# Top

**URL:** https://discuss.elastic.co/top.md?page=1281&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1282

---

## [Unresponsive cluster: weird fluctuating behavior](https://discuss.elastic.co/t/unresponsive-cluster-weird-fluctuating-behavior/37924)

<div class="topic-metadata">

**Author:** [@vicvega](https://discuss.elastic.co/u/vicvega)\
**Replies:** 2\
**Last updated:** [December 25, 2015, 8:24pm UTC](https://discuss.elastic.co/t/unresponsive-cluster-weird-fluctuating-behavior/37924 "2015-12-25T20:24:38Z")

</div>

Hello Since a few days ago, my ES cluster is unresponsive and I noticed a weird fluctuating behavior. If a periodically check the status, I see number\_of\_pending\_tasks increasing (3 millions and more) and at the same t…

---

## [Best load balancing solution for logstash service](https://discuss.elastic.co/t/best-load-balancing-solution-for-logstash-service/359896)

<div class="topic-metadata">

**Author:** [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\
**Replies:** 5\
**Last updated:** [May 22, 2024, 5:40am UTC](https://discuss.elastic.co/t/best-load-balancing-solution-for-logstash-service/359896 "2024-05-22T05:40:51Z")

</div>

Hi Team, Currently we have logstash deployed on AWS ECS with service discovery (DNS), which creates DNS records pointing to task containers, We are pointing filebeat to these Domain names, with this setup Due to DNS TTL…

---

## [Logstash Illegal Argument Exception while parsing date](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142)

<div class="topic-metadata">

**Author:** [@b.ohmer](https://discuss.elastic.co/u/b.ohmer)\
**Replies:** 5\
**Last updated:** [May 10, 2022, 4:24pm UTC](https://discuss.elastic.co/t/logstash-illegal-argument-exception-while-parsing-date/303142 "2022-05-10T16:24:04Z")

</div>

Hi there, I've got three questions around Logstash: We're using an older version of Logstash (6.5.4) and experiencing currently an issue while parsing a date. I've got absolutely no idea anymore what I can do to make …

---

## [\_field\_caps API takes long time (more than a minute) to return results causing kibana to not be able to refresh index pattern](https://discuss.elastic.co/t/field-caps-api-takes-long-time-more-than-a-minute-to-return-results-causing-kibana-to-not-be-able-to-refresh-index-pattern/198933)

<div class="topic-metadata">

**Author:** [@nikhil-bhat](https://discuss.elastic.co/u/nikhil-bhat)\
**Replies:** 5\
**Last updated:** [September 30, 2019, 4:44pm UTC](https://discuss.elastic.co/t/field-caps-api-takes-long-time-more-than-a-minute-to-return-results-causing-kibana-to-not-be-able-to-refresh-index-pattern/198933 "2019-09-30T16:44:13Z")

</div>

Elasticsearch version 6.7.2 JVM version Java HotSpot(TM) 64-Bit Server VM (1.8.0\_172): OS version Linux field\_caps API takes long time (more than a minute) to return results : Steps to reproduce : 1.) Index patte…

---

## [Logstash error when running .conf](https://discuss.elastic.co/t/logstash-error-when-running-conf/164079)

<div class="topic-metadata">

**Author:** [@OpSecMonkey](https://discuss.elastic.co/u/OpSecMonkey)\
**Replies:** 5\
**Last updated:** [January 14, 2019, 11:10pm UTC](https://discuss.elastic.co/t/logstash-error-when-running-conf/164079 "2019-01-14T23:10:00Z")

</div>

I get this error when running in centos 7 \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, { at line 15, c…

---

## [Metricbeat default index template causes "No matching token for number\_type \[BIG\_INTEGER\]"](https://discuss.elastic.co/t/metricbeat-default-index-template-causes-no-matching-token-for-number-type-big-integer/148370)

<div class="topic-metadata">

**Author:** [@wes](https://discuss.elastic.co/u/wes)\
**Replies:** 5\
**Last updated:** [September 17, 2018, 4:44pm UTC](https://discuss.elastic.co/t/metricbeat-default-index-template-causes-no-matching-token-for-number-type-big-integer/148370 "2018-09-17T16:44:30Z")

</div>

Hi there, I've posted about this issue in the past and never received any suggestions. I finally got around to looking at it again and was able to figure out a little more this time, so I'm hoping someone will be able t…

