… --- ## [Packetbeat is not sniffing the packets from a SPAN port](https://discuss.elastic.co/t/packetbeat-is-not-sniffing-the-packets-from-a-span-port/47064)
**Author:** [@Anantha\_Ravi](https://discuss.elastic.co/u/Anantha_Ravi)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 2:17pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-sniffing-the-packets-from-a-span-port/47064 "2016-04-12T14:17:15Z")
i have configured eth2 as my device in packetbeat . and eth2 is configured a span destination in my test configuration . tcpdump does show flow are recieved by interface , but i don't see same with packetbeat . i try… --- ## [Autodiscovery with modules in Docker](https://discuss.elastic.co/t/autodiscovery-with-modules-in-docker/176390)
**Author:** [@ftec](https://discuss.elastic.co/u/ftec)\ **Replies:** 2\ **Last updated:** [April 12, 2019, 8:19am UTC](https://discuss.elastic.co/t/autodiscovery-with-modules-in-docker/176390 "2019-04-12T08:19:57Z")
Hi, I have the deployed ES stack (ES + Kibana + Metricbeat + Filebeat) to a Docker Swarm stack. That stack contains also some services like MySQL (mariadb), Kafka+Zookeeper, Traefik gateways, etc. I want to read Docke… --- ## [ELK stack and additional CloudWatch output](https://discuss.elastic.co/t/elk-stack-and-additional-cloudwatch-output/26892)
**Author:** [@sebastianhoitz](https://discuss.elastic.co/u/sebastianhoitz)\ **Replies:** 4\ **Last updated:** [August 24, 2015, 1:28pm UTC](https://discuss.elastic.co/t/elk-stack-and-additional-cloudwatch-output/26892 "2015-08-24T13:28:53Z")
I would like to output all my logs to Elastic Search and when certain conditions are met, send them as metrics to Cloud Watch, which should take care of alerting me. They way I understand it is, that I have to add a CW… --- ## [Kibana map - No results Found documents](https://discuss.elastic.co/t/kibana-map-no-results-found-documents/271966)
**Author:** [@rana5](https://discuss.elastic.co/u/rana5)\ **Replies:** 6\ **Last updated:** [May 4, 2021, 1:47pm UTC](https://discuss.elastic.co/t/kibana-map-no-results-found-documents/271966 "2021-05-04T13:47:49Z")
Hello everyone, I am having trouble viewing points in my kibana map, It says No results found , I have made sure of the timestamps and that the data is in geo.point format, so I have no clue what the problem could be. b… --- ## [Морфология с Hunspell не работает при поиске](https://discuss.elastic.co/t/hunspell/260189)
**Author:** [@DimanG](https://discuss.elastic.co/u/DimanG)\ **Replies:** 6\ **Last updated:** [January 5, 2021, 5:58pm UTC](https://discuss.elastic.co/t/hunspell/260189 "2021-01-05T17:58:34Z")
Всем доброго дня! В эластике новичок. Остался один шаг до начала использования - побороть морфологию. Проблема схожа с описанной в этой теме, но у меня само не заработало: https://discuss.elastic.co/t/topic/182967/2 По… --- ## [Automatically excluding fields in new indexes](https://discuss.elastic.co/t/automatically-excluding-fields-in-new-indexes/152641)
**Author:** [@braoul](https://discuss.elastic.co/u/braoul)\ **Replies:** 6\ **Last updated:** [October 17, 2018, 7:06am UTC](https://discuss.elastic.co/t/automatically-excluding-fields-in-new-indexes/152641 "2018-10-17T07:06:58Z")
Hi, we have setup different indexes by day on our data and now we would like to exclude some fields from being indexed. How should we proceed, so that every newly created index will automatically have those fields excl… --- ## [Accessing search result (index\_out\_of\_bounds](https://discuss.elastic.co/t/accessing-search-result-index-out-of-bounds/129508)
