# Top

**URL:** https://discuss.elastic.co/top.md?page=1248&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1249

---

## [Limiting Initial Scope of Winlogbeat](https://discuss.elastic.co/t/limiting-initial-scope-of-winlogbeat/53847)

<div class="topic-metadata">

**Author:** [@rgibson](https://discuss.elastic.co/u/rgibson)\
**Replies:** 2\
**Last updated:** [June 26, 2016, 8:06am UTC](https://discuss.elastic.co/t/limiting-initial-scope-of-winlogbeat/53847 "2016-06-26T08:06:01Z")

</div>

Is there a configuration option to restrict the initial ingestion of Winlogbeat to something less than the entirety of the logs, perhaps by date? For example, I am trying to onboard about 350 Windows servers, and when …

---

## [How to deal with different log in input?](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146)

<div class="topic-metadata">

**Author:** [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)\
**Replies:** 2\
**Last updated:** [June 10, 2016, 12:12pm UTC](https://discuss.elastic.co/t/how-to-deal-with-different-log-in-input/52146 "2016-06-10T12:12:45Z")

</div>

I have a lot of logs to deal,they have different format. For example, some are one log with one line, but some are one log with several lines. First I use multiline in filter, but the logstash show: Defaulting pipeli…

---

## [Dynamically adding replicas to index](https://discuss.elastic.co/t/dynamically-adding-replicas-to-index/27133)

<div class="topic-metadata">

**Author:** [@Pavel\_Pavelsky](https://discuss.elastic.co/u/Pavel_Pavelsky)\
**Replies:** 2\
**Last updated:** [August 10, 2015, 11:09pm UTC](https://discuss.elastic.co/t/dynamically-adding-replicas-to-index/27133 "2015-08-10T23:09:20Z")

</div>

Is it possible to dynamically add as many replicas to my cluster as I want? My setup is: 1 index with 1 shard and 1 replica, and in case of high load I want to add more replicas to handle more requests. I don't know ahea…

---

## [Filebeat - Exiting: error unpacking config data: more than one namespace configured accessing 'queue'](https://discuss.elastic.co/t/filebeat-exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-queue/319028)

<div class="topic-metadata">

**Author:** [@pszemesy](https://discuss.elastic.co/u/pszemesy)\
**Replies:** 1\
**Last updated:** [November 18, 2022, 11:56am UTC](https://discuss.elastic.co/t/filebeat-exiting-error-unpacking-config-data-more-than-one-namespace-configured-accessing-queue/319028 "2022-11-18T11:56:50Z")

</div>

Hi All, I have received the following error message in the /var/log/messages - while filebeat won't start: Exiting: error unpacking config data: more than one namespace configured accessing 'queue' (source:'/usr/asdf/e…

---

## [Can't compile elasticsearch from source: error: release version 11 not supported](https://discuss.elastic.co/t/cant-compile-elasticsearch-from-source-error-release-version-11-not-supported/266797)

<div class="topic-metadata">

**Author:** [@Kazimazi](https://discuss.elastic.co/u/Kazimazi)\
**Replies:** 1\
**Last updated:** [March 11, 2021, 12:24pm UTC](https://discuss.elastic.co/t/cant-compile-elasticsearch-from-source-error-release-version-11-not-supported/266797 "2021-03-11T12:24:51Z")

</div>

First and foremost I'm kinda new, so I might be missing something very basic. I'm trying to compile elasticsearch from source from master branch (060b3aadd60116e6055e3fc35f472687719b7658). I've installed openjdk15 on a …

---

## [ES 5.6 - Delete by query](https://discuss.elastic.co/t/es-5-6-delete-by-query/240745)

<div class="topic-metadata">

**Author:** [@natasha\_adewar](https://discuss.elastic.co/u/natasha_adewar)\
**Replies:** 7\
**Last updated:** [July 14, 2020, 4:29am UTC](https://discuss.elastic.co/t/es-5-6-delete-by-query/240745 "2020-07-14T04:29:47Z")

</div>

We have an index in ES 2.4 that holds 120 million plus documents with different ttl values on each of them and we do insert upto 700k documents every day into the same index. We are now migrating to ES 5.6 and are plann…