---

## [Useragent is missing ELB-HealthChecker](https://discuss.elastic.co/t/useragent-is-missing-elb-healthchecker/121143)

<div class="topic-metadata">

**Author:** [@red888](https://discuss.elastic.co/u/red888)\
**Replies:** 5\
**Last updated:** [February 26, 2018, 11:04pm UTC](https://discuss.elastic.co/t/useragent-is-missing-elb-healthchecker/121143 "2018-02-26T23:04:53Z")

</div>

Im using the useragent plugin in my logstash pipeline: useragent { prefix =\> "userAgent\_" source =\> "userAgent" } But its not getting the ELB healthcheck user agent Here is an example log line: 2018-02-22 14:53:31…

---

## [How to get Coordinating node client](https://discuss.elastic.co/t/how-to-get-coordinating-node-client/91400)

<div class="topic-metadata">

**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\
**Replies:** 5\
**Last updated:** [July 3, 2017, 1:44pm UTC](https://discuss.elastic.co/t/how-to-get-coordinating-node-client/91400 "2017-07-03T13:44:08Z")

</div>

Hi Migrating to es 5.4.1 from es 2.3.2. Previously We were using nodeclient in our application. How to achieve the same in es 5.4.1 ? I have tried the coordinating node but the node not getting joined to the cluster. e…

---

## [My health status is red](https://discuss.elastic.co/t/my-health-status-is-red/58266)

<div class="topic-metadata">

**Author:** [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\
**Replies:** 5\
**Last updated:** [August 17, 2016, 3:03pm UTC](https://discuss.elastic.co/t/my-health-status-is-red/58266 "2016-08-17T15:03:17Z")

</div>

{ "cluster\_name" : "elasticsearch", "status" : "red", "timed\_out" : false, "number\_of\_nodes" : 1, "number\_of\_data\_nodes" : 1, "active\_primary\_shards" : 3200, "active\_shards" : 3200, "relocating\_shards" : 0, "in…

---

## [Having an empty hits and response from elasticsearch when trying to query them via an api](https://discuss.elastic.co/t/having-an-empty-hits-and-response-from-elasticsearch-when-trying-to-query-them-via-an-api/333698)

<div class="topic-metadata">

**Author:** [@Bettaieb\_Walid](https://discuss.elastic.co/u/Bettaieb_Walid)\
**Replies:** 3\
**Last updated:** [May 18, 2023, 9:56pm UTC](https://discuss.elastic.co/t/having-an-empty-hits-and-response-from-elasticsearch-when-trying-to-query-them-via-an-api/333698 "2023-05-18T21:56:27Z")

</div>

hello , I am developing backend using strapi , and i am going to store some data inside elasticsearch , and i would like to be able to consume the data, and fetch them. here is the different configuration files routes: …

---

## [Docker - Elasticsearch 8 - unable to create temporary keystore](https://discuss.elastic.co/t/docker-elasticsearch-8-unable-to-create-temporary-keystore/298878)

<div class="topic-metadata">

**Author:** [@Realsnack](https://discuss.elastic.co/u/Realsnack)\
**Replies:** 0\
**Last updated:** [March 4, 2022, 9:50pm UTC](https://discuss.elastic.co/t/docker-elasticsearch-8-unable-to-create-temporary-keystore/298878 "2022-03-04T21:50:00Z")

</div>

I am upgrading to Elasticsearch 8 on my home docker cluster and I am getting the error: ERROR: unable to create temporary keystore at \[/usr/share/elasticsearch/config/elasticsearch.keystore.tmp\], write permissions requi…

---

## [Indirect dependency on the framework assembly(System.Tuplevalue)](https://discuss.elastic.co/t/indirect-dependency-on-the-framework-assembly-system-tuplevalue/294987)

<div class="topic-metadata">

**Author:** [@sathish\_reddy](https://discuss.elastic.co/u/sathish_reddy)\
**Replies:** 3\
**Last updated:** [January 26, 2022, 10:42am UTC](https://discuss.elastic.co/t/indirect-dependency-on-the-framework-assembly-system-tuplevalue/294987 "2022-01-26T10:42:26Z")

</div>

The primary reference could not be resolved because it has an indirect dependency on the framework assembly "System.ValueTuple, Version=4.0.2.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51" which could not be resolv…

