# Top **URL:** https://discuss.elastic.co/top.md?page=962&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 963 --- ## [Spark elasticsearch 5.0.2 scala.MatchError](https://discuss.elastic.co/t/spark-elasticsearch-5-0-2-scala-matcherror/68364)
**Author:** [@markcitizen](https://discuss.elastic.co/u/markcitizen)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 6:31pm UTC](https://discuss.elastic.co/t/spark-elasticsearch-5-0-2-scala-matcherror/68364 "2016-12-12T18:31:28Z")
Hello, I'm using Spark 2.0 with Spark Elasticsearch version 5.0.2 (Scala 2.11): "org.elasticsearch" % "elasticsearch-spark-20\_2.11" % "5.0.2" When trying to read from an index I'm getting the following error: scala.M… --- ## [Query like UNION. Is it possible?](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335)
**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\ **Replies:** 1\ **Last updated:** [November 8, 2016, 10:13pm UTC](https://discuss.elastic.co/t/query-like-union-is-it-possible/65335 "2016-11-08T22:13:34Z")
Hello. Maybe I want to get strange thing but I'd like to do it. I've got log files which contain following data: ReportName, ReportAction (with values ReportStarted or ReportFinished. Each log can contain only one… --- ## [Update nested object in ElasticSearch](https://discuss.elastic.co/t/update-nested-object-in-elasticsearch/200751)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 3\ **Last updated:** [September 23, 2019, 9:15pm UTC](https://discuss.elastic.co/t/update-nested-object-in-elasticsearch/200751 "2019-09-23T21:15:09Z")
In one of my pipelines I am using logstash with JSON input and output to Elasticsearch with action =\> "update". One of the document fields contains nested data type. If in input JSON I receive following: "nested\_field… --- ## [Snapshot 'repository\_missing\_exception'](https://discuss.elastic.co/t/snapshot-repository-missing-exception/95151)
**Author:** [@frasdav](https://discuss.elastic.co/u/frasdav)\ **Replies:** 0\ **Last updated:** [July 31, 2017, 9:02am UTC](https://discuss.elastic.co/t/snapshot-repository-missing-exception/95151 "2017-07-31T09:02:51Z")
We’ve got two Elasticsearch 2.4 clusters configured identically. Both have a snapshot repository called ‘backups’ defined. If I do: curl -XGET https://$(hostname --fqdn):9200/\_snapshot?pretty …on any node in either clu… --- ## [How does the best\_compression work after I setting it?](https://discuss.elastic.co/t/how-does-the-best-compression-work-after-i-setting-it/78643)
**Author:** [@darouwan](https://discuss.elastic.co/u/darouwan)\ **Replies:** 3\ **Last updated:** [March 20, 2017, 1:04am UTC](https://discuss.elastic.co/t/how-does-the-best-compression-work-after-i-setting-it/78643 "2017-03-20T01:04:08Z")
I am working on index compression currently. Now I have existed index about 500MB to be compressed, but I meet the following questions: When does the best\_compression work after I setting it? Immediately or after a wh… --- ## [Metricbeat - network usage data for dashboard](https://discuss.elastic.co/t/metricbeat-network-usage-data-for-dashboard/61906)
**Author:** [@mha](https://discuss.elastic.co/u/mha)\ **Replies:** 3\ **Last updated:** [October 7, 2016, 2:49pm UTC](https://discuss.elastic.co/t/metricbeat-network-usage-data-for-dashboard/61906 "2016-10-07T14:49:45Z")
Hi This one is already closed: but I still think that it would be really nice feature to have network usage stored also as not incremental values. It would make network dashboard usable (incremental one is useless), a… --- ## [Are Ranges Inclusive?](https://discuss.elastic.co/t/are-ranges-inclusive/27269)
**Author:** [@LansK](https://discuss.elastic.co/u/LansK)\ **Replies:** 3\ **Last updated:** [August 13, 2015, 5:43am UTC](https://discuss.elastic.co/t/are-ranges-inclusive/27269 "2015-08-13T05:43:43Z")
Are ranges (such as in a pie chart) inclusive? In the Kibana tutorial (https://www.elastic.co/guide/en/kibana/4.1/tutorial-visualizing.html), ranges are specified between 1000 and 3000, and 3000 and 7000. Are both ranges… --- ## [Phrase matching using query\_string on nGram analyzed data](https://discuss.elastic.co/t/phrase-matching-using-query-string-on-ngram-analyzed-data/9029)
