# Top

**URL:** https://discuss.elastic.co/top.md?page=1401&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1402

---

## [Option for exact aggregation instead of approximation?](https://discuss.elastic.co/t/option-for-exact-aggregation-instead-of-approximation/44996)

<div class="topic-metadata">

**Author:** [@ChrisR](https://discuss.elastic.co/u/ChrisR)\
**Replies:** 1\
**Last updated:** [March 22, 2016, 1:10am UTC](https://discuss.elastic.co/t/option-for-exact-aggregation-instead-of-approximation/44996 "2016-03-22T01:10:43Z")

</div>

Kibana ought to have an option to display exact aggregations instead of approximations when returning a subset. In other words, when charting the top 50 results, kibana should be able to request aggregations with a size…

---

## [No incoming data to Logstash Output from Elastic Agents - Only Elasticsearch ouptut works](https://discuss.elastic.co/t/no-incoming-data-to-logstash-output-from-elastic-agents-only-elasticsearch-ouptut-works/331350)

<div class="topic-metadata">

**Author:** [@mehdi-lamrani](https://discuss.elastic.co/u/mehdi-lamrani)\
**Replies:** 5\
**Last updated:** [April 30, 2023, 9:36pm UTC](https://discuss.elastic.co/t/no-incoming-data-to-logstash-output-from-elastic-agents-only-elasticsearch-ouptut-works/331350 "2023-04-30T21:36:01Z")

</div>

8.7 stack here After I setup a logstash output in Fleet, and set a policy to use that logstash ouptut for integrations, no data comes to it basically. When I switch the output for integrations to Elasticsearch instead …

---

## [Java apm agent doesn't capture text or json body](https://discuss.elastic.co/t/java-apm-agent-doesnt-capture-text-or-json-body/324064)

<div class="topic-metadata">

**Author:** [@mrodal](https://discuss.elastic.co/u/mrodal)\
**Replies:** 5\
**Last updated:** [January 30, 2023, 12:20pm UTC](https://discuss.elastic.co/t/java-apm-agent-doesnt-capture-text-or-json-body/324064 "2023-01-30T12:20:15Z")

</div>

Kibana version: 8.6 Elasticsearch version:8.6 APM Server version: 8.6 APM Agent language and version: Java 1.35.0 Browser version: Chrome Original install method (e.g. download page, yum, deb, from source, etc.) and…

---

## [Translate private ip to geo location using external dictionary](https://discuss.elastic.co/t/translate-private-ip-to-geo-location-using-external-dictionary/230710)

<div class="topic-metadata">

**Author:** [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Replies:** 5\
**Last updated:** [May 2, 2020, 10:20pm UTC](https://discuss.elastic.co/t/translate-private-ip-to-geo-location-using-external-dictionary/230710 "2020-05-02T22:20:54Z")

</div>

Hi all, I'm trying to follow example in this link https://discuss.elastic.co/t/private-ip-geoip-from-dictionary/156763, however I can't seem to make it work. Basically I want to translate private ip address using exter…

---

## [Fuzziness support in intervals query?](https://discuss.elastic.co/t/fuzziness-support-in-intervals-query/208935)

<div class="topic-metadata">

**Author:** [@val](https://discuss.elastic.co/u/val)\
**Replies:** 5\
**Last updated:** [November 26, 2019, 2:08pm UTC](https://discuss.elastic.co/t/fuzziness-support-in-intervals-query/208935 "2019-11-26T14:08:48Z")

</div>

ES 7.0 introduced support for the Lucene intervals query which is more powerful and easier to deal with than span queries (analyzer support, etc). However, one thing that span queries support and intervals doesn't is fuz…

---

## [Strange "non-restart"](https://discuss.elastic.co/t/strange-non-restart/142909)

<div class="topic-metadata">

**Author:** [@LesioS](https://discuss.elastic.co/u/LesioS)\
**Replies:** 5\
**Last updated:** [August 3, 2018, 2:32pm UTC](https://discuss.elastic.co/t/strange-non-restart/142909 "2018-08-03T14:32:40Z")

</div>

On Win10 after restart Kibana (no ES restart) I've received following error: D:\\Program Files\\Elastic\\Kibana\\6.2.4\\bin\>kibana.bat module.js:478 throw err; ^ Error: Cannot find module 'babel-runtime/core-js/json/…

