# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1737 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1738 --- ## [How to Increase write Queue Size for the 3 node cluster](https://discuss.elastic.co/t/how-to-increase-write-queue-size-for-the-3-node-cluster/211037)
**Author:** [@Anji\_Reddy](https://discuss.elastic.co/u/Anji_Reddy)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 6:10am UTC](https://discuss.elastic.co/t/how-to-increase-write-queue-size-for-the-3-node-cluster/211037 "2019-12-09T06:10:29Z")
We have three node cluster and see lot of rejections because of write queue size. Thanks Anji --- ## [Alerting in Elastic search](https://discuss.elastic.co/t/alerting-in-elastic-search/210828)
**Author:** [@suraj888](https://discuss.elastic.co/u/suraj888)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 5:10am UTC](https://discuss.elastic.co/t/alerting-in-elastic-search/210828 "2019-12-09T05:10:59Z")
Dear All, Could you please help me to understand how can i implement alerting without watcher. Currently i have installed Elastic Search version "7.3.0". I have installed elastalert and it was successfully installed,b… --- ## [How to make Kibana Y axis plot start from the lowest value?](https://discuss.elastic.co/t/how-to-make-kibana-y-axis-plot-start-from-the-lowest-value/210827)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [December 8, 2019, 11:58pm UTC](https://discuss.elastic.co/t/how-to-make-kibana-y-axis-plot-start-from-the-lowest-value/210827 "2019-12-08T23:58:25Z")
I have something like this. There is lot of empty space and the lines are all bunched up. Is it possible that I can make the Y axis range start from non zero value? Key thing is that the values are dynamic. I cannot … --- ## [Porting \_all field when migrating from ES 1.7.5 to 7.4](https://discuss.elastic.co/t/porting-all-field-when-migrating-from-es-1-7-5-to-7-4/210995)
**Author:** [@joneslee85](https://discuss.elastic.co/u/joneslee85)\ **Replies:** 0\ **Last updated:** [December 8, 2019, 6:28am UTC](https://discuss.elastic.co/t/porting-all-field-when-migrating-from-es-1-7-5-to-7-4/210995 "2019-12-08T06:28:17Z")
Hi all I am in the process of migrating following mapping in ES 1.7.5 to 7.4: name: type: 'string' index: 'analyzed' include\_in\_all: true fields: name\_bm25: type: 'string' index: 'analyzed' … --- ## [Search optimisation](https://discuss.elastic.co/t/search-optimisation/211022)
**Author:** [@Nick\_Walton](https://discuss.elastic.co/u/Nick_Walton)\ **Replies:** 1\ **Last updated:** [December 8, 2019, 8:24pm UTC](https://discuss.elastic.co/t/search-optimisation/211022 "2019-12-08T20:24:20Z")
I have around 120 million records using the documents structured as { "flink-index-deduplicated" : { "aliases" : { }, "mappings" : { "properties" : { "arrayinstance" : { "type" : "keyword" }, "bearing" : { "typ… --- ## [Kibana server is not ready yet - Fresh install on CentOS 8](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-fresh-install-on-centos-8/211023)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 2\ **Last updated:** [December 8, 2019, 7:43pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-fresh-install-on-centos-8/211023 "2019-12-08T19:43:18Z")
Hi Folks, I also recieve this error: Kibana server is not ready yet Tutorial I'm following: Java 11 NGINX as Reverse Proxy login is working fine Elasticsearch is running Logstash is running Active Internet connec… --- ## [How can I filter Suggestions](https://discuss.elastic.co/t/how-can-i-filter-suggestions/210577)
**Author:** [@athir.gillani](https://discuss.elastic.co/u/athir.gillani)\ **Replies:** 3\ **Last updated:** [December 8, 2019, 5:54pm UTC](https://discuss.elastic.co/t/how-can-i-filter-suggestions/210577 "2019-12-08T17:54:28Z")
I have an index for items, and I am making a suggest query on top of it like this below. It is working fine, but I want to include the item in suggestions list only if it is active and not sold. I am trying to do it thro… --- ## [How to fix Red cluster with close index](https://discuss.elastic.co/t/how-to-fix-red-cluster-with-close-index/211020)
