# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1873 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1874 --- ## [Logstash stop receiving or emitting events to Elasticsearch and sit idle after sometime](https://discuss.elastic.co/t/logstash-stop-receiving-or-emitting-events-to-elasticsearch-and-sit-idle-after-sometime/201203)
**Author:** [@sherifabdlnaby](https://discuss.elastic.co/u/sherifabdlnaby)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 9:58am UTC](https://discuss.elastic.co/t/logstash-stop-receiving-or-emitting-events-to-elasticsearch-and-sit-idle-after-sometime/201203 "2019-09-26T09:58:35Z")
Hello, We're running a single-node ELK cluster (Elasticsearch and Logstash) on the same host, but each in their own docker container, both version 7.3.0. The system has been stable for the past 5 months, ingesting arou… --- ## [ES 7.3.2 on CentOS: JvmOptionsParser - cannot resolve ES\_TMPDIR](https://discuss.elastic.co/t/es-7-3-2-on-centos-jvmoptionsparser-cannot-resolve-es-tmpdir/201076)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 9:45am UTC](https://discuss.elastic.co/t/es-7-3-2-on-centos-jvmoptionsparser-cannot-resolve-es-tmpdir/201076 "2019-09-26T09:45:56Z")
I'm trying to spin up multiple ES instances on a server, this used to work with ES 6.x, but does not work with the recent version: ES\_LOCAL\_PORT=9100 export ES\_PATH\_CONF=${HOME}/etc/elasticsearch1 export ES\_JAVA\_OPTS="… --- ## [What is the difference in aggregating data in Elasticsearch vs Kibana?](https://discuss.elastic.co/t/what-is-the-difference-in-aggregating-data-in-elasticsearch-vs-kibana/201196)
**Author:** [@sahishnu.patil](https://discuss.elastic.co/u/sahishnu.patil)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 9:35am UTC](https://discuss.elastic.co/t/what-is-the-difference-in-aggregating-data-in-elasticsearch-vs-kibana/201196 "2019-09-26T09:35:23Z")
Aggregations can be applied at Elasticsearch and at Kibana . What is the difference in aggregating data at these locations ? --- ## [Cannot GET \_source if \_id has spaces in it](https://discuss.elastic.co/t/cannot-get-source-if-id-has-spaces-in-it/201045)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 8:48am UTC](https://discuss.elastic.co/t/cannot-get-source-if-id-has-spaces-in-it/201045 "2019-09-26T08:48:40Z")
We have a document indexed with the \_id field set to "STT -30247-010" (note the space). We are unable to retrieve this document via the API (documents without spaces in the \_id) work fine. With a \_search (q=\_id="STT -3… --- ## [Search.query\_time\_in\_millis and search.query\_total metrics](https://discuss.elastic.co/t/search-query-time-in-millis-and-search-query-total-metrics/201186)
**Author:** [@tetiana](https://discuss.elastic.co/u/tetiana)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 8:38am UTC](https://discuss.elastic.co/t/search-query-time-in-millis-and-search-query-total-metrics/201186 "2019-09-26T08:38:37Z")
Hi, The same metrics search.query\_time\_in\_millis, search.query\_total are provided by Node API and Index API, how they are calculated? is it just a sum of shards metrics search.query\_time\_in\_millis, search.query\_total, l… --- ## [Unable to bind 5000 port for logstash](https://discuss.elastic.co/t/unable-to-bind-5000-port-for-logstash/201184)
**Author:** [@jacobmathews](https://discuss.elastic.co/u/jacobmathews)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 8:32am UTC](https://discuss.elastic.co/t/unable-to-bind-5000-port-for-logstash/201184 "2019-09-26T08:32:12Z")
hi...I am not able to connect to my localhost 5000 port in which I have configured by logstash…I am attaching a screenshot of my "filebeat test output",logstash input conf and filebeat.yml configurations.kindly help me w… --- ## [Logstash aggregate maps to be used in a cluster](https://discuss.elastic.co/t/logstash-aggregate-maps-to-be-used-in-a-cluster/201183)
**Author:** [@Gokul\_Raj](https://discuss.elastic.co/u/Gokul_Raj)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 8:29am UTC](https://discuss.elastic.co/t/logstash-aggregate-maps-to-be-used-in-a-cluster/201183 "2019-09-26T08:29:11Z")
I'm trying to know if logstash aggregate maps can be used in a cluster where there are 3 nodes of logstash with multiple pipelines . Read that aggregate maps are shared at pipeline level, will it work if I specify a comm… --- ## [Exact match in the filter query](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321)
