# Top

**URL:** https://discuss.elastic.co/top.md?page=1468&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1469

---

## [Error with Elasticsearch lab environment](https://discuss.elastic.co/t/error-with-elasticsearch-lab-environment/248051)

<div class="topic-metadata">

**Author:** [@Keith\_Sanks](https://discuss.elastic.co/u/Keith_Sanks)\
**Replies:** 7\
**Last updated:** [September 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/error-with-elasticsearch-lab-environment/248051 "2020-09-10T16:32:34Z")

</div>

I'm currently enrolled and taking the On-Demand Elasticsearch Engineering 1 course, and I've run into an issue, the course lab informs me to make edits to the elasticsearch.yml, after making the edit to the elasticsearch…

---

## [Regular expression on array/list field](https://discuss.elastic.co/t/regular-expression-on-array-list-field/149329)

<div class="topic-metadata">

**Author:** [@jprat](https://discuss.elastic.co/u/jprat)\
**Replies:** 1\
**Last updated:** [September 24, 2018, 6:21pm UTC](https://discuss.elastic.co/t/regular-expression-on-array-list-field/149329 "2018-09-24T18:21:17Z")

</div>

Hi, I was wondering if it is possible to make an expression into an if condition where I could check if a field, which is an array/list, could contain any string matching certain regular expression. For example tags =\> …

---

## [Filebeat Loadbalancing not working](https://discuss.elastic.co/t/filebeat-loadbalancing-not-working/142478)

<div class="topic-metadata">

**Author:** [@hangstl](https://discuss.elastic.co/u/hangstl)\
**Replies:** 1\
**Last updated:** [August 1, 2018, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-loadbalancing-not-working/142478 "2018-08-01T16:02:47Z")

</div>

I have setup a Logstash Cluster in Google Cloud that sits behind a Load Balancer and uses Autoscaling (-\> when the load gets to high new instances are started up automatically). Unfortunately this does not work properly…

---

## [Elasticsearch ceph s3 repository 400; "Error Code: InvalidArgument; Request ID: null"](https://discuss.elastic.co/t/elasticsearch-ceph-s3-repository-400-error-code-invalidargument-request-id-null/76903)

<div class="topic-metadata">

**Author:** [@lookcrabs](https://discuss.elastic.co/u/lookcrabs)\
**Replies:** 1\
**Last updated:** [March 1, 2017, 4:19am UTC](https://discuss.elastic.co/t/elasticsearch-ceph-s3-repository-400-error-code-invalidargument-request-id-null/76903 "2017-03-01T04:19:17Z")

</div>

I ran out of space so i'm trying to set up a repository so i can snapshot then delete some indices until I can add more nodes. I setup the following in my elasticsearch.yml cloud: aws: access\_key: XXXXX …

---

## [Convert a string field to geopoint](https://discuss.elastic.co/t/convert-a-string-field-to-geopoint/65864)

<div class="topic-metadata">

**Author:** [@mtarimo](https://discuss.elastic.co/u/mtarimo)\
**Replies:** 1\
**Last updated:** [November 14, 2016, 8:47am UTC](https://discuss.elastic.co/t/convert-a-string-field-to-geopoint/65864 "2016-11-14T08:47:39Z")

</div>

Hi there, We made a mistake when we were indexing our data. We have about 7.1m documents (8GB of data). Our location information has been stored as string. We want to convert this data to geopoint for visualization. Th…

---

## [Regexp Query Not working](https://discuss.elastic.co/t/regexp-query-not-working/14562)

<div class="topic-metadata">

**Author:** [@deep\_saxena](https://discuss.elastic.co/u/deep_saxena)\
**Replies:** 7\
**Last updated:** [November 25, 2013, 8:46am UTC](https://discuss.elastic.co/t/regexp-query-not-working/14562 "2013-11-25T08:46:52Z")

</div>

{ "query": { "regexp": { "first.name": "s\*", "flags": "EMPTY" } } } There is the indexed data 1) Summon in the statement 2) sussy, lussy like names in the elasticsearch server. W…

---

## [Problems with escaping input](https://discuss.elastic.co/t/problems-with-escaping-input/8172)

<div class="topic-metadata">

**Author:** [@Jon\_Hurlock](https://discuss.elastic.co/u/Jon_Hurlock)\
**Replies:** 1\
**Last updated:** [June 21, 2012, 7:25am UTC](https://discuss.elastic.co/t/problems-with-escaping-input/8172 "2012-06-21T07:25:14Z")

