# Top **URL:** https://discuss.elastic.co/top.md?page=1442&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1443 --- ## [Fingerprint does not work as expected](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550)
**Author:** [@Swen](https://discuss.elastic.co/u/Swen)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 3:43pm UTC](https://discuss.elastic.co/t/fingerprint-does-not-work-as-expected/51550 "2016-06-01T15:43:59Z")
I want to use a fingerprint to this into the document\_id. fingerprint { key =\> "78787878" method =\> "SHA1" } I expect this to make a hash from my 'message' and to see a 'fingerprint' variab… --- ## [Search count deprecated, how to get all buckets?](https://discuss.elastic.co/t/search-count-deprecated-how-to-get-all-buckets/46687)
**Author:** [@beckerdo](https://discuss.elastic.co/u/beckerdo)\ **Replies:** 2\ **Last updated:** [April 8, 2016, 4:47pm UTC](https://discuss.elastic.co/t/search-count-deprecated-how-to-get-all-buckets/46687 "2016-04-08T16:47:22Z")
I have an aggregation that sums a field and buckets the field by another field. I understand from Elastic 2.3 release changes that the search\_type=count is deprecated. I am running Elastic 2.2 and when I remove the se… --- ## [Linux Defend doesn't detect EICAR](https://discuss.elastic.co/t/linux-defend-doesnt-detect-eicar/362647)
**Author:** [@FranklinFurter](https://discuss.elastic.co/u/FranklinFurter)\ **Replies:** 6\ **Last updated:** [July 20, 2024, 12:57am UTC](https://discuss.elastic.co/t/linux-defend-doesnt-detect-eicar/362647 "2024-07-20T00:57:08Z")
I've been testing out Elastic Endpoint/Defend for Linux and i'm not sure if it's not setup correctly or what. The standard test of downloading the eicar file (of various forms) didn't trigger the malware sigantures for d… --- ## [Endpoint Security help](https://discuss.elastic.co/t/endpoint-security-help/305463)
**Author:** [@insurin](https://discuss.elastic.co/u/insurin)\ **Replies:** 6\ **Last updated:** [May 26, 2022, 7:19am UTC](https://discuss.elastic.co/t/endpoint-security-help/305463 "2022-05-26T07:19:36Z")
ELK 8.12 on Prem x1 server So far I have all my Active Directory domain controllers sending their logs into ELK server. This produces some great logs for me to view. I have added the Endpoint Security integration into m… --- ## [Log json in an array](https://discuss.elastic.co/t/log-json-in-an-array/295561)
**Author:** [@adouren](https://discuss.elastic.co/u/adouren)\ **Replies:** 6\ **Last updated:** [January 27, 2022, 3:20pm UTC](https://discuss.elastic.co/t/log-json-in-an-array/295561 "2022-01-27T15:20:47Z")
Hello, I am being asked to have the data as a table in kibana. I don't see what to do? My input json logs: {"indexName":"aaa-bbb","ip":"XXX.XXX.XXX.XXX","ipServer":"XXX.XXX.XXX.XXX","userAgent":"Mozilla/5.0 (Windows N… --- ## [Guidance for Production ELK stack box size and other memory components discuss](https://discuss.elastic.co/t/guidance-for-production-elk-stack-box-size-and-other-memory-components-discuss/200357)
**Author:** [@elk.beginners](https://discuss.elastic.co/u/elk.beginners)\ **Replies:** 6\ **Last updated:** [September 20, 2019, 8:18am UTC](https://discuss.elastic.co/t/guidance-for-production-elk-stack-box-size-and-other-memory-components-discuss/200357 "2019-09-20T08:18:38Z")
Hello All, Can anyone share the information about production configuration Box for ELK stack. Actually my aim to design centralised ELK Server with (Elastic+Logstash+Kibana installation) with sufficient memory configur… --- ## [Authentication in Kibana](https://discuss.elastic.co/t/authentication-in-kibana/173955)
**Author:** [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\ **Replies:** 6\ **Last updated:** [April 23, 2019, 4:38pm UTC](https://discuss.elastic.co/t/authentication-in-kibana/173955 "2019-04-23T16:38:21Z")
Hello, I have this use case: I want to have a web page (with authentication) with my kibana visualization embedded with different permissions. I want to have various users and match the user permissions of the web page … --- ## [Storage cost for Elastic Cloud](https://discuss.elastic.co/t/storage-cost-for-elastic-cloud/143088)
