# Top **URL:** https://discuss.elastic.co/top.md?page=996&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 997 --- ## [How to use ESIntegTestCase in elasticsearch 5.6.3](https://discuss.elastic.co/t/how-to-use-esintegtestcase-in-elasticsearch-5-6-3/104787)
**Author:** [@tavandung12](https://discuss.elastic.co/u/tavandung12)\ **Replies:** 1\ **Last updated:** [October 22, 2017, 6:35am UTC](https://discuss.elastic.co/t/how-to-use-esintegtestcase-in-elasticsearch-5-6-3/104787 "2017-10-22T06:35:05Z")
Hi, When I run the source code: public class Mytests extends ESIntegTestCase { @Override protected Settings nodeSettings(int nodeOrdinal) { return Settings.builder().put(super.nodeSettings(nodeOrdinal)) … --- ## [Adding timezone to kibana watcher](https://discuss.elastic.co/t/adding-timezone-to-kibana-watcher/206114)
**Author:** [@Shan\_Chathusanda](https://discuss.elastic.co/u/Shan_Chathusanda)\ **Replies:** 2\ **Last updated:** [November 4, 2019, 4:26am UTC](https://discuss.elastic.co/t/adding-timezone-to-kibana-watcher/206114 "2019-11-04T04:26:07Z")
Hi, Currently I am developing a kibana advanced watcher and I need to get an average value of items from the previous day. I used the time range query in watcher but the watcher only executes in UTC time. I use now-1d/d… --- ## [TShark and Rotating JSON Files](https://discuss.elastic.co/t/tshark-and-rotating-json-files/195124)
**Author:** [@michaelberg](https://discuss.elastic.co/u/michaelberg)\ **Replies:** 2\ **Last updated:** [August 14, 2019, 4:24pm UTC](https://discuss.elastic.co/t/tshark-and-rotating-json-files/195124 "2019-08-14T16:24:44Z")
Greetings ... I am searching and searching and cannot seem to find a way to have TShark capture packets live to ElasticSearch JSON format and rotate them so I create a new JSON file, say, every hour or every 6 hours or … --- ## [Logstash won't start after clean shutdown](https://discuss.elastic.co/t/logstash-wont-start-after-clean-shutdown/180387)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [May 10, 2019, 8:42pm UTC](https://discuss.elastic.co/t/logstash-wont-start-after-clean-shutdown/180387 "2019-05-10T20:42:19Z")
After we upgraded to ELK version 7.0.1 Everytime when we shutdown logstash it won't start until I reboot the machine Here is the message. There is no other log gets register in log file. It is so annoying. just simple… --- ## [Merge different source (sql) to one index](https://discuss.elastic.co/t/merge-different-source-sql-to-one-index/139519)
**Author:** [@christian\_ha](https://discuss.elastic.co/u/christian_ha)\ **Replies:** 2\ **Last updated:** [July 12, 2018, 1:14pm UTC](https://discuss.elastic.co/t/merge-different-source-sql-to-one-index/139519 "2018-07-12T13:14:49Z")
I have two different sources. One is the oracle database of our cmdb and the other is the mysql database of ocs inventory. In the first source my document\_id is an ciid like this 'CI00001' in the second source my id is a… --- ## [Accessing a scripted field in an elasticsearch match query](https://discuss.elastic.co/t/accessing-a-scripted-field-in-an-elasticsearch-match-query/60238)
**Author:** [@omerbenamram](https://discuss.elastic.co/u/omerbenamram)\ **Replies:** 2\ **Last updated:** [September 12, 2016, 8:56am UTC](https://discuss.elastic.co/t/accessing-a-scripted-field-in-an-elasticsearch-match-query/60238 "2016-09-12T08:56:25Z")
I have a query like the following { "script\_fields": { "my\_script\_field": { "script": "..." } }, "query": { "match": { "my\_script\_field":"\*" } } } and it returns empty. { "took… --- ## [Highlight stopwords in hits](https://discuss.elastic.co/t/highlight-stopwords-in-hits/194636)