</div>

Hi All, I'm having trouble inserting data into Elasticsearch via python, in particular the problem concerns handling speech/quotation marks (e.g. "). I have tried escaping the speech marks however, it seems to have no…

---

## [Listening to multiple ports for Netflow traffic](https://discuss.elastic.co/t/listening-to-multiple-ports-for-netflow-traffic/294226)

<div class="topic-metadata">

**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Replies:** 3\
**Last updated:** [January 14, 2022, 1:35pm UTC](https://discuss.elastic.co/t/listening-to-multiple-ports-for-netflow-traffic/294226 "2022-01-14T13:35:47Z")

</div>

Hi, My filebeat 7.14.0 is currently listening on UDP port 1234 for Netflow packets using the Netflow module. Can I configure my netflow.yml to listen to multiple UDP ports for Netflow packets? E.g. (netflow.yml) - mod…

---

## [Monitoring difference in count values on Kibana](https://discuss.elastic.co/t/monitoring-difference-in-count-values-on-kibana/240010)

<div class="topic-metadata">

**Author:** [@gaurav.raj917](https://discuss.elastic.co/u/gaurav.raj917)\
**Replies:** 3\
**Last updated:** [July 21, 2020, 7:41pm UTC](https://discuss.elastic.co/t/monitoring-difference-in-count-values-on-kibana/240010 "2020-07-21T19:41:28Z")

</div>

I'm using metricbeat to push my application metrics to elasticsearch and then visualize it in Kibana. Metricbeat pushes metrics every 10 seconds to elasticsearch. My application is pushing count metric with different lab…

---

## [Elasticsearch ngram tokenizer](https://discuss.elastic.co/t/elasticsearch-ngram-tokenizer/214398)

<div class="topic-metadata">

**Author:** [@mirec](https://discuss.elastic.co/u/mirec)\
**Replies:** 3\
**Last updated:** [January 13, 2020, 3:12pm UTC](https://discuss.elastic.co/t/elasticsearch-ngram-tokenizer/214398 "2020-01-13T15:12:30Z")

</div>

Hi, \[Elasticsearch version 6.7.2\] I am trying to index my data using ngram tokenizer but sometimes it takes too much time to index. What I am trying to do is to make user to be able to search for any word or part of t…

---

## [Connection could be made because the target machine actively refused it](https://discuss.elastic.co/t/connection-could-be-made-because-the-target-machine-actively-refused-it/208151)

<div class="topic-metadata">

**Author:** [@Coder\_HK](https://discuss.elastic.co/u/Coder_HK)\
**Replies:** 3\
**Last updated:** [December 7, 2019, 7:51pm UTC](https://discuss.elastic.co/t/connection-could-be-made-because-the-target-machine-actively-refused-it/208151 "2019-12-07T19:51:56Z")

</div>

I am running windows 10 as my main OS and Ubuntu in Vm ware.. I have installed ELK on ubuntu and now I want to move Sysmon/winlogbeat logs to logstash but I am getting the error .. every thing is running .. E,L,K

---

## [\[ES7.0.1+python3\]\[HELP\]es.bulk() + python3 doesn't ingest csv data into elasticsearch](https://discuss.elastic.co/t/es7-0-1-python3-help-es-bulk-python3-doesnt-ingest-csv-data-into-elasticsearch/197749)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 3\
**Last updated:** [September 6, 2019, 1:05am UTC](https://discuss.elastic.co/t/es7-0-1-python3-help-es-bulk-python3-doesnt-ingest-csv-data-into-elasticsearch/197749 "2019-09-06T01:05:16Z")

</div>

Hi Team, Please check below code which is use python3 and es.bulk() to ingest data in large csv file into elasticsearch. The result is that it doesn't ingest any data. The for loop looks like is not iterative. what's w…

---

## [Dotnet APM Agent Public API calls not cooperating](https://discuss.elastic.co/t/dotnet-apm-agent-public-api-calls-not-cooperating/192140)