**Author:** [@kelvinsmj](https://discuss.elastic.co/u/kelvinsmj)\ **Replies:** 6\ **Last updated:** [August 6, 2018, 11:38pm UTC](https://discuss.elastic.co/t/storage-cost-for-elastic-cloud/143088 "2018-08-06T23:38:55Z")
Hi, I'd like to find out how storage cost works with Elastic Cloud. I've noticed that charges are per GB/RAM/hour, but there is no mention of storage. e.g. if I need 8TB storage, 64GB ram per node, how much it will co… --- ## [Фитрация doc value](https://discuss.elastic.co/t/doc-value/125696)
**Author:** [@GreenX](https://discuss.elastic.co/u/GreenX)\ **Replies:** 6\ **Last updated:** [April 2, 2018, 10:05pm UTC](https://discuss.elastic.co/t/doc-value/125696 "2018-04-02T22:05:18Z")
Доброго времени суток! Упражняюсь с doc value - не получается правильно их зафильтровать. Задача найти документ соответствующий запросу и отфильтрованными полем. Т.е. делаю индекс: { "settings" : { "number\_of\_s… --- ## [Grok WARN without using it](https://discuss.elastic.co/t/grok-warn-without-using-it/117334)
**Author:** [@Robert\_D](https://discuss.elastic.co/u/Robert_D)\ **Replies:** 6\ **Last updated:** [February 15, 2018, 8:03am UTC](https://discuss.elastic.co/t/grok-warn-without-using-it/117334 "2018-02-15T08:03:10Z")
Filebeat config: filebeat.prospectors: - paths: - /\*.log tags: \["internal", "log"\] json.message\_key: msg json.add\_error\_key: true harvester\_limit: 500 close\_inactive: 5m - paths: - /other/\*.log tags… --- ## [API to query elastic search data](https://discuss.elastic.co/t/api-to-query-elastic-search-data/76359)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 6\ **Last updated:** [February 24, 2017, 7:43am UTC](https://discuss.elastic.co/t/api-to-query-elastic-search-data/76359 "2017-02-24T07:43:49Z")
Hi, I have been able to set up Filebeat, Logstash, ES to read the Apache logs and index it in ES. I, however, want to leverage indexed data to build some sort of analytics. For instance; how many requests came from a… --- ## [Purging when storage is low](https://discuss.elastic.co/t/purging-when-storage-is-low/70600)
**Author:** [@jimyoo](https://discuss.elastic.co/u/jimyoo)\ **Replies:** 6\ **Last updated:** [January 4, 2017, 10:22pm UTC](https://discuss.elastic.co/t/purging-when-storage-is-low/70600 "2017-01-04T22:22:07Z")
I want to develop a SW (c++ or script) that checks the available (cluster level) disk space and deletes old indices if the space is under certain amount. For example, if 85% or more of disk has been used, it deletes the … --- ## [On Docker containers. Kibana connect to cloud instead the Elasticsearch container](https://discuss.elastic.co/t/on-docker-containers-kibana-connect-to-cloud-instead-the-elasticsearch-container/348336)
**Author:** [@Juan\_Pablo\_Scodelari](https://discuss.elastic.co/u/Juan_Pablo_Scodelari)\ **Replies:** 7\ **Last updated:** [December 5, 2023, 3:33pm UTC](https://discuss.elastic.co/t/on-docker-containers-kibana-connect-to-cloud-instead-the-elasticsearch-container/348336 "2023-12-05T15:33:45Z")
Hi, I want to install and run locally Elasticsearch and Kibana with Docker. I've tried several methods and reinstalled everything, many times with no success. I can't get Kibana to connect to the elasticsearch in the … --- ## [Upgrading Kibana from 7.14.2 to 7.15.X results in error TypeError: Cannot read property 'schema' of undefined](https://discuss.elastic.co/t/upgrading-kibana-from-7-14-2-to-7-15-x-results-in-error-typeerror-cannot-read-property-schema-of-undefined/288417)
**Author:** [@kking-biometrica](https://discuss.elastic.co/u/kking-biometrica)\ **Replies:** 7\ **Last updated:** [November 5, 2021, 1:38pm UTC](https://discuss.elastic.co/t/upgrading-kibana-from-7-14-2-to-7-15-x-results-in-error-typeerror-cannot-read-property-schema-of-undefined/288417 "2021-11-05T13:38:46Z")
I'm trying to upgrade Kibana on a Linux platform. When upgrading, I am performing the following actions: Download and extract linux tar.gz file to a temp location Stop Kibana Backup existing Kibana install: sudo cp -R… --- ## [\[ES v7.9.1\] DateHistogram - OutOfMemory](https://discuss.elastic.co/t/es-v7-9-1-datehistogram-outofmemory/271840)
