# Top **URL:** https://discuss.elastic.co/top.md?page=1527&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1528 --- ## [SIEM Timeline data persistence and retention](https://discuss.elastic.co/t/siem-timeline-data-persistence-and-retention/212344)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [December 19, 2019, 7:15am UTC](https://discuss.elastic.co/t/siem-timeline-data-persistence-and-retention/212344 "2019-12-19T07:15:20Z")
Playing a bit with SIEM App and wondering where are Timeline stored and how to possibly control their retention? Don't seem to find any godd system index candidates for this... --- ## [How can i fix kibana expand menu](https://discuss.elastic.co/t/how-can-i-fix-kibana-expand-menu/206509)
**Author:** [@hodong](https://discuss.elastic.co/u/hodong)\ **Replies:** 2\ **Last updated:** [November 12, 2019, 12:25am UTC](https://discuss.elastic.co/t/how-can-i-fix-kibana-expand-menu/206509 "2019-11-12T00:25:18Z")
kibana icon is too simple to me (ELK beginner) so i want fix expand menu always but this page collapse menu continuously can i fix it? --- ## [Keyword and Completion of same text mapping](https://discuss.elastic.co/t/keyword-and-completion-of-same-text-mapping/112943)
**Author:** [@Shekhar\_Pandey](https://discuss.elastic.co/u/Shekhar_Pandey)\ **Replies:** 2\ **Last updated:** [January 3, 2018, 7:33am UTC](https://discuss.elastic.co/t/keyword-and-completion-of-same-text-mapping/112943 "2018-01-03T07:33:28Z")
Hello.. Kindly anybody can tell this mapping will work...or not PUT redmi { "mappings": { "products": { "properties": { "title": { "type": "keyword", "fields": { "keyword": { "type": "completion" } } }, "w… --- ## [Dev Tools - A GET request caused Kibana to completely stop responding](https://discuss.elastic.co/t/dev-tools-a-get-request-caused-kibana-to-completely-stop-responding/108923)
**Author:** [@KitJ](https://discuss.elastic.co/u/KitJ)\ **Replies:** 2\ **Last updated:** [November 28, 2017, 3:55pm UTC](https://discuss.elastic.co/t/dev-tools-a-get-request-caused-kibana-to-completely-stop-responding/108923 "2017-11-28T15:55:55Z")
Hello, Last month I tried to run the attached query using our company's instance of Kibana, using the Dev Tools feature (The field names and values have been replaced by placeholders in the attached query but it is stru… --- ## [Nginx module and keyword fields](https://discuss.elastic.co/t/nginx-module-and-keyword-fields/103277)
**Author:** [@aarongorka](https://discuss.elastic.co/u/aarongorka)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 11:24pm UTC](https://discuss.elastic.co/t/nginx-module-and-keyword-fields/103277 "2017-11-02T23:24:11Z")
The Nginx module for Filebeat seems to ship most fields as keywords, as indicated here: https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-nginx.html It makes it really difficult to do some more usefu… --- ## [Bulk Processor doesn't auto flush after flushInterval duration](https://discuss.elastic.co/t/bulk-processor-doesnt-auto-flush-after-flushinterval-duration/95030)
**Author:** [@hugo53](https://discuss.elastic.co/u/hugo53)\ **Replies:** 2\ **Last updated:** [July 29, 2017, 2:34pm UTC](https://discuss.elastic.co/t/bulk-processor-doesnt-auto-flush-after-flushinterval-duration/95030 "2017-07-29T14:34:57Z")
Hi there, I have a problem with bulk indexing using Bulk Processor. I setup like this: .setBulkActions(5000) .setBulkSize(new ByteSizeValue(50, ByteSizeUnit.MB)) .setFlushInterval(TimeValue.timeValueSeconds(5)) .set… --- ## [Logstash docker java port \<1024 issue](https://discuss.elastic.co/t/logstash-docker-java-port-1024-issue/94128)
**Author:** [@amarchal](https://discuss.elastic.co/u/amarchal)\ **Replies:** 2\ **Last updated:** [July 24, 2017, 7:44am UTC](https://discuss.elastic.co/t/logstash-docker-java-port-1024-issue/94128 "2017-07-24T07:44:34Z")
Hello, Contexte: CentOS7 docker-CE Logstash official image: docker.elastic.co/logstash/logstash:5.5.0 SE Linux disabled When Starting Logstash container with input TCP port \< 1024, I have the following error: \[2017… --- ## [Inject angular controller in Init of a kibana plugin](https://discuss.elastic.co/t/inject-angular-controller-in-init-of-a-kibana-plugin/74631)
