# Top **URL:** https://discuss.elastic.co/top.md?page=1037&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1038 --- ## [Need help with jq aggregation filter](https://discuss.elastic.co/t/need-help-with-jq-aggregation-filter/223240)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 10:32am UTC](https://discuss.elastic.co/t/need-help-with-jq-aggregation-filter/223240 "2020-03-12T10:32:10Z")
Hi Folks, I understand this might be off-topic but need help on using jq with my bash script for extracting IP addresses. Somehow my filter is not working hence needed your help. I am extracting src\_ip for last 24 hours… --- ## [Install APM node.js agent in Docker container using yarn](https://discuss.elastic.co/t/install-apm-node-js-agent-in-docker-container-using-yarn/177392)
**Author:** [@Joseph\_Gange](https://discuss.elastic.co/u/Joseph_Gange)\ **Replies:** 2\ **Last updated:** [May 1, 2019, 4:33pm UTC](https://discuss.elastic.co/t/install-apm-node-js-agent-in-docker-container-using-yarn/177392 "2019-05-01T16:33:01Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version:6.5.1 … --- ## [Doc.deleted keeps increasing while indexing](https://discuss.elastic.co/t/doc-deleted-keeps-increasing-while-indexing/68725)
**Author:** [@mdsrosa](https://discuss.elastic.co/u/mdsrosa)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 12:01am UTC](https://discuss.elastic.co/t/doc-deleted-keeps-increasing-while-indexing/68725 "2016-12-13T00:01:02Z")
Hi guys, I'm trying to index 24mi items into ES and I noticed that the number of doc.deleted started to increase after reaching 1mi even though I'm not doing any update/delete calls. I'm using the Bulk API for Python … --- ## [How can i push the tomcat logs into elasticsearch it is showing grokparsefailure](https://discuss.elastic.co/t/how-can-i-push-the-tomcat-logs-into-elasticsearch-it-is-showing-grokparsefailure/37764)
**Author:** [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 6:27am UTC](https://discuss.elastic.co/t/how-can-i-push-the-tomcat-logs-into-elasticsearch-it-is-showing-grokparsefailure/37764 "2015-12-23T06:27:55Z")
input { file { path =\> "E:\\wo\\examples\\xxxxxx.log.2015-12-19.log" start\_position =\> "beginning" sincedb\_path =\> "C:\\Users\\Akash katakam\\null" } } filter { grok { match =\> { "message" =\>… --- ## [Elastic Agent configuration for creating new index based on kubernetes namespace](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 4\ **Last updated:** [September 22, 2022, 1:57pm UTC](https://discuss.elastic.co/t/elastic-agent-configuration-for-creating-new-index-based-on-kubernetes-namespace/314886 "2022-09-22T13:57:22Z")
Hi In filebeat configuration, I could use the following config to create a separate index per kubernetes namespace. output.elasticsearch: indices: - index: '%{\[kubernetes.namespace\]}-%{\[agent.version\]… --- ## [Document dollar-sign interpolation of configuration settings in config file](https://discuss.elastic.co/t/document-dollar-sign-interpolation-of-configuration-settings-in-config-file/152110)
**Author:** [@AdamGardner](https://discuss.elastic.co/u/AdamGardner)\ **Replies:** 4\ **Last updated:** [October 15, 2018, 8:02pm UTC](https://discuss.elastic.co/t/document-dollar-sign-interpolation-of-configuration-settings-in-config-file/152110 "2018-10-15T20:02:46Z")
So, most interpolation you want to do in a filebeat config file is done with a percent sign and curly brackets, %{like.this}. However, you can also interpolate environment variables with a dollar sign, ${LIKE\_THIS}. I've… --- ## [Marvel behind Nginx](https://discuss.elastic.co/t/marvel-behind-nginx/59246)
**Author:** [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Replies:** 4\ **Last updated:** [August 30, 2016, 3:58pm UTC](https://discuss.elastic.co/t/marvel-behind-nginx/59246 "2016-08-30T15:58:20Z")
Hello, I am getting following error when try to access Marvel through Nginx proxy pass: Marvel: Error 404 Not Found: undefined Well I am using latest versions of all. My Nginx configuration is as follow: locati… --- ## [Logstash grok filter thinks we are still in 2015](https://discuss.elastic.co/t/logstash-grok-filter-thinks-we-are-still-in-2015/38731)
