# Top

**URL:** https://discuss.elastic.co/top.md?page=1453&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1454

---

## [Failed to start shard](https://discuss.elastic.co/t/failed-to-start-shard/18809)

<div class="topic-metadata">

**Author:** [@Mohamed\_Lrhazi](https://discuss.elastic.co/u/Mohamed_Lrhazi)\
**Replies:** 3\
**Last updated:** [October 27, 2014, 1:09pm UTC](https://discuss.elastic.co/t/failed-to-start-shard/18809 "2014-10-27T13:09:31Z")

</div>

Hello, Our master is constantly logging this error, about twice per second.... I saw similar error mentioned in the release notes for a previous verion, this cluster is running 1.0.1. Is it the same issue? What …

---

## [How To Add a Hack New Plugins](https://discuss.elastic.co/t/how-to-add-a-hack-new-plugins/237965)

<div class="topic-metadata">

**Author:** [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Replies:** 5\
**Last updated:** [July 25, 2020, 10:07pm UTC](https://discuss.elastic.co/t/how-to-add-a-hack-new-plugins/237965 "2020-07-25T22:07:39Z")

</div>

There is plenty of documentation on how to add a hack in kibana.plugin using UI exports. How do you add them with the new plugin structure? I generated the plugin and using 7.7.2. I assume it goes somewhere in here. i…

---

## [Getting exception while starting the elastic search node](https://discuss.elastic.co/t/getting-exception-while-starting-the-elastic-search-node/229263)

<div class="topic-metadata">

**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\
**Replies:** 5\
**Last updated:** [April 27, 2020, 7:58am UTC](https://discuss.elastic.co/t/getting-exception-while-starting-the-elastic-search-node/229263 "2020-04-27T07:58:36Z")

</div>

We are getting below exception while starting one of the elastic search nodes. \[2020-04-20T15:22:16,743\]\[ERROR\]\[o.e.g.GatewayMetaState \] \[elk-denmod-web-2\] failed to read local state, exiting... \*\*java.lang.IllegalSta…

---

## [Log stash filters log message - need help](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076)

<div class="topic-metadata">

**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\
**Replies:** 5\
**Last updated:** [March 14, 2020, 11:10am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076 "2020-03-14T11:10:21Z")

</div>

Below are the log stash fields Log stash error : \[2020-03-02T16:48:48,354\]\[WARN \]\[logstash.filters.json \] Error parsing json {:source=\>"message", :raw=\>"WITH CORRESPONDING LINE(S)", "HoldReason": "Invoice pric…

---

## [Case insensitive search with fieldname.keyword](https://discuss.elastic.co/t/case-insensitive-search-with-fieldname-keyword/117994)

<div class="topic-metadata">

**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\
**Replies:** 5\
**Last updated:** [February 1, 2018, 2:49pm UTC](https://discuss.elastic.co/t/case-insensitive-search-with-fieldname-keyword/117994 "2018-02-01T14:49:24Z")

</div>

Hi I need search results with exact matching of word but it should be case insensitive. "Abc","ABC","aBc" : all should come in result but "Abc Def", "ABC FG" : should not come (do not search for substring) GET peopl…

---

## [Whitespace tokenizer does not tokenise character code 160](https://discuss.elastic.co/t/whitespace-tokenizer-does-not-tokenise-character-code-160/12675)

<div class="topic-metadata">

**Author:** [@imdhmd](https://discuss.elastic.co/u/imdhmd)\
**Replies:** 5\
**Last updated:** [July 8, 2013, 8:17am UTC](https://discuss.elastic.co/t/whitespace-tokenizer-does-not-tokenise-character-code-160/12675 "2013-07-08T08:17:18Z")

</div>

Hello All, I'm using ES 0.20.6. (all the curl commands below are available at this gist: https://gist.github.com/imdhmd/cda6880e0cc770e80052) ISSUE: Unable to tokenize character code 160 (which looks like spac…

---

## [Https://localhost:8221/ errored!](https://discuss.elastic.co/t/https-localhost-8221-errored/334328)

<div class="topic-metadata">

**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\
**Replies:** 2\
**Last updated:** [May 30, 2023, 6:05pm UTC](https://discuss.elastic.co/t/https-localhost-8221-errored/334328 "2023-05-30T18:05:07Z")

