# Top **URL:** https://discuss.elastic.co/top.md?page=145&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 146 --- ## [Logstash configuration returns different results](https://discuss.elastic.co/t/logstash-configuration-returns-different-results/190471)
**Author:** [@GitsBdr](https://discuss.elastic.co/u/GitsBdr)\ **Replies:** 14\ **Last updated:** [July 16, 2019, 4:33pm UTC](https://discuss.elastic.co/t/logstash-configuration-returns-different-results/190471 "2019-07-16T16:33:05Z")
Hi guys. Below my logstash configuration : input { file { path =\> "/tmp/file.csv" type =\> "myindex" start\_position =\> "beginning" } } filter { if (\[type\] == "myindex") { csv { skip\_header =\>… --- ## [Configure Slack/Email Action on Watch failing - yml issue](https://discuss.elastic.co/t/configure-slack-email-action-on-watch-failing-yml-issue/115851)
**Author:** [@Joff](https://discuss.elastic.co/u/Joff)\ **Replies:** 9\ **Last updated:** [January 24, 2018, 7:46pm UTC](https://discuss.elastic.co/t/configure-slack-email-action-on-watch-failing-yml-issue/115851 "2018-01-24T19:46:03Z")
Hi, I'm trying to configure Slack Action in Watcher but every time I update the elasticsearch.yml as per https://www.elastic.co/guide/en/x-pack/current/actions-slack.html#configuring-slack my node gets offline I edited… --- ## [Filebeat proxy permissions?](https://discuss.elastic.co/t/filebeat-proxy-permissions/67658)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 9\ **Last updated:** [November 30, 2016, 6:48pm UTC](https://discuss.elastic.co/t/filebeat-proxy-permissions/67658 "2016-11-30T18:48:47Z")
I have a nginx proxy restricting access to ES to PUT/POST only, but i am getting Forbidden in filebeat.log. Does filebeat need access to other URL locations? I am allowing PUT and POST to /filebeat\* index and this work… --- ## [Performance hit when multiple filebeats are sending to same ES](https://discuss.elastic.co/t/performance-hit-when-multiple-filebeats-are-sending-to-same-es/335493)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 22\ **Last updated:** [June 27, 2023, 1:09am UTC](https://discuss.elastic.co/t/performance-hit-when-multiple-filebeats-are-sending-to-same-es/335493 "2023-06-27T01:09:44Z")
Hi, I have a total of 5 servers, all sending Netflow data using filebeat to the same server (1 of the 5 servers) running ES. Each server is also running 2 instances of filebeat, so in total, I have 5 x 2 filebeat instan… --- ## [Memory usage in index](https://discuss.elastic.co/t/memory-usage-in-index/228549)
**Author:** [@Rajeev\_Bhat](https://discuss.elastic.co/u/Rajeev_Bhat)\ **Replies:** 22\ **Last updated:** [April 21, 2020, 3:16pm UTC](https://discuss.elastic.co/t/memory-usage-in-index/228549 "2020-04-21T15:16:01Z")
Hello, I am new to ELasticSearch..I created an index and populated with around 500thousand documents. How can I check what % of my documents are in RAM and how much is stored in disk? Thanks Rajeev --- ## [Apache Access Logs with Filebeats-\>Logstash-\>EL\<-Kibana: Throws errors at default dashboard](https://discuss.elastic.co/t/apache-access-logs-with-filebeats-logstash-el-kibana-throws-errors-at-default-dashboard/313585)
**Author:** [@SirStephanikus](https://discuss.elastic.co/u/SirStephanikus)\ **Replies:** 10\ **Last updated:** [September 6, 2022, 8:39pm UTC](https://discuss.elastic.co/t/apache-access-logs-with-filebeats-logstash-el-kibana-throws-errors-at-default-dashboard/313585 "2022-09-06T20:39:12Z")
Hello Everyone While I'm trying to deep dive into ELK, I followed a video course that is unfortunately outdated... My ELK version is 8.3.3 However, the lab goal is this: Use filebeat to parse some apache access logs,… --- ## [Append data to each line](https://discuss.elastic.co/t/append-data-to-each-line/119936)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 9\ **Last updated:** [February 16, 2018, 7:41am UTC](https://discuss.elastic.co/t/append-data-to-each-line/119936 "2018-02-16T07:41:56Z")
