# 中文提问与讨论 **URL:** https://discuss.elastic.co/c/in-your-native-tongue/chinese/46.md?page=3 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 4 --- ## [Elasticsearch 快照功能](https://discuss.elastic.co/t/elasticsearch/139691)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 0\ **Last updated:** [July 12, 2018, 7:49am UTC](https://discuss.elastic.co/t/elasticsearch/139691 "2018-07-12T07:49:23Z")
elasticsearch 快照功能是否可以指定时间段来。 比如现有一个索引a，这个索引a里面有2018年1月到现在的日志数据，我只想快照里面5月份的数据，其它时间段不做快照，该如何实现？ --- ## [Logstash filter target操作之后remove\_field无法删除子字段](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486)
**Author:** [@hjfeng1988](https://discuss.elastic.co/u/hjfeng1988)\ **Replies:** 1\ **Last updated:** [July 11, 2018, 7:12am UTC](https://discuss.elastic.co/t/logstash-filter-target-remove-field/139486 "2018-07-11T07:12:37Z")
grok { match =\> { "message" =\> "%{HTTPD\_COMBINEDLOG}" } remove\_field =\> \[ "message" \] } useragent { source =\> "agent" target =\> "ua" rem… --- ## [Kibana 精确搜索（不想让系统自动忽略大小写）](https://discuss.elastic.co/t/kibana/139073)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 0\ **Last updated:** [July 9, 2018, 2:32am UTC](https://discuss.elastic.co/t/kibana/139073 "2018-07-09T02:32:20Z")
使用Kibana discover模块搜索数据时，系统会将输入的字符串自动忽略大小写，如何可以让系统不忽略大小写，即：我输入“INFO”时，只能匹配到"INFO"的相关信息，而不会匹配到"info"? --- ## [Failed installing 'elasticsearch-service-x64' service 安装失败，为什么？](https://discuss.elastic.co/t/failed-installing-elasticsearch-service-x64-service/137890)
**Author:** [@jintian](https://discuss.elastic.co/u/jintian)\ **Replies:** 1\ **Last updated:** [July 7, 2018, 2:36pm UTC](https://discuss.elastic.co/t/failed-installing-elasticsearch-service-x64-service/137890 "2018-07-07T14:36:45Z")
D:\\elasticsearch-6.3.0\\bin\>elasticsearch-service install Installing service : "elasticsearch-service-x64" Using JAVA\_HOME (64-bit): "D:\\java\_jdk" -XX:+UseConcMarkSweepGC;-XX:CMSInitiatingOccupancyFraction=75;-X… --- ## [分桶之后怎么按数据字段排序](https://discuss.elastic.co/t/topic/138109)
**Author:** [@hubiao](https://discuss.elastic.co/u/hubiao)\ **Replies:** 1\ **Last updated:** [July 2, 2018, 2:03am UTC](https://discuss.elastic.co/t/topic/138109 "2018-07-02T02:03:46Z")
// 从分组的每个桶取出第1个 TopHitsAggregationBuilder topAggr = AggregationBuilders.topHits("top") .sort("reprint", SortOrder.DESC).sort("pubdate", SortOrder.DESC).size(1); // 分桶 AggregationBuilder aggregationBuilder = Aggregat… --- ## [关于集群的特殊问题](https://discuss.elastic.co/t/topic/137768)
**Author:** [@hubiao](https://discuss.elastic.co/u/hubiao)\ **Replies:** 0\ **Last updated:** [June 28, 2018, 9:22am UTC](https://discuss.elastic.co/t/topic/137768 "2018-06-28T09:22:04Z")
环境: jdk 1.8 Elasticsearch 5.5.0 原因： 我有A，B，C，D 共4台服务器，每台配置的集群共同的集群名称，每台的数据是独立的。 然后我有个java程序来调用es客户端：代码如下 Settings settings = Settings.builder().put("cluster.name", "data").build(); esClient = new PreBuiltTrans… --- ## [Type为text 的情况下，设置"index"为 "not\_analyzed"好像不起作用](https://discuss.elastic.co/t/type-text-index-not-analyzed/135285)
