# Top **URL:** https://discuss.elastic.co/top.md?page=1176&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1177 --- ## [I can't see Zeek's http.log in Kibana but everything else (DNS, SSL, etc.) is fine](https://discuss.elastic.co/t/i-cant-see-zeeks-http-log-in-kibana-but-everything-else-dns-ssl-etc-is-fine/217474)
**Author:** [@Sylancer](https://discuss.elastic.co/u/Sylancer)\ **Replies:** 1\ **Last updated:** [February 3, 2020, 3:16pm UTC](https://discuss.elastic.co/t/i-cant-see-zeeks-http-log-in-kibana-but-everything-else-dns-ssl-etc-is-fine/217474 "2020-02-03T15:16:49Z")
Hi, I've got an ElasticStack set up as per these instructions: https://holdmybeersecurity.com/2019/05/01/back-in-the-saddle-install-setup-elastic-stack-7-0-on-ubuntu-18-04/ What I'm trying to do is get Zeek logs into th… --- ## [Kubernetes: cannot allocate memory during bootstrap](https://discuss.elastic.co/t/kubernetes-cannot-allocate-memory-during-bootstrap/186514)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 10:46am UTC](https://discuss.elastic.co/t/kubernetes-cannot-allocate-memory-during-bootstrap/186514 "2019-07-11T10:46:19Z")
Hi, I am trying to get an elasticsearch cluster running in kubernetes. I am getting following bootstrap error: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely … --- ## [Use Dissect filter on json input data](https://discuss.elastic.co/t/use-dissect-filter-on-json-input-data/151564)
**Author:** [@abhi\_latpate](https://discuss.elastic.co/u/abhi_latpate)\ **Replies:** 1\ **Last updated:** [October 9, 2018, 9:43am UTC](https://discuss.elastic.co/t/use-dissect-filter-on-json-input-data/151564 "2018-10-09T09:43:53Z")
I have inputted two json files from logstash, from a variable named file , i want to create few fields using dissect filter, but this is giving me error: this is my json input file: { "tags": \[ "jdkinstall", "class"… --- ## [Where can i find Examples of watches related to SOC so that i can use ELK as SIEM, any Reference which can help me to build a SIEM using ELK](https://discuss.elastic.co/t/where-can-i-find-examples-of-watches-related-to-soc-so-that-i-can-use-elk-as-siem-any-reference-which-can-help-me-to-build-a-siem-using-elk/131223)
**Author:** [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Replies:** 7\ **Last updated:** [May 24, 2018, 5:56pm UTC](https://discuss.elastic.co/t/where-can-i-find-examples-of-watches-related-to-soc-so-that-i-can-use-elk-as-siem-any-reference-which-can-help-me-to-build-a-siem-using-elk/131223 "2018-05-24T17:56:12Z")
Hi I am trying to convert SPLUNK correlation rules to ELK using watchers, anyone has any knowledgebase which can help me take references of X-Pack (watches), any blog or any website, any repository, which contains simil… --- ## [Modules and pipelines - Ignoring the 'pipelines.yml'](https://discuss.elastic.co/t/modules-and-pipelines-ignoring-the-pipelines-yml/120852)
**Author:** [@collse](https://discuss.elastic.co/u/collse)\ **Replies:** 1\ **Last updated:** [February 21, 2018, 2:55pm UTC](https://discuss.elastic.co/t/modules-and-pipelines-ignoring-the-pipelines-yml/120852 "2018-02-21T14:55:17Z")
Hi, still trying to get a grip on this but I want to use the netflow plugin of logstash but surely at the same time not sacrifice my other configuration but I cant find any information if this is even possible or how th… --- ## [Logstash File Input Plugin and Windows Line Endings](https://discuss.elastic.co/t/logstash-file-input-plugin-and-windows-line-endings/73745)