Ingesting XML data which appears like: \\\\\\ \\\\\\ \\\\\\ \\\ **Author:** [@Felipe\_Santos](https://discuss.elastic.co/u/Felipe_Santos)\ **Replies:** 11\ **Last updated:** [November 19, 2015, 3:50pm UTC](https://discuss.elastic.co/t/too-many-files-open-recovering-cluster/35048 "2015-11-19T15:50:22Z") 3 x master node 8GB 2vCPU 3X data note 30GB 8vCPU I am recovering a cluster and I am getting this error 2015-11-18 02:45:20,374\]\[WARN \]\[action.bulk \] \[Bruiser\] failed to perform indices:data/write/bulk\[s… --- ## [Error using Curator 5.1.1 to restore snapshot](https://discuss.elastic.co/t/error-using-curator-5-1-1-to-restore-snapshot/90527)
**Author:** [@Jaff](https://discuss.elastic.co/u/Jaff)\ **Replies:** 10\ **Last updated:** [June 26, 2017, 10:23pm UTC](https://discuss.elastic.co/t/error-using-curator-5-1-1-to-restore-snapshot/90527 "2017-06-26T22:23:35Z")
jenkins@592a48b3b882:~$ curator --config /tmp/config/es5-lineartv\_dev.yml /tmp/actions/restore-lineartv\_dev.yml {"@timestamp": "2017-06-22T19:55:41.694Z", "function": "cli", "linenum": 153, "loglevel": "INFO", "message":… --- ## [Filebeat monitoring metrics are "dropped" when a GEOIP pipeline is used](https://discuss.elastic.co/t/filebeat-monitoring-metrics-are-dropped-when-a-geoip-pipeline-is-used/317063)
**Author:** [@ppine7](https://discuss.elastic.co/u/ppine7)\ **Replies:** 23\ **Last updated:** [October 26, 2022, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-metrics-are-dropped-when-a-geoip-pipeline-is-used/317063 "2022-10-26T12:53:32Z")
Hi, this question comes as a result of solving one mystery in this post: Filebeat monitoring metrics not visible in ElasticSearch - #30 by stephenb - huge Thank You to @stephenb for his help! - where Filebeat monitoring… --- ## [How to create a Vega bar graph with the unique count of devices?](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 14\ **Last updated:** [February 10, 2021, 6:30pm UTC](https://discuss.elastic.co/t/how-to-create-a-vega-bar-graph-with-the-unique-count-of-devices/263447 "2021-02-10T18:30:37Z")
Hello, I have some events that where created: In file 1: {"souceNetwork":"cc567", "sourceDevice":"z01", "destinationNetwork":"cc567", "destinationDevice":"z02", "path":"/user/file1"} {"sourceNetwork":"cc567", "source… --- ## [There is insufficient memory for the Java Runtime Environment to continue](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/383614)
**Author:** [@Aysel\_Guliyeva](https://discuss.elastic.co/u/Aysel_Guliyeva)\ **Replies:** 45\ **Last updated:** [January 28, 2026, 8:50pm UTC](https://discuss.elastic.co/t/there-is-insufficient-memory-for-the-java-runtime-environment-to-continue/383614 "2026-01-28T20:50:23Z")
Hello. I need help. In our system, there are 8 data nodes. And my Elasticsearch VM RAM is 16GB. Normally, Elasticsearch data nodes use 60-65% of RAM. I check via the command “top” on Ubuntu. Unfourtunately, once in a mo… --- ## [Image Display Issues](https://discuss.elastic.co/t/image-display-issues/110074)
**Author:** [@EricWS](https://discuss.elastic.co/u/EricWS)\ **Replies:** 9\ **Last updated:** [December 4, 2017, 10:34pm UTC](https://discuss.elastic.co/t/image-display-issues/110074 "2017-12-04T22:34:13Z")
Hi all, We are in the process of upgrading to ElasticSearch 6.0 and Kibana 6.0, however the removal of the use of string as a field type has create issues with being able to display URL's as images using the below setti… --- ## [Cannot upgrade to Elasticsearch 8.12.1 directly from 7.12.0](https://discuss.elastic.co/t/cannot-upgrade-to-elasticsearch-8-12-1-directly-from-7-12-0/353553)
