# Top

**URL:** https://discuss.elastic.co/top.md?page=1496&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1497

---

## [Elasticsearch filter is not working in logstash](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995)

<div class="topic-metadata">

**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Replies:** 2\
**Last updated:** [February 28, 2017, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995 "2017-02-28T05:48:52Z")

</div>

Hi, I'm using new version of logstash(5.2.0) and i'm facing correlation issue in that. Kinldy find the below detail of my issue, Actually im trying to move some fields from index 1 to another index 2. Already i process…

---

## [Fielddata cache shows nothing](https://discuss.elastic.co/t/fielddata-cache-shows-nothing/74970)

<div class="topic-metadata">

**Author:** [@Alex\_Davidovich](https://discuss.elastic.co/u/Alex_Davidovich)\
**Replies:** 2\
**Last updated:** [February 14, 2017, 2:43pm UTC](https://discuss.elastic.co/t/fielddata-cache-shows-nothing/74970 "2017-02-14T14:43:59Z")

</div>

Our goal is to find out how to reduce memory consumption of elasticsearch and for that I checked our use of fielddata cache. I understand that fielddata cache is used to store aggregations and sorting results. In my app…

---

## [Suitability of Elastic for web search solution](https://discuss.elastic.co/t/suitability-of-elastic-for-web-search-solution/71531)

<div class="topic-metadata">

**Author:** [@mradford](https://discuss.elastic.co/u/mradford)\
**Replies:** 2\
**Last updated:** [January 16, 2017, 10:20am UTC](https://discuss.elastic.co/t/suitability-of-elastic-for-web-search-solution/71531 "2017-01-16T10:20:12Z")

</div>

Hello, Elastic community! I'm looking into the suitability of various search technologies as a replacement for a client's current Google Mini search implementation. Note, this is for a website search solution, so it's…

---

## [Sorting is not giving accurate result](https://discuss.elastic.co/t/sorting-is-not-giving-accurate-result/60029)

<div class="topic-metadata">

**Author:** [@amajumdarinfa](https://discuss.elastic.co/u/amajumdarinfa)\
**Replies:** 2\
**Last updated:** [September 9, 2016, 6:41pm UTC](https://discuss.elastic.co/t/sorting-is-not-giving-accurate-result/60029 "2016-09-09T18:41:45Z")

</div>

I am trying some simple sort on an Elasticsearch 2.3.1 index. The index mapping contains an object named "user" which has a few embedded keys.. one of them is also called "user". So I tried to search by "user.user". Bu…

---

## [Memory usage in elasticsearch](https://discuss.elastic.co/t/memory-usage-in-elasticsearch/374973)

<div class="topic-metadata">

**Author:** [@Carlos\_Cardoso](https://discuss.elastic.co/u/Carlos_Cardoso)\
**Replies:** 3\
**Last updated:** [February 25, 2025, 1:19pm UTC](https://discuss.elastic.co/t/memory-usage-in-elasticsearch/374973 "2025-02-25T13:19:46Z")

</div>

Hello everyone, good evening. I'm experiencing seemingly high memory consumption from Elasticsearch and would like to know if anyone else has experienced this and how they optimized. :small\_blue\_diamond: Scenario: Elas…

---

## [How to embed visualization into my app](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591)

<div class="topic-metadata">

**Author:** [@whitediver](https://discuss.elastic.co/u/whitediver)\
**Replies:** 3\
**Last updated:** [March 31, 2021, 4:48pm UTC](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591 "2021-03-31T16:48:04Z")

</div>

Since the embedVisualizationWithId was removed from the Kibana, I have no way to embed visualization into my Kibana app. Does anybody know what I should use instead?