</div>

Hi, When installing elastic agent on remote servers It shows that it is successful and I can see logs in Kibana: root@srv:~/elastic-agent-8.7.1-linux-x86\_64# ./elastic-agent install --url=https://ip:port --fleet-server…

---

## [Authentication to realm default native failed - Password authentication failed for xyz](https://discuss.elastic.co/t/authentication-to-realm-default-native-failed-password-authentication-failed-for-xyz/271759)

<div class="topic-metadata">

**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\
**Replies:** 2\
**Last updated:** [May 3, 2021, 8:09am UTC](https://discuss.elastic.co/t/authentication-to-realm-default-native-failed-password-authentication-failed-for-xyz/271759 "2021-05-03T08:09:15Z")

</div>

Hi All, Elasticsearch-version-7.6.2 I have created xyz admin user for only monitoring the url. For that I have created one custom role and add that role into the user. Below is my role code with the name my\_admin\_role …

---

## [\[FILEBEAT\] Insert timestamp inside of logfile name](https://discuss.elastic.co/t/filebeat-insert-timestamp-inside-of-logfile-name/249843)

<div class="topic-metadata">

**Author:** [@mstojanovic](https://discuss.elastic.co/u/mstojanovic)\
**Replies:** 2\
**Last updated:** [September 25, 2020, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-insert-timestamp-inside-of-logfile-name/249843 "2020-09-25T15:15:50Z")

</div>

Hello, I want to gather logs from a specific location. As the log's name is changed each day, I would like to insert timestamp in log file name. By doing so, each new day, the correct log name will be parsed by filebeat…

---

## [Fuzzy Hash plugins (Java API for custom types, mappings?)](https://discuss.elastic.co/t/fuzzy-hash-plugins-java-api-for-custom-types-mappings/187866)

<div class="topic-metadata">

**Author:** [@rjzak](https://discuss.elastic.co/u/rjzak)\
**Replies:** 2\
**Last updated:** [June 27, 2019, 9:33pm UTC](https://discuss.elastic.co/t/fuzzy-hash-plugins-java-api-for-custom-types-mappings/187866 "2019-06-27T21:33:43Z")

</div>

I'm interested in developing plugins for fuzzy hashes, including ssdeep, sdhash, and LZJD. I did find something similar, an existing ssdeep plugin for Elasticsearch in Python, but I'd prefer to write the code in Java, si…

---

## [Kibana' remoteAddress & userAgent](https://discuss.elastic.co/t/kibana-remoteaddress-useragent/111853)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 2\
**Last updated:** [December 15, 2017, 9:19pm UTC](https://discuss.elastic.co/t/kibana-remoteaddress-useragent/111853 "2017-12-15T21:19:12Z")

</div>

I'm looking at Kibana's logs and I'm seeing following: kibana11-custom | {"type":"response","@timestamp":"2017-12-14T16:31:29Z","tags":,"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/status","method":"get",…

---

## [Watcher to make HTTP requests to multiple host nodes as a form of redundancy](https://discuss.elastic.co/t/watcher-to-make-http-requests-to-multiple-host-nodes-as-a-form-of-redundancy/84212)

<div class="topic-metadata">

**Author:** [@agf](https://discuss.elastic.co/u/agf)\
**Replies:** 2\
**Last updated:** [May 16, 2017, 2:13am UTC](https://discuss.elastic.co/t/watcher-to-make-http-requests-to-multiple-host-nodes-as-a-form-of-redundancy/84212 "2017-05-16T02:13:39Z")

</div>

I have a separate watcher server which hosts all of my watchers. My watchers monitor my ES cluster which consists of multiple nodes. My watchers use 'HTTP requests' inputs. One of my uses for watchers is to monitor the…

---

## [Install older beats version from repo](https://discuss.elastic.co/t/install-older-beats-version-from-repo/72847)

<div class="topic-metadata">

**Author:** [@pipazarro](https://discuss.elastic.co/u/pipazarro)\
**Replies:** 2\
**Last updated:** [January 26, 2017, 7:50pm UTC](https://discuss.elastic.co/t/install-older-beats-version-from-repo/72847 "2017-01-26T19:50:50Z")