**Author:** [@Justo1982](https://discuss.elastic.co/u/Justo1982)\ **Replies:** 15\ **Last updated:** [March 7, 2024, 8:28am UTC](https://discuss.elastic.co/t/cannot-upgrade-to-elasticsearch-8-12-1-directly-from-7-12-0/353553 "2024-03-07T08:28:17Z")
Hi All, I'm trying to install ELK stack in QA environment but get the error below with Elasticsearch: 'java.lang.IllegalStateException: cannot upgrade a node from version \[7.12.0\] directly to version \[8.12.1\], upgrade … --- ## [Cluster status to RED while indexing and searching at same time](https://discuss.elastic.co/t/cluster-status-to-red-while-indexing-and-searching-at-same-time/146069)
**Author:** [@iluvcode](https://discuss.elastic.co/u/iluvcode)\ **Replies:** 9\ **Last updated:** [August 28, 2018, 5:19am UTC](https://discuss.elastic.co/t/cluster-status-to-red-while-indexing-and-searching-at-same-time/146069 "2018-08-28T05:19:45Z")
Hi, We recently deployed new Search functionality and day after moving things to Production, our ES server blacks out every other day. I was able to replicate the scenario in our QA servers now. While indexing 30k reco… --- ## [Synthetics failing silently?](https://discuss.elastic.co/t/synthetics-failing-silently/295443)
**Author:** [@mybyte](https://discuss.elastic.co/u/mybyte)\ **Replies:** 10\ **Last updated:** [January 30, 2022, 3:43pm UTC](https://discuss.elastic.co/t/synthetics-failing-silently/295443 "2022-01-30T15:43:21Z")
I have a set-up that works perfectly when I run it locally (docker-compose), but is failing without any logs when running on the server. It's a synthetics test/journey. Configuration is as follows: mounted /monitors fo… --- ## [Licence renewal](https://discuss.elastic.co/t/licence-renewal/217037)
**Author:** [@Tim\_James](https://discuss.elastic.co/u/Tim_James)\ **Replies:** 10\ **Last updated:** [February 3, 2020, 10:31am UTC](https://discuss.elastic.co/t/licence-renewal/217037 "2020-02-03T10:31:00Z")
I am trying to install a new licence which i have downloaded for my 6.0.1 installation. but I get the following error when typing it into kibana { "error": { "root\_cause": \[ { "type": "exception", "reason": "Unkno… --- ## [Initializing shards everytime!](https://discuss.elastic.co/t/initializing-shards-everytime/26388)
**Author:** [@it2](https://discuss.elastic.co/u/it2)\ **Replies:** 10\ **Last updated:** [November 30, 2015, 7:05pm UTC](https://discuss.elastic.co/t/initializing-shards-everytime/26388 "2015-11-30T19:05:58Z")
Hello everyone! I have an elasticsearch cluster: 1 master node with logstash on board and 3 data nodes. And everytime in kopf i see next picture: http://prntscr.com/7xv67x What is the reason of this ? Please give me some… --- ## [Mixing Filters](https://discuss.elastic.co/t/mixing-filters/21240)
**Author:** [@bkamiche](https://discuss.elastic.co/u/bkamiche)\ **Replies:** 11\ **Last updated:** [February 9, 2016, 5:17pm UTC](https://discuss.elastic.co/t/mixing-filters/21240 "2016-02-09T17:17:49Z")
Hello, I'm testing elastic search and I need to apply different filters, when I include the "range" filter I get an error and the query is not executed, here's the json: $json = '{ "size" : 10, "… --- ## [Elasticsearch 7 has 4x higher AZ transfer costs in AWS compared to 2.4](https://discuss.elastic.co/t/elasticsearch-7-has-4x-higher-az-transfer-costs-in-aws-compared-to-2-4/225745)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 13\ **Last updated:** [May 5, 2020, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-7-has-4x-higher-az-transfer-costs-in-aws-compared-to-2-4/225745 "2020-05-05T16:21:16Z")