**Author:** [@sauravjsl](https://discuss.elastic.co/u/sauravjsl)\ **Replies:** 2\ **Last updated:** [February 12, 2017, 5:55pm UTC](https://discuss.elastic.co/t/inject-angular-controller-in-init-of-a-kibana-plugin/74631 "2017-02-12T17:55:16Z")
Hello There, I am new with Kibana plugin development. I have created a plugin but i would like to call a angular controller in init function. For example : init(server, options) { } I found this in Tim roes plug… --- ## [Getting a Parse Failure when trying to use global aggregation](https://discuss.elastic.co/t/getting-a-parse-failure-when-trying-to-use-global-aggregation/58849)
**Author:** [@VadymSemeniuk](https://discuss.elastic.co/u/VadymSemeniuk)\ **Replies:** 2\ **Last updated:** [August 26, 2016, 10:00am UTC](https://discuss.elastic.co/t/getting-a-parse-failure-when-trying-to-use-global-aggregation/58849 "2016-08-26T10:00:28Z")
Hi! I trying to use global aggregation and getting a parse failure Elasticsearch\\Common\\Exceptions\\BadRequest400Exception search\_parse\_exception: Expected \[START\_OBJECT\] under \[global\], but got a \[START\_ARRAY\] in \[price\_… --- ## [Forcemerge status](https://discuss.elastic.co/t/forcemerge-status/54861)
**Author:** [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\ **Replies:** 2\ **Last updated:** [July 6, 2016, 9:28pm UTC](https://discuss.elastic.co/t/forcemerge-status/54861 "2016-07-06T21:28:45Z")
Hello Guys, I don't have issues with forcemerge, is work for me as well. My question about this topic is the following: I applied the following command: \`curl -XPOST 'http://localhost:9200/logstash-2… --- ## [Delete documents type after version 2.0](https://discuss.elastic.co/t/delete-documents-type-after-version-2-0/49826)
**Author:** [@yuan0122](https://discuss.elastic.co/u/yuan0122)\ **Replies:** 2\ **Last updated:** [May 12, 2016, 5:47pm UTC](https://discuss.elastic.co/t/delete-documents-type-after-version-2-0/49826 "2016-05-12T17:47:44Z")
I am trying to find out if there is any good way to delete a type after version 2.0, since delete by type was deprecated after 2.0 I am using Hive Integration to insert documents into elasticsearch. if hive's map reduc… --- ## [Is it possible to show Pie chart in such situation?](https://discuss.elastic.co/t/is-it-possible-to-show-pie-chart-in-such-situation/41781)
**Author:** [@kacemrostom](https://discuss.elastic.co/u/kacemrostom)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 2:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-show-pie-chart-in-such-situation/41781 "2016-02-19T14:12:24Z")
Hello everyone one, So i have around 100 docs stored in Elasticsearch, each one have this following part: page\_storytellers\_by\_city: { USA: X, UK: Y, France: Z} It indicates the number of visitor from many countrie… --- ## [Reading logs from Unix server with logstash server on windows](https://discuss.elastic.co/t/reading-logs-from-unix-server-with-logstash-server-on-windows/39866)
**Author:** [@shyamank](https://discuss.elastic.co/u/shyamank)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 12:18pm UTC](https://discuss.elastic.co/t/reading-logs-from-unix-server-with-logstash-server-on-windows/39866 "2016-01-22T12:18:52Z")
Hi, Im just getting started with setting up an ELK stack. Currently my logstash server running on windows reads log files on the local machine and populates the elastic search server also running on the same machine. … --- ## [Logstash - make input file path configurable](https://discuss.elastic.co/t/logstash-make-input-file-path-configurable/32638)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 2\ **Last updated:** [October 21, 2015, 6:32am UTC](https://discuss.elastic.co/t/logstash-make-input-file-path-configurable/32638 "2015-10-21T06:32:25Z")
