# Top

**URL:** https://discuss.elastic.co/top.md?page=1418&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1419

---

## [Extract field from source](https://discuss.elastic.co/t/extract-field-from-source/126984)

<div class="topic-metadata">

**Author:** [@las](https://discuss.elastic.co/u/las)\
**Replies:** 6\
**Last updated:** [April 6, 2018, 12:50pm UTC](https://discuss.elastic.co/t/extract-field-from-source/126984 "2018-04-06T12:50:03Z")

</div>

The event from filebeat contains the source field which contains the log filename. How do I use grok to extract some data from it?

---

## [Is it possible to increment or decrement a time field based on seconds and store it as another attribute?](https://discuss.elastic.co/t/is-it-possible-to-increment-or-decrement-a-time-field-based-on-seconds-and-store-it-as-another-attribute/75583)

<div class="topic-metadata">

**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Replies:** 6\
**Last updated:** [February 21, 2017, 4:46am UTC](https://discuss.elastic.co/t/is-it-possible-to-increment-or-decrement-a-time-field-based-on-seconds-and-store-it-as-another-attribute/75583 "2017-02-21T04:46:17Z")

</div>

Hi, I am using ELK GA 5.0.0. I have a time entry like 06:52:02 and a delay entry (in seconds) like 1.016. I want to push another attribure to elasticsearch, by subtracting seconds from timefield, say 06:52:01 in this c…

---

## [Background segment merge looks like dosen't work](https://discuss.elastic.co/t/background-segment-merge-looks-like-dosent-work/70646)

<div class="topic-metadata">

**Author:** [@WangXiangUSTC](https://discuss.elastic.co/u/WangXiangUSTC)\
**Replies:** 6\
**Last updated:** [January 5, 2017, 8:35am UTC](https://discuss.elastic.co/t/background-segment-merge-looks-like-dosent-work/70646 "2017-01-05T08:35:27Z")

</div>

I use delete by query command to delete old data. And I have already look the document and it said that the deleted data is actualy dosen't delete, just tag this data will be delete, and the segment merge will run backgr…

---

## [Not able to get any results on using bucket aggregations](https://discuss.elastic.co/t/not-able-to-get-any-results-on-using-bucket-aggregations/216576)

<div class="topic-metadata">

**Author:** [@fenster25](https://discuss.elastic.co/u/fenster25)\
**Replies:** 3\
**Last updated:** [January 27, 2020, 1:32am UTC](https://discuss.elastic.co/t/not-able-to-get-any-results-on-using-bucket-aggregations/216576 "2020-01-27T01:32:49Z")

</div>

I have some PR data in my ES. This is how the documents are modelled { "Author" : "dheerajrav", "Date" : "2012-10-05T10:16:49Z", "Number" : 2554441, "IsMerged" : false, …

---

## [Custom field name not showing in Filebeat](https://discuss.elastic.co/t/custom-field-name-not-showing-in-filebeat/212088)

<div class="topic-metadata">

**Author:** [@katara](https://discuss.elastic.co/u/katara)\
**Replies:** 3\
**Last updated:** [December 18, 2019, 9:57am UTC](https://discuss.elastic.co/t/custom-field-name-not-showing-in-filebeat/212088 "2019-12-18T09:57:53Z")

</div>

Below is how im trying to add a custom fiels name in my filebeat 7.2.0 filebeat.inputs: - type: log enabled: true paths: - D:\\Oasis\\Logs\\Admin\_Log\\\* - D:\\Oasis\\Logs\\ERA\_Log\\\* - D:\\OasisServices\\Logs\\\* …

---

## [Elasticsearch monitoring no data in Nodes view](https://discuss.elastic.co/t/elasticsearch-monitoring-no-data-in-nodes-view/180104)

<div class="topic-metadata">

**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Replies:** 3\
**Last updated:** [May 9, 2019, 10:09am UTC](https://discuss.elastic.co/t/elasticsearch-monitoring-no-data-in-nodes-view/180104 "2019-05-09T10:09:08Z")

</div>

I recently upgraded my ES cluster from 6.3 to 7.0. Everything goes well so far, but in monitoring-\> nodes, the table list show "No items found", other views in monitoring works though. What am I missing?