---

## [Can I update a graph?](https://discuss.elastic.co/t/can-i-update-a-graph/101991)

<div class="topic-metadata">

**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\
**Replies:** 5\
**Last updated:** [September 29, 2017, 7:09am UTC](https://discuss.elastic.co/t/can-i-update-a-graph/101991 "2017-09-29T07:09:25Z")

</div>

I am trying to use the Graph feature and it does not work in the way I expect. I have IIS logs indexed, and I used the logstash useragent plugin to parse the UA strings. I start with a new graph (in a 5.6.1 stack), and a…

---

## [Restarting Logstash with ES input](https://discuss.elastic.co/t/restarting-logstash-with-es-input/44724)

<div class="topic-metadata">

**Author:** [@JoaquinS](https://discuss.elastic.co/u/JoaquinS)\
**Replies:** 5\
**Last updated:** [February 15, 2017, 5:45pm UTC](https://discuss.elastic.co/t/restarting-logstash-with-es-input/44724 "2017-02-15T17:45:17Z")

</div>

Hi, I have a question about what happens when you restart Logstash with ES input. It will read from the beginning of the index or it will continue from where it was?. Regards

---

## [Newbie question: which index setting will be used in different nodes?](https://discuss.elastic.co/t/newbie-question-which-index-setting-will-be-used-in-different-nodes/55178)

<div class="topic-metadata">

**Author:** [@goofansu](https://discuss.elastic.co/u/goofansu)\
**Replies:** 5\
**Last updated:** [July 12, 2016, 8:23pm UTC](https://discuss.elastic.co/t/newbie-question-which-index-setting-will-be-used-in-different-nodes/55178 "2016-07-12T20:23:27Z")

</div>

For example, there are node1 and node2 in cluster. node1: index.number\_of\_shards: 5 index.number\_of\_replicas: 1 node2: index.number\_of\_shards: 3 index.number\_of\_replicas: 2 Which setting will be used when creat…

---

## [Designing an index that holds updating product data feeds](https://discuss.elastic.co/t/designing-an-index-that-holds-updating-product-data-feeds/20547)

<div class="topic-metadata">

**Author:** [@Ori\_P](https://discuss.elastic.co/u/Ori_P)\
**Replies:** 5\
**Last updated:** [November 3, 2014, 11:43pm UTC](https://discuss.elastic.co/t/designing-an-index-that-holds-updating-product-data-feeds/20547 "2014-11-03T23:43:21Z")

</div>

I would appreciate your suggestions in helping me design my elasticsearch index. I'm intending to index product feeds from about 20 on-line stores, each store not having more than 20,000 products. each product has…

---

## [Sharding and partitioning on the ES Index](https://discuss.elastic.co/t/sharding-and-partitioning-on-the-es-index/361122)

<div class="topic-metadata">

**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\
**Replies:** 2\
**Last updated:** [June 29, 2024, 2:53am UTC](https://discuss.elastic.co/t/sharding-and-partitioning-on-the-es-index/361122 "2024-06-29T02:53:27Z")

</div>

Currently we have our data in MongoDB and we will continue to keep it there for ACID compliance. However we are moving our search capabilities to Elastic. Since our app supports multi-tenancy our MongoDB architecture is …

---

## [Elasticsearch 7.8.1 maximum shards open error](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234)

<div class="topic-metadata">

**Author:** [@ManOfDestiny](https://discuss.elastic.co/u/ManOfDestiny)\
**Replies:** 2\
**Last updated:** [September 15, 2021, 5:17am UTC](https://discuss.elastic.co/t/elasticsearch-7-8-1-maximum-shards-open-error/284234 "2021-09-15T05:17:01Z")

</div>

How can I solve this problem? Env 1. elsticsearch version : 7.8.1 2. cluster 1) master node 3EA 2) data Node : 7EA ConfigFile : elasticsearch.yml cluster.max\_shards\_per\_node: 10000 Cluster setting GET /\_clust…

---

## [How to use scroll zoom in existing Coordinate Map](https://discuss.elastic.co/t/how-to-use-scroll-zoom-in-existing-coordinate-map/221702)

<div class="topic-metadata">

**Author:** [@Anikesh\_Paul](https://discuss.elastic.co/u/Anikesh_Paul)\
**Replies:** 2\
**Last updated:** [March 3, 2020, 7:24am UTC](https://discuss.elastic.co/t/how-to-use-scroll-zoom-in-existing-coordinate-map/221702 "2020-03-03T07:24:38Z")