Hi guys, Is it possible to pass the input file path from command line like a system variable or environmental variable and use it inside the logstash configuration in some way??? Thanks, sam. --- ## [Filebeat can't keep up with logs volume](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-logs-volume/287459)
**Author:** [@nsouth](https://discuss.elastic.co/u/nsouth)\ **Replies:** 3\ **Last updated:** [October 24, 2021, 5:45pm UTC](https://discuss.elastic.co/t/filebeat-cant-keep-up-with-logs-volume/287459 "2021-10-24T17:45:49Z")
We are trying to run Filebeat on a production server to ship logs to Logstash. However, it is failing to ship logs as quickly as they are being written. If I inspect the Filebeat's registry, it shows that over the past 3… --- ## [Wire and index compatibility version change](https://discuss.elastic.co/t/wire-and-index-compatibility-version-change/232646)
**Author:** [@dlonghi](https://discuss.elastic.co/u/dlonghi)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 4:52am UTC](https://discuss.elastic.co/t/wire-and-index-compatibility-version-change/232646 "2020-05-15T04:52:34Z")
Hello, Is it possible to set minimum\_wire\_compatibility\_version and minimum\_index\_compatibility\_version to a particular version ? For instance: 7.7.0 Thanks, --- ## [Bool query with must on query\_string (with date) and range does not work](https://discuss.elastic.co/t/bool-query-with-must-on-query-string-with-date-and-range-does-not-work/202107)
**Author:** [@thernstig](https://discuss.elastic.co/u/thernstig)\ **Replies:** 0\ **Last updated:** [October 3, 2019, 7:26am UTC](https://discuss.elastic.co/t/bool-query-with-must-on-query-string-with-date-and-range-does-not-work/202107 "2019-10-03T07:26:43Z")
I am using Kibana to explore my Elasticsearch indices. One index stores timestamp in a "log\_timestamp" field. In Kibana I've added an index pattern for this and also indicated that the "log\_timestamp" field is the one to… --- ## [Arrays of objects](https://discuss.elastic.co/t/arrays-of-objects/154388)
**Author:** [@amit.patra](https://discuss.elastic.co/u/amit.patra)\ **Replies:** 3\ **Last updated:** [October 29, 2018, 7:46am UTC](https://discuss.elastic.co/t/arrays-of-objects/154388 "2018-10-29T07:46:22Z")
Hi, My arrays of objects are getting unknown type in kibana. http": { "http\_headers": \[ { "host": "row.bc.yahoo.com", "user\_agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.16) Gecko/20110319 Firef… --- ## [Logstashのinput file pluginについて](https://discuss.elastic.co/t/logstash-input-file-plugin/140896)
**Author:** [@yamamotoh](https://discuss.elastic.co/u/yamamotoh)\ **Replies:** 3\ **Last updated:** [July 25, 2018, 7:16am UTC](https://discuss.elastic.co/t/logstash-input-file-plugin/140896 "2018-07-25T07:16:49Z")
logstashにてinputでログファイルを指定しているのですが、index作成時はlogが読み込まれ、その後発生したlogメッセージがindexに追記されずに困っています。 input { file { path =\> "/logdirectory/access\_log1" type =\> "access\_log1" } file { path =\> "/logdirectory/access.log2" … --- ## [Filebeat fails to send monitoring stats to Elasticsearch](https://discuss.elastic.co/t/filebeat-fails-to-send-monitoring-stats-to-elasticsearch/124635)
**Author:** [@mn\_dev](https://discuss.elastic.co/u/mn_dev)\ **Replies:** 3\ **Last updated:** [March 21, 2018, 1:55pm UTC](https://discuss.elastic.co/t/filebeat-fails-to-send-monitoring-stats-to-elasticsearch/124635 "2018-03-21T13:55:38Z")
I cannot seem to setup the xpack monitoring of Filebeats successfully. Filebeats keeps logging error messages similar to: 2018-03-19T12:29:20.396-0700 ERROR pipeline/output.go:92 Failed to publish events: 500 Internal … --- ## [Does Watcher Slack Action support UTF-8?](https://discuss.elastic.co/t/does-watcher-slack-action-support-utf-8/112731)
**Author:** [@serive](https://discuss.elastic.co/u/serive)\ **Replies:** 3\ **Last updated:** [January 8, 2018, 11:26am UTC](https://discuss.elastic.co/t/does-watcher-slack-action-support-utf-8/112731 "2018-01-08T11:26:55Z")
Hi, I tried slack action of watcher but Non-ASCII character becomes "?". Elastic stack version: 6.1.0 watcher settings: { "trigger": { "schedule": { "cron": "0 \* \* \* \* ?" } }, "input": { "sear… --- ## [Machine Learning - Single Metric Job - Empty 'Field' combobox](https://discuss.elastic.co/t/machine-learning-single-metric-job-empty-field-combobox/96596)