---

## [Watcher "Failed to execute" error](https://discuss.elastic.co/t/watcher-failed-to-execute-error/108585)

<div class="topic-metadata">

**Author:** [@Speedman](https://discuss.elastic.co/u/Speedman)\
**Replies:** 1\
**Last updated:** [November 21, 2017, 4:48pm UTC](https://discuss.elastic.co/t/watcher-failed-to-execute-error/108585 "2017-11-21T16:48:09Z")

</div>

I am new to Watcher and will readily confess that I'm having difficulty figuring out how to create an alert when we're experiencing timeouts on our transaction processors. Here's the goal: If we have 5 or more timeouts …

---

## [There no grok ,geoip information](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636)

<div class="topic-metadata">

**Author:** [@Joe\_Yang](https://discuss.elastic.co/u/Joe_Yang)\
**Replies:** 7\
**Last updated:** [August 4, 2017, 10:48pm UTC](https://discuss.elastic.co/t/there-no-grok-geoip-information/95636 "2017-08-04T22:48:24Z")

</div>

We followed this link to configure elasticsearch, filebeat and logslash(https://www.elastic.co/guide/en/logstash/5.4/advanced-pipeline.html), but there’s no ip and geo information after running curl as follows, any advic…

---

## [Docker-compose start false](https://discuss.elastic.co/t/docker-compose-start-false/322189)

<div class="topic-metadata">

**Author:** [@freemankevin](https://discuss.elastic.co/u/freemankevin)\
**Replies:** 4\
**Last updated:** [January 3, 2023, 3:31am UTC](https://discuss.elastic.co/t/docker-compose-start-false/322189 "2023-01-03T03:31:06Z")

</div>

The 'setup' part cannot be executed repeatedly, there is a problem with the shell script, can you update the description in the official document (Install Elasticsearch with Docker | Elasticsearch Guide \[8.5\] | Elastic) …

---

## [Recommendation or best practice for monitoring SystemD service state](https://discuss.elastic.co/t/recommendation-or-best-practice-for-monitoring-systemd-service-state/296075)

<div class="topic-metadata">

**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\
**Replies:** 4\
**Last updated:** [March 21, 2022, 8:56pm UTC](https://discuss.elastic.co/t/recommendation-or-best-practice-for-monitoring-systemd-service-state/296075 "2022-03-21T20:56:02Z")

</div>

Hello, I would like to generate an alert if a service is not running, but I can't see a straight forward way to do this. I can monitor the process the service starts up, but I was curious if there was a good way to mon…

---

## [No data in Auditbeat events when using include\_fields processor](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802)

<div class="topic-metadata">

**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\
**Replies:** 4\
**Last updated:** [February 8, 2018, 7:45am UTC](https://discuss.elastic.co/t/no-data-in-auditbeat-events-when-using-include-fields-processor/118802 "2018-02-08T07:45:46Z")

</div>

Hey, I'm trying to run auditbeat for the first time on debian jessie. I've downloaded the current .deb (6.2) and configured auditbeat to log everything that it can (using the auditbeat.reference.yaml). It's also exporti…

---

## [Add\_field](https://discuss.elastic.co/t/add-field/58663)

<div class="topic-metadata">

**Author:** [@Lucifer\_hbp](https://discuss.elastic.co/u/Lucifer_hbp)\
**Replies:** 4\
**Last updated:** [August 24, 2016, 7:11am UTC](https://discuss.elastic.co/t/add-field/58663 "2016-08-24T07:11:16Z")

</div>

Hi again, i hav written following 2 pattern inside single match because i hav log files with 2 different patterns: grok { match =\> \["message","%{BR1}%{SYSTEMDATE:timestamp}%{BR2} %{GREEDYDATA:Msg}", …

---

## [Tribe node on multiple clusters with identical index names](https://discuss.elastic.co/t/tribe-node-on-multiple-clusters-with-identical-index-names/45145)

<div class="topic-metadata">

**Author:** [@dloi](https://discuss.elastic.co/u/dloi)\
**Replies:** 4\
**Last updated:** [March 22, 2016, 10:37pm UTC](https://discuss.elastic.co/t/tribe-node-on-multiple-clusters-with-identical-index-names/45145 "2016-03-22T22:37:15Z")

