# Top

**URL:** https://discuss.elastic.co/top.md?page=120&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 121

---

## [Curator doesn't purge Data](https://discuss.elastic.co/t/curator-doesnt-purge-data/132505)

<div class="topic-metadata">

**Author:** [@asalma](https://discuss.elastic.co/u/asalma)\
**Replies:** 26\
**Last updated:** [May 23, 2018, 3:30pm UTC](https://discuss.elastic.co/t/curator-doesnt-purge-data/132505 "2018-05-23T15:30:06Z")

</div>

Hi, I install curator and in order to test it I make : 1 day to purge data, but it seems to me that it doesn't work, my indice from yesterday is still here and not deleted. --- actions: 1: action: delete\_indices…

---

## [EntitlementBootstrap failure preventing startup: AttachNotSupportedException: Unable to open socket file](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452)

<div class="topic-metadata">

**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\
**Replies:** 58\
**Last updated:** [November 11, 2025, 8:46am UTC](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452 "2025-11-11T08:46:41Z")

</div>

Several of our customer instances are hitting the following issue. Any idea what this is? It’s only happening in particular environments. I am currently trying to narrow down what is special about the environments and ho…

---

## [Terms Aggregation not returning keys](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634)

<div class="topic-metadata">

**Author:** [@gabe.ks11](https://discuss.elastic.co/u/gabe.ks11)\
**Replies:** 15\
**Last updated:** [February 1, 2021, 2:59pm UTC](https://discuss.elastic.co/t/terms-aggregation-not-returning-keys/262634 "2021-02-01T14:59:06Z")

</div>

Hi everyone, So recently we ran into a problem using elastic, we are attempting to detect records which have a duplicate value (hash) and to patch them with a flag so that we iterate all records as we go. (27 million re…

---

## [Logstash service/init is not doing anything](https://discuss.elastic.co/t/logstash-service-init-is-not-doing-anything/119695)

<div class="topic-metadata">

**Author:** [@thirusama](https://discuss.elastic.co/u/thirusama)\
**Replies:** 12\
**Last updated:** [February 13, 2018, 11:20pm UTC](https://discuss.elastic.co/t/logstash-service-init-is-not-doing-anything/119695 "2018-02-13T23:20:30Z")

</div>

Hello All, I have installed logstash using RPM. It created sample file in /etc/init/logstash.conf. When I start the process using sudo initctl start logstash, it is creating pid and the service is running in the backgr…

---

## [CorruptIndexException: checksum status indeterminate](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827)

<div class="topic-metadata">

**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\
**Replies:** 14\
**Last updated:** [November 10, 2021, 9:11pm UTC](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827 "2021-11-10T21:11:47Z")

</div>

Hi We recently had an outage on our openshift clusters. In our Test environment the pods came back up with warnings. The log file shows the following Suppressed: org.apache.lucene.index.CorruptIndexException: checksu…

---

## [Querying log.file.path returns no results](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794)

<div class="topic-metadata">

**Author:** [@strshp\_419](https://discuss.elastic.co/u/strshp_419)\
**Replies:** 15\
**Last updated:** [April 17, 2021, 5:19am UTC](https://discuss.elastic.co/t/querying-log-file-path-returns-no-results/269794 "2021-04-17T05:19:24Z")

</div>

Elasticsearch, Filebeat, and Kibana versions are 7.12.0 on Windows Server 2016 In Kibana, querying on log.file.path returns no results in certain scenarios. Example: In Kibana, I go to Observability \> Logs and submit …

---

## [Out Of Memory crash, few documents & load](https://discuss.elastic.co/t/out-of-memory-crash-few-documents-load/286597)

<div class="topic-metadata">

**Author:** [@cyril.r](https://discuss.elastic.co/u/cyril.r)\
**Replies:** 9\
**Last updated:** [October 14, 2021, 1:05pm UTC](https://discuss.elastic.co/t/out-of-memory-crash-few-documents-load/286597 "2021-10-14T13:05:28Z")

</div>

Hi there, I have a small Elasticsearch single node cluster for development purpose that is crashing about one time per month, even when there are no trafic/requests (like in the middle of the night, no one is working on…

