# Top

**URL:** https://discuss.elastic.co/top.md?page=1016&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1017

---

## [Detector field "clientIP.keyword" is not an aggregatable field](https://discuss.elastic.co/t/detector-field-clientip-keyword-is-not-an-aggregatable-field/266465)

<div class="topic-metadata">

**Author:** [@Ingram\_Gultom](https://discuss.elastic.co/u/Ingram_Gultom)\
**Replies:** 8\
**Last updated:** [March 8, 2021, 10:07am UTC](https://discuss.elastic.co/t/detector-field-clientip-keyword-is-not-an-aggregatable-field/266465 "2021-03-08T10:07:00Z")

</div>

Hello, Stack version : 7.9.3 I found issue when I tried to create a machine learning job in kibana The error : Detector field "clientIP.keyword" is not an aggregatable field The data looks like this in kibana { "\_…

---

## [Logstash is trying to connect to xpack in logstash-oss 7.0.1 version](https://discuss.elastic.co/t/logstash-is-trying-to-connect-to-xpack-in-logstash-oss-7-0-1-version/186640)

<div class="topic-metadata">

**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\
**Replies:** 3\
**Last updated:** [June 27, 2019, 6:06am UTC](https://discuss.elastic.co/t/logstash-is-trying-to-connect-to-xpack-in-logstash-oss-7-0-1-version/186640 "2019-06-27T06:06:04Z")

</div>

Hi, I am using elasticseach-oss 7.0.1 and logstash-oss 7.0.1 rpms in my docker image, both with searchguard. Elasticsearch is getting deployed and searchguard index is getting created. But when I deploy logstash, it kee…

---

## [Filebeat Nginx error module @timestamp wrong in Kibana](https://discuss.elastic.co/t/filebeat-nginx-error-module-timestamp-wrong-in-kibana/134456)

<div class="topic-metadata">

**Author:** [@surj08](https://discuss.elastic.co/u/surj08)\
**Replies:** 3\
**Last updated:** [June 6, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-nginx-error-module-timestamp-wrong-in-kibana/134456 "2018-06-06T13:47:40Z")

</div>

Hello I'm having an issue with filebeat 6.2.4 with the Nginx error module. The access module works fine and the data pulls into kibana with the correct time. However, the error logs show up 4 hours late with the default…

---

## [Aggregation with order by integer](https://discuss.elastic.co/t/aggregation-with-order-by-integer/56124)

<div class="topic-metadata">

**Author:** [@samuelr](https://discuss.elastic.co/u/samuelr)\
**Replies:** 3\
**Last updated:** [July 23, 2016, 4:51pm UTC](https://discuss.elastic.co/t/aggregation-with-order-by-integer/56124 "2016-07-23T16:51:42Z")

</div>

hello, I need to make an aggregation and sort the results by an integer field. I know how to do with type string, but not with integer. "size": 0, "aggs" : { "municipios" : { "terms" : { "field" : "doenca…

---

## [Use the java API client to connect to an ES instance at a given URL](https://discuss.elastic.co/t/use-the-java-api-client-to-connect-to-an-es-instance-at-a-given-url/305622)

<div class="topic-metadata">

**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\
**Replies:** 5\
**Last updated:** [June 1, 2022, 11:42am UTC](https://discuss.elastic.co/t/use-the-java-api-client-to-connect-to-an-es-instance-at-a-given-url/305622 "2022-06-01T11:42:25Z")

</div>

Hi, I'm migrating XWiki to use the new Java API client with ES 8.2.0 and I can't find a way to tell the API to connect to a URL (https://domainname/path). If I use RestClient restClient = RestClient.builder(HttpHost.cr…

---

## [.NET APM agent An existing connection was forcibly closed by the remote host](https://discuss.elastic.co/t/net-apm-agent-an-existing-connection-was-forcibly-closed-by-the-remote-host/182942)

<div class="topic-metadata">

**Author:** [@Futerkowiec](https://discuss.elastic.co/u/Futerkowiec)\
**Replies:** 5\
**Last updated:** [May 29, 2019, 8:39am UTC](https://discuss.elastic.co/t/net-apm-agent-an-existing-connection-was-forcibly-closed-by-the-remote-host/182942 "2019-05-29T08:39:52Z")