<div class="topic-metadata">

**Author:** [@MattK](https://discuss.elastic.co/u/MattK)\
**Replies:** 3\
**Last updated:** [July 25, 2019, 9:09pm UTC](https://discuss.elastic.co/t/dotnet-apm-agent-public-api-calls-not-cooperating/192140 "2019-07-25T21:09:39Z")

</div>

Kibana version: 6.8.0 Elasticsearch version: 6.8.0 APM Server version: 6.8.0 APM Agent language and version: dotnet 1.0.0-beta1 Browser version: Firefox Quantum 67.0.4 (64-bit) Original install method: Download page…

---

## [Ignore mapping Exceptions at searching time](https://discuss.elastic.co/t/ignore-mapping-exceptions-at-searching-time/159302)

<div class="topic-metadata">

**Author:** [@alizadehei](https://discuss.elastic.co/u/alizadehei)\
**Replies:** 3\
**Last updated:** [December 9, 2018, 9:31pm UTC](https://discuss.elastic.co/t/ignore-mapping-exceptions-at-searching-time/159302 "2018-12-09T21:31:24Z")

</div>

hi Elasticsearch by default throws an exception if searching data for a field which does not fit the existing type. For example, if a field has been created as number type, index a document with a string value for that …

---

## [Elasticsearch indexing performance io wait](https://discuss.elastic.co/t/elasticsearch-indexing-performance-io-wait/150587)

<div class="topic-metadata">

**Author:** [@matw](https://discuss.elastic.co/u/matw)\
**Replies:** 0\
**Last updated:** [October 1, 2018, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-performance-io-wait/150587 "2018-10-01T16:55:01Z")

</div>

I've got 2 similar deployments of our application: 5.6.1 elasticsearch, soon to be upgraded VM virtualisation 8 CPU (Intel(R) Xeon(R) CPU E5-2640 0 @ 2.50GHz) 12 Gigs of RAM assigned No SSD i've got very different …

---

## [How to bypass vm.max\_map\_count check upon start?](https://discuss.elastic.co/t/how-to-bypass-vm-max-map-count-check-upon-start/101354)

<div class="topic-metadata">

**Author:** [@WoJ](https://discuss.elastic.co/u/WoJ)\
**Replies:** 0\
**Last updated:** [September 21, 2017, 2:32pm UTC](https://discuss.elastic.co/t/how-to-bypass-vm-max-map-count-check-upon-start/101354 "2017-09-21T14:32:51Z")

</div>

Hello I use Elasticsearch 5 in a container (systemd-nspawn) and when I attempt to start it, I get the error max virtual memory areas vm.max\_map\_count \[65530\] is too low, increase to at least \[262144\] As mentionned in …

---

## [Zimbra logstash index pattern](https://discuss.elastic.co/t/zimbra-logstash-index-pattern/81667)

<div class="topic-metadata">

**Author:** [@mhamed](https://discuss.elastic.co/u/mhamed)\
**Replies:** 3\
**Last updated:** [April 9, 2017, 12:33am UTC](https://discuss.elastic.co/t/zimbra-logstash-index-pattern/81667 "2017-04-09T00:33:38Z")

</div>

Hi.. i need an index pattern for kibana to filter zimbra's log (mailbox.log ,audit.log, zimbra.log...) ..Thank you ^\_^

---

## [arcDistance using \_source in painless script](https://discuss.elastic.co/t/arcdistance-using--source-in-painless-script/71287)

<div class="topic-metadata">

**Author:** [@brian](https://discuss.elastic.co/u/brian)\
**Replies:** 0\
**Last updated:** [January 11, 2017, 10:59pm UTC](https://discuss.elastic.co/t/arcdistance-using--source-in-painless-script/71287 "2017-01-11T22:59:06Z")

</div>

I was trying to use arcDistance using the following: PUT /my\_locations { "mappings": { "location": { "properties": { "pin": { "properties": { …

---

## [Elasticsearch and new KD trees](https://discuss.elastic.co/t/elasticsearch-and-new-kd-trees/65289)

<div class="topic-metadata">

**Author:** [@EuclideanSearch](https://discuss.elastic.co/u/EuclideanSearch)\
**Replies:** 0\
**Last updated:** [November 8, 2016, 12:42am UTC](https://discuss.elastic.co/t/elasticsearch-and-new-kd-trees/65289 "2016-11-08T00:42:13Z")