---

## [Analysis-icu plugin usage at client side](https://discuss.elastic.co/t/analysis-icu-plugin-usage-at-client-side/186381)

<div class="topic-metadata">

**Author:** [@tiwari.piyush7](https://discuss.elastic.co/u/tiwari.piyush7)\
**Replies:** 13\
**Last updated:** [June 21, 2019, 6:18am UTC](https://discuss.elastic.co/t/analysis-icu-plugin-usage-at-client-side/186381 "2019-06-21T06:18:27Z")

</div>

Hi, I would like to use analysis-icu plugin (https://www.elastic.co/guide/en/elasticsearch/plugins/6.6/analysis-icu.html) for ICU Folding with ElasticSearch 6.6.2. While doing so, I was able to install analysis-icu plug…

---

## [Separate data stream per customer?](https://discuss.elastic.co/t/separate-data-stream-per-customer/247300)

<div class="topic-metadata">

**Author:** [@Adam\_Wilson](https://discuss.elastic.co/u/Adam_Wilson)\
**Replies:** 10\
**Last updated:** [September 3, 2020, 4:36pm UTC](https://discuss.elastic.co/t/separate-data-stream-per-customer/247300 "2020-09-03T16:36:08Z")

</div>

Hello! I'm evaluating whether to use Elasticsearch as an OLAP backend for our Reports+Dashboards feature We have timeseries data that's ingested for different customers The data between these customers is 100% independ…

---

## [Date Filter](https://discuss.elastic.co/t/date-filter/118128)

<div class="topic-metadata">

**Author:** [@merrillbeth](https://discuss.elastic.co/u/merrillbeth)\
**Replies:** 10\
**Last updated:** [February 13, 2018, 12:18am UTC](https://discuss.elastic.co/t/date-filter/118128 "2018-02-13T00:18:56Z")

</div>

I can't seem to get this date filter to work: "logstash.version"=\>"6.1.0" Elasticsearch 5.6.3 filter{ grok { patterns\_dir =\> \["/etc/logstash/patterns"\] match =\> \[ "message", "%{LOGTIMESTAMP:logTimestamp}" \] } dat…

---

## [Trying to get the data from oracle database through logstash but data is not coming to elasticsearch](https://discuss.elastic.co/t/trying-to-get-the-data-from-oracle-database-through-logstash-but-data-is-not-coming-to-elasticsearch/215678)

<div class="topic-metadata">

**Author:** [@uday\_kumar1](https://discuss.elastic.co/u/uday_kumar1)\
**Replies:** 9\
**Last updated:** [January 28, 2020, 8:45am UTC](https://discuss.elastic.co/t/trying-to-get-the-data-from-oracle-database-through-logstash-but-data-is-not-coming-to-elasticsearch/215678 "2020-01-28T08:45:15Z")

</div>

I am trying to get the data of oracle database through logstash but data is not coming to elasticsearch. not sure where i was missed. I didn't see any error on logstash log file. below are the logstash conf file. input …

---

## ["Unable to Tessellate shape....Possible malformed shape detected." Error while indexing in ES 7.17.7](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected-error-while-indexing-in-es-7-17-7/319922)

<div class="topic-metadata">

**Author:** [@amal\_antony](https://discuss.elastic.co/u/amal_antony)\
**Replies:** 23\
**Last updated:** [December 12, 2022, 11:15am UTC](https://discuss.elastic.co/t/unable-to-tessellate-shape-possible-malformed-shape-detected-error-while-indexing-in-es-7-17-7/319922 "2022-12-12T11:15:50Z")

</div>

Greetings to the community! We have a logstash pipeline writing a geojson file to Elasticsearch. The file never gets fully indexed and some geo\_shape records get dropped by Elasticsearch. Identified the records that cau…

---

## [Docker and System Logs/Metrics from container-based Agent](https://discuss.elastic.co/t/docker-and-system-logs-metrics-from-container-based-agent/322679)

