# Top **URL:** https://discuss.elastic.co/top.md?page=1441&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1442 --- ## [Monitoring: Elastic Data Nodes - System Load](https://discuss.elastic.co/t/monitoring-elastic-data-nodes-system-load/109095)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 2\ **Last updated:** [November 27, 2017, 1:55pm UTC](https://discuss.elastic.co/t/monitoring-elastic-data-nodes-system-load/109095 "2017-11-27T13:55:26Z")
Would like to know the acceptable System Load metrics for elasticsearch data node which is between 0.5 to 3. --- ## [Nginx SSL config](https://discuss.elastic.co/t/nginx-ssl-config/100232)
**Author:** [@kwojcicki](https://discuss.elastic.co/u/kwojcicki)\ **Replies:** 2\ **Last updated:** [September 12, 2017, 3:34pm UTC](https://discuss.elastic.co/t/nginx-ssl-config/100232 "2017-09-12T15:34:15Z")
The nginx docker image I am using sends everything to https which causes metricbeat to print out the following logs in elasticsearch error making http request: Get https://ui:443/server-status: x509: failed to load syste… --- ## [Mysql module in metricbeats is displaying negative values](https://discuss.elastic.co/t/mysql-module-in-metricbeats-is-displaying-negative-values/87501)
**Author:** [@shivnath](https://discuss.elastic.co/u/shivnath)\ **Replies:** 2\ **Last updated:** [May 30, 2017, 9:01am UTC](https://discuss.elastic.co/t/mysql-module-in-metricbeats-is-displaying-negative-values/87501 "2017-05-30T09:01:33Z")
I am seeing negative values for some of the fields. Please see attached screenshots. This happened when I stopped the MySQL database for some time. My version: yum list | grep metricbeat metricbeat.x86\_64 … --- ## [Unable to search documents in Kibana that is indexed using attachment plugin](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [November 18, 2016, 2:18am UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362 "2016-11-18T02:18:49Z")
I have indexed a base64 encoded attachment using latest ingest-attachment plugin. My elsaticsearch and kibana environment is below. \[root@filebeat elasticsearch\]# rpm -qa | grep kibana kibana-5.0.1-1.x86\_64 \[root@fileb… --- ## [Adding GeoIP using logstash](https://discuss.elastic.co/t/adding-geoip-using-logstash/55621)
**Author:** [@vishnubraj](https://discuss.elastic.co/u/vishnubraj)\ **Replies:** 2\ **Last updated:** [July 15, 2016, 8:07pm UTC](https://discuss.elastic.co/t/adding-geoip-using-logstash/55621 "2016-07-15T20:07:52Z")
Hi, I am trying to add geoip detail for my data. I only want the longitude and latitude value. I have the below filter config. filter { if \[label\] == "edge" { geoip { … --- ## [Elasticsearch cluster failed since 2.1.1 - Transport error](https://discuss.elastic.co/t/elasticsearch-cluster-failed-since-2-1-1-transport-error/37506)
**Author:** [@davmrtl](https://discuss.elastic.co/u/davmrtl)\ **Replies:** 2\ **Last updated:** [December 17, 2015, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-failed-since-2-1-1-transport-error/37506 "2015-12-17T20:43:10Z")
Hi, I've juste upgrated my two nodes Elasticsearch cluster to 2.1.1 and since, the cluster stays yellow and no replica shard is able to get over the INIT state. Am I the only one with this problem? David --- ## [Setup Elasticsearch for In-Memory Usage: Configuration and Index Size Estimation](https://discuss.elastic.co/t/setup-elasticsearch-for-in-memory-usage-configuration-and-index-size-estimation/359054)
**Author:** [@M.S.S](https://discuss.elastic.co/u/M.S.S)\ **Replies:** 5\ **Last updated:** [May 9, 2024, 1:12pm UTC](https://discuss.elastic.co/t/setup-elasticsearch-for-in-memory-usage-configuration-and-index-size-estimation/359054 "2024-05-09T13:12:44Z")
Hey everyone, We're looking into maximizing Elasticsearch's performance by leveraging memory usage to its fullest potential. We hypothesize that reducing disk I/O by running Elasticsearch entirely in memory could lead t… --- ## [Ways to purge deleted documents in 4TB indice](https://discuss.elastic.co/t/ways-to-purge-deleted-documents-in-4tb-indice/158988)
