# Top

**URL:** https://discuss.elastic.co/top.md?page=1216&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1217

---

## [How to synchronize tcpdump/pcap file time with kibana?](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706)

<div class="topic-metadata">

**Author:** [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Replies:** 2\
**Last updated:** [July 4, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-to-synchronize-tcpdump-pcap-file-time-with-kibana/91706 "2017-07-04T09:55:17Z")

</div>

I have a JSON data of pcap file as shown in I want to synchronize in kibana, but Here in kibana, "Index contains time-based events" (if I checked the box then unable to load the "Time-field name"),If I unchecked the bo…

---

## [Logstash Watch Folder for files changes](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770)

<div class="topic-metadata">

**Author:** [@kab](https://discuss.elastic.co/u/kab)\
**Replies:** 2\
**Last updated:** [April 10, 2017, 9:14am UTC](https://discuss.elastic.co/t/logstash-watch-folder-for-files-changes/81770 "2017-04-10T09:14:38Z")

</div>

Hi, Logstash v1.5.4 With this release version of logstash , any ideas of best way to scan folder to see if any files exists and push the file names to elastic search ? the selection pattern should be based on the c…

---

## [Logstash linkage between input and output](https://discuss.elastic.co/t/logstash-linkage-between-input-and-output/70080)

<div class="topic-metadata">

**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\
**Replies:** 2\
**Last updated:** [January 5, 2017, 5:51am UTC](https://discuss.elastic.co/t/logstash-linkage-between-input-and-output/70080 "2017-01-05T05:51:34Z")

</div>

Hi list experts Can anyone describe me in details, how logstash choose/link outputs ( among many output sections) for inputs that we had already defined ? Thanks Makara

---

## [Marvel in ES 2.4.2 and kibana 4.6.3 does not show any rates on the dashboard](https://discuss.elastic.co/t/marvel-in-es-2-4-2-and-kibana-4-6-3-does-not-show-any-rates-on-the-dashboard/68327)

<div class="topic-metadata">

**Author:** [@edi](https://discuss.elastic.co/u/edi)\
**Replies:** 2\
**Last updated:** [December 8, 2016, 8:44am UTC](https://discuss.elastic.co/t/marvel-in-es-2-4-2-and-kibana-4-6-3-does-not-show-any-rates-on-the-dashboard/68327 "2016-12-08T08:44:18Z")

</div>

Hi, I've installed marvel-agent in ES 2.4.2 and marvel in kibana 4.6.3. All configs are left to the defaults except elasticsearch.url. The indices get created (.marvel-es-1-YYYY.MM.DD) and are filled, but the marvel da…

---

## [Match\_phrase with a fixed word sequence?](https://discuss.elastic.co/t/match-phrase-with-a-fixed-word-sequence/1015)

<div class="topic-metadata">

**Author:** [@bobchou9](https://discuss.elastic.co/u/bobchou9)\
**Replies:** 2\
**Last updated:** [May 20, 2015, 6:35pm UTC](https://discuss.elastic.co/t/match-phrase-with-a-fixed-word-sequence/1015 "2015-05-20T18:35:09Z")

</div>

Hi there, when I try to use "match\_phrase" and "slop" to query a phrase, the sequence of words is not fixed, for example, if I search "quick fox" with slop 2, it will match either "quick brown fox" or "fox brown quick", …

---

## [ECS issues](https://discuss.elastic.co/t/ecs-issues/301804)

<div class="topic-metadata">

**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Replies:** 5\
**Last updated:** [April 15, 2022, 4:14pm UTC](https://discuss.elastic.co/t/ecs-issues/301804 "2022-04-15T16:14:53Z")

</div>

Hi, We have recently upgraded from 7.x to 8.x which overall has been OK. We have a number of feeds via logstash which were in place under 7.x which are indexing correctly due to having been created under 7.x, however w…

---

## [S3 input getting stuck and not deleting SQS messages](https://discuss.elastic.co/t/s3-input-getting-stuck-and-not-deleting-sqs-messages/267090)

<div class="topic-metadata">

**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\
**Replies:** 5\
**Last updated:** [April 1, 2021, 5:28pm UTC](https://discuss.elastic.co/t/s3-input-getting-stuck-and-not-deleting-sqs-messages/267090 "2021-04-01T17:28:50Z")

