# Top

**URL:** https://discuss.elastic.co/top.md?page=1425&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1426

---

## [Are there docs to help interpret the results?](https://discuss.elastic.co/t/are-there-docs-to-help-interpret-the-results/73436)

<div class="topic-metadata">

**Author:** [@flavor8](https://discuss.elastic.co/u/flavor8)\
**Replies:** 3\
**Last updated:** [February 3, 2017, 7:04am UTC](https://discuss.elastic.co/t/are-there-docs-to-help-interpret-the-results/73436 "2017-02-03T07:04:29Z")

</div>

Obviously the results from Rally are relative and depend on the cluster configuration. That said, it would be useful if there was a reference guide to explain what would be a good or a bad result for each of the scores. …

---

## [Restore Elasticsearch HDFS snapshot on different machine](https://discuss.elastic.co/t/restore-elasticsearch-hdfs-snapshot-on-different-machine/66510)

<div class="topic-metadata">

**Author:** [@Nithya\_Shree](https://discuss.elastic.co/u/Nithya_Shree)\
**Replies:** 3\
**Last updated:** [November 21, 2016, 9:01am UTC](https://discuss.elastic.co/t/restore-elasticsearch-hdfs-snapshot-on-different-machine/66510 "2016-11-21T09:01:46Z")

</div>

Hi, I'm looking for a way to restore my Elasticsearch-5 snapshot from HDFS onto new Elasticsearch-5 machine. Few approaches like Creating a repo from new Elasticsearch5, copying the data from old Elasticsearch repo …

---

## [Query run optimization for percolation](https://discuss.elastic.co/t/query-run-optimization-for-percolation/37933)

<div class="topic-metadata">

**Author:** [@anishek](https://discuss.elastic.co/u/anishek)\
**Replies:** 3\
**Last updated:** [December 28, 2015, 9:50am UTC](https://discuss.elastic.co/t/query-run-optimization-for-percolation/37933 "2015-12-28T09:50:06Z")

</div>

We are using percolation queries for tagging user docs. We have currently about 80 queries. the most time consuming part of these queries is the geo distance filter we are using upto on 10000 points within each query. …

---

## [Complicated filter/aggregation based on an ID excluding CREARED from REVIEVED alerts](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882)

<div class="topic-metadata">

**Author:** [@NilsBecker](https://discuss.elastic.co/u/NilsBecker)\
**Replies:** 3\
**Last updated:** [December 1, 2015, 7:44am UTC](https://discuss.elastic.co/t/complicated-filter-aggregation-based-on-an-id-excluding-creared-from-revieved-alerts/35882 "2015-12-01T07:44:39Z")

</div>

Hey, I have following issue: I recieve "alert-logs" from an monitoring-tool (Tibco Hawk) There are the fields: - event \[ALERT\_RECIEVED, ALERT\_CLEARED\] - alert\_id \[unique ID for every alert\] - more things like IP, Times…

---

## [Kibana 9.3.1 Security Update (ESA-2026-17)](https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [February 26, 2026, 4:55pm UTC](https://discuss.elastic.co/t/kibana-9-3-1-security-update-esa-2026-17/385253 "2026-02-26T16:55:40Z")

</div>

Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF) Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) ex…

---

## [Average size of data indices](https://discuss.elastic.co/t/average-size-of-data-indices/321625)

<div class="topic-metadata">

**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\
**Replies:** 5\
**Last updated:** [December 21, 2022, 10:03am UTC](https://discuss.elastic.co/t/average-size-of-data-indices/321625 "2022-12-21T10:03:36Z")

</div>

I have more of questions regarding size of data. what is average of data can Elasticsearch store par second? if there is 1M document of data in log file and volume 1G after storing in elastic database what is the new …

---

## [Dynamic input (file hashes) for HTTP JSON data collection](https://discuss.elastic.co/t/dynamic-input-file-hashes-for-http-json-data-collection/287016)

<div class="topic-metadata">

**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\
**Replies:** 5\
**Last updated:** [October 19, 2021, 7:20pm UTC](https://discuss.elastic.co/t/dynamic-input-file-hashes-for-http-json-data-collection/287016 "2021-10-19T19:20:47Z")

