# Top

**URL:** https://discuss.elastic.co/top.md?page=1251&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1252

---

## [Metricbeat Error in Docker Module](https://discuss.elastic.co/t/metricbeat-error-in-docker-module/190564)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 0\
**Last updated:** [July 15, 2019, 2:57pm UTC](https://discuss.elastic.co/t/metricbeat-error-in-docker-module/190564 "2019-07-15T14:57:56Z")

</div>

We have installed Metricbeat 7.1.1 on the servers in our Docker cluster and enabled the docker module with the following configuration: - module: docker metricsets: - container - cpu - diskio - event …

---

## [Поиск по большим данным](https://discuss.elastic.co/t/topic/179950)

<div class="topic-metadata">

**Author:** [@KaKaKuRt](https://discuss.elastic.co/u/KaKaKuRt)\
**Replies:** 7\
**Last updated:** [May 17, 2019, 1:25pm UTC](https://discuss.elastic.co/t/topic/179950 "2019-05-17T13:25:14Z")

</div>

Здравствуйте. Использую ELK стек для сбора событий безопасности Windows. Настройки кластера: curl http://xx.xx.xC:9200/\_cat/nodes?v ip heap.percent ram.percent cpu load\_1m load\_5m load\_15m node.role maste…

---

## [Error fetching fields for index pattern filebeat-\* (ID: filebeat-\*)](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-filebeat-id-filebeat/236018)

<div class="topic-metadata">

**Author:** [@Zakaria\_Irkha](https://discuss.elastic.co/u/Zakaria_Irkha)\
**Replies:** 1\
**Last updated:** [June 9, 2020, 1:13pm UTC](https://discuss.elastic.co/t/error-fetching-fields-for-index-pattern-filebeat-id-filebeat/236018 "2020-06-09T13:13:11Z")

</div>

Hello everyone, i'm new to elasticsearch and its tools, i face some troubles loading my apache server logs to kibana using filebeat then visualize them with the dashboard offered in kibana. i have done the setup for fi…

---

## [Field tooltip in Kibana - can it be edited?](https://discuss.elastic.co/t/field-tooltip-in-kibana-can-it-be-edited/211001)

<div class="topic-metadata">

**Author:** [@omerdemb](https://discuss.elastic.co/u/omerdemb)\
**Replies:** 1\
**Last updated:** [December 19, 2019, 2:46pm UTC](https://discuss.elastic.co/t/field-tooltip-in-kibana-can-it-be-edited/211001 "2019-12-19T14:46:13Z")

</div>

today the tooltip when hovering on a field shows the field name - can it be configured somewhere to show different text? can help educate users on what each field means.

---

## [Fleet Server Integration not listed](https://discuss.elastic.co/t/fleet-server-integration-not-listed/297737)

<div class="topic-metadata">

**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\
**Replies:** 2\
**Last updated:** [February 21, 2022, 3:04pm UTC](https://discuss.elastic.co/t/fleet-server-integration-not-listed/297737 "2022-02-21T15:04:07Z")

</div>

Hi, I am facing this bug in Elasticsearch 7.16.2 and tried the workaround of the following threads: Bug: Workaround: When I try to add the Fleet Server integration manually, it is not listed... Why?

---

## [Restrict User to a search filter](https://discuss.elastic.co/t/restrict-user-to-a-search-filter/189941)

<div class="topic-metadata">

**Author:** [@robin.msr](https://discuss.elastic.co/u/robin.msr)\
**Replies:** 2\
**Last updated:** [July 12, 2019, 7:26am UTC](https://discuss.elastic.co/t/restrict-user-to-a-search-filter/189941 "2019-07-12T07:26:36Z")

</div>

Hi, I have a question about Elastic best practices. We use Elasticsearch with Kibana and Filebeat to log access logs from a loadbalancer. Behind it, we have dozens of websites. Each log contains a field which defines t…

---

## [APM tracing is not working for distributed application](https://discuss.elastic.co/t/apm-tracing-is-not-working-for-distributed-application/168525)

<div class="topic-metadata">

**Author:** [@JyotsnaS](https://discuss.elastic.co/u/JyotsnaS)\
**Replies:** 2\
**Last updated:** [July 11, 2019, 3:51am UTC](https://discuss.elastic.co/t/apm-tracing-is-not-working-for-distributed-application/168525 "2019-07-11T03:51:26Z")