---

## [Logstash stops forwarding to elasticsearch after short run](https://discuss.elastic.co/t/logstash-stops-forwarding-to-elasticsearch-after-short-run/242841)

<div class="topic-metadata">

**Author:** [@amhulli](https://discuss.elastic.co/u/amhulli)\
**Replies:** 3\
**Last updated:** [July 28, 2020, 10:27pm UTC](https://discuss.elastic.co/t/logstash-stops-forwarding-to-elasticsearch-after-short-run/242841 "2020-07-28T22:27:13Z")

</div>

i notice that my issue is similar to https://discuss.elastic.co/t/logstash-runs-as-service-but-stops-sending-logs-over-http-after-some-time/102938 but also note there was no resolution at that time. I'm hoping someone …

---

## [Insufficient History for prediction](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711)

<div class="topic-metadata">

**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\
**Replies:** 3\
**Last updated:** [July 18, 2020, 5:53pm UTC](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711 "2020-07-18T17:53:29Z")

</div>

Hi, I'm using Elastic ML 7.8. I've a monthly index with 350k+ documents count/events per month or 118.3mb worth of data per month. I've data from March to July present (4 months+ data). So, in total, that is 1400k even…

---

## [Output condition filter on filebeat module](https://discuss.elastic.co/t/output-condition-filter-on-filebeat-module/237505)

<div class="topic-metadata">

**Author:** [@tvander](https://discuss.elastic.co/u/tvander)\
**Replies:** 3\
**Last updated:** [June 18, 2020, 8:46am UTC](https://discuss.elastic.co/t/output-condition-filter-on-filebeat-module/237505 "2020-06-18T08:46:11Z")

</div>

Hi, i have my kafka server with two filebeat module enabled: kafka and system, the filebeat config also include a "kafka" tags. On my logstash server i use multi pipeline, what i'm trying to do is separate kafka logs fr…

---

## [Catch Memcached Filter exceptions](https://discuss.elastic.co/t/catch-memcached-filter-exceptions/226432)

<div class="topic-metadata">

**Author:** [@Djamox](https://discuss.elastic.co/u/Djamox)\
**Replies:** 3\
**Last updated:** [April 6, 2020, 2:18pm UTC](https://discuss.elastic.co/t/catch-memcached-filter-exceptions/226432 "2020-04-06T14:18:15Z")

</div>

Hi, I'm trying to connect to a memcached server via the filter Memcached. The problem is that the pipeline failed if the server is not available, and it is not acceptable. I couldn't find anything to handler failure so…

---

## [Full match of query value from beginning to end of field](https://discuss.elastic.co/t/full-match-of-query-value-from-beginning-to-end-of-field/212979)

<div class="topic-metadata">

**Author:** [@unavailabl3](https://discuss.elastic.co/u/unavailabl3)\
**Replies:** 3\
**Last updated:** [December 25, 2019, 1:03pm UTC](https://discuss.elastic.co/t/full-match-of-query-value-from-beginning-to-end-of-field/212979 "2019-12-25T13:03:22Z")

</div>

Hello! I have problem with full match querying of field value. title and gender - fields of indexed docs query: { query\_string: { query: "box AND gender:\\"women\\"", default\_field: "title" } } I use double q…

---

## [Cannot see logs in Elasticsearch configured through Filebeat](https://discuss.elastic.co/t/cannot-see-logs-in-elasticsearch-configured-through-filebeat/165314)

<div class="topic-metadata">

**Author:** [@huzefabootwala](https://discuss.elastic.co/u/huzefabootwala)\
**Replies:** 3\
**Last updated:** [January 25, 2019, 3:27am UTC](https://discuss.elastic.co/t/cannot-see-logs-in-elasticsearch-configured-through-filebeat/165314 "2019-01-25T03:27:55Z")

</div>

Hello, I have installed Elasticsearch, Kibana and Filebeat but not able to see the logs. These are filebeat logs 2019-01-23T10:07:49.740+1100 INFO instance/beat.go:592 Home path: \[C:\\Users\\hbootwala\\Downloads\\filebeat…

---

## [Logstash memory sizing](https://discuss.elastic.co/t/logstash-memory-sizing/82600)

<div class="topic-metadata">

**Author:** [@jasonkeller](https://discuss.elastic.co/u/jasonkeller)\
**Replies:** 3\
**Last updated:** [April 20, 2017, 11:37pm UTC](https://discuss.elastic.co/t/logstash-memory-sizing/82600 "2017-04-20T23:37:58Z")