**Author:** [@tdsacilowski](https://discuss.elastic.co/u/tdsacilowski)\ **Replies:** 1\ **Last updated:** [February 8, 2017, 7:46pm UTC](https://discuss.elastic.co/t/logstash-file-input-plugin-and-windows-line-endings/73745 "2017-02-08T19:46:55Z")
Hello, I have the following Logstash (v5.1) conf file that I'm using to ingest data and am running into an issue where it seems to not be recognizing Windows line endings as a row separator (\\r\\n): input { file {… --- ## [How to add dynamic fields + index with a logstash filter?](https://discuss.elastic.co/t/how-to-add-dynamic-fields-index-with-a-logstash-filter/70964)
**Author:** [@thokari](https://discuss.elastic.co/u/thokari)\ **Replies:** 1\ **Last updated:** [January 13, 2017, 3:05am UTC](https://discuss.elastic.co/t/how-to-add-dynamic-fields-index-with-a-logstash-filter/70964 "2017-01-13T03:05:32Z")
Hi, new to ELK. I have some Docker logs that I am successfully sending to Kibana. However next to the field names that I am creating in that filter, it shows a '?', which means 'field not indexed' This is my filter f… --- ## [Shipper log with filebeat on windows sv 2008](https://discuss.elastic.co/t/shipper-log-with-filebeat-on-windows-sv-2008/39305)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [January 15, 2016, 7:40am UTC](https://discuss.elastic.co/t/shipper-log-with-filebeat-on-windows-sv-2008/39305 "2016-01-15T07:40:26Z")
i using filebeat (lastest version) for shipping log IIS on windows server 2008. I testing with IIS log file large (5GB). but i don't see log on ES ( don't create new indices becasue in config filebeat, i set new indice… --- ## [Scaling EL cluster with low/mid HW](https://discuss.elastic.co/t/scaling-el-cluster-with-low-mid-hw/34986)
**Author:** [@nitram](https://discuss.elastic.co/u/nitram)\ **Replies:** 7\ **Last updated:** [November 27, 2015, 9:57am UTC](https://discuss.elastic.co/t/scaling-el-cluster-with-low-mid-hw/34986 "2015-11-27T09:57:02Z")
Hello guys, we are about to deploy EL cluster to our older HW to utilize it and looking for some advices. My current setup is 8x blade servers with internal storage and 88GB of RAM all together (will be distributed i… --- ## [To HTTP chunk or not to chunk](https://discuss.elastic.co/t/to-http-chunk-or-not-to-chunk/20768)
**Author:** [@otisg](https://discuss.elastic.co/u/otisg)\ **Replies:** 1\ **Last updated:** [November 16, 2014, 9:07pm UTC](https://discuss.elastic.co/t/to-http-chunk-or-not-to-chunk/20768 "2014-11-16T21:07:20Z")
Hi, http://www.elasticsearch.org/guide/en/elasticsearch/reference/1.4/modules-http.html recommends NOT to use HTTP Chunking and to use Keep-Alive connections. Yet, the HTTP chunking link there points to http://en… --- ## [CouchDB Integration - ClassNotFoundException\[couchdb\];](https://discuss.elastic.co/t/couchdb-integration-classnotfoundexception-couchdb/5203)
**Author:** [@jramirez](https://discuss.elastic.co/u/jramirez)\ **Replies:** 7\ **Last updated:** [October 18, 2011, 4:24pm UTC](https://discuss.elastic.co/t/couchdb-integration-classnotfoundexception-couchdb/5203 "2011-10-18T16:24:54Z")
Hi, I'm having trouble integrating elasticsearch with couchdb. I followed the instructions here: couchdb-integration but when searching (curl -XGET http://localhost:9200/doc\_es\_idx/\_search -d '{}') I get this erro… --- ## [Excluding patterns with KQL](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965)
**Author:** [@vmassol](https://discuss.elastic.co/u/vmassol)\ **Replies:** 2\ **Last updated:** [August 26, 2022, 9:28am UTC](https://discuss.elastic.co/t/excluding-patterns-with-kql/310965 "2022-08-26T09:28:15Z")
Hi, I'm trying to exclude some patterns when using the Discover feature of Kibana (v8.2) but it doesn't seem to work and return 0 results. For example, I have the following indexed doc: { "\_index": "installs3", "\_… --- ## [Filebeat Setup error: error loading index pattern: returned 408 to import file](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/254855)