**Author:** [@Mike](https://discuss.elastic.co/u/Mike)\ **Replies:** 3\ **Last updated:** [September 17, 2012, 5:23pm UTC](https://discuss.elastic.co/t/phrase-matching-using-query-string-on-ngram-analyzed-data/9029 "2012-09-17T17:23:57Z")
I have my string field index\_analyzed with nGrams, and I can't seem to get phrase matching using " " in my search text to work. Other things like fuzzy matching with ~, combining words with && and ||, boosting with … --- ## [Try to define an admin role (used setting similar to superuser) but not work](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791)
**Author:** [@xujohn](https://discuss.elastic.co/u/xujohn)\ **Replies:** 2\ **Last updated:** [July 16, 2019, 11:34pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791 "2019-07-16T23:34:10Z")
In elasticsearch 7.2.0, I try to define in roles.yml the following role: admin\_role: cluster: \[ "all" \] indices: - names : \[ " \* " \] priviledges: \[ "all" \] allow\_restricted\_indices: true run\_as: \[ " \* " \] applica… --- ## [Elasticsearchのrest.action.multi.allow\_explicit\_indexに関して](https://discuss.elastic.co/t/elasticsearch-rest-action-multi-allow-explicit-index/105658)
**Author:** [@818uuu](https://discuss.elastic.co/u/818uuu)\ **Replies:** 2\ **Last updated:** [October 30, 2017, 1:45pm UTC](https://discuss.elastic.co/t/elasticsearch-rest-action-multi-allow-explicit-index/105658 "2017-10-30T13:45:10Z")
Elasticsearchでインデックスを上書きしない方法としてelasticsearch.ymlにrest.action.multi.allow\_explicit\_index:falseを追加してみましたが予想に反してインデックスが上書きできてしまい、結局目的を果たすことが出来ませんでした。 検証環境はElasticsearch 6.0.0-rc1で、実際に試した内容のログはこちらのブログ(http://sakura818uuu.h… --- ## [Strange Marvel license issue](https://discuss.elastic.co/t/strange-marvel-license-issue/50026)
**Author:** [@KevinFarrell](https://discuss.elastic.co/u/KevinFarrell)\ **Replies:** 2\ **Last updated:** [May 13, 2016, 8:51pm UTC](https://discuss.elastic.co/t/strange-marvel-license-issue/50026 "2016-05-13T20:51:58Z")
I have an Elasticsearch 2.1.0 cluster that's been up and running with Marvel reporting to a separate monitoring cluster for around 5 months with no issues. But I'm now unable to access Marvel due to a strange license is… --- ## [Automate rollover index](https://discuss.elastic.co/t/automate-rollover-index/165311)
**Author:** [@Yasmeenc](https://discuss.elastic.co/u/Yasmeenc)\ **Replies:** 8\ **Last updated:** [January 23, 2019, 4:04am UTC](https://discuss.elastic.co/t/automate-rollover-index/165311 "2019-01-23T04:04:37Z")
Hi Team, Does Elasticsearch rollover index automatically each time the rollover condition is true or it only do it once ? If once so how do I automate it, Please help --- ## [Getting Bad Request with message Request must contain a kbn-xsrf header](https://discuss.elastic.co/t/getting-bad-request-with-message-request-must-contain-a-kbn-xsrf-header/154138)
**Author:** [@Geet](https://discuss.elastic.co/u/Geet)\ **Replies:** 1\ **Last updated:** [October 26, 2018, 5:09pm UTC](https://discuss.elastic.co/t/getting-bad-request-with-message-request-must-contain-a-kbn-xsrf-header/154138 "2018-10-26T17:09:52Z")
Hi , i am new to Kiabana , and when trying to Login , i am getting : {"statusCode":400,"error":"Bad Request","message":"Request must contain a kbn-xsrf header."} Can anyone help ?? Because somewhere i read that : Hi, … --- ## [How do I sum the result of an aggregation and present it in a table?](https://discuss.elastic.co/t/how-do-i-sum-the-result-of-an-aggregation-and-present-it-in-a-table/324352)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 6\ **Last updated:** [February 17, 2023, 6:28pm UTC](https://discuss.elastic.co/t/how-do-i-sum-the-result-of-an-aggregation-and-present-it-in-a-table/324352 "2023-02-17T18:28:23Z")