**Author:** [@kmaci3k](https://discuss.elastic.co/u/kmaci3k)\ **Replies:** 3\ **Last updated:** [August 10, 2017, 6:46pm UTC](https://discuss.elastic.co/t/machine-learning-single-metric-job-empty-field-combobox/96596 "2017-08-10T18:46:57Z")
Hi, I'm trying to set up a single metric machine learning job but after selecting 'index' and 'Aggregation' the 'Field' combobox is just empty. Here is my json: { "\_index": "metrics-2017.08.10", "\_type": "log", "\_… --- ## [Cannot get all fields in Kibana](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764)
**Author:** [@Steve\_1](https://discuss.elastic.co/u/Steve_1)\ **Replies:** 3\ **Last updated:** [June 10, 2017, 5:06pm UTC](https://discuss.elastic.co/t/cannot-get-all-fields-in-kibana/88764 "2017-06-10T17:06:40Z")
I have the following packetbeat.yml packetbeat.flows: period: 60s packetbeat.interfaces.device: any packetbeat.protocols.icmp: enabled: true packetbeat.protocols.amqp: ports: \[5672\] packetbeat.protocols.nfs: … --- ## [Logstash s3 region us-east-2 not supported?](https://discuss.elastic.co/t/logstash-s3-region-us-east-2-not-supported/86591)
**Author:** [@nielsen-at-cgt](https://discuss.elastic.co/u/nielsen-at-cgt)\ **Replies:** 3\ **Last updated:** [May 22, 2017, 2:47pm UTC](https://discuss.elastic.co/t/logstash-s3-region-us-east-2-not-supported/86591 "2017-05-22T14:47:07Z")
My logstash 5.4.0 lab is in AWS us-east-2. input { s3 { # This setting must be a \["us-east-1", "us-west-1", "us-west-2", "eu-central-1", "eu-west-1", "ap-southeast-1", "ap-southeast-2", "ap-northeast-1", "ap-nort… --- ## [About the winlogbeats output](https://discuss.elastic.co/t/about-the-winlogbeats-output/82098)
**Author:** [@qiuyuanshun](https://discuss.elastic.co/u/qiuyuanshun)\ **Replies:** 3\ **Last updated:** [April 13, 2017, 1:21pm UTC](https://discuss.elastic.co/t/about-the-winlogbeats-output/82098 "2017-04-13T13:21:20Z")
If I want to output through the network port to another server on the file, how should I set up my output, I can not find the relevant settings. --- ## [Remove part of a field](https://discuss.elastic.co/t/remove-part-of-a-field/51043)
**Author:** [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Replies:** 3\ **Last updated:** [May 26, 2016, 12:58pm UTC](https://discuss.elastic.co/t/remove-part-of-a-field/51043 "2016-05-26T12:58:34Z")
Hi, I'm working with phone numbers, i would like to save the 2 or 3 first digit of a phone number ( international code) . Actually i have a field "called\_number", how can i save the 2 or 3 first digit in another fie… --- ## [400 request with   character](https://discuss.elastic.co/t/400-request-with-160-character/33056)
**Author:** [@Marc-Ed](https://discuss.elastic.co/u/Marc-Ed)\ **Replies:** 3\ **Last updated:** [October 28, 2015, 1:29am UTC](https://discuss.elastic.co/t/400-request-with-160-character/33056 "2015-10-28T01:29:09Z")
Hi, I would like to confirm the issue first before logging it as a Bug. Using the simplest JSON structure is enough to reproduce the issue. ES version 1.6.0. When a text value contains the character   (e.g nbsp), … --- ## [Auto creation of indexes is done in the wrong timezone](https://discuss.elastic.co/t/auto-creation-of-indexes-is-done-in-the-wrong-timezone/9365)
**Author:** [@Roberto](https://discuss.elastic.co/u/Roberto)\ **Replies:** 3\ **Last updated:** [October 16, 2012, 12:39pm UTC](https://discuss.elastic.co/t/auto-creation-of-indexes-is-done-in-the-wrong-timezone/9365 "2012-10-16T12:39:53Z")
Hi, Everyday, at 9:00 PM, a new index is created by ES. I think this process should be done at midnight. Anyone has idea of what is going on? My timezone is GMT-3, by the way. Thanks, Roberto -- --- ## [Get documents based on other documents](https://discuss.elastic.co/t/get-documents-based-on-other-documents/344475)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 5\ **Last updated:** [October 10, 2023, 3:13pm UTC](https://discuss.elastic.co/t/get-documents-based-on-other-documents/344475 "2023-10-10T15:13:32Z")
