# Top **URL:** https://discuss.elastic.co/top.md?page=125&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 126 --- ## [No Result from osquery elastic agent 7.14.0](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097)
**Author:** [@cheapsupps](https://discuss.elastic.co/u/cheapsupps)\ **Replies:** 12\ **Last updated:** [March 31, 2022, 5:26pm UTC](https://discuss.elastic.co/t/no-result-from-osquery-elastic-agent-7-14-0/281097 "2022-03-31T17:26:36Z")
I have tried to run the query using osquery manager on one of my agent select \* from users However, no result is returned. I got the below message from my agent logs {"log.level":"warn","@timestamp":"2021-08-11T08:27… --- ## [Filebeat consuming too much CPU](https://discuss.elastic.co/t/filebeat-consuming-too-much-cpu/321497)
**Author:** [@Priya\_Vardhan](https://discuss.elastic.co/u/Priya_Vardhan)\ **Replies:** 15\ **Last updated:** [December 20, 2022, 8:30am UTC](https://discuss.elastic.co/t/filebeat-consuming-too-much-cpu/321497 "2022-12-20T08:30:20Z")
Hi, Installed filebeat using docker in 3 servers. In each of the servers, CPU reaching to 99% the moment filebeat starts harvesting. Please suggest how we can control CPU usage --- ## [Recovery shard makes write rejected and iowait increased](https://discuss.elastic.co/t/recovery-shard-makes-write-rejected-and-iowait-increased/162792)
**Author:** [@ttdata](https://discuss.elastic.co/u/ttdata)\ **Replies:** 13\ **Last updated:** [January 11, 2019, 9:43am UTC](https://discuss.elastic.co/t/recovery-shard-makes-write-rejected-and-iowait-increased/162792 "2019-01-11T09:43:00Z")
Hello Guys, I would like to share with you my usecase. Elasticsearch information : ES version : 6.5.1 Hot Nodes : 13 hot with 192Go RAM(Heap 94Go RAM), 5x500Go SSD, CPU \* 2x Intel® Xeon® E5 2640 v4 Shards : Around 4.… --- ## [Json field parsing , multi value field](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005)
**Author:** [@shaileshmali](https://discuss.elastic.co/u/shaileshmali)\ **Replies:** 10\ **Last updated:** [September 13, 2017, 4:11pm UTC](https://discuss.elastic.co/t/json-field-parsing-multi-value-field/97005 "2017-09-13T16:11:07Z")
I want to parse json message . I am using add\_field option as i do not need all fields from the message. landingPlatformCode field has mutiple values . given bellow exmample to pull first value. There might be 1 ,2 ,3 4… --- ## [Metricbeat and Heartbeat 8.x custom index Name should pickup from template ,but creates always bedefault index name](https://discuss.elastic.co/t/metricbeat-and-heartbeat-8-x-custom-index-name-should-pickup-from-template-but-creates-always-bedefault-index-name/337557)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 22\ **Last updated:** [July 11, 2023, 3:40pm UTC](https://discuss.elastic.co/t/metricbeat-and-heartbeat-8-x-custom-index-name-should-pickup-from-template-but-creates-always-bedefault-index-name/337557 "2023-07-11T15:40:37Z")
Hello All, I'm migrating metricbeat and heartbeat from 7.9.1 to 8.7.1 version and current challenge is I'm unbale to create custom index name defined in my index template and metricbeat.yml. I'm not sure how come every… --- ## [Kibana](https://discuss.elastic.co/t/kibana/11718)
**Author:** [@Mohit\_Anchlia](https://discuss.elastic.co/u/Mohit_Anchlia)\ **Replies:** 38\ **Last updated:** [May 28, 2014, 7:08am UTC](https://discuss.elastic.co/t/kibana/11718 "2014-05-28T07:08:42Z")
I am trying to setup kibana with elasticsearch without logstash. Even though it's not directly related to elasticsearch I wanted to know if anyone has successfully used Kibana with elasticsearch but without logstash? … --- ## [Slow initialisation time after restart](https://discuss.elastic.co/t/slow-initialisation-time-after-restart/84377)