</div>

Hi, I tried installing filebeat v5.1.1 from APT repo and it throws an error: E: Version '5.1.1' for 'filebeat' was not found It looks like it is a known issue: https://discuss.elastic.co/t/install-old-beats-version-f…

---

## [Where do I raise bugs for Graph?](https://discuss.elastic.co/t/where-do-i-raise-bugs-for-graph/48505)

<div class="topic-metadata">

**Author:** [@rmoff](https://discuss.elastic.co/u/rmoff)\
**Replies:** 2\
**Last updated:** [April 27, 2016, 6:21pm UTC](https://discuss.elastic.co/t/where-do-i-raise-bugs-for-graph/48505 "2016-04-27T18:21:39Z")

</div>

Where do I log bugs for Graph? I don't see a github repo to log issues against. Thanks.

---

## [Explicit mapping for "not an array"](https://discuss.elastic.co/t/explicit-mapping-for-not-an-array/26827)

<div class="topic-metadata">

**Author:** [@jdh2550](https://discuss.elastic.co/u/jdh2550)\
**Replies:** 2\
**Last updated:** [August 4, 2015, 7:41pm UTC](https://discuss.elastic.co/t/explicit-mapping-for-not-an-array/26827 "2015-08-04T19:41:53Z")

</div>

As I understand things the mapping definition doesn't distinguish between arrays or single values. In other words if I have a mapping of "myfield": { "type": integer } then myfield could contain either 1, \[1\] or \[1,2,3…

---

## [Kibana - DIscover - Issue "indexing is not supported on a read-only engine"](https://discuss.elastic.co/t/kibana-discover-issue-indexing-is-not-supported-on-a-read-only-engine/303389)

<div class="topic-metadata">

**Author:** [@Penchev](https://discuss.elastic.co/u/Penchev)\
**Replies:** 6\
**Last updated:** [April 28, 2022, 10:51am UTC](https://discuss.elastic.co/t/kibana-discover-issue-indexing-is-not-supported-on-a-read-only-engine/303389 "2022-04-28T10:51:34Z")

</div>

Hi, I have an issue with KIbana Disocver module. I cannot search in my indices. The error I see is : "indexing is not supported on a read-only engine". All my indices are with status green. I tried running the followin…

---

## [Scroll & heap size\\ another memory configuration](https://discuss.elastic.co/t/scroll-heap-size-another-memory-configuration/241732)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 6\
**Last updated:** [July 22, 2020, 5:57am UTC](https://discuss.elastic.co/t/scroll-heap-size-another-memory-configuration/241732 "2020-07-22T05:57:44Z")

</div>

Hi, I want to fetch 50 millions of records into data frame with scan(scroll...) what heap size do I need for that procedure? How can I know what is the right size for me? do I need to configure it only in the master …

---

## [Does Elasticsearch work with Apache HTTPD on Windows?](https://discuss.elastic.co/t/does-elasticsearch-work-with-apache-httpd-on-windows/189712)

<div class="topic-metadata">

**Author:** [@chris\_kerr](https://discuss.elastic.co/u/chris_kerr)\
**Replies:** 6\
**Last updated:** [July 10, 2019, 11:27am UTC](https://discuss.elastic.co/t/does-elasticsearch-work-with-apache-httpd-on-windows/189712 "2019-07-10T11:27:30Z")

</div>

I haven't been able to find an answer to this in the documentation. I am part of a team currently evaluating whether Elasticsearch works for us. Getting Elasticsearch up and running will take some time, so it would be h…

---

## [Load an xml files](https://discuss.elastic.co/t/load-an-xml-files/164647)

<div class="topic-metadata">

**Author:** [@Alaoui](https://discuss.elastic.co/u/Alaoui)\
**Replies:** 6\
**Last updated:** [January 17, 2019, 3:45pm UTC](https://discuss.elastic.co/t/load-an-xml-files/164647 "2019-01-17T15:45:40Z")

</div>

Hi, i want to load a 100 xml files in the same time using logstash, so what i should to add in my config file!.

