# Top

**URL:** https://discuss.elastic.co/top.md?page=1067&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1068

---

## [Import data failed document - Some documents could not be imported](https://discuss.elastic.co/t/import-data-failed-document-some-documents-could-not-be-imported/288572)

<div class="topic-metadata">

**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\
**Replies:** 5\
**Last updated:** [November 11, 2021, 2:41pm UTC](https://discuss.elastic.co/t/import-data-failed-document-some-documents-could-not-be-imported/288572 "2021-11-11T14:41:27Z")

</div>

I am in the localhost:5601 GUI on the "Add data / Upload File" page. I am importing a ndjson file with 86 lines and the following mappings set in "Import data / Advanced" "mappings": { { "properties": { "si…

---

## [Out of memory exception for coordinating nodes](https://discuss.elastic.co/t/out-of-memory-exception-for-coordinating-nodes/216538)

<div class="topic-metadata">

**Author:** [@deebify](https://discuss.elastic.co/u/deebify)\
**Replies:** 5\
**Last updated:** [February 15, 2020, 9:43am UTC](https://discuss.elastic.co/t/out-of-memory-exception-for-coordinating-nodes/216538 "2020-02-15T09:43:37Z")

</div>

I've a ES cluster 6.6.2 composed of 3 master, 4 datanodes, 2 coordinating nodes. 2 kibana instances connecting to 2 coordinating nodes. 2 coordinating nodes are 16GB of RAM, and 7GB of Heap (min=max heap). On coordina…

---

## [Painless using comparing to a float](https://discuss.elastic.co/t/painless-using-comparing-to-a-float/102013)

<div class="topic-metadata">

**Author:** [@jspeer](https://discuss.elastic.co/u/jspeer)\
**Replies:** 5\
**Last updated:** [October 2, 2017, 4:47pm UTC](https://discuss.elastic.co/t/painless-using-comparing-to-a-float/102013 "2017-10-02T16:47:32Z")

</div>

I'm trying to divide 2 buckets, and check against a float to see if the value has decreased This works "condition": { "script": { "inline": "return ((ctx.payload.aggregations.today.buckets.latest60.doc\_count)/(ctx.pa…

---

## [Elasticsearch 2.4.1 rpm not in repository](https://discuss.elastic.co/t/elasticsearch-2-4-1-rpm-not-in-repository/61812)

<div class="topic-metadata">

**Author:** [@kobyb](https://discuss.elastic.co/u/kobyb)\
**Replies:** 5\
**Last updated:** [October 1, 2016, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-2-4-1-rpm-not-in-repository/61812 "2016-10-01T13:46:42Z")

</div>

I've tried update elasticsearch using the repository. It doens't seem to be there. I've had to manually download the rpm to install. CentOS 7 yum.repos.d/elasticsearch.repo: \[elasticsearch\] name=elasticsearch re…

---

## [\[Logstash\] \[Filebeat\] Using codec Plain and JSON for the same input](https://discuss.elastic.co/t/logstash-filebeat-using-codec-plain-and-json-for-the-same-input/310836)

<div class="topic-metadata">

**Author:** [@hdryx](https://discuss.elastic.co/u/hdryx)\
**Replies:** 8\
**Last updated:** [August 14, 2022, 4:55pm UTC](https://discuss.elastic.co/t/logstash-filebeat-using-codec-plain-and-json-for-the-same-input/310836 "2022-08-14T16:55:46Z")

</div>

Hi, Actually we have this architecture : Filebeat --\> Kafaka --\> Logstash The Logstash is using this input config : file1.conf input { kafka { codec =\> json bootstrap\_servers =\> "....." topics\_pattern =\>…

---

## [Pipeline workers configuration](https://discuss.elastic.co/t/pipeline-workers-configuration/262934)

<div class="topic-metadata">

**Author:** [@ritusingh](https://discuss.elastic.co/u/ritusingh)\
**Replies:** 8\
**Last updated:** [February 2, 2021, 11:21am UTC](https://discuss.elastic.co/t/pipeline-workers-configuration/262934 "2021-02-02T11:21:14Z")