</div>

Kibana version: 7.1.0 Elasticsearch version: 7.1.0 APM Server version: 7.1.0 APM Agent language and version: .NET Agent version 0.0.2.0 Browser version: Firefox 67.0 Original install method (e.g. download page, yum,…

---

## [Metricbeat - Sparsity - Best Practices](https://discuss.elastic.co/t/metricbeat-sparsity-best-practices/129219)

<div class="topic-metadata">

**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\
**Replies:** 5\
**Last updated:** [April 24, 2018, 11:11am UTC](https://discuss.elastic.co/t/metricbeat-sparsity-best-practices/129219 "2018-04-24T11:11:42Z")

</div>

Hi All, I have a question related to storing of the metrics of various applications monitored by metribeat in the same metricbeat index. For example if I am monitoring system, apache, ngnix, mogodb using metric beat. F…

---

## [Watcher not starting](https://discuss.elastic.co/t/watcher-not-starting/70459)

<div class="topic-metadata">

**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\
**Replies:** 5\
**Last updated:** [January 4, 2017, 3:14pm UTC](https://discuss.elastic.co/t/watcher-not-starting/70459 "2017-01-04T15:14:10Z")

</div>

Hi there, I'm on a elasticsearch and logstash 2.0 environment. I installed watcher as it shows in the documentation. I get the plugins installed: bin/plugin -l i get this: Installed plugins: - watcher - license …

---

## [Self-signed certificate in the chain](https://discuss.elastic.co/t/self-signed-certificate-in-the-chain/324715)

<div class="topic-metadata">

**Author:** [@Leonardo\_Henrique](https://discuss.elastic.co/u/Leonardo_Henrique)\
**Replies:** 1\
**Last updated:** [February 8, 2023, 12:16am UTC](https://discuss.elastic.co/t/self-signed-certificate-in-the-chain/324715 "2023-02-08T00:16:55Z")

</div>

Hey everyone! How have you been? I configured the SSL for the Elastic cluster using the elasticsearch-certutil. So far, elasticsearch nodes can reach out each other, the Kibana can communicate with them and both are bei…

---

## [Aggregating array objects using scripted field](https://discuss.elastic.co/t/aggregating-array-objects-using-scripted-field/200514)

<div class="topic-metadata">

**Author:** [@Thayan\_Oliveira](https://discuss.elastic.co/u/Thayan_Oliveira)\
**Replies:** 1\
**Last updated:** [September 25, 2019, 8:38am UTC](https://discuss.elastic.co/t/aggregating-array-objects-using-scripted-field/200514 "2019-09-25T08:38:02Z")

</div>

Hello everyone! I'm trying to do a transformation in an array object and I'm get stucked. Can anyone help me to figure it out ? I'm aware that the better solution is doing the "denormalization" of this array as @Joe\_Fl…

---

## [Logstash-s3-plugin not importing data or creating sincedb file](https://discuss.elastic.co/t/logstash-s3-plugin-not-importing-data-or-creating-sincedb-file/155245)

<div class="topic-metadata">

**Author:** [@tom.isaacson](https://discuss.elastic.co/u/tom.isaacson)\
**Replies:** 1\
**Last updated:** [November 14, 2018, 4:16am UTC](https://discuss.elastic.co/t/logstash-s3-plugin-not-importing-data-or-creating-sincedb-file/155245 "2018-11-14T04:16:13Z")

</div>

I have an S3 bucket containing logs from other S3 buckets showing downloads, etc. I pulled Docker then installed S3 input plugin | Logstash Reference \[8.11\] | Elastic. I created a logstast.conf file: input { s3 { …

---

## [Convert monthname to monthnumber in logstash configuration file](https://discuss.elastic.co/t/convert-monthname-to-monthnumber-in-logstash-configuration-file/91230)

<div class="topic-metadata">

**Author:** [@JyothiRaj](https://discuss.elastic.co/u/JyothiRaj)\
**Replies:** 1\
**Last updated:** [June 29, 2017, 8:59am UTC](https://discuss.elastic.co/t/convert-monthname-to-monthnumber-in-logstash-configuration-file/91230 "2017-06-29T08:59:54Z")