**Author:** [@achechen](https://discuss.elastic.co/u/achechen)\ **Replies:** 4\ **Last updated:** [January 8, 2016, 2:51pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-thinks-we-are-still-in-2015/38731 "2016-01-08T14:51:57Z")
Hello there, weird problem. I have the following config, which worked in 2015: input { tcp { port =\> 5000 type =\> syslog } udp { port =\> 5000 type =\> syslog } udp { port =\> 122… --- ## [The exact matching result not coming in the top](https://discuss.elastic.co/t/the-exact-matching-result-not-coming-in-the-top/114025)
**Author:** [@aavrug](https://discuss.elastic.co/u/aavrug)\ **Replies:** 3\ **Last updated:** [February 1, 2018, 7:33am UTC](https://discuss.elastic.co/t/the-exact-matching-result-not-coming-in-the-top/114025 "2018-02-01T07:33:46Z")
This is the what I am trying with but I am getting Angular Js in the last and Js in the first. I want to give priority to Angular Js then Angular and so on. I also implemented the order. { "sort": \[ { "thres… --- ## [Transforming an existing variable and creating a useable new one in Kibana](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734)
**Author:** [@Hicham\_Mouddi](https://discuss.elastic.co/u/Hicham_Mouddi)\ **Replies:** 1\ **Last updated:** [January 18, 2017, 8:20pm UTC](https://discuss.elastic.co/t/transforming-an-existing-variable-and-creating-a-useable-new-one-in-kibana/71734 "2017-01-18T20:20:55Z")
Hello, I would like to create a visualisation on Kibana that aggregate documents by a specific field. However the existing field (lets call it interaction\_name) is built as follow : Name\_Interaction | Number I w… --- ## [Logstash is escaping message!](https://discuss.elastic.co/t/logstash-is-escaping-message/51640)
**Author:** [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 7:10am UTC](https://discuss.elastic.co/t/logstash-is-escaping-message/51640 "2016-06-02T07:10:50Z")
Can I have access to the raw message before filters? My message is full with "\\x22". The easy way to deal with it is to use ruby and unpack the string, but... Logstash escape everything an put another backslash in front … --- ## [Marvel 2.0 free?](https://discuss.elastic.co/t/marvel-2-0-free/33189)
**Author:** [@davmrtl](https://discuss.elastic.co/u/davmrtl)\ **Replies:** 1\ **Last updated:** [October 28, 2015, 9:09pm UTC](https://discuss.elastic.co/t/marvel-2-0-free/33189 "2015-10-28T21:09:31Z")
Hi, I've just installed Marvel 2.0 but it says that this is a trial version. As shown on the following post, it show be free now on?? https://www.elastic.co/blog/elasticsearch-2-0-0-released Thanks, David --- ## [Using Shield and getting NotSslRecordException in cluster logs](https://discuss.elastic.co/t/using-shield-and-getting-notsslrecordexception-in-cluster-logs/101)
**Author:** [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Replies:** 0\ **Last updated:** [May 1, 2015, 11:15am UTC](https://discuss.elastic.co/t/using-shield-and-getting-notsslrecordexception-in-cluster-logs/101 "2015-05-01T11:15:51Z")
QUESTION I have installed Shield in my Elasticsearch cluster, and configured both Transport and HTTP protocol to use SSL. Everything appears to be working ok, but I am getting these exceptions in the elasticsearch log… --- ## [How can I monitor the queue of Filebeat](https://discuss.elastic.co/t/how-can-i-monitor-the-queue-of-filebeat/271750)
**Author:** [@Ben\_Tang](https://discuss.elastic.co/u/Ben_Tang)\ **Replies:** 2\ **Last updated:** [May 2, 2021, 11:50pm UTC](https://discuss.elastic.co/t/how-can-i-monitor-the-queue-of-filebeat/271750 "2021-05-02T23:50:08Z")
I'm currently using the default setting for filebeat, and also sends the monitoring data to an Elasticsearch cluster. My workflow for logs is Filebeat -\> Logstash -\> Elasticsearch Just wondering how can we monitor the … --- ## [Unstructured Data and Elastic](https://discuss.elastic.co/t/unstructured-data-and-elastic/93620)
