# Top **URL:** https://discuss.elastic.co/top.md?page=1061&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1062 --- ## [Need info regarding Kibana XSS issue (ESA-2019-01)](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620)
**Author:** [@fragatina](https://discuss.elastic.co/u/fragatina)\ **Replies:** 2\ **Last updated:** [April 10, 2019, 6:36pm UTC](https://discuss.elastic.co/t/need-info-regarding-kibana-xss-issue-esa-2019-01/174620 "2019-04-10T18:36:00Z")
Hi, I'm evaluating Kibana XSS issue (ESA-2019-01) mentioned here: this seems different from previous Kibana XSS scripting issue (ESA-2018-14), right? I'd appreciate if somebody could provide the github PR for this fi… --- ## [Kibana index ID now references an id and not a](https://discuss.elastic.co/t/kibana-index-id-now-references-an-id-and-not-a/136175)
**Author:** [@conmurray](https://discuss.elastic.co/u/conmurray)\ **Replies:** 2\ **Last updated:** [June 18, 2018, 9:34pm UTC](https://discuss.elastic.co/t/kibana-index-id-now-references-an-id-and-not-a/136175 "2018-06-18T21:34:05Z")
Hi guys, Im a GOLD licence and Ive raised this with my support engineer but I wanted to pop it here aswell for context. I've a production environment running on 5.2. I've recently being updating/upgrading our Dev envi… --- ## [\_grokparsefailure and \_geoip\_lookup\_failure when upgrading to ELK 5.0](https://discuss.elastic.co/t/-grokparsefailure-and--geoip-lookup-failure-when-upgrading-to-elk-5-0/75742)
**Author:** [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\ **Replies:** 2\ **Last updated:** [February 21, 2017, 9:15am UTC](https://discuss.elastic.co/t/-grokparsefailure-and--geoip-lookup-failure-when-upgrading-to-elk-5-0/75742 "2017-02-21T09:15:04Z")
I have installed an ELK Stack log parsing pipeline and I was using ES 2.4, LS 2.4 and Kibana 4, and everything woks fine. Now I am trying to upgrade my Stack into ELK 5.0, unfortunately, I am getting \_grokparsefailure a… --- ## [Timelion not showing anything in kibana 5.1](https://discuss.elastic.co/t/timelion-not-showing-anything-in-kibana-5-1/70650)
**Author:** [@Harish\_Kumar](https://discuss.elastic.co/u/Harish_Kumar)\ **Replies:** 2\ **Last updated:** [January 23, 2017, 3:02pm UTC](https://discuss.elastic.co/t/timelion-not-showing-anything-in-kibana-5-1/70650 "2017-01-23T15:02:42Z")
I have installed Kibana 5.1 and as per my understanding Timelion is installed by default, but when i go to timelion it shows nothing for me. I have indexes created on elasticsearch. Could you please help me what is wron… --- ## [关于 Percolate Query 检索](https://discuss.elastic.co/t/percolate-query/57068)
**Author:** [@yan\_feng](https://discuss.elastic.co/u/yan_feng)\ **Replies:** 2\ **Last updated:** [August 8, 2016, 4:01am UTC](https://discuss.elastic.co/t/percolate-query/57068 "2016-08-08T04:01:39Z")
Percolate Query 是先定义检索规则，再把数据读入，找符合检索规则的数据，这样理解正确吗？ 下面url请参考 https://www.elastic.co/guide/en/elasticsearch/reference/master/query-dsl-percolate-query.html#\_sample\_usage 先问一个问题，检索的时候只能一条一条检索吗？（也就是一个id一个id的检索吗？） GET /… --- ## [Parsing a querystring from nginx](https://discuss.elastic.co/t/parsing-a-querystring-from-nginx/51248)
**Author:** [@john\_6](https://discuss.elastic.co/u/john_6)\ **Replies:** 2\ **Last updated:** [May 29, 2016, 3:18pm UTC](https://discuss.elastic.co/t/parsing-a-querystring-from-nginx/51248 "2016-05-29T15:18:01Z")
I have the following logstash filter so far: filter { if \[type\] == "nginx-access" { grok { match =\> { "message" =\> "%{NGINXACCESS}" } } useragent { source =\> "agent" target =\> "ua" }… --- ## [How big can/should you scale Elasticsearch](https://discuss.elastic.co/t/how-big-can-should-you-scale-elasticsearch/19533)
