# Top **URL:** https://discuss.elastic.co/top.md?page=1519&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1520 --- ## [Number of Master nodes across two data centers](https://discuss.elastic.co/t/number-of-master-nodes-across-two-data-centers/198753)
**Author:** [@Vertigo](https://discuss.elastic.co/u/Vertigo)\ **Replies:** 2\ **Last updated:** [September 9, 2019, 5:55pm UTC](https://discuss.elastic.co/t/number-of-master-nodes-across-two-data-centers/198753 "2019-09-09T17:55:14Z")
We are working on redesigning our currently cluster. Our 40 ES data nodes are split between 2 data centers, 20 in each. Currently there are 3 master dedicated nodes, 2 in one DC, and 1 in the other. The goal with the two… --- ## [Using aggregate filter to measure response time](https://discuss.elastic.co/t/using-aggregate-filter-to-measure-response-time/188312)
**Author:** [@BartR](https://discuss.elastic.co/u/BartR)\ **Replies:** 2\ **Last updated:** [July 1, 2019, 1:40pm UTC](https://discuss.elastic.co/t/using-aggregate-filter-to-measure-response-time/188312 "2019-07-01T13:40:13Z")
Hi , i have been attempting to create an additional field into my logging which keeps the responsetime of tsa requests to a service . after looking though some stuff i found that it looked like it would be possible wit… --- ## [Is sparse data on not indexed field affect on ES performance?](https://discuss.elastic.co/t/is-sparse-data-on-not-indexed-field-affect-on-es-performance/112771)
**Author:** [@majid\_zarrin](https://discuss.elastic.co/u/majid_zarrin)\ **Replies:** 2\ **Last updated:** [January 9, 2018, 6:43pm UTC](https://discuss.elastic.co/t/is-sparse-data-on-not-indexed-field-affect-on-es-performance/112771 "2018-01-09T18:43:57Z")
I have sparse data based on a filed named type. assume if (type = A ) fields x and y appears if(type=B) fields w and z appears. if(type=C) no extra fields appears ( about 70% of data ~ 2 billion data ) I know that… --- ## [Package name "heartbeat" conflicts with "heartbeat" package for Linux HA cluster](https://discuss.elastic.co/t/package-name-heartbeat-conflicts-with-heartbeat-package-for-linux-ha-cluster/107706)
**Author:** [@elkinspace](https://discuss.elastic.co/u/elkinspace)\ **Replies:** 2\ **Last updated:** [November 15, 2017, 11:30am UTC](https://discuss.elastic.co/t/package-name-heartbeat-conflicts-with-heartbeat-package-for-linux-ha-cluster/107706 "2017-11-15T11:30:55Z")
Hi there, I have just had an issue with the use of heartbeat. The heartbeat package (ES) has the same name as the heartbeat package used together with Pacemaker and Corosync for Linux clustering. This heartbeat package … --- ## [Kv filter url parsing with dot inside field name](https://discuss.elastic.co/t/kv-filter-url-parsing-with-dot-inside-field-name/49425)
**Author:** [@jmduno](https://discuss.elastic.co/u/jmduno)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 4:27am UTC](https://discuss.elastic.co/t/kv-filter-url-parsing-with-dot-inside-field-name/49425 "2016-05-09T04:27:43Z")
Hello, I am parsing url, and i have warning message : Failed action. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-2015.10.07", :\_type=\>"apache-access", :\_routing=\>nil}, 2015-10-07T13:12:35.000Z XX… --- ## [Conditionals and Dates](https://discuss.elastic.co/t/conditionals-and-dates/36387)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 2\ **Last updated:** [December 5, 2015, 4:29pm UTC](https://discuss.elastic.co/t/conditionals-and-dates/36387 "2015-12-05T16:29:15Z")