**Author:** [@elaair](https://discuss.elastic.co/u/elaair)\ **Replies:** 2\ **Last updated:** [July 21, 2017, 5:54pm UTC](https://discuss.elastic.co/t/unstructured-data-and-elastic/93620 "2017-07-21T17:54:49Z")
I have just started my journey with Elastic Stack. It is really cool so far. I have ELK up, I have created my own filters for named and DHCP using Logstash with GROK, and have started basic visualization with Kibana. My … --- ## [Disappearing data](https://discuss.elastic.co/t/disappearing-data/49414)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 2\ **Last updated:** [May 6, 2016, 6:38pm UTC](https://discuss.elastic.co/t/disappearing-data/49414 "2016-05-06T18:38:56Z")
I have distilled my problem down to something fairly small. I'm sure I'm missing something basic. I am using ES version 2.3.2 and LogStash version 2.3.2. I have a LogStash config that generates a trivial message with one… --- ## [Does the useragent filter produce two apparently identical os fields?](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270)
**Author:** [@LansK](https://discuss.elastic.co/u/LansK)\ **Replies:** 2\ **Last updated:** [August 14, 2015, 1:19pm UTC](https://discuss.elastic.co/t/does-the-useragent-filter-produce-two-apparently-identical-os-fields/27270 "2015-08-14T13:19:56Z")
The useragent filter (https://www.elastic.co/guide/en/logstash/current/plugins-filters-useragent.html), when applied to the user agent that is produced by apache access logs (through the built in COMBINEDAPACHELOG patter… --- ## [Determine if search term is a noun?](https://discuss.elastic.co/t/determine-if-search-term-is-a-noun/19501)
**Author:** [@Eric\_Greene](https://discuss.elastic.co/u/Eric_Greene)\ **Replies:** 2\ **Last updated:** [August 27, 2014, 9:56pm UTC](https://discuss.elastic.co/t/determine-if-search-term-is-a-noun/19501 "2014-08-27T21:56:43Z")
Wondering if there is a way to determine if search terms are nouns. Could some sort of dictionary list be put together and stored, then gives some weight to items in this list? Anyone ever done anything such as t… --- ## [Elasticsearch cluster fails to start](https://discuss.elastic.co/t/elasticsearch-cluster-fails-to-start/259270)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 5\ **Last updated:** [December 29, 2020, 10:25am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-fails-to-start/259270 "2020-12-29T10:25:53Z")
Hi, We use the eck operators to create the Elasticsearch and we create the cluster dynamically when there is a request to create the same. we are using 7.5.0 version and trying to upgrade to 7.9.2 version. So when we t… --- ## [Elasticsearch eat 100% of cpu](https://discuss.elastic.co/t/elasticsearch-eat-100-of-cpu/249076)
**Author:** [@vodka\_pivo](https://discuss.elastic.co/u/vodka_pivo)\ **Replies:** 5\ **Last updated:** [September 22, 2020, 12:02pm UTC](https://discuss.elastic.co/t/elasticsearch-eat-100-of-cpu/249076 "2020-09-22T12:02:12Z")
I have 3 node Elasticsearch cluster (7 verion) on this HW vCPU: 8 RAM 16 ( 8GB HEAP) disk SSD 300gb OS CentOS 7 so totally in my cluster i have 24 vCPU, 48 RAM, and 1,2 TB i have 70 indices (all of indices has 3 primar… --- ## [Backward compatibility from ES 5.6.4 to 5.6.3 for snapshots](https://discuss.elastic.co/t/backward-compatibility-from-es-5-6-4-to-5-6-3-for-snapshots/117017)
**Author:** [@hillel](https://discuss.elastic.co/u/hillel)\ **Replies:** 5\ **Last updated:** [January 29, 2018, 3:20pm UTC](https://discuss.elastic.co/t/backward-compatibility-from-es-5-6-4-to-5-6-3-for-snapshots/117017 "2018-01-29T15:20:26Z")
We have snapshots that were done on an ES cluster running 5.6.4 that we would like to restore in a 5.6.3 cluster. Is this supposed to work? If so, how? We have tried several times without success. Thanks in advance. --- ## [Kibana Not Starting on Windows-7](https://discuss.elastic.co/t/kibana-not-starting-on-windows-7/99552)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 5\ **Last updated:** [September 6, 2017, 5:31pm UTC](https://discuss.elastic.co/t/kibana-not-starting-on-windows-7/99552 "2017-09-06T17:31:23Z")