</div>

Hi, First of all, I am very new to this elastic search and logstash. Excuse me If it sounds simple. I am having issue with logstash conf file. Currently my date format is "Wed Feb 15 08:05:50 2017". I wrote filter to m…

---

## [Exception on configuring Logstash](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510)

<div class="topic-metadata">

**Author:** [@Anca\_Turc](https://discuss.elastic.co/u/Anca_Turc)\
**Replies:** 4\
**Last updated:** [May 28, 2018, 1:17pm UTC](https://discuss.elastic.co/t/exception-on-configuring-logstash/133510 "2018-05-28T13:17:50Z")

</div>

Hi , I am trying to filter the traffic for search queries and I have followed this tutorial where is specified the logstash config file sniff\_search.conf. Input { beats { port =\> 5044 } } filter {…

---

## [EC2 Discovery Not Working](https://discuss.elastic.co/t/ec2-discovery-not-working/11386)

<div class="topic-metadata">

**Author:** [@VegHead](https://discuss.elastic.co/u/VegHead)\
**Replies:** 4\
**Last updated:** [April 4, 2013, 11:59pm UTC](https://discuss.elastic.co/t/ec2-discovery-not-working/11386 "2013-04-04T23:59:34Z")

</div>

So, this one is really puzzling me. I'm sure I've got something misconfigured, but I can't it out. I have two ES clusters on EC2 running 0.19.11 that work perfectly. I am trying to setup a new cluster of two nodes…

---

## [Index to file (.json)](https://discuss.elastic.co/t/index-to-file-json/324683)

<div class="topic-metadata">

**Author:** [@tmslara.a](https://discuss.elastic.co/u/tmslara.a)\
**Replies:** 2\
**Last updated:** [February 9, 2023, 2:50pm UTC](https://discuss.elastic.co/t/index-to-file-json/324683 "2023-02-09T14:50:53Z")

</div>

Hi, I have a running Elastic node with an index. I'm constantly inserting documents into the index in a process that I can't stop. I need to 'export' the index to a file (e.g., a .json). I've check alternatives to do th…

---

## [Visualize ES cluster statistics](https://discuss.elastic.co/t/visualize-es-cluster-statistics/65409)

<div class="topic-metadata">

**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\
**Replies:** 2\
**Last updated:** [November 9, 2016, 11:03pm UTC](https://discuss.elastic.co/t/visualize-es-cluster-statistics/65409 "2016-11-09T23:03:15Z")

</div>

Hi Team, Can i visualize \_cluster metadata? if yes, please let me know what is the base index for visualization and how. Basically i am looking visualization for: GET \_cluster/state/metadata I am using marvel but nee…

---

## [Logstash keeps restarting itself](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124)

<div class="topic-metadata">

**Author:** [@grigala](https://discuss.elastic.co/u/grigala)\
**Replies:** 3\
**Last updated:** [October 7, 2021, 1:59pm UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-itself/286124 "2021-10-07T13:59:17Z")

</div>

Hello everyone, For some reason my Logstash container keeps restarting itself and every time producing the output below: Using bundled JDK: /usr/share/logstash/jdk warning: no jvm.options file found /usr/share/logstash…

---

## [Snapshot elasticsearch with rsync](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033)

<div class="topic-metadata">

**Author:** [@andrezenzen](https://discuss.elastic.co/u/andrezenzen)\
**Replies:** 3\
**Last updated:** [October 5, 2020, 9:06pm UTC](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033 "2020-10-05T21:06:59Z")

</div>

I have a backup routine set up, and would like to use rsync to make a copy to another server. My question is whether rsync will be able to move without breaking files with the routine enabled.

