# Top **URL:** https://discuss.elastic.co/top.md?page=103&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 104 --- ## [Logstash Ruby filter error](https://discuss.elastic.co/t/logstash-ruby-filter-error/140375)
**Author:** [@Darshan\_Parab](https://discuss.elastic.co/u/Darshan_Parab)\ **Replies:** 9\ **Last updated:** [July 18, 2018, 6:37pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-error/140375 "2018-07-18T18:37:41Z")
Hi All, I have written a ruby filter to check if a pattern present in a message and drop the event if pattern is not present. I'm getting below mentioned error after updating the logstash configuration, \[2018-07-17T23… --- ## [Java.io.tmpdir](https://discuss.elastic.co/t/java-io-tmpdir/323534)
**Author:** [@chuck1](https://discuss.elastic.co/u/chuck1)\ **Replies:** 10\ **Last updated:** [January 20, 2023, 9:35pm UTC](https://discuss.elastic.co/t/java-io-tmpdir/323534 "2023-01-20T21:35:27Z")
Hello, My elasticsearch version is 8.5.3-1 I have a hardened RHEL 8 system which requires that /tmp be mounted with the "noexec" option. I have tried to adjust my jvm.options file in /etc/elasticsearch/jvm.options to s… --- ## [Logstash - elasticsarch and double quotes](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 11\ **Last updated:** [April 15, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133 "2021-04-15T16:49:21Z")
Hello I'm trying to ingest logs wich have " in some of their fields as part of a string, I'm trying to scape them with \\ or \\ or \\\\ but no luck, so, is there any way to ingest double quotes from logs into elasticsearch … --- ## [Elastic Stack Setup for Multiple Server](https://discuss.elastic.co/t/elastic-stack-setup-for-multiple-server/134649)
**Author:** [@w0lfxpunk](https://discuss.elastic.co/u/w0lfxpunk)\ **Replies:** 9\ **Last updated:** [June 25, 2018, 7:11pm UTC](https://discuss.elastic.co/t/elastic-stack-setup-for-multiple-server/134649 "2018-06-25T19:11:06Z")
Dear All, I have 10 servers with different application and different clients. I want to setup ELK Stack server for all of them in one place. The server will be sending following logs to my ELK Box Apache Access & Err… --- ## [Elasticsearch Cluster setup Issue](https://discuss.elastic.co/t/elasticsearch-cluster-setup-issue/29561)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 13\ **Last updated:** [September 22, 2015, 3:22pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-setup-issue/29561 "2015-09-22T15:22:41Z")
Hi, I tried to setup Elasticsearch cluster in my local LAB. Setup Scenario : Server 1 : IP : 10.11.12.101 Cluster Name : mycluster Node name : Node\_2 Server 2 : IP : 10.11.12.102 Cluster Name : mycluster Node … --- ## [0 hits, 14693688 total on index with 700 documents](https://discuss.elastic.co/t/0-hits-14693688-total-on-index-with-700-documents/102608)
**Author:** [@spappier](https://discuss.elastic.co/u/spappier)\ **Replies:** 14\ **Last updated:** [October 10, 2017, 6:36pm UTC](https://discuss.elastic.co/t/0-hits-14693688-total-on-index-with-700-documents/102608 "2017-10-10T18:36:21Z")
Hi, I'm having the following problem on an Elasticsearch 5.4.3 cluster. When making a query where some shards don't return any hits they seem to return an incorrect total. This happens only on some nodes and restarting t… --- ## [Elastic search 6.5.4 Caused by:ClassNotFoundException: org.elasticsearch.xpack.core.XPackClientPlugin](https://discuss.elastic.co/t/elastic-search-6-5-4-caused-by-org-elasticsearch-xpack-core-xpackclientplugin/230332)
