# Top **URL:** https://discuss.elastic.co/top.md?page=1381&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1382 --- ## [Should Data Nodes still be the same size?](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059)
**Author:** [@bunste](https://discuss.elastic.co/u/bunste)\ **Replies:** 2\ **Last updated:** [February 23, 2022, 11:20pm UTC](https://discuss.elastic.co/t/should-data-nodes-still-be-the-same-size/298059 "2022-02-23T23:20:53Z")
Hello all, In our company we run a small Elasticsearch cluster with meanwhile 6 data nodes. These have been added over time and are therefore equipped quite differently - especially in terms of disk capacity. Now we ar… --- ## [HEXADECIMAL string to Binary and Binary to decimal in log-stash using ruby filter](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715)
**Author:** [@Kamikaze\_K](https://discuss.elastic.co/u/Kamikaze_K)\ **Replies:** 2\ **Last updated:** [July 4, 2021, 2:30am UTC](https://discuss.elastic.co/t/hexadecimal-string-to-binary-and-binary-to-decimal-in-log-stash-using-ruby-filter/277715 "2021-07-04T02:30:05Z")
I am working with logstash and I am using ruby filter to change HEX to decimal which works fine for one set of data. What I use for this is ; ruby{ code =\> "event.set('xxx', event.get('xx').hex)" } I am looking for s… --- ## [X-pack 6.2.3 issue after upgrade](https://discuss.elastic.co/t/x-pack-6-2-3-issue-after-upgrade/125225)
**Author:** [@MrThecrackerx](https://discuss.elastic.co/u/MrThecrackerx)\ **Replies:** 2\ **Last updated:** [March 22, 2018, 3:59pm UTC](https://discuss.elastic.co/t/x-pack-6-2-3-issue-after-upgrade/125225 "2018-03-22T15:59:36Z")
Hi All i upgraded from elasticsearch 5.6.8 to 6.2.3 and delete all the system indices and removed x-pack and installed it again from scratch. i keep getting this error due to mapping. Please help how to resolve this \[2… --- ## [Changing weekly interval in Visual Builder](https://discuss.elastic.co/t/changing-weekly-interval-in-visual-builder/117509)
**Author:** [@EatYourCake](https://discuss.elastic.co/u/EatYourCake)\ **Replies:** 2\ **Last updated:** [January 31, 2018, 6:07am UTC](https://discuss.elastic.co/t/changing-weekly-interval-in-visual-builder/117509 "2018-01-31T06:07:21Z")
Hi, I am trying to create a graph with the Visual Builder with weekly intervals. The weekly interval that interests us starts on Sunday and not Monday (which is what the graph is currently doing). I've also built a num… --- ## [NEST - UpdateByQuery](https://discuss.elastic.co/t/nest-updatebyquery/105744)
**Author:** [@Illidan](https://discuss.elastic.co/u/Illidan)\ **Replies:** 2\ **Last updated:** [November 17, 2017, 10:23am UTC](https://discuss.elastic.co/t/nest-updatebyquery/105744 "2017-11-17T10:23:45Z")
Is there any "strong typed" way to tell what I want to update during 'UpdateByQuery' operation? I find only 'Script' property which accepts a script text. I prefer to avoid "free texts" as much as possible (free text =… --- ## [What will be the size of index, if the data size is 1 TB?](https://discuss.elastic.co/t/what-will-be-the-size-of-index-if-the-data-size-is-1-tb/87248)
**Author:** [@jafferwilson](https://discuss.elastic.co/u/jafferwilson)\ **Replies:** 2\ **Last updated:** [May 26, 2017, 11:45am UTC](https://discuss.elastic.co/t/what-will-be-the-size-of-index-if-the-data-size-is-1-tb/87248 "2017-05-26T11:45:08Z")
I would like to know whether what will be the size of the index, if I load data of size 1 TB on elasticsearch. Each document is of 4 KB. Kindly suggest the server configuration for this sort of condition. --- ## [Change color](https://discuss.elastic.co/t/change-color/75585)