</div>

Hi, I'm with filebeat 7.10.0 on Ubuntu. I've configured filebeat to retrieve files from S3 bucket alike: filebeat.inputs: - type: s3 enabled: true queue\_url: "https://sqs.us-west-2.amazonaws.com/…

---

## [Display concurrency data on Kibana 5](https://discuss.elastic.co/t/display-concurrency-data-on-kibana-5/82894)

<div class="topic-metadata">

**Author:** [@kiranr20](https://discuss.elastic.co/u/kiranr20)\
**Replies:** 5\
**Last updated:** [April 21, 2017, 12:39am UTC](https://discuss.elastic.co/t/display-concurrency-data-on-kibana-5/82894 "2017-04-21T00:39:45Z")

</div>

Hi Friends, I have time series index which contains start data and duration for each event. I want to plot a graph to show the missing time duration for a particular day / week etc. What is the best way and which graph…

---

## [Index Templates API - Source](https://discuss.elastic.co/t/index-templates-api-source/7312)

<div class="topic-metadata">

**Author:** [@Nicolas\_Huray](https://discuss.elastic.co/u/Nicolas_Huray)\
**Replies:** 5\
**Last updated:** [May 1, 2012, 2:00pm UTC](https://discuss.elastic.co/t/index-templates-api-source/7312 "2012-05-01T14:00:52Z")

</div>

Hi Shay, Is there's a way with the Java client API to create a template and set the source like that : PutIndexTemplateResponse response = client.admin().indices() .preparePutTemplate("twitter\_template"). …

---

## [Unable to specify Environment value when using APM in .NET with AddOtlpExporter](https://discuss.elastic.co/t/unable-to-specify-environment-value-when-using-apm-in-net-with-addotlpexporter/301169)

<div class="topic-metadata">

**Author:** [@Vagif\_Abilov](https://discuss.elastic.co/u/Vagif_Abilov)\
**Replies:** 4\
**Last updated:** [April 1, 2022, 6:41am UTC](https://discuss.elastic.co/t/unable-to-specify-environment-value-when-using-apm-in-net-with-addotlpexporter/301169 "2022-04-01T06:41:28Z")

</div>

My application sends traces to the Elastic APM (v.8.1) using .NET OpenTelemetry OTLP Exporter: builder.AddOtlpExporter(o =\> { o.Endpoint = new Uri("..."); o.Headers = "Authorization=Bearer ..."; } It works fines an…

---

## [Rally Benchmark - Which race/benchmark to use for performance testing](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994)

<div class="topic-metadata">

**Author:** [@mmadhana](https://discuss.elastic.co/u/mmadhana)\
**Replies:** 1\
**Last updated:** [November 29, 2021, 4:55am UTC](https://discuss.elastic.co/t/rally-benchmark-which-race-benchmark-to-use-for-performance-testing/289994 "2021-11-29T04:55:57Z")

</div>

Hi, I am using Rally on ECK to test the performance of my hardware - CPU cores/memory, storage, and network usage. Which benchmark/race is compute-intensive and has a mix of indexing and concurrent search workload? I use…

---

## [Logstash TCP Output Plugin Reconnect Interval Issue](https://discuss.elastic.co/t/logstash-tcp-output-plugin-reconnect-interval-issue/251788)

<div class="topic-metadata">

**Author:** [@Paddy\_F](https://discuss.elastic.co/u/Paddy_F)\
**Replies:** 4\
**Last updated:** [October 15, 2020, 1:18pm UTC](https://discuss.elastic.co/t/logstash-tcp-output-plugin-reconnect-interval-issue/251788 "2020-10-15T13:18:46Z")

</div>

Hi, I'm having a problem with the logstash tcp output plugin, the reconnect\_interval does not seem to have an affect on the plugin's actual reconnect attempts? I may be misunderstanding what the field is used for exactl…

---

## [Newby](https://discuss.elastic.co/t/newby/50663)

<div class="topic-metadata">

**Author:** [@Jen](https://discuss.elastic.co/u/Jen)\
**Replies:** 4\
**Last updated:** [May 23, 2016, 4:34am UTC](https://discuss.elastic.co/t/newby/50663 "2016-05-23T04:34:51Z")

</div>

I started indexing. Then I changed my code to include additional fields but the new fields are "not indexed" according to Kibana. How do I make the new fields indexed as well? Thank you