</div>

Hi, I was trying to implement mouse scroll zoom in/out in coordinate map graph under visualization. But I'm getting only tool tip with +/- for zooming. Is there any possible way to achieve mouse scroll zoom in/out in co…

---

## [Logstash unable to parse xml file](https://discuss.elastic.co/t/logstash-unable-to-parse-xml-file/153372)

<div class="topic-metadata">

**Author:** [@safaa](https://discuss.elastic.co/u/safaa)\
**Replies:** 2\
**Last updated:** [October 22, 2018, 3:45pm UTC](https://discuss.elastic.co/t/logstash-unable-to-parse-xml-file/153372 "2018-10-22T15:45:55Z")

</div>

I have a simple xml file , and i am trying to parse it with losgstash, but the logstash could not undersand split field: my xml file is: \<xmldata\> \<head1\> \<key1\>Value1\</key1\> \<key2\>Value2\</key2\> …

---

## [Single node ElasticSearch always status yellow](https://discuss.elastic.co/t/single-node-elasticsearch-always-status-yellow/84494)

<div class="topic-metadata">

**Author:** [@JohanLanderholm](https://discuss.elastic.co/u/JohanLanderholm)\
**Replies:** 2\
**Last updated:** [May 11, 2017, 5:46am UTC](https://discuss.elastic.co/t/single-node-elasticsearch-always-status-yellow/84494 "2017-05-11T05:46:56Z")

</div>

Hi, My single node elastic search (5.3.2) system is always yellow because the number\_of\_replicas is default 1. I have tried to find out how to change this but failed so far. 1. I tried using elastic search.yml setting,…

---

## [Adding specific filters to Kibana charts and accessing docs](https://discuss.elastic.co/t/adding-specific-filters-to-kibana-charts-and-accessing-docs/71393)

<div class="topic-metadata">

**Author:** [@haytham.salhi](https://discuss.elastic.co/u/haytham.salhi)\
**Replies:** 2\
**Last updated:** [January 22, 2017, 8:16pm UTC](https://discuss.elastic.co/t/adding-specific-filters-to-kibana-charts-and-accessing-docs/71393 "2017-01-22T20:16:01Z")

</div>

Hello everyone, My questions are twofold as the following: First, is it doable to add custom filters on a Kibana chart for a dashboard? Like with the filter choice on an x-axis but in a different way. As an example,…

---

## [Logstash ruby code to irritate through a key value map](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828)

<div class="topic-metadata">

**Author:** [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\
**Replies:** 2\
**Last updated:** [September 5, 2016, 8:04pm UTC](https://discuss.elastic.co/t/logstash-ruby-code-to-irritate-through-a-key-value-map/59828 "2016-09-05T20:04:27Z")

</div>

I have this log: cs1Label=userAuthenticationMechanism cs1=oauth-access-token cs2Label=vcapRequestId cs2=12398012300-c876-4427-56dd-49a7c0e9c254::1dd79781-ee8a-41e6-a630-c9a20f2615e9 cs3Label=result cs3=success cs4Label=…

---

## [Architecture haute dispo et message queue](https://discuss.elastic.co/t/architecture-haute-dispo-et-message-queue/801)

<div class="topic-metadata">

**Author:** [@compo](https://discuss.elastic.co/u/compo)\
**Replies:** 2\
**Last updated:** [May 18, 2015, 8:57pm UTC](https://discuss.elastic.co/t/architecture-haute-dispo-et-message-queue/801 "2015-05-18T20:57:15Z")

</div>

Bonjour, j'ai des workers qui agrègent des flux d'informations en sortie j'ai un format json par enreg. L'objectif est d'alimenter un cluster ES. Actuellement le pipeline est direct mais j'ai 2 problèmes : - je n'ai …

---

## [APM elastic.apm.ignore\_exceptions does not work](https://discuss.elastic.co/t/apm-elastic-apm-ignore-exceptions-does-not-work/323549)

<div class="topic-metadata">

**Author:** [@Mikele](https://discuss.elastic.co/u/Mikele)\
**Replies:** 3\
**Last updated:** [January 23, 2023, 7:14am UTC](https://discuss.elastic.co/t/apm-elastic-apm-ignore-exceptions-does-not-work/323549 "2023-01-23T07:14:39Z")