**Author:** [@Tijot](https://discuss.elastic.co/u/Tijot)\ **Replies:** 2\ **Last updated:** [February 19, 2017, 6:29pm UTC](https://discuss.elastic.co/t/change-color/75585 "2017-02-19T18:29:44Z")
Hello every one, I need some help please. I am using kibana, and I have a dashboard containing 8 little windows. One of the windows contains very important information for our users. I would like to know if someone h… --- ## [Filebeat send events to kafka repeatly](https://discuss.elastic.co/t/filebeat-send-events-to-kafka-repeatly/67615)
**Author:** [@vin](https://discuss.elastic.co/u/vin)\ **Replies:** 2\ **Last updated:** [December 5, 2016, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-send-events-to-kafka-repeatly/67615 "2016-12-05T15:18:05Z")
Filebeat version : 5.0.2 OS : CentOS7 Filebeat Config: filebeat.prospectors: input\_type: log paths: /terminallogs/jhw/step/step.log\* document\_type: 'jhw-terminal-steplog' multiline.pattern: '^\[' multiline.nega… --- ## [Kibana icon's not displaying in IE11](https://discuss.elastic.co/t/kibana-icons-not-displaying-in-ie11/66801)
**Author:** [@nelg](https://discuss.elastic.co/u/nelg)\ **Replies:** 2\ **Last updated:** [November 22, 2016, 10:42pm UTC](https://discuss.elastic.co/t/kibana-icons-not-displaying-in-ie11/66801 "2016-11-22T22:42:16Z")
Accessing Kibana 5.0.1 with x-pack 5.0.1 installed, the SVG based icons do not display. I'm accessing it via IP address, on port 5601, http Any suggestions? I think this is a bug. --- ## [Hot-warm 'move index' does not delete index data from original node](https://discuss.elastic.co/t/hot-warm-move-index-does-not-delete-index-data-from-original-node/63052)
**Author:** [@currycoder](https://discuss.elastic.co/u/currycoder)\ **Replies:** 2\ **Last updated:** [October 14, 2016, 1:27pm UTC](https://discuss.elastic.co/t/hot-warm-move-index-does-not-delete-index-data-from-original-node/63052 "2016-10-14T13:27:59Z")
Hello, I'm experimenting with introducing a 'warm' data node as explained here: https://www.elastic.co/blog/hot-warm-architecture I've allocated my indices to my 'hot' node and have attempted to move a single index t… --- ## [Official cookbook to install kibana 4](https://discuss.elastic.co/t/official-cookbook-to-install-kibana-4/42906)
**Author:** [@Srinivasan\_Ramaswamy](https://discuss.elastic.co/u/Srinivasan_Ramaswamy)\ **Replies:** 2\ **Last updated:** [February 28, 2016, 3:13am UTC](https://discuss.elastic.co/t/official-cookbook-to-install-kibana-4/42906 "2016-02-28T03:13:03Z")
I am looking for a chef cookbook to install kibana. I did find kibana\_lwrp but it installs ngnix and stuff. This brings me to another question. Why do i need ngnix with kibana. Most of the articles i find online talk … --- ## [Integration Elastic : bonnes pratiques](https://discuss.elastic.co/t/integration-elastic-bonnes-pratiques/325742)
**Author:** [@franck67](https://discuss.elastic.co/u/franck67)\ **Replies:** 4\ **Last updated:** [February 19, 2023, 8:59pm UTC](https://discuss.elastic.co/t/integration-elastic-bonnes-pratiques/325742 "2023-02-19T20:59:03Z")
Bonjour, Ayant vu la puissance d'Elastic lors de presentations en ligne, je voudrais installer ceci chez moi. Je vois pleins de documentations, mais malheureusement, je ne trouve pas vraiment de doc en francais, avec u… --- ## [Cannot change timestamp field in an existing data view in kibana](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 4\ **Last updated:** [December 6, 2022, 8:45am UTC](https://discuss.elastic.co/t/cannot-change-timestamp-field-in-an-existing-data-view-in-kibana/320532 "2022-12-06T08:45:45Z")