---

## [Native script inconsistent (not found)](https://discuss.elastic.co/t/native-script-inconsistent-not-found/39839)

<div class="topic-metadata">

**Author:** [@cuongvt101](https://discuss.elastic.co/u/cuongvt101)\
**Replies:** 4\
**Last updated:** [January 22, 2016, 2:38pm UTC](https://discuss.elastic.co/t/native-script-inconsistent-not-found/39839 "2016-01-22T14:38:45Z")

</div>

I was given a development cluster with 2 nodes, there're about 700 indexes there. I installed a plugin and it works very inconsistently. Sometimes it works normally, sometimes when I modify the code a bit, I can build an…

---

## [Difference in shard size of primary and replica](https://discuss.elastic.co/t/difference-in-shard-size-of-primary-and-replica/178446)

<div class="topic-metadata">

**Author:** [@pokaleshrey](https://discuss.elastic.co/u/pokaleshrey)\
**Replies:** 2\
**Last updated:** [April 25, 2019, 12:48pm UTC](https://discuss.elastic.co/t/difference-in-shard-size-of-primary-and-replica/178446 "2019-04-25T12:48:36Z")

</div>

Hi, I have one replica. In all 2 data nodes. Off late i have observed that the size of primary is not in sync with it replica. Though the number of documents are same. /\_cat/shards is giving below results \*yindex 1 …

---

## [Linux-Endpoint-security State changed to DEGRADED-Artifact endpoint-trustlist-linux-v1 is unavailablee](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061)

<div class="topic-metadata">

**Author:** [@pedimave](https://discuss.elastic.co/u/pedimave)\
**Replies:** 3\
**Last updated:** [September 14, 2021, 5:21am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061 "2021-09-14T05:21:33Z")

</div>

I have installed Elastic 7.14 and testing Endoint Security over fleet with Linux Machines (Debian 10). All seems that is working but after few minutes appear the message : State changed to DEGRADED with all of them. Af…

---

## [Improve reindex speed into new cluster](https://discuss.elastic.co/t/improve-reindex-speed-into-new-cluster/159511)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 3\
**Last updated:** [December 8, 2018, 10:08am UTC](https://discuss.elastic.co/t/improve-reindex-speed-into-new-cluster/159511 "2018-12-08T10:08:38Z")

</div>

I'm reindexing 9.2TB-data index (~2bn documents) from a v2-created index (restored onto v5.6 cluster) into a v5 created 20-shard index (on same cluster). The elasticsearch cluster consists of 9-nodes, each with 32 GiB RA…

---

## [ESET File Security Quarantined .dim Files](https://discuss.elastic.co/t/eset-file-security-quarantined-dim-files/95258)

<div class="topic-metadata">

**Author:** [@mhasanbulli](https://discuss.elastic.co/u/mhasanbulli)\
**Replies:** 3\
**Last updated:** [August 1, 2017, 3:44am UTC](https://discuss.elastic.co/t/eset-file-security-quarantined-dim-files/95258 "2017-08-01T03:44:43Z")

</div>

Hello, I have set up a local Elasticsearch instance with two nodes. I have Logstash sending documents every 15 minutes. Today one of our IT members warned me that there are some "viruses" on the Windows server I was giv…

---

## [Iis日志分段格式和映射](https://discuss.elastic.co/t/iis/92006)

<div class="topic-metadata">

**Author:** [@dog](https://discuss.elastic.co/u/dog)\
**Replies:** 3\
**Last updated:** [August 1, 2017, 2:47am UTC](https://discuss.elastic.co/t/iis/92006 "2017-08-01T02:47:34Z")

</div>

我需要解析IIS的日志文件，，我想它在Kibana里得日志看起来是这样的格式，我看了文档，做了一些尝试之后，现在毫无进展，有人可以帮助我吗 我希望在Kibana显示的日志模板大致为 "date"：2017-07-06 02:09:01 "serverIP": 127.0.0.1 "method": GET

---

## [Restarting Elasticsearch node 2.0](https://discuss.elastic.co/t/restarting-elasticsearch-node-2-0/37957)

<div class="topic-metadata">

**Author:** [@mramaprasad](https://discuss.elastic.co/u/mramaprasad)\
**Replies:** 3\
**Last updated:** [December 24, 2015, 9:43pm UTC](https://discuss.elastic.co/t/restarting-elasticsearch-node-2-0/37957 "2015-12-24T21:43:15Z")