**Author:** [@sag-tobias-frey](https://discuss.elastic.co/u/sag-tobias-frey)\ **Replies:** 7\ **Last updated:** [May 4, 2021, 12:11pm UTC](https://discuss.elastic.co/t/es-v7-9-1-datehistogram-outofmemory/271840 "2021-05-04T12:11:28Z")
Hi, I have noticed that when using DateHistograms I'm often running out of memory and my Elasticsearch is crashing. Especially with lower configured intervals. I have tried to tweak Elasticsearch circuit breaker setting… --- ## [Kibana Dev Tools: can the commands in console be saved?](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263 "2020-11-22T22:59:39Z")
Right now, the commands in the Kibana Dev Tools console appears to be tied to the browser. If you change computers or use a different browser session, it is gone completely. It is probably implemented this way because t… --- ## [Custom Kibana Plugin to Call External API](https://discuss.elastic.co/t/custom-kibana-plugin-to-call-external-api/234603)
**Author:** [@Mike\_Adam](https://discuss.elastic.co/u/Mike_Adam)\ **Replies:** 1\ **Last updated:** [June 1, 2020, 11:31pm UTC](https://discuss.elastic.co/t/custom-kibana-plugin-to-call-external-api/234603 "2020-06-01T23:31:53Z")
Hi, I would like to create a custom Kibana plugin which gets a user input "single word" from Kibana interface, then call an external API with the provided user input as a parameter, and only display the result back, no … --- ## [Ruby exception occurred: undefined method \`\[\]' for nil:NilClas](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclas/143750)
**Author:** [@MikaelLindstrom](https://discuss.elastic.co/u/MikaelLindstrom)\ **Replies:** 1\ **Last updated:** [August 9, 2018, 7:01pm UTC](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclas/143750 "2018-08-09T19:01:08Z")
Hi all, We're seeing these two messages in the logs: /var/log/logstash/logstash-plain.log: \[2018-08-09T05:13:41,528\]\[ERROR\]\[logstash.filters.ruby \] Ruby exception occurred: undefined method \`\[\]' for nil:NilClass W… --- ## [Elasticsearch response code 500 class\_cast\_exception](https://discuss.elastic.co/t/elasticsearch-response-code-500-class-cast-exception/138523)
**Author:** [@filipe.ferreira](https://discuss.elastic.co/u/filipe.ferreira)\ **Replies:** 1\ **Last updated:** [July 4, 2018, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-response-code-500-class-cast-exception/138523 "2018-07-04T10:23:34Z")
We are having the following error on our ELK5 Stack: \[2018-07-04T09:25:24,747\]\[INFO \]\[logstash.outputs.elasticsearch\] retrying failed action with response code: 500 ({"type"=\>"class\_cast\_exception", "reason"=\>"class\_cas… --- ## [Convert decimal string IP to ipv4 dotted decimal](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476)
**Author:** [@felixon](https://discuss.elastic.co/u/felixon)\ **Replies:** 1\ **Last updated:** [February 20, 2018, 8:26pm UTC](https://discuss.elastic.co/t/convert-decimal-string-ip-to-ipv4-dotted-decimal/120476 "2018-02-20T20:26:28Z")
Hi, I am sending JSON formatted logs to my 5.4 Logstash. I am using Json Filter Plugin. One of the JSON fields is Source\_IP, the point is that Source\_IP field is coming as decimal long number like "3105947710" (which… --- ## [Is it possible to see the response documents in Kibana 4.6?](https://discuss.elastic.co/t/is-it-possible-to-see-the-response-documents-in-kibana-4-6/93522)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 1\ **Last updated:** [July 19, 2017, 6:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-see-the-response-documents-in-kibana-4-6/93522 "2017-07-19T18:39:26Z")
Hi, In kibana visualizations is it possible to see the json content of the documents . Means i have visualization like this When i clicked on the graph on top of new i am getting like this But what i want is i wa… --- ## [Large and collocated Spark/ES cluster, concerns about data transfert](https://discuss.elastic.co/t/large-and-collocated-spark-es-cluster-concerns-about-data-transfert/62918)