---

## [Script Engine with JAVA - elasticsearch-6.3.0](https://discuss.elastic.co/t/script-engine-with-java-elasticsearch-6-3-0/146500)

<div class="topic-metadata">

**Author:** [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Replies:** 3\
**Last updated:** [August 30, 2018, 6:17pm UTC](https://discuss.elastic.co/t/script-engine-with-java-elasticsearch-6-3-0/146500 "2018-08-30T18:17:53Z")

</div>

Hi Currently I am migrating elasticsearch-6.3.0 ,part of that Have to change script changes to Script Engine. I have written the script using Native language ,java The following syntax i am using to pass the values A…

---

## [ElasticSearch and Hive](https://discuss.elastic.co/t/elasticsearch-and-hive/110875)

<div class="topic-metadata">

**Author:** [@cw2579](https://discuss.elastic.co/u/cw2579)\
**Replies:** 3\
**Last updated:** [December 13, 2017, 7:53pm UTC](https://discuss.elastic.co/t/elasticsearch-and-hive/110875 "2017-12-13T19:53:15Z")

</div>

I can create hive elasticsearch table: CREATE EXTERNAL TABLE artists\_es ( id BIGINT, name STRING ) STORED BY 'org.elasticsearch.hadoop.hive.EsStorageHandler' TBLPROPERTIES('es.nodes'='10.0.14.71','es.port'= '9…

---

## [HOW-TO: terms lookup or sth-else](https://discuss.elastic.co/t/how-to-terms-lookup-or-sth-else/37799)

<div class="topic-metadata">

**Author:** [@nskalis](https://discuss.elastic.co/u/nskalis)\
**Replies:** 3\
**Last updated:** [December 23, 2015, 7:33pm UTC](https://discuss.elastic.co/t/how-to-terms-lookup-or-sth-else/37799 "2015-12-23T19:33:57Z")

</div>

hi guys, i am looking to cross-check two elastic search indices by comparing at least two keys the question is how can i query two indices and apply filtering on them ? for example if i have an index called index\_1 w…

---

## [Why there isn't a configuration 'ignore\_incoming'?](https://discuss.elastic.co/t/why-there-isnt-a-configuration-ignore-incoming/35640)

<div class="topic-metadata">

**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\
**Replies:** 3\
**Last updated:** [November 27, 2015, 2:18pm UTC](https://discuss.elastic.co/t/why-there-isnt-a-configuration-ignore-incoming/35640 "2015-11-27T14:18:49Z")

</div>

I have packetbeat installed in all the EC2 instances. The ignore\_outgoing is set to 'True' which prevents the duplicated transactions being stored in the ES. The applications makes call to MongoDB,as the ignore\_outgoing …

---

## [Scalability and creating 1 index per user](https://discuss.elastic.co/t/scalability-and-creating-1-index-per-user/16018)

<div class="topic-metadata">

**Author:** [@Neera\_Vats](https://discuss.elastic.co/u/Neera_Vats)\
**Replies:** 3\
**Last updated:** [March 12, 2014, 3:37am UTC](https://discuss.elastic.co/t/scalability-and-creating-1-index-per-user/16018 "2014-03-12T03:37:29Z")

</div>

Hi All, I am exploring elastic search to create one index per user instead of one big index for all the users. Each index would be about 6G. I am wondering if anyone has tried it and how would it scale? I couldn't…

---

## [Parsing xml in logstash \[0\] "\_xmlparsefailure"](https://discuss.elastic.co/t/parsing-xml-in-logstash-0-xmlparsefailure/273857)

<div class="topic-metadata">

**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\
**Replies:** 4\
**Last updated:** [May 25, 2021, 8:42am UTC](https://discuss.elastic.co/t/parsing-xml-in-logstash-0-xmlparsefailure/273857 "2021-05-25T08:42:18Z")

</div>

Issue: \[0\] "\_xmlparsefailure" ..Hi all need your help on below issue.. Pleaes refer to step by step explanation of the issue. Step 1 : I have sample input as per below. \<?xml version="1.0" encoding="UTF-8"?\> blue …

---

## [Track Dashboards through user logins](https://discuss.elastic.co/t/track-dashboards-through-user-logins/229975)

<div class="topic-metadata">

**Author:** [@Akhil\_Kaithoju](https://discuss.elastic.co/u/Akhil_Kaithoju)\
**Replies:** 4\
**Last updated:** [May 5, 2020, 3:41am UTC](https://discuss.elastic.co/t/track-dashboards-through-user-logins/229975 "2020-05-05T03:41:21Z")

</div>

Hello, Is there a way to track Kibana dashboard usage (i.e. dashboard used by particular user)?