---

## [Kibana Template for Visualization](https://discuss.elastic.co/t/kibana-template-for-visualization/175755)

<div class="topic-metadata">

**Author:** [@Jinu](https://discuss.elastic.co/u/Jinu)\
**Replies:** 3\
**Last updated:** [April 10, 2019, 9:12am UTC](https://discuss.elastic.co/t/kibana-template-for-visualization/175755 "2019-04-10T09:12:06Z")

</div>

Hi All , Just have some doubts on How to create a template for the selected fields in Kibana . For ex , If I have the following fields in the logs . Name,Age,Height,City,Country,Language . I need to create a template …

---

## [Job scheduler for ES?](https://discuss.elastic.co/t/job-scheduler-for-es/120511)

<div class="topic-metadata">

**Author:** [@Igor\_Yakushin](https://discuss.elastic.co/u/Igor_Yakushin)\
**Replies:** 3\
**Last updated:** [February 19, 2018, 9:52pm UTC](https://discuss.elastic.co/t/job-scheduler-for-es/120511 "2018-02-19T21:52:21Z")

</div>

Hello, What does ES do when multiple jobs by multiple users are submitted to ES cluster? Is it FIFO? Is there any kind of scheduler? Are jobs put on some queue or rejected while the cluster is running some job? Or do …

---

## [Advice about Elastic Search sizing and monitoring Oracle Databases](https://discuss.elastic.co/t/advice-about-elastic-search-sizing-and-monitoring-oracle-databases/49363)

<div class="topic-metadata">

**Author:** [@r4z0rw1r3666](https://discuss.elastic.co/u/r4z0rw1r3666)\
**Replies:** 3\
**Last updated:** [May 6, 2016, 4:25am UTC](https://discuss.elastic.co/t/advice-about-elastic-search-sizing-and-monitoring-oracle-databases/49363 "2016-05-06T04:25:29Z")

</div>

Hello, I'm a new user to the whole ELK stack (\< 1 week) and let me say I am impressed with just what this tool is capable of. Currently in my proof of concept vagrant machine, I have a ELK up and running, 2 vcpu's, 8…

---

## [Date\_detection not working with not\_analyzed fields](https://discuss.elastic.co/t/date-detection-not-working-with-not-analyzed-fields/43758)

<div class="topic-metadata">

**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\
**Replies:** 3\
**Last updated:** [March 8, 2016, 8:03pm UTC](https://discuss.elastic.co/t/date-detection-not-working-with-not-analyzed-fields/43758 "2016-03-08T20:03:02Z")

</div>

I want to enable date\_detection but, at the same time, I want to store all fields as not\_analyzed by default. So I'm using these mappings with date\_detection: true and a dynamic\_template. Dates are not detected, and th…

---

## [Matching a field (exception name) on the second line in a multiline event](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016)

<div class="topic-metadata">

**Author:** [@Ilhami\_Visne](https://discuss.elastic.co/u/Ilhami_Visne)\
**Replies:** 3\
**Last updated:** [January 25, 2016, 12:18pm UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016 "2016-01-25T12:18:12Z")

</div>

I have multiline Log4J logs. The lines after the first are optional. The first line contains the log message and after that is the stacktrace. I want to extract the top exception class name on a stacktrace and it is the …

---

## [Migrating from 1.2 to 1.7.3 - Very high Mem Heap usage + other problem](https://discuss.elastic.co/t/migrating-from-1-2-to-1-7-3-very-high-mem-heap-usage-other-problem/46532)

<div class="topic-metadata">

**Author:** [@MichZem](https://discuss.elastic.co/u/MichZem)\
**Replies:** 0\
**Last updated:** [April 6, 2016, 1:14pm UTC](https://discuss.elastic.co/t/migrating-from-1-2-to-1-7-3-very-high-mem-heap-usage-other-problem/46532 "2016-04-06T13:14:31Z")

</div>

Hello I'm new to the forum. I've upgraded my cluster from 1.2 to 1.7.3 version. Since then, we have lot of problems and our cluster is not very stable. One of the critical problem is that we have lot of GC, and when l…

---

## [Elastic search trained model inference not working](https://discuss.elastic.co/t/elastic-search-trained-model-inference-not-working/359649)