**Author:** [@rickdegreef](https://discuss.elastic.co/u/rickdegreef)\ **Replies:** 6\ **Last updated:** [April 26, 2018, 5:42am UTC](https://discuss.elastic.co/t/accessing-search-result-index-out-of-bounds/129508 "2018-04-26T05:42:26Z")
Hi there, When trying out the watcher, we would like to add info we collected in the input to a webhook POST request. We are trying to use the ctx.payload.hits.hits (with or without any index number). Unfortunately, ev… --- ## [How to create visualization of text data](https://discuss.elastic.co/t/how-to-create-visualization-of-text-data/284607)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 1\ **Last updated:** [September 20, 2021, 9:46am UTC](https://discuss.elastic.co/t/how-to-create-visualization-of-text-data/284607 "2021-09-20T09:46:24Z")
Hi, im having an ELK stack with filebeats. my filebeats configuration is listening to MQTT messages on specific topic. under discover I can filter the message and read the log,my goal is to create dashboard/visualizti… --- ## [How to determine "index.mapping.total\_fields.limit" in an Index in ES 6.3](https://discuss.elastic.co/t/how-to-determine-index-mapping-total-fields-limit-in-an-index-in-es-6-3/213978)
**Author:** [@Harshraj\_Shinde](https://discuss.elastic.co/u/Harshraj_Shinde)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 10:52am UTC](https://discuss.elastic.co/t/how-to-determine-index-mapping-total-fields-limit-in-an-index-in-es-6-3/213978 "2020-01-08T10:52:16Z")
Hello, PUT test1 { "mappings": { "\_doc": { "properties": { "field1":{ "type":"text" }, "field2":{ "type":"text" }, "field3":{ "type":"text" } } } }, "settings": { "analysis": { "normalizer": { "Expo… --- ## [Is there any ways to get Popular keywords?](https://discuss.elastic.co/t/is-there-any-ways-to-get-popular-keywords/86151)
**Author:** [@Lael\_Moon](https://discuss.elastic.co/u/Lael_Moon)\ **Replies:** 1\ **Last updated:** [May 18, 2017, 7:50am UTC](https://discuss.elastic.co/t/is-there-any-ways-to-get-popular-keywords/86151 "2017-05-18T07:50:07Z")
Hello. I want to implement today's hot keyword. == Here is my mapping data == { "content": { "type": "text", "fields": { "keyword": { "type": "keyword",… --- ## [Network bytes per second example](https://discuss.elastic.co/t/network-bytes-per-second-example/76845)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 8:13pm UTC](https://discuss.elastic.co/t/network-bytes-per-second-example/76845 "2017-02-28T20:13:30Z")
The "system.network.out.bytes" metric gives you the total bytes, can someone give me a Timelion expression using derivative to show bytes per second. Thanks, E --- ## [Get logs from different EC2 instance](https://discuss.elastic.co/t/get-logs-from-different-ec2-instance/198451)
**Author:** [@Ghaith\_Haddad](https://discuss.elastic.co/u/Ghaith_Haddad)\ **Replies:** 3\ **Last updated:** [September 9, 2019, 2:03pm UTC](https://discuss.elastic.co/t/get-logs-from-different-ec2-instance/198451 "2019-09-09T14:03:45Z")
Hello everyone, So i have one EC2 instance with logstash, elastichsearch and kibana installed on it. and i have another EC2 instance thats running a dummy apache server. Now i know that i should install filebeat on the … --- ## [Pipeline aborted due to error in password field logstash](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-in-password-field-logstash/68975)
**Author:** [@Nguy\_n\_D\_c\_Th\_nh](https://discuss.elastic.co/u/Nguy_n_D_c_Th_nh)\ **Replies:** 3\ **Last updated:** [January 6, 2017, 9:54pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-in-password-field-logstash/68975 "2017-01-06T21:54:03Z")
Hi everyone, I got an error when sending output to elasticsearch. The error message like this. \[2016-12-14T13:20:18,500\]\[ERROR\]\[logstash.agent \] Pipeline aborted due to error {:exception=\>#\