**Author:** [@jaydeepk](https://discuss.elastic.co/u/jaydeepk)\ **Replies:** 2\ **Last updated:** [November 10, 2020, 8:03am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/254855 "2020-11-10T08:03:20Z")
Hi I'm currently using a 14-day free trial of elastic cloud. I was trying to get my local apache logs shipped to the hosted elastic cluster. So I decided to setup a Filebeat on my local machine ( Mac OS Catalina) acc… --- ## [Error occurred during initialization of VM](https://discuss.elastic.co/t/error-occurred-during-initialization-of-vm/182253)
**Author:** [@JRb](https://discuss.elastic.co/u/JRb)\ **Replies:** 2\ **Last updated:** [May 22, 2019, 2:50pm UTC](https://discuss.elastic.co/t/error-occurred-during-initialization-of-vm/182253 "2019-05-22T14:50:40Z")
I have a Windows10 Machine... I installed the MSI version. Then when I attempt to start elasticsearch I get this error: C:\\Program Files (x86)\\Elastic\\7.1.0\\bin\>.\\elasticsearch.exe Error occurred during initializatio… --- ## [Timelion graph](https://discuss.elastic.co/t/timelion-graph/108503)
**Author:** [@christianmatira](https://discuss.elastic.co/u/christianmatira)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 5:15am UTC](https://discuss.elastic.co/t/timelion-graph/108503 "2017-11-22T05:15:36Z")
Good day, I am confused on how timelion compiles its graphs when it comes to weekly and monthy aggregation. I have created a graph that uses the sum of the cpus allocated by the user. here is the timelion syntax: .es(… --- ## [Trying to install x-pack on 5.4.1 and it is failing](https://discuss.elastic.co/t/trying-to-install-x-pack-on-5-4-1-and-it-is-failing/88751)
**Author:** [@x0r](https://discuss.elastic.co/u/x0r)\ **Replies:** 2\ **Last updated:** [June 9, 2017, 8:13pm UTC](https://discuss.elastic.co/t/trying-to-install-x-pack-on-5-4-1-and-it-is-failing/88751 "2017-06-09T20:13:00Z")
Hey there.. I am trying to install x-pack on a freshly extracted version of elasticsearch and get the following: elasticsearch@dash-02:~/elasticsearch-5.4.1/bin$ ./elasticsearch-plugin install x-pack -\> Downloading … --- ## [Does filebeat cache setting on service start?](https://discuss.elastic.co/t/does-filebeat-cache-setting-on-service-start/87983)
**Author:** [@boxkiller](https://discuss.elastic.co/u/boxkiller)\ **Replies:** 2\ **Last updated:** [June 2, 2017, 1:08pm UTC](https://discuss.elastic.co/t/does-filebeat-cache-setting-on-service-start/87983 "2017-06-02T13:08:19Z")
We have filebeat 5.4.0 installed , it seems when we update the DNS record that points to our logstash servers the filebeat agent needs to be restarted before it will use the updated DNS record. The hosts filebeat is … --- ## [Conditional function score query](https://discuss.elastic.co/t/conditional-function-score-query/21555)
**Author:** [@Jason\_Wee](https://discuss.elastic.co/u/Jason_Wee)\ **Replies:** 2\ **Last updated:** [January 12, 2015, 11:02am UTC](https://discuss.elastic.co/t/conditional-function-score-query/21555 "2015-01-12T11:02:33Z")
Hi, I have build a query using java FunctionScoreQueryBuilder http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/query-dsl-function-score-query.html and was wondering if it possible to create a… --- ## [Dynamic template vs Index template with explicit mapping in terms of performance](https://discuss.elastic.co/t/dynamic-template-vs-index-template-with-explicit-mapping-in-terms-of-performance/319399)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 4\ **Last updated:** [November 22, 2022, 12:42am UTC](https://discuss.elastic.co/t/dynamic-template-vs-index-template-with-explicit-mapping-in-terms-of-performance/319399 "2022-11-22T00:42:01Z")