</div>

Hello, I hope you and your loved ones are safe and healthy. I want to ingest data from an API endpoint that uses JSON for both request and response. (https://developers.virustotal.com/reference) I am aware that filebe…

---

## [Rename a field of particular index](https://discuss.elastic.co/t/rename-a-field-of-particular-index/157479)

<div class="topic-metadata">

**Author:** [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Replies:** 5\
**Last updated:** [November 20, 2018, 10:12am UTC](https://discuss.elastic.co/t/rename-a-field-of-particular-index/157479 "2018-11-20T10:12:22Z")

</div>

can we rename a field in particular field index, Please help me with an example

---

## [Determine shards count for several indices](https://discuss.elastic.co/t/determine-shards-count-for-several-indices/94651)

<div class="topic-metadata">

**Author:** [@Yuval](https://discuss.elastic.co/u/Yuval)\
**Replies:** 5\
**Last updated:** [July 28, 2017, 1:42am UTC](https://discuss.elastic.co/t/determine-shards-count-for-several-indices/94651 "2017-07-28T01:42:38Z")

</div>

Hey, Elastic newbie here. TL;DR: I have few indices which will store LOTS of data (50GB + ) compared to other indices which store much less (1-2GB tops). All the indices share the same default configuration (5 shards…

---

## [Restore deleted dashboards](https://discuss.elastic.co/t/restore-deleted-dashboards/221289)

<div class="topic-metadata">

**Author:** [@tbhaxor](https://discuss.elastic.co/u/tbhaxor)\
**Replies:** 2\
**Last updated:** [February 28, 2020, 8:00pm UTC](https://discuss.elastic.co/t/restore-deleted-dashboards/221289 "2020-02-28T20:00:04Z")

</div>

I have intentionally deleted some built-in dashboard. How do i recover it?

---

## [How to extract json from the response field in the output of dead letter queue?](https://discuss.elastic.co/t/how-to-extract-json-from-the-response-field-in-the-output-of-dead-letter-queue/195306)

<div class="topic-metadata">

**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\
**Replies:** 2\
**Last updated:** [August 19, 2019, 12:01pm UTC](https://discuss.elastic.co/t/how-to-extract-json-from-the-response-field-in-the-output-of-dead-letter-queue/195306 "2019-08-19T12:01:39Z")

</div>

hi guys , my scripts is as follows :- input { dead\_letter\_queue { path =\> "${LS\_HOME}/data/dead\_letter\_queue" pipeline\_id =\> "main" } } filter { ruby { path =\> "${LS\_HOME}/config/failed-index-cre…

---

## [Event get method does not return a json array](https://discuss.elastic.co/t/event-get-method-does-not-return-a-json-array/180108)

<div class="topic-metadata">

**Author:** [@saiteja\_c](https://discuss.elastic.co/u/saiteja_c)\
**Replies:** 2\
**Last updated:** [May 10, 2019, 10:40am UTC](https://discuss.elastic.co/t/event-get-method-does-not-return-a-json-array/180108 "2019-05-10T10:40:55Z")

</div>

I'm using the event api to filter the data collected from various beats. response object: { "a" : "random", "b": \[ { "a1" : "aone" } , …

---

## [Last value in Bar graph](https://discuss.elastic.co/t/last-value-in-bar-graph/146523)

<div class="topic-metadata">

**Author:** [@Marcos\_Dione](https://discuss.elastic.co/u/Marcos_Dione)\
**Replies:** 2\
**Last updated:** [August 31, 2018, 9:03am UTC](https://discuss.elastic.co/t/last-value-in-bar-graph/146523 "2018-08-31T09:03:39Z")

</div>

I want to have a bar graph with current values, but so far the best I can do is to use Average. The data being graphed is disk usage vs size spanning several disks and hosts. A colleague suggested to try to sort by time…

---

## [Scripted Similarity performance](https://discuss.elastic.co/t/scripted-similarity-performance/123098)

<div class="topic-metadata">

**Author:** [@Barry\_Woods](https://discuss.elastic.co/u/Barry_Woods)\
**Replies:** 2\
**Last updated:** [March 9, 2018, 10:14am UTC](https://discuss.elastic.co/t/scripted-similarity-performance/123098 "2018-03-09T10:14:28Z")