**Author:** [@fedoroko](https://discuss.elastic.co/u/fedoroko)\ **Replies:** 3\ **Last updated:** [August 14, 2019, 10:48am UTC](https://discuss.elastic.co/t/highlight-stopwords-in-hits/194636 "2019-08-14T10:48:49Z")
Hey, what is the best way to skip stopwords in query but highlight them in hits? Current settings: 'settings': { 'analysis': { 'analyzer':{ my\_analyzer:{ 'tokenizer':'standard', … --- ## [Merging two lines with the same id to use as one document](https://discuss.elastic.co/t/merging-two-lines-with-the-same-id-to-use-as-one-document/173213)
**Author:** [@pbressan13](https://discuss.elastic.co/u/pbressan13)\ **Replies:** 3\ **Last updated:** [March 25, 2019, 8:45pm UTC](https://discuss.elastic.co/t/merging-two-lines-with-the-same-id-to-use-as-one-document/173213 "2019-03-25T20:45:57Z")
Hi, I'm struggling a few days in order to use aggregate filter to work (or i think it should work like this) I have two lines, as follows E.g: 08:00:45,585|73560708|ibwsin-tp-359|INFO|LoggerService||LogExecutionResul… --- ## [Pre-process message backslashes prior to JSON filter](https://discuss.elastic.co/t/pre-process-message-backslashes-prior-to-json-filter/169821)
**Author:** [@NathanBaulch](https://discuss.elastic.co/u/NathanBaulch)\ **Replies:** 3\ **Last updated:** [February 26, 2019, 1:30am UTC](https://discuss.elastic.co/t/pre-process-message-backslashes-prior-to-json-filter/169821 "2019-02-26T01:30:32Z")
I'm trying to replace the literal string "\\x" with "\\u00" just before parsing JSON to (somewhat naively) convert invalid hex escapes (coming from Nginx) into Unicode escapes. However no matter what I try I always get Log… --- ## [Does Elasticsearch score different length shingles with the same IDF?](https://discuss.elastic.co/t/does-elasticsearch-score-different-length-shingles-with-the-same-idf/126653)
**Author:** [@Brett\_Anderson](https://discuss.elastic.co/u/Brett_Anderson)\ **Replies:** 3\ **Last updated:** [April 9, 2018, 3:37pm UTC](https://discuss.elastic.co/t/does-elasticsearch-score-different-length-shingles-with-the-same-idf/126653 "2018-04-09T15:37:38Z")
In Elasticsearch 5.6.5 I'm searching against a field with the following filter applied: "filter\_shingle":{ "max\_shingle\_size":"4", "min\_shingle\_size":"2", "output\_unigrams":"true", "typ… --- ## [CPU utilization is too low while indexing](https://discuss.elastic.co/t/cpu-utilization-is-too-low-while-indexing/178347)
**Author:** [@suvarna](https://discuss.elastic.co/u/suvarna)\ **Replies:** 5\ **Last updated:** [April 26, 2019, 6:10am UTC](https://discuss.elastic.co/t/cpu-utilization-is-too-low-while-indexing/178347 "2019-04-26T06:10:16Z")
Hi Please find the below configuration. Rally: 1.Running esrally by using eventdata track. 2.Number of shards are 10: 3)Bulk size =2000000 system: 1)have 2 nodes 28 cores per socket. 2)have 1 nvme device of 1.… --- ## [Add more sort on specific fields](https://discuss.elastic.co/t/add-more-sort-on-specific-fields/161775)
**Author:** [@ge\_gary](https://discuss.elastic.co/u/ge_gary)\ **Replies:** 5\ **Last updated:** [December 23, 2018, 2:28pm UTC](https://discuss.elastic.co/t/add-more-sort-on-specific-fields/161775 "2018-12-23T14:28:27Z")
When the first field is equal, the second field is not equal but not compared my query : GET /filebeat.2018-12-20/\_search { "size": 20, "query": { "bool": { "must": \[ { … --- ## [Es search is not working for a specific field](https://discuss.elastic.co/t/es-search-is-not-working-for-a-specific-field/158850)