Issue: I have a lot of different logs coming from 1 source and separate date formats. Situation: Hey everyone I have a conditional logstash file that takes a single input and runs multiple conditionals to determine whi… --- ## [Term Filtered query doesn't work for field with index: not\_analyzed](https://discuss.elastic.co/t/term-filtered-query-doesnt-work-for-field-with-index-not-analyzed/28868)
**Author:** [@MaKro](https://discuss.elastic.co/u/MaKro)\ **Replies:** 2\ **Last updated:** [September 9, 2015, 1:48am UTC](https://discuss.elastic.co/t/term-filtered-query-doesnt-work-for-field-with-index-not-analyzed/28868 "2015-09-09T01:48:35Z")
Hi. I have a problem with query. I want to find document by one of the field using term filtered query (I need to find exact match). I've got index definition: { "settings": { "analysis": { "default": { "… --- ## [Knapsack use case](https://discuss.elastic.co/t/knapsack-use-case/19000)
**Author:** [@Matteo\_Moci](https://discuss.elastic.co/u/Matteo_Moci)\ **Replies:** 2\ **Last updated:** [January 19, 2015, 2:27pm UTC](https://discuss.elastic.co/t/knapsack-use-case/19000 "2015-01-19T14:27:34Z")
Hi All, I have some questions about the knapsack plugin \[1\]. My idea to use the tool to do a backup to a file, starting from a 0.90.x instance and then restore it on a different 1.2.x or 1.3.x instance. I see it ca… --- ## [Getting Licensing](https://discuss.elastic.co/t/getting-licensing/327785)
**Author:** [@alangano](https://discuss.elastic.co/u/alangano)\ **Replies:** 6\ **Last updated:** [March 19, 2023, 9:27pm UTC](https://discuss.elastic.co/t/getting-licensing/327785 "2023-03-19T21:27:39Z")
Is there a trick to getting licensing? Our company has a team dedicated to working with vendors, and they can't get a response over the last 3 months! We would really like to use some (a lot actually) of the licensed-o… --- ## [resultsPerPage is not being sent in the query](https://discuss.elastic.co/t/resultsperpage-is-not-being-sent-in-the-query/285976)
**Author:** [@reka.gay](https://discuss.elastic.co/u/reka.gay)\ **Replies:** 6\ **Last updated:** [October 6, 2021, 12:43pm UTC](https://discuss.elastic.co/t/resultsperpage-is-not-being-sent-in-the-query/285976 "2021-10-06T12:43:05Z")
I had to move the SearchProvider configuration to the server-side as we're using different engines based on the logged-in user's group. Given that I have to wrap practically the whole application in the SearchProvider (w… --- ## [Curator action for deletion based on space and oldest data](https://discuss.elastic.co/t/curator-action-for-deletion-based-on-space-and-oldest-data/272362)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 6\ **Last updated:** [May 27, 2021, 12:16pm UTC](https://discuss.elastic.co/t/curator-action-for-deletion-based-on-space-and-oldest-data/272362 "2021-05-27T12:16:14Z")
Hi, I am trying to delete the oldest data based on space. I have two kind of data. The name of the one is \-2021-05-04, for example, and the name of the second type is like \-2021.05.04. My first… --- ## [Comportement étrange sur une recherche full text](https://discuss.elastic.co/t/comportement-etrange-sur-une-recherche-full-text/172100)
**Author:** [@rorx](https://discuss.elastic.co/u/rorx)\ **Replies:** 6\ **Last updated:** [March 28, 2019, 10:45am UTC](https://discuss.elastic.co/t/comportement-etrange-sur-une-recherche-full-text/172100 "2019-03-28T10:45:15Z")
Bonjour, Je fais face à un comportement qui m'échappe lors d'une requête de recherche full text. Je suis sur la version 6.6 Le contexte tout d'abord: Je cherche à faire un mappage de catégories entre les catégories pro… --- ## [Zen, Split Brain and the Art of Master Election](https://discuss.elastic.co/t/zen-split-brain-and-the-art-of-master-election/4797)
