# Top **URL:** https://discuss.elastic.co/top.md?page=1090&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1091 --- ## [Rotate index every other day](https://discuss.elastic.co/t/rotate-index-every-other-day/42497)
**Author:** [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\ **Replies:** 4\ **Last updated:** [February 25, 2016, 3:20pm UTC](https://discuss.elastic.co/t/rotate-index-every-other-day/42497 "2016-02-25T15:20:26Z")
Hello Guys, I'm using logstash 2.2, in a Centos 6. Logstash rotates the indices each day, is there any way to rotate index every 2 days or 3 days?. Or rotate the index by size?. I must save and keep open the index … --- ## [Changing the timezone does not change how far the logs are from the current time](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753)
**Author:** [@Hemabh\_Ravee\_Fox](https://discuss.elastic.co/u/Hemabh_Ravee_Fox)\ **Replies:** 6\ **Last updated:** [November 30, 2022, 3:41pm UTC](https://discuss.elastic.co/t/changing-the-timezone-does-not-change-how-far-the-logs-are-from-the-current-time/319753 "2022-11-30T15:41:55Z")
I am using a locally deployed elasticsearch and kibana. When I send data to an index with the current timestamp - in kibana it is displayed as being 5:30 hours ahead of the current time. I came to understand that this i… --- ## [Logstash csv filter plugin, with mariadb audit plugin logs](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953)
**Author:** [@fabrizio73](https://discuss.elastic.co/u/fabrizio73)\ **Replies:** 6\ **Last updated:** [July 30, 2020, 5:29pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-plugin-with-mariadb-audit-plugin-logs/242953 "2020-07-30T17:29:32Z")
Hi, we are develeping our log management ELK Platform, and we managed almost everything we need in order to get logs with filebeat from percona, mariadb, ssh and SAMBA4 ADC access. The only issue we are facing is that lo… --- ## [Copying elastic indexes](https://discuss.elastic.co/t/copying-elastic-indexes/140106)
**Author:** [@safhw91](https://discuss.elastic.co/u/safhw91)\ **Replies:** 6\ **Last updated:** [July 17, 2018, 5:27am UTC](https://discuss.elastic.co/t/copying-elastic-indexes/140106 "2018-07-17T05:27:08Z")
Hi, \*edit So we can copy the \\elastic\\data\\nodes\\ folder manually from one machine to another after shutting down, other sources confirm that this should work but is unsupproted. But this is a 1-off copy. Can we contin… --- ## [Multiple elasticsearch-data Volumes](https://discuss.elastic.co/t/multiple-elasticsearch-data-volumes/230972)
**Author:** [@taseer94](https://discuss.elastic.co/u/taseer94)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 9:57am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-data-volumes/230972 "2020-05-07T09:57:47Z")
Hi everyone, I have 3 azure disks which I would like to have the cluster store data to. I want to have a 3 node cluster, each attached to a separate disk. My current config is as follows. However, all the 3 volumes get … --- ## [Filebeat not reading the already processed log file again](https://discuss.elastic.co/t/filebeat-not-reading-the-already-processed-log-file-again/177171)
**Author:** [@SManorathna](https://discuss.elastic.co/u/SManorathna)\ **Replies:** 2\ **Last updated:** [April 19, 2019, 4:47am UTC](https://discuss.elastic.co/t/filebeat-not-reading-the-already-processed-log-file-again/177171 "2019-04-19T04:47:28Z")
Hi, I am reading a .log file using filebeat and I need the data to be output to the elasticsearch. This is my filebeat configuration #=========================== Filebeat inputs ============================= filebeat.… --- ## [Trying to run tests from the test suite](https://discuss.elastic.co/t/trying-to-run-tests-from-the-test-suite/131579)
**Author:** [@matth](https://discuss.elastic.co/u/matth)\ **Replies:** 2\ **Last updated:** [May 12, 2018, 8:13pm UTC](https://discuss.elastic.co/t/trying-to-run-tests-from-the-test-suite/131579 "2018-05-12T20:13:02Z")
I'm just getting into the source code from elastic search. However, I can not seem to be able to run the test suite. This is one example of the command I ran. I tried some different classes or methods but all of them gav… --- ## [Elasticsearch 5.1.1 simple integration test hangs running gradle test](https://discuss.elastic.co/t/elasticsearch-5-1-1-simple-integration-test-hangs-running-gradle-test/70485)