**Author:** [@Rob\_Blackin](https://discuss.elastic.co/u/Rob_Blackin)\ **Replies:** 2\ **Last updated:** [August 29, 2014, 7:38pm UTC](https://discuss.elastic.co/t/how-big-can-should-you-scale-elasticsearch/19533 "2014-08-29T19:38:33Z")
We are trying to implement a 5 TB, 10 Billion item Elasticsearch cluster. The key is an integer and the item data is fairly small. We seem to run into issues around loading. Seems to slow down as the index gets bi… --- ## [Index/API end point to edit detection rules?](https://discuss.elastic.co/t/index-api-end-point-to-edit-detection-rules/266401)
**Author:** [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\ **Replies:** 1\ **Last updated:** [March 8, 2021, 12:12pm UTC](https://discuss.elastic.co/t/index-api-end-point-to-edit-detection-rules/266401 "2021-03-08T12:12:33Z")
Hi, we are currently in the process of migrating off of our old SIEM and into elastic siem. We have created a bunch of detection rules already in Elastic but we still need to move over all the exceptions for those rules … --- ## [Elastic-agent-control.sock: operation not supported on socket](https://discuss.elastic.co/t/elastic-agent-control-sock-operation-not-supported-on-socket/285101)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 4:06pm UTC](https://discuss.elastic.co/t/elastic-agent-control-sock-operation-not-supported-on-socket/285101 "2021-09-29T16:06:01Z")
Hey there, I have an Elasticsearch and Kibana instance running via Docker images (I have configured the secure option). Now I am trying to install the elastic-agent to start the Fleet Server but I am facing this error: … --- ## [How to change directory for path.data and path.logs in elasticsearch in cent Operating system 7.7?](https://discuss.elastic.co/t/how-to-change-directory-for-path-data-and-path-logs-in-elasticsearch-in-cent-operating-system-7-7/190505)
**Author:** [@Anam\_Alfiya](https://discuss.elastic.co/u/Anam_Alfiya)\ **Replies:** 4\ **Last updated:** [July 16, 2019, 7:11am UTC](https://discuss.elastic.co/t/how-to-change-directory-for-path-data-and-path-logs-in-elasticsearch-in-cent-operating-system-7-7/190505 "2019-07-16T07:11:41Z")
How to change directory for path.data and path.logs in elasticsearch in cent Operating system 7.7? I tried to change the path manually in yml file. But every time error is popping out and its failing due to configuratio… --- ## [Pie Chart Issue, how to create pie chart on multiple values](https://discuss.elastic.co/t/pie-chart-issue-how-to-create-pie-chart-on-multiple-values/150900)
**Author:** [@8Bit\_System](https://discuss.elastic.co/u/8Bit_System)\ **Replies:** 4\ **Last updated:** [October 16, 2018, 12:15pm UTC](https://discuss.elastic.co/t/pie-chart-issue-how-to-create-pie-chart-on-multiple-values/150900 "2018-10-16T12:15:14Z")
Hello Sir, I am facing issue to make sub-bucket. suppose we have four field please have a review i have explain that issue in image i have four field we need to create four buket but in all bucket have multiple file… --- ## [Installation errors on Raspberry Pi 2](https://discuss.elastic.co/t/installation-errors-on-raspberry-pi-2/150468)
**Author:** [@mc0re](https://discuss.elastic.co/u/mc0re)\ **Replies:** 4\ **Last updated:** [October 1, 2018, 7:12am UTC](https://discuss.elastic.co/t/installation-errors-on-raspberry-pi-2/150468 "2018-10-01T07:12:16Z")
I have troubles installing Logstash on my Raspberry Pi. APT Cannot connect to the APT, using echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-6.x.list it … --- ## [Nested Array Object](https://discuss.elastic.co/t/nested-array-object/145580)