---

## [Share single graph from kibana dashboard](https://discuss.elastic.co/t/share-single-graph-from-kibana-dashboard/161247)

<div class="topic-metadata">

**Author:** [@Shyju\_M](https://discuss.elastic.co/u/Shyju_M)\
**Replies:** 3\
**Last updated:** [December 18, 2018, 12:12pm UTC](https://discuss.elastic.co/t/share-single-graph-from-kibana-dashboard/161247 "2018-12-18T12:12:38Z")

</div>

Hi Team, Is it possible to share a single graph/widget from the Kibana dashboard rather than sharing the entire dashboard using the URL/IFrame? Kindly Help

---

## [Can't get Kibana to work for graphing Netflow data](https://discuss.elastic.co/t/cant-get-kibana-to-work-for-graphing-netflow-data/100773)

<div class="topic-metadata">

**Author:** [@Fayyaadh](https://discuss.elastic.co/u/Fayyaadh)\
**Replies:** 3\
**Last updated:** [September 18, 2017, 3:52am UTC](https://discuss.elastic.co/t/cant-get-kibana-to-work-for-graphing-netflow-data/100773 "2017-09-18T03:52:57Z")

</div>

Hi all I'm a complete n00b at the ELK stack and I feel like I'm out of my depth. Basically I want to be able to send Netflow data from my DD-WRT router to logstash and then off to elasticsearch and Kibana for some nice…

---

## [Marvel's not creating .marvel-es-data](https://discuss.elastic.co/t/marvels-not-creating-marvel-es-data/35064)

<div class="topic-metadata">

**Author:** [@MagicFrank](https://discuss.elastic.co/u/MagicFrank)\
**Replies:** 3\
**Last updated:** [November 27, 2015, 4:22am UTC](https://discuss.elastic.co/t/marvels-not-creating-marvel-es-data/35064 "2015-11-27T04:22:57Z")

</div>

Hi, I installed Marvel on two independent environments (DEV / PROD). I followed the same procedure on both place. On the dev side, marvel's working perfectly. However, on the prod environment, Marvel refuses to cre…

---

## [Github PR fix CLA error](https://discuss.elastic.co/t/github-pr-fix-cla-error/28268)

<div class="topic-metadata">

**Author:** [@zamblauskas](https://discuss.elastic.co/u/zamblauskas)\
**Replies:** 3\
**Last updated:** [August 29, 2015, 10:24pm UTC](https://discuss.elastic.co/t/github-pr-fix-cla-error/28268 "2015-08-29T22:24:27Z")

</div>

Hey fellow logstash users, I've made a PR Header line by zamblauskas · Pull Request #12 · logstash-plugins/logstash-filter-csv · GitHub , I had signed the CLA, but hadn't made my email public on Github profile, hence t…

---

## [Get events of an specific rule](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073)

<div class="topic-metadata">

**Author:** [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)\
**Replies:** 3\
**Last updated:** [May 6, 2022, 2:43am UTC](https://discuss.elastic.co/t/get-events-of-an-specific-rule/304073 "2022-05-06T02:43:16Z")

</div>

Hi Community! I'm trying to obtain all the events of a specific rule. Since I didn't find an API that does the job, I inspected the Chome Network Dev tool. During the inspection, I saw a request done to /internal/bsearc…

---

## [Facing too many file open or how to hit ES multiple times using spark](https://discuss.elastic.co/t/facing-too-many-file-open-or-how-to-hit-es-multiple-times-using-spark/120785)

<div class="topic-metadata">

**Author:** [@Gunjit\_Bansal](https://discuss.elastic.co/u/Gunjit_Bansal)\
**Replies:** 6\
**Last updated:** [February 21, 2018, 11:02am UTC](https://discuss.elastic.co/t/facing-too-many-file-open-or-how-to-hit-es-multiple-times-using-spark/120785 "2018-02-21T11:02:18Z")

</div>

Hi, My use case is to hit ES multiple times using Spark. In this, i am hitting ES 10000 times. I am getting too many files exception. But its working fine for 5K request To achieve this, I am hitting through REST API. …

---

## [Logs not moved from Logstash to Elasticsearch](https://discuss.elastic.co/t/logs-not-moved-from-logstash-to-elasticsearch/64683)

<div class="topic-metadata">

**Author:** [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)\
**Replies:** 6\
**Last updated:** [November 2, 2016, 3:43pm UTC](https://discuss.elastic.co/t/logs-not-moved-from-logstash-to-elasticsearch/64683 "2016-11-02T15:43:44Z")