**Author:** [@orivera](https://discuss.elastic.co/u/orivera)\ **Replies:** 5\ **Last updated:** [December 15, 2018, 5:07pm UTC](https://discuss.elastic.co/t/ways-to-purge-deleted-documents-in-4tb-indice/158988 "2018-12-15T17:07:08Z")
Looking for an advice on how to get rid of all deleted documents in 4TB indice on a monthly basis. This indice is not a time series and it has lots deletes and writes all day long. These are the number of docs from \_sta… --- ## [Elasticsearch 6.4 вопросы по индексам](https://discuss.elastic.co/t/elasticsearch-6-4/160386)
**Author:** [@byldozer](https://discuss.elastic.co/u/byldozer)\ **Replies:** 5\ **Last updated:** [December 13, 2018, 12:07pm UTC](https://discuss.elastic.co/t/elasticsearch-6-4/160386 "2018-12-13T12:07:02Z")
Добрый день, Коллеги Хотел уточнить как правильно использовать и прописывать поля дабы сохранить дисковое пространство и при этом работали keywords (список доступных значений) в Kibana. Пример: "username": { … --- ## [Parsing Logstash Data](https://discuss.elastic.co/t/parsing-logstash-data/98685)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 5\ **Last updated:** [August 30, 2017, 11:51am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685 "2017-08-30T11:51:55Z")
Hi - I have the below message coming to the ELK, and I’d like to parse those values and create a mapping (Key =\> Value) and add as separate field in Elastic Search. \[image\] Please let me know how could I do this. --- ## [Language support in Standard plan](https://discuss.elastic.co/t/language-support-in-standard-plan/175733)
**Author:** [@kuraga](https://discuss.elastic.co/u/kuraga)\ **Replies:** 2\ **Last updated:** [April 8, 2019, 11:26am UTC](https://discuss.elastic.co/t/language-support-in-standard-plan/175733 "2019-04-08T11:26:37Z")
Good day! As of plans' description, Standard plan doesn't have multilingual support. So, only one language is supported. But which? English only, or on my decision? Thanks! --- ## [Text\_embedding configured for model but rejected for query](https://discuss.elastic.co/t/text-embedding-configured-for-model-but-rejected-for-query/357163)
**Author:** [@wnmills3](https://discuss.elastic.co/u/wnmills3)\ **Replies:** 8\ **Last updated:** [May 5, 2024, 6:45pm UTC](https://discuss.elastic.co/t/text-embedding-configured-for-model-but-rejected-for-query/357163 "2024-05-05T18:45:50Z")
I have issued a query like below: { "query": { "bool": { "should": \[ { "text\_embedding": { "path\_embedding.tokens": { … --- ## [How can we pass elasticapm object for a function inside the threadpool executor](https://discuss.elastic.co/t/how-can-we-pass-elasticapm-object-for-a-function-inside-the-threadpool-executor/337646)
**Author:** [@sairam\_kadakuntla](https://discuss.elastic.co/u/sairam_kadakuntla)\ **Replies:** 8\ **Last updated:** [July 18, 2023, 11:52am UTC](https://discuss.elastic.co/t/how-can-we-pass-elasticapm-object-for-a-function-inside-the-threadpool-executor/337646 "2023-07-18T11:52:17Z")
how can we pass elastic apm object through threadpool and add labels to that function --- ## [Can't run curl in terminal](https://discuss.elastic.co/t/cant-run-curl-in-terminal/312469)
**Author:** [@Sarindra\_Therese](https://discuss.elastic.co/u/Sarindra_Therese)\ **Replies:** 0\ **Last updated:** [August 19, 2022, 12:43pm UTC](https://discuss.elastic.co/t/cant-run-curl-in-terminal/312469 "2022-08-19T12:43:56Z")
Hi Everyone, I don't know what's happen, but i can't run curl cmd in terminal, I've already ran curl -GET https://127.0.0.1:9200 and the response is: curl: (58) could not load PEM client certificate, OpenSSL error e… --- ## [Filebeat fields value unable to use it in logstash configuration file](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614)