**Author:** [@DjDigvijay](https://discuss.elastic.co/u/DjDigvijay)\ **Replies:** 4\ **Last updated:** [September 5, 2018, 4:30pm UTC](https://discuss.elastic.co/t/nested-array-object/145580 "2018-09-05T16:30:29Z")
Having different members with nested mailOpens Array of Objects. Have to solve this query: The list of users who have \>3 distinct mailOpens.mailingId records { "\_index": "members", "\_type": "doc", "\_id": "1234567", … --- ## [Elasticsearch stops indexing logs after upgrading from 5.2.4 to 6.x](https://discuss.elastic.co/t/elasticsearch-stops-indexing-logs-after-upgrading-from-5-2-4-to-6-x/131089)
**Author:** [@shankarps](https://discuss.elastic.co/u/shankarps)\ **Replies:** 4\ **Last updated:** [May 10, 2018, 12:34am UTC](https://discuss.elastic.co/t/elasticsearch-stops-indexing-logs-after-upgrading-from-5-2-4-to-6-x/131089 "2018-05-10T00:34:00Z")
We upgraded our ELK stack from 5.2.4 to 6. We had installed X-Pack and rebuilt the indices before the upgrade. After restarting the new log entries after upgrade are not showing up in Kibana. We see several entries like… --- ## [Jdk8 run logstash6.2.2 error, jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1](https://discuss.elastic.co/t/jdk8-run-logstash6-2-2-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1/125187)
**Author:** [@jackxueman](https://discuss.elastic.co/u/jackxueman)\ **Replies:** 4\ **Last updated:** [March 26, 2018, 1:23am UTC](https://discuss.elastic.co/t/jdk8-run-logstash6-2-2-error-jopenssl-load-java-lang-verifyerror-class-org-bouncycastle-asn1/125187 "2018-03-26T01:23:30Z")
Logstash - java.lang.IllegalStateException: org.jruby.exceptions.RaiseException: (LoadError) load error: jopenssl/load -- java.lang.VerifyError: class org.bouncycastle.asn1.ASN1Primitive overrides final method equals.(Lj… --- ## [Terms entropy computation by fields](https://discuss.elastic.co/t/terms-entropy-computation-by-fields/14138)
**Author:** [@Hrach\_Pelibossian](https://discuss.elastic.co/u/Hrach_Pelibossian)\ **Replies:** 4\ **Last updated:** [November 1, 2013, 10:19am UTC](https://discuss.elastic.co/t/terms-entropy-computation-by-fields/14138 "2013-11-01T10:19:22Z")
Hello, I need something like the entropy computation for terms by fields for a subset of documents. For this I need to know the frequency of terms in fields that I can get by termsFacet and / or termsStatsFacet. … --- ## [High volume Indexing of Documents](https://discuss.elastic.co/t/high-volume-indexing-of-documents/10113)
**Author:** [@Meetu\_Maltiar](https://discuss.elastic.co/u/Meetu_Maltiar)\ **Replies:** 4\ **Last updated:** [December 19, 2012, 7:37am UTC](https://discuss.elastic.co/t/high-volume-indexing-of-documents/10113 "2012-12-19T07:37:34Z")
Hi, We have an application that generates around 7000-10000 JSON messages per second. Each message size is around 2.6 KB. What are the best practices that needs to be followed at the java API level so that my appli… --- ## [回复: really bad post\_filter performance](https://discuss.elastic.co/t/really-bad-post-filter-performance/16730)
**Author:** [@spancer\_ray](https://discuss.elastic.co/u/spancer_ray)\ **Replies:** 1\ **Last updated:** [April 1, 2014, 3:14pm UTC](https://discuss.elastic.co/t/really-bad-post-filter-performance/16730 "2014-04-01T15:14:40Z")
Too many shards may result in querying performance. daveey daveey@gmail.com编写： I just upgraded to ES 1.0.1 from ES 0.9.2 and am seeing huge performance problems. I traced them to what I think is the post\_filter. Her… --- ## [Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion to rational from nil"](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370)