**Author:** [@Paul\_Smith](https://discuss.elastic.co/u/Paul_Smith)\ **Replies:** 6\ **Last updated:** [July 10, 2011, 9:33am UTC](https://discuss.elastic.co/t/zen-split-brain-and-the-art-of-master-election/4797 "2011-07-10T09:33:37Z")
I had originally thought I had seen some information about how the Zen discovery protocol deals with the Split Brain problem, but alas now I can't find it, or it wasn't there and I was dreaming it up in a caffeine fuel… --- ## [How do we find the number unique dates that a field appears?](https://discuss.elastic.co/t/how-do-we-find-the-number-unique-dates-that-a-field-appears/260616)
**Author:** [@kenneth\_wang](https://discuss.elastic.co/u/kenneth_wang)\ **Replies:** 4\ **Last updated:** [January 12, 2021, 2:14am UTC](https://discuss.elastic.co/t/how-do-we-find-the-number-unique-dates-that-a-field-appears/260616 "2021-01-12T02:14:20Z")
Hello, For each log entry, I have "user identifier" and "date" fields. I would like to find out the number of unique dates that a "user identifier" appears in. Eg. For a given user identifier "1234567", if it appeared … --- ## [Unable to start python django APM](https://discuss.elastic.co/t/unable-to-start-python-django-apm/243034)
**Author:** [@itssameer](https://discuss.elastic.co/u/itssameer)\ **Replies:** 4\ **Last updated:** [August 4, 2020, 2:42pm UTC](https://discuss.elastic.co/t/unable-to-start-python-django-apm/243034 "2020-08-04T14:42:04Z")
Hi , I have installed latest version of python agent, apm-server & ELK stack. But i am unable to find the service in APM dashboard. I can see the below error log in apm-server logs: 2020-07-29T10:26:27.692Z ERROR \[requ… --- ## [Elasticsearch ELK Stack Kibana with APM Service (sftp-upload-service) not posting Transaction data](https://discuss.elastic.co/t/elasticsearch-elk-stack-kibana-with-apm-service-sftp-upload-service-not-posting-transaction-data/237848)
**Author:** [@tangiralapraveen](https://discuss.elastic.co/u/tangiralapraveen)\ **Replies:** 4\ **Last updated:** [June 24, 2020, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-elk-stack-kibana-with-apm-service-sftp-upload-service-not-posting-transaction-data/237848 "2020-06-24T08:39:27Z")
We are working with Elasticsearch ELK Stack 7.3.2 version. With Java Spring Boot service version 1.2.0 we are experiencing Transaction data with null with "Access denied exceptions". Does any one come across the simila… --- ## [DB Hostname is missing (unnamed)](https://discuss.elastic.co/t/db-hostname-is-missing-unnamed/189852)
**Author:** [@edhuardotierrez](https://discuss.elastic.co/u/edhuardotierrez)\ **Replies:** 1\ **Last updated:** [July 11, 2019, 2:19am UTC](https://discuss.elastic.co/t/db-hostname-is-missing-unnamed/189852 "2019-07-11T02:19:26Z")
Kibana version: 7.1.0 Elasticsearch version: 7.1.0 APM Server version: 7.1.0 APM Agent language and version: Java - 1.x (current) Description of the problem including expected versus actual behavior. Please include s… --- ## [I have a lot of index, but the show does not come out](https://discuss.elastic.co/t/i-have-a-lot-of-index-but-the-show-does-not-come-out/101452)
**Author:** [@xuhaibo](https://discuss.elastic.co/u/xuhaibo)\ **Replies:** 4\ **Last updated:** [September 23, 2017, 3:22pm UTC](https://discuss.elastic.co/t/i-have-a-lot-of-index-but-the-show-does-not-come-out/101452 "2017-09-23T15:22:10Z")
In the kibana monitoring module The show has 230 index, but there is no one in the list\[QQ图片20170922165807\] --- ## [Can't set doc\_values=true for Boolean field](https://discuss.elastic.co/t/cant-set-doc-values-true-for-boolean-field/31736)