</div>

I used to run curl -XPOST 'http://localhost:9200/\_shutdown' to shut down all nodes and start one node at a time during cluster restarts in order not to re balance the shard allocation. Since this command is disabled in…

---

## [Getting document by document id](https://discuss.elastic.co/t/getting-document-by-document-id/31806)

<div class="topic-metadata">

**Author:** [@mramaprasad](https://discuss.elastic.co/u/mramaprasad)\
**Replies:** 3\
**Last updated:** [October 7, 2015, 11:07pm UTC](https://discuss.elastic.co/t/getting-document-by-document-id/31806 "2015-10-07T23:07:39Z")

</div>

I have an indexed documents to elastic search with "/" (like 13.89/sdc.2002.10009) as doc id. When I try to get by id curl -XGET 'http://localhost:9200/csv1/testl/13.89/sdc.2002.10009' Gives me error No handler found f…

---

## [Elasticsearch autocomplete- / suggest by token](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/18392)

<div class="topic-metadata">

**Author:** [@Christian\_Rutgers](https://discuss.elastic.co/u/Christian_Rutgers)\
**Replies:** 3\
**Last updated:** [March 16, 2015, 4:39pm UTC](https://discuss.elastic.co/t/elasticsearch-autocomplete-suggest-by-token/18392 "2015-03-16T16:39:46Z")

</div>

After I had read \> 100 articles, blog-posts, documentation pages and much more I'll ask the community but still wonder where my blind spot is, if I had overseen the obvious. I want to create search-suggestions …

---

## [Bulk API does not work for huge data!](https://discuss.elastic.co/t/bulk-api-does-not-work-for-huge-data/22366)

<div class="topic-metadata">

**Author:** [@Ali\_Lotfdar](https://discuss.elastic.co/u/Ali_Lotfdar)\
**Replies:** 3\
**Last updated:** [February 25, 2015, 4:28pm UTC](https://discuss.elastic.co/t/bulk-api-does-not-work-for-huge-data/22366 "2015-02-25T16:28:26Z")

</div>

Dear All, I use bulk Api "$ curl -s -XPOST localhost:9200/\_bulk --data-binary @requests; for a file 1.43GB. But after execution nothing happen! For small files I do not have any problem. Thanks to let me know if…

---

## [Aggregation - Blank and date aggregation](https://discuss.elastic.co/t/aggregation-blank-and-date-aggregation/21628)

<div class="topic-metadata">

**Author:** [@bvnagaraju](https://discuss.elastic.co/u/bvnagaraju)\
**Replies:** 7\
**Last updated:** [January 16, 2015, 9:50am UTC](https://discuss.elastic.co/t/aggregation-blank-and-date-aggregation/21628 "2015-01-16T09:50:13Z")

</div>

Hi , Can some one help me on this ? Does term aggregation counts on blank field values ? Does term aggregation is enough for doing date aggregation ? Or there any specific aggregations we have ?All I need in d…

---

## [How to convert timestamp in milliseconds i,e long using elastic-sql](https://discuss.elastic.co/t/how-to-convert-timestamp-in-milliseconds-i-e-long-using-elastic-sql/295543)

<div class="topic-metadata">

**Author:** [@David\_Samm](https://discuss.elastic.co/u/David_Samm)\
**Replies:** 1\
**Last updated:** [January 27, 2022, 7:39am UTC](https://discuss.elastic.co/t/how-to-convert-timestamp-in-milliseconds-i-e-long-using-elastic-sql/295543 "2022-01-27T07:39:33Z")

</div>

Hi, I have timestamp fields where I want to convert this timestamp to long i,e milliseconds GET /\_sql { "query":"select "2017-11-13T13:51:00.000Z" as date from employee " } here I want the timestamp "201…

---

## [Error: can’t merge a non object mapping with an object mapping](https://discuss.elastic.co/t/error-can-t-merge-a-non-object-mapping-with-an-object-mapping/276773)

<div class="topic-metadata">

**Author:** [@jofr](https://discuss.elastic.co/u/jofr)\
**Replies:** 1\
**Last updated:** [June 30, 2021, 7:45am UTC](https://discuss.elastic.co/t/error-can-t-merge-a-non-object-mapping-with-an-object-mapping/276773 "2021-06-30T07:45:50Z")