<div class="topic-metadata">

**Author:** [@likealam](https://discuss.elastic.co/u/likealam)\
**Replies:** 5\
**Last updated:** [January 14, 2025, 8:45pm UTC](https://discuss.elastic.co/t/elastic-search-trained-model-inference-not-working/359649 "2025-01-14T20:45:17Z")

</div>

After importing the text embedding sentence-transformers/msmarco-MiniLM-L12-cos-v5 model to elasticsearch using eland the model infering doesnt work. eland command: eland\_import\_hub\_model --url http://localhost:9200 --…

---

## [Why a cancelled task is still on the list?](https://discuss.elastic.co/t/why-a-cancelled-task-is-still-on-the-list/336413)

<div class="topic-metadata">

**Author:** [@HyebinHong](https://discuss.elastic.co/u/HyebinHong)\
**Replies:** 7\
**Last updated:** [June 21, 2023, 8:15am UTC](https://discuss.elastic.co/t/why-a-cancelled-task-is-still-on-the-list/336413 "2023-06-21T08:15:45Z")

</div>

Hello, elastic! While running multiple msearch API through Java clients, I found one of the tasks took abnormally long. So I executed Task Cancel API, but it doesn't seem cleanup properly. When I check the task via Ta…

---

## [Strigo lab ended before start virtual classroom](https://discuss.elastic.co/t/strigo-lab-ended-before-start-virtual-classroom/219885)

<div class="topic-metadata">

**Author:** [@m-amano](https://discuss.elastic.co/u/m-amano)\
**Replies:** 7\
**Last updated:** [February 20, 2020, 3:59am UTC](https://discuss.elastic.co/t/strigo-lab-ended-before-start-virtual-classroom/219885 "2020-02-20T03:59:28Z")

</div>

I was taking on-demand class "Vega Visualizations in Kibana" , but I could not start a virtual classroom even though after "Setting Up Your Lab". Now, I click "Lab" button and the new tab will show up saying "This cours…

---

## [CSV filter - How can I parse unquoted CSV?](https://discuss.elastic.co/t/csv-filter-how-can-i-parse-unquoted-csv/168566)

<div class="topic-metadata">

**Author:** [@Skeeve](https://discuss.elastic.co/u/Skeeve)\
**Replies:** 7\
**Last updated:** [February 15, 2019, 10:05pm UTC](https://discuss.elastic.co/t/csv-filter-how-can-i-parse-unquoted-csv/168566 "2019-02-15T22:05:55Z")

</div>

My Data looks similar to this: 2019-02-15T10:56:00.000+000\\t{"test":"value","more":{"property":"value"}} but with a lot more fields. Issue here is that one field is a JSON structure which is unquoted. When I do not set…

---

## [How to send only new line data in filebeats](https://discuss.elastic.co/t/how-to-send-only-new-line-data-in-filebeats/126418)

<div class="topic-metadata">

**Author:** [@Kuysuperall](https://discuss.elastic.co/u/Kuysuperall)\
**Replies:** 1\
**Last updated:** [April 3, 2018, 1:38pm UTC](https://discuss.elastic.co/t/how-to-send-only-new-line-data-in-filebeats/126418 "2018-04-03T13:38:21Z")

</div>

hi i try to config filebeat like a if in CSV or log file it have new line record it must to send only new line record not all off them data this is my config filebeat.prospectors: - type: log enabled: true paths: …

---

## [Unable to access /tmp/jna--1985354563/jna1905218698016583564.tmp:](https://discuss.elastic.co/t/unable-to-access-tmp-jna-1985354563-jna1905218698016583564-tmp/100760)

<div class="topic-metadata">

**Author:** [@vaddanam](https://discuss.elastic.co/u/vaddanam)\
**Replies:** 1\
**Last updated:** [September 25, 2017, 5:47am UTC](https://discuss.elastic.co/t/unable-to-access-tmp-jna-1985354563-jna1905218698016583564-tmp/100760 "2017-09-25T05:47:53Z")

</div>

Hi Team, I am running elastic search as service in linux. I am receiving the below error message "\[2017-09-16T11:13:10,538\]\[WARN \]\[o.e.b.Natives\] unable to load JNA native support library, native methods will be disable…

---

## [Not able to make a fileld conditional in grok](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242)

<div class="topic-metadata">

**Author:** [@George\_Cherian](https://discuss.elastic.co/u/George_Cherian)\
**Replies:** 6\
**Last updated:** [November 28, 2017, 9:08am UTC](https://discuss.elastic.co/t/not-able-to-make-a-fileld-conditional-in-grok/109242 "2017-11-28T09:08:00Z")