</div>

Hi, Per this article https://www.elastic.co/blog/lucene-points-6.0 I noticed 'Note that the dimensions need not all be spatial! One exciting potential use case is mixing geo-spatial dimensions with other dimensional va…

---

## [Logstash plugin development; dev container image; review requested](https://discuss.elastic.co/t/logstash-plugin-development-dev-container-image-review-requested/245589)

<div class="topic-metadata">

**Author:** [@cknz](https://discuss.elastic.co/u/cknz)\
**Replies:** 0\
**Last updated:** [August 19, 2020, 11:32am UTC](https://discuss.elastic.co/t/logstash-plugin-development-dev-container-image-review-requested/245589 "2020-08-19T11:32:59Z")

</div>

Hi everyone, particularly those with an interest in Logstash plugin development and build tooling. I'm tooling up to do some logstash plugin development, and found myself going a bit crazy getting my development environ…

---

## [How to work around ES|QL lack of support for unique results](https://discuss.elastic.co/t/how-to-work-around-es-ql-lack-of-support-for-unique-results/370172)

<div class="topic-metadata">

**Author:** [@pjmlp](https://discuss.elastic.co/u/pjmlp)\
**Replies:** 4\
**Last updated:** [November 8, 2024, 2:14pm UTC](https://discuss.elastic.co/t/how-to-work-around-es-ql-lack-of-support-for-unique-results/370172 "2024-11-08T14:14:29Z")

</div>

Hi everyone, I am doing my first steps with analysing reports on Kibana, and after several hours I keep failing to find a way to produce unique results with ES|QL, or KQL as alternative. It seems to me that it is rathe…

---

## [Unable to install ESRally](https://discuss.elastic.co/t/unable-to-install-esrally/335523)

<div class="topic-metadata">

**Author:** [@Darshan\_J](https://discuss.elastic.co/u/Darshan_J)\
**Replies:** 4\
**Last updated:** [June 13, 2023, 6:14am UTC](https://discuss.elastic.co/t/unable-to-install-esrally/335523 "2023-06-13T06:14:50Z")

</div>

Using cached zipp-3.15.0-py3-none-any.whl (6.8 kB) Building wheels for collected packages: yappi Building wheel for yappi (setup.py) ... error error: subprocess-exited-with-error × python setup.py bdist\_wheel …

---

## [SNMP Traps version 3](https://discuss.elastic.co/t/snmp-traps-version-3/322889)

<div class="topic-metadata">

**Author:** [@m3bgwad](https://discuss.elastic.co/u/m3bgwad)\
**Replies:** 4\
**Last updated:** [January 11, 2023, 10:06am UTC](https://discuss.elastic.co/t/snmp-traps-version-3/322889 "2023-01-11T10:06:39Z")

</div>

Hello Everyone, Can the snmptrap input plugin for logstash receive snmp version 3 traps ? If not, are there other solutions ? I would like to collect SNMP v3 traps. Thank You

---

## [MongoDB-Elasticsearch Integration Via Logstash](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash/239316)

<div class="topic-metadata">

**Author:** [@leoper](https://discuss.elastic.co/u/leoper)\
**Replies:** 4\
**Last updated:** [June 30, 2020, 5:15pm UTC](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash/239316 "2020-06-30T17:15:55Z")

</div>

Hi everyone. I am trying to make an integration between MongoDB (Version 4.2.7) and Elasticsearch (Version 7.7.0) via Logstash (Version 7.8.0). The goal is to synchronize data from MongoDB to Elasticsearch. The scena…

---

## [How can i use iframe code in emails watcher](https://discuss.elastic.co/t/how-can-i-use-iframe-code-in-emails-watcher/176012)

<div class="topic-metadata">

**Author:** [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Replies:** 4\
**Last updated:** [April 15, 2019, 1:31pm UTC](https://discuss.elastic.co/t/how-can-i-use-iframe-code-in-emails-watcher/176012 "2019-04-15T13:31:00Z")

</div>

I want my dashboard to be view in email so i copied the iframe code and pasted in html email watcher but i see blank in emails.Please help me in embedding it or mention any other way to show dashboard on email. Thanks a…

---

## [Auditbeat notify about files changes](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354)

<div class="topic-metadata">

**Author:** [@HePw](https://discuss.elastic.co/u/HePw)\
**Replies:** 4\
**Last updated:** [December 18, 2018, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354 "2018-12-18T18:24:52Z")