</div>

We have previously been using a custom similarity plugin to meet the scoring needs of our application. It was pretty simple as all I wanted out of it was to ignore TF/IDF so I could compare scores across indices. In the…

---

## [Logstash how to transform custom json data to multiple data](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642)

<div class="topic-metadata">

**Author:** [@beiming](https://discuss.elastic.co/u/beiming)\
**Replies:** 2\
**Last updated:** [January 11, 2018, 6:58am UTC](https://discuss.elastic.co/t/logstash-how-to-transform-custom-json-data-to-multiple-data/114642 "2018-01-11T06:58:20Z")

</div>

Hi, I use Logstash 6.1.1, and use http plugin put json data to logstash. some data like: "@timestamp": "2018-01-09T02:50:59.776Z", "headers": { ...... }, "key1": "value1" "key2": "value2" "logs": \["2018-01-09 0…

---

## [How to install x-pack on archlinux](https://discuss.elastic.co/t/how-to-install-x-pack-on-archlinux/105623)

<div class="topic-metadata">

**Author:** [@lemongrab](https://discuss.elastic.co/u/lemongrab)\
**Replies:** 2\
**Last updated:** [October 30, 2017, 2:36pm UTC](https://discuss.elastic.co/t/how-to-install-x-pack-on-archlinux/105623 "2017-10-30T14:36:08Z")

</div>

any help would be much appreciated on installing x-pack on arch linux

---

## [Connectivity of R and Elasticsearch](https://discuss.elastic.co/t/connectivity-of-r-and-elasticsearch/102403)

<div class="topic-metadata">

**Author:** [@Bolosh](https://discuss.elastic.co/u/Bolosh)\
**Replies:** 2\
**Last updated:** [October 2, 2017, 5:54am UTC](https://discuss.elastic.co/t/connectivity-of-r-and-elasticsearch/102403 "2017-10-02T05:54:58Z")

</div>

Hi I have a problems making R to work with Elasticsearch via ssh tunnelling on CentOS 7. SSH tunnel is already setup via putty. I have installed Rstudio and R (server). I connect to Elasticsearch: connect(es\_host = "\<h…

---

## [Cannot start/run ElasticSearch on OS X](https://discuss.elastic.co/t/cannot-start-run-elasticsearch-on-os-x/98287)

<div class="topic-metadata">

**Author:** [@stevepetcu](https://discuss.elastic.co/u/stevepetcu)\
**Replies:** 2\
**Last updated:** [August 25, 2017, 5:18pm UTC](https://discuss.elastic.co/t/cannot-start-run-elasticsearch-on-os-x/98287 "2017-08-25T17:18:21Z")

</div>

Hi, I’ve been programming for a few years and now I’d like to learn some Java. I thought a good way to do it would be by contributing to ElasticSearch. Keep in mind that I’m a complete noob with everything Java right no…

---

## [Need to know about Watcher configuration](https://discuss.elastic.co/t/need-to-know-about-watcher-configuration/37289)

<div class="topic-metadata">

**Author:** [@asifalis](https://discuss.elastic.co/u/asifalis)\
**Replies:** 2\
**Last updated:** [December 16, 2015, 12:02am UTC](https://discuss.elastic.co/t/need-to-know-about-watcher-configuration/37289 "2015-12-16T00:02:47Z")

</div>

Hi Elastic Team. I have installed ELK and its working fine as expected, just need know about Watcher plugin and its configuration how it works, hope one of you team member provide me good stuff to setup Watcher in deta…

---

## [ES\_TMPDIR not setting all temporary files](https://discuss.elastic.co/t/es-tmpdir-not-setting-all-temporary-files/324019)

<div class="topic-metadata">

**Author:** [@lquenti](https://discuss.elastic.co/u/lquenti)\
**Replies:** 1\
**Last updated:** [January 26, 2023, 12:00pm UTC](https://discuss.elastic.co/t/es-tmpdir-not-setting-all-temporary-files/324019 "2023-01-26T12:00:42Z")

</div>

Hi all, I am currently trying to set up elasticsearch with a read-only config directory within a docker based on the elasticsearch image. After thoroughly reading the docs, the only related Option I found was the ES\_TMP…