**Author:** [@navin1093](https://discuss.elastic.co/u/navin1093)\ **Replies:** 8\ **Last updated:** [January 10, 2021, 11:20pm UTC](https://discuss.elastic.co/t/filebeat-fields-value-unable-to-use-it-in-logstash-configuration-file/260614 "2021-01-10T23:20:24Z")
I have set custom name in filebeat input section. However, in logstash configuration file it was unable to be use Filebeat config file - type: log enabled: true paths: ... fields: - name\_of\_index: group-1… --- ## [Can not get Kibana-\>Management-\> Security section](https://discuss.elastic.co/t/can-not-get-kibana-management-security-section/236179)
**Author:** [@Gvantsa](https://discuss.elastic.co/u/Gvantsa)\ **Replies:** 3\ **Last updated:** [June 23, 2020, 7:23am UTC](https://discuss.elastic.co/t/can-not-get-kibana-management-security-section/236179 "2020-06-23T07:23:32Z")
I am just starting with ELK. I have basic license on prem and elastic search and kibana versions is 7.6.1 I performed the flowing steps: Enable security in elasticseach.yml --\> xpack.security.enabled: true Generate t… --- ## [Semantics: How are document\_type, mapping\_type, and mapping defined and different?](https://discuss.elastic.co/t/semantics-how-are-document-type-mapping-type-and-mapping-defined-and-different/231394)
**Author:** [@aorona](https://discuss.elastic.co/u/aorona)\ **Replies:** 3\ **Last updated:** [May 8, 2020, 12:38am UTC](https://discuss.elastic.co/t/semantics-how-are-document-type-mapping-type-and-mapping-defined-and-different/231394 "2020-05-08T00:38:31Z")
I an indexing my documents with an explicit mapping that I have specified. These documents: have a document type (\_doc): a metadata label, the type of document being indexed. have a mapping: Either dynamically establis… --- ## [Docker logstash terminated during first run](https://discuss.elastic.co/t/docker-logstash-terminated-during-first-run/118923)
**Author:** [@Stephen\_Im](https://discuss.elastic.co/u/Stephen_Im)\ **Replies:** 0\ **Last updated:** [February 7, 2018, 8:39pm UTC](https://discuss.elastic.co/t/docker-logstash-terminated-during-first-run/118923 "2018-02-07T20:39:32Z")
Hi, I am installing logstash on docker. I installed elasticsearch and kibana, but failed to run logstash. Below is the message I am getting. I created logstash.conf file under "/usr/share/logstash/pipelilne", but bel… --- ## [Connection refused and timed out error](https://discuss.elastic.co/t/connection-refused-and-timed-out-error/94224)
**Author:** [@Srikanth\_Bemineni](https://discuss.elastic.co/u/Srikanth_Bemineni)\ **Replies:** 0\ **Last updated:** [July 23, 2017, 4:30am UTC](https://discuss.elastic.co/t/connection-refused-and-timed-out-error/94224 "2017-07-23T04:30:21Z")
Using elasticsearch 5.4.0 with python library 5.4.0. The initial connection gets established fine, any add requests later ends up with a connection refused error. Updated elasticsearch to 5.5.0 and I am still seeing the … --- ## [Sparse Documents with "store" fields set to false](https://discuss.elastic.co/t/sparse-documents-with-store-fields-set-to-false/61549)
**Author:** [@Mike\_Wagner](https://discuss.elastic.co/u/Mike_Wagner)\ **Replies:** 3\ **Last updated:** [September 27, 2016, 3:58pm UTC](https://discuss.elastic.co/t/sparse-documents-with-store-fields-set-to-false/61549 "2016-09-27T15:58:10Z")
Is there still an impact on performance with sparse documents when store is set to false for all fields (the default)? Based on my reading it would still affect the inverted index in Lucene and also increase the doc valu… --- ## [Protos/http/http.go are packets in disorder handled?](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899)
**Author:** [@patricio.dorantes](https://discuss.elastic.co/u/patricio.dorantes)\ **Replies:** 3\ **Last updated:** [February 4, 2016, 4:50pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899 "2016-02-04T16:50:00Z")
I'm trying to understand packetbeat http code to monitor fcgi. I'm new in go language but the code below suggests me that streams are not separated by tcptuples just by dir. So if tcp packets are in disorder from differe… --- ## [Launching tribe node fails](https://discuss.elastic.co/t/launching-tribe-node-fails/38814)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [January 21, 2016, 11:31pm UTC](https://discuss.elastic.co/t/launching-tribe-node-fails/38814 "2016-01-21T23:31:22Z")