</div>

Hello, can anybody show me example how to create a notification (email, slack...) when Auditbeat notice changes in files? I've elasticsearch from elastic.co with installed auditbeat on the server, all works fine. But I…

---

## [Validation of data post reindex from remote](https://discuss.elastic.co/t/validation-of-data-post-reindex-from-remote/82180)

<div class="topic-metadata">

**Author:** [@tweissin](https://discuss.elastic.co/u/tweissin)\
**Replies:** 4\
**Last updated:** [April 14, 2017, 10:22pm UTC](https://discuss.elastic.co/t/validation-of-data-post-reindex-from-remote/82180 "2017-04-14T22:22:01Z")

</div>

What is the best to validate data was migrated properly when doing a reindex? We are migrating data from ES 1.7 to ES 5.1. We are planning on using the Reindex from Remote API, passing in a query to limit on subsets o…

---

## [Logstash input jmx does'nt work in logstash 5.0.0](https://discuss.elastic.co/t/logstash-input-jmx-doesnt-work-in-logstash-5-0-0/65269)

<div class="topic-metadata">

**Author:** [@anasoid](https://discuss.elastic.co/u/anasoid)\
**Replies:** 4\
**Last updated:** [November 8, 2016, 8:07pm UTC](https://discuss.elastic.co/t/logstash-input-jmx-doesnt-work-in-logstash-5-0-0/65269 "2016-11-08T20:07:10Z")

</div>

when installing plugin (/logstash-plugin install logstash-input-jmx) i have the folowing error : . . . Running bundle update will rebuild your snapshot from scratch, using only the gems in your Gemfile, which may res…

---

## [Proximity between more than 2 words](https://discuss.elastic.co/t/proximity-between-more-than-2-words/60503)

<div class="topic-metadata">

**Author:** [@nivke2000](https://discuss.elastic.co/u/nivke2000)\
**Replies:** 4\
**Last updated:** [September 14, 2016, 1:43pm UTC](https://discuss.elastic.co/t/proximity-between-more-than-2-words/60503 "2016-09-14T13:43:27Z")

</div>

Hi, If I write the query "fox brown"~5, i will get results in which those words are no more than 5 words apart. Can I also write a query "fox brown fast"~5? If so, which results shall be returned? Thanks, Niv

---

## [Cluster configuration about network hosts ips](https://discuss.elastic.co/t/cluster-configuration-about-network-hosts-ips/55513)

<div class="topic-metadata">

**Author:** [@Kamaljit\_Pati](https://discuss.elastic.co/u/Kamaljit_Pati)\
**Replies:** 4\
**Last updated:** [August 4, 2016, 10:50am UTC](https://discuss.elastic.co/t/cluster-configuration-about-network-hosts-ips/55513 "2016-08-04T10:50:54Z")

</div>

To create cluster i put the local loopback address and the ip that need to be connected by the other nodes in network.host place. Till now what i have done is in yml file : network.host: \["127.0.0.1","10.253.130.181"…

---

## [Is there a way to keep the results of a search?](https://discuss.elastic.co/t/is-there-a-way-to-keep-the-results-of-a-search/51469)

<div class="topic-metadata">

**Author:** [@psilos](https://discuss.elastic.co/u/psilos)\
**Replies:** 4\
**Last updated:** [June 1, 2016, 7:24am UTC](https://discuss.elastic.co/t/is-there-a-way-to-keep-the-results-of-a-search/51469 "2016-06-01T07:24:20Z")

</div>

Hi, imagine the scenario that a user searches for "tv". A number of docs match (say 1000 results). Then the user applies some filters , say inches size, Hz, price etc. Is there a way that ES keeps the results of the pr…

---

## [ES 2.0 strange java.io.StreamCorruptedException](https://discuss.elastic.co/t/es-2-0-strange-java-io-streamcorruptedexception/34417)

<div class="topic-metadata">

**Author:** [@zdeseb](https://discuss.elastic.co/u/zdeseb)\
**Replies:** 4\
**Last updated:** [November 13, 2015, 7:57am UTC](https://discuss.elastic.co/t/es-2-0-strange-java-io-streamcorruptedexception/34417 "2015-11-13T07:57:04Z")