</div>

I have a setup where I'll be receiving tons of netflow traffic (i.e. we have multiple 10gbit devices that will be forwarding netflow traffic from many tens of thousands of end users). Needless to say this will be brutal…

---

## [Learning to create watches](https://discuss.elastic.co/t/learning-to-create-watches/75475)

<div class="topic-metadata">

**Author:** [@GogLlundain](https://discuss.elastic.co/u/GogLlundain)\
**Replies:** 3\
**Last updated:** [February 20, 2017, 9:39pm UTC](https://discuss.elastic.co/t/learning-to-create-watches/75475 "2017-02-20T21:39:32Z")

</div>

Hi everyone. I set out to create a really simple alert, when the CPU idle percentage drops below 20% I want an alert. For simplicity I chose the logging action and metric beats is running on a few servers and posting dat…

---

## [Why there can't change default cluster name in es5?](https://discuss.elastic.co/t/why-there-cant-change-default-cluster-name-in-es5/58778)

<div class="topic-metadata">

**Author:** [@elkan1788](https://discuss.elastic.co/u/elkan1788)\
**Replies:** 3\
**Last updated:** [February 6, 2017, 7:35am UTC](https://discuss.elastic.co/t/why-there-cant-change-default-cluster-name-in-es5/58778 "2017-02-06T07:35:08Z")

</div>

Today I were try to deploy elasticsearch5 in my test server, and then update the default yml configure file about the cluster name toes5 , but it's so strange after restart elasticsearch5 service. There still show up def…

---

## [CSV Filter help](https://discuss.elastic.co/t/csv-filter-help/55937)

<div class="topic-metadata">

**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Replies:** 3\
**Last updated:** [July 20, 2016, 5:30am UTC](https://discuss.elastic.co/t/csv-filter-help/55937 "2016-07-20T05:30:42Z")

</div>

Hi There, I am using the following CSV filter after failing to use grok filter for a logfile containing multiple patterns: filter { csv { columns =\> \["@timestamp", "threadType", "requestType", "requestSta…

---

## [ES - Possible to use RAM and Secondary Storage if Heap is full?](https://discuss.elastic.co/t/es-possible-to-use-ram-and-secondary-storage-if-heap-is-full/54545)

<div class="topic-metadata">

**Author:** [@ilyasjaan](https://discuss.elastic.co/u/ilyasjaan)\
**Replies:** 3\
**Last updated:** [July 1, 2016, 8:25pm UTC](https://discuss.elastic.co/t/es-possible-to-use-ram-and-secondary-storage-if-heap-is-full/54545 "2016-07-01T20:25:46Z")

</div>

Hi, Is it possible to say use 16GB MAX RAM and if more data comes to indexes shuffle between RAM and secondary storage? What I got for now is there is a possibility that if somehow all documents being searched then a…

---

## [ElasticSearch Index / Shard Setting](https://discuss.elastic.co/t/elasticsearch-index-shard-setting/41022)

<div class="topic-metadata">

**Author:** [@rameeelastic](https://discuss.elastic.co/u/rameeelastic)\
**Replies:** 3\
**Last updated:** [February 5, 2016, 10:43am UTC](https://discuss.elastic.co/t/elasticsearch-index-shard-setting/41022 "2016-02-05T10:43:12Z")

</div>

I am trying to create a multi node cluster using 2 machines. below is what i am trying to do. Master 1 (master=true,data = false) data 1 (data=true,master=false) data 2 (data=true,master=false) I want to retain the …

---

## [Having a problem running Kibana](https://discuss.elastic.co/t/having-a-problem-running-kibana/21822)

<div class="topic-metadata">

**Author:** [@G\_Lees](https://discuss.elastic.co/u/G_Lees)\
**Replies:** 3\
**Last updated:** [January 26, 2015, 3:09am UTC](https://discuss.elastic.co/t/having-a-problem-running-kibana/21822 "2015-01-26T03:09:56Z")