Wanting to install a tribe node locally with kibana so as to connect to two ES clusters. Trying to start the tribe node first just connecting to one cluster I get an error that hunspeel is unreadable as such file isn't … --- ## [Time problem](https://discuss.elastic.co/t/time-problem/17483)
**Author:** [@Quentin\_Guiot](https://discuss.elastic.co/u/Quentin_Guiot)\ **Replies:** 8\ **Last updated:** [May 20, 2014, 7:43am UTC](https://discuss.elastic.co/t/time-problem/17483 "2014-05-20T07:43:06Z")
hello I have a little problem with elasticsearch when using it with kibana and logstash when i lauch my logstash.conf, i get an error on kibana : "\*No results\* There were no results because no indices were fo… --- ## [Elasticsearch stops working suddenly](https://discuss.elastic.co/t/elasticsearch-stops-working-suddenly/15967)
**Author:** [@mehdi](https://discuss.elastic.co/u/mehdi)\ **Replies:** 3\ **Last updated:** [February 24, 2014, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-stops-working-suddenly/15967 "2014-02-24T15:04:45Z")
\- deleted - --- ## [ARM64 builds for Elasticsearch 5.6?](https://discuss.elastic.co/t/arm64-builds-for-elasticsearch-5-6/288665)
**Author:** [@cjbottaro](https://discuss.elastic.co/u/cjbottaro)\ **Replies:** 1\ **Last updated:** [November 8, 2021, 10:58pm UTC](https://discuss.elastic.co/t/arm64-builds-for-elasticsearch-5-6/288665 "2021-11-08T22:58:49Z")
We are unfortunately stuck on Es5 for the foreseeable future... and I just got a new M1 MacBook. Neither of these commands work. docker run --rm --platform linux/amd64 elasticsearch:5.6.16 docker run --rm --platform li… --- ## [“No processor type exists with name \[attachment\]”](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076)
**Author:** [@judy369](https://discuss.elastic.co/u/judy369)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 3:43am UTC](https://discuss.elastic.co/t/no-processor-type-exists-with-name-attachment/270076 "2021-04-14T03:43:02Z")
when i create pipline, curl --user elastic:ny123456 -H 'Content-Type: application/json' -XPUT 'http://192.168.250.49:9200/\_ingest/pipeline/attachment' -d' { "description" : "Extract attachment information", "… --- ## [Elastic Feature isn't exist at kibana 7.9.0](https://discuss.elastic.co/t/elastic-feature-isnt-exist-at-kibana-7-9-0/253398)
**Author:** [@psanggabuana](https://discuss.elastic.co/u/psanggabuana)\ **Replies:** 1\ **Last updated:** [October 29, 2020, 6:32pm UTC](https://discuss.elastic.co/t/elastic-feature-isnt-exist-at-kibana-7-9-0/253398 "2020-10-29T18:32:26Z")
Hi all, I have problem with my kibana. I dont know why elastic feature isnt exist in there, like as: This my log: initialized to green - Ready log \[12:44:17.934\] \[info\]\[status\]\[plugin:elasticsearch@7.9.0\] Status… --- ## [Index作成時のanalyzerの指定について](https://discuss.elastic.co/t/index-analyzer/199941)
**Author:** [@Masanori\_Mishima](https://discuss.elastic.co/u/Masanori_Mishima)\ **Replies:** 1\ **Last updated:** [September 18, 2019, 8:28am UTC](https://discuss.elastic.co/t/index-analyzer/199941 "2019-09-18T08:28:37Z")
node.jsのrequestモジュールからElasticsearch Service上のESインスタンスのエンドポイントURLへ以下のJsonをPUTした際に、400エラーになります。authの入れ方が悪いとかでしょうか？ request.put({ url: ${this.esUrl + '/' + indexName}, headers: { 'Content-type': 'application/json', }, … --- ## [Logstash not work after enable xpack.security](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631)
**Author:** [@Mrcow](https://discuss.elastic.co/u/Mrcow)\ **Replies:** 1\ **Last updated:** [June 10, 2019, 8:48pm UTC](https://discuss.elastic.co/t/logstash-not-work-after-enable-xpack-security/183631 "2019-06-10T20:48:50Z")
Recently i enabled xpack.security en elasticsearch but logstash stop working and i got this error: \[2019-05-30T17:16:08,636\]\[WARN \]\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance, … --- ## [Output file to create based on timestamp](https://discuss.elastic.co/t/output-file-to-create-based-on-timestamp/150880)