**Author:** [@rzrucher](https://discuss.elastic.co/u/rzrucher)\ **Replies:** 1\ **Last updated:** [October 13, 2016, 9:13pm UTC](https://discuss.elastic.co/t/large-and-collocated-spark-es-cluster-concerns-about-data-transfert/62918 "2016-10-13T21:13:23Z")
Hi all, I want to use spark to query ES. But I've a doubt about how data is transfered back and forth between ES nodes and Spark nodes on a large cluster setup and how node affinity between both world works. We are set… --- ## [Failed to connect to localhost port 9200](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200/53216)
**Author:** [@Madhu\_CM](https://discuss.elastic.co/u/Madhu_CM)\ **Replies:** 1\ **Last updated:** [July 9, 2016, 12:18pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200/53216 "2016-07-09T12:18:00Z")
Hi, I have installed elasticsearch 2.3.3 on ubuntu 14.04. During elasticsearch restart/start I see OK message as below. But when i execute service elasticsearch status it says "\> elasticsearch is not running" root@mad… --- ## [Can't post the announcements](https://discuss.elastic.co/t/cant-post-the-announcements/347)
**Author:** [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Replies:** 1\ **Last updated:** [May 8, 2015, 1:14pm UTC](https://discuss.elastic.co/t/cant-post-the-announcements/347 "2015-05-08T13:14:10Z")
I was trying to announce some plugin updates in the announcements area and I got an error saying I couldn't view the requested resource. I expect this is because I'm not allowed to post there but the error message is bro… --- ## [Permission denied /usr/share/logstash/run](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769)
**Author:** [@RJC](https://discuss.elastic.co/u/RJC)\ **Replies:** 3\ **Last updated:** [March 23, 2023, 7:29pm UTC](https://discuss.elastic.co/t/permission-denied-usr-share-logstash-run/327769 "2023-03-23T19:29:51Z")
I am getting the following error message when starting Logstash on a Linux server: \[ERROR\]\[logstash.java.pipeline \]\[main\] Pipeline worker error, the pipeline will be stopped (:pipeline\_id=\>"main", :error=\>" (EACCESS) Pe… --- ## [Detection rules for Log4J?s](https://discuss.elastic.co/t/detection-rules-for-log4j-s/292021)
**Author:** [@n2x4](https://discuss.elastic.co/u/n2x4)\ **Replies:** 3\ **Last updated:** [December 17, 2021, 7:46am UTC](https://discuss.elastic.co/t/detection-rules-for-log4j-s/292021 "2021-12-17T07:46:50Z")
Curious if anyone has rules in Elastic SIEM for log4j. I didn't see anything in the rule feed on Github and was wondering if there will be native rules for this. --- ## [Indices won't close](https://discuss.elastic.co/t/indices-wont-close/262254)
**Author:** [@JuddyBuddy77](https://discuss.elastic.co/u/JuddyBuddy77)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 9:33am UTC](https://discuss.elastic.co/t/indices-wont-close/262254 "2021-02-22T09:33:48Z")
Hello, first post, still learning. Having an issue closing "random" indices, after removing replica shards and using shard allocation awareness. ES 6.8.3, although indices may have been created in ES 5 (I know). Remov… --- ## [Can't send csv with watcher](https://discuss.elastic.co/t/cant-send-csv-with-watcher/243323)
**Author:** [@Marvin66](https://discuss.elastic.co/u/Marvin66)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 11:46am UTC](https://discuss.elastic.co/t/cant-send-csv-with-watcher/243323 "2020-08-03T11:46:25Z")
Hi, I've just created my first watcher for sending a pdf report via email and it works fine. When I replace the URL for the pdf report with an URL for a csv file I get the following response: {"statusCode":502,"error":"… --- ## [TV Mode or Full Screen](https://discuss.elastic.co/t/tv-mode-or-full-screen/221691)