---

## [Heartbeat config changes creates multiple runners/monitors](https://discuss.elastic.co/t/heartbeat-config-changes-creates-multiple-runners-monitors/216899)

<div class="topic-metadata">

**Author:** [@sastorsl](https://discuss.elastic.co/u/sastorsl)\
**Replies:** 4\
**Last updated:** [January 30, 2020, 3:38pm UTC](https://discuss.elastic.co/t/heartbeat-config-changes-creates-multiple-runners-monitors/216899 "2020-01-30T15:38:37Z")

</div>

Have setup heartbeat-7.5.2 on a RedHat Enterprise Linux 7.7 (RHEL7) server. Basic setup as of yet - pushing to two elasticsearch outputs. http checks - nothing fancy. heartbeat.config.monitors: path: ${path.config}/…

---

## [Help with writing a search query](https://discuss.elastic.co/t/help-with-writing-a-search-query/153808)

<div class="topic-metadata">

**Author:** [@ProxyMasterMerger](https://discuss.elastic.co/u/ProxyMasterMerger)\
**Replies:** 4\
**Last updated:** [October 25, 2018, 6:19am UTC](https://discuss.elastic.co/t/help-with-writing-a-search-query/153808 "2018-10-25T06:19:10Z")

</div>

Hello all, nooby here. I'm trying to write a search query but I'm having some problems. I have an index called Categories. It has the following fields: title, tags (which is just a big string with keywords) and total, a…

---

## [Logstash (6.3) not starting anymore with DLQ](https://discuss.elastic.co/t/logstash-6-3-not-starting-anymore-with-dlq/140917)

<div class="topic-metadata">

**Author:** [@af\_andi](https://discuss.elastic.co/u/af_andi)\
**Replies:** 4\
**Last updated:** [July 26, 2018, 2:33pm UTC](https://discuss.elastic.co/t/logstash-6-3-not-starting-anymore-with-dlq/140917 "2018-07-26T14:33:41Z")

</div>

Hi Guys, since i'd upgraded to 6.3 i have a problem with the dead\_letter\_queue on one Logstash host (at the second everything works fine). I just enable the feature in the logstash.yml and leave the other dlq options t…

---

## [To extract fields from a query string](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680)

<div class="topic-metadata">

**Author:** [@neal1991](https://discuss.elastic.co/u/neal1991)\
**Replies:** 4\
**Last updated:** [November 15, 2017, 12:45pm UTC](https://discuss.elastic.co/t/to-extract-fields-from-a-query-string/107680 "2017-11-15T12:45:23Z")

</div>

Assume that there is a field like: Cmd=FolderSync&User=ABC&DeviceId=androidc737881212&DeviceType=Android&Log=V141 I can use mutate to split the field into an array. it will just like \['Cmd=FolderSync....\] But I want …

---

## [Discover Menu in Kibana no more sorting by index](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592)

<div class="topic-metadata">

**Author:** [@AurelieP](https://discuss.elastic.co/u/AurelieP)\
**Replies:** 4\
**Last updated:** [June 2, 2017, 7:09am UTC](https://discuss.elastic.co/t/discover-menu-in-kibana-no-more-sorting-by-index/87592 "2017-06-02T07:09:22Z")

</div>

Hello, I'm currently using Kibana with Fluentd and Metricbeats. I have 2 indexes : logstash-\* and metricbeat-\* In the Discover menu of Kibana, I have the choice to sort the results by index, but this is not working a…

---

## [Sheduling logstash to run daily](https://discuss.elastic.co/t/sheduling-logstash-to-run-daily/83025)

<div class="topic-metadata">

**Author:** [@Nisal\_Thiwanka](https://discuss.elastic.co/u/Nisal_Thiwanka)\
**Replies:** 4\
**Last updated:** [April 21, 2017, 3:16am UTC](https://discuss.elastic.co/t/sheduling-logstash-to-run-daily/83025 "2017-04-21T03:16:17Z")

</div>

I'm planning to implement a java based REST service which will run logstash on a daily basis on my log files. How can I achieve that?