Hi - Am getting the below error while trying to start the Kibana on Windows-7 servicepack-2. Am running ES with the same version. Could you please let me know to resolve the below issue. Thanks ! \[image\] --- ## [Elasticsearch Index not loaded (ES curator)](https://discuss.elastic.co/t/elasticsearch-index-not-loaded-es-curator/85357)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 5\ **Last updated:** [May 23, 2017, 5:57pm UTC](https://discuss.elastic.co/t/elasticsearch-index-not-loaded-es-curator/85357 "2017-05-23T17:57:26Z")
HEllo Everybody, My elasticsearch instance was not working this morning. It was because the device was without any more space. I have realized I was having a problem with ES curator. python /usr/lib/python2.6/site-pa… --- ## [How to use Limit Token Filter?](https://discuss.elastic.co/t/how-to-use-limit-token-filter/75913)
**Author:** [@mathmatomancer](https://discuss.elastic.co/u/mathmatomancer)\ **Replies:** 5\ **Last updated:** [February 23, 2017, 4:27pm UTC](https://discuss.elastic.co/t/how-to-use-limit-token-filter/75913 "2017-02-23T16:27:44Z")
Hi, I'm trying to use the limit token filter to cap the amount of data stored in elasticsearch from a potentially very large text string in my main database. I have in my settings this filter and analyzer specified: a… --- ## [Store Elasticsearch 2.4.1 snapshots to HDFS](https://discuss.elastic.co/t/store-elasticsearch-2-4-1-snapshots-to-hdfs/65972)
**Author:** [@Ant](https://discuss.elastic.co/u/Ant)\ **Replies:** 5\ **Last updated:** [November 24, 2016, 9:28pm UTC](https://discuss.elastic.co/t/store-elasticsearch-2-4-1-snapshots-to-hdfs/65972 "2016-11-24T21:28:33Z")
Hi, So I've found my definition of definitive and the elastic.io guides definition to be slightly divergent. As such I wondered if anyone here could help me get my backups sorted out? Origionally I tried to get it to… --- ## [Limit search result based on a field](https://discuss.elastic.co/t/limit-search-result-based-on-a-field/154476)
**Author:** [@cweinberger](https://discuss.elastic.co/u/cweinberger)\ **Replies:** 4\ **Last updated:** [October 30, 2018, 6:49am UTC](https://discuss.elastic.co/t/limit-search-result-based-on-a-field/154476 "2018-10-30T06:49:18Z")
Hi there, I have an index full of episodes with this mapping: PUT test\_episodes { "settings": { "index": { "number\_of\_shards": 5, "number\_of\_replicas": 1 } }, "mappings": { "\_doc": { … --- ## [Logstash alert type =\>](https://discuss.elastic.co/t/logstash-alert-type/112898)
**Author:** [@kunam](https://discuss.elastic.co/u/kunam)\ **Replies:** 4\ **Last updated:** [December 26, 2017, 3:14am UTC](https://discuss.elastic.co/t/logstash-alert-type/112898 "2017-12-26T03:14:08Z")
Hi, I'm new to logstash, please bare me and help me in writing this. How to use logstash alert type in logstash config file. I had a log source called allyourbase and alert type should be mapped to "AllYourBase - Audi… --- ## [Logstash can't send logs to ES](https://discuss.elastic.co/t/logstash-cant-send-logs-to-es/95875)
**Author:** [@snah95](https://discuss.elastic.co/u/snah95)\ **Replies:** 4\ **Last updated:** [August 4, 2017, 1:32pm UTC](https://discuss.elastic.co/t/logstash-cant-send-logs-to-es/95875 "2017-08-04T13:32:34Z")
Hello everyone! I have a little problem with my ELK Stack. My Logstash container gathers logs from Filebeat, but it can't pass them to Elasticsearch. I tried many methods described in another topics, but with no success… --- ## [How many actions can one watch have?](https://discuss.elastic.co/t/how-many-actions-can-one-watch-have/34334)
**Author:** [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Replies:** 4\ **Last updated:** [November 11, 2015, 3:21pm UTC](https://discuss.elastic.co/t/how-many-actions-can-one-watch-have/34334 "2015-11-11T15:21:42Z")
Let's say for example that I want to create a watch that watches my system's memory use. If it has only 5% memory left I want to know about this. Now for this watch I plan on adding an action which sends me a message v… --- ## [How to use analyzer from plugin?](https://discuss.elastic.co/t/how-to-use-analyzer-from-plugin/8773)
