# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1789 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1790 --- ## [Watcher doesn't support "distinct count"](https://discuss.elastic.co/t/watcher-doesnt-support-distinct-count/119565)
**Author:** [@ahrtr](https://discuss.elastic.co/u/ahrtr)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 7:59am UTC](https://discuss.elastic.co/t/watcher-doesnt-support-distinct-count/119565 "2018-02-14T07:59:20Z")
There are two fields in each log entry (elasticsearch document), which are userid and ipaddress. I want to fire an alert if the same user logs into the system using 2 or more ipaddresses in the past 10 minutes. So the … --- ## [Watcher errors on sending report with attachment (Error 500)](https://discuss.elastic.co/t/watcher-errors-on-sending-report-with-attachment-error-500/118127)
**Author:** [@cafuego](https://discuss.elastic.co/u/cafuego)\ **Replies:** 9\ **Last updated:** [February 14, 2018, 7:47am UTC](https://discuss.elastic.co/t/watcher-errors-on-sending-report-with-attachment-error-500/118127 "2018-02-14T07:47:46Z")
I use version 5.6.5 of the ELK stack, running under docker. I have a watch that is supposed to run once per month on the 1st of the month and send an email with a PDF report attached containing stats for the previous mo… --- ## [Need step by step process to upload log files into elastic search through Logstash to see result in KIbana](https://discuss.elastic.co/t/need-step-by-step-process-to-upload-log-files-into-elastic-search-through-logstash-to-see-result-in-kibana/119736)
**Author:** [@Anilg](https://discuss.elastic.co/u/Anilg)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 7:46am UTC](https://discuss.elastic.co/t/need-step-by-step-process-to-upload-log-files-into-elastic-search-through-logstash-to-see-result-in-kibana/119736 "2018-02-14T07:46:22Z")
I have all the setup...already few ".json" files are successfully uploaded.but for log files I need help...I am using ubuntu...Thanks in advance.. --- ## ["parse\_exception",](https://discuss.elastic.co/t/parse-exception/119734)
**Author:** [@Anilg](https://discuss.elastic.co/u/Anilg)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 7:39am UTC](https://discuss.elastic.co/t/parse-exception/119734 "2018-02-14T07:39:55Z")
why I am getting this Exception to upload the Data into elastic search....? can anyone tell the reason and solution for this please... curl -XPUT 'localhost:9200/abcfile11?pretty' -H 'Content-Type: application/json' -d' … --- ## [Watcher's State - Error!](https://discuss.elastic.co/t/watchers-state-error/119132)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 11\ **Last updated:** [February 14, 2018, 7:36am UTC](https://discuss.elastic.co/t/watchers-state-error/119132 "2018-02-14T07:36:55Z")
I just noticed that several of X-Pack Monitoring watcher's state is: Error! w/ comment Execution Failing Please advise. --- ## [Changing path.data without full cluster restart](https://discuss.elastic.co/t/changing-path-data-without-full-cluster-restart/119740)
**Author:** [@vivek7mehta](https://discuss.elastic.co/u/vivek7mehta)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 7:34am UTC](https://discuss.elastic.co/t/changing-path-data-without-full-cluster-restart/119740 "2018-02-14T07:34:20Z")
I wanted to change path.data setting for each node in my cluster (6 data and 2 master nodes). Is it possible to do this change without full cluster restart (if any way I can restart nodes one by one and keep cluster runn… --- ## [Curator ignores everything](https://discuss.elastic.co/t/curator-ignores-everything/118906)
**Author:** [@HansCama](https://discuss.elastic.co/u/HansCama)\ **Replies:** 2\ **Last updated:** [February 14, 2018, 7:31am UTC](https://discuss.elastic.co/t/curator-ignores-everything/118906 "2018-02-14T07:31:01Z")
I'm running curator from the command line passing an action and a config file. I'm managed to make it run apparently properly once: curator --config curator-config.yml curator-action.yml 2018-02-07 17:55:22,823 INFO … --- ## [Error saving Slack Action - Watcher: \[illegal\_argument\_exception\] no account found for name: \[null\]](https://discuss.elastic.co/t/error-saving-slack-action-watcher-illegal-argument-exception-no-account-found-for-name-null/117634)