---

## [How to modify the setting parameters of the index](https://discuss.elastic.co/t/how-to-modify-the-setting-parameters-of-the-index/218722)

<div class="topic-metadata">

**Author:** [@k3v8ns](https://discuss.elastic.co/u/k3v8ns)\
**Replies:** 1\
**Last updated:** [February 12, 2020, 4:42pm UTC](https://discuss.elastic.co/t/how-to-modify-the-setting-parameters-of-the-index/218722 "2020-02-12T16:42:05Z")

</div>

i want to modify all index settings config in index\_settings. rally version: 1.3.0 cmd: esrally race --track=geonames --track-params=index\_settings: \["index.number\_of\_shards:1","index.number\_of\_replicas:1"\] or es…

---

## [After Installing X-pack security in elasticsearch 7.2 .My default password "changeme" not working](https://discuss.elastic.co/t/after-installing-x-pack-security-in-elasticsearch-7-2-my-default-password-changeme-not-working/212930)

<div class="topic-metadata">

**Author:** [@viveknagar](https://discuss.elastic.co/u/viveknagar)\
**Replies:** 1\
**Last updated:** [December 24, 2019, 10:57am UTC](https://discuss.elastic.co/t/after-installing-x-pack-security-in-elasticsearch-7-2-my-default-password-changeme-not-working/212930 "2019-12-24T10:57:13Z")

</div>

Hello, I am using elastic search 7.2.0. I have installed xpack successfully from the below configurations. But I am unable to use my default password "changeme" .Or is there any way to set a default password in configm…

---

## [APM Errors not Showing in Kibana](https://discuss.elastic.co/t/apm-errors-not-showing-in-kibana/212158)

<div class="topic-metadata">

**Author:** [@akosanovic](https://discuss.elastic.co/u/akosanovic)\
**Replies:** 1\
**Last updated:** [December 20, 2019, 10:50am UTC](https://discuss.elastic.co/t/apm-errors-not-showing-in-kibana/212158 "2019-12-20T10:50:08Z")

</div>

Steps To Repro: Create new Angular 8 project using Angular CLI Add APM Rum agent following the instructions from the official documentation Throw Error on App Init ngOnInit() { throw Error('Error occure…

---

## [Docker autodiscover with default template harvests logs multiple times](https://discuss.elastic.co/t/docker-autodiscover-with-default-template-harvests-logs-multiple-times/173490)

<div class="topic-metadata">

**Author:** [@FSeidinger](https://discuss.elastic.co/u/FSeidinger)\
**Replies:** 1\
**Last updated:** [March 25, 2019, 10:25am UTC](https://discuss.elastic.co/t/docker-autodiscover-with-default-template-harvests-logs-multiple-times/173490 "2019-03-25T10:25:09Z")

</div>

I tried the autodiscover with docker containers only, like described in https://github.com/elastic/beats/issues/6084 and it fails with parsing docker log files multiple times. Consider the following config: filebeat.au…

---

## [XML parsing logstash, adding part of XML tags to an array per event](https://discuss.elastic.co/t/xml-parsing-logstash-adding-part-of-xml-tags-to-an-array-per-event/94827)

<div class="topic-metadata">

**Author:** [@g\_dev](https://discuss.elastic.co/u/g_dev)\
**Replies:** 1\
**Last updated:** [August 5, 2017, 6:03pm UTC](https://discuss.elastic.co/t/xml-parsing-logstash-adding-part-of-xml-tags-to-an-array-per-event/94827 "2017-08-05T18:03:45Z")

</div>

I'm trying to parsing xml file using multiline, and inside the main tag(from mutiline pattern) I want another tag to add to an array Issue --\> I'm not able to get \<INV\_HW\_STANDARD\_MODULES\> into an array and later I can …

---

## [Graph 2.3.1+ shield problem](https://discuss.elastic.co/t/graph-2-3-1-shield-problem/46549)

<div class="topic-metadata">

**Author:** [@Grazius](https://discuss.elastic.co/u/Grazius)\
**Replies:** 1\
**Last updated:** [April 6, 2016, 6:47pm UTC](https://discuss.elastic.co/t/graph-2-3-1-shield-problem/46549 "2016-04-06T18:47:07Z")