<div class="topic-metadata">

**Author:** [@litronics](https://discuss.elastic.co/u/litronics)\
**Replies:** 13\
**Last updated:** [January 12, 2023, 10:27am UTC](https://discuss.elastic.co/t/docker-and-system-logs-metrics-from-container-based-agent/322679 "2023-01-12T10:27:52Z")

</div>

Hi, I am pretty new to the ELK Stack and have some trouble getting detailed metrics from a docker based agent. The Stack is running on also as docker container and after days playing around with TLS certificates I have…

---

## [Nodes restarting automatically](https://discuss.elastic.co/t/nodes-restarting-automatically/17675)

<div class="topic-metadata">

**Author:** [@Jorge\_Ferrando](https://discuss.elastic.co/u/Jorge_Ferrando)\
**Replies:** 22\
**Last updated:** [June 2, 2014, 7:02am UTC](https://discuss.elastic.co/t/nodes-restarting-automatically/17675 "2014-06-02T07:02:23Z")

</div>

Hello We have a cluster of 3 nodes running Ubuntu 12.04.4 LTS 64bits, and elasticsearch v1.1.1 It's be running flawlessly but since the last weak some of the nodes restarts randomly and cluster gets to red sta…

---

## [Enable xpack on a running Elastic cluster](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671)

<div class="topic-metadata">

**Author:** [@ls4074](https://discuss.elastic.co/u/ls4074)\
**Replies:** 9\
**Last updated:** [September 27, 2021, 5:28pm UTC](https://discuss.elastic.co/t/enable-xpack-on-a-running-elastic-cluster/284671 "2021-09-27T17:28:59Z")

</div>

I deployed Elastic using helm chart (7.13) without xpack enabled. The ES and Kibana pods are running fine. I logged in to one of the master pods and ran the command "Elasticsearch-certutil" to generate the certs and the…

---

## [Geoip field is not showing in dashboard](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205)

<div class="topic-metadata">

**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\
**Replies:** 12\
**Last updated:** [January 12, 2017, 11:08am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205 "2017-01-12T11:08:37Z")

</div>

I'm trying to locate the geo location on apache server but the geoip field is not showing this is logstash configuration file input { beats { port =\> 5044 } } filter { if \[type\] == "apache" { grok { match =\> { …

---

## [Recommended setup & configuration for 3 servers](https://discuss.elastic.co/t/recommended-setup-configuration-for-3-servers/5612)

<div class="topic-metadata">

**Author:** [@doug\_livesey](https://discuss.elastic.co/u/doug_livesey)\
**Replies:** 25\
**Last updated:** [May 31, 2013, 7:54am UTC](https://discuss.elastic.co/t/recommended-setup-configuration-for-3-servers/5612 "2013-05-31T07:54:38Z")

</div>

Hi, I was wondering if anyone could advise me, or point me in the direction of the relevant documentation, on how to best setup elasticsearch to run across 3 servers. I'd like the 3 instances on the 3 servers to be re…

---

## [SSL error](https://discuss.elastic.co/t/ssl-error/234291)

<div class="topic-metadata">

**Author:** [@NoobUser404](https://discuss.elastic.co/u/NoobUser404)\
**Replies:** 10\
**Last updated:** [June 2, 2020, 10:47am UTC](https://discuss.elastic.co/t/ssl-error/234291 "2020-06-02T10:47:26Z")

</div>

I've installed elasticsearch, logstash and metricbeat in my local Windows machine (all 7.7 version). The first thing I did was run .\\bin\\elasticsearch-certutil cert --pem --pass secret to get ca.crt - instance.crt - inst…

---

## [Geographic Coordinates and Java API Client in 8.6](https://discuss.elastic.co/t/geographic-coordinates-and-java-api-client-in-8-6/324613)

<div class="topic-metadata">

**Author:** [@BenjaminD](https://discuss.elastic.co/u/BenjaminD)\
**Replies:** 12\
**Last updated:** [February 6, 2023, 4:24pm UTC](https://discuss.elastic.co/t/geographic-coordinates-and-java-api-client-in-8-6/324613 "2023-02-06T16:24:51Z")

</div>

Hello. I'm trying to create documents from a Java app. Those documents includes geographic coordinates (lat and lon in decimal form). Both Elasticsearch and the java client are in 8.6.0. In the beginning, no index exi…