Hello, i have multiple indexes with multiple documents grouped in a data view. For documents like {..., field1: value, field2: value, ...}, is there a way to get all documents for which at least one other document exis… --- ## [How to divide two doc\_count values in aggregations](https://discuss.elastic.co/t/how-to-divide-two-doc-count-values-in-aggregations/312035)
**Author:** [@Chandana\_P](https://discuss.elastic.co/u/Chandana_P)\ **Replies:** 5\ **Last updated:** [August 16, 2022, 10:26pm UTC](https://discuss.elastic.co/t/how-to-divide-two-doc-count-values-in-aggregations/312035 "2022-08-16T22:26:44Z")
I want to perform division between two doc\_count values of unique fields obtained through "terms" bucket aggregation. Is there a way to do that? --- ## [Delete multiple docs with matching multiple elements](https://discuss.elastic.co/t/delete-multiple-docs-with-matching-multiple-elements/166343)
**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\ **Replies:** 5\ **Last updated:** [January 31, 2019, 4:07am UTC](https://discuss.elastic.co/t/delete-multiple-docs-with-matching-multiple-elements/166343 "2019-01-31T04:07:52Z")
Hi There, I have the documents in my index in the following format; { "\_index": "mt\_uat-app", "\_type": "doc", "\_id": "bR2vjmUBJkTWRy0yg7Y1", "\_version": 1, "\_score": 1, "\_source": { "PartnerID": "wireca… --- ## [Need logstash grok help](https://discuss.elastic.co/t/need-logstash-grok-help/113268)
**Author:** [@subin](https://discuss.elastic.co/u/subin)\ **Replies:** 5\ **Last updated:** [December 27, 2017, 6:46pm UTC](https://discuss.elastic.co/t/need-logstash-grok-help/113268 "2017-12-27T18:46:26Z")
Hi, My pattern works well in grok-debugger, but fails in Logstash's pipeline. I've been trying for hours; no luck. Here are the logs that I'm trying to parse: Nov 10 20:06:05 mx1 postfix/qmgr\[4016\]: D134620D03: from=\ **Author:** [@hackilberry](https://discuss.elastic.co/u/hackilberry)\ **Replies:** 5\ **Last updated:** [September 25, 2017, 10:03am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474 "2017-09-25T10:03:03Z") Hi all, I'm new with it, so be patient to me. I successfuly succeeded runing my first "test" in Logstash (or maybe I didn't .. this is my question). I tried to read an XML file from a directory, and output the result … --- ## [Cannot use sense in my os kibana](https://discuss.elastic.co/t/cannot-use-sense-in-my-os-kibana/79216)
**Author:** [@xxiong95](https://discuss.elastic.co/u/xxiong95)\ **Replies:** 5\ **Last updated:** [March 22, 2017, 9:16am UTC](https://discuss.elastic.co/t/cannot-use-sense-in-my-os-kibana/79216 "2017-03-22T09:16:35Z")
when i excute this command ./bin/kibana plugin --install elastic/sense the iterm says unkown command plugin how can i fix it --- ## [Search query related - REST API](https://discuss.elastic.co/t/search-query-related-rest-api/4030)
**Author:** [@aditya\_kulkarni](https://discuss.elastic.co/u/aditya_kulkarni)\ **Replies:** 5\ **Last updated:** [March 5, 2011, 4:40pm UTC](https://discuss.elastic.co/t/search-query-related-rest-api/4030 "2011-03-05T16:40:42Z")
Hi, system: ES 0.15.1 platform: WinVista I am using REST API. My document is as follows, { "user": "123", /-\>multiple users are possible "file\_name": "gftgf", /-\>multiple file names are possib… --- ## [Esrally benchmark run with(/out) refresh\_interval param doesn't show any difference in runtime](https://discuss.elastic.co/t/esrally-benchmark-run-with-out-refresh-interval-param-doesnt-show-any-difference-in-runtime/321668)