**Author:** [@AmitC](https://discuss.elastic.co/u/AmitC)\ **Replies:** 6\ **Last updated:** [June 16, 2021, 6:00am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370 "2021-06-16T06:00:14Z")
Logstash Version : 6.1.1 Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212)
**Author:** [@Israel\_Braga](https://discuss.elastic.co/u/Israel_Braga)\ **Replies:** 6\ **Last updated:** [September 29, 2020, 1:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/250212 "2020-09-29T13:47:21Z")
After upgrade elk to 7.9.2: root@log:/# systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2020-0… --- ## [Setup watcher with multiple must\_not values do not apply as expected](https://discuss.elastic.co/t/setup-watcher-with-multiple-must-not-values-do-not-apply-as-expected/256957)
**Author:** [@Aviram\_Niron](https://discuss.elastic.co/u/Aviram_Niron)\ **Replies:** 3\ **Last updated:** [December 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/setup-watcher-with-multiple-must-not-values-do-not-apply-as-expected/256957 "2020-12-07T14:51:48Z")
I've set the following watcher which aims to ignore events coming from several tenants (as indicated in the "must\_not" clause). However, these are not ignored. What am I missing? { "trigger": { "schedule": { … --- ## [Constant High CPU Usage by Elasticsearch](https://discuss.elastic.co/t/constant-high-cpu-usage-by-elasticsearch/241969)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 7:36am UTC](https://discuss.elastic.co/t/constant-high-cpu-usage-by-elasticsearch/241969 "2020-07-22T07:36:01Z")
I am having the below setup Elasticsearch version : 7.5.1 APM Server version : 7.5.1 APM Agent language and version : elasticapm-java/1.12.0 Its a single node cluster, with about 500 shards, with 1 replica 64GB RAM,… --- ## [Slow Terms Aggregation](https://discuss.elastic.co/t/slow-terms-aggregation/136182)
**Author:** [@DumpCat](https://discuss.elastic.co/u/DumpCat)\ **Replies:** 3\ **Last updated:** [May 10, 2019, 7:01pm UTC](https://discuss.elastic.co/t/slow-terms-aggregation/136182 "2019-05-10T19:01:55Z")
Hi, I hava a problem with es query and aggregation. All es record count is about 0.1 billion, before adding a terms aggregation, my query is fast, only cost 75ms and all hit count is 105. But after adding a aggregation, … --- ## [Elasticsearch returning a document that is missing a term](https://discuss.elastic.co/t/elasticsearch-returning-a-document-that-is-missing-a-term/128941)
**Author:** [@harirajd](https://discuss.elastic.co/u/harirajd)\ **Replies:** 3\ **Last updated:** [April 24, 2018, 7:00am UTC](https://discuss.elastic.co/t/elasticsearch-returning-a-document-that-is-missing-a-term/128941 "2018-04-24T07:00:58Z")
I am looking for 2 terms in a document (innovu and implement) by using the following query in Kibana: GET esdbfindcases/esdbfindcases\_map/500d000000sOxzuAAC/\_explain { "query": { "bool": { "must"… --- ## [Cannot convert String into Integer](https://discuss.elastic.co/t/cannot-convert-string-into-integer/56588)
**Author:** [@hassanfarid](https://discuss.elastic.co/u/hassanfarid)\ **Replies:** 3\ **Last updated:** [April 7, 2017, 3:17pm UTC](https://discuss.elastic.co/t/cannot-convert-string-into-integer/56588 "2017-04-07T15:17:48Z")
I am using logstash 2.3.4 - the configuration worked for previous inputs in file, some input is now crashing it. How to find the error log line? Exception in pipelineworker, the pipeline stopped processing new events, … --- ## [Load index with data from document db collection and Azure SQL database](https://discuss.elastic.co/t/load-index-with-data-from-document-db-collection-and-azure-sql-database/69932)