Considering both search response speed and indexing rate (in my case the latter is more important ), which is more efficient? Dynamic template or Index template with explicit mapping ? It depends on my environment? --- ## [Date Histogram in Kibana](https://discuss.elastic.co/t/date-histogram-in-kibana/159800)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 4\ **Last updated:** [December 6, 2018, 11:07pm UTC](https://discuss.elastic.co/t/date-histogram-in-kibana/159800 "2018-12-06T23:07:53Z")
Hi, I have data indexed in Elastisearch. The data is sensors readings per hour for multiple stations and it has the following shape { "type": "Temperature", "time": "2012-01-01T01:00:00", "station": "stationX", "value"… --- ## [Big document or plenty of small documents](https://discuss.elastic.co/t/big-document-or-plenty-of-small-documents/128688)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 4\ **Last updated:** [April 19, 2018, 4:48pm UTC](https://discuss.elastic.co/t/big-document-or-plenty-of-small-documents/128688 "2018-04-19T16:48:47Z")
Question about data model, I am using elasticsearch as a pure "JSON storage", no search, just index/update/get, with big document (JSON of 10 Mb), that contains a big nested array: {"cars" : \[ { "name" : ..., "model" : … --- ## [Configuration error - Transcribing auditd ingest pipeline to logstash config](https://discuss.elastic.co/t/configuration-error-transcribing-auditd-ingest-pipeline-to-logstash-config/84985)
**Author:** [@jeffspahr](https://discuss.elastic.co/u/jeffspahr)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 12:28pm UTC](https://discuss.elastic.co/t/configuration-error-transcribing-auditd-ingest-pipeline-to-logstash-config/84985 "2017-05-09T12:28:39Z")
I'm attempting to transcribe the auditd ingest pipeline from the filebeat module to a logstash config, and I'm hitting the following config syntax error. Any idea what I'm missing? \[2017-05-08T18:05:19,699\]\[FATAL\]… --- ## [Building Json response from \_cat/indices](https://discuss.elastic.co/t/building-json-response-from--cat-indices/48251)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 4\ **Last updated:** [April 25, 2016, 8:45pm UTC](https://discuss.elastic.co/t/building-json-response-from--cat-indices/48251 "2016-04-25T20:45:33Z")
Hi Team, I am trying to call \_cat/indices api from AngularJs and i am getting json response where each key of json contains 1 alphabet of the record like below : like for record from \_cat/indices like : yellow open … --- ## [How does the date\_histogram aggregation choose its buckets? Is this tunable?](https://discuss.elastic.co/t/how-does-the-date-histogram-aggregation-choose-its-buckets-is-this-tunable/20290)
**Author:** [@Michael\_Herold](https://discuss.elastic.co/u/Michael_Herold)\ **Replies:** 4\ **Last updated:** [October 20, 2014, 2:35pm UTC](https://discuss.elastic.co/t/how-does-the-date-histogram-aggregation-choose-its-buckets-is-this-tunable/20290 "2014-10-20T14:35:45Z")
I'm trying to use elasticsearch to give me 30-day statistics for a given collection of models (pertinent fields are a date in \*created\_at\* and an integer in \*value\*). Currently, I have this query/aggregation: { … --- ## [Logstash not starting](https://discuss.elastic.co/t/logstash-not-starting/313807)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 6\ **Last updated:** [September 6, 2022, 4:41pm UTC](https://discuss.elastic.co/t/logstash-not-starting/313807 "2022-09-06T16:41:58Z")