**Author:** [@jtruty](https://discuss.elastic.co/u/jtruty)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-5-1-1-simple-integration-test-hangs-running-gradle-test/70485 "2017-01-05T14:48:53Z")
Following the docs and just extending ESIntegTestCase with one noop @Test, gradle test hangs for me after running a single test. I am using gradle 2.13. Running a thread dump on the gradle process is not helpful. --- ## [Automatically watching a topic I've posted to](https://discuss.elastic.co/t/automatically-watching-a-topic-ive-posted-to/55779)
**Author:** [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Replies:** 2\ **Last updated:** [July 18, 2016, 10:44pm UTC](https://discuss.elastic.co/t/automatically-watching-a-topic-ive-posted-to/55779 "2016-07-18T22:44:06Z")
Hi, Currently, whenever I post to a topic, I get notified via email if someone else replies to my post. If a post is not in reply to my post, I don't get the email notification. I'd like to receive email notification… --- ## [JSON log format](https://discuss.elastic.co/t/json-log-format/45567)
**Author:** [@Mykolaichenko](https://discuss.elastic.co/u/Mykolaichenko)\ **Replies:** 2\ **Last updated:** [March 30, 2016, 4:02pm UTC](https://discuss.elastic.co/t/json-log-format/45567 "2016-03-30T16:02:48Z")
Hi! I have filebeat, logstash and json log format in application. It looks like this: {"timestamp":1459152943492,"date":"Mar 28, 2016 10:15:43 AM","hostname":"hostname","username":"tomcat","level":"INFO","thread":"Si… --- ## [Multiple logstash instances reading the same files](https://discuss.elastic.co/t/multiple-logstash-instances-reading-the-same-files/38220)
**Author:** [@asphaltsurfer](https://discuss.elastic.co/u/asphaltsurfer)\ **Replies:** 2\ **Last updated:** [January 4, 2016, 4:16pm UTC](https://discuss.elastic.co/t/multiple-logstash-instances-reading-the-same-files/38220 "2016-01-04T16:16:00Z")
Hi guys! My problem: I have single NAS logs share connected to my application nodes, and logstash node. One logstash instance is reading logfiles, parsing and shipping to ES. Now, I want to add failover to logstash by … --- ## [Creating integration tests with Elastic.net and Nest](https://discuss.elastic.co/t/creating-integration-tests-with-elastic-net-and-nest/37544)
**Author:** [@SeanFarrow](https://discuss.elastic.co/u/SeanFarrow)\ **Replies:** 2\ **Last updated:** [December 20, 2015, 9:04pm UTC](https://discuss.elastic.co/t/creating-integration-tests-with-elastic-net-and-nest/37544 "2015-12-20T21:04:58Z")
Hi, I am in the process of writing an application using Elastic, using the .net clients. I am trying to do some integration testing and having looked at the source code am wondering how the NEST integration tests spin … --- ## [Using Environment Variables in Elastic Synthetics](https://discuss.elastic.co/t/using-environment-variables-in-elastic-synthetics/334997)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 8\ **Last updated:** [June 5, 2023, 1:40pm UTC](https://discuss.elastic.co/t/using-environment-variables-in-elastic-synthetics/334997 "2023-06-05T13:40:50Z")
TL;DR How do I force Elastic Synthetics to use environment variables defined in the pod environment? Use Case I am in the process of migrating our synthetic monitoring framework to Elastic Synthetics. I'm currently usin… --- ## [Reduce number of segments to speed up ANN search](https://discuss.elastic.co/t/reduce-number-of-segments-to-speed-up-ann-search/330584)
**Author:** [@Therese\_Persson](https://discuss.elastic.co/u/Therese_Persson)\ **Replies:** 8\ **Last updated:** [May 30, 2023, 5:43pm UTC](https://discuss.elastic.co/t/reduce-number-of-segments-to-speed-up-ann-search/330584 "2023-05-30T17:43:54Z")
Hi, We have an ES index with a dense\_vector field containing approx. 2.5 M documents which we use for ANN search. The embedding dimension is 512. We experience a very uneven search performance, it often takes \>20 s for … --- ## [Watcher for nodes in elasticsearch](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 8\ **Last updated:** [February 9, 2022, 5:29pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387 "2022-02-09T17:29:17Z")