**Author:** [@arunvinodh](https://discuss.elastic.co/u/arunvinodh)\ **Replies:** 5\ **Last updated:** [November 30, 2018, 7:51am UTC](https://discuss.elastic.co/t/es-search-is-not-working-for-a-specific-field/158850 "2018-11-30T07:51:33Z")
Hi Team, I am facing an issue in elastic search, I have 10 records in elastic search and while searching a field "URL" I am not able to get the relevant/required results for one field and for the other fields it is sh… --- ## [Filter is not working](https://discuss.elastic.co/t/filter-is-not-working/53068)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 5\ **Last updated:** [June 17, 2016, 7:05pm UTC](https://discuss.elastic.co/t/filter-is-not-working/53068 "2016-06-17T19:05:58Z")
I am following this tutorial; https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html The grok pattern is not working. I can not get the result as it expected in the article --- ## [Smart Chinese Analysis returns unicodes instead of chinese tokens](https://discuss.elastic.co/t/smart-chinese-analysis-returns-unicodes-instead-of-chinese-tokens/37133)
**Author:** [@Bogdan\_Petea](https://discuss.elastic.co/u/Bogdan_Petea)\ **Replies:** 5\ **Last updated:** [December 15, 2015, 2:09pm UTC](https://discuss.elastic.co/t/smart-chinese-analysis-returns-unicodes-instead-of-chinese-tokens/37133 "2015-12-15T14:09:12Z")
I'm trying to analyse documents in Elasticsearch using Smart Chinese Analyser, but, instead of getting the analysed Chinese characters, Elasticsearch returns the unicodes of these characters. For example: PUT /test\_chi… --- ## [Defaulting pipeline worker threads to 1](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465)
**Author:** [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)\ **Replies:** 1\ **Last updated:** [December 8, 2016, 8:42pm UTC](https://discuss.elastic.co/t/defaulting-pipeline-worker-threads-to-1/68465 "2016-12-08T20:42:57Z")
Hello, I have following config for logstash.. input { file { path =\> "/appl/log/TestLogs/\*.log" start\_position =\> "beginning" sincedb\_path =\> "/appl/log/sincedbloc/sincedbfile.txt" } } filter{ … --- ## [HTML in Kibana email action](https://discuss.elastic.co/t/html-in-kibana-email-action/277093)
**Author:** [@sireesha\_m](https://discuss.elastic.co/u/sireesha_m)\ **Replies:** 1\ **Last updated:** [July 5, 2021, 3:18pm UTC](https://discuss.elastic.co/t/html-in-kibana-email-action/277093 "2021-07-05T15:18:08Z")
I have Kibana email action being triggered as a web hook from my Elastic watcher. The doc says markdown is supported. I have added the following for email payload: \`\`"message": "New alert created for asset motor\_pump\_… --- ## [Unable to install custom plugin in logstash5.x](https://discuss.elastic.co/t/unable-to-install-custom-plugin-in-logstash5-x/78141)
**Author:** [@Nikhil\_Pillai](https://discuss.elastic.co/u/Nikhil_Pillai)\ **Replies:** 1\ **Last updated:** [March 28, 2017, 2:20pm UTC](https://discuss.elastic.co/t/unable-to-install-custom-plugin-in-logstash5-x/78141 "2017-03-28T14:20:15Z")
Hi, I am facing below error when trying to install a custom (logstash-output-jdbc) plugin in logstash 5.2. Server doesn't have an internet access. ./logstash-plugin install file:///home/tibusr/mounted/ELK/logstash-o… --- ## [Running Kibana in Docker - default index patterns](https://discuss.elastic.co/t/running-kibana-in-docker-default-index-patterns/206300)