**Author:** [@pkshara](https://discuss.elastic.co/u/pkshara)\ **Replies:** 1\ **Last updated:** [October 4, 2018, 12:02pm UTC](https://discuss.elastic.co/t/output-file-to-create-based-on-timestamp/150880 "2018-10-04T12:02:19Z")
Hi Team, Please suggest for the below query, input { } filter { } output { file { path =\> "tmp/path/output-%{+YYYY-MM-dd}" } } This would create an output file based on the day wise / everyday new text file w… --- ## [Is it possible to have search box in Kibana dashboard?](https://discuss.elastic.co/t/is-it-possible-to-have-search-box-in-kibana-dashboard/133355)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 1\ **Last updated:** [May 25, 2018, 7:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-search-box-in-kibana-dashboard/133355 "2018-05-25T19:20:51Z")
Hi, I have a dashboard(metric count) based on search query "level:error AND type:project1". Is it possible to have a search box on the dashboard page where I can search with id(another field of an event)? Thanks --- ## [Creating a no-op QueryBuilder and FilterBuilder](https://discuss.elastic.co/t/creating-a-no-op-querybuilder-and-filterbuilder/23114)
**Author:** [@Todd\_Nine](https://discuss.elastic.co/u/Todd_Nine)\ **Replies:** 1\ **Last updated:** [April 7, 2015, 7:44am UTC](https://discuss.elastic.co/t/creating-a-no-op-querybuilder-and-filterbuilder/23114 "2015-04-07T07:44:53Z")
Hey all, I have a bit of an odd question, hopefully someone can give me an answer. In usergrid, we have our own existing query language. We parse this language into an AST, then visit each of the nodes and const… --- ## [Alert when host(server) is down](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 4\ **Last updated:** [November 21, 2024, 1:56pm UTC](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688 "2024-11-21T13:56:17Z")
Hello everyone! Could you please tell me if there are any ways to create an alert if some server is down or elastic-agent stopped send logs to the Elastic --- ## [Hashing in ElasticSearch](https://discuss.elastic.co/t/hashing-in-elasticsearch/336470)
**Author:** [@Sahil5](https://discuss.elastic.co/u/Sahil5)\ **Replies:** 4\ **Last updated:** [June 22, 2023, 5:05am UTC](https://discuss.elastic.co/t/hashing-in-elasticsearch/336470 "2023-06-22T05:05:08Z")
Hello Team, We have a requirement to store an array of 100,000 users in an Elasticsearch field. During search, we need to match if a user exists in that array and return the corresponding document. Is it possible to ac… --- ## [Error when installing/enrolling Fleet Server](https://discuss.elastic.co/t/error-when-installing-enrolling-fleet-server/332294)
**Author:** [@Miguel\_Azorin](https://discuss.elastic.co/u/Miguel_Azorin)\ **Replies:** 4\ **Last updated:** [May 4, 2023, 9:58am UTC](https://discuss.elastic.co/t/error-when-installing-enrolling-fleet-server/332294 "2023-05-04T09:58:38Z")
Hi, I've been trying to deploy a Fleet Server (ELK stack 7.17.6), but I'm running into a problem I cannot solve, and the logs don't give enough info for me to figure it out (also, there is nothing about this in the elas… --- ## [EQL Sequence doesn't correlate events having same exact timestamp?](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 4\ **Last updated:** [May 12, 2021, 9:02am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845 "2021-05-12T09:02:31Z")
Hello, I was trying to hunt for a specific behavior with EQL sequences and I have a question. If events have the same exact timestamp EQL won't work. Here is an example EQL Query : sequence by winlog.event\_data.Targe… --- ## [ILM setting in beats configuration](https://discuss.elastic.co/t/ilm-setting-in-beats-configuration/179257)