</div>

If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 6.5.…

---

## [Merging rails log lines](https://discuss.elastic.co/t/merging-rails-log-lines/102624)

<div class="topic-metadata">

**Author:** [@Richard\_Collins](https://discuss.elastic.co/u/Richard_Collins)\
**Replies:** 2\
**Last updated:** [October 4, 2017, 9:33pm UTC](https://discuss.elastic.co/t/merging-rails-log-lines/102624 "2017-10-04T21:33:00Z")

</div>

Hi, I am looking at setting up some log aggregation using Filebeats and Elastisearch. We currently have around 200 servers that logs will be aggregated from, with aspirations for growth - the attraction to Elastisearch …

---

## [Open an Index- core operations](https://discuss.elastic.co/t/open-an-index-core-operations/100172)

<div class="topic-metadata">

**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\
**Replies:** 2\
**Last updated:** [September 13, 2017, 10:03am UTC](https://discuss.elastic.co/t/open-an-index-core-operations/100172 "2017-09-13T10:03:48Z")

</div>

As part of core operations course materials, I see a slide for "Open an Index" with below content Be aware that opening an index can take a few seconds or even a couple of minutes -The primary shards may need some upd…

---

## [Create one graphs for each unique values of a text type field](https://discuss.elastic.co/t/create-one-graphs-for-each-unique-values-of-a-text-type-field/97955)

<div class="topic-metadata">

**Author:** [@Pritom\_Ahmed](https://discuss.elastic.co/u/Pritom_Ahmed)\
**Replies:** 2\
**Last updated:** [August 25, 2017, 5:27pm UTC](https://discuss.elastic.co/t/create-one-graphs-for-each-unique-values-of-a-text-type-field/97955 "2017-08-25T17:27:24Z")

</div>

In my index, There are one number field and one date field which can be used to create a line graph with time along the X-axis and average of the number field on the Y-axis. I also have a text type field which has multi…

---

## [Security: Authentication failed on tribe node](https://discuss.elastic.co/t/security-authentication-failed-on-tribe-node/60455)

<div class="topic-metadata">

**Author:** [@obudiman](https://discuss.elastic.co/u/obudiman)\
**Replies:** 2\
**Last updated:** [September 15, 2016, 6:05am UTC](https://discuss.elastic.co/t/security-authentication-failed-on-tribe-node/60455 "2016-09-15T06:05:01Z")

</div>

Hi, We are on alpha5, and not able to authenticate when trying to perform any command from the tribe node, for eg. # curl -u elastic:elastic -XGET localhost:9200 It would throw the following response: {"error":{…

---

## [Cluster really slow after restart](https://discuss.elastic.co/t/cluster-really-slow-after-restart/47596)

<div class="topic-metadata">

**Author:** [@elssar](https://discuss.elastic.co/u/elssar)\
**Replies:** 2\
**Last updated:** [April 18, 2016, 2:18am UTC](https://discuss.elastic.co/t/cluster-really-slow-after-restart/47596 "2016-04-18T02:18:23Z")

</div>

Last week we had to restart a few data nodes in our cluster. These three nodes contained our main index (~1Billion documents, ~450GB across 10 shards with 1 replica). Since the restart, all queries to the cluster have …

---

## [\[ANNOUNCEMENT\] Logstash ipcat filter](https://discuss.elastic.co/t/announcement-logstash-ipcat-filter/40004)

<div class="topic-metadata">

**Author:** [@athoune](https://discuss.elastic.co/u/athoune)\
**Replies:** 2\
**Last updated:** [January 25, 2016, 2:32pm UTC](https://discuss.elastic.co/t/announcement-logstash-ipcat-filter/40004 "2016-01-25T14:32:28Z")

</div>

ipcat is a project for classifying IP : "Datacenter or not", and which provider. Here is the optimized filter for logstash : https://github.com/bearstech/logstash-filter-ipcat