</div>

Hi All, I'm trying to set up a tribe node that connects to multiple clusters with identical index names. Tribe node is only able to return query results from just one cluster. According to the documentation, "When ther…

---

## [Logstash is shutting down after connecting to Elastic Search due to One or more required cgroup files or directories not found](https://discuss.elastic.co/t/logstash-is-shutting-down-after-connecting-to-elastic-search-due-to-one-or-more-required-cgroup-files-or-directories-not-found/347448)

<div class="topic-metadata">

**Author:** [@sathishkumarD](https://discuss.elastic.co/u/sathishkumarD)\
**Replies:** 6\
**Last updated:** [November 19, 2023, 1:56pm UTC](https://discuss.elastic.co/t/logstash-is-shutting-down-after-connecting-to-elastic-search-due-to-one-or-more-required-cgroup-files-or-directories-not-found/347448 "2023-11-19T13:56:15Z")

</div>

\[2023-11-18T14:35:04,262\]\[DEBUG\]\[org.logstash.execution.PeriodicFlush\]\[main\] Pushing flush onto pipeline. \[2023-11-18T14:35:04,906\]\[DEBUG\]\[logstash.instrument.periodicpoller.cgroup\] One or more required cgroup files or …

---

## [How to link to entries triggering a rule](https://discuss.elastic.co/t/how-to-link-to-entries-triggering-a-rule/327334)

<div class="topic-metadata">

**Author:** [@blindahl](https://discuss.elastic.co/u/blindahl)\
**Replies:** 6\
**Last updated:** [March 31, 2023, 9:19pm UTC](https://discuss.elastic.co/t/how-to-link-to-entries-triggering-a-rule/327334 "2023-03-31T21:19:26Z")

</div>

We have setup some Rules and Alerts that should trigger if we get error in our logs. In the mail that is sent when a rule is triggered it feels natural to include a link to Discover view with some filters setup and with …

---

## [Filebeat keeps file handle on deleted logfile](https://discuss.elastic.co/t/filebeat-keeps-file-handle-on-deleted-logfile/312608)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 6\
**Last updated:** [August 25, 2022, 1:29pm UTC](https://discuss.elastic.co/t/filebeat-keeps-file-handle-on-deleted-logfile/312608 "2022-08-25T13:29:43Z")

</div>

Hi, I have following issue and hope you can provide a solution. We are using elastic stack for monitoring our application. Priority 1: application must run Priority 2: monitoring should run to support and monitor the…

---

## [Vector Tile API response id: (integer) Unique ID for the feature within the layer not found in hits or aggs layer](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952)

<div class="topic-metadata">

**Author:** [@Joseph\_Parish](https://discuss.elastic.co/u/Joseph_Parish)\
**Replies:** 6\
**Last updated:** [March 18, 2022, 8:26pm UTC](https://discuss.elastic.co/t/vector-tile-api-response-id-integer-unique-id-for-the-feature-within-the-layer-not-found-in-hits-or-aggs-layer/299952 "2022-03-18T20:26:32Z")

</div>

Hi I am testing the Vector Tile API using this repo which is an excellent tool. I would like to use the feature-id within the hits layer of a polygon, but get this: Error: The feature id parameter must be provided. I …

---

## [Kv plugin not parsing null value](https://discuss.elastic.co/t/kv-plugin-not-parsing-null-value/138751)

<div class="topic-metadata">

**Author:** [@yodog](https://discuss.elastic.co/u/yodog)\
**Replies:** 5\
**Last updated:** [July 23, 2018, 11:23pm UTC](https://discuss.elastic.co/t/kv-plugin-not-parsing-null-value/138751 "2018-07-23T23:23:14Z")

</div>

using kv to parse iptables logs, i cant get it to save the MAC field \[2928868.448110\] \[iptables\] LOGDROP IN=eth0 OUT= MAC=00:50:56:9a:13:2a:02:1f:a0:00:0d:01:08:00 SRC=5.188.207.7 DST=8.8.8.8 LEN=60 TOS=0x08 PREC=0x20 …