I would like to take the results of this query, namely the values: 3683 3676 3574 3530 3706 3695 3663 3530 3586 3567 Sum them together, which would give: 36210, and display them in a table. I can't seem to … --- ## [Cluster elasticsearch port](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 6\ **Last updated:** [September 8, 2022, 11:00am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-port/313866 "2022-09-08T11:00:57Z")
Hello, I want to set up a 3-node elasticsearch cluster in production. 2 nodes master & data and one voting-only or data. I would like to know if I can assign a single port per node and not a range. For example : node… --- ## [Kibana - no information about Logstash](https://discuss.elastic.co/t/kibana-no-information-about-logstash/204442)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 6\ **Last updated:** [October 22, 2019, 2:39pm UTC](https://discuss.elastic.co/t/kibana-no-information-about-logstash/204442 "2019-10-22T14:39:11Z")
I have a little problem. Should I do something to make Kibana see Logstash? I don't see any information about Logstash in the Kibany web panel. Maybe I need to configure it additionally? Logstash is integrated with E… --- ## [Multiple inputs using the same port](https://discuss.elastic.co/t/multiple-inputs-using-the-same-port/158784)
**Author:** [@przemolb](https://discuss.elastic.co/u/przemolb)\ **Replies:** 6\ **Last updated:** [November 30, 2018, 9:08am UTC](https://discuss.elastic.co/t/multiple-inputs-using-the-same-port/158784 "2018-11-30T09:08:10Z")
Hello, we use currently filebeat for shipping logs to logstash. It is in internal network so no SSL. But I have a request to send logs from another place (from fluent bit: from fluent bit to logstash) over Internet so … --- ## [Duplicating data when i am using http plollar input](https://discuss.elastic.co/t/duplicating-data-when-i-am-using-http-plollar-input/91061)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 6\ **Last updated:** [June 28, 2017, 9:53am UTC](https://discuss.elastic.co/t/duplicating-data-when-i-am-using-http-plollar-input/91061 "2017-06-28T09:53:33Z")
I am using http \_pollar input and output as elastic search to get data. From input i am getting data as xml format so i used xml filter in filter section.Everything coming properly into elastic search but when logstash r… --- ## [Setting up Elasticsearch in Production](https://discuss.elastic.co/t/setting-up-elasticsearch-in-production/75417)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 6\ **Last updated:** [February 19, 2017, 4:10am UTC](https://discuss.elastic.co/t/setting-up-elasticsearch-in-production/75417 "2017-02-19T04:10:31Z")
Hello All, I am setting up ES in production with a different approach. I am actually splitting up the node role( master, data & ingest ). I know the configuration for each of them and this is well defined in the docume… --- ## [Logstash forwarding events only on log file update](https://discuss.elastic.co/t/logstash-forwarding-events-only-on-log-file-update/33050)
**Author:** [@nivetha](https://discuss.elastic.co/u/nivetha)\ **Replies:** 6\ **Last updated:** [October 28, 2015, 7:15am UTC](https://discuss.elastic.co/t/logstash-forwarding-events-only-on-log-file-update/33050 "2015-10-28T07:15:14Z")
Hi I am new to ELK. I am using logstash,Redis and Elasticsearch.When I push Events from logstash Shipper to Redis and then to Logstash Indexer and Query for events in Elasticsearch it shows Events lesser than the actual… --- ## [SAML Issue in ELK 7.6.4](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [October 1, 2020, 3:35pm UTC](https://discuss.elastic.co/t/saml-issue-in-elk-7-6-4/249890 "2020-10-01T15:35:01Z")
Hi All, I was trying to integrate Okta with elasticsearch, getting below error while logging into console, {"statusCode":401,"error":"Unauthorized","message":"\[security\_exception\] unable to authenticate user \[\ **Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 5\ **Last updated:** [December 6, 2019, 11:29am UTC](https://discuss.elastic.co/t/easy-way-to-get-a-terms-bucket-count-stats/210523 "2019-12-06T11:29:30Z") Hi, We're a need to get some extended\_stats on the bucket counts of a terms aggregation, i.e. we want to know the stats (avg, stddev etc) of the frequency of terms. So we do: terms {...} extended\_stats { path:"terms.\_co… --- ## [ELK state management!](https://discuss.elastic.co/t/elk-state-management/27545)