**Author:** [@rthangaraj5](https://discuss.elastic.co/u/rthangaraj5)\ **Replies:** 16\ **Last updated:** [May 11, 2020, 5:23pm UTC](https://discuss.elastic.co/t/elastic-search-6-5-4-caused-by-org-elasticsearch-xpack-core-xpackclientplugin/230332 "2020-05-11T17:23:12Z")
I am getting ClassNotFoundException: org.elasticsearch.xpack.core.XPackClientPlugin with elastic search 6.5.4 version. pls find the logs which i am getting . Caused by: org.springframework.beans.factory.BeanCreationExc… --- ## [Too many open files and other problems](https://discuss.elastic.co/t/too-many-open-files-and-other-problems/9626)
**Author:** [@Ulli](https://discuss.elastic.co/u/Ulli)\ **Replies:** 16\ **Last updated:** [November 20, 2012, 12:00pm UTC](https://discuss.elastic.co/t/too-many-open-files-and-other-problems/9626 "2012-11-20T12:00:10Z")
Hi, First I had problems with 'too many open files' warnings. When I finally managed to increase the file limit \[10:56:44,855\]\[INFO \]\[bootstrap \] max\_open\_files \[249978\] other warnings occured l… --- ## [Elasticsearch.service failing on Debian](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366)
**Author:** [@kamie](https://discuss.elastic.co/u/kamie)\ **Replies:** 21\ **Last updated:** [July 12, 2022, 9:25pm UTC](https://discuss.elastic.co/t/elasticsearch-service-failing-on-debian/309366 "2022-07-12T21:25:07Z")
My operating system is Debian 11 (Bullseye), it runs on a Pentium E5800 I've installed JDK/Java 11 (and set the path), apt-transport-https, the Elasticsearch keys and repo, and have updated my system multiple times. I'v… --- ## [Use CURL to create mapping suspend](https://discuss.elastic.co/t/use-curl-to-create-mapping-suspend/104213)
**Author:** [@winlans](https://discuss.elastic.co/u/winlans)\ **Replies:** 10\ **Last updated:** [October 19, 2017, 8:02am UTC](https://discuss.elastic.co/t/use-curl-to-create-mapping-suspend/104213 "2017-10-19T08:02:11Z")
When I use curl to create mapping for index, curl will hang there, there will not be any corresponding, and will not stop operation. elasticsearch version:5.6.3 or 5.6.2 os: ubuntu 16.04 and centos 7 This is not the … --- ## [Upgrade from 5.6 to 6.5-OSS without loosing data](https://discuss.elastic.co/t/upgrade-from-5-6-to-6-5-oss-without-loosing-data/159015)
**Author:** [@jalogisch](https://discuss.elastic.co/u/jalogisch)\ **Replies:** 19\ **Last updated:** [January 6, 2019, 12:35pm UTC](https://discuss.elastic.co/t/upgrade-from-5-6-to-6-5-oss-without-loosing-data/159015 "2019-01-06T12:35:20Z")
Dear all, I have a running Cluster on Centos 7 with the RPM of Elasticsearch 5.6.13 installed and running. Now after all pre-flight checks, I want to upgrade to 6.5. But I do not find a way to upgrade to the OSS Versio… --- ## [How does the elasticsearch expand capacity and shrink capacity？](https://discuss.elastic.co/t/how-does-the-elasticsearch-expand-capacity-and-shrink-capacity/99396)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 16\ **Last updated:** [September 6, 2017, 2:50am UTC](https://discuss.elastic.co/t/how-does-the-elasticsearch-expand-capacity-and-shrink-capacity/99396 "2017-09-06T02:50:33Z")
elasticsearch version: 5.5.2 OS: Linux A cluster of 3 nodes. How does elasticsearch reduce capacity and scale out capacity? Is there any operation command? --- ## [Why is ElasticSearch SQL excruciatingly slow?](https://discuss.elastic.co/t/why-is-elasticsearch-sql-excruciatingly-slow/209276)