---

## [ERROR: Could not find or load main class](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class/306297)

<div class="topic-metadata">

**Author:** [@Wan\_Nur\_Athirah\_Wan](https://discuss.elastic.co/u/Wan_Nur_Athirah_Wan)\
**Replies:** 13\
**Last updated:** [June 27, 2022, 4:30am UTC](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class/306297 "2022-06-27T04:30:35Z")

</div>

Hai. I have a problem regarding Logstash start. Before this when i use Logstash for ingestion, everything works well. but now, the Logstash seems having problem with java where the error as followed: I already have …

---

## [Delete docs by date](https://discuss.elastic.co/t/delete-docs-by-date/274493)

<div class="topic-metadata">

**Author:** [@Jose\_Manuel\_Tirado](https://discuss.elastic.co/u/Jose_Manuel_Tirado)\
**Replies:** 9\
**Last updated:** [May 31, 2021, 2:33pm UTC](https://discuss.elastic.co/t/delete-docs-by-date/274493 "2021-05-31T14:33:29Z")

</div>

HI! In the following index I have several days of data I want to delete the data from the 29th and 30th of the 5th of 2021 But when I launch the following command I obtain this messages: How cai I delete the dat…

---

## [Multiple pipelines running on same machine](https://discuss.elastic.co/t/multiple-pipelines-running-on-same-machine/225217)

<div class="topic-metadata">

**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\
**Replies:** 16\
**Last updated:** [April 24, 2020, 5:41pm UTC](https://discuss.elastic.co/t/multiple-pipelines-running-on-same-machine/225217 "2020-04-24T17:41:26Z")

</div>

Hello Team, I am facing issues with logstash pipelines filter section i am using multiple filters like grok, elasticsearch translate, ruby etc in combination, The issue is the data of some other record processed at the…

---

## [Logstash output to external Elastic Search server](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913)

<div class="topic-metadata">

**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\
**Replies:** 10\
**Last updated:** [April 19, 2016, 5:51pm UTC](https://discuss.elastic.co/t/logstash-output-to-external-elastic-search-server/42913 "2016-04-19T17:51:28Z")

</div>

HI, have been struggling to get the output of one logstash servers output into an elastics search server. When doing a tcpdump on the ES installation I can see the server is connecting, however when looking at the indexe…

---

## [Parsing variable to Curl delete command](https://discuss.elastic.co/t/parsing-variable-to-curl-delete-command/55397)

<div class="topic-metadata">

**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Replies:** 9\
**Last updated:** [July 14, 2016, 6:48am UTC](https://discuss.elastic.co/t/parsing-variable-to-curl-delete-command/55397 "2016-07-14T06:48:01Z")

</div>

HI Team, Actually im work in autopurge script in linux. I dont have enough storage in my disk. i planned to purge the old data from my index and keep last 15 day live records in index.. I can perform this operation by ma…

---

## [How to Handle Metadata in File Headers](https://discuss.elastic.co/t/how-to-handle-metadata-in-file-headers/167544)

<div class="topic-metadata">

**Author:** [@dips](https://discuss.elastic.co/u/dips)\
**Replies:** 12\
**Last updated:** [February 12, 2019, 10:57pm UTC](https://discuss.elastic.co/t/how-to-handle-metadata-in-file-headers/167544 "2019-02-12T22:57:55Z")

</div>

I am using Elasticsearch to collect data from log files. The log files contain metadata in the header relating to the user that logged on. I want to be able to search for events using the metadata in the file header (exa…

---

## [ES 1.5 Delete By Query API not working](https://discuss.elastic.co/t/es-1-5-delete-by-query-api-not-working/109899)

<div class="topic-metadata">

**Author:** [@Andrey\_Deineko](https://discuss.elastic.co/u/Andrey_Deineko)\
**Replies:** 10\
**Last updated:** [December 4, 2017, 9:09am UTC](https://discuss.elastic.co/t/es-1-5-delete-by-query-api-not-working/109899 "2017-12-04T09:09:43Z")

