# Top **URL:** https://discuss.elastic.co/top.md?page=1053&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1054 --- ## [Elasticsearch 5.0.1 fails to start on AWS with discovery-ec2: BindException\[Cannot assign requested address\]](https://discuss.elastic.co/t/elasticsearch-5-0-1-fails-to-start-on-aws-with-discovery-ec2-bindexception-cannot-assign-requested-address/66524)
**Author:** [@sylrouss](https://discuss.elastic.co/u/sylrouss)\ **Replies:** 2\ **Last updated:** [November 18, 2016, 1:24pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-1-fails-to-start-on-aws-with-discovery-ec2-bindexception-cannot-assign-requested-address/66524 "2016-11-18T13:24:13Z")
Hi friends, With the following elasticsearch.yaml: cluster.name: \*\*\* node.name: ${HOSTNAME} cloud: aws: region: eu-west-1 discovery: type: ec2 network: host: \_ec2 discovery.zen.minimum\_… --- ## [If I search for more than 30days data getting the below error. Please advise where to change the "Search.max\_buckets" value?](https://discuss.elastic.co/t/if-i-search-for-more-than-30days-data-getting-the-below-error-please-advise-where-to-change-the-search-max-buckets-value/304694)
**Author:** [@ARAVINTH](https://discuss.elastic.co/u/ARAVINTH)\ **Replies:** 3\ **Last updated:** [May 16, 2022, 12:26am UTC](https://discuss.elastic.co/t/if-i-search-for-more-than-30days-data-getting-the-below-error-please-advise-where-to-change-the-search-max-buckets-value/304694 "2022-05-16T00:26:02Z")
{ "request": {}, "response": {}, "body": { "statusCode": 503, "error": "Service Unavailable", "message": "search\_phase\_execution\_exception", "attributes": { "error": { "root\_cause": , "type": "search\_phase\_exec… --- ## [Elastic document count mismatch - SQL to ES](https://discuss.elastic.co/t/elastic-document-count-mismatch-sql-to-es/107648)
**Author:** [@RSundareswaran](https://discuss.elastic.co/u/RSundareswaran)\ **Replies:** 3\ **Last updated:** [November 15, 2017, 3:26pm UTC](https://discuss.elastic.co/t/elastic-document-count-mismatch-sql-to-es/107648 "2017-11-15T15:26:14Z")
Hi, I am trying to bulk index from MS-SQL data to ES (5.6.3). The SQL query in SSMS gives 16284 as total count but after getting indexed, Kibana gets the total count as 15768.However the stats in API gets shows both cou… --- ## [How to map a MySQL NestedSet Category Tree?](https://discuss.elastic.co/t/how-to-map-a-mysql-nestedset-category-tree/16996)
**Author:** [@Stefan1](https://discuss.elastic.co/u/Stefan1)\ **Replies:** 3\ **Last updated:** [April 14, 2014, 1:16pm UTC](https://discuss.elastic.co/t/how-to-map-a-mysql-nestedset-category-tree/16996 "2014-04-14T13:16:49Z")
Hello, I have a mysql table with categories in a nested set structure (http://en.wikipedia.org/wiki/Nested\_set\_model). How can I map an entire category tree of an articel with an foreign key of the category tab… --- ## [Select first document in each group](https://discuss.elastic.co/t/select-first-document-in-each-group/13279)
**Author:** [@daniel\_koller](https://discuss.elastic.co/u/daniel_koller)\ **Replies:** 3\ **Last updated:** [August 22, 2013, 4:02pm UTC](https://discuss.elastic.co/t/select-first-document-in-each-group/13279 "2013-08-22T16:02:48Z")
Hi all, is there a "query" where I can get only the first document of a group of documents (e.g. all docs have the same value for field "customer")? in SQL this is something like id | customer | total 1 | Jo… --- ## [AlmaLinux OS 9](https://discuss.elastic.co/t/almalinux-os-9/338910)