**Author:** [@Michael\_Radford](https://discuss.elastic.co/u/Michael_Radford)\ **Replies:** 4\ **Last updated:** [August 17, 2012, 9:14pm UTC](https://discuss.elastic.co/t/how-to-use-analyzer-from-plugin/8773 "2012-08-17T21:14:56Z")
I have the Smart Chinese Analysis plugin installed in elasticsearch 0.19.3 (via bin/plugin -install elasticsearch/elasticsearch-analysis-smartcn/1.2.0), and I'm just trying to see the analysis results using command… --- ## [Bootstrapping a new cluster failed with ES7.0](https://discuss.elastic.co/t/bootstrapping-a-new-cluster-failed-with-es7-0/178610)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 7\ **Last updated:** [April 26, 2019, 10:35am UTC](https://discuss.elastic.co/t/bootstrapping-a-new-cluster-failed-with-es7-0/178610 "2019-04-26T10:35:40Z")
I have setdiscovery.seed\_hosts and cluster.initial\_master\_nodes with three master node. ES outputs this message in log: \[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[c3-bigdata-es-master02.bj\] master not discovered y… --- ## [SSD对于es的优势](https://discuss.elastic.co/t/ssd-es/98074)
**Author:** [@Gongruixiao](https://discuss.elastic.co/u/Gongruixiao)\ **Replies:** 1\ **Last updated:** [September 11, 2017, 4:55am UTC](https://discuss.elastic.co/t/ssd-es/98074 "2017-09-11T04:55:40Z")
ES 单节点，5.4.2版本 每秒4万写入量，ssd和普通硬盘的qps无差距，想咨询ssd对于ES的优势体现在哪里 --- ## [Missing bar in vertical bar visualisation](https://discuss.elastic.co/t/missing-bar-in-vertical-bar-visualisation/75763)
**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\ **Replies:** 7\ **Last updated:** [February 20, 2017, 5:38pm UTC](https://discuss.elastic.co/t/missing-bar-in-vertical-bar-visualisation/75763 "2017-02-20T17:38:24Z")
Hi folks. I am trying to create a visualisation based on MetricBeat data, showing memory utilisation by server. The weird thing is that for one of my servers (ca-web06), the bar is blank: Even though the data for thi… --- ## [Logstash send all messages to their log file instead of elasticsearch](https://discuss.elastic.co/t/logstash-send-all-messages-to-their-log-file-instead-of-elasticsearch/36971)
**Author:** [@xandr](https://discuss.elastic.co/u/xandr)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 11:09am UTC](https://discuss.elastic.co/t/logstash-send-all-messages-to-their-log-file-instead-of-elasticsearch/36971 "2015-12-11T11:09:17Z")
Yesterday I upgraded logstash and elasticsearch to the latest version (from 1.x). I have had some problem with it but after fixing all issues it started to work. Today at 2am (at this time server load increase for 5-7min… --- ## [Could not index event to Elasticsearch.Rejecting mapping update to \[\] as the final mapping would have more than 1 type: \[\_doc,syslog\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 2\ **Last updated:** [June 24, 2020, 3:44pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-rejecting-mapping-update-to-as-the-final-mapping-would-have-more-than-1-type-doc-syslog/238326 "2020-06-24T15:44:52Z")
Hello everybody! I get the following error when I try to send syslog data to Elasticsearch Index: \[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :… --- ## [How to use kibana to aggregate(count) based on different user scenarios](https://discuss.elastic.co/t/how-to-use-kibana-to-aggregate-count-based-on-different-user-scenarios/176986)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 2\ **Last updated:** [April 17, 2019, 1:31pm UTC](https://discuss.elastic.co/t/how-to-use-kibana-to-aggregate-count-based-on-different-user-scenarios/176986 "2019-04-17T13:31:33Z")
Hi Team, I have collected some user behavior data in elasticsearch end user did on Web UI. I have hundreds of events in ES and below are the event' fields . userId (which is the login user) actionType (which represe… --- ## [Converting time to milliseconds](https://discuss.elastic.co/t/converting-time-to-milliseconds/135183)