</div>

Hi all i got a problem with a fresh install of Graph 2.3.1 When i try to make a search i got an authentication message ! I don't found if i need a special role in my roles.yml for graph ... Thx for help

---

## [Index\_buffer\_size vs max\_index\_buffer\_size](https://discuss.elastic.co/t/index-buffer-size-vs-max-index-buffer-size/39586)

<div class="topic-metadata">

**Author:** [@Chris\_Fraschetti](https://discuss.elastic.co/u/Chris_Fraschetti)\
**Replies:** 1\
**Last updated:** [January 20, 2016, 8:56am UTC](https://discuss.elastic.co/t/index-buffer-size-vs-max-index-buffer-size/39586 "2016-01-20T08:56:30Z")

</div>

I'm currently running ES 1.7.1 although the docs for this haven't changed so I'm not sure that's relevant. The docs for these settings give a fairly decent explanation of these settings but it's a bit unclear why max\_in…

---

## [Changing index replication factor to 0](https://discuss.elastic.co/t/changing-index-replication-factor-to-0/305482)

<div class="topic-metadata">

**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\
**Replies:** 4\
**Last updated:** [May 24, 2022, 10:08am UTC](https://discuss.elastic.co/t/changing-index-replication-factor-to-0/305482 "2022-05-24T10:08:35Z")

</div>

Currently I am working on a single node Elasticsearch setup. But the replication factor was set to 1 by default. The space on my node is 3TB. If I decrease the replication factor to 0 , what will happen in that case? O…

---

## [Alerts and Actions proxy for connectors](https://discuss.elastic.co/t/alerts-and-actions-proxy-for-connectors/251476)

<div class="topic-metadata">

**Author:** [@Sinios](https://discuss.elastic.co/u/Sinios)\
**Replies:** 4\
**Last updated:** [October 15, 2020, 8:47am UTC](https://discuss.elastic.co/t/alerts-and-actions-proxy-for-connectors/251476 "2020-10-15T08:47:10Z")

</div>

Hello, I am playing with the new feature "Alerts and Actions" which seems very interessting but we are facing one issue: we can not specify the proxy for Slack alerting like we did before with the watcher Is there any …

---

## [Kibana showing normal percentage mode as stacked bug](https://discuss.elastic.co/t/kibana-showing-normal-percentage-mode-as-stacked-bug/207328)

<div class="topic-metadata">

**Author:** [@Xuan\_Nam\_Dang](https://discuss.elastic.co/u/Xuan_Nam_Dang)\
**Replies:** 4\
**Last updated:** [November 18, 2019, 8:08pm UTC](https://discuss.elastic.co/t/kibana-showing-normal-percentage-mode-as-stacked-bug/207328 "2019-11-18T20:08:02Z")

</div>

Hi, I am trying to show a success rate of builds in percentage mode using Count of Y-axis as an aggregation. When I set my: Metrics mode in normal and Y-axes in normal, it shows the data as expected(picture 1). Metri…

---

## [Kibana Index pattern dynamic](https://discuss.elastic.co/t/kibana-index-pattern-dynamic/119084)

<div class="topic-metadata">

**Author:** [@Jathin](https://discuss.elastic.co/u/Jathin)\
**Replies:** 4\
**Last updated:** [February 9, 2018, 4:45pm UTC](https://discuss.elastic.co/t/kibana-index-pattern-dynamic/119084 "2018-02-09T16:45:05Z")

</div>

I have a Log stream to ES indices that roll daily and i need to store 90 days of data. How can i setup a dashboard that searches data from last two days. And then when needed extrapolate to old dates when needed. Cur…

---

## [Scan and Scroll in Cluster](https://discuss.elastic.co/t/scan-and-scroll-in-cluster/88902)

<div class="topic-metadata">

**Author:** [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)\
**Replies:** 4\
**Last updated:** [June 12, 2017, 4:44pm UTC](https://discuss.elastic.co/t/scan-and-scroll-in-cluster/88902 "2017-06-12T16:44:10Z")

</div>

Hi All, Suppose if we have the cluster of three nodes, Can we use scroll\_id which we get from node\_1 and use the same on node\_2 to get the remaining result?