**Author:** [@akezakky555](https://discuss.elastic.co/u/akezakky555)\ **Replies:** 0\ **Last updated:** [December 8, 2019, 4:22pm UTC](https://discuss.elastic.co/t/how-to-fix-red-cluster-with-close-index/211020 "2019-12-08T16:22:42Z")
Hi I have some problem about elasticsearch cluster. Now There are some node left from my elasticsearch cluster. and My indices does not set replicas. (replicas =0 ) In the Past . I used to close API for close indices… --- ## [Consuming messages from Rabbit while output is not responsive](https://discuss.elastic.co/t/consuming-messages-from-rabbit-while-output-is-not-responsive/210997)
**Author:** [@athlan](https://discuss.elastic.co/u/athlan)\ **Replies:** 1\ **Last updated:** [December 8, 2019, 2:34pm UTC](https://discuss.elastic.co/t/consuming-messages-from-rabbit-while-output-is-not-responsive/210997 "2019-12-08T14:34:03Z")
Hello, I've noticed that using RabbitMQ (with ACKing) as Input and Elasticsearch as Output in Logstash might fall into situation, when Output is not responsive from some reason (beeing restarted, connection loss), then … --- ## [Logstash - Avoid duplicated events](https://discuss.elastic.co/t/logstash-avoid-duplicated-events/210999)
**Author:** [@slawek](https://discuss.elastic.co/u/slawek)\ **Replies:** 0\ **Last updated:** [December 8, 2019, 9:28am UTC](https://discuss.elastic.co/t/logstash-avoid-duplicated-events/210999 "2019-12-08T09:28:53Z")
Every 30 minutes, the log file is replaced with a new log file (also containing old events). Is it possible to configure the logstash to sent the event only the most recent events? I want avoid duplicated events in othe… --- ## [How to add logs of elastic audit to index in elastic cloud?](https://discuss.elastic.co/t/how-to-add-logs-of-elastic-audit-to-index-in-elastic-cloud/210998)
**Author:** [@mord](https://discuss.elastic.co/u/mord)\ **Replies:** 0\ **Last updated:** [December 8, 2019, 9:03am UTC](https://discuss.elastic.co/t/how-to-add-logs-of-elastic-audit-to-index-in-elastic-cloud/210998 "2019-12-08T09:03:45Z")
How to add logs of elastic search audit to index in elastic cloud ? --- ## [Hot-Warm Arch, without ILM](https://discuss.elastic.co/t/hot-warm-arch-without-ilm/210959)
**Author:** [@Securitybits](https://discuss.elastic.co/u/Securitybits)\ **Replies:** 3\ **Last updated:** [December 8, 2019, 8:09am UTC](https://discuss.elastic.co/t/hot-warm-arch-without-ilm/210959 "2019-12-08T08:09:22Z")
Long time lurker, but first time poster! So lets see if this works! Currently implementing a Hot-Warm architecture. Which consists of 3 dedicated Master Nodes 3 Hot Nodes 3 Warm Nodes The Attrib is set by node.attr… --- ## [Dec 8th, 2019: \[DE\]\[Elasticsearch\] Loggen in Elasticsearch mit Docker und Elastic Cloud](https://discuss.elastic.co/t/dec-8th-2019-de-elasticsearch-loggen-in-elasticsearch-mit-docker-und-elastic-cloud/210994)
**Author:** [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Replies:** 0\ **Last updated:** [December 8, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-8th-2019-de-elasticsearch-loggen-in-elasticsearch-mit-docker-und-elastic-cloud/210994 "2019-12-08T08:00:03Z")
Loggen ist eines der Themen, das gerne ignoriert wird, bis man es benötigt. Und dann braucht man meistens eine schnelle Lösung. Glücklicherweise ist das Loggen in Elasticsearch sehr flexibel und auch relativ mächtig. Abe… --- ## [Logstash Elasticsearch Input - Query in @timestamp order](https://discuss.elastic.co/t/logstash-elasticsearch-input-query-in-timestamp-order/210607)
**Author:** [@Paul\_Ainslie](https://discuss.elastic.co/u/Paul_Ainslie)\ **Replies:** 11\ **Last updated:** [December 7, 2019, 9:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-query-in-timestamp-order/210607 "2019-12-07T21:33:15Z")
I'm querying an index with Nginx access records, running it thru the Aggregate filter plugin and writing it to a file. However, the elasticsearch input plugin is not reading the records in @timestamp order - they are wr… --- ## [Elasticsearch: Different mapping on staging and prod](https://discuss.elastic.co/t/elasticsearch-different-mapping-on-staging-and-prod/210975)