</div>

Hi, I have reduced pipeline.workers to 1 because I need the output in correct order. Now the problem is when I am giving 10k request (100 per second) it is not reaching elasticsearch, only 9k reaching. Earlier it was no…

---

## [Bulk index operation with iterations failed](https://discuss.elastic.co/t/bulk-index-operation-with-iterations-failed/150355)

<div class="topic-metadata">

**Author:** [@zhugw](https://discuss.elastic.co/u/zhugw)\
**Replies:** 3\
**Last updated:** [October 5, 2018, 9:14am UTC](https://discuss.elastic.co/t/bulk-index-operation-with-iterations-failed/150355 "2018-10-05T09:14:37Z")

</div>

I want to use rally to insert many docs to an index for benchmark, e.g. I have a documents.json with 1405 records, I want to insert 1405\*1000 to index for benchmark. { "operation": "bulk-index", "iterations": 1000, …

---

## [Huawei netstream v5 or V9 logstash 6.3.1 Ignoring Netflow version](https://discuss.elastic.co/t/huawei-netstream-v5-or-v9-logstash-6-3-1-ignoring-netflow-version/146981)

<div class="topic-metadata">

**Author:** [@tigerofcn](https://discuss.elastic.co/u/tigerofcn)\
**Replies:** 3\
**Last updated:** [September 7, 2018, 5:52am UTC](https://discuss.elastic.co/t/huawei-netstream-v5-or-v9-logstash-6-3-1-ignoring-netflow-version/146981 "2018-09-07T05:52:21Z")

</div>

ip netstream export version 5 \[2018-08-16T16:10:51,220\]\[WARN \]\[logstash.codecs.netflow \] Ignoring Netflow version v32773 \[2018-08-16T16:10:56,202\]\[WARN \]\[logstash.codecs.netflow \] Ignoring Netflow version v32773 \[20…

---

## [Painless: match a string](https://discuss.elastic.co/t/painless-match-a-string/143768)

<div class="topic-metadata">

**Author:** [@palace](https://discuss.elastic.co/u/palace)\
**Replies:** 0\
**Last updated:** [August 9, 2018, 9:16pm UTC](https://discuss.elastic.co/t/painless-match-a-string/143768 "2018-08-09T21:16:43Z")

</div>

Hello, I am new to painless and wanted to know what is the proper way to match a string. For my specific example I want to perform two different manipulations to two keywords and then combine them at the end. The first…

---

## [Why does IDF differs on hits with same query?](https://discuss.elastic.co/t/why-does-idf-differs-on-hits-with-same-query/53861)

<div class="topic-metadata">

**Author:** [@Ulrik\_Pedersen](https://discuss.elastic.co/u/Ulrik_Pedersen)\
**Replies:** 3\
**Last updated:** [June 24, 2016, 9:36am UTC](https://discuss.elastic.co/t/why-does-idf-differs-on-hits-with-same-query/53861 "2016-06-24T09:36:12Z")

</div>

Hi I'm trying to understand how scoring is affecting my search results - but seems to misunderstand the IDF term. When quering a single index and one single type of documents the values used for calculating the IDF i…

---

## [Caching a search query for pagination](https://discuss.elastic.co/t/caching-a-search-query-for-pagination/11931)

<div class="topic-metadata">

**Author:** [@Eran\_Eidinger](https://discuss.elastic.co/u/Eran_Eidinger)\
**Replies:** 3\
**Last updated:** [May 14, 2013, 11:38pm UTC](https://discuss.elastic.co/t/caching-a-search-query-for-pagination/11931 "2013-05-14T23:38:44Z")

</div>

When paginating through a query using "from" and "size", does the query stay cached, or is it evaluated anew each time on the server? If not, is there a way to "freeze" a query to paginate it? example: curl -…

---

## [Split filebeat log with a variable length into several new events](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957)

<div class="topic-metadata">

**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\
**Replies:** 2\
**Last updated:** [March 31, 2021, 9:49pm UTC](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957 "2021-03-31T21:49:48Z")

</div>

Hi. I'm fairly new with ELK, and i been struggling a lot trying to make this work, with no luck, so i'm asking for a way to solve this... I'm using Filebeat to get logs into my elasticsearc server and, the line logs ar…