**Author:** [@Deepak\_Mehta1](https://discuss.elastic.co/u/Deepak_Mehta1)\ **Replies:** 10\ **Last updated:** [May 4, 2017, 7:56am UTC](https://discuss.elastic.co/t/slow-initialisation-time-after-restart/84377 "2017-05-04T07:56:13Z")
We are facing the slow shard initialisation time. I went thru the post http://elasticsearch-users.115913.n3.nabble.com/Restarting-an-active-node-without-needing-to-recover-all-data-remotely-td4039346.html#a4039355 and … --- ## [Bulk indexing stalls (7.2.0)](https://discuss.elastic.co/t/bulk-indexing-stalls-7-2-0/187388)
**Author:** [@crispygoth](https://discuss.elastic.co/u/crispygoth)\ **Replies:** 10\ **Last updated:** [June 27, 2019, 3:38pm UTC](https://discuss.elastic.co/t/bulk-indexing-stalls-7-2-0/187388 "2019-06-27T15:38:27Z")
Hi all, I'm in the process of updating an ES 5.3.0 cluster to the latest 7.2 version, and while re-indexing the data I'm noticing some odd behaviour in Elasticsearch. In short, it appears that the bulk indexing API is r… --- ## [Problem with filebeat](https://discuss.elastic.co/t/problem-with-filebeat/91589)
**Author:** [@cdfwb1992](https://discuss.elastic.co/u/cdfwb1992)\ **Replies:** 9\ **Last updated:** [July 5, 2017, 7:38pm UTC](https://discuss.elastic.co/t/problem-with-filebeat/91589 "2017-07-05T19:38:39Z")
Hi, I followed this tutorial "https://www.elastic.co/guide/en/beats/filebeat/5.4/filebeat-getting-started.html" step by step, but Kibana shows me 0 hits and No results found. --- ## [Multiple indices vs. multiple shards approach](https://discuss.elastic.co/t/multiple-indices-vs-multiple-shards-approach/22781)
**Author:** [@Vladi\_Feigin](https://discuss.elastic.co/u/Vladi_Feigin)\ **Replies:** 9\ **Last updated:** [June 20, 2017, 11:46pm UTC](https://discuss.elastic.co/t/multiple-indices-vs-multiple-shards-approach/22781 "2017-06-20T23:46:37Z")
Hello, Please share your thoughts We have one big ES index and 18 shards (9 primary and 9 replicas) We have thousands of customers and each customer could have millions or as opposite very small number of documen… --- ## [How to restart/recover a shard?](https://discuss.elastic.co/t/how-to-restart-recover-a-shard/3239)
**Author:** [@Kenneth\_Loafman](https://discuss.elastic.co/u/Kenneth_Loafman)\ **Replies:** 23\ **Last updated:** [August 20, 2010, 7:54pm UTC](https://discuss.elastic.co/t/how-to-restart-recover-a-shard/3239 "2010-08-20T19:54:54Z")
Hi, The second shard on one of my indexes has failed due to: \[05:59:47,332\]\[WARN \]\[index.gateway \] \[Mangog\] \[twitter\]\[1\] failed to snapshot on close ...followed by a long traceback. ...followed by: \[05… --- ## [Permissions for beats](https://discuss.elastic.co/t/permissions-for-beats/219437)
**Author:** [@David\_Fuge](https://discuss.elastic.co/u/David_Fuge)\ **Replies:** 13\ **Last updated:** [February 19, 2020, 1:27am UTC](https://discuss.elastic.co/t/permissions-for-beats/219437 "2020-02-19T01:27:25Z")
I've read the documentation about accounts for beats and securing beats. However, I still dont understand how to properly limit the accounts used to authenticate my winlogbeat and metricbeats back to my cluster. I am ru… --- ## [\-Des.path.conf issue?](https://discuss.elastic.co/t/des-path-conf-issue/4148)