**Author:** [@mpowers](https://discuss.elastic.co/u/mpowers)\ **Replies:** 4\ **Last updated:** [October 7, 2015, 6:00pm UTC](https://discuss.elastic.co/t/cant-set-doc-values-true-for-boolean-field/31736 "2015-10-07T18:00:17Z")
I'm having some trouble getting doc\_values=true to work for a Boolean field. I can use mappings that set it, but when I read the mappings back out, doc\_values are not appearing on my field. I'm going to paste a bunch of … --- ## [Cluster config not working](https://discuss.elastic.co/t/cluster-config-not-working/175740)
**Author:** [@haux](https://discuss.elastic.co/u/haux)\ **Replies:** 1\ **Last updated:** [April 9, 2019, 12:17pm UTC](https://discuss.elastic.co/t/cluster-config-not-working/175740 "2019-04-09T12:17:56Z")
Hi, Trying to setup two ES clusters: "cluster1" & "cluster2" (each cluster has one node), but both dockers crash after few seconds The first cluster: docker-compose.yml: version: '3.3' services: elasticsearch1: … --- ## [Debugging unit tests in elasticsearch](https://discuss.elastic.co/t/debugging-unit-tests-in-elasticsearch/50634)
**Author:** [@rbellamy](https://discuss.elastic.co/u/rbellamy)\ **Replies:** 1\ **Last updated:** [January 9, 2019, 4:48pm UTC](https://discuss.elastic.co/t/debugging-unit-tests-in-elasticsearch/50634 "2019-01-09T16:48:22Z")
I'm interested in attaching a debugger to the unit tests in Elasticsearch. In the TESTING document, it mentions that I can attach a debugger to the running version of Elasticsearch launched via Gradle (e.g. gradle run --… --- ## [Logstash with error of read\_to\_eof](https://discuss.elastic.co/t/logstash-with-error-of-read-to-eof/150302)
**Author:** [@Chunbo\_Liao](https://discuss.elastic.co/u/Chunbo_Liao)\ **Replies:** 1\ **Last updated:** [October 5, 2018, 9:51am UTC](https://discuss.elastic.co/t/logstash-with-error-of-read-to-eof/150302 "2018-10-05T09:51:23Z")
Hi, When I run logstash 6.4.1, there are lots of follow error logs. \[ERROR\]\[filewatch.tailmode.handlers.grow\] read\_to\_eof: general error reading /home/11thone/caselog/logmonster/CAS-HUNAN-TEST/MME01/MMDU0/SubsHandlerSn… --- ## [Expand visualization](https://discuss.elastic.co/t/expand-visualization/107944)
**Author:** [@ytzlax](https://discuss.elastic.co/u/ytzlax)\ **Replies:** 1\ **Last updated:** [November 16, 2017, 4:38pm UTC](https://discuss.elastic.co/t/expand-visualization/107944 "2017-11-16T16:38:46Z")
All actions in kibana dashboard change the URL, actions like filtering, open and close legend and etc.. But expand and collapse visualization to full screen, doesn't change the URL. I built kibana plugin and I need to… --- ## [Dashboard in Iframe - login?](https://discuss.elastic.co/t/dashboard-in-iframe-login/100691)
**Author:** [@ncarlini](https://discuss.elastic.co/u/ncarlini)\ **Replies:** 1\ **Last updated:** [September 18, 2017, 5:30pm UTC](https://discuss.elastic.co/t/dashboard-in-iframe-login/100691 "2017-09-18T17:30:31Z")
Hello! we are trying out x-pack and searchguard. We want to add a dashboard into a React site that we have. The ELK documentation suggests we use an iframe. But when we use the iframe we are asked for the login credentia… --- ## [No field found in mapping while executing custom score script](https://discuss.elastic.co/t/no-field-found-in-mapping-while-executing-custom-score-script/76087)