**Author:** [@Nick\_Walton](https://discuss.elastic.co/u/Nick_Walton)\ **Replies:** 14\ **Last updated:** [December 2, 2019, 9:14pm UTC](https://discuss.elastic.co/t/why-is-elasticsearch-sql-excruciatingly-slow/209276 "2019-12-02T21:14:19Z")
I have a very simple SQL query select hashstring from "flink-index-deduplicated" where bearing = 60 over about 118 million documents of which around 1/19th will match bearing = 60. The bearing values are defined as Lon… --- ## [Retention users in ES](https://discuss.elastic.co/t/retention-users-in-es/31537)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 12\ **Last updated:** [June 20, 2017, 9:26am UTC](https://discuss.elastic.co/t/retention-users-in-es/31537 "2017-06-20T09:26:29Z")
Hi!!! I have documents with user\_id field. When new user comes I get log with :"New user\_id created" Is it possible in ES to calculate how many new users in my store visit it again after 7(28) days after. --- ## [Unable to run Logstash 7.9.2 as a service on Ubuntu 18.04](https://discuss.elastic.co/t/unable-to-run-logstash-7-9-2-as-a-service-on-ubuntu-18-04/251005)
**Author:** [@Philip\_Colmer](https://discuss.elastic.co/u/Philip_Colmer)\ **Replies:** 15\ **Last updated:** [October 9, 2020, 7:06am UTC](https://discuss.elastic.co/t/unable-to-run-logstash-7-9-2-as-a-service-on-ubuntu-18-04/251005 "2020-10-09T07:06:44Z")
I'm getting a warning and an error when I try to start logstash with systemctl start logstash: \[2020-10-05T14:01:19,067\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or com… --- ## [Java Transport Client slower than curl request](https://discuss.elastic.co/t/java-transport-client-slower-than-curl-request/62067)
**Author:** [@NRS](https://discuss.elastic.co/u/NRS)\ **Replies:** 9\ **Last updated:** [October 4, 2016, 8:16pm UTC](https://discuss.elastic.co/t/java-transport-client-slower-than-curl-request/62067 "2016-10-04T20:16:59Z")
I am facing the same issue . When I use curl to get response , it takes around 40-50 ms . But When same query is executed using execute().actionGet() using TransportClient , it takes around 1000 ms. Trying to figure out … --- ## [Error Warning how to resolve it (highlighted errors in BLACK colour)](https://discuss.elastic.co/t/error-warning-how-to-resolve-it-highlighted-errors-in-black-colour/210320)
**Author:** [@Hari\_Reddy](https://discuss.elastic.co/u/Hari_Reddy)\ **Replies:** 11\ **Last updated:** [December 28, 2019, 1:51am UTC](https://discuss.elastic.co/t/error-warning-how-to-resolve-it-highlighted-errors-in-black-colour/210320 "2019-12-28T01:51:42Z")
bash-4.4$ cd usr/share/kibana/bin/ bash-4.4$ ./kibana log \[09:37:37.708\] \[info\]\[plugins-system\] Setting up \[4\] plugins: \[security,translations,inspector,data\] log \[09:37:37.716\] \[info\]\[plugins\]\[security\] Setting u… --- ## [Kibana is not connecting with elasticsearch shield SSL](https://discuss.elastic.co/t/kibana-is-not-connecting-with-elasticsearch-shield-ssl/48129)
**Author:** [@Devarajc](https://discuss.elastic.co/u/Devarajc)\ **Replies:** 9\ **Last updated:** [April 28, 2016, 11:47am UTC](https://discuss.elastic.co/t/kibana-is-not-connecting-with-elasticsearch-shield-ssl/48129 "2016-04-28T11:47:10Z")
We are try to setup the shield ssl in local machine. Elasticsearch version : 2.2.1 Kibana version : 4.4.1 Shield version : Latest version We generated self signed crt, key, pem file as below: openssl req -out CSR.… --- ## [Generate PDF report not working in Kibana](https://discuss.elastic.co/t/generate-pdf-report-not-working-in-kibana/305674)
**Author:** [@pranay\_jain](https://discuss.elastic.co/u/pranay_jain)\ **Replies:** 11\ **Last updated:** [June 10, 2022, 5:59am UTC](https://discuss.elastic.co/t/generate-pdf-report-not-working-in-kibana/305674 "2022-06-10T05:59:42Z")
Hi, I am trying to generate the PDF report from Kibana dashboard but I end up getting the warning 'The "open URL" phase took longer than 60 seconds. You may need to increase "xpack.reporting.capture.timeouts.openUrl" I… --- ## [AWS Spot + Reserved Instances](https://discuss.elastic.co/t/aws-spot-reserved-instances/10208)