Since upgrading to Elasticsearch 7.4.1 from 2.4. (I know :stuck\_out\_tongue: ) we are seeing our AWS availability zone transfer charges skyrocket. Both the old and new clusters used the cluster.cloud.allocation.awareness.… --- ## [Very slow cluster, cannot find "\_cluster" index?](https://discuss.elastic.co/t/very-slow-cluster-cannot-find-cluster-index/147408)
**Author:** [@emilija](https://discuss.elastic.co/u/emilija)\ **Replies:** 9\ **Last updated:** [September 5, 2018, 3:01pm UTC](https://discuss.elastic.co/t/very-slow-cluster-cannot-find-cluster-index/147408 "2018-09-05T15:01:19Z")
Hi, we have a cluster of 34 nodes running Elastic version 2.2 . The cluster started to behave very weirdly now the shard allocation is very slow and there are "URGENT" pending tasks with over 8 hours in the queue. GET \_c… --- ## [Missing authentication token MetricBeat](https://discuss.elastic.co/t/missing-authentication-token-metricbeat/70912)
**Author:** [@gutasaputra](https://discuss.elastic.co/u/gutasaputra)\ **Replies:** 10\ **Last updated:** [January 9, 2017, 10:27am UTC](https://discuss.elastic.co/t/missing-authentication-token-metricbeat/70912 "2017-01-09T10:27:41Z")
helo, i have an issue with metricbeat. before i install xpack, metricbeat running very well. but suddenly after i install xpack, i cant access it from my kibana. i run this command in my terminal : curl -XGET 'http:/… --- ## [Sankey Visualization plugin installation](https://discuss.elastic.co/t/sankey-visualization-plugin-installation/337752)
**Author:** [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\ **Replies:** 9\ **Last updated:** [July 24, 2023, 8:55am UTC](https://discuss.elastic.co/t/sankey-visualization-plugin-installation/337752 "2023-07-24T08:55:24Z")
Hi, I am trying to install Sankey visualization plugin in kibana. following the instructions mentioned here When i run the yarn start i am getting the following error yarn run v1.22.19 $ cd ../.. && node scripts/ki… --- ## [Search with inject attachment - too long](https://discuss.elastic.co/t/search-with-inject-attachment-too-long/145307)
**Author:** [@Vikentyi](https://discuss.elastic.co/u/Vikentyi)\ **Replies:** 29\ **Last updated:** [August 23, 2018, 7:55am UTC](https://discuss.elastic.co/t/search-with-inject-attachment-too-long/145307 "2018-08-23T07:55:49Z")
Hello. I am using elasticsearch 5.4 and inject attachment plugin. I have indexed everything and search works fine. But the question is: when i index a lot of content files and perform search with excluding attachment.c… --- ## [Is it possible to run dynamic sql query in elastic search](https://discuss.elastic.co/t/is-it-possible-to-run-dynamic-sql-query-in-elastic-search/198276)
**Author:** [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\ **Replies:** 9\ **Last updated:** [September 9, 2019, 9:40am UTC](https://discuss.elastic.co/t/is-it-possible-to-run-dynamic-sql-query-in-elastic-search/198276 "2019-09-09T09:40:30Z")
Dear All. i have use case in elastic search that is matching with below sql query:- DECLARE @EmpID AS SMALLINT DECLARE @SQLQuery AS NVARCHAR(500) DECLARE @ParameterDefinition AS NVARCHAR(100) SET @EmpID = 1001 SET @SQ… --- ## [Benchmarking a remote cluster - provisioning does not appear to be working?](https://discuss.elastic.co/t/benchmarking-a-remote-cluster-provisioning-does-not-appear-to-be-working/114616)