**Author:** [@sreeram](https://discuss.elastic.co/u/sreeram)\ **Replies:** 5\ **Last updated:** [August 18, 2015, 8:32am UTC](https://discuss.elastic.co/t/elk-state-management/27545 "2015-08-18T08:32:18Z")
Hi, I'm new to ELK, need clarifications on what is the purpose of logstash-forwarder when logstash itself can ship files ? I have a Usecase where my system might get restarted at times(killing all services abruptly)… --- ## [Wildcard and \_all with \_open don't seem to work in 1.5.2 (solved)](https://discuss.elastic.co/t/wildcard-and--all-with--open-dont-seem-to-work-in-1-5-2-solved/1046)
**Author:** [@esmattdawson](https://discuss.elastic.co/u/esmattdawson)\ **Replies:** 5\ **Last updated:** [May 20, 2015, 11:27pm UTC](https://discuss.elastic.co/t/wildcard-and--all-with--open-dont-seem-to-work-in-1-5-2-solved/1046 "2015-05-20T23:27:35Z")
I've just updated my dev machine from 1.4.x to 1.5.2 and can no longer do this: curl -XPOST 'localhost:9200/someindex\*/\_open' curl -XPOST 'localhost:9200/\_all/\_open' It always returns IndexMissingException, I've tried … --- ## [Filebeatで作成されるインデックスについて](https://discuss.elastic.co/t/filebeat/224017)
**Author:** [@111142](https://discuss.elastic.co/u/111142)\ **Replies:** 4\ **Last updated:** [March 19, 2020, 3:00am UTC](https://discuss.elastic.co/t/filebeat/224017 "2020-03-19T03:00:36Z")
filebeatの設定を下記のように行いモジュールごとにインデックスを分けてログを取り込んでいます。 output.elasticsearch: hosts: \["localhost:9200"\] indices: - index: "paloalto-%{+yyyy.MM.dd}" when.equals: event.module: "panw" - index: "elasti… --- ## [Date filter seems to remove message](https://discuss.elastic.co/t/date-filter-seems-to-remove-message/89329)
**Author:** [@Evertvz](https://discuss.elastic.co/u/Evertvz)\ **Replies:** 4\ **Last updated:** [June 15, 2017, 11:27am UTC](https://discuss.elastic.co/t/date-filter-seems-to-remove-message/89329 "2017-06-15T11:27:57Z")
Hello, My company is considering switching from graylog to logstash. For this I am setting up a proof of concept and I'm running into a strange problem when doing so. When using the date filter, the message disappears.… --- ## [Upgrade Kibana to latest version?](https://discuss.elastic.co/t/upgrade-kibana-to-latest-version/28444)
**Author:** [@dkraut](https://discuss.elastic.co/u/dkraut)\ **Replies:** 4\ **Last updated:** [March 24, 2017, 9:52am UTC](https://discuss.elastic.co/t/upgrade-kibana-to-latest-version/28444 "2017-03-24T09:52:30Z")
Anyone have the basic steps to upgrade to the latest version of kibana? --- ## [Why the title of visualization and it's id are different](https://discuss.elastic.co/t/why-the-title-of-visualization-and-its-id-are-different/77435)
**Author:** [@star90](https://discuss.elastic.co/u/star90)\ **Replies:** 4\ **Last updated:** [March 8, 2017, 1:39am UTC](https://discuss.elastic.co/t/why-the-title-of-visualization-and-its-id-are-different/77435 "2017-03-08T01:39:23Z")
in the latest version of kibana, the title and id are different when i create a new visualization or dashboard. how can i make them be same --- ## [Logstash, Could not index event to Elasticsearch](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 9:23am UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/240123 "2020-07-07T09:23:05Z")
Hi, I am trying to index some data with logstash. My config: input { redis{ host =\> "localhost" data\_type =\> "list" key =\> "timeset1" threads =\> 4 } } filter { date { match =\> \[ "timestamp" , "yyyy-MM-… --- ## [Is localhost self-signed certificate eligible to make trust connection to external OIDC identity provider?](https://discuss.elastic.co/t/is-localhost-self-signed-certificate-eligible-to-make-trust-connection-to-external-oidc-identity-provider/230998)
