# Top **URL:** https://discuss.elastic.co/top.md?page=117&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 118 --- ## [Windows Module](https://discuss.elastic.co/t/windows-module/81122)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 12\ **Last updated:** [May 9, 2017, 6:25am UTC](https://discuss.elastic.co/t/windows-module/81122 "2017-05-09T06:25:11Z")
Hi Nicolas @ruflin Am trying to get the perfmon data using Beats. I saw it would be available with the future implementation as a Windows Module (https://www.elastic.co/guide/en/beats/metricbeat/master/metricbeat-dev-… --- ## [Dateparsefailure: change @timestamp to timestamp for apache php error log](https://discuss.elastic.co/t/dateparsefailure-change-timestamp-to-timestamp-for-apache-php-error-log/85403)
**Author:** [@PratapSingh](https://discuss.elastic.co/u/PratapSingh)\ **Replies:** 10\ **Last updated:** [May 12, 2017, 12:09pm UTC](https://discuss.elastic.co/t/dateparsefailure-change-timestamp-to-timestamp-for-apache-php-error-log/85403 "2017-05-12T12:09:24Z")
Hi , I am using apache error log where timestamp is as "Wed May 10 17:21:26.820378 2017" Sample log is provided below: Sample log: \[Wed May 10 17:21:26.820378 2017\] \[proxy\_fcgi:error\] \[pid 6803:tid 139780532639488\] … --- ## [How to form a cluster?](https://discuss.elastic.co/t/how-to-form-a-cluster/113892)
**Author:** [@Terry](https://discuss.elastic.co/u/Terry)\ **Replies:** 13\ **Last updated:** [January 10, 2018, 8:56am UTC](https://discuss.elastic.co/t/how-to-form-a-cluster/113892 "2018-01-10T08:56:26Z")
I have two nodes as below which belong to the same cluster elasticsearch. However, the number of nodes showing only 1 instead of 2. How to form a cluster? { "name" : "OANlHwb", "cluster\_name" : "elasticsearch", "clu… --- ## [Error in Winlogbeat logs](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 10\ **Last updated:** [July 19, 2018, 2:00pm UTC](https://discuss.elastic.co/t/error-in-winlogbeat-logs/140485 "2018-07-19T14:00:32Z")
Winlogbeat has been working fine for a week now, today I turned my computer on and it just wouldnt load todays logs. I checked the logs and this is what it says: 2018-07-18T09:32:27.192+0100 ERROR instance/beat.go:691 … --- ## [Collection and storage of information from netflow sources](https://discuss.elastic.co/t/collection-and-storage-of-information-from-netflow-sources/335759)
**Author:** [@BugS](https://discuss.elastic.co/u/BugS)\ **Replies:** 12\ **Last updated:** [July 16, 2023, 12:22pm UTC](https://discuss.elastic.co/t/collection-and-storage-of-information-from-netflow-sources/335759 "2023-07-16T12:22:10Z")
Hello everyone. Maybe it's a newbie question, but I have limited experience with ELK. Currently, I'm trying to use it as a netflow collector. I've configured everything according to the documentation, but I'm a bit conce… --- ## [Index PDF in Elastic App Search](https://discuss.elastic.co/t/index-pdf-in-elastic-app-search/248459)
**Author:** [@JorgeL-TI](https://discuss.elastic.co/u/JorgeL-TI)\ **Replies:** 15\ **Last updated:** [October 2, 2020, 3:37pm UTC](https://discuss.elastic.co/t/index-pdf-in-elastic-app-search/248459 "2020-10-02T15:37:04Z")
Hello, I am using elastic App Search, and I want to index some PDF Documents with data such as title, writer, etc. Is there any option for index them directly (I know FSCRAWLER for Elastic Search)?? My second option … --- ## [Multi-field is not working](https://discuss.elastic.co/t/multi-field-is-not-working/8700)
**Author:** [@Bernd\_Fehling](https://discuss.elastic.co/u/Bernd_Fehling)\ **Replies:** 15\ **Last updated:** [August 13, 2012, 8:51am UTC](https://discuss.elastic.co/t/multi-field-is-not-working/8700 "2012-08-13T08:51:59Z")
I wonder why multi-field is not working. At first, ES is always setting "include\_in\_all" to false by its own. The ES guide for Multi Field Type isn't documenting this. Put mapping is: "myname" : { "type" : "m… --- ## [JVM heap spikes on data node](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 10\ **Last updated:** [April 28, 2021, 7:39am UTC](https://discuss.elastic.co/t/jvm-heap-spikes-on-data-node/270870 "2021-04-28T07:39:56Z")