**Author:** [@Shashank\_Shekhar](https://discuss.elastic.co/u/Shashank_Shekhar)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 9:15am UTC](https://discuss.elastic.co/t/no-field-found-in-mapping-while-executing-custom-score-script/76087 "2017-02-27T09:15:13Z")
I've been struggling with this issue for hours now. I am trying to implement custom score in my search using script score (groovy). Mapping : { "properties": { "m\_skill": { "properties": { "… --- ## [Reindexing glob of indices](https://discuss.elastic.co/t/reindexing-glob-of-indices/34881)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 1\ **Last updated:** [November 18, 2015, 8:19am UTC](https://discuss.elastic.co/t/reindexing-glob-of-indices/34881 "2015-11-18T08:19:41Z")
I have corrupted a set of indexes, nginx-\* , by trying to modify the type of a particular field with the PUT mapping API. I get this error in Kibana settings/indices page: A field is defined as several types (string, i… --- ## [\[Help Request\] HTTP Input with Multiline JSON Post Data](https://discuss.elastic.co/t/help-request-http-input-with-multiline-json-post-data/31920)
**Author:** [@tmo](https://discuss.elastic.co/u/tmo)\ **Replies:** 1\ **Last updated:** [October 9, 2015, 5:59pm UTC](https://discuss.elastic.co/t/help-request-http-input-with-multiline-json-post-data/31920 "2015-10-09T17:59:12Z")
I'm trying to parse a newline separated HTTPS POST data feed, each line is a JSON object. I also have an output to elastic search. Right now I'm trying to use the json\_lines codec and that doesn't seem to be working a… --- ## [Blacklisting(restricting) fields from elasticsearch query to be search](https://discuss.elastic.co/t/blacklisting-restricting-fields-from-elasticsearch-query-to-be-search/308539)
**Author:** [@deepak\_prem](https://discuss.elastic.co/u/deepak_prem)\ **Replies:** 3\ **Last updated:** [June 30, 2022, 7:32am UTC](https://discuss.elastic.co/t/blacklisting-restricting-fields-from-elasticsearch-query-to-be-search/308539 "2022-06-30T07:32:00Z")
Hi, friends am new to Elasticsearch. I want to know if I can exclude certain fields from search from Elasticsearch. To elaborate I want to ignore it from my search. It should not search that field when we specify but sho… --- ## [Logstash Grok Filter Error Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \[A-Za-z0-9\_-\], '\\"', \\"'\\", \[A-Za-z\_\], \\"-\\", \[0-9\], \\"\[\\", \\"{\\"](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808)
**Author:** [@baklavadeseni](https://discuss.elastic.co/u/baklavadeseni)\ **Replies:** 3\ **Last updated:** [April 11, 2021, 11:42pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-error-expected-one-of-t-r-n-a-za-z0-9-a-za-z-0-9/269808 "2021-04-11T23:42:26Z")
Hello Logstash Community, I am trying to parse text below. I was able to filter it in grokdebug site. But however i can't filter in logstash. It throws this. "LogStash::ConfigurationError", :message=\>"Expected one of \[… --- ## [Elasticsearch dead but pid file exists](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 3\ **Last updated:** [October 26, 2020, 11:19am UTC](https://discuss.elastic.co/t/elasticsearch-dead-but-pid-file-exists/252684 "2020-10-26T11:19:39Z")
Why it is happening very frequently? is there any thing crashed ? i have removed the dead file from /var/lock/subsys but again and again i am getting this. Elasticsearch dead but pid file exists --- ## [Solved: removing domain name from hostname (host.name) with Logstash mutate split and replace filter](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 6:29pm UTC](https://discuss.elastic.co/t/solved-removing-domain-name-from-hostname-host-name-with-logstash-mutate-split-and-replace-filter/245661 "2020-08-19T18:29:20Z")
I ran into an issue in Kibana where the logs for a server were not showing up after I clicked on a server in the Metrics -\> Inventory -\> Host logs. There were however logs in the Winlogbeat index that were specific to e… --- ## [Filebeat - Spooling to disk](https://discuss.elastic.co/t/filebeat-spooling-to-disk/232800)