**Author:** [@matt.veitas](https://discuss.elastic.co/u/matt.veitas)\ **Replies:** 9\ **Last updated:** [January 9, 2018, 5:37pm UTC](https://discuss.elastic.co/t/benchmarking-a-remote-cluster-provisioning-does-not-appear-to-be-working/114616 "2018-01-09T17:37:00Z")
Hi I am following the docs to be able to benchmark a remote cluster as per: Tips and Tricks - Rally 2.10.0 documentation. It is my understanding that this should be able to create the ES node on the benchmark candidate … --- ## [Error in connecting Filebeat oss 7.7.0 to S3](https://discuss.elastic.co/t/error-in-connecting-filebeat-oss-7-7-0-to-s3/235901)
**Author:** [@AbhilashPurohit](https://discuss.elastic.co/u/AbhilashPurohit)\ **Replies:** 11\ **Last updated:** [June 8, 2020, 8:08am UTC](https://discuss.elastic.co/t/error-in-connecting-filebeat-oss-7-7-0-to-s3/235901 "2020-06-08T08:08:22Z")
Hi All, I am having a big issue on configuring filebeat with S3 logs as type. Let me explain our Flow. I am not using Logstash. I am using Filebeat oss-7.x version in elastic.repo ( 7.7.0 version is installed) Elast… --- ## [Ingest data from Relational DB to Elasticsearch](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376)
**Author:** [@lcui\_dxc](https://discuss.elastic.co/u/lcui_dxc)\ **Replies:** 9\ **Last updated:** [September 2, 2022, 1:14pm UTC](https://discuss.elastic.co/t/ingest-data-from-relational-db-to-elasticsearch/313376 "2022-09-02T13:14:49Z")
Hello there: We are building a search engine with Elastic, the source data is on a relational DB. We need to ingest data from the DB to Elasticsearch. We know it is doable using JDBC Input Plugin on Logstash to ingest d… --- ## [Evaluating Moving to Discourse - Feedback Wanted](https://discuss.elastic.co/t/evaluating-moving-to-discourse-feedback-wanted/23068)
**Author:** [@Leslie\_Hawthorn](https://discuss.elastic.co/u/Leslie_Hawthorn)\ **Replies:** 32\ **Last updated:** [May 4, 2015, 2:59pm UTC](https://discuss.elastic.co/t/evaluating-moving-to-discourse-feedback-wanted/23068 "2015-05-04T14:59:34Z")
Hello everyone, As we’ve begun to scale up development on three different open source projects, we’ve found Google Groups to be a difficult solution for dealing with all of our needs for community support. We’ve g… --- ## [IllegalStateException on Span.makeCurrent](https://discuss.elastic.co/t/illegalstateexception-on-span-makecurrent/311086)
**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Replies:** 20\ **Last updated:** [August 30, 2022, 7:09am UTC](https://discuss.elastic.co/t/illegalstateexception-on-span-makecurrent/311086 "2022-08-30T07:09:23Z")
Kibana version: 7.8.0 Elasticsearch version: 7.8.0 APM Server version: 7.8.0 APM Agent language and version: Java 1.33.0 Browser version: Chrome 103 Is there anything special in your setup? I am trying to write an i… --- ## [How to use the same Elastic Search Index in Multiple Environments in same server](https://discuss.elastic.co/t/how-to-use-the-same-elastic-search-index-in-multiple-environments-in-same-server/304220)
**Author:** [@Leo\_Lawrence](https://discuss.elastic.co/u/Leo_Lawrence)\ **Replies:** 11\ **Last updated:** [May 10, 2022, 7:46am UTC](https://discuss.elastic.co/t/how-to-use-the-same-elastic-search-index-in-multiple-environments-in-same-server/304220 "2022-05-10T07:46:20Z")
Im having 2 environments(Dev and Test) in a same server. I want to use the same set of Indices in both dev and Test. How to achieve this in Elasticsearch --- ## [Can't get highlighted results using Java High Level Rest Client](https://discuss.elastic.co/t/cant-get-highlighted-results-using-java-high-level-rest-client/305261)
**Author:** [@Tasdiq\_Shaikh](https://discuss.elastic.co/u/Tasdiq_Shaikh)\ **Replies:** 17\ **Last updated:** [June 2, 2022, 6:53am UTC](https://discuss.elastic.co/t/cant-get-highlighted-results-using-java-high-level-rest-client/305261 "2022-06-02T06:53:37Z")
I am using Java 1.8 and Elasticsearch 7.12.0. Hello, I am trying to get Highlighter to work but all i'm getting is the whole document in which word is available and I should get only the snippets of the highlighted word… --- ## [Improving Query Performance](https://discuss.elastic.co/t/improving-query-performance/190737)
