# Top **URL:** https://discuss.elastic.co/top.md?page=1044&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1045 --- ## [Winlogbeat - multiple output](https://discuss.elastic.co/t/winlogbeat-multiple-output/248120)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 9:30am UTC](https://discuss.elastic.co/t/winlogbeat-multiple-output/248120 "2020-09-10T09:30:50Z")
Hi, I am wondering if it is possible to have a winlogbeat output to multiple events? So ideally I would like it to ship to my elasticsearch cluster but also output to a file (ideally a flat file) if anyone knows if that… --- ## [Explanation of string interpolation?](https://discuss.elastic.co/t/explanation-of-string-interpolation/126275)
**Author:** [@Shannon\_Carey](https://discuss.elastic.co/u/Shannon_Carey)\ **Replies:** 1\ **Last updated:** [March 30, 2018, 8:00pm UTC](https://discuss.elastic.co/t/explanation-of-string-interpolation/126275 "2018-03-30T20:00:01Z")
I cannot find where in the docs it explains how string interpolation with %{myvar} works... Is there an explanation? I have an "http" output which uses the "mapping" config to control the structure of the output like so… --- ## [Elasticsearch unresponsive with too many users](https://discuss.elastic.co/t/elasticsearch-unresponsive-with-too-many-users/101039)
**Author:** [@dsb](https://discuss.elastic.co/u/dsb)\ **Replies:** 7\ **Last updated:** [September 19, 2017, 6:27pm UTC](https://discuss.elastic.co/t/elasticsearch-unresponsive-with-too-many-users/101039 "2017-09-19T18:27:33Z")
Elastichsearch randomly becomes unresponsive with too many requests ( aprox. 250 requests per second) and I don't have any idea why. Only the "indice" index is being used. Tried increasing the node heap size to no avai… --- ## [Hosting a visualization plugin in an app plugin](https://discuss.elastic.co/t/hosting-a-visualization-plugin-in-an-app-plugin/91267)
**Author:** [@arieltk](https://discuss.elastic.co/u/arieltk)\ **Replies:** 7\ **Last updated:** [July 6, 2017, 7:12am UTC](https://discuss.elastic.co/t/hosting-a-visualization-plugin-in-an-app-plugin/91267 "2017-07-06T07:12:41Z")
Hello all, We would like to develop an app (like timelion) and host in them visualizations, part of them plugin vis that we developed. How can I do this? Some recommendations? Ariel --- ## [JVM crash under load](https://discuss.elastic.co/t/jvm-crash-under-load/14782)
**Author:** [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Replies:** 7\ **Last updated:** [December 12, 2013, 10:25pm UTC](https://discuss.elastic.co/t/jvm-crash-under-load/14782 "2013-12-12T22:25:54Z")
Hi, I am working on a project with elasticsearch version 0.20.2 in a single node configuration. The project runs fine under normal load, however, when we have a large load on the project with a mix of writes and r… --- ## [Substituting Match Phrase Prefix Query with a MUST combination of Match Phrase and Prefix](https://discuss.elastic.co/t/substituting-match-phrase-prefix-query-with-a-must-combination-of-match-phrase-and-prefix/343218)
**Author:** [@aliyanamu](https://discuss.elastic.co/u/aliyanamu)\ **Replies:** 1\ **Last updated:** [September 19, 2023, 12:24pm UTC](https://discuss.elastic.co/t/substituting-match-phrase-prefix-query-with-a-must-combination-of-match-phrase-and-prefix/343218 "2023-09-19T12:24:55Z")
Hi, I am using match phrase prefix for suggestion and querying search result. I'm using this for searching employee name, skill name, etc... basically name / title field which is not long. When I'm searching name like … --- ## [\[Filebeat\] Override Module Ingest Pipeline at Runtime](https://discuss.elastic.co/t/filebeat-override-module-ingest-pipeline-at-runtime/288432)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 6\ **Last updated:** [November 5, 2021, 2:50pm UTC](https://discuss.elastic.co/t/filebeat-override-module-ingest-pipeline-at-runtime/288432 "2021-11-05T14:50:43Z")
TL;DR Can I override the ingest pipeline for a filebeat module at runtime from modules.d/module.yml? The Rest of the Story I use the apache module with filebeat to capture logs on the Apache servers in our environment. … --- ## [\[mTLS\]\[filebeat-logstash\]\[beat-input-plugin\] Client certificate hostname verification](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973)