**Author:** [@hubiao](https://discuss.elastic.co/u/hubiao)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 9:06am UTC](https://discuss.elastic.co/t/type-text-index-not-analyzed/135285 "2018-06-28T09:06:27Z")
"properties": { "columns": { "properties": { "id": { "type": "keyword", "index": "not\_analyzed" }, "name": { "type": "keyword", "index": "not\_analyzed" }, … --- ## [Kibana index patterns 如何自动添加索引模式](https://discuss.elastic.co/t/kibana-index-patterns/136778)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 2\ **Last updated:** [June 28, 2018, 3:40am UTC](https://discuss.elastic.co/t/kibana-index-patterns/136778 "2018-06-28T03:40:45Z")
大家好！ 由于我现的索引比较多，现在的每个索引都得手动一个个添加，太费时了，有没有好的法办可以批量添加或者是调用相关的API？ --- ## [kibana登陆被禁用（Login is currently disabled. Administrators should consult the Kibana logs for more details.）](https://discuss.elastic.co/t/kibana-login-is-currently-disabled-administrators-should-consult-the-kibana-logs-for-more-details/137530)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 0\ **Last updated:** [June 27, 2018, 3:04am UTC](https://discuss.elastic.co/t/kibana-login-is-currently-disabled-administrators-should-consult-the-kibana-logs-for-more-details/137530 "2018-06-27T03:04:26Z")
elasticsearch 版本6.2 kibana 版本6.3 均未安装使用x-pack插件 服务启动后，kibana提示：Login is currently disabled. Administrators should consult the Kibana logs for more details. kibana日志错误内容： log \[06:42:32.020\] \[warning\]\[security\] Gener… --- ## [索引无法彻底删除](https://discuss.elastic.co/t/topic/135517)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 3\ **Last updated:** [June 13, 2018, 10:43am UTC](https://discuss.elastic.co/t/topic/135517 "2018-06-13T10:43:21Z")
在kibana端，dev\_tools模块下面使用命令删除索引后，在managent模块下面仍然能看到被删除了的索引（这些索引内无数据） \[2\] 从上图中可以看出，索引已经被删除了。 下图中，在Management模块下仍然能看到已删除的索引名称，但是索引里面已经找不到数据了， \[3\] 提问：如何才能彻底的把索引删除了，（包括内容和名称） 提前谢谢！ --- ## [谁能告诉我，为什么es 5.5.0 elasticsearch.yml不能识别如下配置](https://discuss.elastic.co/t/es-5-5-0-elasticsearch-yml/135463)
**Author:** [@hubiao](https://discuss.elastic.co/u/hubiao)\ **Replies:** 1\ **Last updated:** [June 13, 2018, 1:49am UTC](https://discuss.elastic.co/t/es-5-5-0-elasticsearch-yml/135463 "2018-06-13T01:49:46Z")
thread\_pool: index: size: 30 queue\_size: 1000 thread\_pool: bulk: size: 30 queue\_size: 1000 --- ## [Filebeat.yml配置文件里面如何设置和调用自定义变量](https://discuss.elastic.co/t/filebeat-yml/134713)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 1\ **Last updated:** [June 13, 2018, 1:43am UTC](https://discuss.elastic.co/t/filebeat-yml/134713 "2018-06-13T01:43:43Z")
filebeat.yml配置文件里面如何设置和调用自定义变量 --- ## [Elasticsearch，如何基于时间来删除索引里面的数据](https://discuss.elastic.co/t/elasticsearch/134006)