---

## [Data compilation From Netflow & Syslog messages from Cisco Equipment](https://discuss.elastic.co/t/data-compilation-from-netflow-syslog-messages-from-cisco-equipment/80180)

<div class="topic-metadata">

**Author:** [@adrianmc](https://discuss.elastic.co/u/adrianmc)\
**Replies:** 4\
**Last updated:** [March 27, 2017, 7:52pm UTC](https://discuss.elastic.co/t/data-compilation-from-netflow-syslog-messages-from-cisco-equipment/80180 "2017-03-27T19:52:33Z")

</div>

Well, Hello everybody, Actually, I'm working with Netflow protocol and have been working fine. But, i would like work with Syslog too. In my case i have some routers Cisco , i get data from Netflow protocol and show i…

---

## [kibana-6.0.0-alpha1-SNAPSHOT-linux-x86\_64, not start](https://discuss.elastic.co/t/kibana-6-0-0-alpha1-snapshot-linux-x86-64-not-start/60398)

<div class="topic-metadata">

**Author:** [@rccclr](https://discuss.elastic.co/u/rccclr)\
**Replies:** 4\
**Last updated:** [September 24, 2016, 8:40am UTC](https://discuss.elastic.co/t/kibana-6-0-0-alpha1-snapshot-linux-x86-64-not-start/60398 "2016-09-24T08:40:41Z")

</div>

This is the error when startup:

---

## [Seeking advice on our index schema design](https://discuss.elastic.co/t/seeking-advice-on-our-index-schema-design/50205)

<div class="topic-metadata">

**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Replies:** 4\
**Last updated:** [May 19, 2016, 3:37pm UTC](https://discuss.elastic.co/t/seeking-advice-on-our-index-schema-design/50205 "2016-05-19T15:37:43Z")

</div>

We are building our search platform which will support search service (indexing and searching) for multiple sites (might be 100+ sites) with multi-language (about 50 languages) support. Some basic requirements: 1. All si…

---

## [Snapshot/Backup of cluster](https://discuss.elastic.co/t/snapshot-backup-of-cluster/45371)

<div class="topic-metadata">

**Author:** [@sipazzo](https://discuss.elastic.co/u/sipazzo)\
**Replies:** 1\
**Last updated:** [March 24, 2016, 5:23pm UTC](https://discuss.elastic.co/t/snapshot-backup-of-cluster/45371 "2016-03-24T17:23:53Z")

</div>

I am setting up my 3 node cluster to create snapshots nightly. I know I have to make sure the snapshot location is available on all nodes and register the shared files system repo on each node but do I actually run the b…

---

## [Elastic Cloud Enterprise (ECE) 3.8.6 and 4.2.1 Security Update (ESA-2026-211)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [October 29, 2026, 10:45am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260 "2026-10-29T10:45:25Z")

</div>

Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to…

---

## [Terraform, Traffic Filters and Kibana](https://discuss.elastic.co/t/terraform-traffic-filters-and-kibana/327767)

<div class="topic-metadata">

**Author:** [@tensor](https://discuss.elastic.co/u/tensor)\
**Replies:** 0\
**Last updated:** [March 15, 2023, 3:48pm UTC](https://discuss.elastic.co/t/terraform-traffic-filters-and-kibana/327767 "2023-03-15T15:48:58Z")

</div>

Hi! We have been successfully using Terraform to set up Elasticcloud instances, and using traffic filtering to allow only access via private link to our own Azure serup - almost too successful, as it turns out, as it me…

---

## [Options List (Control) Default Value Issue/Question](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144)

<div class="topic-metadata">

**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\
**Replies:** 0\
**Last updated:** [July 14, 2020, 2:10pm UTC](https://discuss.elastic.co/t/options-list-control-default-value-issue-question/241144 "2020-07-14T14:10:14Z")