**Author:** [@emrealtan](https://discuss.elastic.co/u/emrealtan)\ **Replies:** 20\ **Last updated:** [July 22, 2019, 11:53am UTC](https://discuss.elastic.co/t/improving-query-performance/190737 "2019-07-22T11:53:12Z")
Hello all, I'm new in Elasticsearch and trying to find out why my query performance is so slow. I have an index with 1M documents called "variantlist". I'm searching in "VariantIds" values with this query: {"from":0,"… --- ## [User docker to build elasticsearch cluster on multi-machine](https://discuss.elastic.co/t/user-docker-to-build-elasticsearch-cluster-on-multi-machine/244845)
**Author:** [@W1nter-3Z](https://discuss.elastic.co/u/W1nter-3Z)\ **Replies:** 9\ **Last updated:** [August 13, 2020, 12:19pm UTC](https://discuss.elastic.co/t/user-docker-to-build-elasticsearch-cluster-on-multi-machine/244845 "2020-08-13T12:19:00Z")
Machine A runs 3 es nodes , Machine B adds a new data nodes it faield when joining the cluster on A machine A es master node settings: cluster.name: es-cluster node.name: es-master node.master: tru… --- ## [Limitation of client node (Tribe node)](https://discuss.elastic.co/t/limitation-of-client-node-tribe-node/100790)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 14\ **Last updated:** [September 19, 2017, 6:13am UTC](https://discuss.elastic.co/t/limitation-of-client-node-tribe-node/100790 "2017-09-19T06:13:16Z")
Hello All, This is my configuration : curl -XGET 172.24.69.19:9200/\_cat/nodes : 172.24.69.14 16 36 0 0.00 0.01 0.05 - - es-client-02 172.24.69.18 95 97 20 1.64 1.28 1.25 d - es-data-03 172.24.69.20 15 36 0 0.05 0… --- ## [Elastic cloud on kubernetes - logstash question](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-logstash-question/326700)
**Author:** [@splitmessage88](https://discuss.elastic.co/u/splitmessage88)\ **Replies:** 11\ **Last updated:** [March 20, 2023, 4:36am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-logstash-question/326700 "2023-03-20T04:36:03Z")
Hi, I'm trying to setup a logstash pipeline to receive tcp syslog from remote sources logstash on elastic cloud on kubernetes, Openshift 4.12. The sending source must send TCP port 6514 and use TLS to make the connectio… --- ## [Issues with searching data in array](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 9\ **Last updated:** [November 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420 "2019-11-08T12:25:30Z")
Hi Team, Issues in searching the data in kibana. It is not working as expected. The situation is The kind of logs which are collected are firewall logs There are 2 fields Action and matches.action Action specif… --- ## [Bucket Sort over Composite aggregation degrading the performance of query - Any better way?](https://discuss.elastic.co/t/bucket-sort-over-composite-aggregation-degrading-the-performance-of-query-any-better-way/199782)
**Author:** [@Santosh\_Singh1](https://discuss.elastic.co/u/Santosh_Singh1)\ **Replies:** 10\ **Last updated:** [September 24, 2019, 4:42pm UTC](https://discuss.elastic.co/t/bucket-sort-over-composite-aggregation-degrading-the-performance-of-query-any-better-way/199782 "2019-09-24T16:42:01Z")
We have a use case where we need to get the top 20 items, which has max sum of revenues. Lets consider the mapping below: PUT /my-index/\_mapping { "properties": { "item": { "type": "keyword" … --- ## [Unable to Find Document, Searching Contents - Mapper Attachments Plugin](https://discuss.elastic.co/t/unable-to-find-document-searching-contents-mapper-attachments-plugin/48500)