**Author:** [@Meitsrik](https://discuss.elastic.co/u/Meitsrik)\ **Replies:** 6\ **Last updated:** [February 14, 2018, 7:28am UTC](https://discuss.elastic.co/t/error-saving-slack-action-watcher-illegal-argument-exception-no-account-found-for-name-null/117634 "2018-02-14T07:28:50Z")
Hello! I'm setting up a watcher (as described here https://www.elastic.co/guide/en/x-pack/current/actions-slack.html) to check for some error-level logs and send a message to a Slack channel when X errors in Y minutes o… --- ## [How can i increase Nodes and how to configure Replicas and shards](https://discuss.elastic.co/t/how-can-i-increase-nodes-and-how-to-configure-replicas-and-shards/119733)
**Author:** [@saineshwar\_bageri](https://discuss.elastic.co/u/saineshwar_bageri)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 7:28am UTC](https://discuss.elastic.co/t/how-can-i-increase-nodes-and-how-to-configure-replicas-and-shards/119733 "2018-02-14T07:28:17Z")
I have only one Node in elastic Search how can i increase Nodes and how to configure Replicas and shards \[image\] --- ## [Adding field to existing template](https://discuss.elastic.co/t/adding-field-to-existing-template/119737)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 0\ **Last updated:** [February 14, 2018, 7:09am UTC](https://discuss.elastic.co/t/adding-field-to-existing-template/119737 "2018-02-14T07:09:00Z")
Hi, I've got indeces name logstash-netflow-06, 07 etc (week number) and a template called netflow. I used this script to add a field and surely the field shows up on the index pattern and when I do something like GET l… --- ## [Kibana SAML authentication issue](https://discuss.elastic.co/t/kibana-saml-authentication-issue/119420)
**Author:** [@Athul\_Jayson](https://discuss.elastic.co/u/Athul_Jayson)\ **Replies:** 15\ **Last updated:** [February 14, 2018, 6:36am UTC](https://discuss.elastic.co/t/kibana-saml-authentication-issue/119420 "2018-02-14T06:36:51Z")
Hi, I had been trying to get Kibana to work with SAML authentication, but to no avail. Kibana Config server.name: kibana server.host: "0" elasticsearch.url: https://192.168.99.100:9200 elasticsearch.username: elasti… --- ## [Input Type of ElasticSearch](https://discuss.elastic.co/t/input-type-of-elasticsearch/119730)
**Author:** [@NareshPrajapati](https://discuss.elastic.co/u/NareshPrajapati)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 6:32am UTC](https://discuss.elastic.co/t/input-type-of-elasticsearch/119730 "2018-02-14T06:32:49Z")
Hi All, I am new on ElasticSearch. I practised a example in which I have imported .csv file from Logstash in ElasticSearch. I want to ask you that how many types of input type I can use in ElasticSearch to import data… --- ## [Reindexing Performance](https://discuss.elastic.co/t/reindexing-performance/119166)
**Author:** [@olanamramoj2](https://discuss.elastic.co/u/olanamramoj2)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 6:03am UTC](https://discuss.elastic.co/t/reindexing-performance/119166 "2018-02-14T06:03:09Z")
Hi, We are having problems with reindexing our data. Can you advice what to do on how to reindex while not affecting search speed of other indices? reindexing takes alot of resource. Thanks! --- ## [Filebeat input not showing in elastic indices & Kibana](https://discuss.elastic.co/t/filebeat-input-not-showing-in-elastic-indices-kibana/119715)
**Author:** [@anujitbhu](https://discuss.elastic.co/u/anujitbhu)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 3:57am UTC](https://discuss.elastic.co/t/filebeat-input-not-showing-in-elastic-indices-kibana/119715 "2018-02-14T03:57:23Z")
Hi I have got a server installed with ELK kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2018-02-14 06:48:43 IST;… --- ## [Possible To Have Multiple Simultaneous Bulk Inserts?](https://discuss.elastic.co/t/possible-to-have-multiple-simultaneous-bulk-inserts/119525)
**Author:** [@krmathieu](https://discuss.elastic.co/u/krmathieu)\ **Replies:** 5\ **Last updated:** [February 14, 2018, 3:48am UTC](https://discuss.elastic.co/t/possible-to-have-multiple-simultaneous-bulk-inserts/119525 "2018-02-14T03:48:34Z")
I want to run multiple clients that will be doing bulk inserts into the same Elasticsearch index. Is that OK, or do I run the risk of some sort of clash/lock issue(s)? Any info would be appreciated. Thanks. Kevin --- ## [Aggregations - getting all buckets with term aggregations](https://discuss.elastic.co/t/aggregations-getting-all-buckets-with-term-aggregations/119697)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 0\ **Last updated:** [February 13, 2018, 7:26pm UTC](https://discuss.elastic.co/t/aggregations-getting-all-buckets-with-term-aggregations/119697 "2018-02-13T19:26:47Z")