**Author:** [@KTH](https://discuss.elastic.co/u/KTH)\ **Replies:** 3\ **Last updated:** [May 25, 2020, 2:55pm UTC](https://discuss.elastic.co/t/is-localhost-self-signed-certificate-eligible-to-make-trust-connection-to-external-oidc-identity-provider/230998 "2020-05-25T14:55:13Z")
Hi, I managed to make localhost Kibana to be functioned in https environment.(The warning stated that it is not trusted). However my localhost elasticsearch node is still in http environment. The elasticsearch console … --- ## [Too Many Open Files](https://discuss.elastic.co/t/too-many-open-files/2896)
**Author:** [@Matt\_2](https://discuss.elastic.co/u/Matt_2)\ **Replies:** 3\ **Last updated:** [February 23, 2011, 11:10pm UTC](https://discuss.elastic.co/t/too-many-open-files/2896 "2011-02-23T23:10:02Z")
I tried to index about a million documents on a cluster of two servers and ran into my stock Fedora open files limit of 1024. Should I be bumping up the limit, or could Elastic Search be closing up some file descripto… --- ## [Watcher transform runtime error illegal\_argument\_exception: "dynamic method \[java.lang.String, getMillis/0\] not found"](https://discuss.elastic.co/t/watcher-transform-runtime-error-illegal-argument-exception-dynamic-method-java-lang-string-getmillis-0-not-found/191774)
**Author:** [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\ **Replies:** 2\ **Last updated:** [August 1, 2019, 12:03pm UTC](https://discuss.elastic.co/t/watcher-transform-runtime-error-illegal-argument-exception-dynamic-method-java-lang-string-getmillis-0-not-found/191774 "2019-08-01T12:03:32Z")
Hi, I've created a watch containing transform for which I get a runtime error when executing: "type" : "illegal\_argument\_exception", "reason" : "dynamic method \[java.lang.String, getMillis/0\] not found… --- ## [Kibana CanvasにおけるElasticsearch SQLの検索件数上限について](https://discuss.elastic.co/t/kibana-canvas-elasticsearch-sql/177797)
**Author:** [@alster](https://discuss.elastic.co/u/alster)\ **Replies:** 2\ **Last updated:** [April 22, 2019, 6:44am UTC](https://discuss.elastic.co/t/kibana-canvas-elasticsearch-sql/177797 "2019-04-22T06:44:32Z")
Elastic search、Kibana初心者です。 Elasticsearch SQLについて質問です。 データのグラフ化を行うために、Canvasを使用しています。 layerのData sourceに2800件のレコードがあるデータを利用して、 以下のSQLを実行しています SELECT \* FROM \[index名\] その結果をPreviewすると、データが1000件しか取得されておらず、 実際に保存してカウント… --- ## [Trying to grok a watchguard](https://discuss.elastic.co/t/trying-to-grok-a-watchguard/141733)
**Author:** [@L33T](https://discuss.elastic.co/u/L33T)\ **Replies:** 2\ **Last updated:** [July 26, 2018, 1:04pm UTC](https://discuss.elastic.co/t/trying-to-grok-a-watchguard/141733 "2018-07-26T13:04:03Z")
Hi, Im trying to make sense when grokking syslog output from a watchguard. Id like it to split into more fields than im actually getting e.g. port, source ip, destination ip etc etc etc... At present in my logstash conf… --- ## [Balancing searches on a cluster](https://discuss.elastic.co/t/balancing-searches-on-a-cluster/101887)
**Author:** [@wbehn](https://discuss.elastic.co/u/wbehn)\ **Replies:** 2\ **Last updated:** [September 27, 2017, 9:03am UTC](https://discuss.elastic.co/t/balancing-searches-on-a-cluster/101887 "2017-09-27T09:03:56Z")
Hi all, I have an elasticsearch cluster consisting of one client node and two data nodes as a part of an ELK stack. As we have configured 5 shards per index and 1 replica, every data node gets 2 primary shards and 3 rep… --- ## [Refer to value lists in ES|QL?](https://discuss.elastic.co/t/refer-to-value-lists-in-es-ql/384135)
**Author:** [@alyx](https://discuss.elastic.co/u/alyx)\ **Replies:** 1\ **Last updated:** [April 17, 2026, 6:37pm UTC](https://discuss.elastic.co/t/refer-to-value-lists-in-es-ql/384135 "2026-04-17T18:37:21Z")
Hi everyone! Trying to migrate from other SIEM platforms. One question is, is it possible to define some lists and refer to them across different rules? Like WHERE source.ip IN ${some\_defined\_list}? I tried to use valu… --- ## [Elastic Java Agent with CometD for Event based tracing](https://discuss.elastic.co/t/elastic-java-agent-with-cometd-for-event-based-tracing/356733)