Hello, I have created a dataview that uses @timetamp field which is generated from logstash. I wanted to change (edit) the default timestamp field to another field (timestamp\_seconds) in the dataview, but it is greyed o… --- ## [Change Elastic Agent GRPC port via Environment Variable?](https://discuss.elastic.co/t/change-elastic-agent-grpc-port-via-environment-variable/311014)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [July 29, 2022, 7:47pm UTC](https://discuss.elastic.co/t/change-elastic-agent-grpc-port-via-environment-variable/311014 "2022-07-29T19:47:56Z")
Hi All, I was wonder if there is a way to change the GRPC port the Elastic Agent uses via an environment variable. Use case: I have a Kubernetes cluster that runs with a complete underlying OS, because of this, I run … --- ## [Error with \_sql query with curl](https://discuss.elastic.co/t/error-with-sql-query-with-curl/295232)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 4\ **Last updated:** [February 3, 2022, 10:05am UTC](https://discuss.elastic.co/t/error-with-sql-query-with-curl/295232 "2022-02-03T10:05:57Z")
Hello ! I am trying to cast a query to my Elasticsearch cluster. When I use where with numeric fields, everything works correctly, but when I try to use it with text fields, problems appear. What would be the correct s… --- ## [How to secure the default elastic username and password in elasticsearch.yml, logstash.yml and kibana.yml files?](https://discuss.elastic.co/t/how-to-secure-the-default-elastic-username-and-password-in-elasticsearch-yml-logstash-yml-and-kibana-yml-files/269133)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [April 5, 2021, 4:24pm UTC](https://discuss.elastic.co/t/how-to-secure-the-default-elastic-username-and-password-in-elasticsearch-yml-logstash-yml-and-kibana-yml-files/269133 "2021-04-05T16:24:29Z")
I want to secure the username and password which are in plaintext in my elasticsearch.yml, logstash.yml and kibana.yml files. How can I do it? My ELK stack version is 7.10.2. --- ## ["Timeout waiting for connection from pool" from http\_poller plugin](https://discuss.elastic.co/t/timeout-waiting-for-connection-from-pool-from-http-poller-plugin/229014)
**Author:** [@fr3eze](https://discuss.elastic.co/u/fr3eze)\ **Replies:** 4\ **Last updated:** [April 24, 2020, 1:50am UTC](https://discuss.elastic.co/t/timeout-waiting-for-connection-from-pool-from-http-poller-plugin/229014 "2020-04-24T01:50:57Z")
I have a single logstash configuration with single http\_poller plugin, and a lot of URL stacked inside: input { http\_poller { urls =\> { A =\> { method =\> get url =\> "https://xxx.xxx" h… --- ## [Esrally压测xpack加密后的es7.2.0](https://discuss.elastic.co/t/esrally-xpack-es7-2-0/197666)
**Author:** [@rljie](https://discuss.elastic.co/u/rljie)\ **Replies:** 4\ **Last updated:** [September 3, 2019, 2:10am UTC](https://discuss.elastic.co/t/esrally-xpack-es7-2-0/197666 "2019-09-03T02:10:36Z")
我的环境是：es7.2.0，esrally1.2.1；es做了xpack加密，执行esrally命令： esrally --advanced-config --target-hosts=12.19.24.92:9200 --pipeline=benchmark-only --client-options="basic\_auth\_user:'elastic',basic\_auth\_password:'123456',use\_ssl:tr… --- ## [Filebeat6.6.1 start up failed](https://discuss.elastic.co/t/filebeat6-6-1-start-up-failed/171236)
**Author:** [@ly217](https://discuss.elastic.co/u/ly217)\ **Replies:** 4\ **Last updated:** [March 7, 2019, 6:55am UTC](https://discuss.elastic.co/t/filebeat6-6-1-start-up-failed/171236 "2019-03-07T06:55:38Z")
the filebeat version is 6.6.1,the os version Red Hat Enterprise Linux Server release 5.7,when start up filebeat ,it failed.the log showed: runtime: epollwait on fd 4 failed with 38 fatal error: runtime: netpoll failed … --- ## [How to use FSCrawler to send elasticsearch Base64 encoded PDF?](https://discuss.elastic.co/t/how-to-use-fscrawler-to-send-elasticsearch-base64-encoded-pdf/124361)