</div>

Hello, Using kibana 7.8. I created a drop down list control to use in a Dashboard. The drop down is for dates. I would like the default to be the most recent date in the dropdown. However, I am unable to make this work…

---

## [Logstash / input - Elasticsearch query question](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239)

<div class="topic-metadata">

**Author:** [@RoNo](https://discuss.elastic.co/u/RoNo)\
**Replies:** 0\
**Last updated:** [February 20, 2020, 5:42pm UTC](https://discuss.elastic.co/t/logstash-input-elasticsearch-query-question/220239 "2020-02-20T17:42:32Z")

</div>

is it possible to query frozen indexes with the elasticsearch input module in logstash? i am trying to query all my frozen indexes with logstash and the ES input module if i try to query a frozen index in kibana or cur…

---

## [Difference between HTTP and Transport certificates](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839)

<div class="topic-metadata">

**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\
**Replies:** 2\
**Last updated:** [March 16, 2023, 1:53pm UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839 "2023-03-16T13:53:25Z")

</div>

I've found this topic regarding automation of http certificate creation: generate http certificate non interactive, as I was wondering the same thing: why can't I use the same advanced feature of using a yaml file contai…

---

## [Kibana Dev Tools Get Field names from .kibana index](https://discuss.elastic.co/t/kibana-dev-tools-get-field-names-from-kibana-index/254990)

<div class="topic-metadata">

**Author:** [@cwobuzz](https://discuss.elastic.co/u/cwobuzz)\
**Replies:** 2\
**Last updated:** [November 12, 2020, 4:05pm UTC](https://discuss.elastic.co/t/kibana-dev-tools-get-field-names-from-kibana-index/254990 "2020-11-12T16:05:31Z")

</div>

Team, I tried to figure this out, but I am new to using the dev tools. I am using SecOnion. I want to pull out the fields mapped to different event ids. I spent a good amount of time trying to google an answer, but I di…

---

## [Parse UNIX timestamp as human readable date while moving the data into elasticsearch](https://discuss.elastic.co/t/parse-unix-timestamp-as-human-readable-date-while-moving-the-data-into-elasticsearch/162317)

<div class="topic-metadata">

**Author:** [@amitnegi6190](https://discuss.elastic.co/u/amitnegi6190)\
**Replies:** 2\
**Last updated:** [January 7, 2019, 8:30am UTC](https://discuss.elastic.co/t/parse-unix-timestamp-as-human-readable-date-while-moving-the-data-into-elasticsearch/162317 "2019-01-07T08:30:19Z")

</div>

Hi, I have a JSON file which has a field named lastUpdated. It has the UNIX timestamp value for the time when the specified record was last updated. I wish to parse this JSON file and feed it to elasticsearch where this …

---

## [How to enable Machine Learning in cloud version 6.3.2?](https://discuss.elastic.co/t/how-to-enable-machine-learning-in-cloud-version-6-3-2/141699)

<div class="topic-metadata">

**Author:** [@jcastellano](https://discuss.elastic.co/u/jcastellano)\
**Replies:** 2\
**Last updated:** [July 27, 2018, 3:54pm UTC](https://discuss.elastic.co/t/how-to-enable-machine-learning-in-cloud-version-6-3-2/141699 "2018-07-27T15:54:46Z")

</div>

Iam using Elastic Cloud, and in Kibana "Machine Learning" section, iam unable to create jobs. A warning says: "No ML Nodes available. There are no ML nodes available." I try to edit elasticsearch.yml file with settings…

---

## [Tcp time\_wait between logstash agent and elasticsearch cluster nodes](https://discuss.elastic.co/t/tcp-time-wait-between-logstash-agent-and-elasticsearch-cluster-nodes/59936)

<div class="topic-metadata">

**Author:** [@AllenBarra](https://discuss.elastic.co/u/AllenBarra)\
**Replies:** 2\
**Last updated:** [September 7, 2016, 5:38am UTC](https://discuss.elastic.co/t/tcp-time-wait-between-logstash-agent-and-elasticsearch-cluster-nodes/59936 "2016-09-07T05:38:00Z")