---

## [Auditbeat 7.3: Как добавить исключение auditd](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874)

<div class="topic-metadata">

**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\
**Replies:** 4\
**Last updated:** [October 30, 2019, 3:54pm UTC](https://discuss.elastic.co/t/auditbeat-7-3-auditd/205874 "2019-10-30T15:54:16Z")

</div>

Коллеги, добрый день. Столкнулся с задачей: Необходимо исключить определенный процесс из аудита. Для аудита использую модуль auditd в составе Auditbeat 7.3 на centos7. На сервере есть процесс с именем /usr/bin/process…

---

## [High JVM Heap usage in ES load balancer node and Connection Timeout from Client to ElasticSearch load balancer node](https://discuss.elastic.co/t/high-jvm-heap-usage-in-es-load-balancer-node-and-connection-timeout-from-client-to-elasticsearch-load-balancer-node/159864)

<div class="topic-metadata">

**Author:** [@dhanasg](https://discuss.elastic.co/u/dhanasg)\
**Replies:** 4\
**Last updated:** [December 7, 2018, 10:09am UTC](https://discuss.elastic.co/t/high-jvm-heap-usage-in-es-load-balancer-node-and-connection-timeout-from-client-to-elasticsearch-load-balancer-node/159864 "2018-12-07T10:09:13Z")

</div>

Search Guard and Elasticsearch version - 5.6.9 32GB of max heap configured Installed and used enterprise modules, if any - No JVM version and operating system version - 1.8, CentOS Other installed Elasticsearch or Kiban…

---

## [Logstash output for filebeat xpack monitoring](https://discuss.elastic.co/t/logstash-output-for-filebeat-xpack-monitoring/153471)

<div class="topic-metadata">

**Author:** [@jgrevich](https://discuss.elastic.co/u/jgrevich)\
**Replies:** 4\
**Last updated:** [October 31, 2018, 10:39am UTC](https://discuss.elastic.co/t/logstash-output-for-filebeat-xpack-monitoring/153471 "2018-10-31T10:39:48Z")

</div>

Is it possible to configure filebeat to send its monitoring metrics through logstash rather than have filebeat access the ES cluster directly? I can't seem to figure out how to do this and the documentation seems to sug…

---

## [Filebeat not sending logs](https://discuss.elastic.co/t/filebeat-not-sending-logs/130063)

<div class="topic-metadata">

**Author:** [@FIRST\_Souharit](https://discuss.elastic.co/u/FIRST_Souharit)\
**Replies:** 4\
**Last updated:** [May 2, 2018, 3:28am UTC](https://discuss.elastic.co/t/filebeat-not-sending-logs/130063 "2018-05-02T03:28:25Z")

</div>

Hello, I just started ELK and I sucked in English. I have installed ELK + filebeat + winlogbeat on Ubuntu Vm as suggested, but filebeat does not send log firewall to kibana. Can not create index pattern logstash and fil…

---

## [Aggregation on most recent document in a group](https://discuss.elastic.co/t/aggregation-on-most-recent-document-in-a-group/129335)

<div class="topic-metadata">

**Author:** [@lasitha1991](https://discuss.elastic.co/u/lasitha1991)\
**Replies:** 4\
**Last updated:** [April 24, 2018, 4:47pm UTC](https://discuss.elastic.co/t/aggregation-on-most-recent-document-in-a-group/129335 "2018-04-24T16:47:10Z")

</div>

Hi All, I have a dataset as follows { "unit\_id":150, "value":20, "timestamp":"2018-04-24 11:00AM" } { "unit\_id":150, "value":15, "timestamp":"2018-04-24 11:30AM" } { "unit\_id":151, "value":10, "timestamp":…

---

## [Indices or types when different types need different retention times?](https://discuss.elastic.co/t/indices-or-types-when-different-types-need-different-retention-times/77958)

<div class="topic-metadata">

**Author:** [@wokmichel](https://discuss.elastic.co/u/wokmichel)\
**Replies:** 4\
**Last updated:** [March 9, 2017, 3:33pm UTC](https://discuss.elastic.co/t/indices-or-types-when-different-types-need-different-retention-times/77958 "2017-03-09T15:33:16Z")

</div>

Hello, I need some advice on my design of indices / types in the following context : I have set up a single (for, now, I will maybe add nodes later) ElasticSearch server for several purposes : In Kibana, be able t…