**Author:** [@Gui\_Keller](https://discuss.elastic.co/u/Gui_Keller)\ **Replies:** 10\ **Last updated:** [May 2, 2016, 12:03am UTC](https://discuss.elastic.co/t/unable-to-find-document-searching-contents-mapper-attachments-plugin/48500 "2016-05-02T00:03:05Z")
Could someone please try and point out what I am missing / doing wrong? My environment details: Java 1.8.0u45 ElasticSearch 2.1.0 ElasticSearch Mapper Attachments 3.1.0 Here is a snippet from when I start up ES - … --- ## [How to set up 3 dedicate master + 4 data nodes also master elegible](https://discuss.elastic.co/t/how-to-set-up-3-dedicate-master-4-data-nodes-also-master-elegible/338887)
**Author:** [@hlcxpl](https://discuss.elastic.co/u/hlcxpl)\ **Replies:** 15\ **Last updated:** [July 25, 2023, 7:05pm UTC](https://discuss.elastic.co/t/how-to-set-up-3-dedicate-master-4-data-nodes-also-master-elegible/338887 "2023-07-25T19:05:02Z")
i need to set up 3 master node dedicate and 4 data node and master elegibles this is my yml configuration path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch bootstrap.memory\_lock: true cluster.name: C… --- ## [FSCrawler : Retry connection, when it gets failure](https://discuss.elastic.co/t/fscrawler-retry-connection-when-it-gets-failure/293488)
**Author:** [@joseph-l.amalraj](https://discuss.elastic.co/u/joseph-l.amalraj)\ **Replies:** 15\ **Last updated:** [January 15, 2022, 5:41am UTC](https://discuss.elastic.co/t/fscrawler-retry-connection-when-it-gets-failure/293488 "2022-01-15T05:41:26Z")
Hi David, Please share your suggestions. We are using fscrawler-2.4.. When we startup.. getting below connection error.. is there way to look (or) wait for connection success, then continue the process within the \_sett… --- ## [Upgrade ELK on docker from 7.10 to 7.17](https://discuss.elastic.co/t/upgrade-elk-on-docker-from-7-10-to-7-17/312839)
**Author:** [@Boodle](https://discuss.elastic.co/u/Boodle)\ **Replies:** 9\ **Last updated:** [August 31, 2022, 3:30am UTC](https://discuss.elastic.co/t/upgrade-elk-on-docker-from-7-10-to-7-17/312839 "2022-08-31T03:30:51Z")
Need to upgrade Elasticsearch , Kibana installed with docker compose from 7.10 to 7.17 This document shares other methods but not containers installed/started with docker compose - swarm. Is their a steps by step docu… --- ## [Is refresh interval call is sync or async call in elasticsearch](https://discuss.elastic.co/t/is-refresh-interval-call-is-sync-or-async-call-in-elasticsearch/94639)
**Author:** [@krishnaraj221193](https://discuss.elastic.co/u/krishnaraj221193)\ **Replies:** 10\ **Last updated:** [July 27, 2017, 10:28am UTC](https://discuss.elastic.co/t/is-refresh-interval-call-is-sync-or-async-call-in-elasticsearch/94639 "2017-07-27T10:28:26Z")
hello sir, I'm new to elastic search I needed to know how the refresh interval works internally. lets say resfresh interval is 1 second so after 10 seconds how many refresh call will happen if each refresh completes 5 se… --- ## [Please tell me how to get message as well as the content of delimiter and AIR name in output as i am getting only message as output](https://discuss.elastic.co/t/please-tell-me-how-to-get-message-as-well-as-the-content-of-delimiter-and-air-name-in-output-as-i-am-getting-only-message-as-output/119178)
**Author:** [@abhi210797](https://discuss.elastic.co/u/abhi210797)\ **Replies:** 17\ **Last updated:** [February 14, 2018, 8:07am UTC](https://discuss.elastic.co/t/please-tell-me-how-to-get-message-as-well-as-the-content-of-delimiter-and-air-name-in-output-as-i-am-getting-only-message-as-output/119178 "2018-02-14T08:07:16Z")
input { file { path =\> "C:\\PROJECT\\ELK\_STACK\\logstash-6.1.2\\bin\\files\\tcp\_1\_logs.log" } } filter { grok { match =\> \[ "message", "(?^ Error in sending batch file )(?.)" \] match =\> \["message", "(? to AIR server: ) … --- ## [Configuring multiple nodes](https://discuss.elastic.co/t/configuring-multiple-nodes/2877)