</div>

My elasticsearch cluster contains two nodes: node\_ip1,node\_ip2. When I used logstash-output-elasticsearch to connect elasticsearch cluster, there were lots of tcp time\_wait between logstash and elasticsearch nodes. Here …

---

## [Marvel plugin installation wait for input](https://discuss.elastic.co/t/marvel-plugin-installation-wait-for-input/59485)

<div class="topic-metadata">

**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Replies:** 2\
**Last updated:** [September 1, 2016, 5:03pm UTC](https://discuss.elastic.co/t/marvel-plugin-installation-wait-for-input/59485 "2016-09-01T17:03:46Z")

</div>

I am building automation script to install marvel plugin on Windows OS, the script is: plugin install marvel-agent But the installation paused with following warning and wait for input: java.lang.RuntimePermission s…

---

## [Do we already have a Java API for Pipeline Aggregation?](https://discuss.elastic.co/t/do-we-already-have-a-java-api-for-pipeline-aggregation/54503)

<div class="topic-metadata">

**Author:** [@siddharthgoel88](https://discuss.elastic.co/u/siddharthgoel88)\
**Replies:** 2\
**Last updated:** [July 1, 2016, 6:41am UTC](https://discuss.elastic.co/t/do-we-already-have-a-java-api-for-pipeline-aggregation/54503 "2016-07-01T06:41:53Z")

</div>

I am currently using ElasticSearch 2.3.3 and have been successfully able to use Pipeline Aggregation through REST interface. But I could not find Java API implementation for the same. Do we have one? I know that this …

---

## [@timestamp field not matching with the Actual log field in Kibana](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511)

<div class="topic-metadata">

**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\
**Replies:** 2\
**Last updated:** [May 9, 2016, 6:00am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511 "2016-05-09T06:00:42Z")

</div>

Continuing the discussion from @timestamp field not matching with the Actual log field: Hi, I have been using ELK for quite a sometime now. My logs are in following pattern May 9 03:45:25 rjedi-04 docker/3fdf29fdc1eb\[…

---

## [ElasticSearch linear scaling problem](https://discuss.elastic.co/t/elasticsearch-linear-scaling-problem/49274)

<div class="topic-metadata">

**Author:** [@edeak](https://discuss.elastic.co/u/edeak)\
**Replies:** 2\
**Last updated:** [May 5, 2016, 10:09am UTC](https://discuss.elastic.co/t/elasticsearch-linear-scaling-problem/49274 "2016-05-05T10:09:01Z")

</div>

Hi guys, I'm trying to figure out our basic scale unit based on this article: https://www.elastic.co/guide/en/elasticsearch/guide/current/scale.html Hardware is fix, and I use one primary shard without any replica. I…

---

## [Rescore Sorting](https://discuss.elastic.co/t/rescore-sorting/19244)

<div class="topic-metadata">

**Author:** [@kayngee](https://discuss.elastic.co/u/kayngee)\
**Replies:** 2\
**Last updated:** [August 13, 2014, 10:25am UTC](https://discuss.elastic.co/t/rescore-sorting/19244 "2014-08-13T10:25:40Z")

</div>

Hi Guys, I'm getting weird score from my rescore anyone mind explaining why the rescore score is getting ignored in my query? { "from": 0, "size": 10, "explain": false, "sort": \["\_score", { "networks": { …

---

## [Zeppelin and Elasticsearch-Spark incompatibility](https://discuss.elastic.co/t/zeppelin-and-elasticsearch-spark-incompatibility/88935)

<div class="topic-metadata">

**Author:** [@dona](https://discuss.elastic.co/u/dona)\
**Replies:** 0\
**Last updated:** [June 10, 2017, 10:13pm UTC](https://discuss.elastic.co/t/zeppelin-and-elasticsearch-spark-incompatibility/88935 "2017-06-10T22:13:14Z")

</div>

I am running a Zeppelin 0.7.1 instance and I want to use the Spark connector. I added the dependency org.elasticsearch:elasticsearch-spark-20\_2.10:5.4.1 And yet I get the following error message everytime I run any co…

---

## [Help with plugin - can't tell how plugin code is executed](https://discuss.elastic.co/t/help-with-plugin-cant-tell-how-plugin-code-is-executed/87981)