**Author:** [@syedsfayaz](https://discuss.elastic.co/u/syedsfayaz)\ **Replies:** 4\ **Last updated:** [May 1, 2019, 9:56pm UTC](https://discuss.elastic.co/t/ilm-setting-in-beats-configuration/179257 "2019-05-01T21:56:43Z")
Hi I am seeing ilm errors in my Elastic search. I am currently using beats 6.7 version. I am planning to install version 7 now. I got to know that filebeat has to create an alias while creating an index. I see the bel… --- ## [How can i parse the data with comma seperated in logstash](https://discuss.elastic.co/t/how-can-i-parse-the-data-with-comma-seperated-in-logstash/153880)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 4\ **Last updated:** [October 25, 2018, 6:58am UTC](https://discuss.elastic.co/t/how-can-i-parse-the-data-with-comma-seperated-in-logstash/153880 "2018-10-25T06:58:23Z")
I have the below log format which is sending it to logstash through filebeat. I would like to create fields from these and send it to kibana. server1, cpu, 10, xinfo xyz wwer 2, xyzz server2, mem, 25 , xyzinfo abc 123… --- ## [Lucen/Elasticsearch: a query for a fiield with multiple values](https://discuss.elastic.co/t/lucen-elasticsearch-a-query-for-a-fiield-with-multiple-values/51253)
**Author:** [@sen](https://discuss.elastic.co/u/sen)\ **Replies:** 4\ **Last updated:** [May 30, 2016, 12:48pm UTC](https://discuss.elastic.co/t/lucen-elasticsearch-a-query-for-a-fiield-with-multiple-values/51253 "2016-05-30T12:48:40Z")
Hello everyone, Lucen/Elasticsearch: a query for a filed with multiple valuesHere is what I would like to do. I have an index with several documents in Elasticsearch. In every document I have two field: deviceField (na… --- ## [Logstash with large log files](https://discuss.elastic.co/t/logstash-with-large-log-files/42163)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 4\ **Last updated:** [February 18, 2016, 7:30pm UTC](https://discuss.elastic.co/t/logstash-with-large-log-files/42163 "2016-02-18T19:30:34Z")
Hi, I have some Logstash that read Log files with some GBs. Some times this logstash stop to send logs to my redis and when I see, my log files have some Gbs. I using Logstash 1.4.2. There is some way to resolve this… --- ## [Getting average document size from a index with two types](https://discuss.elastic.co/t/getting-average-document-size-from-a-index-with-two-types/60689)
**Author:** [@hgfxng](https://discuss.elastic.co/u/hgfxng)\ **Replies:** 0\ **Last updated:** [September 16, 2016, 10:39am UTC](https://discuss.elastic.co/t/getting-average-document-size-from-a-index-with-two-types/60689 "2016-09-16T10:39:12Z")
Hi, I've enabled the \_size plugin and now I'm trying to get the average document size with the following query: { "query": { "match\_all": {} }, "aggs": { "avg\_size": { "avg": { "terms": { … --- ## [I want to create alert for same Source-ip and same destination-ip but different port](https://discuss.elastic.co/t/i-want-to-create-alert-for-same-source-ip-and-same-destination-ip-but-different-port/202816)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 6:12am UTC](https://discuss.elastic.co/t/i-want-to-create-alert-for-same-source-ip-and-same-destination-ip-but-different-port/202816 "2019-10-10T06:12:56Z")
Hello, My question is Trigger alert when Sourc-ip and Destination-ip is same but different destination port trigger alert and I am facing problem here is my configuration. PUT \_xpack/watcher/watch/vertical-port-scan {… --- ## [Unstable Events Rate/Throughput](https://discuss.elastic.co/t/unstable-events-rate-throughput/169003)
**Author:** [@Daniel\_Dalacort](https://discuss.elastic.co/u/Daniel_Dalacort)\ **Replies:** 2\ **Last updated:** [February 20, 2019, 1:11pm UTC](https://discuss.elastic.co/t/unstable-events-rate-throughput/169003 "2019-02-20T13:11:52Z")
Hello! I saw how filebeat metrics and noticed that event rate and throughput looks like jigsaw. but it's not because there is nothing to send. Our logfiles grows faster than filebeat sends events to elasticsearch. I … --- ## [Creating Logstash metrics beyond counts, like sum or avg on field values of processed documents](https://discuss.elastic.co/t/creating-logstash-metrics-beyond-counts-like-sum-or-avg-on-field-values-of-processed-documents/144219)