**Author:** [@wuwenjie\_cn](https://discuss.elastic.co/u/wuwenjie_cn)\ **Replies:** 1\ **Last updated:** [June 5, 2018, 2:43pm UTC](https://discuss.elastic.co/t/elasticsearch/134006 "2018-06-05T14:43:49Z")
现有一个名为Log的索引，里面存放着2016年到2018年的日志信息，随着时间的增长，里面的日志信息也是相应的增长，如何删除索引里面2018年前的日志信息，而索引本身不删除？ 求解，谢谢！ --- ## [执行./logstash -f /etc/logstash/pipelines.yml 提示"Couldn't find any input plugin named 'log4j'的错误](https://discuss.elastic.co/t/logstash-f-etc-logstash-pipelines-yml-couldnt-find-any-input-plugin-named-log4j/133650)
**Author:** [@jayshi1985](https://discuss.elastic.co/u/jayshi1985)\ **Replies:** 1\ **Last updated:** [June 5, 2018, 2:43pm UTC](https://discuss.elastic.co/t/logstash-f-etc-logstash-pipelines-yml-couldnt-find-any-input-plugin-named-log4j/133650 "2018-06-05T14:43:02Z")
执行./logstash -f /etc/logstash/pipelines.yml ，输出中提示"Couldn't find any input plugin named 'log4j'，这个log4j是需要单独安装的插件吗，这个如何安装 \[2018-05-29T17:27:56,748\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>Lo… --- ## [ES-hadoop怎么不支持Python语言啊？](https://discuss.elastic.co/t/es-hadoop-python/132920)
**Author:** [@liujie40](https://discuss.elastic.co/u/liujie40)\ **Replies:** 1\ **Last updated:** [June 5, 2018, 2:41pm UTC](https://discuss.elastic.co/t/es-hadoop-python/132920 "2018-06-05T14:41:01Z")
我的开发语言都是python，但是ES-Hadoop项目只提供Java和scale两种语言。ES查询的数据必须保存到本地，然后再读进去spark，没法左到无缝衔接。请问各位大神怎么处理这种问题啊？ --- ## [本地测试通过 curl ip:5601提示Connection refused](https://discuss.elastic.co/t/curl-ip-5601-connection-refused/133593)
**Author:** [@jayshi1985](https://discuss.elastic.co/u/jayshi1985)\ **Replies:** 1\ **Last updated:** [May 29, 2018, 2:05am UTC](https://discuss.elastic.co/t/curl-ip-5601-connection-refused/133593 "2018-05-29T02:05:08Z")
如下，为什么出现这样的结果，只能本地localhost访问，ip地址如何绑定 root@elk:~# curl 10.110.0.103:5601/app/kibana#/dashboards curl: (7) Failed to connect to 10.110.0.103 port 5601: Connection refused root@elk:~# curl 127.0.0.1:5601/app/kibana#/da… --- ## [运行./filebeat -c /etc/filebeat/filebeat.yml --setup -e 提示错误](https://discuss.elastic.co/t/filebeat-c-etc-filebeat-filebeat-yml-setup-e/133591)
**Author:** [@jayshi1985](https://discuss.elastic.co/u/jayshi1985)\ **Replies:** 1\ **Last updated:** [May 28, 2018, 11:12pm UTC](https://discuss.elastic.co/t/filebeat-c-etc-filebeat-filebeat-yml-setup-e/133591 "2018-05-28T23:12:01Z")
如下，运行./filebeat -c /etc/filebeat/filebeat.yml --setup -e，没有找到No directory /usr/share/filebeat/bin/kibana/6，但实际上现在目录路径是/usr/share/filebeat/kibana，这个该如何更改，是否可以直接将kibana目录移到bin下？ root@elk:/usr/share/filebeat/bin# ./filebea… --- ## [Java High Level REST Client 怎么解决index\_not\_found\_exception](https://discuss.elastic.co/t/java-high-level-rest-client-index-not-found-exception/133147)
**Author:** [@xiaojiang](https://discuss.elastic.co/u/xiaojiang)\ **Replies:** 1\ **Last updated:** [May 25, 2018, 6:39am UTC](https://discuss.elastic.co/t/java-high-level-rest-client-index-not-found-exception/133147 "2018-05-25T06:39:08Z")
在elasticsearch 中，我们可以通过设置ignore\_unavailable=true防止报空索引异常，但是在Java High Level REST Client中怎么解决？我看了下文档，貌似没有提供响应的方法，求救~~~~~~~~~~~~~~~~~~ --- ## [求教一个 logstash同步中文乱码的问题](https://discuss.elastic.co/t/logstash/127718)