Hello guys This I my first time working with watchers. Can anyone help me with building watcher for all Elasticsearch nodes are running or stopped that is we should get alert when the node is stopped or started. I nee… --- ## [REINDEX : identify fields to remove with a regular expression?](https://discuss.elastic.co/t/reindex-identify-fields-to-remove-with-a-regular-expression/295275)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 8\ **Last updated:** [February 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/reindex-identify-fields-to-remove-with-a-regular-expression/295275 "2022-02-01T13:03:24Z")
Hello. Here's the situation. A source shipping logs to our cluster has messed up and sent us a large number of documents containing undesirable fields. The thing is that the fields names are almost random, there is no w… --- ## [Calculate on nested field, got wrong result , any advice will be appreciated](https://discuss.elastic.co/t/calculate-on-nested-field-got-wrong-result-any-advice-will-be-appreciated/124985)
**Author:** [@small-tomorrow](https://discuss.elastic.co/u/small-tomorrow)\ **Replies:** 3\ **Last updated:** [March 23, 2018, 8:05am UTC](https://discuss.elastic.co/t/calculate-on-nested-field-got-wrong-result-any-advice-will-be-appreciated/124985 "2018-03-23T08:05:31Z")
with query conditions, I filtered out only one doc, part of the doc \_source is : "\_source": { "event": \[ { "time": 1520252057459, "duration": 1… --- ## [Using tribe node for federation between Elasticsearch clusters](https://discuss.elastic.co/t/using-tribe-node-for-federation-between-elasticsearch-clusters/37952)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 3\ **Last updated:** [December 25, 2015, 8:35pm UTC](https://discuss.elastic.co/t/using-tribe-node-for-federation-between-elasticsearch-clusters/37952 "2015-12-25T20:35:43Z")
I have two elastic search clusters ( distributed in two physical sites ). These clusters are working fine with logstash and kibana individually. For now, I am trying to replicate this in a single machine. Each of the cl… --- ## [Lowercase Field Name](https://discuss.elastic.co/t/lowercase-field-name/219987)
**Author:** [@akeslo](https://discuss.elastic.co/u/akeslo)\ **Replies:** 1\ **Last updated:** [February 20, 2020, 6:57am UTC](https://discuss.elastic.co/t/lowercase-field-name/219987 "2020-02-20T06:57:43Z")
Hi All, How do I rename a field name so that it is in all lowercase? The field name is utilizing a value from another field (cs2Label is uppercase and I'd like to convert it to lowercase before I rename the field): mu… --- ## [How to extract .zip files in Logstash?](https://discuss.elastic.co/t/how-to-extract-zip-files-in-logstash/92545)
**Author:** [@g\_dev](https://discuss.elastic.co/u/g_dev)\ **Replies:** 1\ **Last updated:** [July 11, 2017, 2:40am UTC](https://discuss.elastic.co/t/how-to-extract-zip-files-in-logstash/92545 "2017-07-11T02:40:01Z")
How to extract .zip files in Logstash? .zip files have 3 .xml files and I want to apply different filters to the different files. --- ## [Filebeat not detecting all changes made to csv File](https://discuss.elastic.co/t/filebeat-not-detecting-all-changes-made-to-csv-file/137908)
**Author:** [@ganessen23](https://discuss.elastic.co/u/ganessen23)\ **Replies:** 5\ **Last updated:** [June 29, 2018, 12:59pm UTC](https://discuss.elastic.co/t/filebeat-not-detecting-all-changes-made-to-csv-file/137908 "2018-06-29T12:59:49Z")
Hello, I am facing difficulties over Filebeat. My present scenario is that I am using Filebeat (installed in a windows server) to send data (in csv File format) to Logstash and finally to Elasticsearch (both tools inst… --- ## [Read a constantly overwritten file](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 5\ **Last updated:** [February 23, 2017, 10:23am UTC](https://discuss.elastic.co/t/read-a-constantly-overwritten-file/76177 "2017-02-23T10:23:04Z")