**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 11:26am UTC](https://discuss.elastic.co/t/elastic-java-agent-with-cometd-for-event-based-tracing/356733 "2024-04-08T11:26:04Z")
Hi, I am currently using elastic java agent 1.36.0. The application I am trying to capture traces has Kafka calls based on events i.e, some of the services are event based while some are HTTP based. This application h… --- ## [Time taken by ELK stack to create indices](https://discuss.elastic.co/t/time-taken-by-elk-stack-to-create-indices/307836)
**Author:** [@Divyank\_Garg](https://discuss.elastic.co/u/Divyank_Garg)\ **Replies:** 7\ **Last updated:** [June 24, 2022, 10:36am UTC](https://discuss.elastic.co/t/time-taken-by-elk-stack-to-create-indices/307836 "2022-06-24T10:36:13Z")
How much time does it take to create indices using ELK services via docker-compose file? We process total 450 files of total size of 4.6GB to create 450 indices. All these files are basically the log files. It takes aro… --- ## [Index.sort on sequence numbers](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485)
**Author:** [@fhalde](https://discuss.elastic.co/u/fhalde)\ **Replies:** 7\ **Last updated:** [June 1, 2021, 8:42am UTC](https://discuss.elastic.co/t/index-sort-on-sequence-numbers/274485 "2021-06-01T08:42:21Z")
We have a use case that can greatly benefit from the ability to have an index.sort on \_seq\_no meta field of ES but that's not possible it seems As of now, that's not possible curl -XPUT -H "Content-Type:application/jso… --- ## [Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last required field arrived](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252)
**Author:** [@piyalkuet](https://discuss.elastic.co/u/piyalkuet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:53am UTC](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252 "2020-09-21T11:53:58Z")
Dear all, I am facing issues creating a rollup job for big indexes. While saving it gives me a exception "Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last r… --- ## [Problem in installing ingest attachment plugin ES 5.5.1](https://discuss.elastic.co/t/problem-in-installing-ingest-attachment-plugin-es-5-5-1/102093)
**Author:** [@Aamir](https://discuss.elastic.co/u/Aamir)\ **Replies:** 1\ **Last updated:** [September 28, 2017, 10:43am UTC](https://discuss.elastic.co/t/problem-in-installing-ingest-attachment-plugin-es-5-5-1/102093 "2017-09-28T10:43:53Z")
Hey, i am facing below exception while installing ingest attachment on windows 10 elasticsearch\\bin \> elasticsearch-plugin install ingest-attachment Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun… --- ## [Can't set cookie from login kibana 5.4.0](https://discuss.elastic.co/t/cant-set-cookie-from-login-kibana-5-4-0/87271)
**Author:** [@rgheleri](https://discuss.elastic.co/u/rgheleri)\ **Replies:** 1\ **Last updated:** [May 30, 2017, 4:16am UTC](https://discuss.elastic.co/t/cant-set-cookie-from-login-kibana-5-4-0/87271 "2017-05-30T04:16:45Z")
Hi, I know this is a common issue and looking around the forum no other topic could solve it. My problem is very similar to this topic below. I can make the login by /api/security/v1/login by ajax request and I can get… --- ## [Drill down from one visualization to another](https://discuss.elastic.co/t/drill-down-from-one-visualization-to-another/54614)
**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\ **Replies:** 1\ **Last updated:** [July 4, 2016, 8:33am UTC](https://discuss.elastic.co/t/drill-down-from-one-visualization-to-another/54614 "2016-07-04T08:33:08Z")
Hi , Is there an option to drill down from chart to details ? I saw the response that it's not possible Is there a new version of Kibana that support it ? If not is it planned for the next versions ? BR, Chen --- ## [Elasticsearch mapping to convert string fields to long](https://discuss.elastic.co/t/elasticsearch-mapping-to-convert-string-fields-to-long/49454)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 1\ **Last updated:** [May 7, 2016, 6:52am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-to-convert-string-fields-to-long/49454 "2016-05-07T06:52:30Z")