</div>

Dear All, I have installed ELK on single server. Now I am just trying to read a sample log file in my tmp folder andoutput it to elasticsearch and display in Kibana . Below is my logstash configuration file: input…

---

## [Maximum limit for index](https://discuss.elastic.co/t/maximum-limit-for-index/10037)

<div class="topic-metadata">

**Author:** [@Honjoya](https://discuss.elastic.co/u/Honjoya)\
**Replies:** 6\
**Last updated:** [December 13, 2012, 7:13pm UTC](https://discuss.elastic.co/t/maximum-limit-for-index/10037 "2012-12-13T19:13:09Z")

</div>

Hi, I'm having trouble with the maximum index per node, my server has 8gb and -Xms, Xmx are both with 7GB, but I can only create 100 index on a node, the node crashes after 100 index. I wonder if there is some conf…

---

## [How to perform natural sort on a field in Elasticsearch?](https://discuss.elastic.co/t/how-to-perform-natural-sort-on-a-field-in-elasticsearch/285854)

<div class="topic-metadata">

**Author:** [@tranindigo](https://discuss.elastic.co/u/tranindigo)\
**Replies:** 1\
**Last updated:** [October 13, 2021, 8:04pm UTC](https://discuss.elastic.co/t/how-to-perform-natural-sort-on-a-field-in-elasticsearch/285854 "2021-10-13T20:04:02Z")

</div>

I have an Elasticsearch keyword field called LocationNumber that I want to sort "alphanumerically" (or "naturally") so that it is easy for users to read. I have been researching this for days and couldn't find any real d…

---

## [Vercel Integration](https://discuss.elastic.co/t/vercel-integration/285092)

<div class="topic-metadata">

**Author:** [@jasonkuhrt](https://discuss.elastic.co/u/jasonkuhrt)\
**Replies:** 1\
**Last updated:** [September 28, 2021, 4:20pm UTC](https://discuss.elastic.co/t/vercel-integration/285092 "2021-09-28T16:20:55Z")

</div>

I am exploring if it is possible to send logs from our functions hosted on Vercel to our ELK trial. My first hurdle is trying to understand how to ship logs from the function to ELK. Currently I am willing to do this wi…

---

## [How to shrink an index spread over multiple nodes](https://discuss.elastic.co/t/how-to-shrink-an-index-spread-over-multiple-nodes/241814)

<div class="topic-metadata">

**Author:** [@Prash7](https://discuss.elastic.co/u/Prash7)\
**Replies:** 7\
**Last updated:** [July 21, 2020, 5:09am UTC](https://discuss.elastic.co/t/how-to-shrink-an-index-spread-over-multiple-nodes/241814 "2020-07-21T05:09:40Z")

</div>

Hey Team, How do i go about shrinking an index, which has shards over multiple nodes ? I keep getting this error { "error": { "root\_cause": \[ { "type": "remote\_transport\_exception", "reason…

---

## [Do you even SNMP bro?](https://discuss.elastic.co/t/do-you-even-snmp-bro/74690)

<div class="topic-metadata">

**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Replies:** 7\
**Last updated:** [February 13, 2017, 2:02am UTC](https://discuss.elastic.co/t/do-you-even-snmp-bro/74690 "2017-02-13T02:02:51Z")

</div>

Does Logstash store any information in SNMP anywhere? If not, why?

---

## [Update previosuly indexed data](https://discuss.elastic.co/t/update-previosuly-indexed-data/282765)

<div class="topic-metadata">

**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\
**Replies:** 8\
**Last updated:** [August 31, 2021, 9:46am UTC](https://discuss.elastic.co/t/update-previosuly-indexed-data/282765 "2021-08-31T09:46:47Z")

</div>

Hello ! Is there any way to detect with logstash jdbc if some previously indexed field value has been modified and if so, replace the old value with the new modified one in the next scheduled execution? Thanks in advan…

---

## [About remove tansport client performance](https://discuss.elastic.co/t/about-remove-tansport-client-performance/207632)