**Author:** [@saket\_gupta](https://discuss.elastic.co/u/saket_gupta)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 2:29pm UTC](https://discuss.elastic.co/t/filebeat-spooling-to-disk/232800 "2020-05-21T14:29:28Z")
Hi Team, What happens when a filebeat's output like ELastic Search or Logstash is not avalable , however the log files are still written. Will it start consuming memory or will it default to disk. I see that we can con… --- ## [Dataframe Analytics Job Failed to apply boolean mapping](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 3:48am UTC](https://discuss.elastic.co/t/dataframe-analytics-job-failed-to-apply-boolean-mapping/232383 "2020-05-15T03:48:32Z")
Hello, Just tried a dataframe analytics outlier job on our panw data, which immeditaly failed when trying to start: An error occurred starting the data frame analytics dig\_dfa\_outlier\_panw\_user\_001: {"statusCode":400,"… --- ## [Elasticsearch build-in users config in docker-compose](https://discuss.elastic.co/t/elasticsearch-build-in-users-config-in-docker-compose/213854)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 3\ **Last updated:** [January 29, 2020, 8:48pm UTC](https://discuss.elastic.co/t/elasticsearch-build-in-users-config-in-docker-compose/213854 "2020-01-29T20:48:05Z")
Hi, Is there any way to use "elasticsearch-setup-passwords" command in docker-compose to define build-in users and password? I don't wanna exec elasticsearch-setup-passwords interactive command manually on every containe… --- ## [Logstash - Multiple grok pattern not working together](https://discuss.elastic.co/t/logstash-multiple-grok-pattern-not-working-together/181825)
**Author:** [@achatterjee104](https://discuss.elastic.co/u/achatterjee104)\ **Replies:** 3\ **Last updated:** [May 21, 2019, 12:42pm UTC](https://discuss.elastic.co/t/logstash-multiple-grok-pattern-not-working-together/181825 "2019-05-21T12:42:17Z")
I am very new in using Logstash. I have two kinds of log, Pattern 1 : --2019-05-09 08:53:45.057 -INFO 11736 --- \[ntainer#1-0-C-1\] c.s.s.service.MessageLogServiceImpl : \[adc7fd862db5307a688817198046b284dbb12b9347bed… --- ## [GSuite SAML integration for ElasticCloud return 401](https://discuss.elastic.co/t/gsuite-saml-integration-for-elasticcloud-return-401/162408)
**Author:** [@Vincent\_Ngai](https://discuss.elastic.co/u/Vincent_Ngai)\ **Replies:** 3\ **Last updated:** [December 29, 2018, 11:40am UTC](https://discuss.elastic.co/t/gsuite-saml-integration-for-elasticcloud-return-401/162408 "2018-12-29T11:40:19Z")
I am using ElasticCloud and version in v6.5.4 , would like some help in here... What i wanna to do Using Gsuite and email as Kibana login Follow Post (https://www.elastic.co/guide/en/cloud/release-ms-14/ec-securing-cl… --- ## [Elasticsearch Restore snapshot from different azure account](https://discuss.elastic.co/t/elasticsearch-restore-snapshot-from-different-azure-account/101815)
**Author:** [@Narmatha](https://discuss.elastic.co/u/Narmatha)\ **Replies:** 3\ **Last updated:** [September 26, 2017, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch-restore-snapshot-from-different-azure-account/101815 "2017-09-26T11:52:49Z")
I need to copy data from the production server into the test server. How to do this ? The snapshot is created in production using azure cloud plugin. Is it possible to restore data from one azure storage to another az… --- ## [Users prerequisites (sudo). To do what?](https://discuss.elastic.co/t/users-prerequisites-sudo-to-do-what/79442)