I am currently reading a log file to parse it and send the parsed fields to elasticsearch. The problem that I am facing now is that new lines are constantly being appended to the log file. I have ran into situations wh… --- ## [Logstash with elasticsearch input and output keep looping results forever](https://discuss.elastic.co/t/logstash-with-elasticsearch-input-and-output-keep-looping-results-forever/169632)
**Author:** [@ksemaev](https://discuss.elastic.co/u/ksemaev)\ **Replies:** 2\ **Last updated:** [February 22, 2019, 9:17pm UTC](https://discuss.elastic.co/t/logstash-with-elasticsearch-input-and-output-keep-looping-results-forever/169632 "2019-02-22T21:17:49Z")
The issue is absolutely equal to https://discuss.elastic.co/t/logstash-with-elasticsearch-input-and-output-keep-looping-results/115031 I have one elastic index as input, and another as output. I've played with scroll an… --- ## [Problem with Prometheus Module](https://discuss.elastic.co/t/problem-with-prometheus-module/188332)
**Author:** [@D.B](https://discuss.elastic.co/u/D.B)\ **Replies:** 1\ **Last updated:** [July 3, 2019, 9:30am UTC](https://discuss.elastic.co/t/problem-with-prometheus-module/188332 "2019-07-03T09:30:19Z")
Hey all, I am currently making a POC with Metricbeat. My goal is to scrape Pormetheus metrics and send them over to the ELK Stack. Currently I am running into an Error, which I can not solve, namely "Unable to decode r… --- ## [How to set timezone on index using rest-api](https://discuss.elastic.co/t/how-to-set-timezone-on-index-using-rest-api/157007)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 1\ **Last updated:** [November 16, 2018, 8:47am UTC](https://discuss.elastic.co/t/how-to-set-timezone-on-index-using-rest-api/157007 "2018-11-16T08:47:54Z")
I try to set the timezone on the @timestamp index as we do in logstash: 20181116091132.106 - root:139 - ERROR - put index 'proxylogs-mb-pc-2018-10-16' with data:'{ "mappings": { "proxylog": { "pr… --- ## [Packetloss - is this number bad or not?](https://discuss.elastic.co/t/packetloss-is-this-number-bad-or-not/116883)
**Author:** [@rdehuyss](https://discuss.elastic.co/u/rdehuyss)\ **Replies:** 1\ **Last updated:** [January 24, 2018, 4:19pm UTC](https://discuss.elastic.co/t/packetloss-is-this-number-bad-or-not/116883 "2018-01-24T16:19:05Z")
We have installed metricbeat on our virtual windows elastic servers and are measuring network traffic (customer decision to work on virtual windows servers). We have the following packet loss on one machine: \[2018-01-2… --- ## [How to limit filebeat logs to logstash](https://discuss.elastic.co/t/how-to-limit-filebeat-logs-to-logstash/97504)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 1\ **Last updated:** [August 18, 2017, 12:11pm UTC](https://discuss.elastic.co/t/how-to-limit-filebeat-logs-to-logstash/97504 "2017-08-18T12:11:54Z")
Hi, i am sending our production logs to logstash cluster which has 6 server in cluster. In my filebeat setting i have number of workers as 2 . So 12 pipelines to logstash cluster each prod server. But sometimes due to … --- ## [Watchguard firewall on ingestion manager](https://discuss.elastic.co/t/watchguard-firewall-on-ingestion-manager/249482)
**Author:** [@JLT](https://discuss.elastic.co/u/JLT)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 1:49pm UTC](https://discuss.elastic.co/t/watchguard-firewall-on-ingestion-manager/249482 "2020-09-22T13:49:05Z")
The ingestion manager was long due and i am quite pleased with what i see. For this client there is a request to on-board watchguard devices, can i contribute to an effort of creating an ingestion profile for watchguard… --- ## [Timestamp from filename](https://discuss.elastic.co/t/timestamp-from-filename/154938)