</div>

The grok filter what is written is as follows: grok { match =\> { "correlationid:" =\> "(?\\w{8}-\\w{4}-\\w{4}-\\w{4}-\\w{12})?" } } For the below text it is not showing the output: "correlationid:" =\> "1000 | callhalf-138…

---

## [Collapse on nested inner hits](https://discuss.elastic.co/t/collapse-on-nested-inner-hits/232553)

<div class="topic-metadata">

**Author:** [@mekanix](https://discuss.elastic.co/u/mekanix)\
**Replies:** 0\
**Last updated:** [May 14, 2020, 6:02am UTC](https://discuss.elastic.co/t/collapse-on-nested-inner-hits/232553 "2020-05-14T06:02:33Z")

</div>

Can you do collapse on inner\_hits like this: { "query": { "bool": { "filter": \[ { "nested": { "path": "foo", "query": { "match\_all": {} }, …

---

## [ElasticSearch error "socket hang up"](https://discuss.elastic.co/t/elasticsearch-error-socket-hang-up/83137)

<div class="topic-metadata">

**Author:** [@sueken](https://discuss.elastic.co/u/sueken)\
**Replies:** 0\
**Last updated:** [April 21, 2017, 2:34am UTC](https://discuss.elastic.co/t/elasticsearch-error-socket-hang-up/83137 "2017-04-21T02:34:09Z")

</div>

Elasticsearch ERROR: 2017-04-21T02:09:59Z Error: Request error, retrying POST https://7e97d2d6bcb5e2351446637a2f6f6993.ap-northeast-1.aws.found.io:9243/\_search?type=delivery&size=1000 =\> socket hang up at Log.…

---

## [Group by query with select case when gives error: Connot use non-grouped column (Canvas elasticsearch sql)](https://discuss.elastic.co/t/group-by-query-with-select-case-when-gives-error-connot-use-non-grouped-column-canvas-elasticsearch-sql/315880)

<div class="topic-metadata">

**Author:** [@Houssam](https://discuss.elastic.co/u/Houssam)\
**Replies:** 4\
**Last updated:** [October 10, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-query-with-select-case-when-gives-error-connot-use-non-grouped-column-canvas-elasticsearch-sql/315880 "2022-10-10T07:04:39Z")

</div>

Hello everyone I face a problem with a certain group by elasticsearch sql query when i try to use a field in select case condition but not group by it because it doubles my rows and leaves null values, i get the followin…

---

## [Kibana DMARC IP location](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574)

<div class="topic-metadata">

**Author:** [@hapkoek](https://discuss.elastic.co/u/hapkoek)\
**Replies:** 4\
**Last updated:** [September 9, 2021, 8:10am UTC](https://discuss.elastic.co/t/kibana-dmarc-ip-location/282574 "2021-09-09T08:10:04Z")

</div>

Hi all, Recently I installed Elastic and Kibana to create a dashboard for DMARC statistics. (ParseDMARC) Currently Kibana uses ParseDMARC objects to import the data. Two of the fields are Source\_IP and Destination\_IP. …

---

## [Logstash : Multi Pipelines Performances](https://discuss.elastic.co/t/logstash-multi-pipelines-performances/181583)

<div class="topic-metadata">

**Author:** [@Oxyds](https://discuss.elastic.co/u/Oxyds)\
**Replies:** 4\
**Last updated:** [May 20, 2019, 7:49am UTC](https://discuss.elastic.co/t/logstash-multi-pipelines-performances/181583 "2019-05-20T07:49:22Z")

</div>

Hi, I am using Logstash to parse IIS logs and to ingest some metrics about the system of my servers. So I am using Filebeat to send the logs and Metricbeat to send the metrics. However,to allow the analysis of future new…

---

## [APM do not work](https://discuss.elastic.co/t/apm-do-not-work/157438)

<div class="topic-metadata">

**Author:** [@picoroma](https://discuss.elastic.co/u/picoroma)\
**Replies:** 4\
**Last updated:** [November 20, 2018, 10:47am UTC](https://discuss.elastic.co/t/apm-do-not-work/157438 "2018-11-20T10:47:10Z")