**Author:** [@aeronesto](https://discuss.elastic.co/u/aeronesto)\ **Replies:** 4\ **Last updated:** [April 19, 2018, 1:30am UTC](https://discuss.elastic.co/t/how-to-use-fscrawler-to-send-elasticsearch-base64-encoded-pdf/124361 "2018-04-19T01:30:34Z")
Trying to index a PDF into elasticsearch using FSCrawler, since elasticsearch needs Base64 encoded data. I have the following job created in FSCrawler: { "name" : "my\_job\_name", "fs" : { "url" : "/tmp/es", "… --- ## [Logstash not showing any output to console, hangs on launch (on openstack VM)](https://discuss.elastic.co/t/logstash-not-showing-any-output-to-console-hangs-on-launch-on-openstack-vm/85139)
**Author:** [@Garrett\_Huff](https://discuss.elastic.co/u/Garrett_Huff)\ **Replies:** 4\ **Last updated:** [May 9, 2017, 7:16pm UTC](https://discuss.elastic.co/t/logstash-not-showing-any-output-to-console-hangs-on-launch-on-openstack-vm/85139 "2017-05-09T19:16:38Z")
Hey everyone, I have been following the install process on logstash's getting started guide. It is very strange, on my linux machine it works perfectly fine using either the executable or the debian service. I have spun… --- ## [Attachment indexing breaks shards or hangs during indexing](https://discuss.elastic.co/t/attachment-indexing-breaks-shards-or-hangs-during-indexing/3842)
**Author:** [@Travis\_Groth](https://discuss.elastic.co/u/Travis_Groth)\ **Replies:** 4\ **Last updated:** [February 3, 2011, 2:17am UTC](https://discuss.elastic.co/t/attachment-indexing-breaks-shards-or-hangs-during-indexing/3842 "2011-02-03T02:17:12Z")
Hi all, I'm looking at incorporating ES into our environment to allow us to search some large databases that simply don't do well with standard SQL queries to find things. First, I just want to say I am very impr… --- ## [Cross-Cluster search Implementation Issues](https://discuss.elastic.co/t/cross-cluster-search-implementation-issues/270651)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [April 23, 2021, 6:37am UTC](https://discuss.elastic.co/t/cross-cluster-search-implementation-issues/270651 "2021-04-23T06:37:15Z")
Hello Team We have implemented Cross-Cluster Search in Elasticsearch version 7.8.0 clusters. For example Cluster-A and Cluster-B. Cluster-A elasticsearch.yml file has below parameters : cluster.remote.Cluster-B.seeds… --- ## [Saved search columns reset when filtering?](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902)
**Author:** [@tallavi](https://discuss.elastic.co/u/tallavi)\ **Replies:** 7\ **Last updated:** [January 3, 2021, 8:05pm UTC](https://discuss.elastic.co/t/saved-search-columns-reset-when-filtering/259902 "2021-01-03T20:05:04Z")
Hi, We're on version 7.8.1 of the stack. I noticed an annoyance. I have a dashboard with a saved search at the bottom. I add/remove columns, change the order, etc, and when I filter by a value, the columns reset! It wa… --- ## [How to parse message with random data using logstash filter?](https://discuss.elastic.co/t/how-to-parse-message-with-random-data-using-logstash-filter/216453)
**Author:** [@Amit\_Agarwal1](https://discuss.elastic.co/u/Amit_Agarwal1)\ **Replies:** 7\ **Last updated:** [January 30, 2020, 5:59am UTC](https://discuss.elastic.co/t/how-to-parse-message-with-random-data-using-logstash-filter/216453 "2020-01-30T05:59:22Z")
I have received the below message from the producer at Axon Topic with some random ASCII data. "message" =\> "\\u0000\\u0000\\u0000\\u0002�\\u0004C1�\\u0001\\u0002�\\u0003\\u0000\\u0000\\u0000\\u0000A�\\u0003{"prdctId":"10077","id":"… --- ## [Unexpected response code \[503\] from calling PUT http://172.16.6.63:9200/\_xpack/security/user/apm\_system/\_password?pretty Cause: Cluster state has not been recovered yet, cannot write to the security index](https://discuss.elastic.co/t/unexpected-response-code-503-from-calling-put-http-172-16-6-63-9200-xpack-security-user-apm-system-password-pretty-cause-cluster-state-has-not-been-recovered-yet-cannot-write-to-the-security-index/205226)