---

## [Mapping for 12h date format](https://discuss.elastic.co/t/mapping-for-12h-date-format/68433)

<div class="topic-metadata">

**Author:** [@chrisinho](https://discuss.elastic.co/u/chrisinho)\
**Replies:** 5\
**Last updated:** [December 8, 2016, 3:25pm UTC](https://discuss.elastic.co/t/mapping-for-12h-date-format/68433 "2016-12-08T15:25:57Z")

</div>

Hi, i have a log format with a timestamp like this : Dez 08, 2016 8:17:29 AM I use a custom grok pattern for it in logstash. When i want elasticsearch to map it i get a mapper\_parsing\_exception. It says invalid form…

---

## [3G/s reads with fusion](https://discuss.elastic.co/t/3g-s-reads-with-fusion/25165)

<div class="topic-metadata">

**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\
**Replies:** 5\
**Last updated:** [July 10, 2015, 3:37pm UTC](https://discuss.elastic.co/t/3g-s-reads-with-fusion/25165 "2015-07-10T15:37:11Z")

</div>

Just for fun and search! \[smile\] Testing with 1.6.0 and Linux 4 Nodes 1.5 billion documents 7 indexes. 1 query with simple "user id" filter and 20 aggregations using doc values. Unofficial number by eyeballing ioto…

---

## [ConnectionClosedException: When trying to connect to Elasticsearch using Java High Level Client](https://discuss.elastic.co/t/connectionclosedexception-when-trying-to-connect-to-elasticsearch-using-java-high-level-client/270661)

<div class="topic-metadata">

**Author:** [@Jenisha\_Ramanathan](https://discuss.elastic.co/u/Jenisha_Ramanathan)\
**Replies:** 1\
**Last updated:** [April 22, 2021, 12:07pm UTC](https://discuss.elastic.co/t/connectionclosedexception-when-trying-to-connect-to-elasticsearch-using-java-high-level-client/270661 "2021-04-22T12:07:54Z")

</div>

Hi Team, I'm trying to connect Java to https Elasticsearch using Java High Level Client. Getting ConnectionClosedException when trying to check for existing index that are available in elasticsearch. And the elasticsea…

---

## [AuditBeat Will Not Start](https://discuss.elastic.co/t/auditbeat-will-not-start/210005)

<div class="topic-metadata">

**Author:** [@nuffskillz](https://discuss.elastic.co/u/nuffskillz)\
**Replies:** 1\
**Last updated:** [February 20, 2020, 8:35pm UTC](https://discuss.elastic.co/t/auditbeat-will-not-start/210005 "2020-02-20T20:35:39Z")

</div>

Hi A fresh install of auditbeat will not start returning the following below. Exiting: 1 error: 1 error: system/socket dataset setup failed: unable to guess one or more required parameters: guess\_sk\_buff\_proto failed: …

---

## [Scripted Field "String, in between two strings"](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989)

<div class="topic-metadata">

**Author:** [@kohlerdr](https://discuss.elastic.co/u/kohlerdr)\
**Replies:** 1\
**Last updated:** [March 29, 2018, 7:34pm UTC](https://discuss.elastic.co/t/scripted-field-string-in-between-two-strings/125989 "2018-03-29T19:34:58Z")

</div>

I have a field I need to query to get a value. the text in the field, is a string a couple of hundred characters long, and I need 4 characters, which are smack in the middle. I have tried get substring, but I can only …

---

## [Problems understanding Anomaly Explorer](https://discuss.elastic.co/t/problems-understanding-anomaly-explorer/104266)

<div class="topic-metadata">

**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\
**Replies:** 1\
**Last updated:** [October 23, 2017, 9:24am UTC](https://discuss.elastic.co/t/problems-understanding-anomaly-explorer/104266 "2017-10-23T09:24:17Z")

</div>

I have 23 years worth of house price data, and I run a run that looks at median(price) with one influencer. I am having problems understanding the data shown in Anomaly Explorer. It displays 23 coloured rectangles in a r…

---

## [Query (must be X) and (must (Z or Y)](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855)

<div class="topic-metadata">

**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\
**Replies:** 1\
**Last updated:** [June 1, 2017, 8:05am UTC](https://discuss.elastic.co/t/query-must-be-x-and-must-z-or-y/87855 "2017-06-01T08:05:04Z")