**Author:** [@zshaikh](https://discuss.elastic.co/u/zshaikh)\ **Replies:** 3\ **Last updated:** [December 28, 2016, 11:35pm UTC](https://discuss.elastic.co/t/load-index-with-data-from-document-db-collection-and-azure-sql-database/69932 "2016-12-28T23:35:24Z")
Appreciate if any one can point me where I can find information/guidance how to load data in index from document db and Azure SQL database. I have to create couple of indexes both will have geo location. I have to perf… --- ## [String interpolation failing in event dependent config](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768)
**Author:** [@joshzitting](https://discuss.elastic.co/u/joshzitting)\ **Replies:** 3\ **Last updated:** [May 24, 2016, 7:17pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768 "2016-05-24T19:17:52Z")
I am attempting to use a dynamic/event dependent config (as shown here https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) however I keep getting an errror. I am trying to output data to… --- ## [Elasticsearch RED status in AWS](https://discuss.elastic.co/t/elasticsearch-red-status-in-aws/45362)
**Author:** [@irumman](https://discuss.elastic.co/u/irumman)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 9:08pm UTC](https://discuss.elastic.co/t/elasticsearch-red-status-in-aws/45362 "2016-04-04T21:08:44Z")
Hi, I have created an ES domain to search for the vpcglow logs and cloud trail log with daily indexing. Right now, the status is RED : { "cluster\_name": "678628912247:test", "status": "red", "timed\_out": false, "… --- ## [How to correctly store documents with page numbers?](https://discuss.elastic.co/t/how-to-correctly-store-documents-with-page-numbers/7305)
**Author:** [@Vitaly](https://discuss.elastic.co/u/Vitaly)\ **Replies:** 5\ **Last updated:** [April 13, 2012, 4:31pm UTC](https://discuss.elastic.co/t/how-to-correctly-store-documents-with-page-numbers/7305 "2012-04-13T16:31:41Z")
Hi, I was wondering if someone could help me with one issue. What would be the best way to store document in a way that I could get original document page number from elastic search? What happens now is I store pag… --- ## [Not getting data into Elasticsearch](https://discuss.elastic.co/t/not-getting-data-into-elasticsearch/187848)
**Author:** [@markov](https://discuss.elastic.co/u/markov)\ **Replies:** 7\ **Last updated:** [June 28, 2019, 11:15am UTC](https://discuss.elastic.co/t/not-getting-data-into-elasticsearch/187848 "2019-06-28T11:15:45Z")
Hi all, i'm sending logs using filebeat but i don't receive anything in kibana x-pack is enabled I created a logstash writer role \> POST \_xpack/security/role/logstash\_writer \> { \> "cluster": \["manage\_index\_templates"… --- ## [Grok stopping output to elasticsearch from logstash](https://discuss.elastic.co/t/grok-stopping-output-to-elasticsearch-from-logstash/185914)
**Author:** [@legacyboy](https://discuss.elastic.co/u/legacyboy)\ **Replies:** 7\ **Last updated:** [June 17, 2019, 7:59pm UTC](https://discuss.elastic.co/t/grok-stopping-output-to-elasticsearch-from-logstash/185914 "2019-06-17T19:59:41Z")
I am having an issue with grok on my syslog content. I am getting logs but when I try to use grok on it everything stops. Sample data; \<85\>Jun 14 16:38:36--5:00 10.128.107.37 Action="drop" UUid="{0x0,0x0,0x0,0x0}" inz… --- ## [Can't launch Elasticsearch](https://discuss.elastic.co/t/cant-launch-elasticsearch/144101)