**Author:** [@govind201](https://discuss.elastic.co/u/govind201)\ **Replies:** 12\ **Last updated:** [May 26, 2016, 7:27pm UTC](https://discuss.elastic.co/t/aws-spot-reserved-instances/10208 "2016-05-26T19:27:20Z")
I currently run my Elasticsearch cluster on 'Y' number of AWS EBS backed reserved (reliable) instances. I'm now exploring the possibility of introducing '3Y' AWS spot instances (unreliable but very cheap) with the s… --- ## [Kibana Canvas SQL Error](https://discuss.elastic.co/t/kibana-canvas-sql-error/187637)
**Author:** [@AdrianSanchezLopez](https://discuss.elastic.co/u/AdrianSanchezLopez)\ **Replies:** 10\ **Last updated:** [July 12, 2019, 9:13pm UTC](https://discuss.elastic.co/t/kibana-canvas-sql-error/187637 "2019-07-12T21:13:19Z")
I just Updated to Elasticsearch 7.2 and now I'm getting this error when using Canvas with Elasticsearch SQL data: Whoops! Expression failed Expression failed with the message: \[essql\] \> Unexpected error from Elasticsea… --- ## [How to map and index the specific json object into elastic search](https://discuss.elastic.co/t/how-to-map-and-index-the-specific-json-object-into-elastic-search/191204)
**Author:** [@manjudr](https://discuss.elastic.co/u/manjudr)\ **Replies:** 13\ **Last updated:** [July 22, 2019, 1:11pm UTC](https://discuss.elastic.co/t/how-to-map-and-index-the-specific-json-object-into-elastic-search/191204 "2019-07-22T13:11:02Z")
Let's I'm reading data from the kafka topic and indexing specific data into specific elastic search index. Example : Logstash reading message from the kafka topic i has two messages(1. LOG, 2.ERROR) Message1. //{ "e… --- ## [Help with RUBY. Recognising field with prefix and changing its type](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157)
**Author:** [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)\ **Replies:** 10\ **Last updated:** [October 15, 2018, 8:28am UTC](https://discuss.elastic.co/t/help-with-ruby-recognising-field-with-prefix-and-changing-its-type/152157 "2018-10-15T08:28:38Z")
Hi, I am trying to convert fields with a certain prefix into an integer event.to\_hash.keys.each { |k| if event.get\[k\].is\_a?(String) and k.start\_with?('behaviour\_' || 'top\_disease\_') event.get\[k\] = event.… --- ## [Elasticsearch output cluster\_name](https://discuss.elastic.co/t/elasticsearch-output-cluster-name/33770)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 9\ **Last updated:** [November 19, 2015, 4:20pm UTC](https://discuss.elastic.co/t/elasticsearch-output-cluster-name/33770 "2015-11-19T16:20:05Z")
Before upgrading to version 2.0 I was able to reference my elasticsearch cluster in my logstash conf file with the cluster name option. With the upgrade to ES 2.0 and logstash 2.o that option is no longer available. No… --- ## [APM Java agent exception at startup](https://discuss.elastic.co/t/apm-java-agent-exception-at-startup/250208)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 10\ **Last updated:** [October 7, 2020, 7:36am UTC](https://discuss.elastic.co/t/apm-java-agent-exception-at-startup/250208 "2020-10-07T07:36:09Z")
Elasticsearch version: 7.8 APM Server version: 7.8 APM Agent language and version: JAva 1.18 Hi, I'm trying to use the latest APM Java agent (1.18) but I'm facing this error: ERROR co.elastic.apm.agent.util.Dependen… --- ## [Elasticsearch failed to execute slack api http request](https://discuss.elastic.co/t/elasticsearch-failed-to-execute-slack-api-http-request/73456)