**Author:** [@anton1990](https://discuss.elastic.co/u/anton1990)\ **Replies:** 0\ **Last updated:** [December 7, 2019, 5:02pm UTC](https://discuss.elastic.co/t/elasticsearch-different-mapping-on-staging-and-prod/210975 "2019-12-07T17:02:16Z")
I have to server environments: 1x staging, 1x productive. The following configurations are identical: OS version (Ubuntu 18.04.3 LTS) elasticsearch version (7.5.0 Build e9ccaed468e2fac2275a3761849cbee64b39519f) PHP ve… --- ## [Multiple Kibana setups](https://discuss.elastic.co/t/multiple-kibana-setups/210298)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 4\ **Last updated:** [December 7, 2019, 4:58pm UTC](https://discuss.elastic.co/t/multiple-kibana-setups/210298 "2019-12-07T16:58:01Z")
Hi everyone, I wan to know if there is anyway by which i can get data from 3 ES data nodes to 2 Kibana nodes. also i have only one masternode of ES. Thanks --- ## [Reference variable in grok match pattern](https://discuss.elastic.co/t/reference-variable-in-grok-match-pattern/210968)
**Author:** [@marekful](https://discuss.elastic.co/u/marekful)\ **Replies:** 1\ **Last updated:** [December 7, 2019, 3:58pm UTC](https://discuss.elastic.co/t/reference-variable-in-grok-match-pattern/210968 "2019-12-07T15:58:23Z")
I define fields in filebeat.yml as below: ... - paths: - /var/log/\*-\*/a-b-c.log\* document\_type: ... enabled: true fields: serviceNam: a-b-c - paths: - /var/log/\*-\*/d-e-f.log\* document\_type: ... … --- ## [Docker swarm overlay network gwbridge](https://discuss.elastic.co/t/docker-swarm-overlay-network-gwbridge/210969)
**Author:** [@jlim0930](https://discuss.elastic.co/u/jlim0930)\ **Replies:** 0\ **Last updated:** [December 7, 2019, 2:58pm UTC](https://discuss.elastic.co/t/docker-swarm-overlay-network-gwbridge/210969 "2019-12-07T14:58:00Z")
Just deployed several docker nodes with swarm and setup an overlay network with its own subnet and launched a few elastic containers and found that the elastic instances wasn't able to form a cluster.. I went into each … --- ## [Some help in the right direction :)](https://discuss.elastic.co/t/some-help-in-the-right-direction/210964)
**Author:** [@mbarnesuk](https://discuss.elastic.co/u/mbarnesuk)\ **Replies:** 1\ **Last updated:** [December 7, 2019, 12:39pm UTC](https://discuss.elastic.co/t/some-help-in-the-right-direction/210964 "2019-12-07T12:39:37Z")
Hi All, Not sure if this is the correct forum but it seemed the most relevant. I am hoping if someone could kindly point me in the right direction for what I am attempting to achieve. We have elasticsearch 6.4 setup on… --- ## [Logstash "stateful" store](https://discuss.elastic.co/t/logstash-stateful-store/210962)
**Author:** [@xvzf](https://discuss.elastic.co/u/xvzf)\ **Replies:** 0\ **Last updated:** [December 7, 2019, 10:54am UTC](https://discuss.elastic.co/t/logstash-stateful-store/210962 "2019-12-07T10:54:03Z")
Hi there, I'm currently learning about Logstash and am wondering if I can keep a "stateful" (let's just call it like that) object which I can use for enhancements. E.g. a HTTP Request pushes a dictionary which is used … --- ## [Types are deprecated in percolate queries but PercolateQueryBuilder class still requires the type](https://discuss.elastic.co/t/types-are-deprecated-in-percolate-queries-but-percolatequerybuilder-class-still-requires-the-type/210955)
**Author:** [@Sarvar\_Nishonboyev](https://discuss.elastic.co/u/Sarvar_Nishonboyev)\ **Replies:** 0\ **Last updated:** [December 7, 2019, 9:01am UTC](https://discuss.elastic.co/t/types-are-deprecated-in-percolate-queries-but-percolatequerybuilder-class-still-requires-the-type/210955 "2019-12-07T09:01:55Z")
I have been receiving warning messages each time my app does percolate. I'm using the 7.4.0 versions of elasticsearch and percolate clients. Elasticsearch is also at 7.4.0 version. I know types are deprecated at 7th vers… --- ## [Aggregate filter - stop after N events](https://discuss.elastic.co/t/aggregate-filter-stop-after-n-events/210950)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 0\ **Last updated:** [December 7, 2019, 4:13am UTC](https://discuss.elastic.co/t/aggregate-filter-stop-after-n-events/210950 "2019-12-07T04:13:36Z")
Short version: can the aggregate filter be made to stop after it receives 2 events for a given task ID? I'm using the aggregate filter to successfully combine two very similar apache log lines, one of which contains a v… --- ## [Set \_id field when creating index template](https://discuss.elastic.co/t/set-id-field-when-creating-index-template/206706)