</div>

Here is the original question asked on Stackoverflow: elasticsearch - ES 1.5 Delete By Query API not working - Stack Overflow I am using an old version on Elasticsearch - 1.5. Problem: I need to delete a lot of documen…

---

## [Segfault in ffi\_prep\_closure\_loc](https://discuss.elastic.co/t/segfault-in-ffi-prep-closure-loc/19227)

<div class="topic-metadata">

**Author:** [@Markus\_Burger](https://discuss.elastic.co/u/Markus_Burger)\
**Replies:** 10\
**Last updated:** [August 12, 2014, 1:35pm UTC](https://discuss.elastic.co/t/segfault-in-ffi-prep-closure-loc/19227 "2014-08-12T13:35:33Z")

</div>

hello guys, i tryed to install elasticsearch 1.3.1 today on a dev machine and got a problem related to mlockall that i have never seen before and cant wrap my head around. # A fatal error has been detected by t…

---

## [Specifying Multiple Success Status Codes for Heartbeat Monitor](https://discuss.elastic.co/t/specifying-multiple-success-status-codes-for-heartbeat-monitor/198074)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 11\
**Last updated:** [September 11, 2019, 3:12am UTC](https://discuss.elastic.co/t/specifying-multiple-success-status-codes-for-heartbeat-monitor/198074 "2019-09-11T03:12:16Z")

</div>

TL;DR How do I specify multiple success response codes for an Elastic Heartbeat monitor? Details We have an application for which http.response.code: 200 and http.response.code: 403 are both considered successful. Howe…

---

## [Logstash failed to start (org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~\[jruby.jar:?\])](https://discuss.elastic.co/t/logstash-failed-to-start-org-jruby-rubykernel-exit-org-jruby-rubykernel-java-790-jruby-jar/318457)

<div class="topic-metadata">

**Author:** [@Rootlente](https://discuss.elastic.co/u/Rootlente)\
**Replies:** 12\
**Last updated:** [November 8, 2022, 8:18pm UTC](https://discuss.elastic.co/t/logstash-failed-to-start-org-jruby-rubykernel-exit-org-jruby-rubykernel-java-790-jruby-jar/318457 "2022-11-08T20:18:04Z")

</div>

Hello, I am building home lab environment to collect winevent logs using filebat and send them on my Ubuntu machine where i installed everything and configured them by documentation but every time i get this error i d…

---

## [Elastic search curator is failing](https://discuss.elastic.co/t/elastic-search-curator-is-failing/137447)

<div class="topic-metadata">

**Author:** [@sandeepnarla22322](https://discuss.elastic.co/u/sandeepnarla22322)\
**Replies:** 11\
**Last updated:** [July 9, 2018, 2:32pm UTC](https://discuss.elastic.co/t/elastic-search-curator-is-failing/137447 "2018-07-09T14:32:09Z")

</div>

\[root@BVELKL03 elasticsearch-curator\]# curator\_cli --host localhost show\_indices --filter\_list '{"filtertype":"age","source":"name","timestring":"%Y.%m.%d","unit":"days","unit\_count":30}' 2018-06-26 07:07:23,177 ERROR …

---

## [How to create a simple CPU usage graph?](https://discuss.elastic.co/t/how-to-create-a-simple-cpu-usage-graph/342036)

<div class="topic-metadata">

**Author:** [@gornication](https://discuss.elastic.co/u/gornication)\
**Replies:** 9\
**Last updated:** [September 5, 2023, 1:39pm UTC](https://discuss.elastic.co/t/how-to-create-a-simple-cpu-usage-graph/342036 "2023-09-05T13:39:40Z")

</div>

Hi! How to create a simple CPU usage graph? I have incoming records with CPU metrics. Using the cpu\_p field, I want to plot the load percentage versus time. Why do I need Break down by? (this is a required paramete…

---

## [Script python elasticsearch](https://discuss.elastic.co/t/script-python-elasticsearch/136634)

<div class="topic-metadata">

**Author:** [@benzaq](https://discuss.elastic.co/u/benzaq)\
**Replies:** 9\
**Last updated:** [June 26, 2018, 10:36am UTC](https://discuss.elastic.co/t/script-python-elasticsearch/136634 "2018-06-26T10:36:56Z")