**Author:** [@roger\_2](https://discuss.elastic.co/u/roger_2)\ **Replies:** 13\ **Last updated:** [March 23, 2011, 4:02pm UTC](https://discuss.elastic.co/t/des-path-conf-issue/4148 "2011-03-23T16:02:40Z")
Hi together I'm working on an elasticsearch server stub for python using a startup via python subprocess. Everything is working fine except the es.path.conf property. It seems that the -Des.path.conf= is not wor… --- ## [Crete alerts for disabled accounts](https://discuss.elastic.co/t/crete-alerts-for-disabled-accounts/312833)
**Author:** [@ajoshi37](https://discuss.elastic.co/u/ajoshi37)\ **Replies:** 14\ **Last updated:** [September 9, 2022, 9:03pm UTC](https://discuss.elastic.co/t/crete-alerts-for-disabled-accounts/312833 "2022-09-09T21:03:47Z")
Hi, I'm trying to create alerts for the Disabled account for Azure SSO but not able to find the context to that. Disabled account checks for event.code : 4725 Failed account checks for event.code : "4625" The logs do … --- ## [New plugin architecture: How to build?](https://discuss.elastic.co/t/new-plugin-architecture-how-to-build/253036)
**Author:** [@Dasko](https://discuss.elastic.co/u/Dasko)\ **Replies:** 10\ **Last updated:** [November 16, 2020, 7:42pm UTC](https://discuss.elastic.co/t/new-plugin-architecture-how-to-build/253036 "2020-11-16T19:42:41Z")
Hello, We are currently switching to Elasticsearch/Kibana 7.9.1 and creating new plugins, following the new architecture. We were already using our own plugins before, and were building them via the build command of th… --- ## [Not able to install Elasticsearch 8.4.1](https://discuss.elastic.co/t/not-able-to-install-elasticsearch-8-4-1/314650)
**Author:** [@shivang.ahd](https://discuss.elastic.co/u/shivang.ahd)\ **Replies:** 17\ **Last updated:** [September 30, 2022, 3:10pm UTC](https://discuss.elastic.co/t/not-able-to-install-elasticsearch-8-4-1/314650 "2022-09-30T15:10:39Z")
Hi, I am not able to install elasticsearch 8.4.1 I am getting the below mentioned error. will not overwrite keystore at \[C:\\ProgramData\\Elastic\\Elasticsearch\\config\\elasticsearch.keystore\], because this incurs changi… --- ## [Can I take backup of indices from one cluster and restore it to another cluster](https://discuss.elastic.co/t/can-i-take-backup-of-indices-from-one-cluster-and-restore-it-to-another-cluster/334387)
**Author:** [@kunalhiremath](https://discuss.elastic.co/u/kunalhiremath)\ **Replies:** 14\ **Last updated:** [May 26, 2023, 8:55am UTC](https://discuss.elastic.co/t/can-i-take-backup-of-indices-from-one-cluster-and-restore-it-to-another-cluster/334387 "2023-05-26T08:55:37Z")
Can I take backup of indices from one cluster and restore it to another cluster by simply copying the snapshot/backup repository folder and sending it to another cluster and from there I will perform restore operation is… --- ## [Services metrics](https://discuss.elastic.co/t/services-metrics/89807)
**Author:** [@Quardo](https://discuss.elastic.co/u/Quardo)\ **Replies:** 13\ **Last updated:** [June 19, 2017, 12:52am UTC](https://discuss.elastic.co/t/services-metrics/89807 "2017-06-19T00:52:54Z")
Hey, I want to get metrics of windows services (like get-services command data) . I have not seen any metric module that doing so. Does someone know any? Thanks --- ## [Accessing TopDocs from a LeafScoreFunction](https://discuss.elastic.co/t/accessing-topdocs-from-a-leafscorefunction/96336)