**Author:** [@JohnM](https://discuss.elastic.co/u/JohnM)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 8:29am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321 "2019-09-26T08:29:05Z")
Hi friends, I am making my python script to query es to search Linux syslog. the script sends the following query. {'query': {'bool': {'filter': \[{'query\_string': {'query': 'oom-killer AND exim'}}, {'range': {'@timest… --- ## [Split search results the same way everytime](https://discuss.elastic.co/t/split-search-results-the-same-way-everytime/201180)
**Author:** [@satishns](https://discuss.elastic.co/u/satishns)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 8:12am UTC](https://discuss.elastic.co/t/split-search-results-the-same-way-everytime/201180 "2019-09-26T08:12:08Z")
I want to split my search results into say 3 buckets. When I rerun my search again after a week, i want the record to be landed in the same bucket as it did in the past. Records may get added / removed into the bucket bu… --- ## [How to override configuration in runtime](https://discuss.elastic.co/t/how-to-override-configuration-in-runtime/200688)
**Author:** [@Bozo\_Tegeltija](https://discuss.elastic.co/u/Bozo_Tegeltija)\ **Replies:** 3\ **Last updated:** [September 26, 2019, 7:49am UTC](https://discuss.elastic.co/t/how-to-override-configuration-in-runtime/200688 "2019-09-26T07:49:45Z")
How can you use the predefined configuration(elasticsearch.yml) and override just one field (e.g. xpack.security.secureCookies=false? --- ## [\_update\_by\_query is very slow (version 7.3 elastic cloud)](https://discuss.elastic.co/t/update-by-query-is-very-slow-version-7-3-elastic-cloud/201173)
**Author:** [@jadore](https://discuss.elastic.co/u/jadore)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 7:48am UTC](https://discuss.elastic.co/t/update-by-query-is-very-slow-version-7-3-elastic-cloud/201173 "2019-09-26T07:48:55Z")
when I use this query from dev tools in Kibana POST some\_index/\_update\_by\_query?conflicts=proceed { "script": { "source": "ctx.\_source.view\_count = 0", "lang": "painless" } } it will return { "ok": false… --- ## [Cannot rename sub-fields of cloud metadata added via add\_cloud\_metadata](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157)
**Author:** [@jalaziz](https://discuss.elastic.co/u/jalaziz)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 7:47am UTC](https://discuss.elastic.co/t/cannot-rename-sub-fields-of-cloud-metadata-added-via-add-cloud-metadata/201157 "2019-09-26T07:47:34Z")
I'm unable to rename sub-fields of the cloud field added via add\_cloud\_metadata. In particular, this configuration results in missing fields for serverId.id, serverId.datacenter.zone, etc: - add\_cloud\_metadata: ~ -… --- ## [How to set the heap-size reasonably](https://discuss.elastic.co/t/how-to-set-the-heap-size-reasonably/201168)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 7:29am UTC](https://discuss.elastic.co/t/how-to-set-the-heap-size-reasonably/201168 "2019-09-26T07:29:05Z")
Hi everyone, I'm new for elasticsearch and I know that the ES Heap-size is usually 50% of my physical RAM and cannot exceed 32GB. My 1st question is, if my physical RAM has only 32GB, and there are other programs runnin… --- ## [ElasticSearch NEST: Bulk-indexing operation does not make use of specified document IDs](https://discuss.elastic.co/t/elasticsearch-nest-bulk-indexing-operation-does-not-make-use-of-specified-document-ids/201003)
**Author:** [@Miao](https://discuss.elastic.co/u/Miao)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 7:28am UTC](https://discuss.elastic.co/t/elasticsearch-nest-bulk-indexing-operation-does-not-make-use-of-specified-document-ids/201003 "2019-09-26T07:28:15Z")
I currently use the ElasticSearch NEST 7.x library. On the VM that hosts my ElasticSearch master node, I am running a web server which receives JSON data via REST. These JSON data are then to be saved inside ElasticSear… --- ## [\[ERROR\]OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release](https://discuss.elastic.co/t/error-openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release/201092)
**Author:** [@valentine-dev](https://discuss.elastic.co/u/valentine-dev)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 7:21am UTC](https://discuss.elastic.co/t/error-openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release/201092 "2019-09-26T07:21:18Z")
I just set up a GKE ES cluster with 3 master eligible nodes, 3 data nodes, and 2 coordinator nodes. I haven't created any index yet. Following is the logging from Stackdriver: \[2019-09-24 23:01:24.158 PDT\] OpenJDK 64… --- ## [How many swap files are created when you update a text file](https://discuss.elastic.co/t/how-many-swap-files-are-created-when-you-update-a-text-file/197625)