---

## [Http/gelf/beats input host mask not working (docker network)](https://discuss.elastic.co/t/http-gelf-beats-input-host-mask-not-working-docker-network/86128)

<div class="topic-metadata">

**Author:** [@pir1981](https://discuss.elastic.co/u/pir1981)\
**Replies:** 4\
**Last updated:** [May 26, 2017, 2:36pm UTC](https://discuss.elastic.co/t/http-gelf-beats-input-host-mask-not-working-docker-network/86128 "2017-05-26T14:36:26Z")

</div>

Hi, I am trying to allow input only from my own network and thus have the following .conf input{ gelf { type =\> "log" # host =\> "172.16.0.0" # port =\> 12201 } beats { # …

---

## [Having trouble with basic guide, doesn't appear to read any logs](https://discuss.elastic.co/t/having-trouble-with-basic-guide-doesnt-appear-to-read-any-logs/62646)

<div class="topic-metadata">

**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\
**Replies:** 4\
**Last updated:** [October 11, 2016, 12:15pm UTC](https://discuss.elastic.co/t/having-trouble-with-basic-guide-doesnt-appear-to-read-any-logs/62646 "2016-10-11T12:15:58Z")

</div>

hi everyone, I'm trying to setup logstash and am following this guide https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html However, I am not seeing any output from logstash (should I?) when I run th…

---

## [Visualizations getting reordered in dashboard](https://discuss.elastic.co/t/visualizations-getting-reordered-in-dashboard/43795)

<div class="topic-metadata">

**Author:** [@mad\_min](https://discuss.elastic.co/u/mad_min)\
**Replies:** 4\
**Last updated:** [March 22, 2016, 4:47pm UTC](https://discuss.elastic.co/t/visualizations-getting-reordered-in-dashboard/43795 "2016-03-22T16:47:32Z")

</div>

Hello list, I am facing an issue where dashboards with several visualizations are getting reordered across sessions (even after saving). The visualizations end up in a completely random order. Is this a known issue? An…

---

## [Hunspell filter problem](https://discuss.elastic.co/t/hunspell-filter-problem/34196)

<div class="topic-metadata">

**Author:** [@JohnB](https://discuss.elastic.co/u/JohnB)\
**Replies:** 4\
**Last updated:** [November 12, 2015, 5:23pm UTC](https://discuss.elastic.co/t/hunspell-filter-problem/34196 "2015-11-12T17:23:02Z")

</div>

Hello, I cant seem to make the hunspell filter to work. My config: curl -XPUT "http://localhost:9200/test\_index" -d' { "settings": { "analysis": { "analyzer": { "my\_analyzer": { …

---

## [Is there anyway to stop arrays with one element from being returned as a single value](https://discuss.elastic.co/t/is-there-anyway-to-stop-arrays-with-one-element-from-being-returned-as-a-single-value/12704)

<div class="topic-metadata">

**Author:** [@Raja\_Mukherji](https://discuss.elastic.co/u/Raja_Mukherji)\
**Replies:** 4\
**Last updated:** [July 9, 2013, 4:24pm UTC](https://discuss.elastic.co/t/is-there-anyway-to-stop-arrays-with-one-element-from-being-returned-as-a-single-value/12704 "2013-07-09T16:24:57Z")

</div>

I'm using elasticsearch as my main database. I'm using some fields as arrays, and always upload arrays for those fields even if there's only one element in the array. The \_source always contains the unchanged array, …

---

## [Refresh in pipeline: output and/or filter](https://discuss.elastic.co/t/refresh-in-pipeline-output-and-or-filter/278044)

<div class="topic-metadata">

**Author:** [@itokai](https://discuss.elastic.co/u/itokai)\
**Replies:** 6\
**Last updated:** [August 4, 2021, 6:54am UTC](https://discuss.elastic.co/t/refresh-in-pipeline-output-and-or-filter/278044 "2021-08-04T06:54:33Z")

</div>

Hi, in logstash pipeline consecutive documents are consumed from RabbitMQ. Sometimes need to perform lookup on already imported documents via filter-\>elasticsearch-\>query\_template. However, lookup doesn't query the lat…

---

## [Var/audit logs messages include wierd characters](https://discuss.elastic.co/t/var-audit-logs-messages-include-wierd-characters/165443)