Hello, I'm not really educated in this topic, but when I first saw this log in our logstash: \[2021-04-15T14:11:47,605\]\[INFO \]\[logstash.outputs.elasticsearch\]\[beats-monitoring-crypto\]\[3228c43cca49b666651ceb4c7945f188f5… --- ## [Replica allocation awareness](https://discuss.elastic.co/t/replica-allocation-awareness/197491)
**Author:** [@JacovanZyl](https://discuss.elastic.co/u/JacovanZyl)\ **Replies:** 14\ **Last updated:** [September 2, 2019, 1:33pm UTC](https://discuss.elastic.co/t/replica-allocation-awareness/197491 "2019-09-02T13:33:55Z")
Hi there Does cluster routing awareness route replicas based on number data nodes as default if routing attribute is not set specifically in the elasticsearch.yml? I only set an attribute to differentiate between hot/w… --- ## [Elastic SIEM. Security rules doesn't work](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094)
**Author:** [@Dmitriy\_Esin](https://discuss.elastic.co/u/Dmitriy_Esin)\ **Replies:** 11\ **Last updated:** [November 29, 2021, 7:58pm UTC](https://discuss.elastic.co/t/elastic-siem-security-rules-doesnt-work/290094 "2021-11-29T19:58:38Z")
Hi all! I have an issue with the Elastic Security Rules. I've installed the elastic agents on my target instances: I can successfully see its data streams: I've created default enrolment policy for my agents: … --- ## [Apply grok pattern based on logfile name](https://discuss.elastic.co/t/apply-grok-pattern-based-on-logfile-name/216901)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 10\ **Last updated:** [January 29, 2020, 4:21pm UTC](https://discuss.elastic.co/t/apply-grok-pattern-based-on-logfile-name/216901 "2020-01-29T16:21:59Z")
Under one index I have multiple log files and one of those log file will use a different grok format than the other three log files. How can I apply grok pattern based on if statement on file name? For example, - type: … --- ## [Heavy load on one node (1 index)](https://discuss.elastic.co/t/heavy-load-on-one-node-1-index/7034)
**Author:** [@John\_Cwikla](https://discuss.elastic.co/u/John_Cwikla)\ **Replies:** 11\ **Last updated:** [March 23, 2012, 1:18am UTC](https://discuss.elastic.co/t/heavy-load-on-one-node-1-index/7034 "2012-03-23T01:18:02Z")
We have a 4 node cluster with 1 index, 25m docs or so. We have many processes reading/writing to our cluster through pyes which we've verified randomly chooses an initial node to talk to. Strange thing is, 3 of the… --- ## [Why this range query on nested object returns uncorrect data?](https://discuss.elastic.co/t/why-this-range-query-on-nested-object-returns-uncorrect-data/197015)
**Author:** [@Bidzina\_Goginashvili](https://discuss.elastic.co/u/Bidzina_Goginashvili)\ **Replies:** 20\ **Last updated:** [August 28, 2019, 9:07pm UTC](https://discuss.elastic.co/t/why-this-range-query-on-nested-object-returns-uncorrect-data/197015 "2019-08-28T21:07:38Z")
GET bliad7/\_search { "query": {"range": { "prices.price": { "gte": 500, "lte": 600 } }} } mapping "Price" : { "type" : "nested", "properties" : { "Price" : { "type" : "double" } } }, --- ## [Is standalone APM server required with Elastic APM Integration?](https://discuss.elastic.co/t/is-standalone-apm-server-required-with-elastic-apm-integration/310620)
**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\ **Replies:** 16\ **Last updated:** [July 28, 2022, 9:36am UTC](https://discuss.elastic.co/t/is-standalone-apm-server-required-with-elastic-apm-integration/310620 "2022-07-28T09:36:53Z")
Hi, I have installed ES, Kibana. And its up and running. Further, i have added Elastic APM Integration into Kibana, and have setup Fleet server, Elastic Agent. (note i did not setup any APM server yet) I am trying to… --- ## [Error "array index out of bounds java.lang.OutOfMemoryError: Java heap space"](https://discuss.elastic.co/t/error-array-index-out-of-bounds-java-lang-outofmemoryerror-java-heap-space/16143)