---

## [Tuning ELK Performance and controlling Logs](https://discuss.elastic.co/t/tuning-elk-performance-and-controlling-logs/60999)

<div class="topic-metadata">

**Author:** [@spravn789](https://discuss.elastic.co/u/spravn789)\
**Replies:** 2\
**Last updated:** [September 20, 2016, 10:52am UTC](https://discuss.elastic.co/t/tuning-elk-performance-and-controlling-logs/60999 "2016-09-20T10:52:37Z")

</div>

Hi All, I need solution or guidance for below queries, to improve the performance. Kindly help. We can control logs in kibana, like log only if Error, is there any other way to do the same for logstash? Similarly Is…

---

## [Metricbeat chart does not load dashboards](https://discuss.elastic.co/t/metricbeat-chart-does-not-load-dashboards/218624)

<div class="topic-metadata">

**Author:** [@Dimitris\_S](https://discuss.elastic.co/u/Dimitris_S)\
**Replies:** 1\
**Last updated:** [February 16, 2020, 8:48am UTC](https://discuss.elastic.co/t/metricbeat-chart-does-not-load-dashboards/218624 "2020-02-16T08:48:25Z")

</div>

Describe the bug I'm not able to load the metricbeat dashboards in Kibana Version of Helm and Kubernetes: $ helm version Client: &version.Version{SemVer:"v2.16.1", GitCommit:"bbdfe5e7803a12bbdf97e94cd847859890cf4050",…

---

## [Link kibana dashboard to "Discover"](https://discuss.elastic.co/t/link-kibana-dashboard-to-discover/189295)

<div class="topic-metadata">

**Author:** [@Ehtisham\_Ul\_Haq](https://discuss.elastic.co/u/Ehtisham_Ul_Haq)\
**Replies:** 1\
**Last updated:** [July 8, 2019, 3:42pm UTC](https://discuss.elastic.co/t/link-kibana-dashboard-to-discover/189295 "2019-07-08T15:42:25Z")

</div>

Hello I want to achieve a solution where I have one dashboard ,if the user click on any particular metric count , it can redirect to "Discover"with same filter showing related document. Thanks in advance for the help…

---

## [How to use new line '\\n' in a loop](https://discuss.elastic.co/t/how-to-use-new-line-n-in-a-loop/133472)

<div class="topic-metadata">

**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Replies:** 1\
**Last updated:** [May 31, 2018, 4:42pm UTC](https://discuss.elastic.co/t/how-to-use-new-line-n-in-a-loop/133472 "2018-05-31T16:42:08Z")

</div>

I have a watch which triggers a alert on following condition " Multiple Virus Detected Alert in last one hour" for simulation i have changed it to 10 sec. Problem: when i print following "text": "There are {{#ctx.paylo…

---

## [Searching for phrase which will return partial text in the field](https://discuss.elastic.co/t/searching-for-phrase-which-will-return-partial-text-in-the-field/87539)

<div class="topic-metadata">

**Author:** [@jshraddha](https://discuss.elastic.co/u/jshraddha)\
**Replies:** 1\
**Last updated:** [May 30, 2017, 10:30am UTC](https://discuss.elastic.co/t/searching-for-phrase-which-will-return-partial-text-in-the-field/87539 "2017-05-30T10:30:19Z")

</div>

Hi, I am learning elasticsearch and tried few queries like match, match phrase, search, fuzzy etc. Whenever we search for any text ES returns the document containing that text. I am having a different requirement whe…

---

## [Indexes dropped, please\_read index found](https://discuss.elastic.co/t/indexes-dropped-please-read-index-found/71551)

<div class="topic-metadata">

**Author:** [@bkamiche](https://discuss.elastic.co/u/bkamiche)\
**Replies:** 1\
**Last updated:** [January 13, 2017, 5:36pm UTC](https://discuss.elastic.co/t/indexes-dropped-please-read-index-found/71551 "2017-01-13T17:36:04Z")

</div>

All the indexes on my cluster have been deleted for two days in a row, and a suspiciously "please\_read" index as found, although it had no data on it. The cluster is protected from public internet access, and we don't …