<div class="topic-metadata">

**Author:** [@qnator](https://discuss.elastic.co/u/qnator)\
**Replies:** 6\
**Last updated:** [January 29, 2019, 6:34am UTC](https://discuss.elastic.co/t/var-audit-logs-messages-include-wierd-characters/165443 "2019-01-29T06:34:36Z")

</div>

Hello, My current setup on my machine is: Elasticsearch 6.5.4 Kibana 6.5.4 logstash 6.5.4 On a remote machine: filebeat 6.5.4 The output for filebeat is logstash and its configured to pu…

---

## [Source Maps are causing slice out of bounds exception](https://discuss.elastic.co/t/source-maps-are-causing-slice-out-of-bounds-exception/163764)

<div class="topic-metadata">

**Author:** [@Gegenki](https://discuss.elastic.co/u/Gegenki)\
**Replies:** 6\
**Last updated:** [January 15, 2019, 9:48am UTC](https://discuss.elastic.co/t/source-maps-are-causing-slice-out-of-bounds-exception/163764 "2019-01-15T09:48:43Z")

</div>

My APM server had stopped running shortly after uploading source maps for my node application. I tried to run my node server again and the APM server crashed again. I used Kibana to delete the source map index. When m…

---

## [Setup-passwords ERROR: Unknown error](https://discuss.elastic.co/t/setup-passwords-error-unknown-error/143283)

<div class="topic-metadata">

**Author:** [@ssolanoballester](https://discuss.elastic.co/u/ssolanoballester)\
**Replies:** 6\
**Last updated:** [August 8, 2018, 9:08am UTC](https://discuss.elastic.co/t/setup-passwords-error-unknown-error/143283 "2018-08-08T09:08:03Z")

</div>

Hi all, I recently installed elastic 6.2.2 with xpack. I'm trying to set password to elastic user, but I got an Unknow error. There is no messages in cluster log. \[elastic@elastic\]$ bin/x-pack/setup-passwords interact…

---

## [ERROR unexcepted token in Kibana Dev Contributing](https://discuss.elastic.co/t/error-unexcepted-token-in-kibana-dev-contributing/125533)

<div class="topic-metadata">

**Author:** [@Luan\_Ha\_Thanh](https://discuss.elastic.co/u/Luan_Ha_Thanh)\
**Replies:** 6\
**Last updated:** [March 26, 2018, 4:42am UTC](https://discuss.elastic.co/t/error-unexcepted-token-in-kibana-dev-contributing/125533 "2018-03-26T04:42:51Z")

</div>

Hello everyone! I want to build a plugin in Kibana. So I followed guide in think: https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md But when I run: yarn start It has more errors, example: ERROR in ./nod…

---

## [Different results from two clusters on different data center](https://discuss.elastic.co/t/different-results-from-two-clusters-on-different-data-center/32697)

<div class="topic-metadata">

**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Replies:** 6\
**Last updated:** [October 22, 2015, 10:12am UTC](https://discuss.elastic.co/t/different-results-from-two-clusters-on-different-data-center/32697 "2015-10-22T10:12:19Z")

</div>

We deployed our ES cluster on two Azure data centers, and the two cluster contains exactly same index schema and documents. The issue we found is, when querying same terms, the results from these two cluster are sligh…

---

## [Snowflake to Elasticsearch Using Logtsash](https://discuss.elastic.co/t/snowflake-to-elasticsearch-using-logtsash/341785)

<div class="topic-metadata">

**Author:** [@ksaimohan2k](https://discuss.elastic.co/u/ksaimohan2k)\
**Replies:** 3\
**Last updated:** [August 31, 2023, 7:01am UTC](https://discuss.elastic.co/t/snowflake-to-elasticsearch-using-logtsash/341785 "2023-08-31T07:01:17Z")

</div>

We are migrating data from Snowflake to Elasticsearch using the Logtsash driver. I took the logstash conf file template from \[Pull data from Snowflake with logstash | by Izek Chen | Medium\]. Below is the Logstash confi…

---

## [Real Browser monitoring and Captcha](https://discuss.elastic.co/t/real-browser-monitoring-and-captcha/311161)

<div class="topic-metadata">

**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Replies:** 3\
**Last updated:** [August 22, 2022, 12:41pm UTC](https://discuss.elastic.co/t/real-browser-monitoring-and-captcha/311161 "2022-08-22T12:41:33Z")

</div>

A client ask to monitor a login page with Real Browser monitoring, the login contains a captcha, how can we bypass or solve the captcha?