</div>

Somehow I can not define a geo\_point field type in the Elasticsearch mapping and then import data with Logstash. The details are described here in this Stackoverflow question. If I do not define an Elasticsearch mapping…

---

## [ES Continuous Transforms Checkpoint not updating](https://discuss.elastic.co/t/es-continuous-transforms-checkpoint-not-updating/265421)

<div class="topic-metadata">

**Author:** [@sphinx](https://discuss.elastic.co/u/sphinx)\
**Replies:** 1\
**Last updated:** [March 2, 2021, 2:42pm UTC](https://discuss.elastic.co/t/es-continuous-transforms-checkpoint-not-updating/265421 "2021-03-02T14:42:34Z")

</div>

Hi, this is pertaining to ES 7.10.2 with X-Pack. I am trying out transforms because we have a need to have a aggregate table of entities to be queried by downstream applications. we have a set of indices that the tran…

---

## [server.basePath assistance](https://discuss.elastic.co/t/server-basepath-assistance/102766)

<div class="topic-metadata">

**Author:** [@roquefort](https://discuss.elastic.co/u/roquefort)\
**Replies:** 1\
**Last updated:** [October 4, 2017, 10:46pm UTC](https://discuss.elastic.co/t/server-basepath-assistance/102766 "2017-10-04T22:46:11Z")

</div>

Greetings, I have been struggling to figure out how to proxy Kibana requests on my Docker swarm mode cluster. I am using the "Traefik" reverse proxy, and this works perfectly for domain-based Kibana (e.g. "kibana.domain…

---

## [Getting \_groktimeout](https://discuss.elastic.co/t/getting--groktimeout/98279)

<div class="topic-metadata">

**Author:** [@Amit2015](https://discuss.elastic.co/u/Amit2015)\
**Replies:** 1\
**Last updated:** [August 24, 2017, 7:21pm UTC](https://discuss.elastic.co/t/getting--groktimeout/98279 "2017-08-24T19:21:32Z")

</div>

Hi, I have ingest logs and in kibana some of logs getting \_groktimeout in tags. Any idea to solve this error? Thanks!

---

## [All commands returning - failed to process cluster event (503)](https://discuss.elastic.co/t/all-commands-returning-failed-to-process-cluster-event-503/18276)

<div class="topic-metadata">

**Author:** [@Ashish\_Nigam\_3](https://discuss.elastic.co/u/Ashish_Nigam_3)\
**Replies:** 1\
**Last updated:** [June 23, 2014, 11:50pm UTC](https://discuss.elastic.co/t/all-commands-returning-failed-to-process-cluster-event-503/18276 "2014-06-23T23:50:05Z")

</div>

Hi, Production cluster is in yellow state for more than a day now. I do see that unassigned shards are decreasing, but at a very slow pace. (600 shards in last 5 hours) So, I decided to remove very old indexes and al…

---

## [A node cannot be upgraded directly from version \[7.10.2\] to version \[8.4.3\], it must first be upgraded to version \[7.17.0\]](https://discuss.elastic.co/t/a-node-cannot-be-upgraded-directly-from-version-7-10-2-to-version-8-4-3-it-must-first-be-upgraded-to-version-7-17-0/317036)

<div class="topic-metadata">

**Author:** [@SUNA](https://discuss.elastic.co/u/SUNA)\
**Replies:** 6\
**Last updated:** [October 20, 2022, 3:27am UTC](https://discuss.elastic.co/t/a-node-cannot-be-upgraded-directly-from-version-7-10-2-to-version-8-4-3-it-must-first-be-upgraded-to-version-7-17-0/317036 "2022-10-20T03:27:11Z")

</div>

Hi Team, I'm not sure how elastic verion managed to upgrade the major version without tried anyone. Did the stack try to upgrade itself? Kindly help how can i fix this error. my kibana down due to this error

---

## [Elasticsearch Indexing Not Working Periodically](https://discuss.elastic.co/t/elasticsearch-indexing-not-working-periodically/247036)

<div class="topic-metadata">

**Author:** [@jaydba](https://discuss.elastic.co/u/jaydba)\
**Replies:** 6\
**Last updated:** [September 1, 2020, 7:17pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-not-working-periodically/247036 "2020-09-01T19:17:43Z")