**Author:** [@Blackcat308](https://discuss.elastic.co/u/Blackcat308)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 1:17am UTC](https://discuss.elastic.co/t/logstash/127718 "2018-05-03T01:17:21Z")
背景是 从mysql数据库同步数据到Elasticsearch中 结果同步信息中出现了中文乱码 我也有在logstash配置文件中 配置过编码 例如 UTF-8 GBK 等等都有配置过 但是并没有用 实在是让人头疼 摸不着头脑 备注：数据库的编码为UTF-8 elk的版本是 5.4.0 elk与mysql都搭建在 linux上 附上截图\[BaiduShurufa\_2018-4-12\_10-55-43\]\[BaiduSh… --- ## [如何对dashboard不同user做权限控制？](https://discuss.elastic.co/t/dashboard-user/122480)
**Author:** [@cbw1230](https://discuss.elastic.co/u/cbw1230)\ **Replies:** 2\ **Last updated:** [April 26, 2018, 6:02am UTC](https://discuss.elastic.co/t/dashboard-user/122480 "2018-04-26T06:02:34Z")
公司准备使用elastic + kibana + xpack, 如何做到dashboard对不同user做权限控制？ 例如：userA 能查看dashboard ，userB 就不能查看dashboard 虽然已经通过 kibana\_dashboard\_only\_user 控制只显示dashboard功能，但是不能对role或user的权限控制 --- ## [我可不可也把我的事件分组进行统计](https://discuss.elastic.co/t/topic/125883)
**Author:** [@chenzilong444](https://discuss.elastic.co/u/chenzilong444)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 12:12pm UTC](https://discuss.elastic.co/t/topic/125883 "2018-04-10T12:12:27Z")
比如我有个id字段 ，把相同id的字段分为一组，统计的时候按组内所有的数据统计 --- ## [Elasticsearch 中搜索不到Logstash同步过来的数据，这是为什么呢？](https://discuss.elastic.co/t/elasticsearch-logstash/123832)
**Author:** [@linqtosql](https://discuss.elastic.co/u/linqtosql)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 9:23am UTC](https://discuss.elastic.co/t/elasticsearch-logstash/123832 "2018-04-10T09:23:49Z")
运行环境：windows server2008 R2 logstash：v6.2.1 elasticsearch：v6.2.1 我想通过logstash+elasticsearch做一个搜索服务，数据通过logstash从Mysql数据库同步到elasticsearch，我的logstash.conf文件内容如下： input { jdbc { jdbc\_connection\_string =\> "jdbc:mys… --- ## [Dangled indices判定条件](https://discuss.elastic.co/t/dangled-indices/123869)
**Author:** [@z\_y\_xing](https://discuss.elastic.co/u/z_y_xing)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 9:20am UTC](https://discuss.elastic.co/t/dangled-indices/123869 "2018-04-10T09:20:05Z")
我看了下 dangling indices 里面有这样一句话： ..... any shards stored in its local data directory directory which do not already exist in the cluster ... 比较好奇是怎么判断不存在的？ es 日志说这索引是dangling的，然后自动导入了： \[2018-03-14T12:33:11,873\]\[WARN… --- ## [动态映射嵌套结构问题](https://discuss.elastic.co/t/topic/126410)
**Author:** [@shenfl](https://discuss.elastic.co/u/shenfl)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 9:02am UTC](https://discuss.elastic.co/t/topic/126410 "2018-04-10T09:02:32Z")
直接插入一条数据，自动创建索引和mapping： PUT /my\_index/my\_type/1 { "aa.bb": "cc" } 但是自动创建的mapping却是嵌套的结构： { "my\_type": { "properties": { "aa": { "properties": { "bb": { "type": "text", "fields": { "keyword": { "ignore\_abo… --- ## [Kibana的dashboard支持dsl, 但是不支持dsl的aggs？](https://discuss.elastic.co/t/kibana-dashboard-dsl-dsl-aggs/123219)