</div>

I am trying to build a query that a certain term (terminationCause) will be success. And that a different term (clientId) will equal either (OR) X Y or Z (but not A or B) What I built is (ofcourse this doesn't work): …

---

## [Reporting error can't output x-pack when enabled](https://discuss.elastic.co/t/reporting-error-cant-output-x-pack-when-enabled/83785)

<div class="topic-metadata">

**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\
**Replies:** 1\
**Last updated:** [April 27, 2017, 4:02pm UTC](https://discuss.elastic.co/t/reporting-error-cant-output-x-pack-when-enabled/83785 "2017-04-27T16:02:48Z")

</div>

when i use x-pack reporting ,copy the url i can't see the reporting ,the error is "{"statusCode":405,"error":"Method Not Allowed","message":"GET is not allowed"}" how i can see the reporting and shared it. thanks. …

---

## [Help understanding innerhit performance](https://discuss.elastic.co/t/help-understanding-innerhit-performance/81226)

<div class="topic-metadata">

**Author:** [@hcliff](https://discuss.elastic.co/u/hcliff)\
**Replies:** 1\
**Last updated:** [April 7, 2017, 7:56am UTC](https://discuss.elastic.co/t/help-understanding-innerhit-performance/81226 "2017-04-07T07:56:55Z")

</div>

I have a parent/child relationship that queries very performantly but when retrieving innerhits falls over. Since I'm not returning the source and elastic has already done this computation to determine if there's a hit w…

---

## [Elasticsearch indexing too slow](https://discuss.elastic.co/t/elasticsearch-indexing-too-slow/72934)

<div class="topic-metadata">

**Author:** [@Zeeshan\_Alam](https://discuss.elastic.co/u/Zeeshan_Alam)\
**Replies:** 1\
**Last updated:** [January 28, 2017, 8:43am UTC](https://discuss.elastic.co/t/elasticsearch-indexing-too-slow/72934 "2017-01-28T08:43:51Z")

</div>

Hi All, I can't increase the indexing more than 10000 event/second no matter what I do. I am getting around 13000 events per second from kafka in a single logstash instance. I am running 3 Logstash in different machines…

---

## [How to covert boolean to integer](https://discuss.elastic.co/t/how-to-covert-boolean-to-integer/60483)

<div class="topic-metadata">

**Author:** [@Chita\_Rain](https://discuss.elastic.co/u/Chita_Rain)\
**Replies:** 1\
**Last updated:** [September 14, 2016, 10:39am UTC](https://discuss.elastic.co/t/how-to-covert-boolean-to-integer/60483 "2016-09-14T10:39:25Z")

</div>

try to use mutate { conver =\> \["type", 'integer'\] } but I got error NoMethodError: undefined method \`to\_i' for false:FalseClass convert\_integer at /opt/logstash/vendor/bundle…

---

## [ElasticsearchDeprecationWarning: Need some clarification to make corrections](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136)

<div class="topic-metadata">

**Author:** [@varshap](https://discuss.elastic.co/u/varshap)\
**Replies:** 3\
**Last updated:** [February 12, 2021, 4:11pm UTC](https://discuss.elastic.co/t/elasticsearchdeprecationwarning-need-some-clarification-to-make-corrections/264136 "2021-02-12T16:11:33Z")

</div>

Hi Guys, I am new to ES, I recently integrated ES in my Django project by following. https://django-elasticsearch-dsl.readthedocs.io/en/latest/quickstart.html Versions used: django-elasticsearch-dsl==7.1.4 django-el…

---

## [Update-rc.d: /etc/init.d/logstash: file does not exist](https://discuss.elastic.co/t/update-rc-d-etc-init-d-logstash-file-does-not-exist/146407)

<div class="topic-metadata">

**Author:** [@Nina\_brown](https://discuss.elastic.co/u/Nina_brown)\
**Replies:** 3\
**Last updated:** [August 29, 2018, 9:29am UTC](https://discuss.elastic.co/t/update-rc-d-etc-init-d-logstash-file-does-not-exist/146407 "2018-08-29T09:29:01Z")

</div>

I installed logstash 6.4 on Ubuntu 14, but when I try to run it on boot sudo update-rc.d logstash defaults 96 9 I get the error: 'update-rc.d: /etc/init.d/logstash: file does not exist' looks like it's not running a…