I just installed logstash 8.4.1 on an Ubuntu VM. When i start the service It doesn't start and keep throwing this error. Log4j configuration path used is: /etc/logstash/log4j2.properties \[2022-09-06T14:56:04,394\]\[INFO \]… --- ## [Elasticsearch-setup-passwords interactive batch](https://discuss.elastic.co/t/elasticsearch-setup-passwords-interactive-batch/213158)
**Author:** [@screwyy](https://discuss.elastic.co/u/screwyy)\ **Replies:** 0\ **Last updated:** [December 27, 2019, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-setup-passwords-interactive-batch/213158 "2019-12-27T08:39:46Z")
hello, I'm using elasticsearch 7.3.1 and I am automating my deployment of elasticsearch with ansible. This involves managing users and their passwords (elastic, kibana etc.) I'm using file realm and nothing else (no na… --- ## [Average per day for a period](https://discuss.elastic.co/t/average-per-day-for-a-period/308942)
**Author:** [@Igor-lkm](https://discuss.elastic.co/u/Igor-lkm)\ **Replies:** 1\ **Last updated:** [July 20, 2022, 12:53pm UTC](https://discuss.elastic.co/t/average-per-day-for-a-period/308942 "2022-07-20T12:53:20Z")
Hello, I have a quite simple aggregation to get sum and average total price for a period (1 day, 7 days, 30 days etc.) from my index. That works quite good. Aggregation for 30 days looks like this: { "size": 10000, … --- ## [ElasticSearch fails to start with java.lang.IllegalStateException: failed to create child event loop](https://discuss.elastic.co/t/elasticsearch-fails-to-start-with-java-lang-illegalstateexception-failed-to-create-child-event-loop/218797)
**Author:** [@code31415926535](https://discuss.elastic.co/u/code31415926535)\ **Replies:** 1\ **Last updated:** [February 12, 2020, 2:32pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-with-java-lang-illegalstateexception-failed-to-create-child-event-loop/218797 "2020-02-12T14:32:40Z")
Hello. I am trying to run Elasticsearch on a fresh windows 10 machine but I get the following error: org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to create a child event loop … --- ## [Point in time recovery from a snapshot](https://discuss.elastic.co/t/point-in-time-recovery-from-a-snapshot/207795)
**Author:** [@AxialTilt](https://discuss.elastic.co/u/AxialTilt)\ **Replies:** 1\ **Last updated:** [November 14, 2019, 4:41am UTC](https://discuss.elastic.co/t/point-in-time-recovery-from-a-snapshot/207795 "2019-11-14T04:41:01Z")
Hello I am trying out ElasticSearch administration for the first time after having administered relational DBMS for many years. Trying to understand if point in time recovery is possible with ElasticSearch snapshots. Fr… --- ## [The issue with Elasticsearch 6.8 & repository-s3](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984)
**Author:** [@jtsunne](https://discuss.elastic.co/u/jtsunne)\ **Replies:** 2\ **Last updated:** [March 18, 2022, 11:24pm UTC](https://discuss.elastic.co/t/the-issue-with-elasticsearch-6-8-repository-s3/299984 "2022-03-18T23:24:05Z")
I'm facing a strange issue. It was working 6 months ago. Elasticsearch version 6.8.12 was created based on the CentOS Linux release 7.9.2009 (Core) from RPM (we are using Puppet) { "name": "az-es68-master-1", "cluster… --- ## [Track frontend application UI events? Better way?](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861)
**Author:** [@nagendrahk](https://discuss.elastic.co/u/nagendrahk)\ **Replies:** 2\ **Last updated:** [December 24, 2021, 4:58am UTC](https://discuss.elastic.co/t/track-frontend-application-ui-events-better-way/292861 "2021-12-24T04:58:05Z")
I want to build ELK application to track frontend events from my react application. I having two approaches in mind Store events in log file using winston package and later push it to logstash and elastic with filebeat… --- ## [Dynamic naming of data-streams](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281)