</div>

APM Agent language and version: 1.35 Description of the problem including expected versus actual behavior. Please include screenshots (if relevant): I want to use elastic.apm.ignore\_exceptions setting to ignore tempor…

---

## [Closing all indices before system recovery](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163)

<div class="topic-metadata">

**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\
**Replies:** 3\
**Last updated:** [October 27, 2021, 9:42am UTC](https://discuss.elastic.co/t/closing-all-indices-before-system-recovery/287163 "2021-10-27T09:42:03Z")

</div>

Hi All, I'd like to ask if there is a possibility to recover whole cluster without closing indices ? In Kibana 7.11.2-\> stack management -\> snapshot and restore -\>when trying restore "All data streams and indices, incl…

---

## [Dynamic query in jdbc plugin](https://discuss.elastic.co/t/dynamic-query-in-jdbc-plugin/264806)

<div class="topic-metadata">

**Author:** [@niki1](https://discuss.elastic.co/u/niki1)\
**Replies:** 3\
**Last updated:** [February 22, 2021, 6:57pm UTC](https://discuss.elastic.co/t/dynamic-query-in-jdbc-plugin/264806 "2021-02-22T18:57:29Z")

</div>

I got a mysql(or any other relational database) with a table like this: id,name,prod 11,alex,car 22,alice,ship 33,bob,airplane and I have messages going through logstash pipeline like this: 11,20210215,ford,.... 2…

---

## [Roll up index does not populate Time field](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681)

<div class="topic-metadata">

**Author:** [@zaratustra689](https://discuss.elastic.co/u/zaratustra689)\
**Replies:** 3\
**Last updated:** [October 1, 2020, 12:57pm UTC](https://discuss.elastic.co/t/roll-up-index-does-not-populate-time-field/249681 "2020-10-01T12:57:12Z")

</div>

Hi! I'm new to Roll Up index feature and I'm trying to configure some basic index so that I can start doing queries and visualizations. I'm using ElasticSearch Stack in version 6.6.2 with the sample web logs that comes…

---

## [Elasticsearch index not getting created when add\_field is used](https://discuss.elastic.co/t/elasticsearch-index-not-getting-created-when-add-field-is-used/243825)

<div class="topic-metadata">

**Author:** [@pranayv66](https://discuss.elastic.co/u/pranayv66)\
**Replies:** 8\
**Last updated:** [August 7, 2020, 4:49am UTC](https://discuss.elastic.co/t/elasticsearch-index-not-getting-created-when-add-field-is-used/243825 "2020-08-07T04:49:53Z")

</div>

Hi, I'm facing a problem when creating an elasticsearch index. I'm new to this, so please let me know what I could do to fix this. I'm pasting the two config files which I've used for reference. The one at the top is w…

---

## [Kibana User/Client specific Dashboard](https://discuss.elastic.co/t/kibana-user-client-specific-dashboard/205357)

<div class="topic-metadata">

**Author:** [@wizard](https://discuss.elastic.co/u/wizard)\
**Replies:** 3\
**Last updated:** [October 28, 2019, 8:15am UTC](https://discuss.elastic.co/t/kibana-user-client-specific-dashboard/205357 "2019-10-28T08:15:51Z")

</div>

How can I create an user specific dashboard, I have created 2 different dashboard and users: Dashboard:- "Dashboard no.1" & Dashboard no.2 User:- "User A" & "User B" "user A" can see dashboard no.1 but not no.2 and "…

---

## [Metric beat is not pushing data to elastic search - I am using metric beat to monitor host and dockers](https://discuss.elastic.co/t/metric-beat-is-not-pushing-data-to-elastic-search-i-am-using-metric-beat-to-monitor-host-and-dockers/203468)

<div class="topic-metadata">

**Author:** [@ashish\_kumar1490](https://discuss.elastic.co/u/ashish_kumar1490)\
**Replies:** 8\
**Last updated:** [October 15, 2019, 3:54am UTC](https://discuss.elastic.co/t/metric-beat-is-not-pushing-data-to-elastic-search-i-am-using-metric-beat-to-monitor-host-and-dockers/203468 "2019-10-15T03:54:12Z")

</div>

This is for Host metricbeat.modules: …

---

## [Index corruption with .tim file checksum mismatch](https://discuss.elastic.co/t/index-corruption-with-tim-file-checksum-mismatch/171253)