**Author:** [@ethanroseman](https://discuss.elastic.co/u/ethanroseman)\ **Replies:** 12\ **Last updated:** [August 11, 2017, 7:49pm UTC](https://discuss.elastic.co/t/accessing-topdocs-from-a-leafscorefunction/96336 "2017-08-11T19:49:39Z")
My name is Ethan Roseman, and I’m a developer at Basis Technology. We work on an Elasticsearch plugin that integrates our product, RNI (https://www.basistech.com/text-analytics/rosette/name-indexer/). With our plugin, w… --- ## [Elasticsearch cpu spike, search thread pool queues explode](https://discuss.elastic.co/t/elasticsearch-cpu-spike-search-thread-pool-queues-explode/155950)
**Author:** [@bitsofinfo](https://discuss.elastic.co/u/bitsofinfo)\ **Replies:** 9\ **Last updated:** [November 14, 2018, 4:06pm UTC](https://discuss.elastic.co/t/elasticsearch-cpu-spike-search-thread-pool-queues-explode/155950 "2018-11-14T16:06:04Z")
Hi not looking for a definitive answer here but a bit puzzled as to what is going on or some pointers on config settings to look at Running ES 6.3 10 node cluster, 5 warm, 5 hot Indicies: logstash indexes, being ro… --- ## [Not able to start 6.3 after upgrade from 6.2](https://discuss.elastic.co/t/not-able-to-start-6-3-after-upgrade-from-6-2/136150)
**Author:** [@Koen\_Wouters](https://discuss.elastic.co/u/Koen_Wouters)\ **Replies:** 9\ **Last updated:** [June 16, 2018, 12:51pm UTC](https://discuss.elastic.co/t/not-able-to-start-6-3-after-upgrade-from-6-2/136150 "2018-06-16T12:51:19Z")
We just upgraded from 6.2 to 6.3 and are no longer able to start. The error message states that I cannot start as root, and it seems to be a very common issue looking at posts here and using google. But I just can't fig… --- ## [Should CircuitBreakingException cause the node to become failed?](https://discuss.elastic.co/t/should-circuitbreakingexception-cause-the-node-to-become-failed/220817)
**Author:** [@rsyne](https://discuss.elastic.co/u/rsyne)\ **Replies:** 13\ **Last updated:** [March 12, 2020, 12:05pm UTC](https://discuss.elastic.co/t/should-circuitbreakingexception-cause-the-node-to-become-failed/220817 "2020-03-12T12:05:33Z")
Hello I'm running a 7.5.2 cluster. Today, while snapshots were being made (although I'm not sure it was snapshotting that triggered the issue), one of the nodes logged CircuitBreakingException and became failed for seve… --- ## ["add panel" in dashboard edit view never loads](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976)
**Author:** [@bacony0atmeal](https://discuss.elastic.co/u/bacony0atmeal)\ **Replies:** 27\ **Last updated:** [July 22, 2021, 3:46am UTC](https://discuss.elastic.co/t/add-panel-in-dashboard-edit-view-never-loads/277976 "2021-07-22T03:46:45Z")
kibana version 7.9.1. recently migrated from 6.8.x. steps taken to recreate: kibana home -\> dashboards -\> open up existing dashboard -\> click "Add" -\> "Add panels" pane never populates with any saved visualizations. … --- ## [Where to get marvel 1.3](https://discuss.elastic.co/t/where-to-get-marvel-1-3/35926)
**Author:** [@lifo888](https://discuss.elastic.co/u/lifo888)\ **Replies:** 9\ **Last updated:** [December 1, 2015, 6:26am UTC](https://discuss.elastic.co/t/where-to-get-marvel-1-3/35926 "2015-12-01T06:26:52Z")
Hi, Anybody know where i can get the binary for marvel 1.3 as well as license plugin that's compatible with that version? Thanks, GC --- ## [Cluster not reforming after simulating split-brain using iptables](https://discuss.elastic.co/t/cluster-not-reforming-after-simulating-split-brain-using-iptables/40921)
**Author:** [@agp](https://discuss.elastic.co/u/agp)\ **Replies:** 12\ **Last updated:** [February 4, 2016, 10:21pm UTC](https://discuss.elastic.co/t/cluster-not-reforming-after-simulating-split-brain-using-iptables/40921 "2016-02-04T22:21:14Z")
Hi, I wanted to understand the behavior of split-brain with ElasticSearch. So I created a two-node cluster with a single index. Once the cluster was established, I installed iptables rule like so: node1 rule: iptable… --- ## [Logstash Conf File for Apache Log won't interpret "message"](https://discuss.elastic.co/t/logstash-conf-file-for-apache-log-wont-interpret-message/101378)