---

## [Monitor kafka lag](https://discuss.elastic.co/t/monitor-kafka-lag/124106)

<div class="topic-metadata">

**Author:** [@Richard\_Neely](https://discuss.elastic.co/u/Richard_Neely)\
**Replies:** 3\
**Last updated:** [March 22, 2018, 6:06pm UTC](https://discuss.elastic.co/t/monitor-kafka-lag/124106 "2018-03-22T18:06:58Z")

</div>

I'm looking to calculate lag for kafka which seems like it is kafka.partition.offset.newest - kafka.consumergroup.offset. Those fields are in different documents though across the consumergroup and partition metricset. I…

---

## [Timing issues with Watcher](https://discuss.elastic.co/t/timing-issues-with-watcher/95549)

<div class="topic-metadata">

**Author:** [@mhus](https://discuss.elastic.co/u/mhus)\
**Replies:** 3\
**Last updated:** [August 4, 2017, 6:54am UTC](https://discuss.elastic.co/t/timing-issues-with-watcher/95549 "2017-08-04T06:54:47Z")

</div>

I have a watcher that checks for specific logfile entries and I need its action to trigger exactly once for any entries found within a specific timeframe. It currently checks for logfile entries once a minute using the f…

---

## [Setting up ELK processes in supervisor](https://discuss.elastic.co/t/setting-up-elk-processes-in-supervisor/89510)

<div class="topic-metadata">

**Author:** [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)\
**Replies:** 0\
**Last updated:** [June 15, 2017, 6:53am UTC](https://discuss.elastic.co/t/setting-up-elk-processes-in-supervisor/89510 "2017-06-15T06:53:38Z")

</div>

I am trying to daemonise Elastic search, Kibana and Logstash processes using supervisor as they shut down at times due to RAM issues. Below is the supervisord programs for it \[program:elasticsearch\] command=sudo servic…

---

## [Aggregate filter not run at all](https://discuss.elastic.co/t/aggregate-filter-not-run-at-all/39602)

<div class="topic-metadata">

**Author:** [@CamJN](https://discuss.elastic.co/u/CamJN)\
**Replies:** 3\
**Last updated:** [October 24, 2016, 3:20pm UTC](https://discuss.elastic.co/t/aggregate-filter-not-run-at-all/39602 "2016-10-24T15:20:15Z")

</div>

I'm trying to carry forward a year that is specified infrequently in my logs, and it seemed like the aggregate filter would work beautifully for this, however the filter doesn't seem to actually do anything (I've added t…

---

## [Visibility of Data view in Space](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120)

<div class="topic-metadata">

**Author:** [@Petr\_Vancl\_Hochberge](https://discuss.elastic.co/u/Petr_Vancl_Hochberge)\
**Replies:** 2\
**Last updated:** [March 20, 2022, 3:08pm UTC](https://discuss.elastic.co/t/visibility-of-data-view-in-space/300120 "2022-03-20T15:08:01Z")

</div>

Hi. I am building “workflow” in Kibana for my users. I have around 50 spaces for each department of my organization. I have one Data view created which all should have access to, but I have no idea how to achieve it wit…

---

## [Error during Marvel 2.0 UI plugin installation](https://discuss.elastic.co/t/error-during-marvel-2-0-ui-plugin-installation/34930)

<div class="topic-metadata">

**Author:** [@Pieter\_Agenbag](https://discuss.elastic.co/u/Pieter_Agenbag)\
**Replies:** 2\
**Last updated:** [November 24, 2015, 2:52pm UTC](https://discuss.elastic.co/t/error-during-marvel-2-0-ui-plugin-installation/34930 "2015-11-24T14:52:35Z")

</div>

Hi - I had just installed a fresh Elasticsearch 2.0 and Kibana 4.3 snapshot for evaluation and thought I'd add Marvel on as well.. but I get the following when attempting to install the UI plugin root@sin-cpt-sl-elk2-d…