<div class="topic-metadata">

**Author:** [@Rushikesh\_Pathak](https://discuss.elastic.co/u/Rushikesh_Pathak)\
**Replies:** 3\
**Last updated:** [March 7, 2019, 2:36pm UTC](https://discuss.elastic.co/t/index-corruption-with-tim-file-checksum-mismatch/171253 "2019-03-07T14:36:36Z")

</div>

Have elastic search setup with cluster size of 20+ nodes. Last week encountered an issue related to index corruption with following traceback in logs. org.apache.lucene.index.CorruptIndexException: checksum failed (hard…

---

## [Murmur3 values differ between ES 1.7 and 6.4](https://discuss.elastic.co/t/murmur3-values-differ-between-es-1-7-and-6-4/154223)

<div class="topic-metadata">

**Author:** [@dan-blanchard](https://discuss.elastic.co/u/dan-blanchard)\
**Replies:** 8\
**Last updated:** [October 26, 2018, 3:40pm UTC](https://discuss.elastic.co/t/murmur3-values-differ-between-es-1-7-and-6-4/154223 "2018-10-26T15:40:01Z")

</div>

We're in the process of finally migrating from ES 1.7, and I noticed a strange inconsistency between the hashed values of Murmur3 fields between the two versions. Specifically, the hashes do not match in the last byte. T…

---

## [Filebeat handles rotated files issue](https://discuss.elastic.co/t/filebeat-handles-rotated-files-issue/152298)

<div class="topic-metadata">

**Author:** [@IngZero2](https://discuss.elastic.co/u/IngZero2)\
**Replies:** 3\
**Last updated:** [October 18, 2018, 8:56pm UTC](https://discuss.elastic.co/t/filebeat-handles-rotated-files-issue/152298 "2018-10-18T20:56:21Z")

</div>

Hi all, i've installed Filebeat on a AKS cluster with 5 nodes. I've a stranger behaviour with rotated containers log files. Docker rotation rule is { "live-restore": true, "log-driver": "json-file", "log-opts": { "ma…

---

## [Upgrading index with custom similarity not working](https://discuss.elastic.co/t/upgrading-index-with-custom-similarity-not-working/76678)

<div class="topic-metadata">

**Author:** [@xabbu42](https://discuss.elastic.co/u/xabbu42)\
**Replies:** 3\
**Last updated:** [March 9, 2017, 2:41pm UTC](https://discuss.elastic.co/t/upgrading-index-with-custom-similarity-not-working/76678 "2017-03-09T14:41:45Z")

</div>

Hello I use a custom similarity and since the switch to elasticsearch 5 I can't upgrade existing indices using this custom similarity. The Plugin code registers the custom similarity as follows: public void onIndex…

---

## [Elastic search plugin to inject query filter](https://discuss.elastic.co/t/elastic-search-plugin-to-inject-query-filter/53163)

<div class="topic-metadata">

**Author:** [@sbanand](https://discuss.elastic.co/u/sbanand)\
**Replies:** 3\
**Last updated:** [June 20, 2016, 1:52pm UTC](https://discuss.elastic.co/t/elastic-search-plugin-to-inject-query-filter/53163 "2016-06-20T13:52:46Z")

</div>

Hello, I am developing an application that connects to Elasticsearch using Java TransportClient API. I want to deploy an elastic search plugin that will inject a query filter into all search requests. The plug-in itsel…

---

## [Database request](https://discuss.elastic.co/t/database-request/42596)

<div class="topic-metadata">

**Author:** [@Justin\_V](https://discuss.elastic.co/u/Justin_V)\
**Replies:** 3\
**Last updated:** [February 25, 2016, 7:49am UTC](https://discuss.elastic.co/t/database-request/42596 "2016-02-25T07:49:45Z")

</div>

Hello, I didn't find the answer in other topics, so I post a new one. Here's the thing : In my logs, I have some id's, who are totally not representative of what they are exactly. So my question is : After having "gro…

---

## [How can I specify the default mapping for a type across all indexes?](https://discuss.elastic.co/t/how-can-i-specify-the-default-mapping-for-a-type-across-all-indexes/30082)

<div class="topic-metadata">

**Author:** [@LansK](https://discuss.elastic.co/u/LansK)\
**Replies:** 3\
**Last updated:** [October 27, 2015, 8:24pm UTC](https://discuss.elastic.co/t/how-can-i-specify-the-default-mapping-for-a-type-across-all-indexes/30082 "2015-10-27T20:24:04Z")