---

## [Planned change of license to SSPL](https://discuss.elastic.co/t/planned-change-of-license-to-sspl/261279)

<div class="topic-metadata">

**Author:** [@johann-petrak](https://discuss.elastic.co/u/johann-petrak)\
**Replies:** 3\
**Last updated:** [January 22, 2021, 5:50pm UTC](https://discuss.elastic.co/t/planned-change-of-license-to-sspl/261279 "2021-01-22T17:50:52Z")

</div>

I think the planned change from Apache 2 to SSPL for ES and Kibana will not just motivate myself to seriously look for other solutions. (see https://www.elastic.co/blog/licensing-change) SSPL seems to be extremely rest…

---

## [\[WARN \]\[org.apache.kafka.clients.NetworkClient\] \[Consumer clientId=logstash-0, groupId=logstash\] Connection to node -1 could not be established. Broker may not be available](https://discuss.elastic.co/t/warn-org-apache-kafka-clients-networkclient-consumer-clientid-logstash-0-groupid-logstash-connection-to-node-1-could-not-be-established-broker-may-not-be-available/148571)

<div class="topic-metadata">

**Author:** [@aerys\_targaryen](https://discuss.elastic.co/u/aerys_targaryen)\
**Replies:** 0\
**Last updated:** [September 14, 2018, 7:29am UTC](https://discuss.elastic.co/t/warn-org-apache-kafka-clients-networkclient-consumer-clientid-logstash-0-groupid-logstash-connection-to-node-1-could-not-be-established-broker-may-not-be-available/148571 "2018-09-14T07:29:44Z")

</div>

Hello Im installing logstash arcsight module to ship logs from smartconnectors to es. my command looks like this: \[root@srv-hostname bin\] ./logstash --modules arcsight --setup --path.settings /etc/logstash/ " -M "…

---

## [Query Help: must\_not keeps matching document](https://discuss.elastic.co/t/query-help-must-not-keeps-matching-document/122762)

<div class="topic-metadata">

**Author:** [@aaronloesattv](https://discuss.elastic.co/u/aaronloesattv)\
**Replies:** 3\
**Last updated:** [March 6, 2018, 9:17pm UTC](https://discuss.elastic.co/t/query-help-must-not-keeps-matching-document/122762 "2018-03-06T21:17:33Z")

</div>

I'm trying to write a watcher alert that triggers when any other watcher alert fails to execute. However, due to a bug, we're getting a lot of failed watch executions because a given watch is executed at the same time by…

---

## [Identify and delete duplicates on several indexes](https://discuss.elastic.co/t/identify-and-delete-duplicates-on-several-indexes/111317)

<div class="topic-metadata">

**Author:** [@zeusviper](https://discuss.elastic.co/u/zeusviper)\
**Replies:** 0\
**Last updated:** [December 12, 2017, 11:21am UTC](https://discuss.elastic.co/t/identify-and-delete-duplicates-on-several-indexes/111317 "2017-12-12T11:21:55Z")

</div>

Hello, I search a lot in the threads but still can't find a solution. Following to issue with my batch, I got to refeed my elastic but like I use some dated index, the \_id param was not sufficient to keep some unicity.…

---

## [Error while setting up enviromental variables](https://discuss.elastic.co/t/error-while-setting-up-enviromental-variables/88532)

<div class="topic-metadata">

**Author:** [@Kvin](https://discuss.elastic.co/u/Kvin)\
**Replies:** 3\
**Last updated:** [June 14, 2017, 9:28am UTC](https://discuss.elastic.co/t/error-while-setting-up-enviromental-variables/88532 "2017-06-14T09:28:34Z")

</div>

I have the following line in my Logstash RabbitMQ input: arguments =\> { "x-max-length" =\> 250000 } I want the value to be easily changable, so I would like to store it in an enviromental variable. arguments =\> { "x…

[Previous page](https://discuss.elastic.co/top.md?page=1424&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1426&per_page=50&period=all)