**Author:** [@miked](https://discuss.elastic.co/u/miked)\ **Replies:** 10\ **Last updated:** [February 21, 2017, 4:42am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-execute-slack-api-http-request/73456 "2017-02-21T04:42:26Z")
Hi there, I'm using ES and Kibana 5.1.2 (with x-pack) and have configured a Watcher to send an alert to Slack. The Watcher and query is working but the following error is generated in ES when trying to send the message … --- ## [Error after upgrading filebeat to 7.10](https://discuss.elastic.co/t/error-after-upgrading-filebeat-to-7-10/255402)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 11\ **Last updated:** [December 4, 2020, 4:43pm UTC](https://discuss.elastic.co/t/error-after-upgrading-filebeat-to-7-10/255402 "2020-12-04T16:43:47Z")
Hi, after I upgraded my stack to 7.10(from 7.9.3), I tried to upgrade my filebeat. But I'm getting this error: Nov 14 14:41:54 XXXXXXX filebeat\[13184\]: 2020-11-14T14:41:54.462+0330 INFO instance/beat.go:46… --- ## ["." is behaving like special character in ES 2.3](https://discuss.elastic.co/t/is-behaving-like-special-character-in-es-2-3/92540)
**Author:** [@maryam](https://discuss.elastic.co/u/maryam)\ **Replies:** 9\ **Last updated:** [July 12, 2017, 8:49pm UTC](https://discuss.elastic.co/t/is-behaving-like-special-character-in-es-2-3/92540 "2017-07-12T20:49:10Z")
When doing a GET request to the following endpoint against all of our Elastic Search (ES) environments to see how the analyzers work: http://\[elastic search endpoint\]/\_analyze?analyzer=standard&text=eee.fe.Esddasdae.ds… --- ## [How to find docs that contain the exact specified terms](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 14\ **Last updated:** [February 11, 2022, 2:29pm UTC](https://discuss.elastic.co/t/how-to-find-docs-that-contain-the-exact-specified-terms/295758 "2022-02-11T14:29:10Z")
Hi, I'm trying to get docs that contain the exact specified terms. Terms query doesn't match because it also returns docs with additional terms. Create index : PUT my-index { "mappings": { "properties": { … --- ## [Metricbeat autodiscovery kubernetes](https://discuss.elastic.co/t/metricbeat-autodiscovery-kubernetes/139328)
**Author:** [@mat1010](https://discuss.elastic.co/u/mat1010)\ **Replies:** 21\ **Last updated:** [October 2, 2018, 11:39am UTC](https://discuss.elastic.co/t/metricbeat-autodiscovery-kubernetes/139328 "2018-10-02T11:39:58Z")
I'm running metricbeat 6.3.0 with autodiscovery enabled as daemonset on my K8s cluster in GCP as described in the documentation The autodiscovery works fine once I attach the proper annotations to my pods. Anyway once I… --- ## [Metricbeat Kibana Dashboard for Postgresql](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-for-postgresql/183544)
**Author:** [@RockD](https://discuss.elastic.co/u/RockD)\ **Replies:** 10\ **Last updated:** [June 25, 2019, 1:04pm UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard-for-postgresql/183544 "2019-06-25T13:04:24Z")
Hi I have installed metricbeat in a machine with a postgresql service on it, so I enabled the postgresql module of metricbeat. I loaded the dashboards into kibana and search for a postgresql dashboard and doesn't exist… --- ## [My elastic apm is not showing stack trace of a transaction](https://discuss.elastic.co/t/my-elastic-apm-is-not-showing-stack-trace-of-a-transaction/342467)