</div>

Hi. I am new to ElasticSearch and am trying to get up and running with Kibana. I already have ElasticSearch running and am completely confused with how to now get Kibana going as well. So i download and extracted K…

---

## [How to use ElasticSearch Custom Similarity provider classes?](https://discuss.elastic.co/t/how-to-use-elasticsearch-custom-similarity-provider-classes/15266)

<div class="topic-metadata">

**Author:** [@dark\_shadow](https://discuss.elastic.co/u/dark_shadow)\
**Replies:** 3\
**Last updated:** [January 17, 2014, 7:14am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-custom-similarity-provider-classes/15266 "2014-01-17T07:14:57Z")

</div>

Hi, I'm using the following two java files for overriding the Default Similarity of ElasticSearch 0.90.3 but it's not working for me. https://github.com/awnuxkjy/es-custom-similarity-provider/tree/master/src/mai…

---

## [Search child by parent field](https://discuss.elastic.co/t/search-child-by-parent-field/6597)

<div class="topic-metadata">

**Author:** [@Igor\_Semenko](https://discuss.elastic.co/u/Igor_Semenko)\
**Replies:** 8\
**Last updated:** [July 23, 2013, 3:57pm UTC](https://discuss.elastic.co/t/search-child-by-parent-field/6597 "2013-07-23T15:57:41Z")

</div>

Hello, I'm exploring Parent-Child feature in elasticsearch, but can't understand whether it's possible to find child by parent's field name? Sort of reverse 'has\_child' query. Here is example: Author (parent) -…

---

## [Facet count - strange behaviour - different result for different size of most frequent terms](https://discuss.elastic.co/t/facet-count-strange-behaviour-different-result-for-different-size-of-most-frequent-terms/11064)

<div class="topic-metadata">

**Author:** [@Artur\_Konczak](https://discuss.elastic.co/u/Artur_Konczak)\
**Replies:** 8\
**Last updated:** [March 8, 2013, 10:14am UTC](https://discuss.elastic.co/t/facet-count-strange-behaviour-different-result-for-different-size-of-most-frequent-terms/11064 "2013-03-08T10:14:03Z")

</div>

I'm looking for any good explanation for a different value for facet count. I have changed only the return size of the most frequent terms. My ES is in version 0.20.5. \*The query looks like this:\* { "size"…

---

## [What happened to templated/scripted dashboards in Kibana 4?](https://discuss.elastic.co/t/what-happened-to-templated-scripted-dashboards-in-kibana-4/65)

<div class="topic-metadata">

**Author:** [@robyn](https://discuss.elastic.co/u/robyn)\
**Replies:** 0\
**Last updated:** [April 30, 2015, 5:26pm UTC](https://discuss.elastic.co/t/what-happened-to-templated-scripted-dashboards-in-kibana-4/65 "2015-04-30T17:26:19Z")

</div>

In Kibana 4, the state of each dashboard (including filters, queries, columns, etc..) is stored directly in its URL. This should be a lot easier than constructing scripted dashboards. The URL is encoded using RISON, a …

---

## [Charts plugin or @elastic/charts](https://discuss.elastic.co/t/charts-plugin-or-elastic-charts/339033)

<div class="topic-metadata">

**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\
**Replies:** 6\
**Last updated:** [July 26, 2023, 8:16am UTC](https://discuss.elastic.co/t/charts-plugin-or-elastic-charts/339033 "2023-07-26T08:16:11Z")

</div>

Hi, I am creating an external plugin in Kibana 8.8.1 using React. I want to create charts inside my plugin. I expect them to be clickable and also just like in Kibana, when I click on a particular chart item (like bar …

---

## [Best way to visualize health and structure of data processing pipeline](https://discuss.elastic.co/t/best-way-to-visualize-health-and-structure-of-data-processing-pipeline/250458)

<div class="topic-metadata">

**Author:** [@FloJe](https://discuss.elastic.co/u/FloJe)\
**Replies:** 6\
**Last updated:** [October 7, 2020, 6:49am UTC](https://discuss.elastic.co/t/best-way-to-visualize-health-and-structure-of-data-processing-pipeline/250458 "2020-10-07T06:49:25Z")