**Author:** [@kiran\_kumar1](https://discuss.elastic.co/u/kiran_kumar1)\ **Replies:** 1\ **Last updated:** [November 17, 2019, 7:32pm UTC](https://discuss.elastic.co/t/unexpected-response-code-503-from-calling-put-http-172-16-6-63-9200-xpack-security-user-apm-system-password-pretty-cause-cluster-state-has-not-been-recovered-yet-cannot-write-to-the-security-index/205226 "2019-11-17T19:32:21Z")
Hi team, could you help on this issue, when am trying get cluster password. getting issue like below. exec -it es-coordinating-0 bash -n 2304670352 Defaulting container name to es-coordinating. Use 'kubectl describe … --- ## [Ruby get element of an array](https://discuss.elastic.co/t/ruby-get-element-of-an-array/152004)
**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\ **Replies:** 1\ **Last updated:** [October 11, 2018, 10:12am UTC](https://discuss.elastic.co/t/ruby-get-element-of-an-array/152004 "2018-10-11T10:12:13Z")
Hello, I want to get the element of an array called 'Choix menu SVI' at the position "i" and check if it is equal to '9'. I tried this bit it does not work. How can I do that ? if(event.get('Choix menu SVI'\[i\]))=='9' … --- ## [How to parse csv using logstash](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 7\ **Last updated:** [January 10, 2018, 11:33am UTC](https://discuss.elastic.co/t/how-to-parse-csv-using-logstash/114823 "2018-01-10T11:33:01Z")
I have CSV files where columns are in following sequence--\> File1: A,B,C,D File2: A,C,D,B I have to parse only A and B columns. how to map this and push to ES. --- ## [Unable to Modify Roles for 'kibana' User](https://discuss.elastic.co/t/unable-to-modify-roles-for-kibana-user/79309)
**Author:** [@jt1234](https://discuss.elastic.co/u/jt1234)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 8:31pm UTC](https://discuss.elastic.co/t/unable-to-modify-roles-for-kibana-user/79309 "2017-03-21T20:31:30Z")
Hello, I'm setting up a test cluster for evaluation. I am installing using RPM / yum, using the instructions in the documentation, keeping most settings default, and using the latest versions of the software (ElasticS… --- ## [Couldn't start the Wmibeat as Windows Service](https://discuss.elastic.co/t/couldnt-start-the-wmibeat-as-windows-service/78829)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [March 17, 2017, 9:45am UTC](https://discuss.elastic.co/t/couldnt-start-the-wmibeat-as-windows-service/78829 "2017-03-17T09:45:36Z")
Hi - I've added the wmibeats as a service on a windows-7 server, when I tried to start the service, its throwing the below error: Could you please let me know, how do I fix this issue ? I had put my configuration bel… --- ## [Поиск по массиву объектов](https://discuss.elastic.co/t/topic/71074)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 1\ **Last updated:** [January 10, 2017, 12:55pm UTC](https://discuss.elastic.co/t/topic/71074 "2017-01-10T12:55:46Z")
Всем привет! У нас есть лог в котором встречается массив объектов, естественно мы используем nested type и всё прекрасно работает. Но возникла необходимость создать такой запрос: найти все записи лога, в каждой из кото… --- ## [Mappings, templates and default in a single file. How to update this information?](https://discuss.elastic.co/t/mappings-templates-and-default-in-a-single-file-how-to-update-this-information/26333)