**Author:** [@Mansoor\_Ur\_Rehman](https://discuss.elastic.co/u/Mansoor_Ur_Rehman)\ **Replies:** 10\ **Last updated:** [September 28, 2023, 10:03am UTC](https://discuss.elastic.co/t/my-elastic-apm-is-not-showing-stack-trace-of-a-transaction/342467 "2023-09-28T10:03:01Z")
my elastic apm is not showing stack trace of a transaction i have shared the picture Kibana version: 8.9 Elasticsearch version: 8.9 APM Server version: get it installed from kibana elasticagent APM Agent languag… --- ## [PLEASE PLEASE provide a way to turn off JarHell classpath checking!](https://discuss.elastic.co/t/please-please-provide-a-way-to-turn-off-jarhell-classpath-checking/42807)
**Author:** [@tbessie](https://discuss.elastic.co/u/tbessie)\ **Replies:** 9\ **Last updated:** [July 31, 2016, 6:39pm UTC](https://discuss.elastic.co/t/please-please-provide-a-way-to-turn-off-jarhell-classpath-checking/42807 "2016-07-31T18:39:09Z")
In our project, we have many libraries that don't conflict in Eclipse, don't conflict in standalone apps, and don't conflict in a JBoss environment... but Elasticsearch's JarHell checking says there is a conflict and ref… --- ## [Elasticsearch is spanning multiple processes and threads resulting in 100% CPU utilization](https://discuss.elastic.co/t/elasticsearch-is-spanning-multiple-processes-and-threads-resulting-in-100-cpu-utilization/138138)
**Author:** [@abdulwaheed](https://discuss.elastic.co/u/abdulwaheed)\ **Replies:** 15\ **Last updated:** [July 18, 2018, 5:36am UTC](https://discuss.elastic.co/t/elasticsearch-is-spanning-multiple-processes-and-threads-resulting-in-100-cpu-utilization/138138 "2018-07-18T05:36:08Z")
Hi Elastic users, We are using ES 2.4.5 along with Liferay DXP, we have set it up with the default configuration. We are having (1node, 1 shard and 0 replicas) on ES 2.4.5 running on EC2 (4CPU, 16GB RAM). On a daily … --- ## [Daily/hourly aggregation using transform](https://discuss.elastic.co/t/daily-hourly-aggregation-using-transform/248677)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 11\ **Last updated:** [September 18, 2020, 5:15am UTC](https://discuss.elastic.co/t/daily-hourly-aggregation-using-transform/248677 "2020-09-18T05:15:47Z")
Hello I want to have a daily aggregation index with daily avg, percentiles etc . I've created a daily transform with: (more complex than below) "pivot": { "group\_by": { "datetime": { "date\_histogram… --- ## [ELK Stack + TLS + Headache](https://discuss.elastic.co/t/elk-stack-tls-headache/279429)
**Author:** [@pooch](https://discuss.elastic.co/u/pooch)\ **Replies:** 14\ **Last updated:** [August 20, 2021, 6:39pm UTC](https://discuss.elastic.co/t/elk-stack-tls-headache/279429 "2021-08-20T18:39:42Z")
I am ashamed to admin that I spent a week or so trying to get SSL enabled in my stack and this is my last ditch effort. I have scoured the docs, message boards, git but I am getting nowhere. ELK Stack version 7.13.2 ins… --- ## [Logstash Geolocate IP Address into Elasticsearch](https://discuss.elastic.co/t/logstash-geolocate-ip-address-into-elasticsearch/75246)
**Author:** [@Bondo](https://discuss.elastic.co/u/Bondo)\ **Replies:** 13\ **Last updated:** [February 17, 2017, 6:47pm UTC](https://discuss.elastic.co/t/logstash-geolocate-ip-address-into-elasticsearch/75246 "2017-02-17T18:47:16Z")
I'm trying to get Logstash to take in an IIS web log and geo locate the IP address using something like GeoLite from MaxMind and then dump it to Elasticsearch. Has anyone done something similar before? I'm not an ELK gur… --- ## [Index not created and more it doesn't open and read the log file to ship logs when starting logstash](https://discuss.elastic.co/t/index-not-created-and-more-it-doesnt-open-and-read-the-log-file-to-ship-logs-when-starting-logstash/164598)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 15\ **Last updated:** [January 20, 2019, 5:31pm UTC](https://discuss.elastic.co/t/index-not-created-and-more-it-doesnt-open-and-read-the-log-file-to-ship-logs-when-starting-logstash/164598 "2019-01-20T17:31:18Z")