**Author:** [@Prashant\_Pal](https://discuss.elastic.co/u/Prashant_Pal)\ **Replies:** 16\ **Last updated:** [March 10, 2014, 11:02am UTC](https://discuss.elastic.co/t/error-array-index-out-of-bounds-java-lang-outofmemoryerror-java-heap-space/16143 "2014-03-10T11:02:56Z")
Hi ES users, I am getting the following exception while indexing huge amount of data(say ~5GB) to ES node. Exception: 1) array index out of bounds java.lang.OutOfMemoryError: Java heap space Dumping heap … --- ## [Registry 60MB and increasing causes high cpu and stops sending events](https://discuss.elastic.co/t/registry-60mb-and-increasing-causes-high-cpu-and-stops-sending-events/54305)
**Author:** [@Zfs](https://discuss.elastic.co/u/Zfs)\ **Replies:** 11\ **Last updated:** [July 12, 2016, 12:21pm UTC](https://discuss.elastic.co/t/registry-60mb-and-increasing-causes-high-cpu-and-stops-sending-events/54305 "2016-07-12T12:21:00Z")
Hi, I have many servers using filebeat 1.2.3 on windows. It's monitoring about 16 directories with rotating logs in each. Some logs can be rotated within a few seconds others can take longer. The issue I face is that th… --- ## [Deleted docs could be still retrieved although refreshed](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609)
**Author:** [@fanqiaoqing](https://discuss.elastic.co/u/fanqiaoqing)\ **Replies:** 14\ **Last updated:** [November 23, 2022, 6:44am UTC](https://discuss.elastic.co/t/deleted-docs-could-be-still-retrieved-although-refreshed/319609 "2022-11-23T06:44:52Z")
Hi Elasticsearch, I have an index with about 2.5 billion documents. The primary has a total of 10 shards, and each shard is about 10G. We have a problem like this: A query will find out the number of documents for som… --- ## [Dynamically loading elasticsearch index](https://discuss.elastic.co/t/dynamically-loading-elasticsearch-index/139960)
**Author:** [@prabhurajreddy](https://discuss.elastic.co/u/prabhurajreddy)\ **Replies:** 17\ **Last updated:** [July 13, 2018, 6:22pm UTC](https://discuss.elastic.co/t/dynamically-loading-elasticsearch-index/139960 "2018-07-13T18:22:23Z")
I have this specific requirement to load different elasticsearch index data for different users without restarting the elasticsearch, I can do this using open and close index. Create elasticsearch index loop: Index so… --- ## [How do I get whole values of a field, as a facet? (not individual terms!)](https://discuss.elastic.co/t/how-do-i-get-whole-values-of-a-field-as-a-facet-not-individual-terms/5177)
**Author:** [@ogregras](https://discuss.elastic.co/u/ogregras)\ **Replies:** 13\ **Last updated:** [February 5, 2014, 3:53am UTC](https://discuss.elastic.co/t/how-do-i-get-whole-values-of-a-field-as-a-facet-not-individual-terms/5177 "2014-02-05T03:53:30Z")
In trying to get some facets for a search, using Java. But currently I'm only able to get separated terms as a result, not fields' full values! Let's say I index a document as such (simplified code): ============… --- ## [Logstash 2.3.4 memory leak](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969)
**Author:** [@strike00](https://discuss.elastic.co/u/strike00)\ **Replies:** 15\ **Last updated:** [August 18, 2016, 1:37am UTC](https://discuss.elastic.co/t/logstash-2-3-4-memory-leak/57969 "2016-08-18T01:37:11Z")
Hi! I've been working on setting up ELK in AWS and been having this issue with Constantly increasing consumption of memory. I started out with 4GB then up to 10GB! But yes, it still consumed causing the logstash server… --- ## [New GeoIP ingest processor is missing databases, but existing GeoIP processors work fine](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 14\ **Last updated:** [December 6, 2022, 7:59pm UTC](https://discuss.elastic.co/t/new-geoip-ingest-processor-is-missing-databases-but-existing-geoip-processors-work-fine/320381 "2022-12-06T19:59:32Z")
Elasticsearch 8.4.1 and 8.5.2. When creating a new ingest pipeline with the GeoIP processor the MaxMind databases are not found. Yet, the existing managed pipelines (logs-system.security\*, logs-iptables.log\*, etc) don'… --- ## [How to send data to Elastic Cloud with On-Premise Logstash](https://discuss.elastic.co/t/how-to-send-data-to-elastic-cloud-with-on-premise-logstash/228423)