**Author:** [@LotusD](https://discuss.elastic.co/u/LotusD)\ **Replies:** 6\ **Last updated:** [September 6, 2021, 5:58am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973 "2021-09-06T05:58:31Z")
Dear All, I'm trying to set up mTLS between filebeat (client) and logstash (server). I refer to the documents Secure communication with Logstash | Filebeat Reference \[7.14\] | Elastic Filebeat config: output.logstash… --- ## [IO / Disc intensive load testing](https://discuss.elastic.co/t/io-disc-intensive-load-testing/247722)
**Author:** [@Oleg\_Ruchovets](https://discuss.elastic.co/u/Oleg_Ruchovets)\ **Replies:** 6\ **Last updated:** [September 7, 2020, 9:17am UTC](https://discuss.elastic.co/t/io-disc-intensive-load-testing/247722 "2020-09-07T09:17:29Z")
Hello, My task is to make an elastic search disk/io "hard life" :-). To not reinventing the wheel - is there a tool for simulation high disk load on elastic? what type of query is the most disk/io intensive? I saw ma… --- ## [How do I know which filters apply to many types of logs?](https://discuss.elastic.co/t/how-do-i-know-which-filters-apply-to-many-types-of-logs/144922)
**Author:** [@jeongsyhd](https://discuss.elastic.co/u/jeongsyhd)\ **Replies:** 6\ **Last updated:** [August 21, 2018, 5:22am UTC](https://discuss.elastic.co/t/how-do-i-know-which-filters-apply-to-many-types-of-logs/144922 "2018-08-21T05:22:07Z")
I am currently receiving firewalls and IPSec VPN, WAF, IPS logs. There are four types of logs: Firewall, IPSec VPN, WAF, and IPS. I create an index pattern for each device's log and set it on the grok filter. So how d… --- ## [Did ES ever consider replacing current query DSL with an external DSL?](https://discuss.elastic.co/t/did-es-ever-consider-replacing-current-query-dsl-with-an-external-dsl/14956)
**Author:** [@xin\_zhang](https://discuss.elastic.co/u/xin_zhang)\ **Replies:** 6\ **Last updated:** [November 11, 2016, 5:51am UTC](https://discuss.elastic.co/t/did-es-ever-consider-replacing-current-query-dsl-with-an-external-dsl/14956 "2016-11-11T05:51:37Z")
I used ES for one year I like all features it provides except the query DSL. The json style DSL is not intuitive and was confused me for a while when I was putting multiple conditions together at very beginning. e… --- ## [Parsing timestamp from file and put in @timestamp](https://discuss.elastic.co/t/parsing-timestamp-from-file-and-put-in-timestamp/62788)
**Author:** [@Artyom\_Davydov](https://discuss.elastic.co/u/Artyom_Davydov)\ **Replies:** 6\ **Last updated:** [October 12, 2016, 11:49am UTC](https://discuss.elastic.co/t/parsing-timestamp-from-file-and-put-in-timestamp/62788 "2016-10-12T11:49:07Z")
Hi all. I use folowing scheme to collect logs: filebeat -\> logstash -\> graylog So i have problem with parsing date and put it to the @timestamp example of log: 20161012T082829Z|urn:oasis:names:tc:SAML:2.0:bindings:H… --- ## [Logstash HTTP plugin details](https://discuss.elastic.co/t/logstash-http-plugin-details/93439)
**Author:** [@Bob04](https://discuss.elastic.co/u/Bob04)\ **Replies:** 5\ **Last updated:** [July 18, 2017, 6:25pm UTC](https://discuss.elastic.co/t/logstash-http-plugin-details/93439 "2017-07-18T18:25:34Z")
I have a question about Logstash http input plugin: What is the format of URL for sending POST request to Logstash so Logstash can receive JSON message via http plugin? Is it something like this: server\_name:tcp\_port… --- ## [Elastic Agent/Fleet Limit how many agents get a policy update at once](https://discuss.elastic.co/t/elastic-agent-fleet-limit-how-many-agents-get-a-policy-update-at-once/292175)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 6:14pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-limit-how-many-agents-get-a-policy-update-at-once/292175 "2021-12-16T18:14:12Z")
Hi All, I was wondering if there is a way to limit the number of agents that can pull an updated policy at once? The reason for this, is I have noticed that in large deployments where I perform a policy update (i.e.: a… --- ## [Alerts an Action 7.12 not working](https://discuss.elastic.co/t/alerts-an-action-7-12-not-working/271806)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 8:16pm UTC](https://discuss.elastic.co/t/alerts-an-action-7-12-not-working/271806 "2021-05-10T20:16:23Z")