**Author:** [@JohnnyB](https://discuss.elastic.co/u/JohnnyB)\ **Replies:** 3\ **Last updated:** [March 22, 2017, 1:46pm UTC](https://discuss.elastic.co/t/users-prerequisites-sudo-to-do-what/79442 "2017-03-22T13:46:24Z")
In Check the Prerequisites, you ask sudo group for the elastic user. My security manager ask which command the elastic user will sudo to ? Thanks for your precisions, Johnny. --- ## [How to use custom log4j2.properties](https://discuss.elastic.co/t/how-to-use-custom-log4j2-properties/70518)
**Author:** [@wenyao](https://discuss.elastic.co/u/wenyao)\ **Replies:** 3\ **Last updated:** [January 11, 2017, 9:34am UTC](https://discuss.elastic.co/t/how-to-use-custom-log4j2-properties/70518 "2017-01-11T09:34:24Z")
Hi, i need to run two separate instances of logstash with different configurations of log4j2.properties. Is it possible to specify a custom file on execution? If so, please share some examples. Thank you. --- ## [Synonyms Feature in Elasticserach](https://discuss.elastic.co/t/synonyms-feature-in-elasticserach/60135)
**Author:** [@prasad\_kp](https://discuss.elastic.co/u/prasad_kp)\ **Replies:** 3\ **Last updated:** [September 12, 2016, 6:56am UTC](https://discuss.elastic.co/t/synonyms-feature-in-elasticserach/60135 "2016-09-12T06:56:04Z")
Hi Everyone...I am trying to implement the Synonyms feature in ES,is there any step by step complete documentation to achieve this in ES . Thanks for your help in advance. --- ## [Better protection against typo in curator config file](https://discuss.elastic.co/t/better-protection-against-typo-in-curator-config-file/54235)
**Author:** [@hongyuan1306](https://discuss.elastic.co/u/hongyuan1306)\ **Replies:** 3\ **Last updated:** [July 1, 2016, 1:41pm UTC](https://discuss.elastic.co/t/better-protection-against-typo-in-curator-config-file/54235 "2016-07-01T13:41:17Z")
I am a new user to curator and with the latest version of curator (4.0.0) I started with the following action config: actions: 1: action: delete\_indices fitlers: - filtertype: pattern kind: prefix … --- ## [Query with OR and AND clauses](https://discuss.elastic.co/t/query-with-or-and-and-clauses/48657)
**Author:** [@fallenstorm](https://discuss.elastic.co/u/fallenstorm)\ **Replies:** 3\ **Last updated:** [April 28, 2016, 1:31pm UTC](https://discuss.elastic.co/t/query-with-or-and-and-clauses/48657 "2016-04-28T13:31:51Z")
I want to realize query like this: (span\_near or (span\_near and span\_near) or ...). I have tried: \> "span\_or": { clauses: \[ { … --- ## [BulkIndexing is~10X slower in 2.1 when index is dropped and recreated](https://discuss.elastic.co/t/bulkindexing-is-10x-slower-in-2-1-when-index-is-dropped-and-recreated/36381)
**Author:** [@sundeep](https://discuss.elastic.co/u/sundeep)\ **Replies:** 3\ **Last updated:** [December 12, 2015, 11:35am UTC](https://discuss.elastic.co/t/bulkindexing-is-10x-slower-in-2-1-when-index-is-dropped-and-recreated/36381 "2015-12-12T11:35:06Z")
I am upgrading from Elasticsearch 1.7.1 to 2.1. I had a test case in 1.7.1 and am testing the same on 2.1. Here are the steps 1) create object with random values and corresponding JSONs are 3K Bytes. 2) Index 200 such… --- ## [How to connect logstash 1.5.5 to s3-ceph storage?](https://discuss.elastic.co/t/how-to-connect-logstash-1-5-5-to-s3-ceph-storage/34789)