---

## [ParsingException in Elastic 5.0.0](https://discuss.elastic.co/t/parsingexception-in-elastic-5-0-0/64626)

<div class="topic-metadata">

**Author:** [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)\
**Replies:** 1\
**Last updated:** [November 1, 2016, 8:25pm UTC](https://discuss.elastic.co/t/parsingexception-in-elastic-5-0-0/64626 "2016-11-01T20:25:56Z")

</div>

Hi , I am trying to run very simple query using Java client SearchRequestBuilder searchRequestBuilder; String query = "{\\"query\\":{\\"match\_all\\":{}}}"; searchRequestBuilder = client.prepareSearc…

---

## [A very simple query with CURL from a Windows box](https://discuss.elastic.co/t/a-very-simple-query-with-curl-from-a-windows-box/46339)

<div class="topic-metadata">

**Author:** [@ameconi](https://discuss.elastic.co/u/ameconi)\
**Replies:** 7\
**Last updated:** [April 15, 2016, 9:53am UTC](https://discuss.elastic.co/t/a-very-simple-query-with-curl-from-a-windows-box/46339 "2016-04-15T09:53:07Z")

</div>

Hello all. I’m a beginner so start with a very simple question about searching. A customer of mine is running an ELK solution to collect Netflow packets coming from Cisco devices. I try to search using the CURL tool from…

---

## [Announcing: A Wireshark dissector for elasticsearch](https://discuss.elastic.co/t/announcing-a-wireshark-dissector-for-elasticsearch/20194)

<div class="topic-metadata">

**Author:** [@Ryan\_Doyle](https://discuss.elastic.co/u/Ryan_Doyle)\
**Replies:** 1\
**Last updated:** [November 16, 2014, 10:50pm UTC](https://discuss.elastic.co/t/announcing-a-wireshark-dissector-for-elasticsearch/20194 "2014-11-16T22:50:38Z")

</div>

Hi Guys I have been working on a Wireshark dissector for elasticsearch. This allows you to more intelligently debug elasticsearch problems at the network level. I have been working in my own branch of Wireshark an…

---

## [Missing transport-netty4-client for ES 8.0.0](https://discuss.elastic.co/t/missing-transport-netty4-client-for-es-8-0-0/297024)

<div class="topic-metadata">

**Author:** [@coutoPL](https://discuss.elastic.co/u/coutoPL)\
**Replies:** 6\
**Last updated:** [February 12, 2022, 11:56am UTC](https://discuss.elastic.co/t/missing-transport-netty4-client-for-es-8-0-0/297024 "2022-02-12T11:56:49Z")

</div>

Hi Guys, There is ES 8.0.0 released, but I cannot find transport-netty4-client for 8.0.0: https://repo1.maven.org/maven2/org/elasticsearch/plugin/transport-netty4-client/ Is it an oversight or maybe, for some reason, …

---

## [Trying to separate key-value pairs in nested array (help with RUBY)](https://discuss.elastic.co/t/trying-to-separate-key-value-pairs-in-nested-array-help-with-ruby/152035)

<div class="topic-metadata">

**Author:** [@Harshet\_Jain](https://discuss.elastic.co/u/Harshet_Jain)\
**Replies:** 6\
**Last updated:** [October 12, 2018, 8:49am UTC](https://discuss.elastic.co/t/trying-to-separate-key-value-pairs-in-nested-array-help-with-ruby/152035 "2018-10-12T08:49:21Z")

</div>

I have been trying to import my mySQL database into Elasticsearch through Logstash but I am stuck (for two days now) to separate three columns into separate fields. I want to split these into different fields so it disp…

---

## [Not able to fetch max file descriptors](https://discuss.elastic.co/t/not-able-to-fetch-max-file-descriptors/63454)

<div class="topic-metadata">

**Author:** [@redshadow](https://discuss.elastic.co/u/redshadow)\
**Replies:** 6\
**Last updated:** [October 21, 2016, 5:16pm UTC](https://discuss.elastic.co/t/not-able-to-fetch-max-file-descriptors/63454 "2016-10-21T17:16:34Z")