**Author:** [@Diederik](https://discuss.elastic.co/u/Diederik)\ **Replies:** 1\ **Last updated:** [August 15, 2018, 10:16pm UTC](https://discuss.elastic.co/t/cant-launch-elasticsearch/144101 "2018-08-15T22:16:51Z")
Hi, I am very happy using Elasticsearch and are trying to upgrade from 1.2.1 to 6.3.2. I have downloaded 6.3.2 and set java to 1.8.0, see: $ java -version java version "1.8.0\_181" Java(TM) SE Runtime Environment (bu… --- ## [Is Z in input time valid for Z in Logstash date filter?](https://discuss.elastic.co/t/is-z-in-input-time-valid-for-z-in-logstash-date-filter/125430)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [March 24, 2018, 9:29am UTC](https://discuss.elastic.co/t/is-z-in-input-time-valid-for-z-in-logstash-date-filter/125430 "2018-03-24T09:29:51Z")
Hi, I am using ELK GA 5.0.0. I am taking input from Kafka and I have a date field like 2018-03-23T13:14:33.419Z. In my date filter, I am using the format; date { match =\> \[ "log\_time", "yyyy-MM-ddTHH:mm:ss.SSSZ" \] ti… --- ## [Logstash: Configuration for websphere](https://discuss.elastic.co/t/logstash-configuration-for-websphere/44295)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 1\ **Last updated:** [March 14, 2016, 8:54am UTC](https://discuss.elastic.co/t/logstash-configuration-for-websphere/44295 "2016-03-14T08:54:38Z")
Following is my configuration file for logstash to read data from websphere logs. input { file { type =\> "bolbo" path =\> \[ "D:/Users/abced/Documents/My Received Files/1003/1003/gca1.log" \] … --- ## [Regular expression as a parameter in painless](https://discuss.elastic.co/t/regular-expression-as-a-parameter-in-painless/128838)
**Author:** [@anoopvalluthadam](https://discuss.elastic.co/u/anoopvalluthadam)\ **Replies:** 3\ **Last updated:** [April 21, 2018, 6:43am UTC](https://discuss.elastic.co/t/regular-expression-as-a-parameter-in-painless/128838 "2018-04-21T06:43:54Z")
{ "query": { "bool": { "must": \[ { "query\_string": { "query": "a\*", "quote\_analyzer": "standard", "allow\_leading\_wildc… --- ## [Kubernetes - populate deployment name](https://discuss.elastic.co/t/kubernetes-populate-deployment-name/269308)
**Author:** [@Szymon\_Przepiora](https://discuss.elastic.co/u/Szymon_Przepiora)\ **Replies:** 0\ **Last updated:** [April 6, 2021, 9:06am UTC](https://discuss.elastic.co/t/kubernetes-populate-deployment-name/269308 "2021-04-06T09:06:46Z")
Hi, I'm trying to populate a field kubernetes.deployment.name. I'm getting only the higher level kubernetes.replicaset.name . There isn't any error in the log. My config: filebeat: enabled: true filebeatConfig: … --- ## [Search\_after doesn't work when sorting descendent](https://discuss.elastic.co/t/search-after-doesnt-work-when-sorting-descendent/230386)
**Author:** [@yv\_2904](https://discuss.elastic.co/u/yv_2904)\ **Replies:** 0\ **Last updated:** [April 29, 2020, 2:02pm UTC](https://discuss.elastic.co/t/search-after-doesnt-work-when-sorting-descendent/230386 "2020-04-29T14:02:20Z")
I am implementing a sear\_after for cursor pagination, my sort is based on a unique Id that is a text field. When I tried to sort this field desc the search\_after doesn't return any result. If I sort asc, it returns resu… --- ## [Forcemerge is not allowed in cold phase](https://discuss.elastic.co/t/forcemerge-is-not-allowed-in-cold-phase/208124)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 0\ **Last updated:** [November 15, 2019, 6:58pm UTC](https://discuss.elastic.co/t/forcemerge-is-not-allowed-in-cold-phase/208124 "2019-11-15T18:58:35Z")
I am trying the following request for ILM: PUT \_ilm/policy/test1 { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "set\_priority": { "priority": 100 … --- ## [Create es index alias from logstash pipeline conf](https://discuss.elastic.co/t/create-es-index-alias-from-logstash-pipeline-conf/120531)