**Author:** [@Nirjonadda](https://discuss.elastic.co/u/Nirjonadda)\ **Replies:** 4\ **Last updated:** [July 25, 2023, 8:27pm UTC](https://discuss.elastic.co/t/almalinux-os-9/338910 "2023-07-25T20:27:12Z")
Do you have any plan add support for AlmaLinux OS 9? Can not install Elasticsearch in AlmaLinux OS 9 because RPM signing key is invalid. rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch warning: Signature… --- ## [Elastic can't connect remote cluster](https://discuss.elastic.co/t/elastic-cant-connect-remote-cluster/283003)
**Author:** [@lisiyu](https://discuss.elastic.co/u/lisiyu)\ **Replies:** 4\ **Last updated:** [September 8, 2021, 8:47am UTC](https://discuss.elastic.co/t/elastic-cant-connect-remote-cluster/283003 "2021-09-08T08:47:09Z")
Verison elasticsearch: 7.13.1 cluster-one and cluster-two have same config. apiVersion: apps/v1 kind: StatefulSet metadata: name: elasticsearch labels: app: elasticsearch spec: selector: matchLabels: … --- ## [Filebeat & ingest pipelines](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515)
**Author:** [@StefanoM](https://discuss.elastic.co/u/StefanoM)\ **Replies:** 4\ **Last updated:** [February 19, 2020, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515 "2020-02-19T15:11:59Z")
Hi there, is it correct to say that you only need to load an ingest pipeline (e.g. filebeat setup --pipelines --modules system,nginx,mysql) when you are using elasticsearch ingest node as output? Or do also need to do t… --- ## [Export indexed data using curl](https://discuss.elastic.co/t/export-indexed-data-using-curl/190790)
**Author:** [@vijaykriishna](https://discuss.elastic.co/u/vijaykriishna)\ **Replies:** 4\ **Last updated:** [July 16, 2019, 5:09pm UTC](https://discuss.elastic.co/t/export-indexed-data-using-curl/190790 "2019-07-16T17:09:29Z")
Hi @dadoonet, @all I need to export indexed data from one of index in ES. How do i export it considering it's compatibility with bulk import it after updating mapping of this index ? I need to do this in production e… --- ## [Logstash is not showing me any output even after clearing the .since db file](https://discuss.elastic.co/t/logstash-is-not-showing-me-any-output-even-after-clearing-the-since-db-file/185613)
**Author:** [@deepanshu\_goel](https://discuss.elastic.co/u/deepanshu_goel)\ **Replies:** 4\ **Last updated:** [June 13, 2019, 12:19pm UTC](https://discuss.elastic.co/t/logstash-is-not-showing-me-any-output-even-after-clearing-the-since-db-file/185613 "2019-06-13T12:19:55Z")
configuration file: input { file { path=\>"\\E:\\kibana\\logstash-7.1.1\\logstash-7.1.1\\data\\event-data\\apache\_access.log" type =\> "apache-access" start\_position=\> "beginning" } … --- ## [How to check if a document was successfully insert into elasticsearch](https://discuss.elastic.co/t/how-to-check-if-a-document-was-successfully-insert-into-elasticsearch/100995)
**Author:** [@karim.aloui](https://discuss.elastic.co/u/karim.aloui)\ **Replies:** 4\ **Last updated:** [September 20, 2017, 8:30am UTC](https://discuss.elastic.co/t/how-to-check-if-a-document-was-successfully-insert-into-elasticsearch/100995 "2017-09-20T08:30:07Z")
Hello, I'm using logstash to insert documents into ES, but i want to output in a file duplicated documents that ES failed to insert. Is there a way to check if a document insert into ES was successfull through logstas… --- ## [Why log4j plugin for logstash is deprecated?](https://discuss.elastic.co/t/why-log4j-plugin-for-logstash-is-deprecated/85033)
**Author:** [@iknowabc](https://discuss.elastic.co/u/iknowabc)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 8:24am UTC](https://discuss.elastic.co/t/why-log4j-plugin-for-logstash-is-deprecated/85033 "2017-05-09T08:24:39Z")
Hello, I want to use log4j for my application to write the log via stream mode to logstash by its log4j plugin. But from website below: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html it tell… --- ## [Could not dynamically add mapping for field \[stats.something.else\]. Existing mapping for \[stats.something\] must be of type object but found \[long\]](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919)