**Author:** [@jaredvacanti](https://discuss.elastic.co/u/jaredvacanti)\ **Replies:** 2\ **Last updated:** [November 18, 2019, 1:45am UTC](https://discuss.elastic.co/t/running-kibana-in-docker-default-index-patterns/206300 "2019-11-18T01:45:31Z")
Is there a way to provide a fresh kibana instance running in a docker container some default index patterns to load when first starting kibana + es? Currently I have to manually set patterns in the dashboard, it would be… --- ## [Elasticsearch::Transport::Transport::Errors::ServiceUnavailable: \[503\] {"ok":false,"message":"The requested deployment is currently unavailable."}](https://discuss.elastic.co/t/elasticsearch-503-ok-false-message-the-requested-deployment-is-currently-unavailable/200583)
**Author:** [@atul2685](https://discuss.elastic.co/u/atul2685)\ **Replies:** 2\ **Last updated:** [September 23, 2019, 12:52pm UTC](https://discuss.elastic.co/t/elasticsearch-503-ok-false-message-the-requested-deployment-is-currently-unavailable/200583 "2019-09-23T12:52:25Z")
Hi, I don't know why I am getting the above error continuously. Error count has been reached to 1,00,000. --- ## [Combine fields into one field but from Grok match](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370)
**Author:** [@waqark3389](https://discuss.elastic.co/u/waqark3389)\ **Replies:** 2\ **Last updated:** [August 7, 2018, 4:50pm UTC](https://discuss.elastic.co/t/combine-fields-into-one-field-but-from-grok-match/143370 "2018-08-07T16:50:11Z")
match =\> \["message", "(?\%{YEAR}.%{MONTHNUM}.%{MONTHDAY} %{TIME}Z) (?%{SYSLOG5424SD}):(?%{SYSLOG5424SD}):(?%{SYSLOG5424SD}) (?(.|\\r|\\n)\*)"\] break\_on\_match =\> false mutate { add\_field =\> {"lo… --- ## [Custom styling of compose box](https://discuss.elastic.co/t/custom-styling-of-compose-box/110438)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 2\ **Last updated:** [December 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/custom-styling-of-compose-box/110438 "2017-12-06T04:38:36Z")
With the merging of our new composer style the custom CSS for the composer here on Elastic needs adjusting - see the right side of the screenshot below: \[image\] --- ## [Integrate logstash with zabbix 2.2 for getting alerts](https://discuss.elastic.co/t/integrate-logstash-with-zabbix-2-2-for-getting-alerts/53772)
**Author:** [@Sarath\_S](https://discuss.elastic.co/u/Sarath_S)\ **Replies:** 2\ **Last updated:** [June 23, 2016, 1:06pm UTC](https://discuss.elastic.co/t/integrate-logstash-with-zabbix-2-2-for-getting-alerts/53772 "2016-06-23T13:06:23Z")
OS: Ubuntu 14.04 I would like to Integrate logstash with zabbix for getting alerts while logstash getting error messages from openstack node logs. I have already configured ELK stack and Zabbix which are working calm.… --- ## [Using other than comma as separator in csv filter](https://discuss.elastic.co/t/using-other-than-comma-as-separator-in-csv-filter/240067)
**Author:** [@Shipper01](https://discuss.elastic.co/u/Shipper01)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 12:53am UTC](https://discuss.elastic.co/t/using-other-than-comma-as-separator-in-csv-filter/240067 "2020-07-07T00:53:01Z")
I have files that has either a semi-colon or pipe as separator. The values within the fields can have commas, so I can't use a commas as separator. I have tried using the csv filter and altering the separator. My conf… --- ## [Errors while indexing mounted drive using fscrawler](https://discuss.elastic.co/t/errors-while-indexing-mounted-drive-using-fscrawler/228238)
**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\ **Replies:** 4\ **Last updated:** [April 17, 2020, 12:12pm UTC](https://discuss.elastic.co/t/errors-while-indexing-mounted-drive-using-fscrawler/228238 "2020-04-17T12:12:38Z")
Hi, I have mounted sharpeoint site to a network drive (/mnt/sp) in centos. Then I am indexing the mounted files using fscrawler. Here is my settings file: --- name: "index\_45.79.189.33" fs: url: "/mnt/sp/fsSharepoi… --- ## [Logstash output plugin not writing data sequentially](https://discuss.elastic.co/t/logstash-output-plugin-not-writing-data-sequentially/146178)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 4\ **Last updated:** [August 30, 2018, 6:34pm UTC](https://discuss.elastic.co/t/logstash-output-plugin-not-writing-data-sequentially/146178 "2018-08-30T18:34:08Z")