</div>

I want to make the default analyzer for the string type for ALL string fields across ALL indexes to “index”: “not\_analyzed” (or the equivalent formulation for templates). Something like this, but this doesn’t work: P…

---

## [Tls errors, max mem, max clients... sudden dead everywhere!](https://discuss.elastic.co/t/tls-errors-max-mem-max-clients-sudden-dead-everywhere/1834)

<div class="topic-metadata">

**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\
**Replies:** 3\
**Last updated:** [June 5, 2015, 1:12am UTC](https://discuss.elastic.co/t/tls-errors-max-mem-max-clients-sudden-dead-everywhere/1834 "2015-06-05T01:12:54Z")

</div>

Hi again forum! ...I'm sad as my brand new toy lasted very little time... thank God I kept ald stuff on. As I decided that ELK may still be suitable to have nice stats on services for IT staff, I started creting my fil…

---

## [Why my elk always report an error "{"statusCode":503,"error":"Service Unavailable","message":"License is not available."}"](https://discuss.elastic.co/t/why-my-elk-always-report-an-error-statuscode-503-error-service-unavailable-message-license-is-not-available/332780)

<div class="topic-metadata">

**Author:** [@maf\_77](https://discuss.elastic.co/u/maf_77)\
**Replies:** 6\
**Last updated:** [May 16, 2023, 4:59am UTC](https://discuss.elastic.co/t/why-my-elk-always-report-an-error-statuscode-503-error-service-unavailable-message-license-is-not-available/332780 "2023-05-16T04:59:39Z")

</div>

I made a ELK system,but there offen have a error,the kibana html report:{"statusCode":503,"error":"Service Unavailable","message":"License is not available."} I don't know how to find the reason,so i had restart the ser…

---

## [Empty output when extracting field](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514)

<div class="topic-metadata">

**Author:** [@sigizmynd](https://discuss.elastic.co/u/sigizmynd)\
**Replies:** 6\
**Last updated:** [June 23, 2022, 12:24pm UTC](https://discuss.elastic.co/t/empty-output-when-extracting-field/307514 "2022-06-23T12:24:17Z")

</div>

Hello I want to extract some value from my log: { "\_index": ".ds-filebeat-8.2.2-2022.06.14-000002", "\_id": "veGbcYEBr3mqBf4wJF1j", "\_version": 1, "\_score": null, "fields": { "host.os.name.text": \[ "AlmaLinux" \]…

---

## [Match rule not working](https://discuss.elastic.co/t/match-rule-not-working/266666)

<div class="topic-metadata">

**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Replies:** 6\
**Last updated:** [March 11, 2021, 8:51am UTC](https://discuss.elastic.co/t/match-rule-not-working/266666 "2021-03-11T08:51:25Z")

</div>

Hello, I am trying to add a threat intelligence in my SIEM, I downloaded the database of malware hashes, and I am using auditbeat file integrity to detect malware, and then I created a rmatch rule like that: and the…

---

## [Unable to perform insert or delete action in elasticsearch](https://discuss.elastic.co/t/unable-to-perform-insert-or-delete-action-in-elasticsearch/214024)

<div class="topic-metadata">

**Author:** [@swati\_dupare](https://discuss.elastic.co/u/swati_dupare)\
**Replies:** 6\
**Last updated:** [January 8, 2020, 9:44am UTC](https://discuss.elastic.co/t/unable-to-perform-insert-or-delete-action-in-elasticsearch/214024 "2020-01-08T09:44:28Z")

</div>

Hi, I am getting below error when I am trying to insert or delete data from elasticsearch : index \[index\_name\] blocked by: \[FORBIDDEN/12/index read-only / allow delete (api) Thanks

---

## [CAN'T CONNECT TO 127.0.0.1:9200](https://discuss.elastic.co/t/cant-connect-to-127-0-0-1-9200/201627)

<div class="topic-metadata">

**Author:** [@Shodipo\_Samuel](https://discuss.elastic.co/u/Shodipo_Samuel)\
**Replies:** 6\
**Last updated:** [October 7, 2019, 2:58pm UTC](https://discuss.elastic.co/t/cant-connect-to-127-0-0-1-9200/201627 "2019-10-07T14:58:21Z")