<div class="topic-metadata">

**Author:** [@samiam](https://discuss.elastic.co/u/samiam)\
**Replies:** 1\
**Last updated:** [June 8, 2017, 1:24pm UTC](https://discuss.elastic.co/t/help-with-plugin-cant-tell-how-plugin-code-is-executed/87981 "2017-06-08T13:24:50Z")

</div>

Hi, Sorry for the length of this post and thanks in advance for any insight here. I am hitting my head against a wall at this point. I've made copy of default cloud-aws plugin and modified it to use kms server side…

---

## [Elasticsearch failed to start with fatal exception while booting Elasticsearch", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.Elasticsearch","e](https://discuss.elastic.co/t/elasticsearch-failed-to-start-with-fatal-exception-while-booting-elasticsearch-ecs-version-1-2-0-service-name-es-ecs-event-dataset-elasticsearch-server-process-thread-name-main-log-logger-org-elasticsearch-bootstrap-elasticsearch-e/354488)

<div class="topic-metadata">

**Author:** [@Vatsal\_Sharma](https://discuss.elastic.co/u/Vatsal_Sharma)\
**Replies:** 1\
**Last updated:** [March 2, 2024, 6:24am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-start-with-fatal-exception-while-booting-elasticsearch-ecs-version-1-2-0-service-name-es-ecs-event-dataset-elasticsearch-server-process-thread-name-main-log-logger-org-elasticsearch-bootstrap-elasticsearch-e/354488 "2024-03-02T06:24:46Z")

</div>

I have deployed a elasticsearch cluster using eck-operator on my eks cluster. I am trying to restore a snapshot stored in my s3 by trying to connect to it. here is the manifest I used -\> --- # Default values for eck-ela…

---

## [Kibana SSL configure in Windows Server](https://discuss.elastic.co/t/kibana-ssl-configure-in-windows-server/216214)

<div class="topic-metadata">

**Author:** [@balupad14](https://discuss.elastic.co/u/balupad14)\
**Replies:** 1\
**Last updated:** [January 23, 2020, 11:36pm UTC](https://discuss.elastic.co/t/kibana-ssl-configure-in-windows-server/216214 "2020-01-23T23:36:24Z")

</div>

Hi, I am very new to the Kibana. I have set up the Kinbana in Windows Server 2012 virtual machine. It is working well in the localhost as http. It is working well the same domain. But my system is in a different domain.…

---

## [Certificate hell :)](https://discuss.elastic.co/t/certificate-hell/136188)

<div class="topic-metadata">

**Author:** [@vincentv](https://discuss.elastic.co/u/vincentv)\
**Replies:** 1\
**Last updated:** [June 18, 2018, 6:49am UTC](https://discuss.elastic.co/t/certificate-hell/136188 "2018-06-18T06:49:28Z")

</div>

Hi all, i currently have a 3 node ES cluster (6x) with kibana in front, and 3 logstash nodes behind. Because we use SSO we have TLS/SSL enabled in ES both for the nodes 9300 and clients 9200. The node to node is worki…

---

## [Custom document Id](https://discuss.elastic.co/t/custom-document-id/111706)

<div class="topic-metadata">

**Author:** [@cj\_elastic](https://discuss.elastic.co/u/cj_elastic)\
**Replies:** 1\
**Last updated:** [December 15, 2017, 9:23am UTC](https://discuss.elastic.co/t/custom-document-id/111706 "2017-12-15T09:23:17Z")

</div>

Im trying to use a custom documentId insertion for every new record. Will there be any performance impact or any other issues for not using the the automatic id generated by elastic db

---

## [Best practice about index pattern definition](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156)

<div class="topic-metadata">

**Author:** [@Houss](https://discuss.elastic.co/u/Houss)\
**Replies:** 1\
**Last updated:** [November 25, 2016, 7:16am UTC](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156 "2016-11-25T07:16:03Z")

</div>

Hello, I am creating an index for each type of logs being sent to the elasticsearch cluster (there might be like 5-6 index patterns overall). The patterns look like this : logstash-squid-%{+YYYY.MM}, or logstash-apache…