**Author:** [@SusantaBN](https://discuss.elastic.co/u/SusantaBN)\ **Replies:** 2\ **Last updated:** [November 1, 2018, 7:58pm UTC](https://discuss.elastic.co/t/timestamp-from-filename/154938 "2018-11-01T19:58:18Z")
I have a requirement to put the timestamp on log file name and subsequently extract the timestamp from filename and add as a field in the elastic search index. e.g. file name: 2018-10-31\_13-11-25.33.csv My custom grok … --- ## [Heartbeat - verify tcp ports failed with timeout and socket error](https://discuss.elastic.co/t/heartbeat-verify-tcp-ports-failed-with-timeout-and-socket-error/104130)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 2\ **Last updated:** [October 20, 2017, 11:08am UTC](https://discuss.elastic.co/t/heartbeat-verify-tcp-ports-failed-with-timeout-and-socket-error/104130 "2017-10-20T11:08:10Z")
I am trying to check the status of TCP ports of servers from Hearbeat client. I am getting 4 output responses in kibana, three are showing status as false and one status is true. Initially it has failed due to timeout a… --- ## [Unable to find in Java Client API ES 8.7 replacement of fieldsAndWeights in QueryStringQueryBuilder of earlier version](https://discuss.elastic.co/t/unable-to-find-in-java-client-api-es-8-7-replacement-of-fieldsandweights-in-querystringquerybuilder-of-earlier-version/336285)
**Author:** [@ramyogi](https://discuss.elastic.co/u/ramyogi)\ **Replies:** 4\ **Last updated:** [June 19, 2023, 12:20am UTC](https://discuss.elastic.co/t/unable-to-find-in-java-client-api-es-8-7-replacement-of-fieldsandweights-in-querystringquerybuilder-of-earlier-version/336285 "2023-06-19T00:20:16Z")
Before ES 8 we were using below query. final BoolQueryBuilder expectedBooleanQuery = QueryBuilders.boolQuery(); expectedBooleanQuery.must( QueryBuilders.queryStringQuery("water") .defaultOperato… --- ## [Mutate Lowercase Issue](https://discuss.elastic.co/t/mutate-lowercase-issue/274247)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 4\ **Last updated:** [May 27, 2021, 7:46pm UTC](https://discuss.elastic.co/t/mutate-lowercase-issue/274247 "2021-05-27T19:46:09Z")
Hi, I'm running Logstash 7.3 and I actually face an issue (or maybe I didn't write the filter correctly) when I apply a lowercase to a new field. The base field is always lowered too. First, I tried this: filter { … --- ## [logstashのFile output pluginにおけるファイルロックについて](https://discuss.elastic.co/t/logstash-file-output-plugin/242689)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 4\ **Last updated:** [August 20, 2020, 4:50am UTC](https://discuss.elastic.co/t/logstash-file-output-plugin/242689 "2020-08-20T04:50:07Z")
お世話になります。 logstashのFile output pluginにおいて、ファイル出力中のファイルロックの仕様はどのようになっているのでしょうか？ （調べてみたものの、情報を見つけることができませんでした） 具体的にやろうとしていることは、Logstashで出力したファイルをシェルなどで定期的にgzipコマンドで圧縮して後続処理へ渡すようなことを考えております。 この際に、inputが不定期で行われるため、ファイル出力… --- ## [Elasticsearch upgrade stuck - Skipping deletion because of migrating](https://discuss.elastic.co/t/elasticsearch-upgrade-stuck-skipping-deletion-because-of-migrating/213568)
**Author:** [@pabloborh](https://discuss.elastic.co/u/pabloborh)\ **Replies:** 4\ **Last updated:** [January 7, 2020, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-stuck-skipping-deletion-because-of-migrating/213568 "2020-01-07T08:39:47Z")
Hello, I've modified request, limits and xms xmx Java options of my cluster yaml. The upgrade is stuck and operators logs are {"level":"info","ts":1577967197.4311237,"logger":"elasticsearch-controller","msg":"Updatin… --- ## [Extract edges between terms of a field based on another field\[s\]](https://discuss.elastic.co/t/extract-edges-between-terms-of-a-field-based-on-another-field-s/57415)
**Author:** [@mvadood](https://discuss.elastic.co/u/mvadood)\ **Replies:** 4\ **Last updated:** [August 10, 2016, 6:59pm UTC](https://discuss.elastic.co/t/extract-edges-between-terms-of-a-field-based-on-another-field-s/57415 "2016-08-10T18:59:09Z")
I illustrate my question with an example. Assume having a type named "post". Each post has a userid field which indicates its author. This is how the post is stored: { "\_index": "test", "\_type": "post", "\_id":… --- ## [Machine learning tools or plugin for elasticsearch?](https://discuss.elastic.co/t/machine-learning-tools-or-plugin-for-elasticsearch/135301)