</div>

Sep 30 12:49:00 elasticsearch elasticsearch\[3281\]: 2019-09-30 12:49:00,460 main ERROR Null object returned for RollingFile in Appenders. Sep 30 12:49:00 elasticsearch elasticsearch\[3281\]: 2019-09-30 12:49:00,461 main ER…

---

## [Elasticsearch performance tuning](https://discuss.elastic.co/t/elasticsearch-performance-tuning/22231)

<div class="topic-metadata">

**Author:** [@Deva\_Raj](https://discuss.elastic.co/u/Deva_Raj)\
**Replies:** 6\
**Last updated:** [February 22, 2015, 11:50pm UTC](https://discuss.elastic.co/t/elasticsearch-performance-tuning/22231 "2015-02-22T23:50:37Z")

</div>

Hi All, In a Single Node Elastic Search along with logstash, We tested with 20mb and 200mb file parsing to Elastic Search on Different types of the AWS instance i.e Medium, Large and Xlarge. Environment Detail…

---

## [Logstash with JDBC performance](https://discuss.elastic.co/t/logstash-with-jdbc-performance/296984)

<div class="topic-metadata">

**Author:** [@HerveSavard](https://discuss.elastic.co/u/HerveSavard)\
**Replies:** 7\
**Last updated:** [February 14, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-with-jdbc-performance/296984 "2022-02-14T09:10:21Z")

</div>

Hello, I use Logstash with JDBC connector. I have 6 pipelines defined in my pipeline.yml. pipeline1 have 14 SQL pipeline2 have 10 SQL pipeline3 have 2 SQL pipeline4 have 8 SQL pipeline5 have 1 SQL pipeline6 have…

---

## [Kibana does not detect elasticsearch indices](https://discuss.elastic.co/t/kibana-does-not-detect-elasticsearch-indices/103196)

<div class="topic-metadata">

**Author:** [@PDS42](https://discuss.elastic.co/u/PDS42)\
**Replies:** 1\
**Last updated:** [October 9, 2017, 10:25am UTC](https://discuss.elastic.co/t/kibana-does-not-detect-elasticsearch-indices/103196 "2017-10-09T10:25:10Z")

</div>

Hello. Just getting started with ES / Kibana. I configured them with official docker images, and they are both up and running. When I try to visualize my Elasticsearch data in Kibana though, I get the following message …

---

## [Kafka Input not committing and causing OOM](https://discuss.elastic.co/t/kafka-input-not-committing-and-causing-oom/97178)

<div class="topic-metadata">

**Author:** [@jalaziz](https://discuss.elastic.co/u/jalaziz)\
**Replies:** 1\
**Last updated:** [August 17, 2017, 12:31am UTC](https://discuss.elastic.co/t/kafka-input-not-committing-and-causing-oom/97178 "2017-08-17T00:31:44Z")

</div>

We recently upgraded to ES 5.5.1 and Logstash 5.5.1 from ES 2.4 and Logstash 2.4. Our pipeline is pretty simple: a kafka input with multiple consumer threads subscribing to a pattern, a few filters, and an ES output. I…

---

## [How to extract data from string filed "message"](https://discuss.elastic.co/t/how-to-extract-data-from-string-filed-message/84451)

<div class="topic-metadata">

**Author:** [@cnallapati](https://discuss.elastic.co/u/cnallapati)\
**Replies:** 1\
**Last updated:** [May 3, 2017, 7:11pm UTC](https://discuss.elastic.co/t/how-to-extract-data-from-string-filed-message/84451 "2017-05-03T19:11:22Z")

</div>

Data is populating in message files as below and I would like to extract logger\_name and HOSTNAME and use them as fields. How can I achieve Kibana. Please advise, Thanks, Chaitanya. {"@timestamp":"2017-05-03T18:54:45…

---

## [Missing documents after indexing with Logstash](https://discuss.elastic.co/t/missing-documents-after-indexing-with-logstash/77329)

<div class="topic-metadata">

**Author:** [@ylan\_d](https://discuss.elastic.co/u/ylan_d)\
**Replies:** 1\
**Last updated:** [March 7, 2017, 12:28pm UTC](https://discuss.elastic.co/t/missing-documents-after-indexing-with-logstash/77329 "2017-03-07T12:28:38Z")