<div class="topic-metadata">

**Author:** [@acrawlsnail](https://discuss.elastic.co/u/acrawlsnail)\
**Replies:** 8\
**Last updated:** [November 18, 2019, 8:10am UTC](https://discuss.elastic.co/t/about-remove-tansport-client-performance/207632 "2019-11-18T08:10:02Z")

</div>

I want to know why remove tansport client . HTTP1.1 that I know uses the text protocol and does not support multiplexing , so I think there is a huge performance difference between jest client and tansport client in high…

---

## [413 Request Entity Too Large](https://discuss.elastic.co/t/413-request-entity-too-large/91443)

<div class="topic-metadata">

**Author:** [@Yong\_Zhang](https://discuss.elastic.co/u/Yong_Zhang)\
**Replies:** 0\
**Last updated:** [June 30, 2017, 1:52pm UTC](https://discuss.elastic.co/t/413-request-entity-too-large/91443 "2017-06-30T13:52:54Z")

</div>

Hi, all I'm using fluentd to collect logs and send them to elasticsearch but facing below issue, how to fix it? Thanks for the help. Elasticsearch version: 5.4.0 with default elasticsearch.yml error log from fluent…

---

## [Multiple ES on one node](https://discuss.elastic.co/t/multiple-es-on-one-node/53617)

<div class="topic-metadata">

**Author:** [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)\
**Replies:** 0\
**Last updated:** [June 22, 2016, 7:13am UTC](https://discuss.elastic.co/t/multiple-es-on-one-node/53617 "2016-06-22T07:13:08Z")

</div>

Hello everyone, I'm trying to run two Elasticsearch on one node and I'm having some issues. Why two ES on one node ? I'll use the tribe node and, as you know, a node configured as a tribe node is a read only node. Bu…

---

## [How To Capture Java Application Client Side Log](https://discuss.elastic.co/t/how-to-capture-java-application-client-side-log/72586)

<div class="topic-metadata">

**Author:** [@soumya\_iiitc](https://discuss.elastic.co/u/soumya_iiitc)\
**Replies:** 1\
**Last updated:** [January 25, 2017, 12:05pm UTC](https://discuss.elastic.co/t/how-to-capture-java-application-client-side-log/72586 "2017-01-25T12:05:45Z")

</div>

We have a client side application for windows and mac. Our customers install and run them on different Mac and Windows machine. Currently, we are collecting application and user interaction logs in a log file into client…

---

## [Logstash: Adding custom field to documennt](https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361)

<div class="topic-metadata">

**Author:** [@delly.fofie](https://discuss.elastic.co/u/delly.fofie)\
**Replies:** 5\
**Last updated:** [July 11, 2018, 9:21am UTC](https://discuss.elastic.co/t/logstash-adding-custom-field-to-documennt/139361 "2018-07-11T09:21:06Z")

</div>

Hi all. I have the following XML file format: \<?xml version="1.0" encoding="UTF-8"?\> \<Object id="1" MUID="XXXX" GUID="XXXXXX2"\> \<Attribute name="Others" value="---"/\> \<Attribute name="Module name" value="Anforde…

---

## [Hw to configure ping\_retries with ec2 discovery?](https://discuss.elastic.co/t/hw-to-configure-ping-retries-with-ec2-discovery/45414)

<div class="topic-metadata">

**Author:** [@dany](https://discuss.elastic.co/u/dany)\
**Replies:** 5\
**Last updated:** [March 25, 2016, 9:22pm UTC](https://discuss.elastic.co/t/hw-to-configure-ping-retries-with-ec2-discovery/45414 "2016-03-25T21:22:00Z")

</div>

I would like to configure ping\_retries with ec2 discovery. could someone help with that? Should I use, discovery: type: ec2 ping\_retries:20 zen: minimum\_master\_nodes: 2 or discovery: t…

---

## [Getting OOME's (Out of Memory Exceptions) to stop](https://discuss.elastic.co/t/getting-oomes-out-of-memory-exceptions-to-stop/18332)

<div class="topic-metadata">

**Author:** [@Robin\_Clarke](https://discuss.elastic.co/u/Robin_Clarke)\
**Replies:** 2\
**Last updated:** [June 26, 2014, 12:10pm UTC](https://discuss.elastic.co/t/getting-oomes-out-of-memory-exceptions-to-stop/18332 "2014-06-26T12:10:08Z")