**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 2:48pm UTC](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919 "2021-03-31T14:48:44Z")
The problem seems to be that we have both a field called stats.something and another field called stats.something.else. I get the above error when I try to submit the second piece of data. I could replace each dot with … --- ## [Npm ES library - how to do a upsert?](https://discuss.elastic.co/t/npm-es-library-how-to-do-a-upsert/140018)
**Author:** [@Darin\_Hensley](https://discuss.elastic.co/u/Darin_Hensley)\ **Replies:** 1\ **Last updated:** [July 16, 2018, 5:45am UTC](https://discuss.elastic.co/t/npm-es-library-how-to-do-a-upsert/140018 "2018-07-16T05:45:39Z")
Using the ES node library.... how do I do a upsert? After reading documentation, I thought this would work but not having success. My goal is to insert a new document, if it already exists, then update it(or do nothing i… --- ## [Too many open files](https://discuss.elastic.co/t/too-many-open-files/18729)
**Author:** [@Seungjin\_Lee](https://discuss.elastic.co/u/Seungjin_Lee)\ **Replies:** 1\ **Last updated:** [July 18, 2014, 4:46am UTC](https://discuss.elastic.co/t/too-many-open-files/18729 "2014-07-18T04:46:42Z")
hello, I'm using elasticsearch with storm, Java TransportClient. I have total 128 threads across machines which communicate with elasticsearch cluster. From time to time, error below occurs org.elasticsearc… --- ## [Cluster rebalancing across AZs](https://discuss.elastic.co/t/cluster-rebalancing-across-azs/210946)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 5\ **Last updated:** [December 31, 2019, 12:03am UTC](https://discuss.elastic.co/t/cluster-rebalancing-across-azs/210946 "2019-12-31T00:03:40Z")
We have a cluster with 6 warm data nodes per AZ in EC2, for a total of 18 nodes spread in 3 AZs. As they were getting full, we added 1 more node to each AZ, and enabled auto-balancing in the cluster. I expected some of… --- ## [Bulk index request dataloss](https://discuss.elastic.co/t/bulk-index-request-dataloss/23127)
**Author:** [@am87](https://discuss.elastic.co/u/am87)\ **Replies:** 5\ **Last updated:** [April 29, 2015, 10:13am UTC](https://discuss.elastic.co/t/bulk-index-request-dataloss/23127 "2015-04-29T10:13:07Z")
Hey everyone, I've been trying to maximise my indexing rate. I'm indexing around a million documents, using 4 threads. Each thread is indexing at 2500 documents per bulk request, so that's 10000 at a time. I'v… --- ## [Unable to run set-up password after enabling x-pack security on a cluster](https://discuss.elastic.co/t/unable-to-run-set-up-password-after-enabling-x-pack-security-on-a-cluster/231317)
**Author:** [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)\ **Replies:** 6\ **Last updated:** [May 12, 2020, 10:25pm UTC](https://discuss.elastic.co/t/unable-to-run-set-up-password-after-enabling-x-pack-security-on-a-cluster/231317 "2020-05-12T22:25:24Z")
Hello I am using Elasticsearch version 7.6.2. on Ubuntu 18.04. I set up an Elasticsearch cluster with 3 nodes and it works perfectly. When I went back to set up secuirty on the cluster. I started by setting the follow… --- ## [Index created with 10 shards with roll over api when first index created was with 30 shards](https://discuss.elastic.co/t/index-created-with-10-shards-with-roll-over-api-when-first-index-created-was-with-30-shards/96860)