</div>

I used the link here : https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-configuration.html#file-descriptors My query was the same as noted in the link above ie curl localhost:9200/\_nodes/stats/pr…

---

## [Curator is deleting all snapshots](https://discuss.elastic.co/t/curator-is-deleting-all-snapshots/36833)

<div class="topic-metadata">

**Author:** [@Ashish\_Goel](https://discuss.elastic.co/u/Ashish_Goel)\
**Replies:** 6\
**Last updated:** [December 10, 2015, 7:46am UTC](https://discuss.elastic.co/t/curator-is-deleting-all-snapshots/36833 "2015-12-10T07:46:02Z")

</div>

Hi there, I am using ElasticSearch 1.5.0 and curator 3.2.3. I recently created a script to be executed as daily cron job which deletes all snapshots older than a week. But when executed, it deletes each and every snaps…

---

## [Rsyslog not sending data to logstash](https://discuss.elastic.co/t/rsyslog-not-sending-data-to-logstash/88536)

<div class="topic-metadata">

**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\
**Replies:** 1\
**Last updated:** [June 11, 2017, 2:35pm UTC](https://discuss.elastic.co/t/rsyslog-not-sending-data-to-logstash/88536 "2017-06-11T14:35:43Z")

</div>

I have followed this Digital Ocean tutorial to send logs to logstash via rsyslog. But I am not getting logs in logstash. I am sending logs to a centralized rsyslog-server, and then to logstash. This rsyslog-server and …

---

## [ES memory vs disk storage](https://discuss.elastic.co/t/es-memory-vs-disk-storage/11883)

<div class="topic-metadata">

**Author:** [@Justin\_Franks](https://discuss.elastic.co/u/Justin_Franks)\
**Replies:** 1\
**Last updated:** [May 8, 2013, 9:55pm UTC](https://discuss.elastic.co/t/es-memory-vs-disk-storage/11883 "2013-05-08T21:55:35Z")

</div>

We can configure ES to store it's data in memory or on disk, right? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiv…

---

## [Unable to install Kibana on Windows](https://discuss.elastic.co/t/unable-to-install-kibana-on-windows/269743)

<div class="topic-metadata">

**Author:** [@hussshe](https://discuss.elastic.co/u/hussshe)\
**Replies:** 4\
**Last updated:** [April 12, 2021, 1:39pm UTC](https://discuss.elastic.co/t/unable-to-install-kibana-on-windows/269743 "2021-04-12T13:39:25Z")

</div>

Hello, Kibana Version: 7.12.0- Windows I am unable to install Kibana though the Elastic search is up and running on http://localhost:9200/. The following are the commands I ran in Command prompt C:\>cd C:\\kibana\\kiban…

---

## [Discovery, sort by timestamp and then field (int)](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770)

<div class="topic-metadata">

**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\
**Replies:** 4\
**Last updated:** [March 20, 2018, 2:41pm UTC](https://discuss.elastic.co/t/discovery-sort-by-timestamp-and-then-field-int/124770 "2018-03-20T14:41:56Z")

</div>

I have logs that come in that are only accurate down to a second. The logs are generated when different part of an application is run, so when a function is run it has a unique ID to group those messages together and th…

---

## [How force index level for raw query](https://discuss.elastic.co/t/how-force-index-level-for-raw-query/73190)

<div class="topic-metadata">

**Author:** [@rookie](https://discuss.elastic.co/u/rookie)\
**Replies:** 4\
**Last updated:** [January 31, 2017, 10:39pm UTC](https://discuss.elastic.co/t/how-force-index-level-for-raw-query/73190 "2017-01-31T22:39:49Z")

</div>

Hello I currently have a elasticsearch index like : logs-{ automate timestamp message } I have a query like { ""aggs"": { ""langs"": { ""terms"": {""field"": ""automate""}} } } …

---

## [Libbeat.kafka.published\_but\_not\_acked\_events](https://discuss.elastic.co/t/libbeat-kafka-published-but-not-acked-events/65446)

<div class="topic-metadata">

**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\
**Replies:** 4\
**Last updated:** [November 10, 2016, 12:54pm UTC](https://discuss.elastic.co/t/libbeat-kafka-published-but-not-acked-events/65446 "2016-11-10T12:54:19Z")