I am running to an issue since yesterday that it doesn't open and read the log file when starting logstash. Could you please help take a look what is the problem here? 1. Here is the logstash.conf input { file{… --- ## [Winlogbeat maximum size of event?](https://discuss.elastic.co/t/winlogbeat-maximum-size-of-event/73708)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 12\ **Last updated:** [February 22, 2017, 4:20am UTC](https://discuss.elastic.co/t/winlogbeat-maximum-size-of-event/73708 "2017-02-22T04:20:17Z")
Hi! I'm curious whether there is a maximum size of events winlogbeat can forward. While I need to know this for current versions I also need this information about version 1.2 or 1.3. Background: I plan to use winlog… --- ## [Question about the idle\_timeout option](https://discuss.elastic.co/t/question-about-the-idle-timeout-option/50002)
**Author:** [@ericpietro](https://discuss.elastic.co/u/ericpietro)\ **Replies:** 10\ **Last updated:** [May 19, 2016, 10:08am UTC](https://discuss.elastic.co/t/question-about-the-idle-timeout-option/50002 "2016-05-19T10:08:47Z")
hi, reading the documentation, i was thinking that the spooler is flushed every 'idle\_timeout' duration or if the spool\_size is reached. In my case (as u can see on my log below), I set these options : - spool\_size = 40… --- ## [Fscrawler](https://discuss.elastic.co/t/fscrawler/260467)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 14\ **Last updated:** [January 27, 2021, 2:25pm UTC](https://discuss.elastic.co/t/fscrawler/260467 "2021-01-27T14:25:25Z")
Hi I am running elasticsearch cluster in docker. Setup fscrawler, but when I am running it is giving error We can not start Elasticsearch Client. Exiting. Here are complete error Recreating fscrawler ... done Attachin… --- ## [Extracting time from @timestamp field using Runtime](https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 13\ **Last updated:** [December 4, 2023, 6:47am UTC](https://discuss.elastic.co/t/extracting-time-from-timestamp-field-using-runtime/348468 "2023-12-04T06:47:56Z")
I understand Scripted Fields have been deprecated since 7.13. The replacement is now Runtime. I have a @timestamp field How can I extract out the time component into a new field @timeofday - such that when I filter … --- ## [My story](https://discuss.elastic.co/t/my-story/92230)
**Author:** [@wldev](https://discuss.elastic.co/u/wldev)\ **Replies:** 13\ **Last updated:** [July 7, 2017, 2:58pm UTC](https://discuss.elastic.co/t/my-story/92230 "2017-07-07T14:58:50Z")
Because it started to become little mess, I wanted to shed some light on my story. We are small, 2 people-only, company. Our main fierld of activity was cloud-computing. As catalog of goods we offer got larger, we th… --- ## [Nodes eventually disconnect with ssl enabled on transport layer](https://discuss.elastic.co/t/nodes-eventually-disconnect-with-ssl-enabled-on-transport-layer/252100)
**Author:** [@Sebastian\_Seith](https://discuss.elastic.co/u/Sebastian_Seith)\ **Replies:** 16\ **Last updated:** [October 20, 2020, 10:16pm UTC](https://discuss.elastic.co/t/nodes-eventually-disconnect-with-ssl-enabled-on-transport-layer/252100 "2020-10-20T22:16:22Z")
Hi Everyone, I've got a 3-node, 7.6.1 cluster running on ec2 t2.medium instances in a private vpc we're using for a machine-learning project. We got everything set up fine and had no issues with a number of different t… --- ## [Filebeat not filtering for separate index](https://discuss.elastic.co/t/filebeat-not-filtering-for-separate-index/193742)