**Author:** [@sandeepnarla22322](https://discuss.elastic.co/u/sandeepnarla22322)\ **Replies:** 2\ **Last updated:** [June 8, 2018, 6:05pm UTC](https://discuss.elastic.co/t/converting-time-to-milliseconds/135183 "2018-06-08T18:05:52Z")
converting 00:00:00.013 in to milliseconds I used to dissect to get values and having trouble calculating the values dissect { mapping =\> { "ExecuteTime" =\> %{hour}:%{minute}:%{second}.%{millisecond}" } } if \[hour… --- ## [Centralized logging with ELK Stack - Sizing question](https://discuss.elastic.co/t/centralized-logging-with-elk-stack-sizing-question/128777)
**Author:** [@rinderbe](https://discuss.elastic.co/u/rinderbe)\ **Replies:** 2\ **Last updated:** [April 20, 2018, 8:02am UTC](https://discuss.elastic.co/t/centralized-logging-with-elk-stack-sizing-question/128777 "2018-04-20T08:02:09Z")
Hi, I am very new to the fantastic world of Elastic and the whole ELK Stack, so sorry for any dumb question that might pop up in this post. I am right now working on a project where we are looking into replacing our ex… --- ## [Virtualization Performance](https://discuss.elastic.co/t/virtualization-performance/121096)
**Author:** [@Cen\_giz](https://discuss.elastic.co/u/Cen_giz)\ **Replies:** 2\ **Last updated:** [March 3, 2018, 11:44am UTC](https://discuss.elastic.co/t/virtualization-performance/121096 "2018-03-03T11:44:49Z")
Dears, We are running Elastic on physical nodes with 24 Core/256 GB RAM - 1 Elastic Instance per machine and CPU utilization is around 10 %. I have virtualized the node with Hypervisor and split the machine into 2 and… --- ## [Winlogbeat - how to change path for where to look for files](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492)
**Author:** [@jeriel20](https://discuss.elastic.co/u/jeriel20)\ **Replies:** 2\ **Last updated:** [November 1, 2016, 12:28am UTC](https://discuss.elastic.co/t/winlogbeat-how-to-change-path-for-where-to-look-for-files/64492 "2016-11-01T00:28:40Z")
Does any one know what configuration if any I can put in the YAML file to specify a location for where my windows event logs reside. I have a folder with archived data that i need winlogbeat to index into elasticsearch..… --- ## [Cant' find an example of how Elastic.Serilog.Sinks works with json configuration file](https://discuss.elastic.co/t/cant-find-an-example-of-how-elastic-serilog-sinks-works-with-json-configuration-file/337078)
**Author:** [@pantonis](https://discuss.elastic.co/u/pantonis)\ **Replies:** 0\ **Last updated:** [June 28, 2023, 12:27pm UTC](https://discuss.elastic.co/t/cant-find-an-example-of-how-elastic-serilog-sinks-works-with-json-configuration-file/337078 "2023-06-28T12:27:48Z")
I cannot find an example of how Elastic.Serilog.Sinks works with a json configuration file. It seems that serilog json configuration file does not work with this library. any example of how a json file looks like would… --- ## [Java RestClient sending gzip update](https://discuss.elastic.co/t/java-restclient-sending-gzip-update/132220)
**Author:** [@surabaya](https://discuss.elastic.co/u/surabaya)\ **Replies:** 0\ **Last updated:** [May 16, 2018, 9:32pm UTC](https://discuss.elastic.co/t/java-restclient-sending-gzip-update/132220 "2018-05-16T21:32:18Z")
Is there a way to send gzipped document update to ES using the low-level Java RestClient? I intend to send a \_bulk update using RestClient this way: restClient.performRequest("POST", "endpoint/\_bulk", emptyMap(), n… --- ## [Protect your data from ransom attacks](https://discuss.elastic.co/t/protect-your-data-from-ransom-attacks/72027)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [January 18, 2017, 2:40pm UTC](https://discuss.elastic.co/t/protect-your-data-from-ransom-attacks/72027 "2017-01-18T14:40:08Z")
I wanted to bring attention to two blog posts we have done recently in response to the recent set of data ransom attacks affecting Elasticsearch and other systems. The two are: For Elasticsearch: Protecting Against A… --- ## [Could not find value with minus](https://discuss.elastic.co/t/could-not-find-value-with-minus/82846)
**Author:** [@rolandgolla](https://discuss.elastic.co/u/rolandgolla)\ **Replies:** 1\ **Last updated:** [April 19, 2017, 9:43am UTC](https://discuss.elastic.co/t/could-not-find-value-with-minus/82846 "2017-04-19T09:43:38Z")
Hi, i try to search GET /myindex/product/\_search { "size": 10000, "query" : { "match" : { "identvalue" : "xy-02-00027" } } } But the result is all items. Then i only search for… --- ## [Daylight saving time impacting only part of the environment](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622)