**Author:** [@living\_jordi](https://discuss.elastic.co/u/living_jordi)\ **Replies:** 1\ **Last updated:** [July 27, 2015, 4:30pm UTC](https://discuss.elastic.co/t/mappings-templates-and-default-in-a-single-file-how-to-update-this-information/26333 "2015-07-27T16:30:43Z")
I've created a single file containg all type mappings, templates and default configurations. I'm trying to PUT it using curl command, however It dumps me a error: {"error":"ActionRequestValidationException\[Validation … --- ## [Spark read from elasticsearch and primary shards](https://discuss.elastic.co/t/spark-read-from-elasticsearch-and-primary-shards/45224)
**Author:** [@vincent\_gromakowski](https://discuss.elastic.co/u/vincent_gromakowski)\ **Replies:** 1\ **Last updated:** [April 5, 2016, 2:31pm UTC](https://discuss.elastic.co/t/spark-read-from-elasticsearch-and-primary-shards/45224 "2016-04-05T14:31:17Z")
I would like to know how the shards are balanced when reading from Spark. I have checked the documentation where I can see Spark can read from both primary shards or replica but it's unclear how the mapping is done and i… --- ## [Elasticsearch client node in Docker unable to join non Docker cluster](https://discuss.elastic.co/t/elasticsearch-client-node-in-docker-unable-to-join-non-docker-cluster/40989)
**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\ **Replies:** 1\ **Last updated:** [February 5, 2016, 11:58am UTC](https://discuss.elastic.co/t/elasticsearch-client-node-in-docker-unable-to-join-non-docker-cluster/40989 "2016-02-05T11:58:53Z")
Hello All, We have an 1.7.5 Elasticsearch cluster of 6 nodes. I am trying to join a client only node that is on Docker and have been unable to apart from one time. The Docker host is on the same network with the El… --- ## [Exporting data from Kibana 4.1.1 to CSV](https://discuss.elastic.co/t/exporting-data-from-kibana-4-1-1-to-csv/31911)
**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\ **Replies:** 1\ **Last updated:** [October 10, 2015, 2:23am UTC](https://discuss.elastic.co/t/exporting-data-from-kibana-4-1-1-to-csv/31911 "2015-10-10T02:23:32Z")
Guys, I recently upgraded my Kibana from 4.0.3 to 4.1.1. I always thought exporting content to a CSV is possible in it. But I'm not able to. I can export the count, but not the entire content of what I get to see in "Dis… --- ## [Logstash-forwarder + SSL + HAProxy](https://discuss.elastic.co/t/logstash-forwarder-ssl-haproxy/27008)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 1\ **Last updated:** [August 7, 2015, 10:48am UTC](https://discuss.elastic.co/t/logstash-forwarder-ssl-haproxy/27008 "2015-08-07T10:48:15Z")
Hello, I am trying to setup an ELK stack but I have a question about Logstash-forwarder and SSL. My setup looks like this: Logstash-forwarder -\> HAProxy (VM) -\> (2 VM's) Logstash/Redis -\> (2 VM's) Logstash Indexer -\> … --- ## [Apply dynamic template to all fields of an object](https://discuss.elastic.co/t/apply-dynamic-template-to-all-fields-of-an-object/7968)
**Author:** [@mkleen](https://discuss.elastic.co/u/mkleen)\ **Replies:** 7\ **Last updated:** [June 21, 2012, 9:51am UTC](https://discuss.elastic.co/t/apply-dynamic-template-to-all-fields-of-an-object/7968 "2012-06-21T09:51:26Z")
Hello, I am trying to apply a dynamic template mapping to all fields of an object including the aggregated objects, but it gets only applied to the fields of the root object: curl -XPUT http://localhost:9200… --- ## [How can I make an SLM policy, that excludes specific indices by pattern?](https://discuss.elastic.co/t/how-can-i-make-an-slm-policy-that-excludes-specific-indices-by-pattern/223799)
**Author:** [@Guerteltier](https://discuss.elastic.co/u/Guerteltier)\ **Replies:** 0\ **Last updated:** [March 16, 2020, 5:08pm UTC](https://discuss.elastic.co/t/how-can-i-make-an-slm-policy-that-excludes-specific-indices-by-pattern/223799 "2020-03-16T17:08:01Z")
\-\*beat\* doesn't work. --- ## [Nested Aggregation (Group by cluase)](https://discuss.elastic.co/t/nested-aggregation-group-by-cluase/18191)