Hi, I have create some alerts for ML jobs, and is not sending mails, I have tested the send email action and it works, I have set the alerts to the lowest level of anomaly score, both bucket and record (on separated aler… --- ## [How do you use the ExampleWhitelistExtension in Terms Aggregations](https://discuss.elastic.co/t/how-do-you-use-the-examplewhitelistextension-in-terms-aggregations/120551)
**Author:** [@byoungb](https://discuss.elastic.co/u/byoungb)\ **Replies:** 4\ **Last updated:** [February 22, 2018, 2:11pm UTC](https://discuss.elastic.co/t/how-do-you-use-the-examplewhitelistextension-in-terms-aggregations/120551 "2018-02-22T14:11:55Z")
I am trying to whitelist some additional Java functions in painless. I am using the ExampleWhitelistExtension as example. I compiled it and installed it on to my elasticsearch server. \[byoungb@sawmill ~\]$ curl "http://… --- ## [Extract IP from multiple lines](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910)
**Author:** [@dvi\_469](https://discuss.elastic.co/u/dvi_469)\ **Replies:** 4\ **Last updated:** [February 7, 2018, 9:15pm UTC](https://discuss.elastic.co/t/extract-ip-from-multiple-lines/118910 "2018-02-07T21:15:28Z")
Using ELK 5.6 Filebeat ships a log to Logstash that looks like this: 1.1.1.1 2.2.2.2 3.3.3.3 etc. What would be the best way to extract each IP address and put it into its own field, like peer1, peer2, peer3, etc..… --- ## [Filebeat data loss with file rotation and elasticsearch not reachable](https://discuss.elastic.co/t/filebeat-data-loss-with-file-rotation-and-elasticsearch-not-reachable/104238)
**Author:** [@an.secure](https://discuss.elastic.co/u/an.secure)\ **Replies:** 4\ **Last updated:** [October 18, 2017, 9:33am UTC](https://discuss.elastic.co/t/filebeat-data-loss-with-file-rotation-and-elasticsearch-not-reachable/104238 "2017-10-18T09:33:10Z")
I am seeing loss of data in below scenario : filebeat is sending data to elasticsearch from a json file elasticsearch is down multiple ( say 5 ) files are created during this time due to file rotation policy. files are… --- ## [Way to re-index failed documents using BulkProcessor](https://discuss.elastic.co/t/way-to-re-index-failed-documents-using-bulkprocessor/33736)
**Author:** [@kpkvarma](https://discuss.elastic.co/u/kpkvarma)\ **Replies:** 4\ **Last updated:** [November 5, 2015, 8:29am UTC](https://discuss.elastic.co/t/way-to-re-index-failed-documents-using-bulkprocessor/33736 "2015-11-05T08:29:33Z")
We are developing a application, where we ingest and bulk index time-series data using native JAVA client. Here each and every document/event is very important to us, we can't miss single event. As we are using BulkPro… --- ## [After changing port I cannot start another Node on the same Machine?](https://discuss.elastic.co/t/after-changing-port-i-cannot-start-another-node-on-the-same-machine/2680)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 4\ **Last updated:** [June 15, 2015, 3:48pm UTC](https://discuss.elastic.co/t/after-changing-port-i-cannot-start-another-node-on-the-same-machine/2680 "2015-06-15T15:48:08Z")
Hi Experts, My requirement is to change the default ES port 9200 to 1000. I changed it in elasticsearch.yml under "http.port: 1000". Now when I start another node on the same machine I got an error BindHttpException… --- ## [How to switch from file storage to memory storage?](https://discuss.elastic.co/t/how-to-switch-from-file-storage-to-memory-storage/3263)
**Author:** [@ppearcy](https://discuss.elastic.co/u/ppearcy)\ **Replies:** 4\ **Last updated:** [August 27, 2010, 10:32am UTC](https://discuss.elastic.co/t/how-to-switch-from-file-storage-to-memory-storage/3263 "2010-08-27T10:32:24Z")
I wanted to run some performance tests against in memory indexes using the index module store. I set up my elasticsearch.yaml file similar to what is in this thread: http://elasticsearch-users.115913.n3.nabble.com/Out… --- ## [Removing transient settings from cluster](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [May 17, 2022, 3:16pm UTC](https://discuss.elastic.co/t/removing-transient-settings-from-cluster/304958 "2022-05-17T15:16:24Z")