</div>

When I start ES 2.0 as is extracted from ZIP file on my Windows 7 x64 computer, I get multiple (12x) WARNINGS like following: \[2015-11-12 13:34:08,248\]\[WARN \]\[transport.netty \] \[Lorelei II\] exception caught on …

---

## [Where are the remote logs saves in my local ELK instance?](https://discuss.elastic.co/t/where-are-the-remote-logs-saves-in-my-local-elk-instance/308255)

<div class="topic-metadata">

**Author:** [@Khalifa\_Khalifi](https://discuss.elastic.co/u/Khalifa_Khalifi)\
**Replies:** 8\
**Last updated:** [June 28, 2022, 1:35pm UTC](https://discuss.elastic.co/t/where-are-the-remote-logs-saves-in-my-local-elk-instance/308255 "2022-06-28T13:35:52Z")

</div>

Dear Elastic community, I am using filebeat and I am able to read the logs using the ELK GUI. Where are the logs stored in my local ELK instance please? I would love to have them stored by Hostname, each hostname in a …

---

## [Slow processing in Logstash with S3 input](https://discuss.elastic.co/t/slow-processing-in-logstash-with-s3-input/33940)

<div class="topic-metadata">

**Author:** [@andrey](https://discuss.elastic.co/u/andrey)\
**Replies:** 0\
**Last updated:** [November 5, 2015, 11:48pm UTC](https://discuss.elastic.co/t/slow-processing-in-logstash-with-s3-input/33940 "2015-11-05T23:48:50Z")

</div>

Hi, We are using Logstash 2.0 to move a couple of months of log data (3000 files, 10G total) from Amazon S3 into Elasticsearch (1.7.1), but it's taking a very long time - roughly 1 hour to get through a day of data (200…

---

## [Visualization only works when selecting ignore global filters](https://discuss.elastic.co/t/visualization-only-works-when-selecting-ignore-global-filters/191892)

<div class="topic-metadata">

**Author:** [@joey1](https://discuss.elastic.co/u/joey1)\
**Replies:** 1\
**Last updated:** [July 23, 2019, 7:42pm UTC](https://discuss.elastic.co/t/visualization-only-works-when-selecting-ignore-global-filters/191892 "2019-07-23T19:42:20Z")

</div>

Hi, I'm using the visual builder to create a time series visualization and am running into an issue where I I only see data when I set Ignore Global Filter to Yes. What I don't understand about this though is that I don…

---

## [Single node cluster in production, any suggestion?](https://discuss.elastic.co/t/single-node-cluster-in-production-any-suggestion/148281)

<div class="topic-metadata">

**Author:** [@arota](https://discuss.elastic.co/u/arota)\
**Replies:** 1\
**Last updated:** [September 12, 2018, 5:11pm UTC](https://discuss.elastic.co/t/single-node-cluster-in-production-any-suggestion/148281 "2018-09-12T17:11:58Z")

</div>

Hello, I am about using Elasticsearch as component of a standalone application, running on a single node. The application will run on a pretty decent dedicated consumer machine (i7 7xxx/2c/4t, 16/32 gb of RAM, pcie SSD),…

---

## [How to find the right plugin to save data in hdfs?](https://discuss.elastic.co/t/how-to-find-the-right-plugin-to-save-data-in-hdfs/28814)

<div class="topic-metadata">

**Author:** [@JulianZhang](https://discuss.elastic.co/u/JulianZhang)\
**Replies:** 1\
**Last updated:** [September 8, 2015, 8:02am UTC](https://discuss.elastic.co/t/how-to-find-the-right-plugin-to-save-data-in-hdfs/28814 "2015-09-08T08:02:55Z")

</div>

Hi all I want to set my ES to save all data to hdfs. I had find the project https://github.com/elastic/elasticsearch-hdfs/ and the new project https://github.com/elastic/elasticsearch-hadoop/tree/master/repository-hd…

---

## [How to parse live continous logs from iptables using ulog which are in pcap format?](https://discuss.elastic.co/t/how-to-parse-live-continous-logs-from-iptables-using-ulog-which-are-in-pcap-format/28017)