</div>

Hello; I am very new to working with Elasticsearch, but I've come up against an error that the vendor of our software (bundled with Elasticsearch) is not able to solve or find a root cause of. Unfortunately I am not se…

---

## [Elasticsearch server is not starting on Ramdisk (imdisk)](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting-on-ramdisk-imdisk/222167)

<div class="topic-metadata">

**Author:** [@MadhukarA](https://discuss.elastic.co/u/MadhukarA)\
**Replies:** 6\
**Last updated:** [March 10, 2020, 8:13pm UTC](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting-on-ramdisk-imdisk/222167 "2020-03-10T20:13:49Z")

</div>

I am unable to start Elasticsearch when path.data was set to a location on Ramdisk (Imdisk). It throws the following error: elasticsearch-7.6.0-windows-x86\_64\\elasticsearch-7.6.0\\bin\>.\\elasticsearch.bat OpenJDK 64-B…

---

## [Logstash 2.4 output won't execute until stop](https://discuss.elastic.co/t/logstash-2-4-output-wont-execute-until-stop/65769)

<div class="topic-metadata">

**Author:** [@yiju](https://discuss.elastic.co/u/yiju)\
**Replies:** 6\
**Last updated:** [November 15, 2016, 8:40am UTC](https://discuss.elastic.co/t/logstash-2-4-output-wont-execute-until-stop/65769 "2016-11-15T08:40:28Z")

</div>

Hi, I am running logstash 2.4 on ubuntu 14.0.4. My config file is: input { file { path =\> "/home/spark/\*.log" start\_position =\> beginning codec =\> multiline { pattern =\> "(^\\d+…

---

## [\[Hadoop\] Hadoop plugin indices with ':' colon - not able to snapshot (?)](https://discuss.elastic.co/t/hadoop-hadoop-plugin-indices-with-colon-not-able-to-snapshot/19561)

<div class="topic-metadata">

**Author:** [@Mateusz\_Kaczynski](https://discuss.elastic.co/u/Mateusz_Kaczynski)\
**Replies:** 6\
**Last updated:** [September 2, 2014, 3:04pm UTC](https://discuss.elastic.co/t/hadoop-hadoop-plugin-indices-with-colon-not-able-to-snapshot/19561 "2014-09-02T15:04:45Z")

</div>

Whenever I try to take a snapshot of an index which contains a ':' colon in its name,I end up with the following trace: { "error":"IllegalArgumentException\[java.net.URISyntaxException: Relative path in absol…

---

## [Marvel Indices taking lot of space ? Can we specify automatic delete of marvel indice?](https://discuss.elastic.co/t/marvel-indices-taking-lot-of-space-can-we-specify-automatic-delete-of-marvel-indice/17460)

<div class="topic-metadata">

**Author:** [@deepakas](https://discuss.elastic.co/u/deepakas)\
**Replies:** 6\
**Last updated:** [May 19, 2014, 9:39am UTC](https://discuss.elastic.co/t/marvel-indices-taking-lot-of-space-can-we-specify-automatic-delete-of-marvel-indice/17460 "2014-05-19T09:39:40Z")

</div>

Is there a way to set marvel to delete the marvel indices after 7 days. It looks like Marvel is generating around 2 GB of data everyday. Our disk got full 2 times because of Marvel data. Is there a way to reduce the amo…

---

## [EQL query help](https://discuss.elastic.co/t/eql-query-help/286974)

<div class="topic-metadata">

**Author:** [@Billz1026](https://discuss.elastic.co/u/Billz1026)\
**Replies:** 0\
**Last updated:** [October 18, 2021, 10:35am UTC](https://discuss.elastic.co/t/eql-query-help/286974 "2021-10-18T10:35:46Z")

</div>

Hi All, I am using EQL to write detection rues. I have a sequence of evens as follows. Event A Event B Event C I want to raise an alert if the time between Event A and Event C exceeds 30 seconds. I tried with maxspa…

---

## [Heartbeat can't connect to endpoint with cert and key](https://discuss.elastic.co/t/heartbeat-cant-connect-to-endpoint-with-cert-and-key/208436)