</div>

I have a 10 machine cluster where frequently (about once per day when indexing and querying is at its height) one elasticsearch node goes OOM... It usually recovers, but by this time the cluster is redistributing th…

---

## [Getting custom filebeat module into production](https://discuss.elastic.co/t/getting-custom-filebeat-module-into-production/275740)

<div class="topic-metadata">

**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\
**Replies:** 4\
**Last updated:** [July 28, 2021, 10:13am UTC](https://discuss.elastic.co/t/getting-custom-filebeat-module-into-production/275740 "2021-07-28T10:13:11Z")

</div>

I have created a new beats module (jde) which contain a couple of filesets. I have gone through the testing phases of the filebeat modules and all tests pass - Yeah! I am now trying to move this into production. To do…

---

## [Visualisations with fields from different indexes?](https://discuss.elastic.co/t/visualisations-with-fields-from-different-indexes/256553)

<div class="topic-metadata">

**Author:** [@madteo](https://discuss.elastic.co/u/madteo)\
**Replies:** 4\
**Last updated:** [November 24, 2020, 9:31pm UTC](https://discuss.elastic.co/t/visualisations-with-fields-from-different-indexes/256553 "2020-11-24T21:31:47Z")

</div>

Hi everyone! I have a little question for the wizards of Elastic, here... I hope that someone can help me in clarifying if this is an issue that is affecting my logic, or if I've encountered a limitation of the technolo…

---

## [Elastic APM not instrumenting spring cloud gateway](https://discuss.elastic.co/t/elastic-apm-not-instrumenting-spring-cloud-gateway/167081)

<div class="topic-metadata">

**Author:** [@Michael\_Couck](https://discuss.elastic.co/u/Michael_Couck)\
**Replies:** 4\
**Last updated:** [February 5, 2019, 2:14pm UTC](https://discuss.elastic.co/t/elastic-apm-not-instrumenting-spring-cloud-gateway/167081 "2019-02-05T14:14:20Z")

</div>

Hello, We are integrating Elastic APM into our landscape, eureka gets instrumented, the custom services, even the config server gets instrumented, but not the spring cloud gateway. Anyone done this, please post your sta…

---

## [Logstash Failed to Setup on Linux Mint 19](https://discuss.elastic.co/t/logstash-failed-to-setup-on-linux-mint-19/162185)

<div class="topic-metadata">

**Author:** [@peekr](https://discuss.elastic.co/u/peekr)\
**Replies:** 4\
**Last updated:** [December 28, 2018, 3:49pm UTC](https://discuss.elastic.co/t/logstash-failed-to-setup-on-linux-mint-19/162185 "2018-12-28T15:49:43Z")

</div>

Received an error upon: # apt-get install logstash Reading package lists... Done Building dependency tree Reading state information... Done The following NEW packages will be installed: logstash --------- Setti…

---

## [Unable to output csv file from Logstash](https://discuss.elastic.co/t/unable-to-output-csv-file-from-logstash/49588)

<div class="topic-metadata">

**Author:** [@Dark\_Light](https://discuss.elastic.co/u/Dark_Light)\
**Replies:** 4\
**Last updated:** [May 9, 2016, 11:55pm UTC](https://discuss.elastic.co/t/unable-to-output-csv-file-from-logstash/49588 "2016-05-09T23:55:37Z")

</div>

I am unable to figure out how to generate \*.csv files from Logstash. My goal is to generate csv files from multiple inputs i.e. winlogbeat, filebeat (from Mac Syslogs) and syslog (from our router). I have these 3 input…

---

## [Removing a single value from an array](https://discuss.elastic.co/t/removing-a-single-value-from-an-array/172016)

<div class="topic-metadata">

**Author:** [@tszyro](https://discuss.elastic.co/u/tszyro)\
**Replies:** 3\
**Last updated:** [March 12, 2019, 7:49pm UTC](https://discuss.elastic.co/t/removing-a-single-value-from-an-array/172016 "2019-03-12T19:49:14Z")