</div>

Dear Forum, in one of our projects we want to monitor the components of several data processing pipelines. Each of these pipelines has the following structure: Connects to at least one data source Connects to at leas…

---

## [Win 2003 32 bit OS Period(Time) is not correct it is showing default](https://discuss.elastic.co/t/win-2003-32-bit-os-period-time-is-not-correct-it-is-showing-default/118713)

<div class="topic-metadata">

**Author:** [@dilip](https://discuss.elastic.co/u/dilip)\
**Replies:** 6\
**Last updated:** [March 12, 2018, 6:57am UTC](https://discuss.elastic.co/t/win-2003-32-bit-os-period-time-is-not-correct-it-is-showing-default/118713 "2018-03-12T06:57:10Z")

</div>

Hi, I am using Metricbeat 6.0.0 on WIn 2003 OS 32 Bit .with System module to collect the performance data. everything is working fine except Period Interval .its taking default as 10s instead of custom like 2m. Please…

---

## [Instances Status on Elastic Search](https://discuss.elastic.co/t/instances-status-on-elastic-search/73309)

<div class="topic-metadata">

**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\
**Replies:** 6\
**Last updated:** [January 31, 2017, 6:14am UTC](https://discuss.elastic.co/t/instances-status-on-elastic-search/73309 "2017-01-31T06:14:07Z")

</div>

Hi- Is there a way to check the Instances status thru API, I wanted to check the whether an Instance is available online or not. Please let me know. Thanks in advance. Prakash.

---

## [Unable to deploy elastic/eck-operator on RedHat OpenShift 4.11](https://discuss.elastic.co/t/unable-to-deploy-elastic-eck-operator-on-redhat-openshift-4-11/314534)

<div class="topic-metadata">

**Author:** [@Uzi\_Cohen](https://discuss.elastic.co/u/Uzi_Cohen)\
**Replies:** 1\
**Last updated:** [September 30, 2022, 5:31pm UTC](https://discuss.elastic.co/t/unable-to-deploy-elastic-eck-operator-on-redhat-openshift-4-11/314534 "2022-09-30T17:31:35Z")

</div>

When deploying elastic/eck-operator helm chart on OpenShift 4.11, deployment fails, getting: msg="runc create failed: unable to start container process: exec: "./elastic-operator": stat ./elastic-operator: permission de…

---

## [Importing Saved Objects API Error 413](https://discuss.elastic.co/t/importing-saved-objects-api-error-413/249550)

<div class="topic-metadata">

**Author:** [@Bustencio](https://discuss.elastic.co/u/Bustencio)\
**Replies:** 1\
**Last updated:** [September 23, 2020, 8:34am UTC](https://discuss.elastic.co/t/importing-saved-objects-api-error-413/249550 "2020-09-23T08:34:24Z")

</div>

Hi, I'm trying to import into Kibana a file created by using the export endpoint where I backup every object saved in a specific space including everything available (dashboards, index-patterns, visualizations, etc etc.…

---

## [Jira Error Logging with Logstash / Filebeat](https://discuss.elastic.co/t/jira-error-logging-with-logstash-filebeat/198393)

<div class="topic-metadata">

**Author:** [@dwisnia](https://discuss.elastic.co/u/dwisnia)\
**Replies:** 1\
**Last updated:** [September 6, 2019, 12:25pm UTC](https://discuss.elastic.co/t/jira-error-logging-with-logstash-filebeat/198393 "2019-09-06T12:25:56Z")

</div>

Howdy Folks, Disclaimer: I am a bloody beginner at the ELK Stack. We want log the errors and messages from our Atlassian Enviroment. Starting with Jira, we had issues with correct formats in the messages. I already ad…

---

## [Spaces default dashboard](https://discuss.elastic.co/t/spaces-default-dashboard/195039)

<div class="topic-metadata">

**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\
**Replies:** 1\
**Last updated:** [August 13, 2019, 10:07pm UTC](https://discuss.elastic.co/t/spaces-default-dashboard/195039 "2019-08-13T22:07:22Z")