**Author:** [@phdsantos](https://discuss.elastic.co/u/phdsantos)\ **Replies:** 5\ **Last updated:** [November 8, 2021, 9:03pm UTC](https://discuss.elastic.co/t/daylight-saving-time-impacting-only-part-of-the-environment/288622 "2021-11-08T21:03:14Z")
Hello everyone, we are facing a strange behavior in ELK environment related to daylight saving time; the details are below: Platform: kibana 6.7.2 Logstash 5.3.0 Elasticsearch 6.7.2 Scenario: We have Weblogic domai… --- ## [Mapping of dest index overwritten upon reindexing](https://discuss.elastic.co/t/mapping-of-dest-index-overwritten-upon-reindexing/224291)
**Author:** [@ETspielberg](https://discuss.elastic.co/u/ETspielberg)\ **Replies:** 5\ **Last updated:** [March 20, 2020, 12:42pm UTC](https://discuss.elastic.co/t/mapping-of-dest-index-overwritten-upon-reindexing/224291 "2020-03-20T12:42:59Z")
Hi, I am using elasticsearch 7.6.1 and I have indexed a number of documents with a type, which was generated automatically. For example I have timestamps, which are currently indexed as text. In addition, I need to adju… --- ## [Workplace search loading time problem](https://discuss.elastic.co/t/workplace-search-loading-time-problem/329268)
**Author:** [@Gunbay\_Park](https://discuss.elastic.co/u/Gunbay_Park)\ **Replies:** 8\ **Last updated:** [April 7, 2023, 6:48am UTC](https://discuss.elastic.co/t/workplace-search-loading-time-problem/329268 "2023-04-07T06:48:07Z")
HI, there. I'm testing workplace search in internetless intranet env. When I start workplace search (x.x.x.x:5601/ws/search) , it takes time too long to open first page. it takes almost 90 seconds. After opening fir… --- ## [Elastic 5.6.5 - Force Merge how many segments need to configure](https://discuss.elastic.co/t/elastic-5-6-5-force-merge-how-many-segments-need-to-configure/189293)
**Author:** [@Sathish\_kumar\_Marimu](https://discuss.elastic.co/u/Sathish_kumar_Marimu)\ **Replies:** 8\ **Last updated:** [July 8, 2019, 9:18am UTC](https://discuss.elastic.co/t/elastic-5-6-5-force-merge-how-many-segments-need-to-configure/189293 "2019-07-08T09:18:52Z")
Hi, I have more than 1 billion documents in one index with 1 shard and 2 replica. My use case is to update elastic document frequently, so i have more than six hundred fifty million deleted documents in the index which … --- ## [Automatically delete 1 month old documents(without deleting index) in elastic search](https://discuss.elastic.co/t/automatically-delete-1-month-old-documents-without-deleting-index-in-elastic-search/159844)
**Author:** [@sid\_nikhil](https://discuss.elastic.co/u/sid_nikhil)\ **Replies:** 3\ **Last updated:** [December 7, 2018, 2:16pm UTC](https://discuss.elastic.co/t/automatically-delete-1-month-old-documents-without-deleting-index-in-elastic-search/159844 "2018-12-07T14:16:06Z")
I am new to Elastic Search & I need to delete documents older than 1 month (in all indices) in the elastic search . I know how to delete a single document by id / deleting an index , but not able to figure out how to a… --- ## [Waiting for elected master node to setup local exporter \[default\_local\] (does it have x-pack installed?)](https://discuss.elastic.co/t/waiting-for-elected-master-node-to-setup-local-exporter-default-local-does-it-have-x-pack-installed/146518)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 0\ **Last updated:** [August 29, 2018, 11:22am UTC](https://discuss.elastic.co/t/waiting-for-elected-master-node-to-setup-local-exporter-default-local-does-it-have-x-pack-installed/146518 "2018-08-29T11:22:56Z")
Hi, I have a cluster of two elasticsearch instances. After the update from 6.3.1 to 6.4 the elasticsearch log on one machine is flooded with messages like the following: \[2018-08-29T13:17:01,091\]\[INFO \]\[o.e.x.m.e.l.Lo… [Previous page](https://discuss.elastic.co/top.md?page=1036&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1038&per_page=50&period=all)