**Author:** [@sgunnala](https://discuss.elastic.co/u/sgunnala)\ **Replies:** 6\ **Last updated:** [August 14, 2017, 3:26pm UTC](https://discuss.elastic.co/t/index-created-with-10-shards-with-roll-over-api-when-first-index-created-was-with-30-shards/96860 "2017-08-14T15:26:07Z")
Elastic Search/Kibana 5.2 and Logstash 5.0.2 with kafka 0.9 We create the first indices 30 shards with logstash\*-000001 and using time/log count and curator with rollover api and Alias to rollover indices. We are getti… --- ## [Add\_tag failing](https://discuss.elastic.co/t/add-tag-failing/46151)
**Author:** [@brain](https://discuss.elastic.co/u/brain)\ **Replies:** 6\ **Last updated:** [April 3, 2016, 7:35am UTC](https://discuss.elastic.co/t/add-tag-failing/46151 "2016-04-03T07:35:21Z")
i have the following in my config file, where i'm using the GeoIPASNum database to add the AS of an IP to its own field (asn\_id.orig\_h.number) if \[id.orig\_h\] { geoip { database =\> "/opt/logstash/vendor/geoip/GeoI… --- ## [Elasticsearch with mongo-connector - ConnectionTimeout](https://discuss.elastic.co/t/elasticsearch-with-mongo-connector-connectiontimeout/40862)
**Author:** [@JuHwon](https://discuss.elastic.co/u/JuHwon)\ **Replies:** 0\ **Last updated:** [February 3, 2016, 11:36am UTC](https://discuss.elastic.co/t/elasticsearch-with-mongo-connector-connectiontimeout/40862 "2016-02-03T11:36:42Z")
Hi I am using mongodb and elasticsearch with the mongo-connector. The problem is that my mongo-connector very often get the following error: 2016-02-03 12:10:31,415 \[WARNING\] elasticsearch:82 - POST http://localhost… --- ## [Can't replace character with Backslash with gsub](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [October 24, 2021, 10:35am UTC](https://discuss.elastic.co/t/cant-replace-character-with-backslash-with-gsub/287501 "2021-10-24T10:35:09Z")
Hi all. I am trying to replace the pound character in a field value with the backslash but am truggling to get it to work. The field looks like this: PoundedUNC =\> "##Network#Share#Name$" and I would like to turn it int… --- ## [Watcher, execute action for individual buckets from aggregation?](https://discuss.elastic.co/t/watcher-execute-action-for-individual-buckets-from-aggregation/138926)
**Author:** [@mitom](https://discuss.elastic.co/u/mitom)\ **Replies:** 2\ **Last updated:** [July 13, 2018, 7:15am UTC](https://discuss.elastic.co/t/watcher-execute-action-for-individual-buckets-from-aggregation/138926 "2018-07-13T07:15:46Z")
Hi, I am wondering if I can somehow make Watcher execute the action part of a watch multiple times. For example, I have a watch that would trigger when any instance is over 80% filesystem usage as reported by metricbeat… --- ## [Math operations](https://discuss.elastic.co/t/math-operations/122596)
**Author:** [@Danilo1](https://discuss.elastic.co/u/Danilo1)\ **Replies:** 2\ **Last updated:** [March 8, 2018, 5:46pm UTC](https://discuss.elastic.co/t/math-operations/122596 "2018-03-08T17:46:58Z")
Hi, Is it possible to use one field aggregation in another field aggregation script? I was looking for something like this (sum(quantity) / count(unique)) \* 60 --- ## [Cannot create data tables in Vega plugin for Kibana v6.2](https://discuss.elastic.co/t/cannot-create-data-tables-in-vega-plugin-for-kibana-v6-2/120784)
**Author:** [@AshishAAB](https://discuss.elastic.co/u/AshishAAB)\ **Replies:** 2\ **Last updated:** [February 22, 2018, 5:50am UTC](https://discuss.elastic.co/t/cannot-create-data-tables-in-vega-plugin-for-kibana-v6-2/120784 "2018-02-22T05:50:18Z")
I need to create a data table which has values that need to be calculated using scripted aggregations. As Kibana out of box visualization don't support such aggregations(I think), I was considering using Vega visualizat… --- ## [Returning a map from scripted metric aggregation](https://discuss.elastic.co/t/returning-a-map-from-scripted-metric-aggregation/98556)