---

## [Kibana 4.2 very slow initialization](https://discuss.elastic.co/t/kibana-4-2-very-slow-initialization/33711)

<div class="topic-metadata">

**Author:** [@samuelbr](https://discuss.elastic.co/u/samuelbr)\
**Replies:** 2\
**Last updated:** [November 4, 2015, 8:28am UTC](https://discuss.elastic.co/t/kibana-4-2-very-slow-initialization/33711 "2015-11-04T08:28:26Z")

</div>

When I open a Kibana in Chrome (but also in IE), a text "Searching" is shown for a very long time - more than 2 minutes. I attach images for illustration: Slow loading: Result after 2 minutes: Profiler: Kibana…

---

## [Redis input host array](https://discuss.elastic.co/t/redis-input-host-array/33248)

<div class="topic-metadata">

**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Replies:** 3\
**Last updated:** [March 8, 2016, 3:28pm UTC](https://discuss.elastic.co/t/redis-input-host-array/33248 "2016-03-08T15:28:52Z")

</div>

Is there a reason the redis output can use an array but the redis input cannot. I would like to use my domain name (a DNS entry for many IP's with the same domain name) in the redis input so that I can spin up new no…

---

## [Snapshots are failing](https://discuss.elastic.co/t/snapshots-are-failing/262769)

<div class="topic-metadata">

**Author:** [@SteveHodges](https://discuss.elastic.co/u/SteveHodges)\
**Replies:** 4\
**Last updated:** [February 1, 2021, 7:52pm UTC](https://discuss.elastic.co/t/snapshots-are-failing/262769 "2021-02-01T19:52:46Z")

</div>

After a network outage, the elasticsearch snapshot is failing. After I restored the connection to the NAS I am getting errors when I try to take a snapshot. The error is access\_denied\_exception Here is the command I r…

---

## [Custom transactions cannot match the trace.id of the backend](https://discuss.elastic.co/t/custom-transactions-cannot-match-the-trace-id-of-the-backend/223278)

<div class="topic-metadata">

**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\
**Replies:** 4\
**Last updated:** [March 18, 2020, 1:45am UTC](https://discuss.elastic.co/t/custom-transactions-cannot-match-the-trace-id-of-the-backend/223278 "2020-03-18T01:45:19Z")

</div>

The frontend generates a trace.id and the backend adds a trace.id What can I do to match trace.id

---

## [\[RESOLVED\] Error: "Attempted to create unknown action type pagerduty." when trying to update a watcher in Kibana](https://discuss.elastic.co/t/resolved-error-attempted-to-create-unknown-action-type-pagerduty-when-trying-to-update-a-watcher-in-kibana/167433)

<div class="topic-metadata">

**Author:** [@vicpav](https://discuss.elastic.co/u/vicpav)\
**Replies:** 4\
**Last updated:** [February 12, 2019, 8:11pm UTC](https://discuss.elastic.co/t/resolved-error-attempted-to-create-unknown-action-type-pagerduty-when-trying-to-update-a-watcher-in-kibana/167433 "2019-02-12T20:11:32Z")

</div>

Elasticsearch cluster has been upgraded from version 6.3.4 to 6.6.0 and it looks like now I cannot update the watchers that have "pageduty" action configured: open a watcher editing in Kibana, change something in the W…

---

## [Document search using Rest High Level Client](https://discuss.elastic.co/t/document-search-using-rest-high-level-client/154565)

<div class="topic-metadata">

**Author:** [@Sanjaybg](https://discuss.elastic.co/u/Sanjaybg)\
**Replies:** 4\
**Last updated:** [October 30, 2018, 12:23pm UTC](https://discuss.elastic.co/t/document-search-using-rest-high-level-client/154565 "2018-10-30T12:23:44Z")

</div>

I am trying to upload a document index it and search within the document but i am not able to. I am using Rest High Level Client. I have added ingest plugin. I think i'm not using the proper way to index the document. Ca…

---

## [Selecting values from JSON](https://discuss.elastic.co/t/selecting-values-from-json/141400)

<div class="topic-metadata">

**Author:** [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Replies:** 4\
**Last updated:** [July 26, 2018, 9:04am UTC](https://discuss.elastic.co/t/selecting-values-from-json/141400 "2018-07-26T09:04:47Z")

</div>

Hello. I am parsing twitter with following settings: input { twitter { consumer\_key =\> "XX" consumer\_secret =\> "XX" oauth\_token =\> "XX" oauth\_token\_secret =\> "XX" full\_tweet =\> true use\_samples =\> true language…