**Author:** [@komal\_mittal](https://discuss.elastic.co/u/komal_mittal)\ **Replies:** 3\ **Last updated:** [June 12, 2018, 12:34pm UTC](https://discuss.elastic.co/t/machine-learning-tools-or-plugin-for-elasticsearch/135301 "2018-06-12T12:34:13Z")
can somebody tell me about machine learning tools or plugin for elasticsearch which are open source and free?? --- ## [Search bar in embed mode](https://discuss.elastic.co/t/search-bar-in-embed-mode/124357)
**Author:** [@Sam12](https://discuss.elastic.co/u/Sam12)\ **Replies:** 3\ **Last updated:** [March 18, 2018, 9:29pm UTC](https://discuss.elastic.co/t/search-bar-in-embed-mode/124357 "2018-03-18T21:29:15Z")
Hello everyone, How can I add an search bar when kibana dashboard is setup in embed mode. Thanks Sam --- ## [Unable to take snapshot on S3](https://discuss.elastic.co/t/unable-to-take-snapshot-on-s3/107880)
**Author:** [@jogaco](https://discuss.elastic.co/u/jogaco)\ **Replies:** 3\ **Last updated:** [November 19, 2017, 10:08am UTC](https://discuss.elastic.co/t/unable-to-take-snapshot-on-s3/107880 "2017-11-19T10:08:21Z")
Latests days I am getting this error while running a snapshot on S3 repository: { "error" : { "root\_cause" : \[ { "type" : "amazon\_client\_exception", "reason" : "Unable to execute HTTP request: connect timed o… --- ## [Sort not working with nested query in elasticsearch](https://discuss.elastic.co/t/sort-not-working-with-nested-query-in-elasticsearch/5787)
**Author:** [@narinder\_izap](https://discuss.elastic.co/u/narinder_izap)\ **Replies:** 3\ **Last updated:** [November 7, 2011, 11:44am UTC](https://discuss.elastic.co/t/sort-not-working-with-nested-query-in-elasticsearch/5787 "2011-11-07T11:44:00Z")
I have been working on the nested query, and i need to sort the results, but as explained at http://www.elasticsearch.org/guide/reference/query-dsl/nested-query.html there is not dattribute for the sort, but i trie… --- ## [Logstash config question](https://discuss.elastic.co/t/logstash-config-question/157258)
**Author:** [@teichae](https://discuss.elastic.co/u/teichae)\ **Replies:** 6\ **Last updated:** [November 19, 2018, 8:08am UTC](https://discuss.elastic.co/t/logstash-config-question/157258 "2018-11-19T08:08:55Z")
Hi, guys. I have some questions about logstash setup. I want to use logstash to read the logs of our Tomcat through Kibana. However, due to misconfiguration, the multi-line is not being displayed. I need your help on… --- ## [Diagnosing a slow query](https://discuss.elastic.co/t/diagnosing-a-slow-query/19008)
**Author:** [@Christopher\_Ambler](https://discuss.elastic.co/u/Christopher_Ambler)\ **Replies:** 5\ **Last updated:** [August 2, 2014, 4:24pm UTC](https://discuss.elastic.co/t/diagnosing-a-slow-query/19008 "2014-08-02T16:24:23Z")
Okay, let's attack this directly. We have a cluster of 6 machines (6 nodes). We have an index of just under 3.5 million documents. Each document represents an Internet domain name. We are performing queries against t… --- ## [Documents size vs. indexing size?](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255)
**Author:** [@Denis\_Haskin](https://discuss.elastic.co/u/Denis_Haskin)\ **Replies:** 1\ **Last updated:** [June 2, 2022, 7:39pm UTC](https://discuss.elastic.co/t/documents-size-vs-indexing-size/306255 "2022-06-02T19:39:56Z")
We have an existing Kibana/Elastic setup ingesting logs from our infrastructure. I'm trying to determine what the actual documents size is, e.g. I want to exclude indices. Basically, what is the volume of logs coming o… --- ## [Pyspark write list type to ES](https://discuss.elastic.co/t/pyspark-write-list-type-to-es/43944)
**Author:** [@Joseph\_Gartner](https://discuss.elastic.co/u/Joseph_Gartner)\ **Replies:** 1\ **Last updated:** [March 12, 2016, 2:16pm UTC](https://discuss.elastic.co/t/pyspark-write-list-type-to-es/43944 "2016-03-12T14:16:56Z")
I'm attempting to write data to elasticsearch using pyspark. I can successfully write using the "saveAsNewAPIHadoopFile" api for most cases, however, when one of the json objects is a list, it throws an error: SparkExce… --- ## [How to handle fields containg ipv4 OR ipv6 (actually only ::1 - ie. localhost)?](https://discuss.elastic.co/t/how-to-handle-fields-containg-ipv4-or-ipv6-actually-only-1-ie-localhost/15840)