<div class="topic-metadata">

**Author:** [@Akshat\_Kakkar](https://discuss.elastic.co/u/Akshat_Kakkar)\
**Replies:** 1\
**Last updated:** [August 26, 2015, 6:43am UTC](https://discuss.elastic.co/t/how-to-parse-live-continous-logs-from-iptables-using-ulog-which-are-in-pcap-format/28017 "2015-08-26T06:43:47Z")

</div>

I am logging from iptables using ulog pcap plugin. I am using pcap mode as this is fastest possible option with ulog. I am looking at traffic rates of the orders of around 15-20K/sec. I want to parse this live pcap outpu…

---

## [Automatically increase number of shards](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749)

<div class="topic-metadata">

**Author:** [@MaVa](https://discuss.elastic.co/u/MaVa)\
**Replies:** 5\
**Last updated:** [October 5, 2022, 6:43am UTC](https://discuss.elastic.co/t/automatically-increase-number-of-shards/315749 "2022-10-05T06:43:07Z")

</div>

Hi! I have few indices where all the data is equally relevant no matter how old it is. Over time these indices will increase in size (from 5-10MB to 1000GB). I want to optimize the number of shards in these indices, and …

---

## [Tuning SSD Performance](https://discuss.elastic.co/t/tuning-ssd-performance/244557)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 5\
**Last updated:** [August 13, 2020, 11:16am UTC](https://discuss.elastic.co/t/tuning-ssd-performance/244557 "2020-08-13T11:16:01Z")

</div>

Hi, Is there an aggregated, and detailed, source of information regarding optimising nvme ssd config for indexing heavy use cases with elasticsearch? Thx D

---

## [How to align the legends and maintain uniform color across the whole dashboard?](https://discuss.elastic.co/t/how-to-align-the-legends-and-maintain-uniform-color-across-the-whole-dashboard/238555)

<div class="topic-metadata">

**Author:** [@Jaishree\_Pal](https://discuss.elastic.co/u/Jaishree_Pal)\
**Replies:** 5\
**Last updated:** [July 6, 2020, 7:38am UTC](https://discuss.elastic.co/t/how-to-align-the-legends-and-maintain-uniform-color-across-the-whole-dashboard/238555 "2020-07-06T07:38:14Z")

</div>

Hi guys, I created a dashboard containing several visualizations. But, the problem I'm facing is that the legends change color every time the page is refreshed. I want some color uniformity like 'green' for 'pass', 'red'…

---

## [Alerting with a chain-input](https://discuss.elastic.co/t/alerting-with-a-chain-input/231989)

<div class="topic-metadata">

**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Replies:** 5\
**Last updated:** [May 26, 2020, 9:43am UTC](https://discuss.elastic.co/t/alerting-with-a-chain-input/231989 "2020-05-26T09:43:58Z")

</div>

Hi, We are getting NPS logs and want to monitor when a certain string appears. We want to create an alert if we receive a log containing the field "CISCOTAG" containing the value "%ASA-2-113022". But, we only want to se…

---

## [Various metricbeat example visualizations don't work OOTB, missing .keyword in Group by field?](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101)

<div class="topic-metadata">

**Author:** [@abruening](https://discuss.elastic.co/u/abruening)\
**Replies:** 5\
**Last updated:** [March 15, 2018, 5:24pm UTC](https://discuss.elastic.co/t/various-metricbeat-example-visualizations-dont-work-ootb-missing-keyword-in-group-by-field/124101 "2018-03-15T17:24:52Z")

</div>

I'm using Debian to set up a test system, and the included visualizations, for example "Interfaces by Incoming traffic \[Metricbeat System\]", show no data by default. I had to set "Group by" to "system.network.name.keywor…

---

## [Bucket sorting gives different values](https://discuss.elastic.co/t/bucket-sorting-gives-different-values/119228)

<div class="topic-metadata">

**Author:** [@Robert\_Naccache](https://discuss.elastic.co/u/Robert_Naccache)\
**Replies:** 5\
**Last updated:** [February 16, 2018, 2:48pm UTC](https://discuss.elastic.co/t/bucket-sorting-gives-different-values/119228 "2018-02-16T14:48:14Z")

</div>

Hello, Something i noticed that's a bit off and i'm not sure exactly what's the cause of it. My data is in the form of: "businessevent": "GENERICPGPFILESOUTGOING", "jobid": 6054972458, "start": "2018-02-09T11:22:05.44…