</div>

I can't figure out how to remove a single value from an array. I am trying to build a pipeline where I clone an event do different operation on the copy and finally output an original event into one index and the clone …

---

## [Elapsed Filter](https://discuss.elastic.co/t/elapsed-filter/26198)

<div class="topic-metadata">

**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Replies:** 3\
**Last updated:** [July 24, 2015, 11:27pm UTC](https://discuss.elastic.co/t/elapsed-filter/26198 "2015-07-24T23:27:29Z")

</div>

I've got 9 apache servers feeding data into Elasticsearch via Logstash, front-end is Kibana 4. One of the items they want me to visualize is Average Visitor Stay Length. It was suggested in another thread that I could…

---

## [Warning \[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\] after updating to 7.16.1](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049)

<div class="topic-metadata">

**Author:** [@d71247](https://discuss.elastic.co/u/d71247)\
**Replies:** 1\
**Last updated:** [December 15, 2021, 9:07pm UTC](https://discuss.elastic.co/t/warning-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-after-updating-to-7-16-1/292049 "2021-12-15T21:07:37Z")

</div>

Hello, I just updated my Logstash to 7.16.1... but I noticed warning in my conf when starting Logstash. the same conf of Logstash works well in version 7.9.1 How do to fix this warning ? I am using a Logstash docker …

---

## [Sum of Average aggregation in visualization](https://discuss.elastic.co/t/sum-of-average-aggregation-in-visualization/238533)

<div class="topic-metadata">

**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\
**Replies:** 1\
**Last updated:** [July 15, 2020, 10:37am UTC](https://discuss.elastic.co/t/sum-of-average-aggregation-in-visualization/238533 "2020-07-15T10:37:48Z")

</div>

i using this script to get sum of average aggregation Script: { "size": 0, "aggs": { "by category": { "terms": { "field": "spv.keyword" }, "aggs": { "by user\_id": { "…

---

## [Missing authentication token for REST error](https://discuss.elastic.co/t/missing-authentication-token-for-rest-error/142291)

<div class="topic-metadata">

**Author:** [@Miho](https://discuss.elastic.co/u/Miho)\
**Replies:** 1\
**Last updated:** [August 6, 2018, 6:26am UTC](https://discuss.elastic.co/t/missing-authentication-token-for-rest-error/142291 "2018-08-06T06:26:20Z")

</div>

Hello! I'm getting a missing authentication error and was wondering if anyone can help me. I'm using version 6.1.1 My code without credentials: PUT \_xpack/watcher/watch/cluster\_yellow3 { "trigger": { "schedule"…

---

## [Logstash output: dynamically multiple indexes](https://discuss.elastic.co/t/logstash-output-dynamically-multiple-indexes/72008)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 1\
**Last updated:** [January 18, 2017, 1:52pm UTC](https://discuss.elastic.co/t/logstash-output-dynamically-multiple-indexes/72008 "2017-01-18T13:52:55Z")

</div>

Hi, we have logs of our production, qa and dev systems in the same elasticsearch database. Currently we have one index for all, and I want to separate it, with the target: - higher performance - lower storage usage - …

---

## [Elasticsearch 5.0.0-alpha4 - nodebuilder and settingsbuilder out?](https://discuss.elastic.co/t/elasticsearch-5-0-0-alpha4-nodebuilder-and-settingsbuilder-out/59370)

<div class="topic-metadata">

**Author:** [@sarunkum](https://discuss.elastic.co/u/sarunkum)\
**Replies:** 1\
**Last updated:** [August 31, 2016, 1:28am UTC](https://discuss.elastic.co/t/elasticsearch-5-0-0-alpha4-nodebuilder-and-settingsbuilder-out/59370 "2016-08-31T01:28:05Z")

</div>

Getting the following compilation errors when moving from 2.3.4 to 5.0.0-alpha4 of elasticsearch: \[error\] /workspace/spark/vulnerability/src/test/scala/etl/EsLoopTest.scala:9: object NodeBuilder is not a member of pack…

[Previous page](https://discuss.elastic.co/top.md?page=1015&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1017&per_page=50&period=all)