---

## [Next Steps to Improve Performance on a Large (500gb+) Index](https://discuss.elastic.co/t/next-steps-to-improve-performance-on-a-large-500gb-index/46743)

<div class="topic-metadata">

**Author:** [@mikewillekes](https://discuss.elastic.co/u/mikewillekes)\
**Replies:** 1\
**Last updated:** [April 7, 2016, 11:40pm UTC](https://discuss.elastic.co/t/next-steps-to-improve-performance-on-a-large-500gb-index/46743 "2016-04-07T23:40:45Z")

</div>

Hi all, I've hit a performance wall scaling up operations on a large index and would appreciate any opinions and/or insight this community may offer. Summary Our all\_the\_data index is 500gb (primaries) with 128m do…

---

## [Postgresql log not sending data with logstash service](https://discuss.elastic.co/t/postgresql-log-not-sending-data-with-logstash-service/36550)

<div class="topic-metadata">

**Author:** [@yairaba](https://discuss.elastic.co/u/yairaba)\
**Replies:** 1\
**Last updated:** [December 7, 2015, 6:42pm UTC](https://discuss.elastic.co/t/postgresql-log-not-sending-data-with-logstash-service/36550 "2015-12-07T18:42:48Z")

</div>

Hi postgresql logs are not processed when logstash run as service , When i run it with below command line it works /opt/logstash/bin/logstash agent -f /etc/logstash/conf.d See below conf file and logstash debug messa…

---

## [Client works in plan java, but not in Tomcat](https://discuss.elastic.co/t/client-works-in-plan-java-but-not-in-tomcat/27403)

<div class="topic-metadata">

**Author:** [@hortond](https://discuss.elastic.co/u/hortond)\
**Replies:** 1\
**Last updated:** [August 17, 2015, 6:15pm UTC](https://discuss.elastic.co/t/client-works-in-plan-java-but-not-in-tomcat/27403 "2015-08-17T18:15:56Z")

</div>

I'm working on a elasticsearch client that will run inside Tomcat. I am starting with a simple test. So far, I have the exact same code that works when I run as a java class, but does not work when I execute it in Tomcat…

---

## [.security-6 Reindex (update assistant)](https://discuss.elastic.co/t/security-6-reindex-update-assistant/328422)

<div class="topic-metadata">

**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\
**Replies:** 5\
**Last updated:** [March 24, 2023, 7:33am UTC](https://discuss.elastic.co/t/security-6-reindex-update-assistant/328422 "2023-03-24T07:33:48Z")

</div>

Hello, We have a cluster running elasticsearch 7.17.7, we recently decided to work on upgrading the cluster to 8.x and everything was going well, I was working on creating a snapshot when I noticed that the system indic…

---

## [Slow Indexing speed / Bottleneck](https://discuss.elastic.co/t/slow-indexing-speed-bottleneck/245378)

<div class="topic-metadata">

**Author:** [@Anirbaan\_Chowdhury](https://discuss.elastic.co/u/Anirbaan_Chowdhury)\
**Replies:** 5\
**Last updated:** [August 19, 2020, 3:49am UTC](https://discuss.elastic.co/t/slow-indexing-speed-bottleneck/245378 "2020-08-19T03:49:23Z")

</div>

Hi Experts, I know there are many threads opened for this but I haven't been able to fix my issue with them. I am new to this. In our ES cluster, there are 4 data, 1 master and 1 ingest nodes. The index rate is curre…

---

## [Need help logstash stop indexing to elasitc search](https://discuss.elastic.co/t/need-help-logstash-stop-indexing-to-elasitc-search/197964)

<div class="topic-metadata">

**Author:** [@callmejon](https://discuss.elastic.co/u/callmejon)\
**Replies:** 5\
**Last updated:** [September 4, 2019, 3:00am UTC](https://discuss.elastic.co/t/need-help-logstash-stop-indexing-to-elasitc-search/197964 "2019-09-04T03:00:34Z")

</div>

hi we have been using elastic search for call manger CDR record for few yrs now. been working great. its stoped working on 12aug2019 for unknow reason. i see log file stay in the FTP directory not clearning up. and no…

[Previous page](https://discuss.elastic.co/top.md?page=1417&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1419&per_page=50&period=all)