**Author:** [@marcus\_lhisp](https://discuss.elastic.co/u/marcus_lhisp)\ **Replies:** 2\ **Last updated:** [September 3, 2021, 10:49pm UTC](https://discuss.elastic.co/t/dynamic-naming-of-data-streams/283281 "2021-09-03T22:49:32Z")
Hello, Currently I'm trying to simplify my pipelines but unfortunately the sprintf format for field reference according to Field References Deep Dive | Logstash Reference \[7.14\] | Elastic does not work. Am I doing some… --- ## [Highlighting within fragments inconsistent](https://discuss.elastic.co/t/highlighting-within-fragments-inconsistent/168334)
**Author:** [@Tree1](https://discuss.elastic.co/u/Tree1)\ **Replies:** 2\ **Last updated:** [February 15, 2019, 12:07am UTC](https://discuss.elastic.co/t/highlighting-within-fragments-inconsistent/168334 "2019-02-15T00:07:52Z")
I'm trying to use ElasticSearch to locate important text which I then run a second process to extract information from the highlighted fragment. The problem is that in these highlighted fragments, the text I need to ext… --- ## [Elastic 2.6 Monitoring with 6.x](https://discuss.elastic.co/t/elastic-2-6-monitoring-with-6-x/119125)
**Author:** [@Karthik\_Ramachandran](https://discuss.elastic.co/u/Karthik_Ramachandran)\ **Replies:** 2\ **Last updated:** [February 9, 2018, 10:23pm UTC](https://discuss.elastic.co/t/elastic-2-6-monitoring-with-6-x/119125 "2018-02-09T22:23:52Z")
We have a older cluster running in ES version 2.6. Can I send the monitoring data of this cluster to a newer version ES cluster, that is running 6.2 and used as monitoring cluster? If yes, does the dashboards and other … --- ## [Topbeat \_p fields on Windows hosts](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638)
**Author:** [@meons](https://discuss.elastic.co/u/meons)\ **Replies:** 2\ **Last updated:** [March 3, 2016, 6:34pm UTC](https://discuss.elastic.co/t/topbeat--p-fields-on-windows-hosts/42638 "2016-03-03T18:34:35Z")
Hi there, I have deployed Topbeat on some Windows 7 hosts but I see a problem when I analyse logs in Kibana: proc.mem.rss and proc.cpu.user fields recieve the correct data from hosts but proc.mem.rss\_p and proc.cpu.user\_… --- ## [Failed to parse query with escaped quotation mark](https://discuss.elastic.co/t/failed-to-parse-query-with-escaped-quotation-mark/13643)
**Author:** [@Maya](https://discuss.elastic.co/u/Maya)\ **Replies:** 2\ **Last updated:** [September 19, 2013, 7:04am UTC](https://discuss.elastic.co/t/failed-to-parse-query-with-escaped-quotation-mark/13643 "2013-09-19T07:04:52Z")
Hi, I pass the following query with escaped quotation mark: { "from": 0, "size": 100, "query": { "query\_string": { "query": "\\"http://www.ynet.co.il/tags/jQuery16103187891168054193\_137931990140… --- ## [EFK. Fluentd with GROK plugin. Field type change from string to any other doesn't work](https://discuss.elastic.co/t/efk-fluentd-with-grok-plugin-field-type-change-from-string-to-any-other-doesnt-work/180848)
**Author:** [@Taras\_Fog](https://discuss.elastic.co/u/Taras_Fog)\ **Replies:** 0\ **Last updated:** [May 13, 2019, 4:28pm UTC](https://discuss.elastic.co/t/efk-fluentd-with-grok-plugin-field-type-change-from-string-to-any-other-doesnt-work/180848 "2019-05-13T16:28:09Z")
Hi guys, Please assist if you have a spare minute or two. The logging stack is as follow: ES v.6.3.1 as a service on AWS. Fluentd version is 1.3.3 Grok plugin as described here: https://github.com/fluent/fluent-plug… --- ## [How to tweak the lucene core in Elasticsearch](https://discuss.elastic.co/t/how-to-tweak-the-lucene-core-in-elasticsearch/83388)