Hello, I've set the following settings into my cluster for a temporatry moment: PUT \_cluster/settings { "transient": { "cluster.routing.allocation.disk.watermark.low": "90%", "cluster.routing.allocation.d… --- ## [Netflow and Filebeat - Error running harvester: listen udp 0.0.0.0:2055: bind: address already in use](https://discuss.elastic.co/t/netflow-and-filebeat-error-running-harvester-listen-udp-0-0-0-0-bind-address-already-in-use/219498)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 1:11pm UTC](https://discuss.elastic.co/t/netflow-and-filebeat-error-running-harvester-listen-udp-0-0-0-0-bind-address-already-in-use/219498 "2020-02-18T13:11:13Z")
I'm trying to configure the netflow module with Filebeat but getting an error about the local address already in use. In my config, if I change the netflow\_host to localhost instead of 0.0.0.0 then the error says 127.0.0… --- ## [Integration tests fail with java.security.AccessControlException](https://discuss.elastic.co/t/integration-tests-fail-with-java-security-accesscontrolexception/69979)
**Author:** [@jvj](https://discuss.elastic.co/u/jvj)\ **Replies:** 1\ **Last updated:** [December 26, 2016, 8:39am UTC](https://discuss.elastic.co/t/integration-tests-fail-with-java-security-accesscontrolexception/69979 "2016-12-26T08:39:36Z")
I'm trying to run integration tests with Elasticsearch 5 by extending ESIntegTestCase in my class. However, it always fails with java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "setDefa… --- ## [Kibanaのマルチテナント運用におけるユーザ管理について](https://discuss.elastic.co/t/kibana/296353)
**Author:** [@Yuji1](https://discuss.elastic.co/u/Yuji1)\ **Replies:** 2\ **Last updated:** [February 9, 2022, 3:06am UTC](https://discuss.elastic.co/t/kibana/296353 "2022-02-09T03:06:45Z")
Kibana 7.16.2でダッシュボード機能をマルチテナント化し、組織内に展開しようと考えています。 下記サイトを参考にし、ユーザ毎に利用できる情報を制御することでマルチテナント運用を実現したいと考えています。 https://acro-engineer.hatenablog.com/entry/2018/04/12/120000 ここで課題となっているのがユーザ管理についてです。 組織A、組織Bに対してそれぞれAdminの… --- ## [How to modify data table column values in Kibana](https://discuss.elastic.co/t/how-to-modify-data-table-column-values-in-kibana/248989)
**Author:** [@geekganesh](https://discuss.elastic.co/u/geekganesh)\ **Replies:** 2\ **Last updated:** [September 17, 2020, 11:26pm UTC](https://discuss.elastic.co/t/how-to-modify-data-table-column-values-in-kibana/248989 "2020-09-17T23:26:13Z")
In Elastic search we store events, I have built data table which aggregates based on event types. I have filter which checks for event.keyword : "job-completed". I am getting the count as 1 or 0 but i want to display as … --- ## [Possible memory leak in elasticsearch 6.2.4](https://discuss.elastic.co/t/possible-memory-leak-in-elasticsearch-6-2-4/212988)
**Author:** [@imperio-wxm](https://discuss.elastic.co/u/imperio-wxm)\ **Replies:** 2\ **Last updated:** [December 26, 2019, 7:23am UTC](https://discuss.elastic.co/t/possible-memory-leak-in-elasticsearch-6-2-4/212988 "2019-12-26T07:23:46Z")
I have a cluster for 3 nodes. index number：2816 shards： 24893 docs： 1240277375 disk use: 477G // jvm ops -Xms8g -Xmx8g ## GC configuration -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSIn… --- ## [Duplicate \_id docs and docs with multiple \_id values - how is this possible?](https://discuss.elastic.co/t/duplicate-id-docs-and-docs-with-multiple-id-values-how-is-this-possible/170848)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [March 6, 2019, 8:12am UTC](https://discuss.elastic.co/t/duplicate-id-docs-and-docs-with-multiple-id-values-how-is-this-possible/170848 "2019-03-06T08:12:52Z")
We have generated an \_id field which we set in our elasticsearch output so that, in case we ever load the same log twice, we don't get duplicate events. However, we are now seeing lots of duplicate \_id fields (see below… --- ## [Elasticsearch failed on start when Path.data change in elasticsearch.yml](https://discuss.elastic.co/t/elasticsearch-failed-on-start-when-path-data-change-in-elasticsearch-yml/89581)