**Author:** [@newkate12](https://discuss.elastic.co/u/newkate12)\ **Replies:** 3\ **Last updated:** [December 7, 2019, 3:52am UTC](https://discuss.elastic.co/t/set-id-field-when-creating-index-template/206706 "2019-12-07T03:52:10Z")
I want to use index template when creating index in elasticsearch. I saw that we can set \_id field with specific field when creating index. (https://www.elastic.co/guide/en/elasticsearch/reference/1.4/mapping-id-field.… --- ## [Elastic Search Phrase Suggestion API](https://discuss.elastic.co/t/elastic-search-phrase-suggestion-api/210942)
**Author:** [@Bidzina\_Goginashvili](https://discuss.elastic.co/u/Bidzina_Goginashvili)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 10:37pm UTC](https://discuss.elastic.co/t/elastic-search-phrase-suggestion-api/210942 "2019-12-06T22:37:31Z")
var response = await \_client.SearchAsync(s =\> s .Index($"{\_config.ElasticIndex}") .Suggest(ss =\> ss .Phrase("simple\_phrase", ph =\> ph.Field(f =\> f.Name.Select(fn =\> fn.Text)) .Size(1) .GramSize(10) .DirectGenerat… --- ## [False positive](https://discuss.elastic.co/t/false-positive/208846)
**Author:** [@vnovomeska](https://discuss.elastic.co/u/vnovomeska)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 10:04pm UTC](https://discuss.elastic.co/t/false-positive/208846 "2019-12-06T22:04:24Z")
Hello, I encountered a false positive: https://www.virustotal.com/gui/file/9fdd641a90f64de570e08202dc0ffe9db8a94264bf969dcf16037413db49da1e/detection Endgame reports "Malicious (moderate Confidence)" but the file is s… --- ## [Pricing et al](https://discuss.elastic.co/t/pricing-et-al/205410)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 5\ **Last updated:** [December 6, 2019, 10:03pm UTC](https://discuss.elastic.co/t/pricing-et-al/205410 "2019-12-06T22:03:37Z")
How does endpoint security pricing work? After releasing such an exciting product you've made it very difficult to find / evaluate and buy Endpoint security..! H --- ## [Deal with false positives](https://discuss.elastic.co/t/deal-with-false-positives/208950)
**Author:** [@p3464782](https://discuss.elastic.co/u/p3464782)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 10:00pm UTC](https://discuss.elastic.co/t/deal-with-false-positives/208950 "2019-12-06T22:00:59Z")
Can one overrule a triggered detection and response rule via e.g. the API, for example if a false positive is identified by my company? Or does the Kibana SIEM allows an analist to revert any automatic responses? --- ## [Data node went offline - data loss?](https://discuss.elastic.co/t/data-node-went-offline-data-loss/210943)
**Author:** [@ntran](https://discuss.elastic.co/u/ntran)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 9:47pm UTC](https://discuss.elastic.co/t/data-node-went-offline-data-loss/210943 "2019-12-06T21:47:21Z")
Hi, One of my data nodes unexpectedly went offline. I looked at the logs, however, I saw at during the time the data node was offline, there are no logs. I was able to get data node to rejoin the cluster, however, I can… --- ## [Data Visualization issue](https://discuss.elastic.co/t/data-visualization-issue/210818)
**Author:** [@ronics](https://discuss.elastic.co/u/ronics)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 9:31pm UTC](https://discuss.elastic.co/t/data-visualization-issue/210818 "2019-12-06T21:31:48Z")
I can read all datasets in discover in tabular form but when I try to use data visualization, all fields are not shown. Is there any limitation on string length for data visualization ? --- ## [Kiban dashbord](https://discuss.elastic.co/t/kiban-dashbord/210812)
**Author:** [@vin.ramesh](https://discuss.elastic.co/u/vin.ramesh)\ **Replies:** 1\ **Last updated:** [December 6, 2019, 9:26pm UTC](https://discuss.elastic.co/t/kiban-dashbord/210812 "2019-12-06T21:26:14Z")
We want to show actual data no need any aggregation and also multiple series data on how to do this kind of requirement. Please see the below photo and advise us. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1736) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1738)