**Author:** [@Origin\_Jing](https://discuss.elastic.co/u/Origin_Jing)\ **Replies:** 3\ **Last updated:** [April 25, 2017, 11:14am UTC](https://discuss.elastic.co/t/how-to-tweak-the-lucene-core-in-elasticsearch/83388 "2017-04-25T11:14:02Z")
I need to tweak something in lucene core(add diagnostic information to help resolve issues in other part). However I found that elasticsearch refuse to start when a self build jar of lucene core is used, even when what I… --- ## [I cannot use monitoring in X-Pack](https://discuss.elastic.co/t/i-cannot-use-monitoring-in-x-pack/77376)
**Author:** [@arianayay](https://discuss.elastic.co/u/arianayay)\ **Replies:** 3\ **Last updated:** [March 9, 2017, 1:36am UTC](https://discuss.elastic.co/t/i-cannot-use-monitoring-in-x-pack/77376 "2017-03-09T01:36:04Z")
Hi, may I know why error is showing? As per checking, all nodes of the cluster are joined. I have also configured the exporter and user with kibana and monitoring role. Thanks! --- ## [\[Solved\] - How to create a replica node only to existing cluster](https://discuss.elastic.co/t/solved-how-to-create-a-replica-node-only-to-existing-cluster/207473)
**Author:** [@JH82](https://discuss.elastic.co/u/JH82)\ **Replies:** 5\ **Last updated:** [November 12, 2019, 12:38pm UTC](https://discuss.elastic.co/t/solved-how-to-create-a-replica-node-only-to-existing-cluster/207473 "2019-11-12T12:38:40Z")
Hello, Today I've only 1 node. (health is marked Yellow, because is not HA) is it possible to add a replica node only to a cluster ? I wish to have 1 node active and 1 datanode only for search with replica data from fi… --- ## [\[Solved\] Cannot start ES 7.0.1 on Fedora 30 unless "xpack.ml.enabled: false" is set](https://discuss.elastic.co/t/solved-cannot-start-es-7-0-1-on-fedora-30-unless-xpack-ml-enabled-false-is-set/179693)
**Author:** [@Damian\_Jimenez](https://discuss.elastic.co/u/Damian_Jimenez)\ **Replies:** 5\ **Last updated:** [June 3, 2019, 1:34pm UTC](https://discuss.elastic.co/t/solved-cannot-start-es-7-0-1-on-fedora-30-unless-xpack-ml-enabled-false-is-set/179693 "2019-06-03T13:34:03Z")
Solution: The solution was to install libxcrypt-compat (sudo dnf install libxcrypt-compat) as pointed out in the thread below. After installing that no further custom configuration was necessary and the service started w… --- ## [Nested field and query/filter sur plusieurs champs en même temps](https://discuss.elastic.co/t/nested-field-and-query-filter-sur-plusieurs-champs-en-meme-temps/133554)
**Author:** [@Ugo\_Bourdon](https://discuss.elastic.co/u/Ugo_Bourdon)\ **Replies:** 5\ **Last updated:** [May 30, 2018, 10:04am UTC](https://discuss.elastic.co/t/nested-field-and-query-filter-sur-plusieurs-champs-en-meme-temps/133554 "2018-05-30T10:04:32Z")
Bonjour, Je dispose de données associant des identifiants quelconques à des zones géographiques et je veux pouvoir les requêter ensemble. Voici le mapping que j'ai déduis de mon besoin : "zones": { "type": "neste… --- ## [I want to create a gauge that displays number of documents in a certain timeslice vs total documents](https://discuss.elastic.co/t/i-want-to-create-a-gauge-that-displays-number-of-documents-in-a-certain-timeslice-vs-total-documents/113601)
**Author:** [@anchasis](https://discuss.elastic.co/u/anchasis)\ **Replies:** 5\ **Last updated:** [December 30, 2017, 10:43am UTC](https://discuss.elastic.co/t/i-want-to-create-a-gauge-that-displays-number-of-documents-in-a-certain-timeslice-vs-total-documents/113601 "2017-12-30T10:43:00Z")
I am using Kibana 6.0 and fail to create a gauge that visualizes the number of documents that fall withing a timeslice timestampfield:\[now-1y TO now\] compared to the total number of documents without slicing. How to best… --- ## [Multiple document handling](https://discuss.elastic.co/t/multiple-document-handling/64186)