---

## [Cannot send email](https://discuss.elastic.co/t/cannot-send-email/63548)

<div class="topic-metadata">

**Author:** [@ryang97](https://discuss.elastic.co/u/ryang97)\
**Replies:** 4\
**Last updated:** [October 24, 2016, 3:46pm UTC](https://discuss.elastic.co/t/cannot-send-email/63548 "2016-10-24T15:46:17Z")

</div>

Hi, I encountered this error { "id": "email\_admin", "type": "email", "status": "failure", "reason": "MessagingException\[failed to send email with subject \[testing\] via account \[work\]\]; nested: MessagingExcept…

---

## [Create Memory Index with Elasticsearch.net](https://discuss.elastic.co/t/create-memory-index-with-elasticsearch-net/25996)

<div class="topic-metadata">

**Author:** [@Serhat\_Topkaya](https://discuss.elastic.co/u/Serhat_Topkaya)\
**Replies:** 4\
**Last updated:** [July 23, 2015, 9:26am UTC](https://discuss.elastic.co/t/create-memory-index-with-elasticsearch-net/25996 "2015-07-23T09:26:06Z")

</div>

Hi, I try to create memory index with following code but it creates regular index. Any idea? var node = new Uri("http://localhost:9200"); var settings = new ConnectionSettings(node); var client = new Elas…

---

## [Elastic search exclude few fields while reading](https://discuss.elastic.co/t/elastic-search-exclude-few-fields-while-reading/274065)

<div class="topic-metadata">

**Author:** [@whiletruelearn](https://discuss.elastic.co/u/whiletruelearn)\
**Replies:** 3\
**Last updated:** [May 26, 2021, 2:11pm UTC](https://discuss.elastic.co/t/elastic-search-exclude-few-fields-while-reading/274065 "2021-05-26T14:11:55Z")

</div>

Hi, I am using elasticsearch spark connector and trying to use es.read.field.exclude to exclude reading two fields. In the documentation there is this example given es.read.field.exclude = company.income I have two …

---

## [Grok pattern extract data based on column position](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126)

<div class="topic-metadata">

**Author:** [@bruinjoe](https://discuss.elastic.co/u/bruinjoe)\
**Replies:** 3\
**Last updated:** [April 12, 2019, 4:23pm UTC](https://discuss.elastic.co/t/grok-pattern-extract-data-based-on-column-position/176126 "2019-04-12T16:23:05Z")

</div>

I have a mainframe export. I need to parse it based on column position. Does Logstash grok support extraction based on column position? Example line: M4349456 First two characters dept number: M4 Characters 3-6 mail …

---

## [How filter Cloudwatch Logs Aws?](https://discuss.elastic.co/t/how-filter-cloudwatch-logs-aws/174638)

<div class="topic-metadata">

**Author:** [@angelicamaria](https://discuss.elastic.co/u/angelicamaria)\
**Replies:** 3\
**Last updated:** [March 30, 2019, 3:46pm UTC](https://discuss.elastic.co/t/how-filter-cloudwatch-logs-aws/174638 "2019-03-30T15:46:37Z")

</div>

Hello guys, How do I make the filter take into account the records that are between START and END? I want to send to Elastic something as this: { "\_index": "pruebalog:07132017", "\_type": "cloudwatch\_logs", "\_id…

---

## [RangeError: Maximum call stack size exceeded in node\_modules -\> elasticsearch](https://discuss.elastic.co/t/rangeerror-maximum-call-stack-size-exceeded-in-node-modules-elasticsearch/90716)

<div class="topic-metadata">

**Author:** [@Aseed\_Usmani](https://discuss.elastic.co/u/Aseed_Usmani)\
**Replies:** 0\
**Last updated:** [June 24, 2017, 3:30pm UTC](https://discuss.elastic.co/t/rangeerror-maximum-call-stack-size-exceeded-in-node-modules-elasticsearch/90716 "2017-06-24T15:30:44Z")

</div>

Each and every detail: https://stackoverflow.com/questions/44737917/rangeerror-maximum-call-stack-size-exceeded-in-node-modules-elasticsearch