**Author:** [@Mahesh3](https://discuss.elastic.co/u/Mahesh3)\ **Replies:** 7\ **Last updated:** [December 24, 2022, 5:59am UTC](https://discuss.elastic.co/t/esrally-benchmark-run-with-out-refresh-interval-param-doesnt-show-any-difference-in-runtime/321668 "2022-12-24T05:59:58Z")
I have done two benchmark runs using the esrally, one with default refresh interval and second with "refresh\_interval" set to "-1" (disabled). Both runs took same amount of time. (382 seconds) I am hoping that second be… --- ## [Salesforce Integration in Elastic](https://discuss.elastic.co/t/salesforce-integration-in-elastic/314961)
**Author:** [@sakib3833](https://discuss.elastic.co/u/sakib3833)\ **Replies:** 7\ **Last updated:** [September 29, 2022, 4:00pm UTC](https://discuss.elastic.co/t/salesforce-integration-in-elastic/314961 "2022-09-29T16:00:39Z")
I've connected Salesforce to Workplace Search source with proper authentication. I also get content items in Source overview section. I am wondering how I can visualize Salesforce data in Kibana like other integration.… --- ## [Get visualization of missing data](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 1\ **Last updated:** [October 14, 2020, 10:48am UTC](https://discuss.elastic.co/t/get-visualization-of-missing-data/251285 "2020-10-14T10:48:08Z")
I have data that comes in from many different sources(syslog hosts, ossec, etc). I need to visualize in a data table any sources that have been recieved in the last month but have NOT been recieved in the last 48 hours(T… --- ## [Pin filters by default - but only for me!](https://discuss.elastic.co/t/pin-filters-by-default-but-only-for-me/223862)
**Author:** [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Replies:** 1\ **Last updated:** [March 17, 2020, 11:23am UTC](https://discuss.elastic.co/t/pin-filters-by-default-but-only-for-me/223862 "2020-03-17T11:23:03Z")
We work a lot with filters in out setup, and it is extremely useful to pin filters by default. Especially because we work with a series of dashboards, where the filters should be carried from one to another. But... It'… --- ## [How to restart elasticsearch cluster in redhat linux](https://discuss.elastic.co/t/how-to-restart-elasticsearch-cluster-in-redhat-linux/183489)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 1\ **Last updated:** [May 30, 2019, 8:58am UTC](https://discuss.elastic.co/t/how-to-restart-elasticsearch-cluster-in-redhat-linux/183489 "2019-05-30T08:58:46Z")
Hi, I made some changes in elasticsearch.yml and want to restart my 3 node cluster. i tried this on each node. sudo systemctl stop elasticsearch.service | sudo /bin/systemctl daemon-reload | sudo /bin/systemctl enable… --- ## [Downgrade Filebeat](https://discuss.elastic.co/t/downgrade-filebeat/158354)
**Author:** [@bayoumben](https://discuss.elastic.co/u/bayoumben)\ **Replies:** 1\ **Last updated:** [November 27, 2018, 2:25pm UTC](https://discuss.elastic.co/t/downgrade-filebeat/158354 "2018-11-27T14:25:19Z")
It's installed via yum. --- ## [Measure system temperature](https://discuss.elastic.co/t/measure-system-temperature/128475)
**Author:** [@ionutzp](https://discuss.elastic.co/u/ionutzp)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 9:34am UTC](https://discuss.elastic.co/t/measure-system-temperature/128475 "2018-04-18T09:34:04Z")
Hello all, I've successfully run metricbeat on a raspberryPI and I'm wondering what's the best way of adding the system temperature to the metricbeat data collection? The system temperature can be retrieved using this … --- ## [Making Kibana read-only (version 5.3 running on AWS)](https://discuss.elastic.co/t/making-kibana-read-only-version-5-3-running-on-aws/95104)
**Author:** [@scolon725](https://discuss.elastic.co/u/scolon725)\ **Replies:** 1\ **Last updated:** [July 31, 2017, 1:31am UTC](https://discuss.elastic.co/t/making-kibana-read-only-version-5-3-running-on-aws/95104 "2017-07-31T01:31:52Z")
Hello All, I’m a fairly new user of Elastic and Kibana, so forgive me if this question has already been answered. I’m running Elastic and Kibana (version 5.3, because it appears that’s the latest available on AWS) on a… --- ## [404 Watcher with Java API](https://discuss.elastic.co/t/404-watcher-with-java-api/67655)