**Author:** [@Ashish\_Goel](https://discuss.elastic.co/u/Ashish_Goel)\ **Replies:** 2\ **Last updated:** [August 28, 2017, 7:15pm UTC](https://discuss.elastic.co/t/returning-a-map-from-scripted-metric-aggregation/98556 "2017-08-28T19:15:25Z")
Hi there, I have been using ElasticSearch 1.5 before. And in that, there was a scripted metric aggregation with groovy as the language where I was returning a map. Now, we are working on upgrading to ElasticSearch 5.4 … --- ## [Dynamic index expiration dates](https://discuss.elastic.co/t/dynamic-index-expiration-dates/165963)
**Author:** [@vincentvm](https://discuss.elastic.co/u/vincentvm)\ **Replies:** 1\ **Last updated:** [January 28, 2019, 1:36pm UTC](https://discuss.elastic.co/t/dynamic-index-expiration-dates/165963 "2019-01-28T13:36:48Z")
We're using the following curator script to expire data older than 7 days. actions: 1: action: delete\_indices description: \>- Delete indices older than 7 days (based on index name), for logstash- p… --- ## [Elasticsearch 6.3.2 X-Pack features](https://discuss.elastic.co/t/elasticsearch-6-3-2-x-pack-features/141785)
**Author:** [@cerbi](https://discuss.elastic.co/u/cerbi)\ **Replies:** 8\ **Last updated:** [July 31, 2018, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch-6-3-2-x-pack-features/141785 "2018-07-31T13:57:41Z")
Is Elasticsearch Watcher features available for x-pack in Elasticsearch 6.3.2? Where can I check available x-pack features? Thanks Sarah --- ## [Why export ES\_HEAP\_SIZE=2g or bin/elasticsearch bin/elasticsearch --network.host 0.0.0.0 -Xmx2g -Xms2g not work](https://discuss.elastic.co/t/why-export-es-heap-size-2g-or-bin-elasticsearch-bin-elasticsearch-network-host-0-0-0-0-xmx2g-xms2g-not-work/56847)
**Author:** [@figo10203](https://discuss.elastic.co/u/figo10203)\ **Replies:** 3\ **Last updated:** [August 1, 2016, 8:54am UTC](https://discuss.elastic.co/t/why-export-es-heap-size-2g-or-bin-elasticsearch-bin-elasticsearch-network-host-0-0-0-0-xmx2g-xms2g-not-work/56847 "2016-08-01T08:54:42Z")
Hi body, My es version is 2.3.3 and I want to upgrade es memory to 2g from default value(1g). following the document I firstly export environment ES\_HEAP\_SIZE in user bash file and restarting es. but the heap keep disp… --- ## [JVM crash originating from APM agent](https://discuss.elastic.co/t/jvm-crash-originating-from-apm-agent/337265)
**Author:** [@svenrienstra](https://discuss.elastic.co/u/svenrienstra)\ **Replies:** 7\ **Last updated:** [July 5, 2023, 12:58pm UTC](https://discuss.elastic.co/t/jvm-crash-originating-from-apm-agent/337265 "2023-07-05T12:58:53Z")
We've been experiencing a SIGSEV JVM crash on our production cluster which seems to originate from the APM Java agent. We haven't been able to establish a pattern of when this happens or what triggers this. The second in… --- ## [Logtash Pattern not working](https://discuss.elastic.co/t/logtash-pattern-not-working/104553)
**Author:** [@mbvelo](https://discuss.elastic.co/u/mbvelo)\ **Replies:** 7\ **Last updated:** [October 23, 2017, 1:30pm UTC](https://discuss.elastic.co/t/logtash-pattern-not-working/104553 "2017-10-23T13:30:10Z")
input { beats { port =\> 5044 } } filter { grok { match =\> \["mesage", "ts:(?\((\[0-9\]+)-\*)+ (\[0-9\]+-\*)+ \[A-Z\]+)\\|INFO:%{{LOGLEVEL:LEVE}\\|WebContainer:%{WORD:WebContainer}\\|request:%{WORD:r… --- ## [Unable to push nested json from filebeat to elasticsearch](https://discuss.elastic.co/t/unable-to-push-nested-json-from-filebeat-to-elasticsearch/194920)