**Author:** [@lucabes](https://discuss.elastic.co/u/lucabes)\ **Replies:** 9\ **Last updated:** [August 12, 2019, 7:30am UTC](https://discuss.elastic.co/t/filebeat-not-filtering-for-separate-index/193742 "2019-08-12T07:30:55Z")
I have problem with my filebeat configuration, it doesnt filter logs to separate index in elasticsearch. My configuration looks like: logging: level: error metrics: enabled: false filebeat.modules: - module… --- ## [Why is rollover not automatic and field based?](https://discuss.elastic.co/t/why-is-rollover-not-automatic-and-field-based/114807)
**Author:** [@Rahul\_Midha](https://discuss.elastic.co/u/Rahul_Midha)\ **Replies:** 9\ **Last updated:** [January 11, 2018, 2:03pm UTC](https://discuss.elastic.co/t/why-is-rollover-not-automatic-and-field-based/114807 "2018-01-11T14:03:02Z")
Hi, I was just going through a closed issue which is of my interest. Reference link: https://github.com/elastic/elasticsearch/issues/22392 We are actually planning to write some data to Elasticsearch in a time based m… --- ## [Need help in Kibana : not able to open kibana in browser](https://discuss.elastic.co/t/need-help-in-kibana-not-able-to-open-kibana-in-browser/36385)
**Author:** [@Lokesh\_Kumar](https://discuss.elastic.co/u/Lokesh_Kumar)\ **Replies:** 9\ **Last updated:** [December 7, 2015, 2:22pm UTC](https://discuss.elastic.co/t/need-help-in-kibana-not-able-to-open-kibana-in-browser/36385 "2015-12-07T14:22:57Z")
HI, I have installed kibana on my windows system successfully. And created the web site through IIS server when i am trying to open the web site in my browser(google chrome) i am getting below error: HTTP Error 404… --- ## [Shared limit](https://discuss.elastic.co/t/shared-limit/222057)
**Author:** [@Amna\_sayed\_ali](https://discuss.elastic.co/u/Amna_sayed_ali)\ **Replies:** 18\ **Last updated:** [April 3, 2020, 3:33pm UTC](https://discuss.elastic.co/t/shared-limit/222057 "2020-04-03T15:33:24Z")
Hi, i got this error when i tried to add some indices in AWS-ES but this cluster currently has \[1992\]/\[2000\] maximum shards open how can i solve this, if i want to keep that ES creates a delay index for each logs --- ## [Metricbeat Active Directory (AD) performance metrics (perfmon) yaml build](https://discuss.elastic.co/t/metricbeat-active-directory-ad-performance-metrics-perfmon-yaml-build/209687)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 9\ **Last updated:** [December 12, 2019, 5:45pm UTC](https://discuss.elastic.co/t/metricbeat-active-directory-ad-performance-metrics-perfmon-yaml-build/209687 "2019-12-12T17:45:04Z")
I'm looking for a little guidance on how to build out the windows.yml module in Metricbeat. If this is being built out correctly we may need 3-4 lines to ship the Active Directroy perfmon out. The issue that I'm having… --- ## [Elastic cluster went to RED State](https://discuss.elastic.co/t/elastic-cluster-went-to-red-state/143206)
**Author:** [@sivap](https://discuss.elastic.co/u/sivap)\ **Replies:** 10\ **Last updated:** [August 10, 2018, 6:27am UTC](https://discuss.elastic.co/t/elastic-cluster-went-to-red-state/143206 "2018-08-10T06:27:06Z")
Hi Team, I have been running my elk stack in docker. I have activated 30 days free license. Suddenly my elastic cluster went to RED State. JVM Heap & Disk space is good. Please find the error message as below, \[2018… [Previous page](https://discuss.elastic.co/top.md?page=102&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=104&per_page=50&period=all)