**Author:** [@zeno](https://discuss.elastic.co/u/zeno)\ **Replies:** 8\ **Last updated:** [September 26, 2019, 7:16am UTC](https://discuss.elastic.co/t/how-many-swap-files-are-created-when-you-update-a-text-file/197625 "2019-09-26T07:16:18Z")
I want to know how many swap files are created in kibana for Ubuntu server when you create a text file using nano. i see 4 swap files deleted when i deleted the text file i have created in Ubuntu. Similarly the no of swa… --- ## [Is any exception handling mechanism in Logstash when dealing with multiple Elasticsearch in the output section to overcome the Elasticsearch failures?](https://discuss.elastic.co/t/is-any-exception-handling-mechanism-in-logstash-when-dealing-with-multiple-elasticsearch-in-the-output-section-to-overcome-the-elasticsearch-failures/201145)
**Author:** [@geethusureshkrishna](https://discuss.elastic.co/u/geethusureshkrishna)\ **Replies:** 3\ **Last updated:** [September 26, 2019, 7:14am UTC](https://discuss.elastic.co/t/is-any-exception-handling-mechanism-in-logstash-when-dealing-with-multiple-elasticsearch-in-the-output-section-to-overcome-the-elasticsearch-failures/201145 "2019-09-26T07:14:11Z")
We are trying to write data parallelly to 2 different clusters let us say, cluster A and cluster B from Logstash. In the sample Logstash configuration is given below. input { elasticsearch{ hosts… --- ## [Aggregation of two fields in single query](https://discuss.elastic.co/t/aggregation-of-two-fields-in-single-query/200803)
**Author:** [@rgranit](https://discuss.elastic.co/u/rgranit)\ **Replies:** 5\ **Last updated:** [September 26, 2019, 7:01am UTC](https://discuss.elastic.co/t/aggregation-of-two-fields-in-single-query/200803 "2019-09-26T07:01:21Z")
Hello, I have aמ index with documents that contain several fields, among these are: grade person\_id I wish to create an aggregation that count the number of documents found for each person\_id and for each person sum … --- ## [Get the data about which fields are being visualised](https://discuss.elastic.co/t/get-the-data-about-which-fields-are-being-visualised/201063)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 7:01am UTC](https://discuss.elastic.co/t/get-the-data-about-which-fields-are-being-visualised/201063 "2019-09-26T07:01:04Z")
Hi, I have some 250 visualisations and i want to get the data about what fields are being used in visualisations. is there any simple way to get that data? kibana version: 7.3 Thanks --- ## [Ecommerce data model with ES](https://discuss.elastic.co/t/ecommerce-data-model-with-es/201158)
**Author:** [@svbhayani](https://discuss.elastic.co/u/svbhayani)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 6:58am UTC](https://discuss.elastic.co/t/ecommerce-data-model-with-es/201158 "2019-09-26T06:58:59Z")
Hello , I want to create a schema design in ES to support below business model I have Hundreds of thousands of articles ~1000K Each article may have different prices/offers like Samsumg S10 can have different 50 or mo… --- ## [Elasticsearch 1.5.2 service stops after 5 - 6 hours](https://discuss.elastic.co/t/elasticsearch-1-5-2-service-stops-after-5-6-hours/201138)
**Author:** [@Harsh\_Vadodaria](https://discuss.elastic.co/u/Harsh_Vadodaria)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 5:53am UTC](https://discuss.elastic.co/t/elasticsearch-1-5-2-service-stops-after-5-6-hours/201138 "2019-09-26T05:53:49Z")
Dear all, I recently found that ES service stops after few hours of activity. I am using version 1.5.2 and the server contains 8g of RAM and 155g of heap. I changed value of ES\_HEAP\_SIZE=1024m in /etc/default/elasticsea… --- ## [Azure cloud discovery plugin not working for 6.7.2](https://discuss.elastic.co/t/azure-cloud-discovery-plugin-not-working-for-6-7-2/201141)
**Author:** [@shankar\_s](https://discuss.elastic.co/u/shankar_s)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 5:45am UTC](https://discuss.elastic.co/t/azure-cloud-discovery-plugin-not-working-for-6-7-2/201141 "2019-09-26T05:45:16Z")
i'm trying to build up the 3-master 3-nodes elastic search stack in azure using vm. when i configure the elasticsearch with azure cloud discovery plugin i dont see that both master can communicate & it is not able to j… --- ## [\[ES7.0.1\] Field 'cn'(keyword&text type) is not extracted as expected from message field](https://discuss.elastic.co/t/es7-0-1-field-cn-keyword-text-type-is-not-extracted-as-expected-from-message-field/199560)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 6\ **Last updated:** [September 26, 2019, 5:42am UTC](https://discuss.elastic.co/t/es7-0-1-field-cn-keyword-text-type-is-not-extracted-as-expected-from-message-field/199560 "2019-09-26T05:42:00Z")