**Author:** [@dahansi](https://discuss.elastic.co/u/dahansi)\ **Replies:** 14\ **Last updated:** [September 23, 2017, 7:53am UTC](https://discuss.elastic.co/t/logstash-conf-file-for-apache-log-wont-interpret-message/101378 "2017-09-23T07:53:41Z")
Hey there, I am pretty new to Elasticsearch. My ELK-setup on ubuntu is working so far and I receive the logfiles from the client server with filebeat. Now I want to interpret the accesslog file. It looks like this: … --- ## [\[BUG\] Filebeat creates wrong index name on index deletion](https://discuss.elastic.co/t/bug-filebeat-creates-wrong-index-name-on-index-deletion/227100)
**Author:** [@vutkin](https://discuss.elastic.co/u/vutkin)\ **Replies:** 12\ **Last updated:** [April 10, 2020, 6:15pm UTC](https://discuss.elastic.co/t/bug-filebeat-creates-wrong-index-name-on-index-deletion/227100 "2020-04-10T18:15:21Z")
Hi All, Filebeat affected: 7.6.1/7.6.2, installed via Elastic's helm charts (with default config). ES: 7.5.1 We are running into an issue where setting the ILM policy via filebeat config with the default index pattern… --- ## [\[Java\] Stream large file while indexing](https://discuss.elastic.co/t/java-stream-large-file-while-indexing/6706)
**Author:** [@vineeth\_mohan](https://discuss.elastic.co/u/vineeth_mohan)\ **Replies:** 9\ **Last updated:** [March 27, 2015, 8:17pm UTC](https://discuss.elastic.co/t/java-stream-large-file-while-indexing/6706 "2015-03-27T20:17:16Z")
Hi , While indexing i have a field whose value is quite large. This value is stored in a file as text. I prefer not to load the entire file into main memory to read the content. Instead i would prefer this file i… --- ## [Why Filebeat cannot start and work correctly on windows](https://discuss.elastic.co/t/why-filebeat-cannot-start-and-work-correctly-on-windows/346926)
**Author:** [@baber1223](https://discuss.elastic.co/u/baber1223)\ **Replies:** 22\ **Last updated:** [November 16, 2023, 2:37pm UTC](https://discuss.elastic.co/t/why-filebeat-cannot-start-and-work-correctly-on-windows/346926 "2023-11-16T14:37:58Z")
I want to install filebeat on my windows server . My filebeat version is : 8.10.4 This is my filebeat config : output.elasticsearch: # Array of hosts to connect to. hosts: \["https://10.20.11.29:9200"\] protocol: … --- ## [Unable to send data to elasticsearch](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch/32109)
**Author:** [@sfunk](https://discuss.elastic.co/u/sfunk)\ **Replies:** 10\ **Last updated:** [October 13, 2015, 8:27pm UTC](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch/32109 "2015-10-13T20:27:15Z")
This question has probably been answered a million times, btu I can't find a satisfactory answer, nor do I understand what I'm doing wrong. Curling elasticsearch I get: { "status" : 200, "name" : "poc", "cluste… --- ## [Stuck in Logstash](https://discuss.elastic.co/t/stuck-in-logstash/269704)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 15\ **Last updated:** [April 9, 2021, 4:43pm UTC](https://discuss.elastic.co/t/stuck-in-logstash/269704 "2021-04-09T16:43:54Z")
Whenever I am running file, it is stuck even I tried different file but still stuck. --- ## [X-PACK authentification kibana et envoi de mail](https://discuss.elastic.co/t/x-pack-authentification-kibana-et-envoi-de-mail/124530)