**Author:** [@Kumar\_Pratyush](https://discuss.elastic.co/u/Kumar_Pratyush)\ **Replies:** 1\ **Last updated:** [August 14, 2019, 10:47am UTC](https://discuss.elastic.co/t/unable-to-push-nested-json-from-filebeat-to-elasticsearch/194920 "2019-08-14T10:47:06Z")
So my requirement is fairly simple. I have logs in the form of json where each line corresponds to one document. The json is in nested format. When I use a simple json, i.e. without any nestings, it works fine and the sa… --- ## [Plot a graph using two fields](https://discuss.elastic.co/t/plot-a-graph-using-two-fields/40020)
**Author:** [@binurajps](https://discuss.elastic.co/u/binurajps)\ **Replies:** 1\ **Last updated:** [January 25, 2016, 3:13pm UTC](https://discuss.elastic.co/t/plot-a-graph-using-two-fields/40020 "2016-01-25T15:13:46Z")
Hello Team, I have two fields like as below, Session\_ID and Request\_ID Example values like as below: S001 | R001 S001 | R002 I would like to plot a Unique Count Graph using these fields. How two combine these… --- ## [Validation Failed: 1: this action would add \[2\] total shards, but this cluster currently has \[2122\]/\[2000\] maximum shards open](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2122-2000-maximum-shards-open/257678)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:59pm UTC](https://discuss.elastic.co/t/validation-failed-1-this-action-would-add-2-total-shards-but-this-cluster-currently-has-2122-2000-maximum-shards-open/257678 "2020-12-04T16:59:27Z")
How can I solve this problem? \[2020-12-04T10:10:41,540\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>"e45d58acd2b072154d7ac57ceb05491db728… --- ## [How to setup curator for multiple clusters?](https://discuss.elastic.co/t/how-to-setup-curator-for-multiple-clusters/135914)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 4\ **Last updated:** [June 20, 2018, 5:06am UTC](https://discuss.elastic.co/t/how-to-setup-curator-for-multiple-clusters/135914 "2018-06-20T05:06:49Z")
Hi Experts, I was wondering if I can set up curator for multiple clusters . Below is my curator configuration which works absolutely fine for one cluster . Now I want to apply same setup for my second cluster which uses… --- ## [Is top\_hits aggregation really a metric one?](https://discuss.elastic.co/t/is-top-hits-aggregation-really-a-metric-one/47693)
**Author:** [@golubev](https://discuss.elastic.co/u/golubev)\ **Replies:** 4\ **Last updated:** [April 21, 2016, 6:19pm UTC](https://discuss.elastic.co/t/is-top-hits-aggregation-really-a-metric-one/47693 "2016-04-21T18:19:23Z")
Hello! I got confused with the top\_hits aggregation. It is not clear for me that it is a metric one. While reading top\_hits reference page one can find this two conflicting statements: A top\_hits metric aggregator ke… --- ## [Composite aggregation returns after\_key even when there are no more buckets](https://discuss.elastic.co/t/composite-aggregation-returns-after-key-even-when-there-are-no-more-buckets/338606)
**Author:** [@cdhowie](https://discuss.elastic.co/u/cdhowie)\ **Replies:** 0\ **Last updated:** [July 17, 2023, 10:00pm UTC](https://discuss.elastic.co/t/composite-aggregation-returns-after-key-even-when-there-are-no-more-buckets/338606 "2023-07-17T22:00:35Z")
I've been working on a query that performs a composite aggregation with a large number of buckets. When I set the aggregation size to 50,000, all buckets fit in the response. However, after\_key is still present in the re… --- ## [How to scale up the cache file size when we scale up the disk size?](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747)
**Author:** [@gaobinlong](https://discuss.elastic.co/u/gaobinlong)\ **Replies:** 5\ **Last updated:** [October 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/how-to-scale-up-the-cache-file-size-when-we-scale-up-the-disk-size/287747 "2021-10-29T08:40:09Z")
Our es clusters are deployed in cloud, and the cloud disk is very easy to scale up it's size. We found that the size of the local cache file shared\_snapshot\_cache on the dedicated frozen node didn't change when we scale… --- ## [Filebeat Index Template from Modules](https://discuss.elastic.co/t/filebeat-index-template-from-modules/242660)