---

## [\[SQL\] Return type constraints are overly restrictive](https://discuss.elastic.co/t/sql-return-type-constraints-are-overly-restrictive/145185)

<div class="topic-metadata">

**Author:** [@paulcarey](https://discuss.elastic.co/u/paulcarey)\
**Replies:** 6\
**Last updated:** [August 28, 2018, 1:16pm UTC](https://discuss.elastic.co/t/sql-return-type-constraints-are-overly-restrictive/145185 "2018-08-28T13:16:10Z")

</div>

Hi Executing the following DELETE nested\_numbers POST /nested\_numbers/\_doc {"numbers": \[{"n": 1}, {"n": 2}\]} POST /\_xpack/sql?format=json { "query": "select \* from nested\_numbers" } will fail with an sql\_illegal\_arg…

---

## [Increasing 'index.mapping.nested\_objects.limit' setting's value has no effect](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-settings-value-has-no-effect/228242)

<div class="topic-metadata">

**Author:** [@elastic2](https://discuss.elastic.co/u/elastic2)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 5:00am UTC](https://discuss.elastic.co/t/increasing-index-mapping-nested-objects-limit-settings-value-has-no-effect/228242 "2020-04-16T05:00:51Z")

</div>

Hello, I am facing an issue, where i get the exception: { "type": "mapper\_parsing\_exception", "reason": "The number of nested documents has exceeded the allowed limit of \[10000\]. This li…

---

## [Functionbeat fails to update with a new cloudwatch log group Could not execute the lambda function](https://discuss.elastic.co/t/functionbeat-fails-to-update-with-a-new-cloudwatch-log-group-could-not-execute-the-lambda-function/315020)

<div class="topic-metadata">

**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\
**Replies:** 1\
**Last updated:** [October 14, 2022, 7:07am UTC](https://discuss.elastic.co/t/functionbeat-fails-to-update-with-a-new-cloudwatch-log-group-could-not-execute-the-lambda-function/315020 "2022-10-14T07:07:16Z")

</div>

We had functionbeat running and i had to remove and recreate it, however im getting the following errors: {"log.level":"info","@timestamp":"2022-09-23T13:55:44.066+0100","log.logger":"aws","log.origin":{"file.name":"aws…

---

## [Elasticsearch-hadoop inserting query as field](https://discuss.elastic.co/t/elasticsearch-hadoop-inserting-query-as-field/104192)

<div class="topic-metadata">

**Author:** [@avlach](https://discuss.elastic.co/u/avlach)\
**Replies:** 1\
**Last updated:** [October 31, 2017, 4:19pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-inserting-query-as-field/104192 "2017-10-31T16:19:28Z")

</div>

Hello, I am trying to use elasticsearch-hadoop v5.6.2 with pyspark and I have the following issue. The sample code is very simple just to det the hang of it: df = spark.read.format('org.elasticsearch.spark.sql').load('…

---

## [How to use Logs in Logstash format with Filebeat](https://discuss.elastic.co/t/how-to-use-logs-in-logstash-format-with-filebeat/229786)

<div class="topic-metadata">

**Author:** [@BuesBu](https://discuss.elastic.co/u/BuesBu)\
**Replies:** 1\
**Last updated:** [April 25, 2020, 10:27pm UTC](https://discuss.elastic.co/t/how-to-use-logs-in-logstash-format-with-filebeat/229786 "2020-04-25T22:27:55Z")

</div>

Hello guys, I'm at my wit's end and I need your advice. We use Filebeat to send our logs to elastic search (Cloud). All good so far. Nginx and system logs are working fine so far. Now we would like to send our logs …

---

## [\[logstash.pipeline\] A plugin had an unrecoverable error](https://discuss.elastic.co/t/logstash-pipeline-a-plugin-had-an-unrecoverable-error/134627)

<div class="topic-metadata">

**Author:** [@swastime](https://discuss.elastic.co/u/swastime)\
**Replies:** 1\
**Last updated:** [June 11, 2018, 8:41am UTC](https://discuss.elastic.co/t/logstash-pipeline-a-plugin-had-an-unrecoverable-error/134627 "2018-06-11T08:41:21Z")

</div>

Hi! I'm new to the ELK stack and I am trying to use the jdbc input plugin to put data from my derby database into kibana. I am using a windows computer and I have elasticsearch, kibana and logstash installed, I am using …