**Author:** [@pitieu](https://discuss.elastic.co/u/pitieu)\ **Replies:** 14\ **Last updated:** [March 22, 2018, 11:14am UTC](https://discuss.elastic.co/t/x-pack-authentification-kibana-et-envoi-de-mail/124530 "2018-03-22T11:14:51Z")
Bonjour à tous, Je souhaites mettre en place le x-pack mais j'ai des difficultés à configurer l'identifiant et le mot de passe pour l'ouverture de kibana. J'utilise les derniére version de kibana, elasticsearch, logsta… --- ## [Consuming More RAM Than Configured](https://discuss.elastic.co/t/consuming-more-ram-than-configured/124589)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 9\ **Last updated:** [April 9, 2018, 4:06pm UTC](https://discuss.elastic.co/t/consuming-more-ram-than-configured/124589 "2018-04-09T16:06:23Z")
Came in this morning to Elasticsearch not running. Checking the event logs, Windows reported Resource-Exhaustion with Elasticsearch consuming 9,965,961,216 bytes (9.2-ish GB) of RAM. JVM Options and the service are bot… --- ## [I could not start logstash properly via rpm installed](https://discuss.elastic.co/t/i-could-not-start-logstash-properly-via-rpm-installed/65120)
**Author:** [@Generalibm\_Jang](https://discuss.elastic.co/u/Generalibm_Jang)\ **Replies:** 15\ **Last updated:** [November 8, 2016, 6:10am UTC](https://discuss.elastic.co/t/i-could-not-start-logstash-properly-via-rpm-installed/65120 "2016-11-08T06:10:08Z")
Hi, all I could not start logstash properly via rpm installed. Any helps here? Description sudo systemctl start logstash.service the command above would generate logs at /var/log/logstash/logstash-plain.log \[2… --- ## [Неожиданный java.io.IOException: failed to obtain in-memory shard lock](https://discuss.elastic.co/t/java-io-ioexception-failed-to-obtain-in-memory-shard-lock/153572)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 16\ **Last updated:** [November 12, 2018, 5:14pm UTC](https://discuss.elastic.co/t/java-io-ioexception-failed-to-obtain-in-memory-shard-lock/153572 "2018-11-12T17:14:33Z")
Elastic версии 6.4.2 4 дата-ноды, две hot и две warm + одна мастер нода Общий объем данных 22Тб, индексов 199, шардов 1038, документов 20млрд На hot нодах занято около 600Гб, остальное лежит на warm. Вчера днем проис… --- ## [Elastic search automatically changing the date type field year value to 1970](https://discuss.elastic.co/t/elastic-search-automatically-changing-the-date-type-field-year-value-to-1970/209749)
**Author:** [@dhshaw](https://discuss.elastic.co/u/dhshaw)\ **Replies:** 9\ **Last updated:** [December 4, 2019, 6:32pm UTC](https://discuss.elastic.co/t/elastic-search-automatically-changing-the-date-type-field-year-value-to-1970/209749 "2019-12-04T18:32:27Z")
I am using Elastic search version 7.2 and my date field mapping is "agent\_utc\_time": { "type": "date", "format": "MM/dd/YYYY HH:mm:ss || MM/dd/YYYY || YYYY-MM-dd" }, I am inserting the date value as: "agent\_utc\_time… --- ## [Failed to connect to App Search. Failed to open TCP connection to https:443 (initialize: name or service not known)](https://discuss.elastic.co/t/failed-to-connect-to-app-search-failed-to-open-tcp-connection-to-https-443-initialize-name-or-service-not-known/274025)