</div>

Hey, I'm using Elasticsearch 5.2.2, Logstash 5.2.2 and PostgreSQL 9.5.2. And trying to index over 5,000,000 documents distributed in two types in one index. But after indexing some documents are missing. :cry: The fi…

---

## [Show "right" substring in Kibana visualisation](https://discuss.elastic.co/t/show-right-substring-in-kibana-visualisation/72511)

<div class="topic-metadata">

**Author:** [@Cylindric](https://discuss.elastic.co/u/Cylindric)\
**Replies:** 1\
**Last updated:** [January 24, 2017, 4:01am UTC](https://discuss.elastic.co/t/show-right-substring-in-kibana-visualisation/72511 "2017-01-24T04:01:01Z")

</div>

Hi folks. I am trying to make a visualisation for MetricBeat process data, and as we run a few things that have identical process names (several instances of SQL server, and many instances of our own in-house app), just …

---

## [Install in a Windows 10 pc](https://discuss.elastic.co/t/install-in-a-windows-10-pc/44172)

<div class="topic-metadata">

**Author:** [@poorknight](https://discuss.elastic.co/u/poorknight)\
**Replies:** 1\
**Last updated:** [March 11, 2016, 4:31pm UTC](https://discuss.elastic.co/t/install-in-a-windows-10-pc/44172 "2016-03-11T16:31:15Z")

</div>

Hi, Newbie Here I'm trying to get everything up and running on a windows 10 laptop so I can get used to it all. Installed elasticsearch in that its running and I've checked it (curl checked ok). Installed kibana an…

---

## [Query Pre-filter](https://discuss.elastic.co/t/query-pre-filter/36290)

<div class="topic-metadata">

**Author:** [@rosherd](https://discuss.elastic.co/u/rosherd)\
**Replies:** 1\
**Last updated:** [December 5, 2015, 2:50am UTC](https://discuss.elastic.co/t/query-pre-filter/36290 "2015-12-05T02:50:43Z")

</div>

Hi, We have a use-case where we have a separate location index. We want to query the location index with a string, and for a match use this as a filter into the main query, so can then filter by a location number. O…

---

## [Multi node cluster failing to connect](https://discuss.elastic.co/t/multi-node-cluster-failing-to-connect/326753)

<div class="topic-metadata">

**Author:** [@vanwoes](https://discuss.elastic.co/u/vanwoes)\
**Replies:** 4\
**Last updated:** [March 20, 2023, 4:29am UTC](https://discuss.elastic.co/t/multi-node-cluster-failing-to-connect/326753 "2023-03-20T04:29:02Z")

</div>

Hi, I'm having an issue with a multi node elasticsearch cluster where the nodes are failing to join in a docker swarm. received join request from \[{es01}{SBn0YXX-RyuPcEsz3vgdjA}{0l0I2h0HRteijUgnwwmvqg}{es01}{10.0.0.69}…

---

## [Logstash not parsing dynamic updates happening on the files present under the configured input path](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852)

<div class="topic-metadata">

**Author:** [@harish\_92](https://discuss.elastic.co/u/harish_92)\
**Replies:** 4\
**Last updated:** [April 14, 2021, 5:51am UTC](https://discuss.elastic.co/t/logstash-not-parsing-dynamic-updates-happening-on-the-files-present-under-the-configured-input-path/269852 "2021-04-14T05:51:21Z")

</div>

Hi Guys, I have configured a folder containing files which will be dynamically updated with some data which needs to be parsed by logstash and pushed into ES. Here, whenever new data is written into any one of the inpu…

---

## [Watcherのemail actionでdashboard.pdfを添付したい](https://discuss.elastic.co/t/watcher-email-action-dashboard-pdf/205998)

<div class="topic-metadata">

**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\
**Replies:** 4\
**Last updated:** [November 7, 2019, 6:37am UTC](https://discuss.elastic.co/t/watcher-email-action-dashboard-pdf/205998 "2019-11-07T06:37:21Z")

</div>

Watcherのemail actionで、送るメールにdashboardのpdfファイルを添付したいと考えています。 下記URLを参考に設定をしているのですが、上手くいきません。 https://www.elastic.co/guide/en/elasticsearch/reference/7.3/actions-email.html#configuring-email-attachments 設定した条件（trigger,in…

[Previous page](https://discuss.elastic.co/top.md?page=1400&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1402&per_page=50&period=all)