**Author:** [@Arjun\_subramanyam\_va](https://discuss.elastic.co/u/Arjun_subramanyam_va)\ **Replies:** 0\ **Last updated:** [February 19, 2018, 10:50pm UTC](https://discuss.elastic.co/t/create-es-index-alias-from-logstash-pipeline-conf/120531 "2018-02-19T22:50:19Z")
Hi I want to automate the alias creation for es index, currently I specify index name in elasticsearch output plugin, similarly can i specify index alias in the conf file or template file ? how to do this efficiently, I… --- ## [Geo\_polygon filter with hole?](https://discuss.elastic.co/t/geo-polygon-filter-with-hole/23289)
**Author:** [@Andrej](https://discuss.elastic.co/u/Andrej)\ **Replies:** 0\ **Last updated:** [April 17, 2015, 10:39am UTC](https://discuss.elastic.co/t/geo-polygon-filter-with-hole/23289 "2015-04-17T10:39:00Z")
Short question about geo\_polygon filter as I haven't found anything about it in the reference: can the geo\_polygon filter handle polygons with holes? If yes, how are they defined? Thanks in advance! Andrej -… --- ## [Can not create elasticsearch cluster in different servers with docker compose](https://discuss.elastic.co/t/can-not-create-elasticsearch-cluster-in-different-servers-with-docker-compose/223896)
**Author:** [@wvx](https://discuss.elastic.co/u/wvx)\ **Replies:** 2\ **Last updated:** [March 19, 2020, 2:45am UTC](https://discuss.elastic.co/t/can-not-create-elasticsearch-cluster-in-different-servers-with-docker-compose/223896 "2020-03-19T02:45:01Z")
I have 2 servers, and create elasticsearch nodes in the 2 servers. the content of docker-compose.yml files are like these: es0: image: elasticsearch:7.6.0 container\_name: es0 environment: - "ES\_JAVA\_OP… --- ## [Problem to install logstash using 'sudo apt install logstash'](https://discuss.elastic.co/t/problem-to-install-logstash-using-sudo-apt-install-logstash/177029)
**Author:** [@alextim](https://discuss.elastic.co/u/alextim)\ **Replies:** 2\ **Last updated:** [April 16, 2019, 3:24pm UTC](https://discuss.elastic.co/t/problem-to-install-logstash-using-sudo-apt-install-logstash/177029 "2019-04-16T15:24:04Z")
Hi everyone. I trying to install logstash (sudo apt install logstash) on my laptop with ubuntu 18.04 and having following outcome: Setting up logstash (1:6.7.1-1) ... Using provided startup.options file: /etc/logstash… --- ## [Filter inside DropDown visualization](https://discuss.elastic.co/t/filter-inside-dropdown-visualization/147432)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 2\ **Last updated:** [September 6, 2018, 7:43am UTC](https://discuss.elastic.co/t/filter-inside-dropdown-visualization/147432 "2018-09-06T07:43:55Z")
Hello, I have a question about filters inside the controls visualization (option list or DropDown) when I choose my field I have for example 100 elements in this list but when I add a filter like in this picture the d… --- ## [Unable to start service](https://discuss.elastic.co/t/unable-to-start-service/90506)
**Author:** [@sbach](https://discuss.elastic.co/u/sbach)\ **Replies:** 2\ **Last updated:** [June 29, 2017, 8:06pm UTC](https://discuss.elastic.co/t/unable-to-start-service/90506 "2017-06-29T20:06:53Z")
Have ELK running on CentOS, Linux servers are sending logs as expected. Installed service in Windows Server 16, Config test passed, getting error 1053 when trying to start service. Running winlogbeat in foreground, w… --- ## [Elasticsearch data consistency](https://discuss.elastic.co/t/elasticsearch-data-consistency/66070)