---

## [Display noValue as 0 in Kibana Heat Maps](https://discuss.elastic.co/t/display-novalue-as-0-in-kibana-heat-maps/105545)

<div class="topic-metadata">

**Author:** [@Manoj\_13](https://discuss.elastic.co/u/Manoj_13)\
**Replies:** 1\
**Last updated:** [October 27, 2017, 8:53pm UTC](https://discuss.elastic.co/t/display-novalue-as-0-in-kibana-heat-maps/105545 "2017-10-27T20:53:24Z")

</div>

In Kibana Heat Maps ,Can i get the value as zero if no incidents exits under a category(right now i am getting balnk spaces)\[Screenshot (78)\]

---

## [Récupérer les résultats d'une requête](https://discuss.elastic.co/t/recuperer-les-resultats-dune-requete/80035)

<div class="topic-metadata">

**Author:** [@Johann\_RIDARCH](https://discuss.elastic.co/u/Johann_RIDARCH)\
**Replies:** 1\
**Last updated:** [March 28, 2017, 2:43pm UTC](https://discuss.elastic.co/t/recuperer-les-resultats-dune-requete/80035 "2017-03-28T14:43:31Z")

</div>

Bonjour à tous et à toutes Je viens tout juste de commencer sur Elasticsearch et je vous cache pas que ça me paraît assez abscons pour l'instant. J'utilise l'API sur Symfony 2. Pour vous situer un peu le context…

---

## [Wildcard in conditionals?](https://discuss.elastic.co/t/wildcard-in-conditionals/37016)

<div class="topic-metadata">

**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\
**Replies:** 1\
**Last updated:** [December 12, 2015, 1:00am UTC](https://discuss.elastic.co/t/wildcard-in-conditionals/37016 "2015-12-12T01:00:20Z")

</div>

Is this legal? output{ if "\*error\*" in \[tags\] or "\*failure\*" in \[tags\]{ stdout{ codec =\> rubydebug } } else{ # index in ES } }

---

## [Variable to store list of recipient addresses for Elastic Watcher](https://discuss.elastic.co/t/variable-to-store-list-of-recipient-addresses-for-elastic-watcher/306108)

<div class="topic-metadata">

**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\
**Replies:** 4\
**Last updated:** [June 14, 2022, 11:34am UTC](https://discuss.elastic.co/t/variable-to-store-list-of-recipient-addresses-for-elastic-watcher/306108 "2022-06-14T11:34:27Z")

</div>

Hi Team, In our production setup, we have multiple watcher alerts (around 100), having different sets of recipient email addresses. Now if there is any requirement from the client to update the list, we need to edit 100…

---

## [Radar Chart with Dynamic Data](https://discuss.elastic.co/t/radar-chart-with-dynamic-data/285002)

<div class="topic-metadata">

**Author:** [@bodach](https://discuss.elastic.co/u/bodach)\
**Replies:** 4\
**Last updated:** [September 24, 2021, 9:21am UTC](https://discuss.elastic.co/t/radar-chart-with-dynamic-data/285002 "2021-09-24T09:21:29Z")

</div>

Hello, I am a beginner with Kibana and Vega. I m trying to create a radar chart with an index. I managed to create a chart with static values. See below: vega code However, when I try to do the same with my index, I …

---

## [Canvas filter's title - How can I replace the "--ANY--"?](https://discuss.elastic.co/t/canvas-filters-title-how-can-i-replace-the-any/216327)

<div class="topic-metadata">

**Author:** [@rosamar](https://discuss.elastic.co/u/rosamar)\
**Replies:** 4\
**Last updated:** [January 29, 2020, 3:21pm UTC](https://discuss.elastic.co/t/canvas-filters-title-how-can-i-replace-the-any/216327 "2020-01-29T15:21:21Z")

</div>

How can I replace the "--ANY--" showed in a filter item when the dropdown id closed to show a proper "title" indicating what data that filter refers to? Thank you!