**Author:** [@Klavs\_Klavsen](https://discuss.elastic.co/u/Klavs_Klavsen)\ **Replies:** 1\ **Last updated:** [February 18, 2014, 3:23pm UTC](https://discuss.elastic.co/t/how-to-handle-fields-containg-ipv4-or-ipv6-actually-only-1-ie-localhost/15840 "2014-02-18T15:23:00Z")
elasticsearch seems to go bananas when it gets data set to be ip - but containing "::1".. :( I can see that the IP type does not support ipv6 yet.. but I would like to be able to do range stuff on ip's.. Is th… --- ## [Very High Cpu Usage for search](https://discuss.elastic.co/t/very-high-cpu-usage-for-search/352110)
**Author:** [@bharat\_bhushan\_ship](https://discuss.elastic.co/u/bharat_bhushan_ship)\ **Replies:** 8\ **Last updated:** [February 16, 2024, 6:14pm UTC](https://discuss.elastic.co/t/very-high-cpu-usage-for-search/352110 "2024-02-16T18:14:44Z")
I have a cluster (ES version 7.0.3) with 3 nodes with ubuntu servers and i have not declare any node as a master or data node, by default it elect one master and other data nodes itself. And i have only one index on this… --- ## [Question regarding question 4 of the Observability practice exam](https://discuss.elastic.co/t/question-regarding-question-4-of-the-observability-practice-exam/269388)
**Author:** [@EvanKara](https://discuss.elastic.co/u/EvanKara)\ **Replies:** 8\ **Last updated:** [April 22, 2021, 1:45am UTC](https://discuss.elastic.co/t/question-regarding-question-4-of-the-observability-practice-exam/269388 "2021-04-22T01:45:39Z")
Hi All, I am attempting question 4 of the practice exam, and am stuck on how to use the dissect processor to escape the "\\t" character: The Input sample pipeline document is as follows: { "\_source": { "message": "2020… --- ## [Watcher is throwing timeout\_exception](https://discuss.elastic.co/t/watcher-is-throwing-timeout-exception/278514)
**Author:** [@JF\_LTQ](https://discuss.elastic.co/u/JF_LTQ)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 10:41am UTC](https://discuss.elastic.co/t/watcher-is-throwing-timeout-exception/278514 "2021-07-13T10:41:49Z")
Hello, We've been having some issues with watchers throwing timeout exceptions: "result": { "execution\_time": "2021-07-13T07:45:00.144Z", "execution\_duration": 60004, "input": { "type": "search", … --- ## [SNMP Trap listener died](https://discuss.elastic.co/t/snmp-trap-listener-died/49376)
**Author:** [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 3:02am UTC](https://discuss.elastic.co/t/snmp-trap-listener-died/49376 "2016-05-09T03:02:38Z")
I use snmp trap input plugin to import log from switch.This is my logstash config input { snmptrap { type =\> "snmptrap" port =\> 162 host =\> "192.168.1.254" community =\> "cisco" yamlmibdir =\> "/opt/logstash/vendor/… --- ## [Problem with Filebeat and Kafka](https://discuss.elastic.co/t/problem-with-filebeat-and-kafka/202988)
**Author:** [@saisimo02](https://discuss.elastic.co/u/saisimo02)\ **Replies:** 3\ **Last updated:** [October 11, 2019, 9:02pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-kafka/202988 "2019-10-11T21:02:54Z")
Hello, I have a problem with my configuration filebeat+kafka+logstash. I have a lot of files every minute and I am using kafka between filebeat and logstash to deal with that. Filebeat send an error message: 2019-10-… --- ## [Remove a Field using a wildcard on reindex](https://discuss.elastic.co/t/remove-a-field-using-a-wildcard-on-reindex/182448)
**Author:** [@hogbinj](https://discuss.elastic.co/u/hogbinj)\ **Replies:** 3\ **Last updated:** [May 26, 2019, 6:37pm UTC](https://discuss.elastic.co/t/remove-a-field-using-a-wildcard-on-reindex/182448 "2019-05-26T18:37:53Z")
I've done a foolish thing and created a large number of fields in the format "fingerprint.attachment\_5C6C2D4E000092B707F41EF1" : "Attachment 5C6C2D4E000092B707F41EF1.gif is an IMAGE and therfore NOT processed" I used … [Previous page](https://discuss.elastic.co/top.md?page=1089&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1091&per_page=50&period=all)