</div>

I'm trying to work with APM agent and server. Tryinf to monitoring an java application that run under Tomcat 8.5 (windows) I have installed the APM server on same host of ELK stack is installed. This is a test envirome…

---

## [How to Add Machine Learning to Existing AWS Elastic Instance?](https://discuss.elastic.co/t/how-to-add-machine-learning-to-existing-aws-elastic-instance/157437)

<div class="topic-metadata">

**Author:** [@t249a](https://discuss.elastic.co/u/t249a)\
**Replies:** 1\
**Last updated:** [November 19, 2018, 8:57pm UTC](https://discuss.elastic.co/t/how-to-add-machine-learning-to-existing-aws-elastic-instance/157437 "2018-11-19T20:57:47Z")

</div>

Hi all, I have an existing Elastic instance on AWS which I would like to use the machine learning and anomaly prediction features described in I understand it's a paid feature. Can I add it to my existing AWS Elastic …

---

## [ELK web APIs](https://discuss.elastic.co/t/elk-web-apis/107794)

<div class="topic-metadata">

**Author:** [@kundavaram](https://discuss.elastic.co/u/kundavaram)\
**Replies:** 4\
**Last updated:** [November 15, 2017, 8:16pm UTC](https://discuss.elastic.co/t/elk-web-apis/107794 "2017-11-15T20:16:13Z")

</div>

Hello, I'm new to ELK Stack. We would like to feed logs that are generated from our middleware application (Biztalk). I'm considering couple of options: My app generated an XML logs and whats the best way to feed th…

---

## [Filtered by IdsQuery vs by TermsQuery](https://discuss.elastic.co/t/filtered-by-idsquery-vs-by-termsquery/66553)

<div class="topic-metadata">

**Author:** [@xavierfacq](https://discuss.elastic.co/u/xavierfacq)\
**Replies:** 4\
**Last updated:** [November 21, 2016, 1:00pm UTC](https://discuss.elastic.co/t/filtered-by-idsquery-vs-by-termsquery/66553 "2016-11-21T13:00:51Z")

</div>

Hi all, Admit we have lot of documents with \_id (String) setted by ourself and a field with the same value of the \_id as Long. I want to run a filtered query on a list of Long , so I have 2 options : Option 1: a…

---

## [Limit the result of Elasticsearch query](https://discuss.elastic.co/t/limit-the-result-of-elasticsearch-query/55051)

<div class="topic-metadata">

**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Replies:** 4\
**Last updated:** [July 11, 2016, 12:44pm UTC](https://discuss.elastic.co/t/limit-the-result-of-elasticsearch-query/55051 "2016-07-11T12:44:29Z")

</div>

Hi, I wrote one elasticsearch query to get only top 10 result in descending order { "size": 10, "aggs": { "group\_by\_user": { "terms": { "field": "user.raw" } } } } I am getting th…

---

## [Can I execute Java query using JSON string](https://discuss.elastic.co/t/can-i-execute-java-query-using-json-string/10366)

<div class="topic-metadata">

**Author:** [@Janusz\_Dalecki](https://discuss.elastic.co/u/Janusz_Dalecki)\
**Replies:** 4\
**Last updated:** [January 16, 2013, 11:39pm UTC](https://discuss.elastic.co/t/can-i-execute-java-query-using-json-string/10366 "2013-01-16T23:39:05Z")

</div>

Hi, I have a search string that is already JSON string like this: { description:"Cisco Network Data Switch" } When I pass it to the code below : SearchRequestBuilder srb = client.prepareSearch("asset\_index").…

---

## [Could not write file \[/usr/share/elasticsearch/config/users\] bind mounted using docker-compose](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046)

<div class="topic-metadata">

**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\
**Replies:** 2\
**Last updated:** [February 24, 2022, 10:35am UTC](https://discuss.elastic.co/t/could-not-write-file-usr-share-elasticsearch-config-users-bind-mounted-using-docker-compose/298046 "2022-02-24T10:35:51Z")

</div>

Continuing the discussion from "Device or resource busy" when adding to keystore in Docker Compose: I received a similar exception trying to execute a bin/elasticsearch-users useradd command: Exception in thread "main"…