**Author:** [@mbreest](https://discuss.elastic.co/u/mbreest)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 8:00pm UTC](https://discuss.elastic.co/t/creating-logstash-metrics-beyond-counts-like-sum-or-avg-on-field-values-of-processed-documents/144219 "2018-08-13T20:00:52Z")
Hi folks, I have a use case, where I process log files from my CDN provider and want to count requests as well as the sum of bytes (bytes taken from log line) for the different products I have (set of domains or referre… --- ## [Query whether an integer is within a range of field values](https://discuss.elastic.co/t/query-whether-an-integer-is-within-a-range-of-field-values/142597)
**Author:** [@achton](https://discuss.elastic.co/u/achton)\ **Replies:** 2\ **Last updated:** [August 1, 2018, 3:21pm UTC](https://discuss.elastic.co/t/query-whether-an-integer-is-within-a-range-of-field-values/142597 "2018-08-01T15:21:52Z")
I have an index where documents contain two fields that together make up a range, ie: "office\_postal\_from" : \[ "1500", "1800", "2000" \], "office\_postal\_to" : \[ "1799", "1999", … --- ## [How to create a parent-child documents using High Level ES REST client](https://discuss.elastic.co/t/how-to-create-a-parent-child-documents-using-high-level-es-rest-client/135807)
**Author:** [@sudeepkumarnair](https://discuss.elastic.co/u/sudeepkumarnair)\ **Replies:** 2\ **Last updated:** [June 14, 2018, 12:26am UTC](https://discuss.elastic.co/t/how-to-create-a-parent-child-documents-using-high-level-es-rest-client/135807 "2018-06-14T00:26:34Z")
Consider the following piece of indexing code and please set know how i can add attributes to link parent and child documents. This piece of documentation is missing on Elasticseach site. Schema: PUT discovery-index/\_d… --- ## [How the logstash s3 input plugin handle load balance?](https://discuss.elastic.co/t/how-the-logstash-s3-input-plugin-handle-load-balance/87064)
**Author:** [@hanks](https://discuss.elastic.co/u/hanks)\ **Replies:** 2\ **Last updated:** [May 30, 2017, 12:29am UTC](https://discuss.elastic.co/t/how-the-logstash-s3-input-plugin-handle-load-balance/87064 "2017-05-30T00:29:32Z")
Hi, the question is if I have multi logstash servers and set the same conf to collect the s3 bucket, is the result become duplicate? And how to setup load balance for s3 input plugin? Thank you for your time. --- ## [Writing to multiple Elasticsearch Nodes](https://discuss.elastic.co/t/writing-to-multiple-elasticsearch-nodes/68553)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 7:54am UTC](https://discuss.elastic.co/t/writing-to-multiple-elasticsearch-nodes/68553 "2016-12-12T07:54:43Z")
I was just reading this article: https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html I'm wondering how writing to multiple Elasticsearch nodes works in Logstash. In particular, let's assume I am… --- ## [Is there a way to color every other row in Discover or the Search Object?](https://discuss.elastic.co/t/is-there-a-way-to-color-every-other-row-in-discover-or-the-search-object/55790)
**Author:** [@secumind](https://discuss.elastic.co/u/secumind)\ **Replies:** 2\ **Last updated:** [July 18, 2016, 10:59pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-color-every-other-row-in-discover-or-the-search-object/55790 "2016-07-18T22:59:55Z")
I find the discover page very hard to read when I have a lot of data in an index. Is there a an easy line(s) I can edit in Kibana 4's code to make every other row a light gray or something so that the differentiation bet… --- ## [Logstash error after filebeat restarted](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819)
**Author:** [@ivanandrianto95](https://discuss.elastic.co/u/ivanandrianto95)\ **Replies:** 2\ **Last updated:** [June 22, 2016, 2:43am UTC](https://discuss.elastic.co/t/logstash-error-after-filebeat-restarted/52819 "2016-06-22T02:43:13Z")
I got error in Logstash every time I restart Filebeat. To make logstash work again, I have to kll the Logstash process and restart it. How to fix it? Here is the error {:timestamp=\>"2016-06-15T00:48:30.697000-0400", :… [Previous page](https://discuss.elastic.co/top.md?page=1440&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1442&per_page=50&period=all)