---

## [How to choose right version](https://discuss.elastic.co/t/how-to-choose-right-version/66496)

<div class="topic-metadata">

**Author:** [@shawnzhao](https://discuss.elastic.co/u/shawnzhao)\
**Replies:** 3\
**Last updated:** [November 18, 2016, 8:53am UTC](https://discuss.elastic.co/t/how-to-choose-right-version/66496 "2016-11-18T08:53:57Z")

</div>

hi guys, i want to know how to match the right version between logstash and elasticsearch。 for example，after 2.x ，i can easy find the right version both logstash and elasticsearch。 but 1.x，it is not very clear ！so anyb…

---

## [Absence of some X.AXIS values in Bar chart or line chart](https://discuss.elastic.co/t/absence-of-some-x-axis-values-in-bar-chart-or-line-chart/49624)

<div class="topic-metadata">

**Author:** [@saba\_soltani](https://discuss.elastic.co/u/saba_soltani)\
**Replies:** 3\
**Last updated:** [May 16, 2016, 7:29pm UTC](https://discuss.elastic.co/t/absence-of-some-x-axis-values-in-bar-chart-or-line-chart/49624 "2016-05-16T19:29:48Z")

</div>

Hi every one I want to make a bar chart or line chart based on a string value or either number in X.AXIS. The point is for some of these value in x axis, there is no value in the data set so I won't have those values i…

---

## [Set up elasticsearch cluster for 2 machines](https://discuss.elastic.co/t/set-up-elasticsearch-cluster-for-2-machines/142542)

<div class="topic-metadata">

**Author:** [@Akshay\_Singhvi](https://discuss.elastic.co/u/Akshay_Singhvi)\
**Replies:** 1\
**Last updated:** [August 1, 2018, 12:02pm UTC](https://discuss.elastic.co/t/set-up-elasticsearch-cluster-for-2-machines/142542 "2018-08-01T12:02:53Z")

</div>

I am trying to cluster two system as an elastic cluster I have two system running on ubuntu where elasticsearch is set .The following are the config files with the lines that i have modified or uncommented from the defa…

---

## [Remove Visualisations from Dashboard](https://discuss.elastic.co/t/remove-visualisations-from-dashboard/140685)

<div class="topic-metadata">

**Author:** [@pvderivco](https://discuss.elastic.co/u/pvderivco)\
**Replies:** 1\
**Last updated:** [July 19, 2018, 9:26pm UTC](https://discuss.elastic.co/t/remove-visualisations-from-dashboard/140685 "2018-07-19T21:26:43Z")

</div>

Our elastic search is configured in a way where we delete logs after a defined time frame. My struggle is there are some visualisations created with some filters and when all the data with regards to that visualisation i…

---

## [分桶之后怎么按数据字段排序](https://discuss.elastic.co/t/topic/138109)

<div class="topic-metadata">

**Author:** [@hubiao](https://discuss.elastic.co/u/hubiao)\
**Replies:** 1\
**Last updated:** [July 2, 2018, 2:03am UTC](https://discuss.elastic.co/t/topic/138109 "2018-07-02T02:03:46Z")

</div>

// 从分组的每个桶取出第1个 TopHitsAggregationBuilder topAggr = AggregationBuilders.topHits("top") .sort("reprint", SortOrder.DESC).sort("pubdate", SortOrder.DESC).size(1); // 分桶 AggregationBuilder aggregationBuilder = Aggregat…

---

## [nGram Autocomplete](https://discuss.elastic.co/t/ngram-autocomplete/117072)

<div class="topic-metadata">

**Author:** [@Hrachya\_Yeghishyan](https://discuss.elastic.co/u/Hrachya_Yeghishyan)\
**Replies:** 1\
**Last updated:** [January 29, 2018, 2:46pm UTC](https://discuss.elastic.co/t/ngram-autocomplete/117072 "2018-01-29T14:46:33Z")

</div>

I have implemented multifield partial autocomplete using nGram-s as presented in the following blogpost: https://qbox.io/blog/multi-field-partial-word-autocomplete-in-elasticsearch-using-ngrams It works great in case of…

---

## [Send logs to Arcsight from Logstash](https://discuss.elastic.co/t/send-logs-to-arcsight-from-logstash/109284)

<div class="topic-metadata">

**Author:** [@saad](https://discuss.elastic.co/u/saad)\
**Replies:** 1\
**Last updated:** [November 28, 2017, 9:49am UTC](https://discuss.elastic.co/t/send-logs-to-arcsight-from-logstash/109284 "2017-11-28T09:49:47Z")

</div>

Can we send CEF logs from logstash to arcsight? If yes, How we can do this.