</div>

Hi all, I was wondering if there exists a way to set a default route/dashboard for a specific Kibana Space, i.e. multiple Spaces having different default dashboard. Let me explain better. In my Kibana instance I have …

---

## [Formatting in Y axis I want to display rounded values instead of the value figure](https://discuss.elastic.co/t/formatting-in-y-axis-i-want-to-display-rounded-values-instead-of-the-value-figure/174921)

<div class="topic-metadata">

**Author:** [@Swati123](https://discuss.elastic.co/u/Swati123)\
**Replies:** 1\
**Last updated:** [April 3, 2019, 12:30am UTC](https://discuss.elastic.co/t/formatting-in-y-axis-i-want-to-display-rounded-values-instead-of-the-value-figure/174921 "2019-04-03T00:30:55Z")

</div>

Hi All, In Kibana Visualization I am using the entire value in y axis like 10000000 which is in bytes,instead of that i want it to display like 1 GB or to a particular format. I have few like above scenarios which nee…

---

## [Index\_out\_of\_bounds\_exception watcher using aggregration](https://discuss.elastic.co/t/index-out-of-bounds-exception-watcher-using-aggregration/170376)

<div class="topic-metadata">

**Author:** [@Muhammad\_Saleem](https://discuss.elastic.co/u/Muhammad_Saleem)\
**Replies:** 1\
**Last updated:** [March 20, 2019, 8:59am UTC](https://discuss.elastic.co/t/index-out-of-bounds-exception-watcher-using-aggregration/170376 "2019-03-20T08:59:11Z")

</div>

Here is my code to create a watcher, which is trying to compare two values from the aggregated values from the payload. The problem is when there is no data being context by the condition in the watcher, it returns the …

---

## [Percentage Formatting](https://discuss.elastic.co/t/percentage-formatting/124417)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 1\
**Last updated:** [March 17, 2018, 8:04pm UTC](https://discuss.elastic.co/t/percentage-formatting/124417 "2018-03-17T20:04:51Z")

</div>

Not really sure where this belongs to be honest. I am ingesting a field that has a numeric value that represents a percentage. So 5 is 5%, 50 is 50%, 100 is 100%. Unfortunately, I can't figure out the Kibana formattin…

---

## [Auditing Windows file acccess](https://discuss.elastic.co/t/auditing-windows-file-acccess/101438)

<div class="topic-metadata">

**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\
**Replies:** 1\
**Last updated:** [September 29, 2017, 10:47am UTC](https://discuss.elastic.co/t/auditing-windows-file-acccess/101438 "2017-09-29T10:47:55Z")

</div>

Hi, This didn't really fit into any of the categories, so I'll post it here. I'm trying to audit windows file share accesses, but it seems to be quite hard, at least for me. I have found numerous resources which indic…

---

## [Dashboards without login page](https://discuss.elastic.co/t/dashboards-without-login-page/98053)

<div class="topic-metadata">

**Author:** [@Helder\_Marques](https://discuss.elastic.co/u/Helder_Marques)\
**Replies:** 1\
**Last updated:** [August 23, 2017, 5:45pm UTC](https://discuss.elastic.co/t/dashboards-without-login-page/98053 "2017-08-23T17:45:50Z")

</div>

I installed x-pack to add login functionality to Kibana. Is this service paid at the end of 30 days? it’s possible to share dashboards without login page?

---

## [Filebeat not reading log](https://discuss.elastic.co/t/filebeat-not-reading-log/94198)

<div class="topic-metadata">

**Author:** [@Aman\_Wadhwa](https://discuss.elastic.co/u/Aman_Wadhwa)\
**Replies:** 1\
**Last updated:** [July 24, 2017, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-not-reading-log/94198 "2017-07-24T13:14:22Z")

</div>

I am facing an strange issue where filebeat is not able to read a log file (basically it just do nothing) and unable to send to logstash: Log: \[{"Client IP":"122.180.180.80","API ID":"25209983","API Name":"placeholder","…