---

## [Unable to load lat and lon values in map view](https://discuss.elastic.co/t/unable-to-load-lat-and-lon-values-in-map-view/106117)

<div class="topic-metadata">

**Author:** [@arun\_s](https://discuss.elastic.co/u/arun_s)\
**Replies:** 5\
**Last updated:** [November 2, 2017, 11:14am UTC](https://discuss.elastic.co/t/unable-to-load-lat-and-lon-values-in-map-view/106117 "2017-11-02T11:14:38Z")

</div>

Hi I am using kibana 5.6.3 and i am facing problem while creating coordinate map after loading index. I am getting error as No Compatible Fields: The "geo4-\*" index pattern does not contain any of the following field t…

---

## [Question About Logstash](https://discuss.elastic.co/t/question-about-logstash/51593)

<div class="topic-metadata">

**Author:** [@Espresso\_Machine](https://discuss.elastic.co/u/Espresso_Machine)\
**Replies:** 5\
**Last updated:** [June 2, 2016, 3:41am UTC](https://discuss.elastic.co/t/question-about-logstash/51593 "2016-06-02T03:41:06Z")

</div>

Is Logstash able to show the current system status of the machine that it is installed onto? Information such as storage access for all connected hard drives, memory usage, processor usage, temperature or does it only re…

---

## [Date format in elasticsearch](https://discuss.elastic.co/t/date-format-in-elasticsearch/44004)

<div class="topic-metadata">

**Author:** [@pecwich](https://discuss.elastic.co/u/pecwich)\
**Replies:** 5\
**Last updated:** [March 14, 2016, 7:18am UTC](https://discuss.elastic.co/t/date-format-in-elasticsearch/44004 "2016-03-14T07:18:47Z")

</div>

While sending logs from logstash to elasticsearch, How can I specify my date within the logs to "date" format, rather than just a string?

---

## [Index type depending on the query?](https://discuss.elastic.co/t/index-type-depending-on-the-query/22508)

<div class="topic-metadata">

**Author:** [@Jean\_Marc\_F](https://discuss.elastic.co/u/Jean_Marc_F)\
**Replies:** 5\
**Last updated:** [March 4, 2015, 11:58pm UTC](https://discuss.elastic.co/t/index-type-depending-on-the-query/22508 "2015-03-04T23:58:52Z")

</div>

Hi everyone, I am pretty new to ES and need some advice for the following use case: I have a unique input field for user search (Google like). In my test index, I have two different types, let's call them "rent" a…

---

## [Exception when creating a \_parent mapping in an index that exists, on a type that exists, with no existing \_parent mapping](https://discuss.elastic.co/t/exception-when-creating-a--parent-mapping-in-an-index-that-exists-on-a-type-that-exists-with-no-existing--parent-mapping/21870)

<div class="topic-metadata">

**Author:** [@Ian\_Boston](https://discuss.elastic.co/u/Ian_Boston)\
**Replies:** 5\
**Last updated:** [January 28, 2015, 11:09am UTC](https://discuss.elastic.co/t/exception-when-creating-a--parent-mapping-in-an-index-that-exists-on-a-type-that-exists-with-no-existing--parent-mapping/21870 "2015-01-28T11:09:00Z")

</div>

Hi, I am trying to add \_parent to a type in an index that already exists using. PutMappingResponse create = client.admin().indices().preparePutMapping(index).setType(type).setSource("\_parent", "type="+par…

---

## [Java APM agent can't connect to APM server](https://discuss.elastic.co/t/java-apm-agent-cant-connect-to-apm-server/315087)

<div class="topic-metadata">

**Author:** [@majarianil](https://discuss.elastic.co/u/majarianil)\
**Replies:** 2\
**Last updated:** [September 25, 2022, 7:14am UTC](https://discuss.elastic.co/t/java-apm-agent-cant-connect-to-apm-server/315087 "2022-09-25T07:14:44Z")

</div>

Kibana version: 7.12.0 Elasticsearch version: 7.12.0 APM Server version: 7.12.0 APM Agent language and version: Java - openjdk:17.0.2 Browser version: Google chrome - 05.0.5195.127 Original install method (e.g. dow…

[Previous page](https://discuss.elastic.co/top.md?page=1467&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1469&per_page=50&period=all)