How can I use aggregations to get all of the buckets in my index? Right now I add "size:30" to get all of the buckets. GET /index\_name/\_search?size=0 { "aggs":{ "aggs\_name":{ "terms":{"field":"Field\_Name.ke… --- ## [Usecase verification - monitoring](https://discuss.elastic.co/t/usecase-verification-monitoring/119608)
**Author:** [@Robto](https://discuss.elastic.co/u/Robto)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 12:50am UTC](https://discuss.elastic.co/t/usecase-verification-monitoring/119608 "2018-02-14T00:50:17Z")
Hello community, This is my first post on this forum, so I hope this is the right approach. I've been trying to find information that would help me decide if ELK is the correct solution for a usecase I have in mind, or … --- ## [To have replicas or not?](https://discuss.elastic.co/t/to-have-replicas-or-not/119669)
**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 12:47am UTC](https://discuss.elastic.co/t/to-have-replicas-or-not/119669 "2018-02-14T00:47:25Z")
Hi, I am doing tests with cluster of 5 elasticsearch nodes and I see big difference in performance depending on how elasticsearch cluster is configured. When the index is configured with 8 shards and no replicas, I see… --- ## [Machine learning: Duration of "Open/Active" Event?](https://discuss.elastic.co/t/machine-learning-duration-of-open-active-event/119388)
**Author:** [@StephenOTT](https://discuss.elastic.co/u/StephenOTT)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 12:27am UTC](https://discuss.elastic.co/t/machine-learning-duration-of-open-active-event/119388 "2018-02-14T00:27:16Z")
Looking at a use case where there is a Open and Close event. The Event shares the same ID, so the Close is a document update to the original Open document in ES. Is there a function in the ML engine to detect when the … --- ## [Unable to install x-pack for version 6.2.1](https://discuss.elastic.co/t/unable-to-install-x-pack-for-version-6-2-1/119371)
**Author:** [@kev](https://discuss.elastic.co/u/kev)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 12:22am UTC](https://discuss.elastic.co/t/unable-to-install-x-pack-for-version-6-2-1/119371 "2018-02-14T00:22:46Z")
I am building a new CentOS with ELK. CentOS version is: # hostnamectl Static hostname: localhost.localdomain Icon name: computer-vm Chassis: vm Virtualization: vmware Operating System: CentO… --- ## [RestHighLevelClient HTTP dependency problem](https://discuss.elastic.co/t/resthighlevelclient-http-dependency-problem/119685)
**Author:** [@Jeffrey\_Blayney](https://discuss.elastic.co/u/Jeffrey_Blayney)\ **Replies:** 1\ **Last updated:** [February 14, 2018, 12:00am UTC](https://discuss.elastic.co/t/resthighlevelclient-http-dependency-problem/119685 "2018-02-14T00:00:55Z")
Well, the RestHighLevelClient doesn't work either.. Here is the stack trace: Caused by: java.lang.ClassNotFoundException: org.apache.http.conn.util.PublicSuffixMatcherLoader at org.apache.catalina.loader.WebappClassLoa… --- ## [Elasticsearch Constantly Reallocating Shards](https://discuss.elastic.co/t/elasticsearch-constantly-reallocating-shards/118276)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 6:58pm UTC](https://discuss.elastic.co/t/elasticsearch-constantly-reallocating-shards/118276 "2018-02-09T18:58:45Z")
ES Version 5.6.2 For the past few weeks, every time I check ES Monitoring, twenty shards are being reallocated: \[image\] This is defined as the max in my cluster settings. I have it set higher than default as many of t… --- ## [Elasticsearch 5.6 very quickly increasing direct buffer pools](https://discuss.elastic.co/t/elasticsearch-5-6-very-quickly-increasing-direct-buffer-pools/119561)