**Author:** [@Sameer\_Sharma](https://discuss.elastic.co/u/Sameer_Sharma)\ **Replies:** 2\ **Last updated:** [June 19, 2017, 10:02am UTC](https://discuss.elastic.co/t/elasticsearch-failed-on-start-when-path-data-change-in-elasticsearch-yml/89581 "2017-06-19T10:02:03Z")
I setup the elasticsearch 5.2.2 on ubuntu machine and its works fine until i uncomment the "path.data: /elasticstack/elasticsearch/data" setting in elasticsearch.yml . --- ## [Group by not working for more than 1 word which contains space in between](https://discuss.elastic.co/t/group-by-not-working-for-more-than-1-word-which-contains-space-in-between/45744)
**Author:** [@Aravinthan\_Asokan](https://discuss.elastic.co/u/Aravinthan_Asokan)\ **Replies:** 2\ **Last updated:** [March 31, 2016, 10:57am UTC](https://discuss.elastic.co/t/group-by-not-working-for-more-than-1-word-which-contains-space-in-between/45744 "2016-03-31T10:57:49Z")
Hi I have be working for more than 3 days in this and tried many forums to fix this but still not possible. Also I am new to Elasticsearch as this is our first project to implement. For me Create New Index and Get the… --- ## [Rebalancing data between disks](https://discuss.elastic.co/t/rebalancing-data-between-disks/327927)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [March 17, 2023, 12:13pm UTC](https://discuss.elastic.co/t/rebalancing-data-between-disks/327927 "2023-03-17T12:13:49Z")
Hi Can You give some tips how I can trigger rebalance for equal distribution of data depending on the size of the disk node shards disk.indices disk.used disk.avail disk.total disk.percent es\_data\_hdd\_1\_2 … --- ## [How to create custom message info for monitors in Elastic?](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456)
**Author:** [@Maddyle0](https://discuss.elastic.co/u/Maddyle0)\ **Replies:** 3\ **Last updated:** [October 22, 2021, 8:46am UTC](https://discuss.elastic.co/t/how-to-create-custom-message-info-for-monitors-in-elastic/283456 "2021-10-22T08:46:31Z")
Hello, I'm new to Elastic, I have configured the Email alerts for port violation monitor, but I getting emails with default Messages info, not Specific details about the alert. How can I edit the default template and add… --- ## [Difference between using (in the Field Metric) Count and Unique Count](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173)
**Author:** [@rosammb](https://discuss.elastic.co/u/rosammb)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 7:55pm UTC](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173 "2021-07-20T19:55:03Z")
Hi, I'm using 6.8.3 Elastic version. I'm having problems when I create visualizes and using the Field Metric. If I use Unique count the result is different than if I use count. My feeling is that Unique count is the co… --- ## [How to fix this date range](https://discuss.elastic.co/t/how-to-fix-this-date-range/243065)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 3\ **Last updated:** [July 29, 2020, 3:42pm UTC](https://discuss.elastic.co/t/how-to-fix-this-date-range/243065 "2020-07-29T15:42:58Z")
Hi, Here is sample code from the documentation: GET /\_search { "query": { "range": { "timestamp": { "gte": "now-1d/d", "lt": "now/d" } } } } I want to change it so that now only… --- ## [Analysis logstash jvm Tuning and Profiling Logstash Performance question](https://discuss.elastic.co/t/analysis-logstash-jvm-tuning-and-profiling-logstash-performance-question/132013)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 3\ **Last updated:** [May 17, 2018, 12:07pm UTC](https://discuss.elastic.co/t/analysis-logstash-jvm-tuning-and-profiling-logstash-performance-question/132013 "2018-05-17T12:07:41Z")
i test a logstash instance with the visualVM at: https://www.elastic.co/guide/en/logstash/current/tuning-logstash.html#profiling-the-heap cmd is as ./logstash -b 50000 -u 1 -w 16 -f xxx.conf why the JVM use not like a … --- ## [Date filter not doing what it said it did](https://discuss.elastic.co/t/date-filter-not-doing-what-it-said-it-did/68526)