**Author:** [@Gareth\_Stokes](https://discuss.elastic.co/u/Gareth_Stokes)\ **Replies:** 18\ **Last updated:** [April 23, 2010, 9:20pm UTC](https://discuss.elastic.co/t/configuring-multiple-nodes/2877 "2010-04-23T21:20:09Z")
Im having a lot of problems getting multiple nodes talking to each other, for some reason netty keeps on giving me errors. \[01:57:20,724\]\[WARN \]\[transport.netty \] \[Alchemy\] Exception caught on netty layer \[… --- ## [How to tune elasticsearch performance](https://discuss.elastic.co/t/how-to-tune-elasticsearch-performance/106472)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 10\ **Last updated:** [November 6, 2017, 8:49pm UTC](https://discuss.elastic.co/t/how-to-tune-elasticsearch-performance/106472 "2017-11-06T20:49:52Z")
I am using ES to ingest flow data from other application, but I found that the ES speed isn't high enough, so sometimes it would drop flow. How can I change the setting of ES performance ? I have seen the elasticsearch… --- ## [Installed x-pack - discover shows no results found](https://discuss.elastic.co/t/installed-x-pack-discover-shows-no-results-found/130896)
**Author:** [@irb7501](https://discuss.elastic.co/u/irb7501)\ **Replies:** 14\ **Last updated:** [May 9, 2018, 12:42am UTC](https://discuss.elastic.co/t/installed-x-pack-discover-shows-no-results-found/130896 "2018-05-09T00:42:18Z")
I have (finally) successfully installed x-pack...so it seems. The current issue is I get no results under kibana's discover tab. I have the following alerts: Medium 17 min ago Elasticsearch cluster nodes have changed… --- ## [Kibana not starting for enabling AD security](https://discuss.elastic.co/t/kibana-not-starting-for-enabling-ad-security/199417)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 13\ **Last updated:** [September 17, 2019, 1:51pm UTC](https://discuss.elastic.co/t/kibana-not-starting-for-enabling-ad-security/199417 "2019-09-17T13:51:03Z")
Dear All, Recently enabled elasticsearch with AD with xpack and able to authenticate successfully via curl command. Kibana is not properly starting up, any help will be appreciated. My intention is to have Kibana secure… --- ## [Unable to detect new logstash instances](https://discuss.elastic.co/t/unable-to-detect-new-logstash-instances/125085)
**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\ **Replies:** 12\ **Last updated:** [March 22, 2018, 8:29pm UTC](https://discuss.elastic.co/t/unable-to-detect-new-logstash-instances/125085 "2018-03-22T20:29:17Z")
Hi , i have ELK stack running and X-pack monitoring is able to detect first 3 logstash node and able to monitor . But i have added 3 more logstash nodes are not able to detect by x-pack monitoring . \[2018-03-21T23:33:3… --- ## [Missing Data Nodes on Cluster Monitoring of Kibana](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546)
**Author:** [@wonderland14](https://discuss.elastic.co/u/wonderland14)\ **Replies:** 10\ **Last updated:** [October 12, 2022, 10:11am UTC](https://discuss.elastic.co/t/missing-data-nodes-on-cluster-monitoring-of-kibana/314546 "2022-10-12T10:11:10Z")
A pleasant day everyone! I have this issue on my Kibana Cluster Monitoring, it happens that my data nodes are missing and only the monitoring nodes is there. I checked the config xpack.monitoring.collection.enabled : tr… [Previous page](https://discuss.elastic.co/top.md?page=144&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=146&per_page=50&period=all)