Hi There, I am using logstash as means of backup tool for the logs of my application. The conf file i created is simply an input with a file plugin and an output with a file plugin. So basically i have a shell script r… --- ## [Has\_child / has\_parent for billions of children - heavy cpu load for simple queries?](https://discuss.elastic.co/t/has-child-has-parent-for-billions-of-children-heavy-cpu-load-for-simple-queries/59026)
**Author:** [@AndreCi](https://discuss.elastic.co/u/AndreCi)\ **Replies:** 4\ **Last updated:** [August 29, 2016, 8:55am UTC](https://discuss.elastic.co/t/has-child-has-parent-for-billions-of-children-heavy-cpu-load-for-simple-queries/59026 "2016-08-29T08:55:34Z")
Hey everyone, is there a trick to speed up has\_child / has\_parent joins for small subsets of large document bodies? We have around 90 million parent documents and close to 1.4 billion child documents, seven 10-core mac… --- ## [Netflow - SUM netflow.bytes between 2 ip's](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409)
**Author:** [@rjpetrin](https://discuss.elastic.co/u/rjpetrin)\ **Replies:** 6\ **Last updated:** [July 25, 2019, 5:20pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409 "2019-07-25T17:20:55Z")
Hi All, I'm using ELK 7.1 and Netflow v.5 to gather and visualize Netflow data in our environment. All features and dashboards are working correctly. However I'm trying to create a graph that displays the bandwidth bein… --- ## [Benefits of using Apache Nifi instead of logstash](https://discuss.elastic.co/t/benefits-of-using-apache-nifi-instead-of-logstash/126436)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 0\ **Last updated:** [April 2, 2018, 2:00pm UTC](https://discuss.elastic.co/t/benefits-of-using-apache-nifi-instead-of-logstash/126436 "2018-04-02T14:00:24Z")
Hi Team, can someone tell me if using Apache Nifi instead of logstash would be useful? Since I believe logstash goes very well with EK not sure what benefit I'll get? What your thoughts? And which one will be best cons… --- ## [Bool search must\_not is not useful](https://discuss.elastic.co/t/bool-search-must-not-is-not-useful/124041)
**Author:** [@shockerY](https://discuss.elastic.co/u/shockerY)\ **Replies:** 3\ **Last updated:** [March 16, 2018, 3:44am UTC](https://discuss.elastic.co/t/bool-search-must-not-is-not-useful/124041 "2018-03-16T03:44:59Z")
I use bool to search,it like this: { "query": { "bool": { "must": { "match": { "message": { "query": "disconnect" }… --- ## [Can't start winlogbeat as service](https://discuss.elastic.co/t/cant-start-winlogbeat-as-service/112694)
**Author:** [@talis](https://discuss.elastic.co/u/talis)\ **Replies:** 0\ **Last updated:** [December 20, 2017, 6:11pm UTC](https://discuss.elastic.co/t/cant-start-winlogbeat-as-service/112694 "2017-12-20T18:11:15Z")
I experienced the following error when trying to start winlogbeat as a service: Windows could not start the winlogbeat service on Local Computer. Error 1053: The service did not respond to the start or control request … --- ## [Access Kibana Dashboard without login](https://discuss.elastic.co/t/access-kibana-dashboard-without-login/218626)