---

## [ESE allocators xfs not showing allocated space](https://discuss.elastic.co/t/ese-allocators-xfs-not-showing-allocated-space/151962)

<div class="topic-metadata">

**Author:** [@JeanD-SYD](https://discuss.elastic.co/u/JeanD-SYD)\
**Replies:** 4\
**Last updated:** [October 12, 2018, 4:12am UTC](https://discuss.elastic.co/t/ese-allocators-xfs-not-showing-allocated-space/151962 "2018-10-12T04:12:32Z")

</div>

Hi, I have setup 3 allocators using the small script on Ubuntu 16.04. https://www.elastic.co/guide/en/cloud-enterprise/current/ece-topology-example1.html The servers have each a root drive of 80GB and an extra drive o…

---

## [Flush Logstash-output-email Queue](https://discuss.elastic.co/t/flush-logstash-output-email-queue/94517)

<div class="topic-metadata">

**Author:** [@Nishant\_Kumar1](https://discuss.elastic.co/u/Nishant_Kumar1)\
**Replies:** 4\
**Last updated:** [July 26, 2017, 11:23am UTC](https://discuss.elastic.co/t/flush-logstash-output-email-queue/94517 "2017-07-26T11:23:07Z")

</div>

I configured Filebeats to add new Logfiles in the harvestors' path and restarted the filebeat service on those instances from where the Logs were to be harvested. On the Logstash side, I configured the Logstash-output-…

---

## [Data Type in Kibana & sync pace?](https://discuss.elastic.co/t/data-type-in-kibana-sync-pace/59241)

<div class="topic-metadata">

**Author:** [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)\
**Replies:** 4\
**Last updated:** [August 30, 2016, 4:40pm UTC](https://discuss.elastic.co/t/data-type-in-kibana-sync-pace/59241 "2016-08-30T16:40:03Z")

</div>

If i changed a field's data type within the same indice, does Kibana show the previous data type or the updated one, or both?? And does kibana instantly reflect the update from ES? (which i don't think so)

---

## [Playing with GroovyConsole](https://discuss.elastic.co/t/playing-with-groovyconsole/3900)

<div class="topic-metadata">

**Author:** [@David\_Hernandez](https://discuss.elastic.co/u/David_Hernandez)\
**Replies:** 4\
**Last updated:** [February 8, 2011, 6:29pm UTC](https://discuss.elastic.co/t/playing-with-groovyconsole/3900 "2011-02-08T18:29:39Z")

</div>

Hi I'm playing with the Groovy API inside Groovy Console @GrabResolver(name='elasticsearch', root='http://oss.sonatype.org/content/repositories/releases/') @GrabResolver(name='maven', root='http://repo1.maven.org/ma…

---

## [About index template upon output from logstash to elasticsearch](https://discuss.elastic.co/t/about-index-template-upon-output-from-logstash-to-elasticsearch/1982)

<div class="topic-metadata">

**Author:** [@zkun](https://discuss.elastic.co/u/zkun)\
**Replies:** 3\
**Last updated:** [June 8, 2015, 6:56am UTC](https://discuss.elastic.co/t/about-index-template-upon-output-from-logstash-to-elasticsearch/1982 "2015-06-08T06:56:02Z")

</div>

Hi guys, recently I'm trying to setup multiple indices in ES for log storage of different services. And I noticed that I might need to set field value types for them respectively, which involves applying different templa…

---

## [ES|QL command join](https://discuss.elastic.co/t/es-ql-command-join/363425)

<div class="topic-metadata">

**Author:** [@nspaniol](https://discuss.elastic.co/u/nspaniol)\
**Replies:** 2\
**Last updated:** [May 1, 2025, 1:14pm UTC](https://discuss.elastic.co/t/es-ql-command-join/363425 "2025-05-01T13:14:35Z")

</div>

Hello Team, I am new to the environment Kibana and used some commands for a few weeks. My question today is about the ES|QL language. There are several types of commands, written down in the Docs. Through my lecture, …

---

## [Filebeat journald input failing to open a handle to the library](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505)

<div class="topic-metadata">

**Author:** [@Marko\_Todoric](https://discuss.elastic.co/u/Marko_Todoric)\
**Replies:** 2\
**Last updated:** [June 18, 2022, 9:07am UTC](https://discuss.elastic.co/t/filebeat-journald-input-failing-to-open-a-handle-to-the-library/307505 "2022-06-18T09:07:16Z")