<div class="topic-metadata">

**Author:** [@rdaimler](https://discuss.elastic.co/u/rdaimler)\
**Replies:** 8\
**Last updated:** [December 17, 2019, 1:56am UTC](https://discuss.elastic.co/t/heartbeat-cant-connect-to-endpoint-with-cert-and-key/208436 "2019-12-17T01:56:03Z")

</div>

Hello, I'm trying to check an endpoint that requires a cert and key. I get a Client.Timeout exceeded while awaiting headers error. - type: http id: Bitbucket schedule: '@every 20s' urls: \["https://bark.tgyu.com/b…

---

## [Logstash automatically loading the config file](https://discuss.elastic.co/t/logstash-automatically-loading-the-config-file/208790)

<div class="topic-metadata">

**Author:** [@Avinaba\_Ghosh\_Hajra](https://discuss.elastic.co/u/Avinaba_Ghosh_Hajra)\
**Replies:** 8\
**Last updated:** [November 21, 2019, 9:06am UTC](https://discuss.elastic.co/t/logstash-automatically-loading-the-config-file/208790 "2019-11-21T09:06:11Z")

</div>

Logstash is running via systemctl. It is loading the configuration file automatically after certain interval.So the Configuration file which contains an SQL query is loaded multiple times. JDBC plugin does not contain a…

---

## [TransportClient ElasticSearch 6.0](https://discuss.elastic.co/t/transportclient-elasticsearch-6-0/117603)

<div class="topic-metadata">

**Author:** [@Panagiota\_Papagianni](https://discuss.elastic.co/u/Panagiota_Papagianni)\
**Replies:** 8\
**Last updated:** [February 1, 2018, 9:51am UTC](https://discuss.elastic.co/t/transportclient-elasticsearch-6-0/117603 "2018-02-01T09:51:51Z")

</div>

I use TransportClient in order to connect with ES but the operation was too slow. In order to see what's going on, I measure time. The response from ES was 1ms which is fine but the client.close() operation was too slow. …

---

## [\[Enhancement\] Integrate new topic auto-suggest with elastic.co content](https://discuss.elastic.co/t/enhancement-integrate-new-topic-auto-suggest-with-elastic-co-content/26675)

<div class="topic-metadata">

**Author:** [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Replies:** 0\
**Last updated:** [August 1, 2015, 12:54pm UTC](https://discuss.elastic.co/t/enhancement-integrate-new-topic-auto-suggest-with-elastic-co-content/26675 "2015-08-01T12:54:25Z")

</div>

When a user starts to create a new topic, a list of similar topics is shown to the user ("Your topic is similar to..."). @colings86 and I were discussing this and wondering if this list could also include suggestions fro…

---

## [Renaming Values](https://discuss.elastic.co/t/renaming-values/296769)

<div class="topic-metadata">

**Author:** [@chin1](https://discuss.elastic.co/u/chin1)\
**Replies:** 2\
**Last updated:** [February 10, 2022, 2:09am UTC](https://discuss.elastic.co/t/renaming-values/296769 "2022-02-10T02:09:06Z")

</div>

Hi there, Is there away to rename values within visuals? so for example filtering Colors which outputs 1 , 2 I want to rename these 1 == 'Red' 2== 'Blue' etc.

---

## [Csv load with logstash not working](https://discuss.elastic.co/t/csv-load-with-logstash-not-working/183139)

<div class="topic-metadata">

**Author:** [@soufiane1](https://discuss.elastic.co/u/soufiane1)\
**Replies:** 2\
**Last updated:** [May 29, 2019, 8:12am UTC](https://discuss.elastic.co/t/csv-load-with-logstash-not-working/183139 "2019-05-29T08:12:16Z")

</div>

Hello everyone, I am trying to load a csv file with logstash with the following conf : ############################################################################################################################ input …

---

## [Field\_value\_factor on nested field with dynamic mapping](https://discuss.elastic.co/t/field-value-factor-on-nested-field-with-dynamic-mapping/158501)

<div class="topic-metadata">

**Author:** [@inversive](https://discuss.elastic.co/u/inversive)\
**Replies:** 2\
**Last updated:** [December 4, 2018, 10:13am UTC](https://discuss.elastic.co/t/field-value-factor-on-nested-field-with-dynamic-mapping/158501 "2018-12-04T10:13:51Z")

</div>

I'm trying to boost the \_score of documents by using the value (double) that is present in a dynamic field in a nested structure. This is (part of) my mapping: { "\_doc": { ... "dynamic": "strict",…