</div>

my filebeat config file: filebeat: prospectors: - paths: - /var/log/xyz.log document\_type: log fields: {log\_type: log1} - paths: - /var/log/abc.log document\_type: l…

---

## [What would happend if filebeat couldn't reach elasticsearch](https://discuss.elastic.co/t/what-would-happend-if-filebeat-couldnt-reach-elasticsearch/53871)

<div class="topic-metadata">

**Author:** [@Arvin2015](https://discuss.elastic.co/u/Arvin2015)\
**Replies:** 4\
**Last updated:** [June 28, 2016, 4:19am UTC](https://discuss.elastic.co/t/what-would-happend-if-filebeat-couldnt-reach-elasticsearch/53871 "2016-06-28T04:19:17Z")

</div>

what would happend if filebeat couldn't reach elasticsearch? filebeat couldn't reach elasticsearch for a while, and then my server which is running filebeat reported CPU alert to me, filebeat used about 60% CPU usage, ho…

---

## [Logstash failing to connect with Elasticsearch and file input plugin crashes](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487)

<div class="topic-metadata">

**Author:** [@Vanguard\_space](https://discuss.elastic.co/u/Vanguard_space)\
**Replies:** 4\
**Last updated:** [November 25, 2015, 6:37am UTC](https://discuss.elastic.co/t/logstash-failing-to-connect-with-elasticsearch-and-file-input-plugin-crashes/35487 "2015-11-25T06:37:02Z")

</div>

I am trying to read a .txt file into Logstash and then grok parse it into ES. I am encountering this error: {:timestamp=\>"2015-11-24T20:46:44.957000+0000", :message=\>"A plugin had an unrecoverable error. Will restart…

---

## [Group by field and then sum the groups](https://discuss.elastic.co/t/group-by-field-and-then-sum-the-groups/19103)

<div class="topic-metadata">

**Author:** [@Cameron\_Barker](https://discuss.elastic.co/u/Cameron_Barker)\
**Replies:** 4\
**Last updated:** [August 6, 2014, 4:19pm UTC](https://discuss.elastic.co/t/group-by-field-and-then-sum-the-groups/19103 "2014-08-06T16:19:39Z")

</div>

Hi all, I have an elastic database of posts, each post has a \*user\_id\* and has \*likes\* field. My goal is to output for a query how many likes in total each user has. I wondered if any one had any advice/direct…

---

## [Parsing logs using Regex pattern in logstash filter](https://discuss.elastic.co/t/parsing-logs-using-regex-pattern-in-logstash-filter/288117)

<div class="topic-metadata">

**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Replies:** 2\
**Last updated:** [November 12, 2021, 6:53am UTC](https://discuss.elastic.co/t/parsing-logs-using-regex-pattern-in-logstash-filter/288117 "2021-11-12T06:53:22Z")

</div>

Hi, I am using logstash to ingest data into the Elasticsearch using a txt file. I build a regex query to extract msg-id field from the logs, but msg-id field is not getting extracted though the regex query is working f…

---

## [Wildcards in Field Names (e.g \*.ip, \*.hostname)](https://discuss.elastic.co/t/wildcards-in-field-names-e-g-ip-hostname/188077)

<div class="topic-metadata">

**Author:** [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)\
**Replies:** 2\
**Last updated:** [June 28, 2019, 5:33pm UTC](https://discuss.elastic.co/t/wildcards-in-field-names-e-g-ip-hostname/188077 "2019-06-28T17:33:17Z")

</div>

In a webinar - Elastic Common Schema for Cyber Threat Hunting, I see @mikepaq using wildcards in fields within Kibana. When I try this within my setup (6.2), I get shard errors, with no results found. Thanks for yo…

---

## [Shard size is different between primary and replica](https://discuss.elastic.co/t/shard-size-is-different-between-primary-and-replica/150079)

<div class="topic-metadata">

**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\
**Replies:** 2\
**Last updated:** [September 28, 2018, 8:59pm UTC](https://discuss.elastic.co/t/shard-size-is-different-between-primary-and-replica/150079 "2018-09-28T20:59:15Z")