---

## [Logstash giving error regarding log4j](https://discuss.elastic.co/t/logstash-giving-error-regarding-log4j/84767)

<div class="topic-metadata">

**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\
**Replies:** 1\
**Last updated:** [May 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/logstash-giving-error-regarding-log4j/84767 "2017-05-06T13:47:26Z")

</div>

Using latest logstash 5.4.0, getting this error on startup ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only errors to the console. Sending Logstash's logs to /var/log/ wh…

---

## [Firewall Logs](https://discuss.elastic.co/t/firewall-logs/50931)

<div class="topic-metadata">

**Author:** [@Kennedy\_Kan](https://discuss.elastic.co/u/Kennedy_Kan)\
**Replies:** 1\
**Last updated:** [May 25, 2016, 9:42pm UTC](https://discuss.elastic.co/t/firewall-logs/50931 "2016-05-25T21:42:04Z")

</div>

Is there anyway that I can read data from firewall or antivirus and analyse it in kibana? Thanks in advance.

---

## [No Result/Graph comes up after search](https://discuss.elastic.co/t/no-result-graph-comes-up-after-search/46037)

<div class="topic-metadata">

**Author:** [@cehpanku](https://discuss.elastic.co/u/cehpanku)\
**Replies:** 1\
**Last updated:** [April 1, 2016, 3:13pm UTC](https://discuss.elastic.co/t/no-result-graph-comes-up-after-search/46037 "2016-04-01T15:13:46Z")

</div>

Hi There, Just installed and running the Graph, but after selecting the index, field and the keyword nothing comes up. Thanks & Regards Pankaj

---

## [How to solve the problem primary shard is not yet active](https://discuss.elastic.co/t/how-to-solve-the-problem-primary-shard-is-not-yet-active/34516)

<div class="topic-metadata">

**Author:** [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\
**Replies:** 1\
**Last updated:** [November 13, 2015, 4:03pm UTC](https://discuss.elastic.co/t/how-to-solve-the-problem-primary-shard-is-not-yet-active/34516 "2015-11-13T16:03:05Z")

</div>

How could I resolve this problem? index shard prirep state docs store ip node new\_gompute\_history\_2015-10-23\_10:10:26 2 p INITIALIZING …

---

## [Apache log to logstash and consume content](https://discuss.elastic.co/t/apache-log-to-logstash-and-consume-content/33110)

<div class="topic-metadata">

**Author:** [@steven\_vogogo](https://discuss.elastic.co/u/steven_vogogo)\
**Replies:** 1\
**Last updated:** [October 27, 2015, 9:18pm UTC](https://discuss.elastic.co/t/apache-log-to-logstash-and-consume-content/33110 "2015-10-27T21:18:04Z")

</div>

Hello, We are using logstash to parse sensitive data from our logs and as a result we need the original logfile (that contains the sensitive data) to not retain any content. I have tried using a mkfifo and have logst…

---

## [Do we need to avoid using Elastic Search as primary DB?](https://discuss.elastic.co/t/do-we-need-to-avoid-using-elastic-search-as-primary-db/320233)

<div class="topic-metadata">

**Author:** [@aswin1906](https://discuss.elastic.co/u/aswin1906)\
**Replies:** 5\
**Last updated:** [December 2, 2022, 2:55pm UTC](https://discuss.elastic.co/t/do-we-need-to-avoid-using-elastic-search-as-primary-db/320233 "2022-12-02T14:55:31Z")

</div>

We are using Elasticsearch as primary db which includes entire ELK, unfortunately last week we lost huge data from Elasticsearch during server restart. 1) Do we need to avoid using Elastic Search as primary DB? If Yes, …

---

## [Elasticsearch: setting up cluster with two nodes](https://discuss.elastic.co/t/elasticsearch-setting-up-cluster-with-two-nodes/247994)

<div class="topic-metadata">

**Author:** [@Techmod](https://discuss.elastic.co/u/Techmod)\
**Replies:** 5\
**Last updated:** [September 15, 2020, 5:28am UTC](https://discuss.elastic.co/t/elasticsearch-setting-up-cluster-with-two-nodes/247994 "2020-09-15T05:28:54Z")