**Author:** [@Jin\_Nguyen](https://discuss.elastic.co/u/Jin_Nguyen)\ **Replies:** 3\ **Last updated:** [November 18, 2015, 10:29am UTC](https://discuss.elastic.co/t/how-to-connect-logstash-1-5-5-to-s3-ceph-storage/34789 "2015-11-18T10:29:44Z")
Dear all, I need to connect logstash output to my s3-ceph storage but the s3 output settings does not let me choose custom region\_enpoint. I have a endpoint named s3.myhost.com so what do I need to do to connect logst… --- ## [Elasticsearch/logstash/kibana with hadoop as Hunk alternative](https://discuss.elastic.co/t/elasticsearch-logstash-kibana-with-hadoop-as-hunk-alternative/18202)
**Author:** [@kay\_kay](https://discuss.elastic.co/u/kay_kay)\ **Replies:** 3\ **Last updated:** [June 23, 2014, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-logstash-kibana-with-hadoop-as-hunk-alternative/18202 "2014-06-23T13:52:41Z")
Hi For performance improvement I'm trying to combine Elasticsearch/Logstash/Kibana with Hadoop (cdh4) and configure opensource alternative to Hunk. Unfortunately I'm familiar only with HDFS where I store logs. I… --- ## [Compression options for small documents](https://discuss.elastic.co/t/compression-options-for-small-documents/4933)
**Author:** [@dottom](https://discuss.elastic.co/u/dottom)\ **Replies:** 3\ **Last updated:** [July 26, 2011, 12:04am UTC](https://discuss.elastic.co/t/compression-options-for-small-documents/4933 "2011-07-26T00:04:15Z")
Would it be possible to eventually compress data beyond \_source compression? I am indexing a lot of small documents 200-400 bytes in size. Using default settings, the index is 4-6x the size of the raw text data (r… --- ## [How to add input fields to Eui Data Grid](https://discuss.elastic.co/t/how-to-add-input-fields-to-eui-data-grid/326567)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 5\ **Last updated:** [March 24, 2023, 8:39am UTC](https://discuss.elastic.co/t/how-to-add-input-fields-to-eui-data-grid/326567 "2023-03-24T08:39:39Z")
Hi, I want to add input fields to my data grid. Meaning in total I'll have 10 columns After 3 columns data, I need 2 columns as input fields, and the values in the rest of the columns will depend on the values in the … --- ## [Fleet Server No Data Stream](https://discuss.elastic.co/t/fleet-server-no-data-stream/324753)
**Author:** [@NathanLau](https://discuss.elastic.co/u/NathanLau)\ **Replies:** 5\ **Last updated:** [February 10, 2023, 11:03am UTC](https://discuss.elastic.co/t/fleet-server-no-data-stream/324753 "2023-02-10T11:03:55Z")
Hi All , When installed Fleet server with quick start. the fleet server cannot receive any data themselves , same as system. install command : sudo ./elastic-agent install \\ --fleet-server-es=https://172.16.\*\*.\*\*:9… --- ## [ElasticSearch as primary database and other solutions](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021)
**Author:** [@xemyleex](https://discuss.elastic.co/u/xemyleex)\ **Replies:** 5\ **Last updated:** [September 1, 2021, 10:07pm UTC](https://discuss.elastic.co/t/elasticsearch-as-primary-database-and-other-solutions/283021 "2021-09-01T22:07:50Z")
I am using elasticsearch as primary database. But due to the lack of the ACID properties, I want to: or replace it with another database with similar or better performances ( maybe postgresql or kafka/ksql ). or use ot… --- ## [MSSP SOC - How to ByPass "Cases"](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 5\ **Last updated:** [December 17, 2020, 10:01am UTC](https://discuss.elastic.co/t/mssp-soc-how-to-bypass-cases/255387 "2020-12-17T10:01:07Z")
I'm a SOC Engineer at a MSSP SOC and we currently use AlienVault for the majority of our clients, but we started to play around with Elastic SIEM and we just started to work with a potential new client and we have deploy… [Previous page](https://discuss.elastic.co/top.md?page=1518&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1520&per_page=50&period=all)