</div>

bonjour, je suis entrain de crée un script en python pour récupérer de la base ES des nom et les IPs qui sont associé au nom,ainsi que le timestamp , le tous trié . Le probleme est que je n'arrive pas a faire une reque…

---

## [Bulk Indexing performance on AWS ES service](https://discuss.elastic.co/t/bulk-indexing-performance-on-aws-es-service/106011)

<div class="topic-metadata">

**Author:** [@michaels](https://discuss.elastic.co/u/michaels)\
**Replies:** 12\
**Last updated:** [November 1, 2017, 11:34am UTC](https://discuss.elastic.co/t/bulk-indexing-performance-on-aws-es-service/106011 "2017-11-01T11:34:43Z")

</div>

Hi I am performing a massive bulk indexing daily and it seems that whatever I do my cluster nodes quickly use 100% CPU for hours which causes my searches to perform bad. My configuration is as follows: AWS ES cluster…

---

## [From logstash how to lookup on a data in elastic index?](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387)

<div class="topic-metadata">

**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\
**Replies:** 10\
**Last updated:** [August 18, 2021, 6:36pm UTC](https://discuss.elastic.co/t/from-logstash-how-to-lookup-on-a-data-in-elastic-index/281387 "2021-08-18T18:36:15Z")

</div>

Need a support, i have created a lookup index in elastic search index - lookup Username;Identifier;First name;Last name booker12;l9012;Rachel;Booker grey07;l2070;Laura;Grey johnson81;l4081;Craig;Johnson jenkins46;…

---

## [Filebeat setup for cakephp logs](https://discuss.elastic.co/t/filebeat-setup-for-cakephp-logs/339620)

<div class="topic-metadata">

**Author:** [@sanjeev1895](https://discuss.elastic.co/u/sanjeev1895)\
**Replies:** 35\
**Last updated:** [September 4, 2023, 6:00am UTC](https://discuss.elastic.co/t/filebeat-setup-for-cakephp-logs/339620 "2023-09-04T06:00:58Z")

</div>

Hi, Can anyone advice how to configure the filebeat and logstash for cakephp logs. I need to configure filebeat for following cakephp logs, cake.log error.log Is do I need to enable any module in filebeat? Please c…

---

## [Regarding Displaying Ram in Pie chart](https://discuss.elastic.co/t/regarding-displaying-ram-in-pie-chart/102075)

<div class="topic-metadata">

**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\
**Replies:** 12\
**Last updated:** [October 11, 2017, 6:47pm UTC](https://discuss.elastic.co/t/regarding-displaying-ram-in-pie-chart/102075 "2017-10-11T18:47:06Z")

</div>

Hi , I wants to display RAM(total Ram, Used ram , Free ram) through pie chart in Kibana. can anybody help me with steps Thanks & Regards Shrikant

---

## [Issue with rules creation](https://discuss.elastic.co/t/issue-with-rules-creation/301083)

<div class="topic-metadata">

**Author:** [@kesako](https://discuss.elastic.co/u/kesako)\
**Replies:** 14\
**Last updated:** [April 7, 2022, 1:56pm UTC](https://discuss.elastic.co/t/issue-with-rules-creation/301083 "2022-04-07T13:56:13Z")

</div>

Hello, I am trying to test some features of the SIEM integrated in ELK but I am stuck on the rules. In fact I am trying to put a rule where a alert is sent when a specific ip receives packets from another specific ip…

---

## [How to add more nodes to an existing elastic search](https://discuss.elastic.co/t/how-to-add-more-nodes-to-an-existing-elastic-search/306818)

<div class="topic-metadata">

**Author:** [@eliumoraes](https://discuss.elastic.co/u/eliumoraes)\
**Replies:** 10\
**Last updated:** [July 1, 2022, 4:09pm UTC](https://discuss.elastic.co/t/how-to-add-more-nodes-to-an-existing-elastic-search/306818 "2022-07-01T16:09:03Z")