---

## [How to filter out system indices?](https://discuss.elastic.co/t/how-to-filter-out-system-indices/137851)

<div class="topic-metadata">

**Author:** [@Jinggang\_Diao](https://discuss.elastic.co/u/Jinggang_Diao)\
**Replies:** 1\
**Last updated:** [June 28, 2018, 7:30pm UTC](https://discuss.elastic.co/t/how-to-filter-out-system-indices/137851 "2018-06-28T19:30:24Z")

</div>

I cannot find any documentation on system indices. I want to retrieve all non-system indices and the way I am doing it is to get all indices first and filter out system indices. The filter I am using is "does the index …

---

## [Installing elasticsearch 5.4 in a system having elasticsearch 2.3.3 already installed](https://discuss.elastic.co/t/installing-elasticsearch-5-4-in-a-system-having-elasticsearch-2-3-3-already-installed/86061)

<div class="topic-metadata">

**Author:** [@ajoealex](https://discuss.elastic.co/u/ajoealex)\
**Replies:** 1\
**Last updated:** [May 19, 2017, 6:30am UTC](https://discuss.elastic.co/t/installing-elasticsearch-5-4-in-a-system-having-elasticsearch-2-3-3-already-installed/86061 "2017-05-19T06:30:24Z")

</div>

I am trying to install elasticsearch 5.4. But elasticsearch 2.3.3 is already installed in my system. Without touching the old settings, I need to install new 5.4 version. Already a service named elasticsearch 2.3.3(ela…

---

## [I want to get all the spaces in my kibana using python API](https://discuss.elastic.co/t/i-want-to-get-all-the-spaces-in-my-kibana-using-python-api/327859)

<div class="topic-metadata">

**Author:** [@Bhrugu\_Sharma](https://discuss.elastic.co/u/Bhrugu_Sharma)\
**Replies:** 3\
**Last updated:** [April 12, 2023, 5:14pm UTC](https://discuss.elastic.co/t/i-want-to-get-all-the-spaces-in-my-kibana-using-python-api/327859 "2023-04-12T17:14:49Z")

</div>

I am trying to write a python script to get all the spaces in my Kibana spaces I tried all the different combos but there seems to be no proper way for it. Here are the few examples that i tired resp = client.api.space…

---

## [Elasticsearch status RED](https://discuss.elastic.co/t/elasticsearch-status-red/85685)

<div class="topic-metadata">

**Author:** [@rrs](https://discuss.elastic.co/u/rrs)\
**Replies:** 3\
**Last updated:** [May 15, 2017, 8:57am UTC](https://discuss.elastic.co/t/elasticsearch-status-red/85685 "2017-05-15T08:57:39Z")

</div>

Hi All, I am I bit confused about my Elasticsearch index. Some of the the indexes are turned into RED, while some are in Yellow status. I am suspecting the issue with unassigned\_shards. Can anyone explain me is the E…

---

## [Constant high CPU consumption after bulk](https://discuss.elastic.co/t/constant-high-cpu-consumption-after-bulk/75448)

<div class="topic-metadata">

**Author:** [@frank-montyne](https://discuss.elastic.co/u/frank-montyne)\
**Replies:** 3\
**Last updated:** [February 17, 2017, 4:51pm UTC](https://discuss.elastic.co/t/constant-high-cpu-consumption-after-bulk/75448 "2017-02-17T16:51:35Z")

</div>

Hi, I'm using ElasticSearch 5.2.1 (using 4GB ram, single node on a 16 GB machine with SSD) and have the following problem: I'm using the Java client to communicate with ElasticSearch. One of my Maven projects has a str…

---

## [Document\_id in redis](https://discuss.elastic.co/t/document-id-in-redis/51323)

<div class="topic-metadata">

**Author:** [@Swen](https://discuss.elastic.co/u/Swen)\
**Replies:** 3\
**Last updated:** [May 31, 2016, 5:44am UTC](https://discuss.elastic.co/t/document-id-in-redis/51323 "2016-05-31T05:44:06Z")

</div>

My input comes from a rest service that is digging in a database. Every time I request the service, I get events from the last 24 hours (for instance). That means, when I request the service every hour I will get a few …

[Previous page](https://discuss.elastic.co/top.md?page=1215&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1217&per_page=50&period=all)