---

## [Loading SQL Server data using Logstash](https://discuss.elastic.co/t/loading-sql-server-data-using-logstash/288097)

<div class="topic-metadata">

**Author:** [@sunilmpatil](https://discuss.elastic.co/u/sunilmpatil)\
**Replies:** 2\
**Last updated:** [November 2, 2021, 5:49am UTC](https://discuss.elastic.co/t/loading-sql-server-data-using-logstash/288097 "2021-11-02T05:49:37Z")

</div>

Hi All, I am planning to load data from SQL Server database to Elastic. While trying to load this data using Logstash JDBC plugin, I am facing issue. I am pasting details as below, please suggest what is missing here. (…

---

## [Elasticsearch Engineer I Home Labs Setup](https://discuss.elastic.co/t/elasticsearch-engineer-i-home-labs-setup/259544)

<div class="topic-metadata">

**Author:** [@NigelM](https://discuss.elastic.co/u/NigelM)\
**Replies:** 2\
**Last updated:** [December 28, 2020, 10:28pm UTC](https://discuss.elastic.co/t/elasticsearch-engineer-i-home-labs-setup/259544 "2020-12-28T22:28:45Z")

</div>

Hi, I am working through my Elasticsearch training material for the Elasticsearch Engineer 1 course and I have built my home environment - however it makes reference to accessing the blogs search page which was just an …

---

## [Initializing variable in ruby logstash filter](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875)

<div class="topic-metadata">

**Author:** [@sajjad0927](https://discuss.elastic.co/u/sajjad0927)\
**Replies:** 2\
**Last updated:** [May 11, 2020, 2:20am UTC](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875 "2020-05-11T02:20:16Z")

</div>

Can I do multiple initialization in logstash ruby filter like below. For me it is giving error ruby { init =\> "@buffer = 377" init =\> "@buffer1 = 477" code =\> "

---

## [Monitoring not showing all nodes](https://discuss.elastic.co/t/monitoring-not-showing-all-nodes/197673)

<div class="topic-metadata">

**Author:** [@coudenysj](https://discuss.elastic.co/u/coudenysj)\
**Replies:** 2\
**Last updated:** [September 5, 2019, 9:37am UTC](https://discuss.elastic.co/t/monitoring-not-showing-all-nodes/197673 "2019-09-05T09:37:47Z")

</div>

Hi, This is a followup question for Monitoring -\> Elasticsearch -\> Nodes - no data nodes(. I have 15 nodes in my cluster, but the Monitoring -\> Elasticsearch -\> Nodes is only showing master nodes. The strange thing is…

---

## [Make search with special characters insensitive](https://discuss.elastic.co/t/make-search-with-special-characters-insensitive/188330)

<div class="topic-metadata">

**Author:** [@tomsk](https://discuss.elastic.co/u/tomsk)\
**Replies:** 2\
**Last updated:** [July 1, 2019, 3:36pm UTC](https://discuss.elastic.co/t/make-search-with-special-characters-insensitive/188330 "2019-07-01T15:36:33Z")

</div>

Hello, firstly sorry if this is wrong section and I am beginner, but I need help with search query for Elasticsearch. I use Elasticsearch as search engine for my website. People can search for products and as you can se…

---

## [Variable string empty in ruby filter](https://discuss.elastic.co/t/variable-string-empty-in-ruby-filter/186367)

<div class="topic-metadata">

**Author:** [@manunc](https://discuss.elastic.co/u/manunc)\
**Replies:** 2\
**Last updated:** [June 19, 2019, 8:28am UTC](https://discuss.elastic.co/t/variable-string-empty-in-ruby-filter/186367 "2019-06-19T08:28:27Z")

</div>

Hello, I am using ELK 5.6 (for several reasons) I dont not succeed to assign a variable string using this ruby code: s = event.get("\[sigfox\]\[data\]") tab = s.split(/(\\w{2})(\\w{2})(\\w{20})/) pack\_id …

---

## [Filebeat multiline splitting events - which timeout to tweak?](https://discuss.elastic.co/t/filebeat-multiline-splitting-events-which-timeout-to-tweak/114427)

<div class="topic-metadata">

**Author:** [@tehowe](https://discuss.elastic.co/u/tehowe)\
**Replies:** 2\
**Last updated:** [January 8, 2018, 3:59pm UTC](https://discuss.elastic.co/t/filebeat-multiline-splitting-events-which-timeout-to-tweak/114427 "2018-01-08T15:59:59Z")