**Author:** [@Raurq](https://discuss.elastic.co/u/Raurq)\ **Replies:** 1\ **Last updated:** [December 1, 2016, 9:42am UTC](https://discuss.elastic.co/t/404-watcher-with-java-api/67655 "2016-12-01T09:42:42Z")
Alright. I am trying to set up a watcher that emails me whenever I get a 404 on Elasticsearch. I've really been hacking away at this for a while and I'm exhausted. Relevant info: JDK: 1.8 ElasticSearch: 2.4 I have a … --- ## [Find duplicate](https://discuss.elastic.co/t/find-duplicate/32991)
**Author:** [@kodermax](https://discuss.elastic.co/u/kodermax)\ **Replies:** 1\ **Last updated:** [October 26, 2015, 4:07pm UTC](https://discuss.elastic.co/t/find-duplicate/32991 "2015-10-26T16:07:39Z")
I have a new task find duplicates in contacts. I have a store of contacts in ElasticSearch contact : { name : 'Peter", emails: \["test@test.ru","test@gmail.com"\], phones: \[3242343,4234324\] } Can i find duplicate… --- ## [Using ES as our primary and only datastore](https://discuss.elastic.co/t/using-es-as-our-primary-and-only-datastore/4694)
**Author:** [@Spring\_Ninja](https://discuss.elastic.co/u/Spring_Ninja)\ **Replies:** 7\ **Last updated:** [June 28, 2011, 2:28am UTC](https://discuss.elastic.co/t/using-es-as-our-primary-and-only-datastore/4694 "2011-06-28T02:28:05Z")
I have read through some threads where people mention that their only datastore is ES. From what I have read it can be an option. However, can you point out some drawbacks in doing so? My main no-go is transaction s… --- ## [Advanced Watcher - If Failed % is greater than some defined threshold value](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727)
**Author:** [@Freddy.Raj](https://discuss.elastic.co/u/Freddy.Raj)\ **Replies:** 6\ **Last updated:** [March 30, 2022, 8:18am UTC](https://discuss.elastic.co/t/advanced-watcher-if-failed-is-greater-than-some-defined-threshold-value/300727 "2022-03-30T08:18:26Z")
Hi All, I need some help to achieve below monitoring condition to enable watcher alert. We have a domain named "XYZ" as a value to one of the term field - "main.domain" Under this domain "XYZ", we see logs for several… --- ## [Difference between logstash .conf file and elastic template file](https://discuss.elastic.co/t/difference-between-logstash-conf-file-and-elastic-template-file/129269)
**Author:** [@SRIpandu1729](https://discuss.elastic.co/u/SRIpandu1729)\ **Replies:** 6\ **Last updated:** [April 24, 2018, 9:40am UTC](https://discuss.elastic.co/t/difference-between-logstash-conf-file-and-elastic-template-file/129269 "2018-04-24T09:40:39Z")
Why do we need templates even though we have logstash configuraion files or the question would be reiterated as what is the difference between logstash's configuration file and elastic's template file? (Here what I mean … --- ## [Java DSL and Query DSL different results](https://discuss.elastic.co/t/java-dsl-and-query-dsl-different-results/11004)
**Author:** [@eric\_sanford](https://discuss.elastic.co/u/eric_sanford)\ **Replies:** 6\ **Last updated:** [March 8, 2013, 1:55pm UTC](https://discuss.elastic.co/t/java-dsl-and-query-dsl-different-results/11004 "2013-03-08T13:55:45Z")
Hello, when i run this query... {"filter":{"exists":{"field":"NUM\_OF\_WKS"}}, \* "fields" : \["NUM\_OF\_WKS"\]\*, "facets" : {"Number\_of\_Weeks\_Facet":{"terms":{"field":"NUM\_OF\_WKS","size":"1"} }}} I corerctly get only… --- ## [Error: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/259409)
**Author:** [@Jonathan\_Davis](https://discuss.elastic.co/u/Jonathan_Davis)\ **Replies:** 0\ **Last updated:** [December 22, 2020, 4:35pm UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/259409 "2020-12-22T16:35:22Z")
Good time of the day! I have got a problem with a launch of Filebeat. It doen't want to start. Here is a text of error: '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''… [Previous page](https://discuss.elastic.co/top.md?page=1526&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1528&per_page=50&period=all)