</div>

Hello guys, I'm new to Elasticsearch and started to work on a company that assigned me a taqsk to add more nodes in an existing environment. We are using the integration between Elastic and Azure in our environment. W…

---

## [HTTP spans doesn't show the full information about the request](https://discuss.elastic.co/t/http-spans-doesnt-show-the-full-information-about-the-request/288908)

<div class="topic-metadata">

**Author:** [@floyola](https://discuss.elastic.co/u/floyola)\
**Replies:** 12\
**Last updated:** [November 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/http-spans-doesnt-show-the-full-information-about-the-request/288908 "2021-11-30T15:04:38Z")

</div>

Hi! I'm using Opentelemetry + Elastic. The problem that I'm facing is that the http requests child spans doesn't show the full information. The way those spans are shown aren't useful since doesn't indicates which span…

---

## [Elasticsearch 5.0.0 alpha2 'NodeNodeAvailableException'](https://discuss.elastic.co/t/elasticsearch-5-0-0-alpha2-nodenodeavailableexception/49125)

<div class="topic-metadata">

**Author:** [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\
**Replies:** 12\
**Last updated:** [May 7, 2016, 12:52pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-0-alpha2-nodenodeavailableexception/49125 "2016-05-07T12:52:46Z")

</div>

Hi. I got this error when using JavaClient+Elasticsearch(both version of them are 5.0.0alpha2) Today morning I upgraded clinet/Server from alpha1 to alpha2. This did not happen in 5.0.0 alpha1 I think. client code an…

---

## [Hive overwhelming Elasticsearch](https://discuss.elastic.co/t/hive-overwhelming-elasticsearch/269930)

<div class="topic-metadata">

**Author:** [@albertkohl](https://discuss.elastic.co/u/albertkohl)\
**Replies:** 23\
**Last updated:** [April 20, 2021, 5:57pm UTC](https://discuss.elastic.co/t/hive-overwhelming-elasticsearch/269930 "2021-04-20T17:57:46Z")

</div>

i'm new to ES so bare with me :slight\_smile: i have a hadoop cluster running hive, and i have a table of about 441 million rows, 10 columns wide (string and bigint) i setup an external table in hive, created an index i…

---

## [ServiceNow integration with Elasticsearch](https://discuss.elastic.co/t/servicenow-integration-with-elasticsearch/218095)

<div class="topic-metadata">

**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\
**Replies:** 9\
**Last updated:** [February 7, 2020, 10:31am UTC](https://discuss.elastic.co/t/servicenow-integration-with-elasticsearch/218095 "2020-02-07T10:31:34Z")

</div>

Hi, I have a setup of ELK Stack 7.5.1 to visualize/analyse different kind of logs in our environment. Now, I have a serviceNow of tool where we raise ticket. I want to integrate serviceNow with elasticsearch is there a…

---

## [How to configure logstash to get only new data/updated data into elasticsearch](https://discuss.elastic.co/t/how-to-configure-logstash-to-get-only-new-data-updated-data-into-elasticsearch/203266)

<div class="topic-metadata">

**Author:** [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\
**Replies:** 9\
**Last updated:** [October 31, 2019, 1:41pm UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-get-only-new-data-updated-data-into-elasticsearch/203266 "2019-10-31T13:41:11Z")

</div>

Dear All. i am facing the issue from a long time.i have unique column in sql server side and i want to get only new data/updated data into elasticsearch every 15 min. how will i do ...after loading first time data int…

---

## [Wow, there is some really great documenation for ES! But](https://discuss.elastic.co/t/wow-there-is-some-really-great-documenation-for-es-but/10354)

<div class="topic-metadata">

**Author:** [@Justin\_Treher](https://discuss.elastic.co/u/Justin_Treher)\
**Replies:** 12\
**Last updated:** [February 13, 2013, 9:06pm UTC](https://discuss.elastic.co/t/wow-there-is-some-really-great-documenation-for-es-but/10354 "2013-02-13T21:06:35Z")

</div>

It took me about four days on and off to figure out how to use the documentation "navigation" (navigation definitely needs quotes there). Basically, I can fork this thing and rework the TOC and someone will pull it…