</div>

Hello everyone, i just managed to compile filebeat to work on armv7 with journald input (regular filestream works just fine) however when starting filebeat i get a following error message, filebeat keeps on running but …

---

## [Cannot mount elasticsearch.yml in ECK CRD](https://discuss.elastic.co/t/cannot-mount-elasticsearch-yml-in-eck-crd/246834)

<div class="topic-metadata">

**Author:** [@amanjain](https://discuss.elastic.co/u/amanjain)\
**Replies:** 2\
**Last updated:** [August 31, 2020, 7:47am UTC](https://discuss.elastic.co/t/cannot-mount-elasticsearch-yml-in-eck-crd/246834 "2020-08-31T07:47:32Z")

</div>

I am trying to mount elasticsearch.yml from my kubernetes configmap as follows but the elastic-internal-init-filesystem init container is throwing error. Error Starting init script Linking /mnt/elastic-internal/xpack-f…

---

## [Result window is too large, from + size must be less than or equal to: \[1000\] but was \[1025\]](https://discuss.elastic.co/t/result-window-is-too-large-from-size-must-be-less-than-or-equal-to-1000-but-was-1025/163615)

<div class="topic-metadata">

**Author:** [@arunics](https://discuss.elastic.co/u/arunics)\
**Replies:** 2\
**Last updated:** [January 9, 2019, 8:34pm UTC](https://discuss.elastic.co/t/result-window-is-too-large-from-size-must-be-less-than-or-equal-to-1000-but-was-1025/163615 "2019-01-09T20:34:21Z")

</div>

I am seeing the above error when Application Searches from ES cluster. I wonder how it shows as 1000 when the default seems to be 10K. ES Version: "number" : "5.5.3", "build\_hash" : "9305a5e", "build\_date" : "2017-09…

---

## [Kibana dont show all messages in datatable](https://discuss.elastic.co/t/kibana-dont-show-all-messages-in-datatable/159327)

<div class="topic-metadata">

**Author:** [@Oleg\_Gorelikov](https://discuss.elastic.co/u/Oleg_Gorelikov)\
**Replies:** 2\
**Last updated:** [December 12, 2018, 10:32pm UTC](https://discuss.elastic.co/t/kibana-dont-show-all-messages-in-datatable/159327 "2018-12-12T22:32:55Z")

</div>

Hello! I created saved search, where i have messages with word "Ошибка". In this search i see all messages - its correct: Then i need to see agregation by sum of this message in visualization. When i created visualiz…

---

## [Split Nested Object](https://discuss.elastic.co/t/split-nested-object/104911)

<div class="topic-metadata">

**Author:** [@filipe.ferreira](https://discuss.elastic.co/u/filipe.ferreira)\
**Replies:** 2\
**Last updated:** [November 3, 2017, 4:54pm UTC](https://discuss.elastic.co/t/split-nested-object/104911 "2017-11-03T16:54:03Z")

</div>

I have a json log that looks like this: { "a" : "info", "data" : { "x1" : { Object }, "x2" : { Object }, "x3" : { Object } } } I would like to convert it to look like this: { "a" : "info", "data" : { "x1" : …

---

## [Topbeat alerting](https://discuss.elastic.co/t/topbeat-alerting/73007)

<div class="topic-metadata">

**Author:** [@bini](https://discuss.elastic.co/u/bini)\
**Replies:** 2\
**Last updated:** [January 30, 2017, 8:47am UTC](https://discuss.elastic.co/t/topbeat-alerting/73007 "2017-01-30T08:47:43Z")

</div>

Hi, i want to trigger an email whenever the C: drive reaches 40 Gb. How can this be done? any help would be appreciated. Thanks :slight\_smile:

---

## [Different data in exported pdf report (Bug?)](https://discuss.elastic.co/t/different-data-in-exported-pdf-report-bug/61824)

<div class="topic-metadata">

**Author:** [@Eike](https://discuss.elastic.co/u/Eike)\
**Replies:** 2\
**Last updated:** [October 10, 2016, 11:27pm UTC](https://discuss.elastic.co/t/different-data-in-exported-pdf-report-bug/61824 "2016-10-10T23:27:02Z")

</div>

I made a dashboard with several visualizations which i then exported to a pdf file. For most visualizations this worked fine (Same data in export as visible on the dash), but the "search" (just a table of results) has …