**Author:** [@todd-bowles-console](https://discuss.elastic.co/u/todd-bowles-console)\ **Replies:** 3\ **Last updated:** [December 13, 2016, 6:14am UTC](https://discuss.elastic.co/t/date-filter-not-doing-what-it-said-it-did/68526 "2016-12-13T06:14:43Z")
I have a particularly ruinous issue that is causing a me a lot of confusion. I have a number of logstash instances that pull out of Redis and insert into Elasticsearch as part of a greater ELK system. Some events sto… --- ## [Specify es.query condition in HIVE SQL query?](https://discuss.elastic.co/t/specify-es-query-condition-in-hive-sql-query/47178)
**Author:** [@andrewwwooster](https://discuss.elastic.co/u/andrewwwooster)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 4:06pm UTC](https://discuss.elastic.co/t/specify-es-query-condition-in-hive-sql-query/47178 "2016-04-13T16:06:37Z")
Is it possible to pass the es.query parameter as part of a HIVE SQL query? I currently specify the es.query query string as table property when I define an external table DDL: CREATE EXTERNAL TABLE doc ( url … --- ## [Cluster health](https://discuss.elastic.co/t/cluster-health/26801)
**Author:** [@oussama](https://discuss.elastic.co/u/oussama)\ **Replies:** 3\ **Last updated:** [August 4, 2015, 2:31pm UTC](https://discuss.elastic.co/t/cluster-health/26801 "2015-08-04T14:31:34Z")
Hi, Am new in elasticsearch, i have a probleme with the health of cluster and indice, the health of py cluster is yellow curl 'ELK:9200/\_cat/health?v' epoch timestamp cluster status node.total node.data sha… --- ## [Connection refused with Python connection in Docker](https://discuss.elastic.co/t/connection-refused-with-python-connection-in-docker/316365)
**Author:** [@kgeographer](https://discuss.elastic.co/u/kgeographer)\ **Replies:** 1\ **Last updated:** [October 19, 2022, 11:40am UTC](https://discuss.elastic.co/t/connection-refused-with-python-connection-in-docker/316365 "2022-10-19T11:40:23Z")
Trying to install Elasticsearch and Kibana 8.4.3 Docker containers on a development laptop, and run elasticsearch-py commands from an app in another running container. And I'm stuck. I have the ES8 and Kibana containers… --- ## [How to improve my GeoPoint ElasticSearch Index for better response time?](https://discuss.elastic.co/t/how-to-improve-my-geopoint-elasticsearch-index-for-better-response-time/241353)
**Author:** [@zoomash](https://discuss.elastic.co/u/zoomash)\ **Replies:** 7\ **Last updated:** [July 16, 2020, 8:29am UTC](https://discuss.elastic.co/t/how-to-improve-my-geopoint-elasticsearch-index-for-better-response-time/241353 "2020-07-16T08:29:50Z")
Below is my Index (tz\_geo) and mapping details: Index setting: { "index.blocks.read\_only\_allow\_delete": "false", "index.priority": "1", "index.query.default\_field": \[ "\*" \], "index.write.wait\_for\_active\_s… --- ## [Are counts generally exact or approximate?](https://discuss.elastic.co/t/are-counts-generally-exact-or-approximate/135069)
**Author:** [@andrew\_rueckert](https://discuss.elastic.co/u/andrew_rueckert)\ **Replies:** 1\ **Last updated:** [June 18, 2018, 6:12pm UTC](https://discuss.elastic.co/t/are-counts-generally-exact-or-approximate/135069 "2018-06-18T18:12:47Z")
I know that cardinality values and terms aggregation counts are approximate, because it's mentioned in the documentation. Should I assume that if a value is not explicitly called out as being an approximation, that it is… --- ## [Python: ES DSL: How to define custom DocType properly](https://discuss.elastic.co/t/python-es-dsl-how-to-define-custom-doctype-properly/94411)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [July 25, 2017, 9:37am UTC](https://discuss.elastic.co/t/python-es-dsl-how-to-define-custom-doctype-properly/94411 "2017-07-25T09:37:23Z")
I am trying to define custom DocType in Python using the ElasticSearch DSL library but am having some trouble, specifically with Nested classes. In the example below, both the fields author and mentions have the same typ… --- ## [Set different src folder](https://discuss.elastic.co/t/set-different-src-folder/26745)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 7\ **Last updated:** [August 5, 2015, 8:58pm UTC](https://discuss.elastic.co/t/set-different-src-folder/26745 "2015-08-05T20:58:35Z")
Hi, We have Kibana 4 installed in read-only environment. And we would like to modify the src files. So we want to copy the src in different location and modify. But can we set this new location in configuration for Kib… --- ## [Regexp query case-insensitive flag](https://discuss.elastic.co/t/regexp-query-case-insensitive-flag/16216)