**Author:** [@grad](https://discuss.elastic.co/u/grad)\ **Replies:** 3\ **Last updated:** [March 3, 2020, 12:37pm UTC](https://discuss.elastic.co/t/tv-mode-or-full-screen/221691 "2020-03-03T12:37:04Z")
Hi all, I've setup correctly Heartbeat for Uptime service.... Now I would like to share Uptime view in a TV but I don't want view the rest of Kibana (e.g. menu, filter bar, ecc..) Is there a TV mode? thanks --- ## [APM + Grails](https://discuss.elastic.co/t/apm-grails/215346)
**Author:** [@gokelly2020](https://discuss.elastic.co/u/gokelly2020)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 5:04pm UTC](https://discuss.elastic.co/t/apm-grails/215346 "2020-01-20T17:04:38Z")
Hi, Im using the apm (7.5.1 server) with a grails app (grails mvc 2.5.5) it seems the APM is always reading the SimpleGrailsController as the entrypoint, regardless of the request or backend code thats hit. Is there a w… --- ## [APM JMS -Tibco](https://discuss.elastic.co/t/apm-jms-tibco/211185)
**Author:** [@tmihaldinec](https://discuss.elastic.co/u/tmihaldinec)\ **Replies:** 3\ **Last updated:** [December 10, 2019, 12:42pm UTC](https://discuss.elastic.co/t/apm-jms-tibco/211185 "2019-12-10T12:42:40Z")
Hi, this is just a question if you can help is there any documentation how to integrate ELK APM java agent and Tibco EMS/JMS if you guys can help it would be awesome Thanks tomislav --- ## [Filebeat Autodiscovery for coredns in docker, what labels to use?](https://discuss.elastic.co/t/filebeat-autodiscovery-for-coredns-in-docker-what-labels-to-use/201530)
**Author:** [@Masta\_Boombastic](https://discuss.elastic.co/u/Masta_Boombastic)\ **Replies:** 3\ **Last updated:** [October 5, 2019, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-autodiscovery-for-coredns-in-docker-what-labels-to-use/201530 "2019-10-05T12:56:02Z")
I'm running elk and coredns in docker. I am having difficulty getting any log data from coredns docker container using the autodiscovery. The sample apache auto discovery works a treat for me, I get data in ES and nice… --- ## [Filter helper options list always empty](https://discuss.elastic.co/t/filter-helper-options-list-always-empty/192782)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 3\ **Last updated:** [August 1, 2019, 1:21am UTC](https://discuss.elastic.co/t/filter-helper-options-list-always-empty/192782 "2019-08-01T01:21:51Z")
Using the filter helper dropdowns in Kibana is always failing to populate the options list, instead showing There aren't any options available If I type a value in manually, it works just fine. And creating a control … --- ## [Cannot uninstall x-pack during rolling upgrade from Elasticsearch 5.6.10 to Elasticsearch 6.2.4](https://discuss.elastic.co/t/cannot-uninstall-x-pack-during-rolling-upgrade-from-elasticsearch-5-6-10-to-elasticsearch-6-2-4/155713)
**Author:** [@bsarkar](https://discuss.elastic.co/u/bsarkar)\ **Replies:** 3\ **Last updated:** [November 8, 2018, 6:55am UTC](https://discuss.elastic.co/t/cannot-uninstall-x-pack-during-rolling-upgrade-from-elasticsearch-5-6-10-to-elasticsearch-6-2-4/155713 "2018-11-08T06:55:40Z")
I have an Elasticsearch 5.6.10 cluster (2 master, 2 client and 3 data nodes) with x-pack 5.6.10 installed. But all x-pack features are disabled with the following configurations in config\\elasticsearch.yml files of all n… --- ## [The queries for numeric fields are slower after upgraded the cluster from 2.4.5 to 5.6.3](https://discuss.elastic.co/t/the-queries-for-numeric-fields-are-slower-after-upgraded-the-cluster-from-2-4-5-to-5-6-3/121620)
**Author:** [@Zzzxf](https://discuss.elastic.co/u/Zzzxf)\ **Replies:** 3\ **Last updated:** [March 17, 2018, 11:45am UTC](https://discuss.elastic.co/t/the-queries-for-numeric-fields-are-slower-after-upgraded-the-cluster-from-2-4-5-to-5-6-3/121620 "2018-03-17T11:45:05Z")
Cluster info PS: two cluster with same nodes,docs Elasticsearch version : 2.4.5/5.6.3 JVM version : java8 OS version: Linux CentOS 6 Nodes: 32(data/master) Problem The queries for numeric fields are slower after upg… --- ## [yyyy-MM-dd hh:mi:ss 관련 데이터 검색](https://discuss.elastic.co/t/yyyy-mm-dd-hh-mi-ss/110620)