---

## [How many users are accessing elasticsearch at any given moment](https://discuss.elastic.co/t/how-many-users-are-accessing-elasticsearch-at-any-given-moment/54387)

<div class="topic-metadata">

**Author:** [@Karambir.Singh](https://discuss.elastic.co/u/Karambir.Singh)\
**Replies:** 2\
**Last updated:** [July 12, 2016, 8:57am UTC](https://discuss.elastic.co/t/how-many-users-are-accessing-elasticsearch-at-any-given-moment/54387 "2016-07-12T08:57:11Z")

</div>

Hi, I am new to ELK stack and I employed this for log managment for my current project. As per my new requirement, I wanted to know that at a give moment, how many users are accessing elasticsearch or how many request …

---

## [How to aggregate values for embedded documents](https://discuss.elastic.co/t/how-to-aggregate-values-for-embedded-documents/28777)

<div class="topic-metadata">

**Author:** [@Keith\_Garrod](https://discuss.elastic.co/u/Keith_Garrod)\
**Replies:** 2\
**Last updated:** [September 8, 2015, 7:42am UTC](https://discuss.elastic.co/t/how-to-aggregate-values-for-embedded-documents/28777 "2015-09-08T07:42:23Z")

</div>

I have a document 'user' with embedded 'review' documents. Each review document has a 'rating' field. I want to run a query which returns a 'range' type field for each 'user' that is returned from a query. I am able …

---

## [My Elastic search and Kibana functionalities are not working after container restart , i need to recreate the entire setup again to configure logs and apm,](https://discuss.elastic.co/t/my-elastic-search-and-kibana-functionalities-are-not-working-after-container-restart-i-need-to-recreate-the-entire-setup-again-to-configure-logs-and-apm/361833)

<div class="topic-metadata">

**Author:** [@devops\_yorosis](https://discuss.elastic.co/u/devops_yorosis)\
**Replies:** 8\
**Last updated:** [June 21, 2024, 12:51pm UTC](https://discuss.elastic.co/t/my-elastic-search-and-kibana-functionalities-are-not-working-after-container-restart-i-need-to-recreate-the-entire-setup-again-to-configure-logs-and-apm/361833 "2024-06-21T12:51:49Z")

</div>

Hi, Actually we are running Elasticsearch and Kibana as a Docker container and then we connect to our cluster. actually the problem is when we are patching the servers , our running elastic and Kibana container gets rest…

---

## [Advanced Configuration Machine Learning](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 8\
**Last updated:** [September 30, 2022, 7:58am UTC](https://discuss.elastic.co/t/advanced-configuration-machine-learning/315446 "2022-09-30T07:58:43Z")

</div>

I want to use high count function for a field , for this i select Advanced Confiugration wizard Machine Learning \> Anomaly Detection \> Create Job \> Advanced configuration Here i am using high\_count detector for test…

---

## [Instaall filebeat on Oracle Solaris on SPARC (64-bit) OS](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882)

<div class="topic-metadata">

**Author:** [@Mar-g2021](https://discuss.elastic.co/u/Mar-g2021)\
**Replies:** 3\
**Last updated:** [July 5, 2021, 5:55am UTC](https://discuss.elastic.co/t/instaall-filebeat-on-oracle-solaris-on-sparc-64-bit-os/276882 "2021-07-05T05:55:38Z")

</div>

Filebeat can be installed or there is another beat that can be installed on Oracle Solaris on SPARC (64-bit) OS version 11.4 to send database logs?

---

## [Change order to return web pages first](https://discuss.elastic.co/t/change-order-to-return-web-pages-first/216090)

<div class="topic-metadata">

**Author:** [@elitzur\_e](https://discuss.elastic.co/u/elitzur_e)\
**Replies:** 3\
**Last updated:** [February 17, 2020, 12:45pm UTC](https://discuss.elastic.co/t/change-order-to-return-web-pages-first/216090 "2020-02-17T12:45:45Z")

</div>

HI, is there a way to change the weight (or some other method) so that all web pages typs get a higher score? thanks

[Previous page](https://discuss.elastic.co/top.md?page=1452&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1454&per_page=50&period=all)