---

## [Duplicate \_id/\_type within the same index](https://discuss.elastic.co/t/duplicate--id--type-within-the-same-index/5954)

<div class="topic-metadata">

**Author:** [@Max\_M](https://discuss.elastic.co/u/Max_M)\
**Replies:** 4\
**Last updated:** [December 1, 2011, 12:02pm UTC](https://discuss.elastic.co/t/duplicate--id--type-within-the-same-index/5954 "2011-12-01T12:02:24Z")

</div>

We apparently ended up with two documents sharing the same \_id/\_type pair within the same index. Here is a \*\_search\* query's output: GET "http://192.168.72.55:19301/kqi.docubank.document.documatica\_checker.tdoc\_ch…

---

## [Help with heartbeat setup of locations](https://discuss.elastic.co/t/help-with-heartbeat-setup-of-locations/227555)

<div class="topic-metadata">

**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\
**Replies:** 8\
**Last updated:** [May 6, 2020, 11:01pm UTC](https://discuss.elastic.co/t/help-with-heartbeat-setup-of-locations/227555 "2020-05-06T23:01:02Z")

</div>

I have about 30 sites I would like to ping with heartbeat. I'm confused about how best to add the geo location and other info for each site. Do I add each site to its own yaml file or is there a simple way to do it all…

---

## [Combining match query with "\_all" and boosting at query time?](https://discuss.elastic.co/t/combining-match-query-with--all-and-boosting-at-query-time/9407)

<div class="topic-metadata">

**Author:** [@Alexander\_Pepper](https://discuss.elastic.co/u/Alexander_Pepper)\
**Replies:** 8\
**Last updated:** [October 20, 2012, 10:10am UTC](https://discuss.elastic.co/t/combining-match-query-with--all-and-boosting-at-query-time/9407 "2012-10-20T10:10:40Z")

</div>

Hello there, is it possible to use a match query which searches in "\_all" and combine it with boosting at query time? For example: I have a field title and body. Now I'm searching for { "match" : { "\_all" : "fo…

---

## [It looks like you have instances that aren't connected to an Elasticsearch cluster](https://discuss.elastic.co/t/it-looks-like-you-have-instances-that-arent-connected-to-an-elasticsearch-cluster/323057)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 7\
**Last updated:** [January 26, 2023, 3:34am UTC](https://discuss.elastic.co/t/it-looks-like-you-have-instances-that-arent-connected-to-an-elasticsearch-cluster/323057 "2023-01-26T03:34:15Z")

</div>

Hello World! per the above screenshot, it appears like there are 2 (two) clusters, in reality there is only 1 (one) the "standalone cluster" is using a separate set of metricbeat vs the "elasticsearch" cluster, and …

---

## [Problem encountered in the cosine similarity test sample](https://discuss.elastic.co/t/problem-encountered-in-the-cosine-similarity-test-sample/189114)

<div class="topic-metadata">

**Author:** [@forheroes1994](https://discuss.elastic.co/u/forheroes1994)\
**Replies:** 1\
**Last updated:** [July 10, 2019, 5:51pm UTC](https://discuss.elastic.co/t/problem-encountered-in-the-cosine-similarity-test-sample/189114 "2019-07-10T17:51:03Z")

</div>

With the ES 7.2.0 environment，I wanted to use cosineSimilarity function to calculate cosine similarity.But I got this error. { "error": { "root\_cause": \[ { "type": "script\_exception", "reason…

---

## [JSON carriage return](https://discuss.elastic.co/t/json-carriage-return/186130)

<div class="topic-metadata">

**Author:** [@jbro](https://discuss.elastic.co/u/jbro)\
**Replies:** 7\
**Last updated:** [June 17, 2019, 10:14pm UTC](https://discuss.elastic.co/t/json-carriage-return/186130 "2019-06-17T22:14:08Z")

</div>

So by adding a physical carriage return logstash will ingest data. My json data does not do a carriage return and \\n does not work either. Anyone have any suggestions?

[Previous page](https://discuss.elastic.co/top.md?page=1247&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1249&per_page=50&period=all)