**Author:** [@BjoernB](https://discuss.elastic.co/u/BjoernB)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 3:51pm UTC](https://discuss.elastic.co/t/access-kibana-dashboard-without-login/218626 "2020-02-10T15:51:17Z")
Seems to be a well discussed topic, but I might run into some difficulties. I'm using elastic-stack in Version: 6.2.4, x-pack installed. I already do the "anonymous"-user in elasticstack.yml - Where I can change the ac… --- ## ['View examples' for mlcategory detector hangs browser (6.0.0-rc1)](https://discuss.elastic.co/t/view-examples-for-mlcategory-detector-hangs-browser-6-0-0-rc1/104270)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 7\ **Last updated:** [November 2, 2017, 10:06am UTC](https://discuss.elastic.co/t/view-examples-for-mlcategory-detector-hangs-browser-6-0-0-rc1/104270 "2017-11-02T10:06:47Z")
I have created a job using count by mlcategory on a message field. In the Anomaly Explorer I get anomalies, and in the links column there is an Open link / View examples link. In the next column we have category examples… --- ## [Where can we download the benchmark dataset?](https://discuss.elastic.co/t/where-can-we-download-the-benchmark-dataset/55011)
**Author:** [@chenryn](https://discuss.elastic.co/u/chenryn)\ **Replies:** 1\ **Last updated:** [July 20, 2016, 6:24am UTC](https://discuss.elastic.co/t/where-can-we-download-the-benchmark-dataset/55011 "2016-07-20T06:24:51Z")
I see 'Using JSON source documents: /l/data/geonames-documents.json.blocks' at https://benchmarks.elastic.co/logs/fastsettings/2016-05-17-23-28-23.txt And Benchmark Scenarios only said 'indexes 8.6M documents (POIs fro… --- ## [Problems with logstsah multiple pipelines](https://discuss.elastic.co/t/problems-with-logstsah-multiple-pipelines/127017)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 2\ **Last updated:** [April 6, 2018, 2:22am UTC](https://discuss.elastic.co/t/problems-with-logstsah-multiple-pipelines/127017 "2018-04-06T02:22:17Z")
Dear folks, Recently I'm trying to enable multiple pipelines with logstash version 6.2.3. but we got the problems from the logstash log as follows, I tested my pipline with version 5.5.x , It's working well with single… --- ## [Getting lots of Errors on dashboard visuals "EsError"](https://discuss.elastic.co/t/getting-lots-of-errors-on-dashboard-visuals-eserror/274245)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 5\ **Last updated:** [June 4, 2021, 2:41pm UTC](https://discuss.elastic.co/t/getting-lots-of-errors-on-dashboard-visuals-eserror/274245 "2021-06-04T14:41:45Z")
I keep getting these errors on my dashboard and they appear relatively often. When I hover over it, it only says \[esaggs\] \> EsError . When I look at network/console in inspector, I get {"statusCode":404,"error":"Not … --- ## [Facet performance going bad on large indexes](https://discuss.elastic.co/t/facet-performance-going-bad-on-large-indexes/15423)
**Author:** [@oreno](https://discuss.elastic.co/u/oreno)\ **Replies:** 5\ **Last updated:** [January 29, 2014, 5:40pm UTC](https://discuss.elastic.co/t/facet-performance-going-bad-on-large-indexes/15423 "2014-01-29T17:40:46Z")
Hi, I've been testing the facet performance during that last week and at first it seemed like the perfect solution for my need. Now I'm not so sure. I have 2 indexes, index1 with 50GB and index2 with 160GB (both w… --- ## [SIGSEGV JVM Crash with ZGC Garbage collection](https://discuss.elastic.co/t/sigsegv-jvm-crash-with-zgc-garbage-collection/337269)