**Author:** [@Krzysztof\_Szarlej](https://discuss.elastic.co/u/Krzysztof_Szarlej)\ **Replies:** 6\ **Last updated:** [February 13, 2018, 11:02pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-very-quickly-increasing-direct-buffer-pools/119561 "2018-02-13T23:02:09Z")
Hi all, Elastic invo: version\[5.6.4\], pid\[1\], build\[8bbedf5/2017-10-31T18:55:38.105Z\], OS\[Linux/4.4.0-11 2-generic/amd64\], JVM\[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/1.8.0\_151/25.151-b12\] JVM argument… --- ## [Elasticsearch Master Node](https://discuss.elastic.co/t/elasticsearch-master-node/118256)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 7\ **Last updated:** [February 13, 2018, 10:48pm UTC](https://discuss.elastic.co/t/elasticsearch-master-node/118256 "2018-02-13T22:48:53Z")
Where does master node store data nodes information. Thanks Gaurav --- ## [Map field as Object and Text](https://discuss.elastic.co/t/map-field-as-object-and-text/119708)
**Author:** [@cappy](https://discuss.elastic.co/u/cappy)\ **Replies:** 2\ **Last updated:** [February 13, 2018, 10:04pm UTC](https://discuss.elastic.co/t/map-field-as-object-and-text/119708 "2018-02-13T22:04:12Z")
Is there any way to map a field as an object AND text, similar to what you can do with "fields" and text and keyword types? I'm having an issue where a field is mapped differently across indices, because Winlogbeat expe… --- ## [Approach to combining log data](https://discuss.elastic.co/t/approach-to-combining-log-data/119688)
**Author:** [@christian1](https://discuss.elastic.co/u/christian1)\ **Replies:** 1\ **Last updated:** [February 13, 2018, 10:00pm UTC](https://discuss.elastic.co/t/approach-to-combining-log-data/119688 "2018-02-13T22:00:44Z")
What is the best approach to combining log data from two distinct type of logs? Use Case: One log contains Events that occurred from time A to B. A second log contains user actions from time C to D, where there may or m… --- ## [Connection error between apache-hive and elasticsearch](https://discuss.elastic.co/t/connection-error-between-apache-hive-and-elasticsearch/119453)
**Author:** [@yash\_mangla](https://discuss.elastic.co/u/yash_mangla)\ **Replies:** 5\ **Last updated:** [February 13, 2018, 8:52pm UTC](https://discuss.elastic.co/t/connection-error-between-apache-hive-and-elasticsearch/119453 "2018-02-13T20:52:18Z")
Hello Folks, I'm trying to integrate apache-hive with elasticsearch. In order to achieve same i am following below steps Created Table in hive: CREATE TABLE scadapass (VENDOR string, Device string, Default\_Password s… --- ## [How come my ElasticSearch ingest pipelines with multiple grok patterns are all failing?](https://discuss.elastic.co/t/how-come-my-elasticsearch-ingest-pipelines-with-multiple-grok-patterns-are-all-failing/119702)
**Author:** [@ujjain](https://discuss.elastic.co/u/ujjain)\ **Replies:** 0\ **Last updated:** [February 13, 2018, 7:52pm UTC](https://discuss.elastic.co/t/how-come-my-elasticsearch-ingest-pipelines-with-multiple-grok-patterns-are-all-failing/119702 "2018-02-13T19:52:18Z")
I'm working on getting the Tomcat logs of some applications correctly processed in ElasticSearch, but unfortunately my ingest pipelines with multiple grok processors aren't working and they all end up in the failed-index… --- ## [Grok pattern failing in ingest pipeline, but working in grok debugger](https://discuss.elastic.co/t/grok-pattern-failing-in-ingest-pipeline-but-working-in-grok-debugger/119701)
**Author:** [@ujjain](https://discuss.elastic.co/u/ujjain)\ **Replies:** 0\ **Last updated:** [February 13, 2018, 7:51pm UTC](https://discuss.elastic.co/t/grok-pattern-failing-in-ingest-pipeline-but-working-in-grok-debugger/119701 "2018-02-13T19:51:21Z")
My grok pattern works fine in https://grokdebug.herokuapp.com/, but not on the pipeline. What could be the cause? 09-Feb-2018 15:32:35.559 WARNING \[monkey.co.uk-startStop-1\] org.apache.tomcat.jdbc.pool.ConnectionPool$… --- ## [Elasticsearch multiline search](https://discuss.elastic.co/t/elasticsearch-multiline-search/119002)
**Author:** [@elasticdude](https://discuss.elastic.co/u/elasticdude)\ **Replies:** 1\ **Last updated:** [February 13, 2018, 7:44pm UTC](https://discuss.elastic.co/t/elasticsearch-multiline-search/119002 "2018-02-13T19:44:01Z")
Hi, Is it possible to do following queries on Elasticsearch? Given Line1 and Line2, find all the line pairs such that Line1 and Line2 are N seconds apart. Return all the log lines where Line1 occurred before Line2 [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1788) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1790)