**Author:** [@111317](https://discuss.elastic.co/u/111317)\ **Replies:** 14\ **Last updated:** [April 17, 2020, 3:49am UTC](https://discuss.elastic.co/t/how-to-send-data-to-elastic-cloud-with-on-premise-logstash/228423 "2020-04-17T03:49:45Z")
I am using Elastic Cloud. I want to move data from Linux on VMware to Elastic Cloud. What settings do you need? --- ## [Single data source split to different indexes](https://discuss.elastic.co/t/single-data-source-split-to-different-indexes/215695)
**Author:** [@BeMoore](https://discuss.elastic.co/u/BeMoore)\ **Replies:** 11\ **Last updated:** [January 23, 2020, 2:57pm UTC](https://discuss.elastic.co/t/single-data-source-split-to-different-indexes/215695 "2020-01-23T14:57:20Z")
Morning all ! i have a question, if i have a json data source like : { "log\_url" =\> "http://127.0.0.1/log.txt", "key" =\> "22op3dfe", "raw\_msg" =\> "404.19 – Denied by filtering rule", "MD5" =\> "2c5c… --- ## [Can't parse the log](https://discuss.elastic.co/t/cant-parse-the-log/82121)
**Author:** [@amakarenkov](https://discuss.elastic.co/u/amakarenkov)\ **Replies:** 11\ **Last updated:** [April 12, 2017, 1:55pm UTC](https://discuss.elastic.co/t/cant-parse-the-log/82121 "2017-04-12T13:55:30Z")
Greetings, guys! I must say that I am a network engineer, who works with network and server environment. Sadly I am not a programmer, more to say I am really dumb at programming logic. I have a question on to how to pa… --- ## [KQL-related performance issue](https://discuss.elastic.co/t/kql-related-performance-issue/199420)
**Author:** [@benpolzin](https://discuss.elastic.co/u/benpolzin)\ **Replies:** 10\ **Last updated:** [October 17, 2019, 3:58am UTC](https://discuss.elastic.co/t/kql-related-performance-issue/199420 "2019-10-17T03:58:55Z")
When I submit a terms query in Kibana on a keyword field using KQL, my queries often time out. If I submit the exact same with KQL off (using Lucene), performance is fantastic and I get results in a second or two. I ins… --- ## [Nodes are not responsive after a large query](https://discuss.elastic.co/t/nodes-are-not-responsive-after-a-large-query/91233)
**Author:** [@Eldad\_Moneta](https://discuss.elastic.co/u/Eldad_Moneta)\ **Replies:** 11\ **Last updated:** [June 30, 2017, 6:48am UTC](https://discuss.elastic.co/t/nodes-are-not-responsive-after-a-large-query/91233 "2017-06-30T06:48:05Z")
Hi, We have a hot-warm cluster for time-based metrics. We have 3 hot nodes with 30.5GB RAM and 900GB SSDs, 3 warm nodes with 30.5GB RAM and a large network storage and 3 dedicated weaker master machines. Some of our … --- ## [Types removal warning](https://discuss.elastic.co/t/types-removal-warning/233916)
**Author:** [@irishwill2008](https://discuss.elastic.co/u/irishwill2008)\ **Replies:** 9\ **Last updated:** [May 22, 2020, 9:14pm UTC](https://discuss.elastic.co/t/types-removal-warning/233916 "2020-05-22T21:14:51Z")
Hey guys, Inside "elasticsearch\_deprecation.log" i see the odd warning stating: \[types removal\] Specifying types in bulk requests is deprecated.. I want to remove this, i am running my Elastic Stack on v7.7. I looked o… --- ## [Logstash breaks my log line into multiple documets](https://discuss.elastic.co/t/logstash-breaks-my-log-line-into-multiple-documets/215156)
**Author:** [@kasra](https://discuss.elastic.co/u/kasra)\ **Replies:** 14\ **Last updated:** [February 8, 2020, 7:23am UTC](https://discuss.elastic.co/t/logstash-breaks-my-log-line-into-multiple-documets/215156 "2020-02-08T07:23:15Z")
I have nested JSON log files which I'm trying to parse and ship to my ES v.5 My logstash version is also 7.5. The problem is among for instance 3000 logs I get 250 \_jsonparsefailure! My log format is nested JSON. her… --- ## [Fields and Row template in Annotations \[TSVB\]](https://discuss.elastic.co/t/fields-and-row-template-in-annotations-tsvb/272433)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 16\ **Last updated:** [May 13, 2021, 5:25pm UTC](https://discuss.elastic.co/t/fields-and-row-template-in-annotations-tsvb/272433 "2021-05-13T17:25:36Z")