**Author:** [@Zh\_C](https://discuss.elastic.co/u/Zh_C)\ **Replies:** 1\ **Last updated:** [April 10, 2018, 8:22am UTC](https://discuss.elastic.co/t/kibana-dashboard-dsl-dsl-aggs/123219 "2018-04-10T08:22:53Z")
The dsl: { "aggs": { "group": { "terms": { "field": "agentName" }, "aggs": { "group\_docs": { "top\_hits": { … --- ## [java.net.SocketException: Connection reset by peer: socket write error【已解决】](https://discuss.elastic.co/t/java-net-socketexception-connection-reset-by-peer-socket-write-error/122837)
**Author:** [@Faustine\_Fan](https://discuss.elastic.co/u/Faustine_Fan)\ **Replies:** 0\ **Last updated:** [March 7, 2018, 7:09am UTC](https://discuss.elastic.co/t/java-net-socketexception-connection-reset-by-peer-socket-write-error/122837 "2018-03-07T07:09:14Z")
我用Jest的Bulk批量添加数据报了java.net.SocketException: Connection reset by peer: socket write error这个错，每批次5w条，执行20个批次。 奇怪的是执行2个批次的时候就不会出现这个错。 log如下： 126084 \[main\] DEBUG org.apache.http.wire - http-outgoing-9 \>\> "\[write\] I/O err… --- ## [java.lang.StackOverflowError: null 异常导致es挂掉](https://discuss.elastic.co/t/java-lang-stackoverflowerror-null-es/122205)
**Author:** [@yitiaoxianyu](https://discuss.elastic.co/u/yitiaoxianyu)\ **Replies:** 2\ **Last updated:** [March 5, 2018, 2:28am UTC](https://discuss.elastic.co/t/java-lang-stackoverflowerror-null-es/122205 "2018-03-05T02:28:11Z")
描述 搭建的es在使用过程中会挂掉。 es版本： 5.6.3 os版本：centos6.2 CPU 32核 内存 256G log信息 \[2018-03-02T09:59:17,533\]\[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[\] fatal error in thread \[elasticsearch\[Nx5NyLh\]\[search\]\[T#7\]\], exiting… --- ## [使用Elasticsearch官方的哪一个python库](https://discuss.elastic.co/t/elasticsearch-python/117585)
**Author:** [@bk653871695](https://discuss.elastic.co/u/bk653871695)\ **Replies:** 1\ **Last updated:** [February 23, 2018, 2:31am UTC](https://discuss.elastic.co/t/elasticsearch-python/117585 "2018-02-23T02:31:15Z")
有一个elasticsearch库，还有一个elasticsearch DSL库，我应该使用哪一个库更好？ --- ## [Kibana No 'Access-Control-Allow-Origin' header is present on the requested resource](https://discuss.elastic.co/t/kibana-no-access-control-allow-origin-header-is-present-on-the-requested-resource/119434)
**Author:** [@xvdayou](https://discuss.elastic.co/u/xvdayou)\ **Replies:** 1\ **Last updated:** [February 13, 2018, 6:32pm UTC](https://discuss.elastic.co/t/kibana-no-access-control-allow-origin-header-is-present-on-the-requested-resource/119434 "2018-02-13T18:32:09Z")
my code is $http({ url:'http://10.153.98.130:8080/elastic-web/elastic/exportExcel.action', method: 'POST', data: ｛ endTime:"Wed Feb 07 2018 11:33:28 GMT+0… --- ## [No Node Availiable](https://discuss.elastic.co/t/no-node-availiable/117552)
**Author:** [@iwtbafp](https://discuss.elastic.co/u/iwtbafp)\ **Replies:** 1\ **Last updated:** [January 30, 2018, 5:02am UTC](https://discuss.elastic.co/t/no-node-availiable/117552 "2018-01-30T05:02:56Z")
es 5.2 单节点 es开启后，java代码请求es结果正常，但是运行一到两天后，会报错No Node Availiable，所有主分片全部挂掉 [Previous page](https://discuss.elastic.co/c/in-your-native-tongue/chinese/46.md?page=2) [Next page](https://discuss.elastic.co/c/in-your-native-tongue/chinese/46.md?page=4)