</div>

We have an index that is divided in 10 primary shards (with 1 replica per shard, so we have 20 in total). I expected the shards to have roughly the same size, so I plotted a histogram with them: There are 3 shards th…

---

## [Message not proper showing in elastic after index](https://discuss.elastic.co/t/message-not-proper-showing-in-elastic-after-index/104329)

<div class="topic-metadata">

**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\
**Replies:** 2\
**Last updated:** [October 18, 2017, 6:41am UTC](https://discuss.elastic.co/t/message-not-proper-showing-in-elastic-after-index/104329 "2017-10-18T06:41:37Z")

</div>

I transfer data from mysql to kafka using logstash and from kafak to elastic....result is not showing properly.... my conf files are given below: consumer conf file \[consumer\] \[resultshow\]

---

## [Explicit Order of Terms in Bar Chart](https://discuss.elastic.co/t/explicit-order-of-terms-in-bar-chart/55207)

<div class="topic-metadata">

**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\
**Replies:** 2\
**Last updated:** [July 11, 2016, 10:21pm UTC](https://discuss.elastic.co/t/explicit-order-of-terms-in-bar-chart/55207 "2016-07-11T22:21:12Z")

</div>

I'm using ELK to monitor Cache Servers and have stacked bar graphs that represent a count based on cache hits, misses and expires. I want to order them so that they are stacked: hits, misses, expires. The problem is that…

---

## [Distinct key value pairs](https://discuss.elastic.co/t/distinct-key-value-pairs/15759)

<div class="topic-metadata">

**Author:** [@atoomkern](https://discuss.elastic.co/u/atoomkern)\
**Replies:** 2\
**Last updated:** [February 13, 2014, 4:38pm UTC](https://discuss.elastic.co/t/distinct-key-value-pairs/15759 "2014-02-13T16:38:47Z")

</div>

I would like to be able to search all fields for a certain string and get all distinct matching key value pairs as a result. It should also be possible to add filters/queries to constrain the results. The original…

---

## [Disable adding filter upon click on a bar chart](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350)

<div class="topic-metadata">

**Author:** [@kasun](https://discuss.elastic.co/u/kasun)\
**Replies:** 3\
**Last updated:** [March 16, 2021, 12:47pm UTC](https://discuss.elastic.co/t/disable-adding-filter-upon-click-on-a-bar-chart/267350 "2021-03-16T12:47:40Z")

</div>

Hi all, In above chart when I click on bars it will automatically add a filter to the entire dashboard. As an example when I click on the first bar it will add a filter as in below. Is there a way to disable this …

---

## [Execute Cosine Similarity inside script\_score function if field is present in the document](https://discuss.elastic.co/t/execute-cosine-similarity-inside-script-score-function-if-field-is-present-in-the-document/253006)

<div class="topic-metadata">

**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\
**Replies:** 3\
**Last updated:** [November 20, 2020, 10:56am UTC](https://discuss.elastic.co/t/execute-cosine-similarity-inside-script-score-function-if-field-is-present-in-the-document/253006 "2020-11-20T10:56:10Z")

</div>

I am trying to use cosine similarity in script\_score function. The query is breaking when the dense vector field is missing in the document against which I am trying to measure similarity is missing. I spent a lot of ti…

---

## [Kibana plugin helpers error](https://discuss.elastic.co/t/kibana-plugin-helpers-error/250923)

<div class="topic-metadata">

**Author:** [@K\_Chaitanya](https://discuss.elastic.co/u/K_Chaitanya)\
**Replies:** 3\
**Last updated:** [October 9, 2020, 4:39am UTC](https://discuss.elastic.co/t/kibana-plugin-helpers-error/250923 "2020-10-09T04:39:14Z")

</div>

Hi, I developed a kibana plugin for kibana version 7.9.0. I setup the development environment following this. Now I want to generate the zip of the developed plugin. I tried follow the steps mentioned here but while ru…

---

## [Increase disk allocation for Elastic Search on linux](https://discuss.elastic.co/t/increase-disk-allocation-for-elastic-search-on-linux/242470)