Hi. I am using TSVB to visualize the data stored in the machine learning index, I have seen that I can use annotations to visualize the details of the anomaly but when I try to add the causes.typical field it does not g… --- ## [Having issues parsing json](https://discuss.elastic.co/t/having-issues-parsing-json/183619)
**Author:** [@az123](https://discuss.elastic.co/u/az123)\ **Replies:** 14\ **Last updated:** [June 21, 2019, 1:39am UTC](https://discuss.elastic.co/t/having-issues-parsing-json/183619 "2019-06-21T01:39:22Z")
I am seeing \_jsonparsefailure when using json codec in logstash. "message" =\> "%{\\"node\_id\_str\\":\\"xxxxxxx\\",\\"subscription\_id\_str\\":\\"Sub1\\",\\"encoding\_path\\":\\"Cisco-IOS-XR-fib-common-oper:fib/nodes/node/protocols/… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/280518)
**Author:** [@smam](https://discuss.elastic.co/u/smam)\ **Replies:** 16\ **Last updated:** [August 17, 2021, 1:15pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/280518 "2021-08-17T13:15:25Z")
I am confronting the above error while trying to set up minimalistic security for elasticsearch. I know there are multiple forum contributions, but none of them helped me. elasticsearch.yml: # ======================== … --- ## [Premature end of Benchmark run](https://discuss.elastic.co/t/premature-end-of-benchmark-run/102684)
**Author:** [@sanketshinde](https://discuss.elastic.co/u/sanketshinde)\ **Replies:** 9\ **Last updated:** [October 17, 2017, 8:06am UTC](https://discuss.elastic.co/t/premature-end-of-benchmark-run/102684 "2017-10-17T08:06:34Z")
The rally I run to benchmark a remote cluster ends with a following warning: \[WARNING\] No throughput metrics available for \[index-append\]. Likely cause: The benchmark ended already during warmup. I initially used warm… --- ## [\_grokparsefailure](https://discuss.elastic.co/t/-grokparsefailure/72579)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 22\ **Last updated:** [January 25, 2017, 9:04am UTC](https://discuss.elastic.co/t/-grokparsefailure/72579 "2017-01-25T09:04:30Z")
input { file { path =\>"C:\\elk\\router" type =\> "logs" start\_position =\> beginning sincedb\_path =\> "C:\\elkstack\\ELK\\logstash-5.1.2\\data\\plugins\\inputs\\file.sincedb\_5eed3ff4207ce42c69ff2b34b669aa79" } } filt… --- ## [Add creation (not update) time of doc using ingest](https://discuss.elastic.co/t/add-creation-not-update-time-of-doc-using-ingest/217515)
**Author:** [@alza](https://discuss.elastic.co/u/alza)\ **Replies:** 11\ **Last updated:** [February 17, 2020, 11:53am UTC](https://discuss.elastic.co/t/add-creation-not-update-time-of-doc-using-ingest/217515 "2020-02-17T11:53:54Z")
I'm using the following pipeline to add creation timestamp to docs but it changes the timestamp every time that I put a newer version of a same doc to elastic. PUT \_ingest/pipeline/set\_creation\_date { "description":… --- ## [Elastic agent uninstall](https://discuss.elastic.co/t/elastic-agent-uninstall/349659)
**Author:** [@secsec](https://discuss.elastic.co/u/secsec)\ **Replies:** 9\ **Last updated:** [January 5, 2024, 5:53pm UTC](https://discuss.elastic.co/t/elastic-agent-uninstall/349659 "2024-01-05T17:53:32Z")
Hello, it seeemed to be simple but, im trying to uninstall elastic agent, but unfortunately no luck root@elk:/opt/elastic-agent-8.11.2-linux-x86\_64# elastic-agent uninstall Error: can only be uninstalled by executing … --- ## [Infrastructure UI is empty](https://discuss.elastic.co/t/infrastructure-ui-is-empty/197933)