Please share Elasticsearch mapping to convert string fields to long Tanks in advance --- ## [WARN No appenders could be found for logger (org.apache.kafka.clients.consumer.ConsumerConfig)](https://discuss.elastic.co/t/warn-no-appenders-could-be-found-for-logger-org-apache-kafka-clients-consumer-consumerconfig/76784)
**Author:** [@mostolog](https://discuss.elastic.co/u/mostolog)\ **Replies:** 0\ **Last updated:** [February 28, 2017, 1:41pm UTC](https://discuss.elastic.co/t/warn-no-appenders-could-be-found-for-logger-org-apache-kafka-clients-consumer-consumerconfig/76784 "2017-02-28T13:41:30Z")
Hi During Logstash 5.2.1 boot which uses kafka input, just noticed a few warnings: log4j:WARN No appenders could be found for logger (org.apache.kafka.clients.consumer.ConsumerConfig). log4j:WARN Please initialize the … --- ## [Install Elastic Agent 8.12 via SCCM](https://discuss.elastic.co/t/install-elastic-agent-8-12-via-sccm/352032)
**Author:** [@gnatola](https://discuss.elastic.co/u/gnatola)\ **Replies:** 6\ **Last updated:** [January 31, 2024, 2:17pm UTC](https://discuss.elastic.co/t/install-elastic-agent-8-12-via-sccm/352032 "2024-01-31T14:17:00Z")
Is there a method for installing the Elastic Agent via SCCM? If yes, after installing via SCCM can upgrades be managed in the Fleet page of the Elastic Dashboard? Thank you. --- ## [Using the TransportClient with ECK](https://discuss.elastic.co/t/using-the-transportclient-with-eck/197767)
**Author:** [@akappler](https://discuss.elastic.co/u/akappler)\ **Replies:** 6\ **Last updated:** [April 14, 2020, 3:16pm UTC](https://discuss.elastic.co/t/using-the-transportclient-with-eck/197767 "2020-04-14T15:16:05Z")
We have a legacy application which uses the Java TransportClient to access the ES API on port 9300, which we would like to operate with the ES operator. It seems that the ES instance created by ECK only exposes the REST … --- ## [Filebeat CPU utilization metrics are not normalized by default](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659)
**Author:** [@marko\_vranjkovic](https://discuss.elastic.co/u/marko_vranjkovic)\ **Replies:** 6\ **Last updated:** [December 19, 2019, 8:38am UTC](https://discuss.elastic.co/t/filebeat-cpu-utilization-metrics-are-not-normalized-by-default/210659 "2019-12-19T08:38:35Z")
Can someone confirm that by using all default settings Filebeat CPU utilization metrics in Kibana stack monitoring are not normalized, e.g. for 4 CPUs the CPU utilization goes from 0% to 400%. This question is just a fi… --- ## [Filebeat 7.14.0 filestream input field log.offset is character count of the line](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956)
**Author:** [@Michael\_Savettiere](https://discuss.elastic.co/u/Michael_Savettiere)\ **Replies:** 4\ **Last updated:** [September 1, 2021, 2:22pm UTC](https://discuss.elastic.co/t/filebeat-7-14-0-filestream-input-field-log-offset-is-character-count-of-the-line/282956 "2021-09-01T14:22:10Z")
Using Filebeat 7.14.0 input: filestream and output.console: pretty: true I see that the value of log.offset is the size of the event.message and not the offset from the beginning of the file. I used to use input: log an… --- ## [Resizing of visualization whenever size of visualization is changed in dashboard](https://discuss.elastic.co/t/resizing-of-visualization-whenever-size-of-visualization-is-changed-in-dashboard/263594)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 4\ **Last updated:** [March 1, 2021, 5:36pm UTC](https://discuss.elastic.co/t/resizing-of-visualization-whenever-size-of-visualization-is-changed-in-dashboard/263594 "2021-03-01T17:36:13Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "data": {"url": "https://vega.github.io/vega-lite/data/barley.json"}, "width": 300, "height":300, "mark": "bar", "encoding": { "column": {"fi… [Previous page](https://discuss.elastic.co/top.md?page=961&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=963&per_page=50&period=all)