**Author:** [@ayushsangani](https://discuss.elastic.co/u/ayushsangani)\ **Replies:** 0\ **Last updated:** [June 18, 2014, 5:39pm UTC](https://discuss.elastic.co/t/nested-aggregation-group-by-cluase/18191 "2014-06-18T17:39:39Z")
Hi All, I am pretty new to elasticsearch, my project requires me to write a group-by clause query. I am trying to write a nested dsl using aggregation which will be like a group by clause. Structure of Input D… --- ## [Filebeat is always read file from beginning](https://discuss.elastic.co/t/filebeat-is-always-read-file-from-beginning/213563)
**Author:** [@rguptarg](https://discuss.elastic.co/u/rguptarg)\ **Replies:** 1\ **Last updated:** [January 4, 2020, 12:11pm UTC](https://discuss.elastic.co/t/filebeat-is-always-read-file-from-beginning/213563 "2020-01-04T12:11:51Z")
HI Team, I am using filebeat-7.3.2-1.x86\_64 for application log reading. but all the time filebeat read log from starting, hence duplicate data is present in elastic please suggest what configuration required? --- ## [EC2 Instances for Elasticsearch Master, Data and Coordinating Nodes](https://discuss.elastic.co/t/ec2-instances-for-elasticsearch-master-data-and-coordinating-nodes/171806)
**Author:** [@Habbiot](https://discuss.elastic.co/u/Habbiot)\ **Replies:** 1\ **Last updated:** [March 11, 2019, 7:30pm UTC](https://discuss.elastic.co/t/ec2-instances-for-elasticsearch-master-data-and-coordinating-nodes/171806 "2019-03-11T19:30:28Z")
for Master nodes, which kind of EC2 instances would be nice to have? I have a similar situation like mentioned in the below link: Referance \[https://discuss.elastic.co/t/choosing-the-correct-aws-ec2-servers/105902\] Als… --- ## [Field Exist in Index Pattern but didnt show in Discover](https://discuss.elastic.co/t/field-exist-in-index-pattern-but-didnt-show-in-discover/160293)
**Author:** [@Rahmat\_Agung\_W](https://discuss.elastic.co/u/Rahmat_Agung_W)\ **Replies:** 1\ **Last updated:** [December 12, 2018, 9:27pm UTC](https://discuss.elastic.co/t/field-exist-in-index-pattern-but-didnt-show-in-discover/160293 "2018-12-12T21:27:56Z")
I have a problem with my ELK. So, I i have 3 different logs send via Filebeat to my logstash. 2 logs sent successfully and show up in Kibana. But 1logs which is virustotal log, the fields only appear in index: But, in… --- ## [Elasticsearch certification](https://discuss.elastic.co/t/elasticsearch-certification/93330)
**Author:** [@SKumarMN](https://discuss.elastic.co/u/SKumarMN)\ **Replies:** 1\ **Last updated:** [July 17, 2017, 4:19am UTC](https://discuss.elastic.co/t/elasticsearch-certification/93330 "2017-07-17T04:19:45Z")
Is Elastic planning to have official certification exams on Elasticsearch just like other major vendors like Spark, cloudera hadoop etc --- ## [Unable to update users and roles (primary shard is not active Timeout)](https://discuss.elastic.co/t/unable-to-update-users-and-roles-primary-shard-is-not-active-timeout/59108)
**Author:** [@rocky4bmw](https://discuss.elastic.co/u/rocky4bmw)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 12:58am UTC](https://discuss.elastic.co/t/unable-to-update-users-and-roles-primary-shard-is-not-active-timeout/59108 "2016-09-01T00:58:04Z")
Hi Team, I am using elasticsearch with searchguard 2.3.4 and testing for 1 node only. Whenever I tried to create and update new user and roles it says clustertimed out. Please find below elasticsearch logs and help me… --- ## [Ok to add safe-to-evict annotation to Elasticsearch/Kibana pods for k8s cluster autoscaling?](https://discuss.elastic.co/t/ok-to-add-safe-to-evict-annotation-to-elasticsearch-kibana-pods-for-k8s-cluster-autoscaling/302264)