**Author:** [@luksi1](https://discuss.elastic.co/u/luksi1)\ **Replies:** 14\ **Last updated:** [September 4, 2019, 9:17pm UTC](https://discuss.elastic.co/t/infrastructure-ui-is-empty/197933 "2019-09-04T21:17:41Z")
Hello, I'm trying to diagnose why my Infrastructure UI is empty. The waffle map is empty, but the metrics explorer is populated. I can search the metricbeat-\* index without any problems. The problem arose when upgrading… --- ## [Saved "field" parameter is now invalid. Please select a new field](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 15\ **Last updated:** [November 26, 2020, 5:00pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413 "2020-11-26T17:00:55Z")
Hi, Currently using ELK 7.9.2. I have been using Winlogbeat for a while now. I created some custom visualizations and dashboards that read from winlogbeat-\* indexes. Everything was working fine just a few days ago, unt… --- ## [What are the advantages of filebeat 1.2.2 over logstash 2.1.1?](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593)
**Author:** [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Replies:** 16\ **Last updated:** [May 12, 2016, 11:54am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593 "2016-05-12T11:54:39Z")
I get a fair number of crashes of the latter which I have always assumed is because of bugs and the java runtime and that one of the advantages I might enjoy with filebeat is that it is written in Go and perhaps has bett… --- ## [Is there any way to set number of shards for an Index's replica?(default is 1)](https://discuss.elastic.co/t/is-there-any-way-to-set-number-of-shards-for-an-indexs-replica-default-is-1/282606)
**Author:** [@iti](https://discuss.elastic.co/u/iti)\ **Replies:** 10\ **Last updated:** [August 27, 2021, 3:24pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-set-number-of-shards-for-an-indexs-replica-default-is-1/282606 "2021-08-27T15:24:26Z")
I am setting the index's shard to something other than 1. (Say 5). I was expecting to have 5 primary shards and 5 replica shards. But what I got is 5 primary shards and 1 replica shard. Is there anyway to set the shard … --- ## [How to parse xml log inside of the json format in Logstash](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006)
**Author:** [@Bigboy0706](https://discuss.elastic.co/u/Bigboy0706)\ **Replies:** 15\ **Last updated:** [December 1, 2021, 6:28am UTC](https://discuss.elastic.co/t/how-to-parse-xml-log-inside-of-the-json-format-in-logstash/290006 "2021-12-01T06:28:09Z")
I will receive a log that contained JSON and XML format I configurated the Logstash to receive TCP in JSON and used the filter when shown dateparsefailure in tags. The JSON part is able to extract, but the xml part can… --- ## [How to install logstash-output-solr plugin in logstash 5.5](https://discuss.elastic.co/t/how-to-install-logstash-output-solr-plugin-in-logstash-5-5/98154)
**Author:** [@soumya1](https://discuss.elastic.co/u/soumya1)\ **Replies:** 9\ **Last updated:** [August 31, 2017, 5:45am UTC](https://discuss.elastic.co/t/how-to-install-logstash-output-solr-plugin-in-logstash-5-5/98154 "2017-08-31T05:45:36Z")
how to install logstash-output-solr plugin in logstash 5.5.pls help --- ## [Out of Memory on 2.3.1 (cluster id 14de95)](https://discuss.elastic.co/t/out-of-memory-on-2-3-1-cluster-id-14de95/47652)
**Author:** [@James\_Faulkner](https://discuss.elastic.co/u/James_Faulkner)\ **Replies:** 12\ **Last updated:** [April 21, 2016, 4:01pm UTC](https://discuss.elastic.co/t/out-of-memory-on-2-3-1-cluster-id-14de95/47652 "2016-04-21T16:01:43Z")
Hi, I am currently in the process of trying to upgrade our Elastic Cloud clusters from 1.7.3 to 2.3.1. For testing I have created a new cluster (ID is 14de95) which is running 2.3.1. This was setup to have the same … --- ## [Metricsets are executed more than the period specified in config](https://discuss.elastic.co/t/metricsets-are-executed-more-than-the-period-specified-in-config/129337)
**Author:** [@Hussain\_Kothari](https://discuss.elastic.co/u/Hussain_Kothari)\ **Replies:** 13\ **Last updated:** [May 4, 2018, 7:33am UTC](https://discuss.elastic.co/t/metricsets-are-executed-more-than-the-period-specified-in-config/129337 "2018-05-04T07:33:23Z")
We are seeing a significant spike in data for Metrics. See the index size for today (only 8 hours in) and yesterday versus the largest other index on the box from last Thursday. \[image\] This is the monitoring for the m… --- ## [Kibana does not create a .kibana](https://discuss.elastic.co/t/kibana-does-not-create-a-kibana/230907)