**Author:** [@bbfb2b9129f8b9e1b62c](https://discuss.elastic.co/u/bbfb2b9129f8b9e1b62c)\ **Replies:** 3\ **Last updated:** [December 11, 2017, 5:28am UTC](https://discuss.elastic.co/t/yyyy-mm-dd-hh-mi-ss/110620 "2017-12-11T05:28:34Z")
엘라스틱서치 관련 문의드립니다. 매핑을 먼저 하지 않고 인덱스만 만든상태에서 아래와 같이 데이터를 넣었습니다. \[POST\] http://localhost:9200/test/type1/3 { "create\_date" : "2017-12-07 23:42:51" } ES에서 자동으로 매핑을 해줘서 아래와 같이 되었습니다. { "test": { "mappings": { "type1… --- ## [Datatable config case help](https://discuss.elastic.co/t/datatable-config-case-help/68123)
**Author:** [@joodies](https://discuss.elastic.co/u/joodies)\ **Replies:** 3\ **Last updated:** [December 13, 2016, 8:37pm UTC](https://discuss.elastic.co/t/datatable-config-case-help/68123 "2016-12-13T20:37:01Z")
Assuming i have data as follow in ES, type status a new a wip b new b new a done then i need a data-table in Kibana 5.0, type new wip done a 1 … --- ## [Is Kabana able to deal with an index of 2 billions docs?](https://discuss.elastic.co/t/is-kabana-able-to-deal-with-an-index-of-2-billions-docs/53943)
**Author:** [@mdiouf](https://discuss.elastic.co/u/mdiouf)\ **Replies:** 3\ **Last updated:** [June 26, 2016, 1:24am UTC](https://discuss.elastic.co/t/is-kabana-able-to-deal-with-an-index-of-2-billions-docs/53943 "2016-06-26T01:24:12Z")
Hello, I'm using kibana since some years. Good product and I'm sure the best is coming. We hava a index with 2 billion documents and it'll continue growing. At the begining, when we just had hundruds on millions kibana w… --- ## [Where to install?](https://discuss.elastic.co/t/where-to-install/1312)
**Author:** [@wesleyhall](https://discuss.elastic.co/u/wesleyhall)\ **Replies:** 3\ **Last updated:** [May 26, 2015, 11:58pm UTC](https://discuss.elastic.co/t/where-to-install/1312 "2015-05-26T23:58:15Z")
Hey folks, Unless I have missed it, the docs do not seem very clear with regards to how to install watcher on a cluster. If watcher is installed upon multiple nodes in the cluster, does it generate multiple alerts … --- ## [Elasticsearch Docker: flood stage disk watermark \[95%\] exceeded](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248300)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-docker-flood-stage-disk-watermark-95-exceeded/248300 "2020-09-11T10:23:39Z")
I have a similar issue to the one posted here: https://stackoverflow.com/questions/50609417/elasticsearch-error-cluster-block-exception-forbidden-12-index-read-only-all I'm running Elasticsearch and Kibana with docker-c… --- ## [Enabling the sFlow Codec in Logstash Container?](https://discuss.elastic.co/t/enabling-the-sflow-codec-in-logstash-container/236948)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 9:46pm UTC](https://discuss.elastic.co/t/enabling-the-sflow-codec-in-logstash-container/236948 "2020-06-12T21:46:24Z")
Hi Logstash Jedi Masters, I recently saw an instance of Logstash 7.7.1 that was accepting sFlow traffic as input. My colleague said he was able to set it up with no problem at all. I would like to do this, but in a Lo… --- ## [Is scroll id always same for one user](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 5\ **Last updated:** [April 8, 2021, 5:33am UTC](https://discuss.elastic.co/t/is-scroll-id-always-same-for-one-user/269517 "2021-04-08T05:33:52Z")
For example, I have an Elasticsearch cluster with a single user and two different applications that want to retrieve all documents from the index to process them. Both applications are using search with scroll mechanism … --- ## [What is possible hardware configurations for 80 GB Per day data volume?](https://discuss.elastic.co/t/what-is-possible-hardware-configurations-for-80-gb-per-day-data-volume/188895)
**Author:** [@Vivek\_Vardhan](https://discuss.elastic.co/u/Vivek_Vardhan)\ **Replies:** 5\ **Last updated:** [July 4, 2019, 1:14pm UTC](https://discuss.elastic.co/t/what-is-possible-hardware-configurations-for-80-gb-per-day-data-volume/188895 "2019-07-04T13:14:12Z")
I am setting up a cluster on ES version 6.2.3 and i have following scenario: Data Volume 80GB per day (with 1 month of retention ) Search scenarios (dashboards only few aggregation queries, max 50 users a day) Curren… --- ## [Query question using should and must](https://discuss.elastic.co/t/query-question-using-should-and-must/115785)