**Author:** [@tactics](https://discuss.elastic.co/u/tactics)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-index-template-from-modules/242660 "2020-07-30T14:21:16Z")
Hi, Not sure if I am overcomplicating things and bothering unnecessarily... I have finally got apache logs importing nicely using Filebeat and the Apache module. I am simply using the fields.yml and therefore the inde… --- ## [Nodes not communicating in 3-node cluster](https://discuss.elastic.co/t/nodes-not-communicating-in-3-node-cluster/185393)
**Author:** [@Paul\_14](https://discuss.elastic.co/u/Paul_14)\ **Replies:** 5\ **Last updated:** [June 12, 2019, 12:57pm UTC](https://discuss.elastic.co/t/nodes-not-communicating-in-3-node-cluster/185393 "2019-06-12T12:57:24Z")
Hello, I have deployed a 3 node Elasticsearch 7.0 Cluster from the Azure marketplace. However, I'm having trouble configuring them to see each other. Below I have detailed the elasticsearch.yml for 2 of the nodes. Node… --- ## [Using a geo\_bound aggregation together with pagination](https://discuss.elastic.co/t/using-a-geo-bound-aggregation-together-with-pagination/39521)
**Author:** [@iammichiel](https://discuss.elastic.co/u/iammichiel)\ **Replies:** 5\ **Last updated:** [February 23, 2016, 10:03am UTC](https://discuss.elastic.co/t/using-a-geo-bound-aggregation-together-with-pagination/39521 "2016-02-23T10:03:03Z")
Hi all, When using a geo\_bound aggregation (ie. the smallest window of coordinates to display all results) and pagination (x documents per page) together, I am wondering if the aggregation is run on the subset of resu… --- ## [How to show the JSON spring boot logs as a seperate fields out of the messages in the table format](https://discuss.elastic.co/t/how-to-show-the-json-spring-boot-logs-as-a-seperate-fields-out-of-the-messages-in-the-table-format/253424)
**Author:** [@Aathithiyan](https://discuss.elastic.co/u/Aathithiyan)\ **Replies:** 2\ **Last updated:** [October 31, 2020, 2:02pm UTC](https://discuss.elastic.co/t/how-to-show-the-json-spring-boot-logs-as-a-seperate-fields-out-of-the-messages-in-the-table-format/253424 "2020-10-31T14:02:43Z")
Hi, I have a task that i need to view the spring boot JSON logs in the table format. It should not dump into the message field of kibana. It has to view as a seperate field in the table format. Eg: EmployeeId 123 Emp… --- ## [Metricbeat - Bulk send failure - 429 Too Many Requests](https://discuss.elastic.co/t/metricbeat-bulk-send-failure-429-too-many-requests/219839)
**Author:** [@Djaswan](https://discuss.elastic.co/u/Djaswan)\ **Replies:** 2\ **Last updated:** [February 19, 2020, 1:03pm UTC](https://discuss.elastic.co/t/metricbeat-bulk-send-failure-429-too-many-requests/219839 "2020-02-19T13:03:04Z")
Hi, We are running a metricbeat daemon set within two GKE environments, a test and production environment. Both metricbeats are sending data to the same elasticsearch monitoring cluster. De metricbeat from the test env… --- ## [ELK 6.0 read Microsoft Access Database (.mdb) file](https://discuss.elastic.co/t/elk-6-0-read-microsoft-access-database-mdb-file/111701)
**Author:** [@pengran93](https://discuss.elastic.co/u/pengran93)\ **Replies:** 2\ **Last updated:** [December 21, 2017, 8:48am UTC](https://discuss.elastic.co/t/elk-6-0-read-microsoft-access-database-mdb-file/111701 "2017-12-21T08:48:37Z")
Hello I am quite new to ELK, just started to use it 3rd quater of this year. Soo my question is, can ELK read Microsoft Access Database (.mdb) file? If so, is there any tutorial on how to do it? I would like to know if… --- ## [Logstash sending logs to wrong indices](https://discuss.elastic.co/t/logstash-sending-logs-to-wrong-indices/110024)