**Author:** [@famoss](https://discuss.elastic.co/u/famoss)\ **Replies:** 2\ **Last updated:** [November 16, 2016, 1:00am UTC](https://discuss.elastic.co/t/elasticsearch-data-consistency/66070 "2016-11-16T01:00:30Z")
1.Es create a document says: Node 3 executes the request on the primary shard. If it is successful, it forwards the request in parallel to the replica shards on Node 1 and Node 2. Once all of the replica shards report … --- ## [Capture response from HTTP requests using HTTP Output Plugin in Logstash](https://discuss.elastic.co/t/capture-response-from-http-requests-using-http-output-plugin-in-logstash/40609)
**Author:** [@Vaibhav\_Chawla](https://discuss.elastic.co/u/Vaibhav_Chawla)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 8:38pm UTC](https://discuss.elastic.co/t/capture-response-from-http-requests-using-http-output-plugin-in-logstash/40609 "2016-10-10T20:38:45Z")
Hello, I could not figure out a way to capture the response by issuing a HTTP request to a target endpoint using the HTTP Output plugin. I just want to get the status code displayed (200 OK / 404 Not Found) on the consol… --- ## [File plugin path setup to multiple files](https://discuss.elastic.co/t/file-plugin-path-setup-to-multiple-files/40040)
**Author:** [@yahoo](https://discuss.elastic.co/u/yahoo)\ **Replies:** 2\ **Last updated:** [January 26, 2016, 4:46pm UTC](https://discuss.elastic.co/t/file-plugin-path-setup-to-multiple-files/40040 "2016-01-26T16:46:07Z")
I have a process that generates log files aaalog\_20160101 aaalog\_20160102 aaalog\_20160103 This config file did not work: file { path =\> \[ "D:\\a\\b\\d\\e\\f\\aaalog\_\*" \] start\_position =\> beginning … --- ## [Elasticsearch Transport Client fails to recovery connection after cluster restart](https://discuss.elastic.co/t/elasticsearch-transport-client-fails-to-recovery-connection-after-cluster-restart/85042)
**Author:** [@merlob](https://discuss.elastic.co/u/merlob)\ **Replies:** 4\ **Last updated:** [May 16, 2017, 2:55pm UTC](https://discuss.elastic.co/t/elasticsearch-transport-client-fails-to-recovery-connection-after-cluster-restart/85042 "2017-05-16T14:55:16Z")
Hi, I'm using Elasticsearch 5.4.0 with Transport Client with the following problems: you must launch the application several times before it can connect to the cluster. when connection is established, after a clus… --- ## [How to use ReindexRequestBuilder in combination with the Task API?](https://discuss.elastic.co/t/how-to-use-reindexrequestbuilder-in-combination-with-the-task-api/64416)
**Author:** [@Aymeric\_Caroff](https://discuss.elastic.co/u/Aymeric_Caroff)\ **Replies:** 4\ **Last updated:** [October 31, 2016, 2:12pm UTC](https://discuss.elastic.co/t/how-to-use-reindexrequestbuilder-in-combination-with-the-task-api/64416 "2016-10-31T14:12:22Z")
Hi, I am trying to migrate some Elastic 2.3.4 code to the new Elastic 5.0.0 and I'm struggling with the Reindex API. What I'm trying to achieve is the equivalent of this: POST /\_reindex?wait\_for\_completion=false … --- ## [Analyzing Windows Host Data - Lab](https://discuss.elastic.co/t/analyzing-windows-host-data-lab/239171)
**Author:** [@fadi.alhamwii](https://discuss.elastic.co/u/fadi.alhamwii)\ **Replies:** 8\ **Last updated:** [July 29, 2020, 5:53pm UTC](https://discuss.elastic.co/t/analyzing-windows-host-data-lab/239171 "2020-07-29T17:53:16Z")
I have an issue with Analyzing Windows Host Data - Lab. I could open Strigo page, then can not Access lab instructions Also left the lab page open (30 min) and still the page is unreachable [Previous page](https://discuss.elastic.co/top.md?page=1060&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1062&per_page=50&period=all)