**Author:** [@iitgrad](https://discuss.elastic.co/u/iitgrad)\ **Replies:** 5\ **Last updated:** [January 19, 2018, 12:32pm UTC](https://discuss.elastic.co/t/query-question-using-should-and-must/115785 "2018-01-19T12:32:07Z")
I have documents which have a "category" : \["cat1", "cat2", "cat3"\] etc. Some documents may have 20 or so different categories in the array, some may only have 1. I am trying to construct a query that does the following… --- ## [Elastic Performance](https://discuss.elastic.co/t/elastic-performance/98884)
**Author:** [@sharongur](https://discuss.elastic.co/u/sharongur)\ **Replies:** 5\ **Last updated:** [September 3, 2017, 8:03pm UTC](https://discuss.elastic.co/t/elastic-performance/98884 "2017-09-03T20:03:17Z")
Hi all, I wonder how\\if elastic will handle my requirements: 20M records a day -\> index 3 years backwards. My worry is about query performance and not multiple requests. (more shards rather then more nodes) will elas… --- ## [Security audits using elasticsearch](https://discuss.elastic.co/t/security-audits-using-elasticsearch/92099)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 5\ **Last updated:** [July 14, 2017, 1:57pm UTC](https://discuss.elastic.co/t/security-audits-using-elasticsearch/92099 "2017-07-14T13:57:00Z")
Can i use elasticsearch for security audits? For example I have 10 users accessing confidential datas everyday and I log this and index to elasticsearch. Will be be able to do random audits on these users,for example 2 d… --- ## [Logstash-codec-cloudtrail support for 5.x?](https://discuss.elastic.co/t/logstash-codec-cloudtrail-support-for-5-x/69314)
**Author:** [@Mike\_Garrison](https://discuss.elastic.co/u/Mike_Garrison)\ **Replies:** 5\ **Last updated:** [December 28, 2016, 8:54pm UTC](https://discuss.elastic.co/t/logstash-codec-cloudtrail-support-for-5-x/69314 "2016-12-28T20:54:35Z")
I'd like to be able to get my cloudtrail logs into ES via Logstash. It seems like this was fixed by the following pull request: Update to logstash 5.0 by patrobinson · Pull Request #11 · logstash-plugins/logstash-codec-c… --- ## [Fatal occur when kibana@7.1.1 yarn start](https://discuss.elastic.co/t/fatal-occur-when-kibana-7-1-1-yarn-start/189316)
**Author:** [@AveiShriety](https://discuss.elastic.co/u/AveiShriety)\ **Replies:** 1\ **Last updated:** [July 8, 2019, 2:14pm UTC](https://discuss.elastic.co/t/fatal-occur-when-kibana-7-1-1-yarn-start/189316 "2019-07-08T14:14:21Z")
Here is the error output: server log \[09:23:15.041\] \[fatal\]\[root\] { Error: getaddrinfo ENOTFOUND s3.amazonaws.com s3.amazonaws.com:443 at GetAddrInfoReqWrap.onlookup \[as oncomplete\] (dns.js:57:26) errno: 'ENO… --- ## [Elasticsearch java api client](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042)
**Author:** [@Arun\_Nath](https://discuss.elastic.co/u/Arun_Nath)\ **Replies:** 8\ **Last updated:** [January 12, 2022, 5:28pm UTC](https://discuss.elastic.co/t/elasticsearch-java-api-client/294042 "2022-01-12T17:28:43Z")
{ "aggs": { "my-agg-name": { "terms": { "field": "my-field" }, "aggs": { "my-sub-agg-name": { "avg": { "field": "my-other-field" } } }… --- ## [How to find which node, with an old version of metricbeat, is the data coming from?](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389)
**Author:** [@vee](https://discuss.elastic.co/u/vee)\ **Replies:** 8\ **Last updated:** [January 11, 2021, 1:51am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389 "2021-01-11T01:51:53Z")
We've upgraded to elastic v7.5 a few months ago, and upgraded most of the known servers metricbeat to the same version. However, looks like there might be a few servers which still have v6.6 metricbeat running and so we … [Previous page](https://discuss.elastic.co/top.md?page=1441&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1443&per_page=50&period=all)