**Author:** [@ElAouane](https://discuss.elastic.co/u/ElAouane)\ **Replies:** 25\ **Last updated:** [May 5, 2020, 12:11am UTC](https://discuss.elastic.co/t/kibana-does-not-create-a-kibana/230907 "2020-05-05T00:11:49Z")
Hello everybody, Sorry to bother any of you with my basic question but i have a problem i cant go around anyway as all the solution i found online does not solve my problem. I am a junior DevOps i have been working on… --- ## [Is it possible to aggregate logs from cef input](https://discuss.elastic.co/t/is-it-possible-to-aggregate-logs-from-cef-input/139976)
**Author:** [@saad](https://discuss.elastic.co/u/saad)\ **Replies:** 23\ **Last updated:** [August 9, 2018, 4:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-aggregate-logs-from-cef-input/139976 "2018-08-09T16:39:41Z")
Hi, Is it possible to apply aggregate filter on cef logs. Would you please check my conf file if there is something wrong. it should aggregating when name and sourceAddress are common and increase field aggregatedEvent… --- ## [How to use Logstash filter condition to copy docs](https://discuss.elastic.co/t/how-to-use-logstash-filter-condition-to-copy-docs/42670)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 9\ **Last updated:** [February 26, 2016, 9:08am UTC](https://discuss.elastic.co/t/how-to-use-logstash-filter-condition-to-copy-docs/42670 "2016-02-26T09:08:33Z")
Hi All, We are trying to copy docs from one index to another index using logstash. Our index (es\_item) doc count is nearly 194,556,883 with primary size of 567.7GB, the docs which are indexed to the es\_item has differ… --- ## [Elasicsearc multi rack configuration](https://discuss.elastic.co/t/elasicsearc-multi-rack-configuration/145380)
**Author:** [@mauro\_segreto](https://discuss.elastic.co/u/mauro_segreto)\ **Replies:** 20\ **Last updated:** [August 29, 2018, 10:19am UTC](https://discuss.elastic.co/t/elasicsearc-multi-rack-configuration/145380 "2018-08-29T10:19:34Z")
Hi, we have a production cluster composed by 8 nodes (4 with node.rack= location1 and 4 with node.rack= location2 ) . We have 3 elegible master nodes per each rack (node.master=true) and discovery.zen.minimum\_master\_no… --- ## [German stemmer - Cistem und Caumann stemmer](https://discuss.elastic.co/t/german-stemmer-cistem-und-caumann-stemmer/210047)
**Author:** [@htsr](https://discuss.elastic.co/u/htsr)\ **Replies:** 11\ **Last updated:** [December 6, 2019, 5:50pm UTC](https://discuss.elastic.co/t/german-stemmer-cistem-und-caumann-stemmer/210047 "2019-12-06T17:50:37Z")
The stem algorithms available for German in Elasticsearch perform not good. But there are alternatives. Namely Apache Lucene/Solr offers already the GermanStemmer based on the Caumann stemming algorithm. There is the new… --- ## [Endpoint Security without using Fleet](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 9\ **Last updated:** [October 4, 2021, 2:52pm UTC](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802 "2021-10-04T14:52:30Z")
Hi, Is it possible to use the Elastic Endpoint Security integration without utilising Fleet? We have a use case to protect endpoints with the Endpoint Security that has restricted access to the Elastic stack. Ideally,… --- ## [Syslog beats separate output](https://discuss.elastic.co/t/syslog-beats-separate-output/87653)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 9\ **Last updated:** [June 5, 2017, 1:25am UTC](https://discuss.elastic.co/t/syslog-beats-separate-output/87653 "2017-06-05T01:25:18Z")
Hi there, I'm trying to learn logstash. I have three inputs in logstash listening on different ports. This is what the config looks like input { udp { tags =\> \["netflow"\] type =\> "netflow" port =\> 5046 … [Previous page](https://discuss.elastic.co/top.md?page=116&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=118&per_page=50&period=all)