**Author:** [@jketcham](https://discuss.elastic.co/u/jketcham)\ **Replies:** 2\ **Last updated:** [April 19, 2022, 7:51pm UTC](https://discuss.elastic.co/t/ok-to-add-safe-to-evict-annotation-to-elasticsearch-kibana-pods-for-k8s-cluster-autoscaling/302264 "2022-04-19T19:51:12Z")
I'm running ECK in Google Kubernetes Engine, and I've run into instances where the Cluster Autoscaler will choose not to remove an ES/KB Pod because it has local storage. One option is to add the "cluster-autoscaler.kub… --- ## [Cluster crashed: "Server gave HTTP response to HTTPS client"](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762)
**Author:** [@realscout](https://discuss.elastic.co/u/realscout)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 10:48pm UTC](https://discuss.elastic.co/t/cluster-crashed-server-gave-http-response-to-https-client/255762 "2020-11-17T22:48:13Z")
Today, our ElasticSearch cluster stopped responding. We were not performing any sort of maintenance or making any changes. Any request to the cluster caused it to respond with: "Get "https://X.X.X.X:X/": http: server g… --- ## [Stuck at "Successfully started Lgstash API endpoint {:port=\>9600}" and nothing happend when import csv](https://discuss.elastic.co/t/stuck-at-successfully-started-lgstash-api-endpoint-port-9600-and-nothing-happend-when-import-csv/179462)
**Author:** [@Sean\_Donghyun\_Park](https://discuss.elastic.co/u/Sean_Donghyun_Park)\ **Replies:** 2\ **Last updated:** [May 22, 2019, 10:35am UTC](https://discuss.elastic.co/t/stuck-at-successfully-started-lgstash-api-endpoint-port-9600-and-nothing-happend-when-import-csv/179462 "2019-05-22T10:35:41Z")
Hi. I got problem when I import csv file to logstash and output to elasticsearch. id,title,defaultLanguage,caption,start,duration 1,Triple Frontier Trailer #2 (2019) | Movieclips Trailers,en,I have never had a feeling a… --- ## [Logstash keystore elasticsearch password](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 2\ **Last updated:** [June 11, 2019, 11:33pm UTC](https://discuss.elastic.co/t/logstash-keystore-elasticsearch-password/185085 "2019-06-11T23:33:00Z")
How can I use the keystore for password instead of specifying it in the logstash.yml? xpack.monitoring.elasticsearch.password: I tried adding the ES\_PWD and listing it from the keystore /usr/share/logstash/bin/logstas… --- ## [Installed x-pack on kibana now I've been asked to login](https://discuss.elastic.co/t/installed-x-pack-on-kibana-now-ive-been-asked-to-login/105618)
**Author:** [@Schizo](https://discuss.elastic.co/u/Schizo)\ **Replies:** 2\ **Last updated:** [October 28, 2017, 1:14am UTC](https://discuss.elastic.co/t/installed-x-pack-on-kibana-now-ive-been-asked-to-login/105618 "2017-10-28T01:14:13Z")
I was trying out Kibana for couple of days and wanted to look into x-pack, so followed the instructions here: https://www.elastic.co/guide/en/kibana/current/installing-xpack-kb.html restarted elasticsearch and kibana a… --- ## [Logstash faield. "Page file size 0 different to configured page"](https://discuss.elastic.co/t/logstash-faield-page-file-size-0-different-to-configured-page/102335)
**Author:** [@vl.zemtsov](https://discuss.elastic.co/u/vl.zemtsov)\ **Replies:** 2\ **Last updated:** [October 2, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-faield-page-file-size-0-different-to-configured-page/102335 "2017-10-02T05:15:07Z")
Hello. Logstash version - 5.5.1 Logstash cant start. In log: \` Logstash failed to create queue {"exception"=\>"Page file size 0 different to configured page capacity 262144000 for /usr/share/logstash/data/queue/main/… [Previous page](https://discuss.elastic.co/top.md?page=1380&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1382&per_page=50&period=all)