</div>

I've set two master nodes in my cluster but it only shows "elastic-master" not "elastic-slave".(second node is not shown).How can I resolve it? I've already followed Elasticsearch documents but nothing changed! #my host…

---

## [Elasticsearch Query Rule Group By](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 0\
**Last updated:** [April 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314 "2022-04-26T18:03:52Z")

</div>

Hi All, (Elasticsearch & Kibana 7.17.2) I'm trying to create an Elasticsearch query rule in Kibana observability which group bys a concept. I have the following rule configured: Index: synthetics-\* Size: 100 { "ag…

---

## [Pushing flush onto pipeline pipeline](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-pipeline/68606)

<div class="topic-metadata">

**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\
**Replies:** 0\
**Last updated:** [December 9, 2016, 9:13pm UTC](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-pipeline/68606 "2016-12-09T21:13:32Z")

</div>

Hello, What does "pushing flush onto pipeline pipeline" mean in Logstash. I was running a Logstash instance in Debug Mode and saw that all my documents had been processed and shipped by Logstash, but kept getting the \<\<…

---

## [Excluding \_id, \_type, \_index etc. in the output](https://discuss.elastic.co/t/excluding--id--type--index-etc-in-the-output/22548)

<div class="topic-metadata">

**Author:** [@lasseschou](https://discuss.elastic.co/u/lasseschou)\
**Replies:** 0\
**Last updated:** [March 6, 2015, 10:00am UTC](https://discuss.elastic.co/t/excluding--id--type--index-etc-in-the-output/22548 "2015-03-06T10:00:36Z")

</div>

Hi, See this: http://stackoverflow.com/questions/23968200/exclude-id-and-index-field-in-elasticsearch-result-data It looks like there's no way to avoid outputting fields like \_id, \_type, \_index etc when getting…

---

## [Filebeat autodiscover filter by namespace or container labels](https://discuss.elastic.co/t/filebeat-autodiscover-filter-by-namespace-or-container-labels/362550)

<div class="topic-metadata">

**Author:** [@Andrea\_Bertanzon](https://discuss.elastic.co/u/Andrea_Bertanzon)\
**Replies:** 2\
**Last updated:** [July 6, 2024, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-autodiscover-filter-by-namespace-or-container-labels/362550 "2024-07-06T16:01:44Z")

</div>

Hello, I deployed Filebeats in my kubernetes cluster. The cluster uses CRI-O not Docker or Containerd (this is helpful for log folder path). The idea I am trying to implement is to make so that Filebeats only collects …

---

## [Sorting based on scripted metrics aggregation](https://discuss.elastic.co/t/sorting-based-on-scripted-metrics-aggregation/262384)

<div class="topic-metadata">

**Author:** [@Abbass](https://discuss.elastic.co/u/Abbass)\
**Replies:** 2\
**Last updated:** [February 23, 2021, 9:45am UTC](https://discuss.elastic.co/t/sorting-based-on-scripted-metrics-aggregation/262384 "2021-02-23T09:45:25Z")

</div>

Hello! I faced a limitation on sorting buckets of a term aggrigation, based on a scripted metrics sub aggregation values. This issue clearly states that it is not possible to do this in elasticsearch. However, i mana…

---

## [Skip the document using a script processor](https://discuss.elastic.co/t/skip-the-document-using-a-script-processor/230608)

<div class="topic-metadata">

**Author:** [@bindu](https://discuss.elastic.co/u/bindu)\
**Replies:** 2\
**Last updated:** [May 1, 2020, 2:51am UTC](https://discuss.elastic.co/t/skip-the-document-using-a-script-processor/230608 "2020-05-01T02:51:37Z")

</div>

My use-case : Before the document is indexed, I would like to Skip the documents with conditions using a script processor (defined in a pipeline). When I try to create a index using the pipeline with the script processor…

[Previous page](https://discuss.elastic.co/top.md?page=1495&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1497&per_page=50&period=all)