**Author:** [@joeripeeters](https://discuss.elastic.co/u/joeripeeters)\ **Replies:** 9\ **Last updated:** [May 26, 2021, 8:30pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-app-search-failed-to-open-tcp-connection-to-https-443-initialize-name-or-service-not-known/274025 "2021-05-26T20:30:35Z")
I've got a logstash.conf file defining the following: input { jdbc { jdbc\_validate\_connection =\> true jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "" jdbc\_connection\_stri… --- ## [NullPointerException in scroll](https://discuss.elastic.co/t/nullpointerexception-in-scroll/98717)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 9\ **Last updated:** [September 7, 2017, 3:57pm UTC](https://discuss.elastic.co/t/nullpointerexception-in-scroll/98717 "2017-09-07T15:57:52Z")
I've noticed this error today in the logs of our 5.4 cluster when running a scroll query - one that ran with no issues before and is running with no issues after this exception, which I was not able to reproduce. Has an… --- ## [Elastic Agent (Security Onion)](https://discuss.elastic.co/t/elastic-agent-security-onion/370611)
**Author:** [@chamara\_sandun](https://discuss.elastic.co/u/chamara_sandun)\ **Replies:** 11\ **Last updated:** [November 23, 2024, 1:41pm UTC](https://discuss.elastic.co/t/elastic-agent-security-onion/370611 "2024-11-23T13:41:27Z")
I installed Security Onion to enhance my knowledge. I followed the documentation for the setup but faced several issues. After setting it up, my main goal was to get Windows event logs into Security Onion. I installed… --- ## [Thread Pool Configuration - Max thread\_pool.size?](https://discuss.elastic.co/t/thread-pool-configuration-max-thread-pool-size/228089)
**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\ **Replies:** 10\ **Last updated:** [April 16, 2020, 4:32am UTC](https://discuss.elastic.co/t/thread-pool-configuration-max-thread-pool-size/228089 "2020-04-16T04:32:52Z")
Hi All, Kindly help me with my query What could be the best possible configuration for a data-node running on a server having configuration lscpu output\> Architecture: x86\_64 CPU op-mode(s): 32-bit,… --- ## [Ingest xml file using Logstash](https://discuss.elastic.co/t/ingest-xml-file-using-logstash/255113)
**Author:** [@Priyanka3](https://discuss.elastic.co/u/Priyanka3)\ **Replies:** 9\ **Last updated:** [November 12, 2020, 8:29pm UTC](https://discuss.elastic.co/t/ingest-xml-file-using-logstash/255113 "2020-11-12T20:29:55Z")
Hi, I am very new to Elastic search and Logstash. But I am trying to ingest using Logstash. My xml file looks something like this \ **Author:** [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Replies:** 11\ **Last updated:** [October 30, 2015, 7:56pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294 "2015-10-30T19:56:33Z") I am able to send windows server 2012 logs to logstash with lumberjack with the following configs below, but I want to now send to redis from windows server 2012 and then to logstash. lumberjack config: { "networ… --- ## [Help Logstash XML Parsing to Xpath](https://discuss.elastic.co/t/help-logstash-xml-parsing-to-xpath/241051)
**Author:** [@akim](https://discuss.elastic.co/u/akim)\ **Replies:** 22\ **Last updated:** [August 14, 2020, 10:06am UTC](https://discuss.elastic.co/t/help-logstash-xml-parsing-to-xpath/241051 "2020-08-14T10:06:52Z")
Hello! I need help how to parse this kind of XML File: \ \ \ \ **Author:** [@paris1](https://discuss.elastic.co/u/paris1)\ **Replies:** 14\ **Last updated:** [September 8, 2022, 5:06pm UTC](https://discuss.elastic.co/t/elasticsearch-get-exited-and-shows-unhealthy-status-in-docker-container/313931 "2022-09-08T17:06:49Z") I Run Elasticsearch on docker production on aws ec2(ubuntu).It was working fine.my elasticsearch got exited today after I updated an index I started again manually.after this the status of the containers changed to unhea… --- ## [TOPBEAT \> WINDOWS : Topbeat starting but showing error in log](https://discuss.elastic.co/t/topbeat-windows-topbeat-starting-but-showing-error-in-log/44428)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 14\ **Last updated:** [March 18, 2016, 3:03am UTC](https://discuss.elastic.co/t/topbeat-windows-topbeat-starting-but-showing-error-in-log/44428 "2016-03-18T03:03:33Z")