</div>

Hey, I'm using Filebeat 6.1.1 on a number of Linux hosts. I'm prospecting apt-get logs, which look like this usually Start-Date: 2018-01-03 20:45:26 Commandline: /usr/bin/apt-get -y -o Dpkg::Options::=--force-confdef -…

---

## [Interpreting results](https://discuss.elastic.co/t/interpreting-results/110898)

<div class="topic-metadata">

**Author:** [@loren](https://discuss.elastic.co/u/loren)\
**Replies:** 2\
**Last updated:** [December 13, 2017, 10:25pm UTC](https://discuss.elastic.co/t/interpreting-results/110898 "2017-12-13T22:25:16Z")

</div>

I've read Are there docs to help interpret the results? and ESRally Metrics Definition but still have some questions on interpreting results, specifically those from a tournament. In the results below, the index-append t…

---

## [XFS quotas does not work in ECE beta1](https://discuss.elastic.co/t/xfs-quotas-does-not-work-in-ece-beta1/78482)

<div class="topic-metadata">

**Author:** [@vb4t](https://discuss.elastic.co/u/vb4t)\
**Replies:** 2\
**Last updated:** [March 15, 2017, 8:26pm UTC](https://discuss.elastic.co/t/xfs-quotas-does-not-work-in-ece-beta1/78482 "2017-03-15T20:26:05Z")

</div>

Hello, I have XFS quota enabled and mounted /mnt/data. But inside the docker allocator container log I can see: \[2017-03-14 09:18:20,368\]\[WARN \]\[no.found.runner.managers.XFSQuotaManager\] Command \[\[sudo, -n, xfs\_quota…

---

## [Automation( visualization process)](https://discuss.elastic.co/t/automation-visualization-process/51586)

<div class="topic-metadata">

**Author:** [@bbhandari0121](https://discuss.elastic.co/u/bbhandari0121)\
**Replies:** 2\
**Last updated:** [June 1, 2016, 4:31pm UTC](https://discuss.elastic.co/t/automation-visualization-process/51586 "2016-06-01T16:31:34Z")

</div>

Hi team, I am working on visualizing the data, one visualization per server on kibana. We have like more than 100 servers, my concern is rather going on the kibana dashboard and making the visualization and droping that…

---

## [Kibana - graph, capacityplan](https://discuss.elastic.co/t/kibana-graph-capacityplan/39268)

<div class="topic-metadata">

**Author:** [@pittoch](https://discuss.elastic.co/u/pittoch)\
**Replies:** 2\
**Last updated:** [January 19, 2016, 7:51pm UTC](https://discuss.elastic.co/t/kibana-graph-capacityplan/39268 "2016-01-19T19:51:23Z")

</div>

Bonjour, Je suis sur ELK depuis 1 semaine, et j'aurais voulu savoir si il est possible de . Sur un graph line: exemple avec un graph représenant la consommation disque en Y, et le temps sur l'axe X, je veux pouvoir …

---

## [Elasticsearch at Netsuite: Speed, Scale, and Security Webinar](https://discuss.elastic.co/t/elasticsearch-at-netsuite-speed-scale-and-security-webinar/26915)

<div class="topic-metadata">

**Author:** [@Christina\_Thaute](https://discuss.elastic.co/u/Christina_Thaute)\
**Replies:** 2\
**Last updated:** [August 10, 2015, 8:55pm UTC](https://discuss.elastic.co/t/elasticsearch-at-netsuite-speed-scale-and-security-webinar/26915 "2015-08-10T20:55:33Z")

</div>

Elasticsearch at Netsuite: Speed, Scale, and Security Webinar Topics covered: -Netsuite’s Elasticsearch architecture to ingest 3 billion daily events -Scale to handle a petabyte of data -Meet security needs like HIPA…

---

## [APM RUM agent not connecting APM Server over https](https://discuss.elastic.co/t/apm-rum-agent-not-connecting-apm-server-over-https/263835)

<div class="topic-metadata">

**Author:** [@Ram\_Dinesh](https://discuss.elastic.co/u/Ram_Dinesh)\
**Replies:** 1\
**Last updated:** [March 23, 2021, 5:13pm UTC](https://discuss.elastic.co/t/apm-rum-agent-not-connecting-apm-server-over-https/263835 "2021-03-23T17:13:24Z")

</div>

If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea…

[Previous page](https://discuss.elastic.co/top.md?page=1280&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1282&per_page=50&period=all)