---

## [How to create rule alert brute force](https://discuss.elastic.co/t/how-to-create-rule-alert-brute-force/88289)

<div class="topic-metadata">

**Author:** [@H\_c](https://discuss.elastic.co/u/H_c)\
**Replies:** 1\
**Last updated:** [June 6, 2017, 12:25pm UTC](https://discuss.elastic.co/t/how-to-create-rule-alert-brute-force/88289 "2017-06-06T12:25:23Z")

</div>

I am using ELK 5.1. Please help create rule aler t via email : dos attack, brute force . thank for all!

---

## [Spark Reading/Writing Performance](https://discuss.elastic.co/t/spark-reading-writing-performance/65008)

<div class="topic-metadata">

**Author:** [@aokolnychyi](https://discuss.elastic.co/u/aokolnychyi)\
**Replies:** 1\
**Last updated:** [November 10, 2016, 5:58pm UTC](https://discuss.elastic.co/t/spark-reading-writing-performance/65008 "2016-11-10T17:58:07Z")

</div>

Hi, I am interested in optimizing the reading and writing performances in a system that works with Spark 1.6.2 and ES 2.4. I have read the existing posts & docs but there some minor moments I would like to clarify. I…

---

## [Strange DocumentAlreadyExists / VersionConflictError exceptions](https://discuss.elastic.co/t/strange-documentalreadyexists-versionconflicterror-exceptions/25252)

<div class="topic-metadata">

**Author:** [@Ben\_Wolfson](https://discuss.elastic.co/u/Ben_Wolfson)\
**Replies:** 1\
**Last updated:** [September 15, 2015, 10:23pm UTC](https://discuss.elastic.co/t/strange-documentalreadyexists-versionconflicterror-exceptions/25252 "2015-09-15T22:23:07Z")

</div>

I'm getting some errors I don't really understand (unfortunately only in production, too, I can't reproduce them elsewhere)---occasionally attempts to update or insert a document will result in either a DocumentAlreadyEx…

---

## [Case Insensitive Term Filters](https://discuss.elastic.co/t/case-insensitive-term-filters/12181)

<div class="topic-metadata">

**Author:** [@tbrianjones](https://discuss.elastic.co/u/tbrianjones)\
**Replies:** 1\
**Last updated:** [May 30, 2013, 5:24am UTC](https://discuss.elastic.co/t/case-insensitive-term-filters/12181 "2013-05-30T05:24:41Z")

</div>

I have created an analyzer that should simply lowercase a field. I do this because I want to be able to filter on full phrases in this field ( eg, north dakota ). My problem is that when I perform a filter agains…

---

## [405 error when calling /\_cluster/health?level=indices from a watcher](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457)

<div class="topic-metadata">

**Author:** [@mkadiri](https://discuss.elastic.co/u/mkadiri)\
**Replies:** 2\
**Last updated:** [January 28, 2021, 8:30am UTC](https://discuss.elastic.co/t/405-error-when-calling-cluster-health-level-indices-from-a-watcher/262457 "2021-01-28T08:30:19Z")

</div>

I'm trying to setup a watcher to display indices health using the endpoint mentioned but keep getting a 405 error. This error goes away when I just use the following /\_cluster/health dropping the params ?level=indices, …

---

## [Cant use environment variables in elasticsearch.yml](https://discuss.elastic.co/t/cant-use-environment-variables-in-elasticsearch-yml/117093)

<div class="topic-metadata">

**Author:** [@red888](https://discuss.elastic.co/u/red888)\
**Replies:** 2\
**Last updated:** [January 26, 2018, 10:26am UTC](https://discuss.elastic.co/t/cant-use-environment-variables-in-elasticsearch-yml/117093 "2018-01-26T10:26:40Z")