<div class="topic-metadata">

**Author:** [@rao7806](https://discuss.elastic.co/u/rao7806)\
**Replies:** 3\
**Last updated:** [July 24, 2020, 10:00am UTC](https://discuss.elastic.co/t/increase-disk-allocation-for-elastic-search-on-linux/242470 "2020-07-24T10:00:19Z")

</div>

We are trying to index large datasets to elastic search and indexing is stopped due to watermark reached and nodes are set to read-only. We ran the command GET /\_cat/allocation?v and from the output, we came to know t…

---

## [TSVB markdown Dates](https://discuss.elastic.co/t/tsvb-markdown-dates/215916)

<div class="topic-metadata">

**Author:** [@Mack\_rogers](https://discuss.elastic.co/u/Mack_rogers)\
**Replies:** 3\
**Last updated:** [January 24, 2020, 8:15am UTC](https://discuss.elastic.co/t/tsvb-markdown-dates/215916 "2020-01-24T08:15:42Z")

</div>

Has anyone solved rendering dates in TSVB visualization? ( Time Series Visual Builder) Any field that was inputted as type: "date" with multiple random dates values. I only want 1 date shown just like the text field "id"…

---

## [Trying to use Aggregate, "Fielddata is disabled on text fields by default. Set fielddata=true"](https://discuss.elastic.co/t/trying-to-use-aggregate-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true/173259)

<div class="topic-metadata">

**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\
**Replies:** 3\
**Last updated:** [March 21, 2019, 9:39am UTC](https://discuss.elastic.co/t/trying-to-use-aggregate-fielddata-is-disabled-on-text-fields-by-default-set-fielddata-true/173259 "2019-03-21T09:39:10Z")

</div>

ElasticSearch version: 6.6 Language: PHP Hello and good day! I'm using Laravel PHP Framework and ElasticSearch as our database / search engine. In my Index, I'm trying to get a list of Authors who had produced the mos…

---

## [Logstash input jdbc](https://discuss.elastic.co/t/logstash-input-jdbc/33831)

<div class="topic-metadata">

**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\
**Replies:** 3\
**Last updated:** [June 23, 2016, 2:25pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc/33831 "2016-06-23T14:25:33Z")

</div>

file: contacts-index-logstash.conf input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@//192.168.54.74:1521/od6oracle" jdbc\_user =\> "od6oracle" jdbc\_password =\> "od6oracle" jd…

---

## [Why ESQL so slow compared to KQL - Please inform how to optimize](https://discuss.elastic.co/t/why-esql-so-slow-compared-to-kql-please-inform-how-to-optimize/373514)

<div class="topic-metadata">

**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\
**Replies:** 3\
**Last updated:** [February 11, 2025, 2:27pm UTC](https://discuss.elastic.co/t/why-esql-so-slow-compared-to-kql-please-inform-how-to-optimize/373514 "2025-02-11T14:27:10Z")

</div>

Hi I convert lots of old KQL to ESQL, mainly because it is easier to understand and I'm and old Splunker used to the pipeline there :slight\_smile: but ESQL queries are so much slower, How can I optimize?, I tried adding…

---

## [\[Population Job\]: port scanner](https://discuss.elastic.co/t/population-job-port-scanner/260870)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 2\
**Last updated:** [January 13, 2021, 4:51pm UTC](https://discuss.elastic.co/t/population-job-port-scanner/260870 "2021-01-13T16:51:23Z")

</div>

Hello everybody, I would like to create a machine learning job to detect port scanner so I have configured my job like that: Job Type: Population Population field: destination.ip Add metric: Distinct count(destinati…

---

## [\[Vega Map\] How to get geoshapes from elasticsearch index coordinates](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677)

<div class="topic-metadata">

**Author:** [@lehti](https://discuss.elastic.co/u/lehti)\
**Replies:** 5\
**Last updated:** [October 7, 2021, 2:10pm UTC](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677 "2021-10-07T14:10:31Z")

</div>

Hi! I need to make a map using Vega-visualization. The coordinates come from an Elasticsearch index. I can load the index into Vega just fine. The issue is that I have no idea how to get Vega to understand the coordinat…

[Previous page](https://discuss.elastic.co/top.md?page=1066&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1068&per_page=50&period=all)