**Author:** [@GuillaumeN](https://discuss.elastic.co/u/GuillaumeN)\ **Replies:** 2\ **Last updated:** [December 3, 2017, 7:10pm UTC](https://discuss.elastic.co/t/logstash-sending-logs-to-wrong-indices/110024 "2017-12-03T19:10:02Z")
Hi! I'm having an issue with logstash, it's sending logs to the configured output indices of ALL the pipeline configuration files (I have 2 with 1 output index per file) even though it shouldn't. I'm using the ELK stac… --- ## [Adding JSON fields Kibana](https://discuss.elastic.co/t/adding-json-fields-kibana/62437)
**Author:** [@arque](https://discuss.elastic.co/u/arque)\ **Replies:** 2\ **Last updated:** [October 7, 2016, 6:01pm UTC](https://discuss.elastic.co/t/adding-json-fields-kibana/62437 "2016-10-07T18:01:49Z")
Hi, I have a JSON file as input for Logstash, and it looks as follows: \[ { "\_index": "packets-2016-10-06", "\_type": "pcap\_file", "\_score": null, "\_source": { "layers": { "frame": { … --- ## [High CPU due to build of global ordinals](https://discuss.elastic.co/t/high-cpu-due-to-build-of-global-ordinals/60573)
**Author:** [@Roy\_Reznik](https://discuss.elastic.co/u/Roy_Reznik)\ **Replies:** 2\ **Last updated:** [September 20, 2016, 12:29pm UTC](https://discuss.elastic.co/t/high-cpu-due-to-build-of-global-ordinals/60573 "2016-09-20T12:29:36Z")
Hi, Recently, we've been getting high CPU usage due to (what seems to be) the build of global ordinals. We already adjusted refresh\_interval to 30s, which helped for a while, but CPU is high again, after some data was … --- ## [Elasticsearch for product database search - weighting](https://discuss.elastic.co/t/elasticsearch-for-product-database-search-weighting/53046)
**Author:** [@midget2000x](https://discuss.elastic.co/u/midget2000x)\ **Replies:** 2\ **Last updated:** [June 16, 2016, 8:17pm UTC](https://discuss.elastic.co/t/elasticsearch-for-product-database-search-weighting/53046 "2016-06-16T20:17:02Z")
Absolute newb here, so go easy! \[:smirk:\] I am wanting to build a better search for my shopping site, and I'm tinkering with elasticsearch right now. I'm trying to come up with a somewhat smarter "default" product sea… --- ## [Querying Nested Structure Without Hardcoding Keys](https://discuss.elastic.co/t/querying-nested-structure-without-hardcoding-keys/118857)
**Author:** [@jagt70](https://discuss.elastic.co/u/jagt70)\ **Replies:** 2\ **Last updated:** [February 7, 2018, 4:44pm UTC](https://discuss.elastic.co/t/querying-nested-structure-without-hardcoding-keys/118857 "2018-02-07T16:44:41Z")
Hi, I am totally new to Elasticsearch 6.0 and need help in querying documents with a nested structure (below). I have kept the example below simple, but in total the payload is around 28 KB. My Query What I am trying … --- ## [Infrastructure UI with Windows and Unix hosts](https://discuss.elastic.co/t/infrastructure-ui-with-windows-and-unix-hosts/163799)
**Author:** [@Marc-Antoine\_J](https://discuss.elastic.co/u/Marc-Antoine_J)\ **Replies:** 6\ **Last updated:** [January 30, 2019, 11:13am UTC](https://discuss.elastic.co/t/infrastructure-ui-with-windows-and-unix-hosts/163799 "2019-01-30T11:13:51Z")
I'm discovering the new Infrastructure UI and I like it so far. But I had a few issue especially with the year change. I was configuring my beats to use the metricbeat-{+YYYY.MM} index naming pattern. Since I set it up … [Previous page](https://discuss.elastic.co/top.md?page=1052&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1054&per_page=50&period=all)