**Author:** [@Kim\_Attree](https://discuss.elastic.co/u/Kim_Attree)\ **Replies:** 4\ **Last updated:** [October 12, 2023, 6:20am UTC](https://discuss.elastic.co/t/sigsegv-jvm-crash-with-zgc-garbage-collection/337269 "2023-10-12T06:20:21Z")
Kibana version: 7.17.5 Elasticsearch version: 7.17.5 Java: OpenJDK 64-Bit Server VM Temurin-17.0.6+10 (build 17.0.6+10, mixed mode, sharing) APM Agent language and version: Java 1.37.0 OS: Alpine Linux v3.17 Running… --- ## [Analysis with Lens Table return statusCode: 413](https://discuss.elastic.co/t/analysis-with-lens-table-return-statuscode-413/302926)
**Author:** [@rituzza](https://discuss.elastic.co/u/rituzza)\ **Replies:** 4\ **Last updated:** [April 29, 2022, 7:18am UTC](https://discuss.elastic.co/t/analysis-with-lens-table-return-statuscode-413/302926 "2022-04-29T07:18:33Z")
I have an enviroment with Kibana v7.14.1 e I created an analysis with lens component that return the error {statusCode: 413, error: "Request Entity Too Large",…} error: "Request Entity Too Large" message: "Payload co… --- ## [Using logstash plugin to change a field value](https://discuss.elastic.co/t/using-logstash-plugin-to-change-a-field-value/205907)
**Author:** [@ndg](https://discuss.elastic.co/u/ndg)\ **Replies:** 4\ **Last updated:** [October 31, 2019, 1:17pm UTC](https://discuss.elastic.co/t/using-logstash-plugin-to-change-a-field-value/205907 "2019-10-31T13:17:01Z")
I have a ELK stack deployed in docker swarm and i need to improve some data created by the filebeat. I have a field with docker metadata that contains the node id (container.labels.com\_docker\_swarm\_node\_id) with a random… --- ## [Does packet beat work for custom ports or custom protocols?](https://discuss.elastic.co/t/does-packet-beat-work-for-custom-ports-or-custom-protocols/35991)
**Author:** [@rabeetwaqar](https://discuss.elastic.co/u/rabeetwaqar)\ **Replies:** 4\ **Last updated:** [December 1, 2015, 11:01am UTC](https://discuss.elastic.co/t/does-packet-beat-work-for-custom-ports-or-custom-protocols/35991 "2015-12-01T11:01:34Z")
Hi Does packet beat work for custom ports or custom protocols? Thanks --- ## [Special Characters in Query String](https://discuss.elastic.co/t/special-characters-in-query-string/224971)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 1\ **Last updated:** [March 26, 2020, 11:47am UTC](https://discuss.elastic.co/t/special-characters-in-query-string/224971 "2020-03-26T11:47:16Z")
Hi, I'm having trouble trying to search special characters using query string. I need to search an email address in format "xxx@xxx.xxx". At index time I use a custom normalizer which provide lowercase and ascii folding.… --- ## [CMSInitiatingOccupancyFraction not having any effect on GC trigger](https://discuss.elastic.co/t/cmsinitiatingoccupancyfraction-not-having-any-effect-on-gc-trigger/204230)
**Author:** [@Amit\_Agarwal](https://discuss.elastic.co/u/Amit_Agarwal)\ **Replies:** 1\ **Last updated:** [October 25, 2019, 1:13pm UTC](https://discuss.elastic.co/t/cmsinitiatingoccupancyfraction-not-having-any-effect-on-gc-trigger/204230 "2019-10-25T13:13:11Z")
Hi, CMSInitiatingOccupancyFraction=75 flag does not seem to have any effect on GC. The GC starts at about 85-95 % old gen usage and makes the cluster status as yellow. I am using 1.7 version with java 8. Any idea what m… --- ## [Unexpected exception while running Enterprise Search](https://discuss.elastic.co/t/unexpected-exception-while-running-enterprise-search/283244)
**Author:** [@Shubh\_Garg](https://discuss.elastic.co/u/Shubh_Garg)\ **Replies:** 3\ **Last updated:** [September 3, 2021, 10:49pm UTC](https://discuss.elastic.co/t/unexpected-exception-while-running-enterprise-search/283244 "2021-09-03T22:49:55Z")
I am trying to setup elastic enterprise search through docker compose but i keep getting , "Unexpected exception while running Enterprise Search" in the logs. Here are the full logs , Overwriting the default Enterpris… --- ## [Converting old logstash file to new syntax](https://discuss.elastic.co/t/converting-old-logstash-file-to-new-syntax/132600)