---

## [Migrating from ES 2.4 to 5.x](https://discuss.elastic.co/t/migrating-from-es-2-4-to-5-x/116935)

<div class="topic-metadata">

**Author:** [@motts](https://discuss.elastic.co/u/motts)\
**Replies:** 17\
**Last updated:** [February 9, 2018, 6:29pm UTC](https://discuss.elastic.co/t/migrating-from-es-2-4-to-5-x/116935 "2018-02-09T18:29:00Z")

</div>

I am trying to install the migration tool and that seemed to work fine. However, I cannot seem to connect to the host with localhost:9200/\_plugin/elasticsearch-migration I get a 404 error, but ES is running. If I try to …

---

## [Slower Perfomance with Elaticsearch cluster in kubernetes compared to Docker](https://discuss.elastic.co/t/slower-perfomance-with-elaticsearch-cluster-in-kubernetes-compared-to-docker/325759)

<div class="topic-metadata">

**Author:** [@samdevops](https://discuss.elastic.co/u/samdevops)\
**Replies:** 12\
**Last updated:** [March 14, 2023, 10:30am UTC](https://discuss.elastic.co/t/slower-perfomance-with-elaticsearch-cluster-in-kubernetes-compared-to-docker/325759 "2023-03-14T10:30:02Z")

</div>

We are facing issues with Elasticsearch deployment resulting in response time being slower in EKS to that in Docker. In both cases, we are using AWS to provision EC2 instances. Docker consists of a single EC2 instance w…

---

## [Logstash fatal error: Not enough free disk space](https://discuss.elastic.co/t/logstash-fatal-error-not-enough-free-disk-space/143649)

<div class="topic-metadata">

**Author:** [@PolterFox](https://discuss.elastic.co/u/PolterFox)\
**Replies:** 12\
**Last updated:** [August 29, 2018, 2:02pm UTC](https://discuss.elastic.co/t/logstash-fatal-error-not-enough-free-disk-space/143649 "2018-08-29T14:02:44Z")

</div>

Hey guys, I have a problem with logstash, I have configured a persisted queue to process the events of logstash. This setup worked, but I increased the RAM from the system an restarted the server, since that Logstash th…

---

## [How to aggregate multiple events coming from different logs with slight different timestamp, when the only field is timestamp to combine those?](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-coming-from-different-logs-with-slight-different-timestamp-when-the-only-field-is-timestamp-to-combine-those/287848)

<div class="topic-metadata">

**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\
**Replies:** 10\
**Last updated:** [November 5, 2021, 1:05pm UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-events-coming-from-different-logs-with-slight-different-timestamp-when-the-only-field-is-timestamp-to-combine-those/287848 "2021-11-05T13:05:14Z")

</div>

Hi, I have this situation: "How to aggregate multiple events coming from different logs with slight different timestamp, when the only common field could be the timesamp? I need to combine all data points into one dat…

---

## [Filebeat module cef syslog parse errors](https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148)

<div class="topic-metadata">

**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\
**Replies:** 12\
**Last updated:** [March 18, 2020, 11:53am UTC](https://discuss.elastic.co/t/filebeat-module-cef-syslog-parse-errors/220148 "2020-03-18T11:53:38Z")

</div>

Im using the cef module in filebeat to receive cef events from a ArcSight SmartConnector. The SmartConnector is configured for Port 5001 Protocol UDP and CEF Version 0.1. On the Filebeat side I receive on port 5001 and…

---

## [How to graph this?](https://discuss.elastic.co/t/how-to-graph-this/85927)

<div class="topic-metadata">

**Author:** [@imaad](https://discuss.elastic.co/u/imaad)\
**Replies:** 15\
**Last updated:** [May 17, 2017, 1:19pm UTC](https://discuss.elastic.co/t/how-to-graph-this/85927 "2017-05-17T13:19:20Z")

</div>

Hello, I need to graph the top 10 URI response over time with duration \> 5s. I managed to graph the top 10 URI reponse over time but I don't know how to add the condition duration \>5s.

[Previous page](https://discuss.elastic.co/top.md?page=119&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=121&per_page=50&period=all)