**Author:** [@diopib](https://discuss.elastic.co/u/diopib)\ **Replies:** 5\ **Last updated:** [October 31, 2016, 7:25am UTC](https://discuss.elastic.co/t/multiple-document-handling/64186 "2016-10-31T07:25:33Z")
Hello, I'm trying to use the index action, and I'm trying to save the multiple documents returned by my search. For that I use the transform feature and I'm attempting to return the multiple document like this: "ind… --- ## [How to build Elasticsearch from source without xpack](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:13am UTC](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299 "2020-12-01T06:13:04Z")
Hi, i am trying to build a non-snapshot build of elasticsearch from source using gradle assemble -Dbuild.snapshot=false But I am getting the following exception Property license.key must be set for release build I th… --- ## [Error in curator log on Date math function](https://discuss.elastic.co/t/error-in-curator-log-on-date-math-function/160308)
**Author:** [@Elango-mas](https://discuss.elastic.co/u/Elango-mas)\ **Replies:** 6\ **Last updated:** [December 14, 2018, 5:34am UTC](https://discuss.elastic.co/t/error-in-curator-log-on-date-math-function/160308 "2018-12-14T05:34:25Z")
Hi Team, I am trying to take snapshot using curator and the job is successful. But i get the below error in the log file. 2018-12-11 07:39:57,048 INFO curator.utils parse\_date\_pattern:1338 "\ **Author:** [@Yih\_Ashley](https://discuss.elastic.co/u/Yih_Ashley)\ **Replies:** 6\ **Last updated:** [August 4, 2018, 10:54am UTC](https://discuss.elastic.co/t/error-in-logstash-conf/141281 "2018-08-04T10:54:13Z") Hello, I have a problem when running my logstash. Below is my configuration in logstash.conf input { file { path =\> \["/var/log/nsm/eve.json"\] codec =\> json type =\> "SuricataIDPS" } } filter { if \[type\] == "Sur… --- ## [Need for \`on\_success\` with pipelines](https://discuss.elastic.co/t/need-for-on-success-with-pipelines/88610)
**Author:** [@Brian\_Topping](https://discuss.elastic.co/u/Brian_Topping)\ **Replies:** 6\ **Last updated:** [June 8, 2017, 7:30pm UTC](https://discuss.elastic.co/t/need-for-on-success-with-pipelines/88610 "2017-06-08T19:30:20Z")
In studying https://www.elastic.co/guide/en/elasticsearch/reference/current/handling-failure-in-pipelines.html, I see that "a pipeline defines a list of processors that are executed sequentially, and processing halts at … --- ## [Red status after putting data](https://discuss.elastic.co/t/red-status-after-putting-data/36947)
**Author:** [@stana](https://discuss.elastic.co/u/stana)\ **Replies:** 4\ **Last updated:** [December 14, 2015, 3:13am UTC](https://discuss.elastic.co/t/red-status-after-putting-data/36947 "2015-12-14T03:13:11Z")
Hi guys, I started up Elasticsearch 2.1 successfully,and setting path.data to the folder which mount on hadoop through nfs. When I excute 'curl -XGET 'http://server-a1:9200/\_cluster/health?level=indices&pretty=tr… --- ## [Lucene query on nested type](https://discuss.elastic.co/t/lucene-query-on-nested-type/248434)
**Author:** [@Yuval99](https://discuss.elastic.co/u/Yuval99)\ **Replies:** 1\ **Last updated:** [September 13, 2020, 10:43am UTC](https://discuss.elastic.co/t/lucene-query-on-nested-type/248434 "2020-09-13T10:43:48Z")
Hi guys! We are trying to make a search based on lucene syntax on object with nested type fields. We looked on DSL but it's not fitted to our requirements. Our data looks like: { scans: \[ { ip: "1.2.3.4", is\_malware:… [Previous page](https://discuss.elastic.co/top.md?page=1175&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1177&per_page=50&period=all)