</div>

My variable is set # echo $ESCLUSTER es-datanode-01,es-datanode-02 In ES config I have: discovery.zen.ping.unicast.hosts: "${ESCLUSTER}" The service won't start. If I add the string explicitly it does start: disco…

---

## [Log Events/Records that Cause Exceptions](https://discuss.elastic.co/t/log-events-records-that-cause-exceptions/94501)

<div class="topic-metadata">

**Author:** [@swsw](https://discuss.elastic.co/u/swsw)\
**Replies:** 2\
**Last updated:** [July 31, 2017, 4:58pm UTC](https://discuss.elastic.co/t/log-events-records-that-cause-exceptions/94501 "2017-07-31T16:58:50Z")

</div>

Hello, How do I log the events/records that come into Logstash that cause exceptions (specifically illegal\_argument\_exception when putting data into Elasticsearch from Logstash). Situation: I am using Logstash and El…

---

## [You're running Kibana 5.4.1 with some different versions of Elasticsearch!](https://discuss.elastic.co/t/youre-running-kibana-5-4-1-with-some-different-versions-of-elasticsearch/89790)

<div class="topic-metadata">

**Author:** [@tkorkunckaya](https://discuss.elastic.co/u/tkorkunckaya)\
**Replies:** 2\
**Last updated:** [June 17, 2017, 7:20am UTC](https://discuss.elastic.co/t/youre-running-kibana-5-4-1-with-some-different-versions-of-elasticsearch/89790 "2017-06-17T07:20:33Z")

</div>

Hi, i did a fresh install of elastic and kibana, they are both v.5.4.1 I also installed x-pack with plugin install. When running kibana it gives a warning that kibana and elastic are not the same version. log \[01:27…

---

## [Filed to execute main query](https://discuss.elastic.co/t/filed-to-execute-main-query/41738)

<div class="topic-metadata">

**Author:** [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Replies:** 2\
**Last updated:** [February 16, 2016, 5:12am UTC](https://discuss.elastic.co/t/filed-to-execute-main-query/41738 "2016-02-16T05:12:23Z")

</div>

I have faced a issue in searching,I am continuously getting out of memory in the particular index. Caused by: java.lang.OutOfMemoryError: Java heap space \[2016-02-15 06:18:08,400\]\[DEBUG\]\[action.search.type \] \[10…

---

## [TOMCAT can work with Kibana4?](https://discuss.elastic.co/t/tomcat-can-work-with-kibana4/25571)

<div class="topic-metadata">

**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\
**Replies:** 2\
**Last updated:** [July 17, 2015, 5:05am UTC](https://discuss.elastic.co/t/tomcat-can-work-with-kibana4/25571 "2015-07-17T05:05:47Z")

</div>

Why we use Tomcat with Kibana when it is just a view tool ?? and if we use Kibana with Tomcat then how to use it? please answer soon

---

## [Exiting: Error reading config file: required 'object', but found 'string' in field 'filebeat.inputs.0' (source:'filebeat.yml')](https://discuss.elastic.co/t/exiting-error-reading-config-file-required-object-but-found-string-in-field-filebeat-inputs-0-source-filebeat-yml/337940)

<div class="topic-metadata">

**Author:** [@Bhakti\_Bhabal](https://discuss.elastic.co/u/Bhakti_Bhabal)\
**Replies:** 5\
**Last updated:** [July 12, 2023, 2:07pm UTC](https://discuss.elastic.co/t/exiting-error-reading-config-file-required-object-but-found-string-in-field-filebeat-inputs-0-source-filebeat-yml/337940 "2023-07-12T14:07:37Z")

</div>

HI Guys i have created the below sample filebeat.yml and verified through yamalint still i am getting the same error . I am trying to setup filebeat to work with elastic and the filebeat itself wont start up giving the e…

---

## [What is the difference between boost and weight](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714)

<div class="topic-metadata">

**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\
**Replies:** 5\
**Last updated:** [September 22, 2021, 1:54am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-boost-and-weight/284714 "2021-09-22T01:54:08Z")

</div>

Boost parameter is used in the below example wildcard": { "City": { "wildcard": "M", "boost": 10 } Can I use similar query for weight?