Hi Team, in prod elk, there's below message with containing the value of cn field is GRIFOLS, S.A. 2019-09-11 17:29:30,930 module=SCM fa=TS at=SCM.TS.LIST\_SAVED\_SEARCH si=566F57EC24877AC67B8D36655D69D490.vsa3029283 ci… --- ## [\[logstash\]what does "\\1" mean in gsub?](https://discuss.elastic.co/t/logstash-what-does-1-mean-in-gsub/199946)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 11\ **Last updated:** [September 26, 2019, 5:41am UTC](https://discuss.elastic.co/t/logstash-what-does-1-mean-in-gsub/199946 "2019-09-26T05:41:40Z")
Hi team, what does "\\1" mean in below configuration and how to use it? I can;t find the official documentation which can explain it. mutate { gsub =\> \["message","(?\<=SERVICEPERFDATA::)procs=(\\d+);\\S+", "\\1"\] } Is be… --- ## [\[Resolved\]ES7.0.1 - Error in elasticsearch 'Failed to parse mapping \[\_doc\]'](https://discuss.elastic.co/t/resolved-es7-0-1-error-in-elasticsearch-failed-to-parse-mapping-doc/200998)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 2\ **Last updated:** [September 26, 2019, 5:39am UTC](https://discuss.elastic.co/t/resolved-es7-0-1-error-in-elasticsearch-failed-to-parse-mapping-doc/200998 "2019-09-26T05:39:07Z")
Hi Team, I observed an error in elasticsearch. how to resolve it? \[2019-09-25T14:32:07,690\]\[INFO \]\[o.e.l.LicenseService \] \[node-1\] license \[e57e4a0d-4f0a-4e25-8beb-2e6192495d41\] mode \[trial\] - valid \[2019-09-25T14… --- ## [What does master having high load of CPU could mean?](https://discuss.elastic.co/t/what-does-master-having-high-load-of-cpu-could-mean/201139)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 4\ **Last updated:** [September 26, 2019, 5:27am UTC](https://discuss.elastic.co/t/what-does-master-having-high-load-of-cpu-could-mean/201139 "2019-09-26T05:27:43Z")
From some guidance, it suggests that master nodes do not need much cpu/memory. From my clusters, this looks true for most of the time. But sometimes, I do observe one of the master node has a high load\_5m. e.g. 5 or 6, b… --- ## [Access issues not able to get Elasticsearch status from Browser?](https://discuss.elastic.co/t/access-issues-not-able-to-get-elasticsearch-status-from-browser/200876)
**Author:** [@ent\_1](https://discuss.elastic.co/u/ent_1)\ **Replies:** 4\ **Last updated:** [September 26, 2019, 4:31am UTC](https://discuss.elastic.co/t/access-issues-not-able-to-get-elasticsearch-status-from-browser/200876 "2019-09-26T04:31:49Z")
unable to get Elasticsearch status from Browser help me out sort the issue --- ## [Memory/cpu ratio to disk size](https://discuss.elastic.co/t/memory-cpu-ratio-to-disk-size/200752)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 6\ **Last updated:** [September 26, 2019, 4:58am UTC](https://discuss.elastic.co/t/memory-cpu-ratio-to-disk-size/200752 "2019-09-26T04:58:26Z")
Could I get some comments on concerns/ insights on the following resource( cpu/ memory and disk size) configuration for one of my Elasticsearch cluster? Data volume: throughput: 18K docs/ second ( very continous load) … --- ## [Input via Log4J SocketAppender fails due to charachter problems](https://discuss.elastic.co/t/input-via-log4j-socketappender-fails-due-to-charachter-problems/201136)
**Author:** [@Dilan\_Sachintha](https://discuss.elastic.co/u/Dilan_Sachintha)\ **Replies:** 0\ **Last updated:** [September 26, 2019, 4:46am UTC](https://discuss.elastic.co/t/input-via-log4j-socketappender-fails-due-to-charachter-problems/201136 "2019-09-26T04:46:29Z")
I'm using Log4J v2.x SocketAppender to send logs to logstash directly. The system was previously designed to send the logs via filebeat. Since I changed the setting, logstash now cannot read my inputs. \[2019-09-26T10:06… --- ## [Can data nodes have different size of disk in one cluster?](https://discuss.elastic.co/t/can-data-nodes-have-different-size-of-disk-in-one-cluster/201134)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 4:33am UTC](https://discuss.elastic.co/t/can-data-nodes-have-different-size-of-disk-in-one-cluster/201134 "2019-09-26T04:33:53Z")
does anyone know any concern if I construct a cluster with data nodes with different disk size? e.g. 5 data nodes with 200GB Disk 5 data nodes with 1TB disk and 5 data nodes with 10TB disk. Will this cause any issue… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1872) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1874)