**Author:** [@arcreigh](https://discuss.elastic.co/u/arcreigh)\ **Replies:** 8\ **Last updated:** [May 24, 2018, 4:30am UTC](https://discuss.elastic.co/t/converting-old-logstash-file-to-new-syntax/132600 "2018-05-24T04:30:13Z")
Hello all! I would like to use the following configuration to parse through my Juniper logs. ## Grok filter SRX ## input { syslog{ host =\> "10.25.2.200" port =\> "10514" type =\> "syslog" } } filter { if \[type\] ==… --- ## [Parent-Child mapping using JAVA client API using POJO's](https://discuss.elastic.co/t/parent-child-mapping-using-java-client-api-using-pojos/118335)
**Author:** [@wandermonk](https://discuss.elastic.co/u/wandermonk)\ **Replies:** 3\ **Last updated:** [February 4, 2018, 3:30pm UTC](https://discuss.elastic.co/t/parent-child-mapping-using-java-client-api-using-pojos/118335 "2018-02-04T15:30:22Z")
Hi, I am a newbie working with ElasticSearch. I have been working on an application for which I would like to use ES as the backend datastore. I have POJO's or domain entities for which I would like to create a Parent-Ch… --- ## [Foreach for bucket aggregation in watcher not working](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 6:10pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523 "2020-11-09T18:10:58Z")
Hi , I am trying to logging according to user using foreach but it is giving exception "type" : "exception", "reason" : "specified foreach object was null: \[ctx.payload.aggregations.user.buckets.keys\]" } Foreach C… --- ## [Metricbeat: Kibana Dashboard with (almost) no data](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-with-almost-no-data/226760)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 6\ **Last updated:** [April 10, 2020, 11:10pm UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-with-almost-no-data/226760 "2020-04-10T23:10:41Z")
Hi I have a group of Metricbeats collecting metrics every 1m. When I try to view those metrics in the Dashboard / \[Metricbeat System\] Host overview ECS I get something like this: Not much being showed and some visual… --- ## [Why move shard to unassigned when the circuit breaker is open?](https://discuss.elastic.co/t/why-move-shard-to-unassigned-when-the-circuit-breaker-is-open/212085)
**Author:** [@cigarl](https://discuss.elastic.co/u/cigarl)\ **Replies:** 6\ **Last updated:** [December 19, 2019, 2:04am UTC](https://discuss.elastic.co/t/why-move-shard-to-unassigned-when-the-circuit-breaker-is-open/212085 "2019-12-19T02:04:16Z")
I find that the replica shard is moved to unassigned, when write to replica and trip to circuit-brek if i used Circuit-break based on real memory usage. This will result in many started shards being moved back to the u… --- ## [Wildcard \* is not working for my index](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040)
**Author:** [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)\ **Replies:** 6\ **Last updated:** [September 25, 2019, 7:03pm UTC](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040 "2019-09-25T19:03:11Z")
Hi, I have created an index with the following mapping: PUT abc { "mappings": { "type" : { "properties": { "title" : { "type": "text", "analyzer": "standard" } } } } } After this I added documents to it li… [Previous page](https://discuss.elastic.co/top.md?page=995&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=997&per_page=50&period=all)