---

## [ElasticSearch master and slaves](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735)

<div class="topic-metadata">

**Author:** [@Dzyann](https://discuss.elastic.co/u/Dzyann)\
**Replies:** 6\
**Last updated:** [November 18, 2020, 12:58am UTC](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735 "2020-11-18T00:58:13Z")

</div>

I don't usually work much with Elastic, I have been reading about Elastic Configuration. It is my understanding that Elastic is designed to run clustered, where several nodes, at least 3, should be master. And there are …

---

## [Index stops accepting writes after applying filebeat index template](https://discuss.elastic.co/t/index-stops-accepting-writes-after-applying-filebeat-index-template/119853)

<div class="topic-metadata">

**Author:** [@dis\_manoli](https://discuss.elastic.co/u/dis_manoli)\
**Replies:** 6\
**Last updated:** [February 14, 2018, 9:58pm UTC](https://discuss.elastic.co/t/index-stops-accepting-writes-after-applying-filebeat-index-template/119853 "2018-02-14T21:58:36Z")

</div>

So I'm using AWS Elasticsearch (which is currently at version 6.0.1). I use filebeat (6.1.0) to send logs to logstash (6.2.0), which uses the https://github.com/awslabs/logstash-output-amazon\_es output plugin to write t…

---

## [Lock up on actionGet](https://discuss.elastic.co/t/lock-up-on-actionget/6678)

<div class="topic-metadata">

**Author:** [@Frank\_LaRosa](https://discuss.elastic.co/u/Frank_LaRosa)\
**Replies:** 6\
**Last updated:** [February 13, 2012, 2:41pm UTC](https://discuss.elastic.co/t/lock-up-on-actionget/6678 "2012-02-13T14:41:23Z")

</div>

Hi, I've been doing a large number of updates and queries to my index over the past couple of days. It currently contains about 10 million documents which is about half the data I intend to insert. Twice today, m…

---

## [Out of memory error and duplicate rows](https://discuss.elastic.co/t/out-of-memory-error-and-duplicate-rows/321932)

<div class="topic-metadata">

**Author:** [@darius12](https://discuss.elastic.co/u/darius12)\
**Replies:** 4\
**Last updated:** [December 27, 2022, 2:29pm UTC](https://discuss.elastic.co/t/out-of-memory-error-and-duplicate-rows/321932 "2022-12-27T14:29:06Z")

</div>

getting this error when trying to index using logstash: warning: thread "\[main\]\>worker1" terminated with exception (report\_on\_exception is true): java.lang.OutOfMemoryError: UTF16 String size is 1371255266, should be l…

---

## [Error multiples inputs - block in multifilter, block in start\_workers, ParseException: No close tag for /log4j:event/log4j:throwable](https://discuss.elastic.co/t/error-multiples-inputs-block-in-multifilter-block-in-start-workers-parseexception-no-close-tag-for-log4j-event-log4j-throwable/315106)

<div class="topic-metadata">

**Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\
**Replies:** 4\
**Last updated:** [September 26, 2022, 6:54pm UTC](https://discuss.elastic.co/t/error-multiples-inputs-block-in-multifilter-block-in-start-workers-parseexception-no-close-tag-for-log4j-event-log4j-throwable/315106 "2022-09-26T18:54:15Z")

</div>

Context: I have 4 folders, one contains logstash, the other 3 each contain filebeat, the first acts as if an application launched log, the second with 2 applications that send logs for which filebeat has 2 entries, and t…

---

## [How can we patch the ECK operator to watch multiple namespaces](https://discuss.elastic.co/t/how-can-we-patch-the-eck-operator-to-watch-multiple-namespaces/198925)

<div class="topic-metadata">

**Author:** [@shahtab](https://discuss.elastic.co/u/shahtab)\
**Replies:** 4\
**Last updated:** [August 31, 2020, 9:37am UTC](https://discuss.elastic.co/t/how-can-we-patch-the-eck-operator-to-watch-multiple-namespaces/198925 "2020-08-31T09:37:33Z")

</div>

I ahve patched it ONCE to watch one namespace other than default ... But how do you patch for multiple ... ECK worked for the first one but without patching doesn't for the second one. How do we add to the list of names…

[Previous page](https://discuss.elastic.co/top.md?page=1250&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1252&per_page=50&period=all)