Hi, I am using Topbeat for monitoring. I've downloaded and followed process as per instructions. I am using WINDOWS and I want to post my logs to a the computer in my network(10.77.240116) After running topbeat power… --- ## [Kibana Dashboard Timeout](https://discuss.elastic.co/t/kibana-dashboard-timeout/128201)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 14\ **Last updated:** [April 16, 2018, 5:09pm UTC](https://discuss.elastic.co/t/kibana-dashboard-timeout/128201 "2018-04-16T17:09:31Z")
Hello it seems we keep running into a timeout after trying to look back at a days work of data. It works fine 12 hours or less. Once i try to query 24hrs or more , i get a time out in Kibana. I am using Kibana 6.1.1 . th… --- ## [Search java api not working v6.2.1](https://discuss.elastic.co/t/search-java-api-not-working-v6-2-1/137147)
**Author:** [@ali\_imran](https://discuss.elastic.co/u/ali_imran)\ **Replies:** 9\ **Last updated:** [June 26, 2018, 7:18pm UTC](https://discuss.elastic.co/t/search-java-api-not-working-v6-2-1/137147 "2018-06-26T19:18:08Z")
I am using elasticsearch (6.2.1) in my project. The indexing queries are running fine. Whereas the searching query is not working. It works with curl and give search results. But when using java search api, it always gi… --- ## [How to set max\_merged\_segment at startup?](https://discuss.elastic.co/t/how-to-set-max-merged-segment-at-startup/5246)
**Author:** [@dottom](https://discuss.elastic.co/u/dottom)\ **Replies:** 9\ **Last updated:** [September 23, 2011, 4:48pm UTC](https://discuss.elastic.co/t/how-to-set-max-merged-segment-at-startup/5246 "2011-09-23T16:48:45Z")
Is there a way to set max\_merged\_segment (or any of the merge settings) at startup? I can set max\_merged\_segment dynamically like this and it works as expected: curl -XPUT localhost:9200/myindex/\_settings -d … --- ## [Elasticsearch Cluster, how to create 2 data nodes single node to primary shards and the other to replica?](https://discuss.elastic.co/t/elasticsearch-cluster-how-to-create-2-data-nodes-single-node-to-primary-shards-and-the-other-to-replica/163089)
**Author:** [@m\_5amy](https://discuss.elastic.co/u/m_5amy)\ **Replies:** 19\ **Last updated:** [January 7, 2019, 2:41am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-how-to-create-2-data-nodes-single-node-to-primary-shards-and-the-other-to-replica/163089 "2019-01-07T02:41:17Z")
Elasticsearch Cluster, what is the best configuration to create 2 data nodes single node to primary shards and the other to replica?? --- ## [TLS Certificate Expired issue in Uptime](https://discuss.elastic.co/t/tls-certificate-expired-issue-in-uptime/292565)
**Author:** [@dabo](https://discuss.elastic.co/u/dabo)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 11:09am UTC](https://discuss.elastic.co/t/tls-certificate-expired-issue-in-uptime/292565 "2022-01-19T11:09:38Z")
Hi, After renewing certificate on all levels for one domain we still have TLS Certificate showing Expired message in its monitor in Uptime. Interestingly monitor is not down, but shows expired certificate. Anyone know… [Previous page](https://discuss.elastic.co/top.md?page=124&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=126&per_page=50&period=all)