**Author:** [@Guoxing\_Li](https://discuss.elastic.co/u/Guoxing_Li)\ **Replies:** 1\ **Last updated:** [March 7, 2014, 1:14pm UTC](https://discuss.elastic.co/t/regexp-query-case-insensitive-flag/16216 "2014-03-07T13:14:31Z")
Hi there! I have a question regarding regexp query. Is there any way to enable case-insensitive flag when doing regexp query? I didn't find any way to specify that. Also, not in regex filter, or the regex functionali… --- ## [Commit / Rollback support](https://discuss.elastic.co/t/commit-rollback-support/6804)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 1\ **Last updated:** [February 26, 2012, 7:34pm UTC](https://discuss.elastic.co/t/commit-rollback-support/6804 "2012-02-26T19:34:30Z")
Heya, Is it planned (or best, is it already exist) to have a support for transactions in ES ? What I would like to achieve is to make my ES insert/update be part of a transaction. Something… --- ## [How can I stop elasticsearch and kibana to check for upgrade?](https://discuss.elastic.co/t/how-can-i-stop-elasticsearch-and-kibana-to-check-for-upgrade/174091)
**Author:** [@subhas](https://discuss.elastic.co/u/subhas)\ **Replies:** 2\ **Last updated:** [April 1, 2019, 10:44am UTC](https://discuss.elastic.co/t/how-can-i-stop-elasticsearch-and-kibana-to-check-for-upgrade/174091 "2019-04-01T10:44:59Z")
Downtime happens everytime when there is a new release. Kibana would stop working or elasticsearch plugins would require upgrade and unable to start elasticsearch etc. How can we stop all the automatic upgrade process an… --- ## [Filebeat only reporting on last prospector](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [February 9, 2016, 4:46am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237 "2016-02-09T04:46:51Z")
Hey guys, I'm trying to recreate my lumberjack configuration in filebeats. My lumberjack configuration had been working great for me for a number of years! But I like the convenience of notating things in yaml way bet… --- ## [How to specify where to find elasticsearch.yml for TransportClient?](https://discuss.elastic.co/t/how-to-specify-where-to-find-elasticsearch-yml-for-transportclient/2245)
**Author:** [@tbessie](https://discuss.elastic.co/u/tbessie)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 6:06pm UTC](https://discuss.elastic.co/t/how-to-specify-where-to-find-elasticsearch-yml-for-transportclient/2245 "2015-06-11T18:06:20Z")
I want to specify where TransportClient can find elasticsearch.yml - from what I can see, the documentation on Java clients doesn't talk much about it, except to say: You can define cluster.name in the /src/main/resour… --- ## [Need help updating syslog conf and grok filter](https://discuss.elastic.co/t/need-help-updating-syslog-conf-and-grok-filter/168702)
**Author:** [@johnnyd](https://discuss.elastic.co/u/johnnyd)\ **Replies:** 5\ **Last updated:** [February 16, 2019, 10:00pm UTC](https://discuss.elastic.co/t/need-help-updating-syslog-conf-and-grok-filter/168702 "2019-02-16T22:00:55Z")
I am setting up my first ELK server. My first goal is to ingest firewall syslogs from a Mikrotik router. Second is to add other syslog sources. I have gotten to a part where I am stuck and am going in circles. I have … --- ## [Why filebeat is SOOO slow in reading files (from SSD): only got 27MBPs when output to /dev/null console?](https://discuss.elastic.co/t/why-filebeat-is-sooo-slow-in-reading-files-from-ssd-only-got-27mbps-when-output-to-dev-null-console/196401)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 2\ **Last updated:** [August 26, 2019, 6:02pm UTC](https://discuss.elastic.co/t/why-filebeat-is-sooo-slow-in-reading-files-from-ssd-only-got-27mbps-when-output-to-dev-null-console/196401 "2019-08-26T18:02:12Z")
Hello, As comparison, a simple single threaded program can read at 3GBps+ on the same machine. However, when we allocate 7 cores to filebeat, the maximum throughput i got from filebeat is only about 27MBps. allocating… [Previous page](https://discuss.elastic.co/top.md?page=1043&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1045&per_page=50&period=all)