# Top

**URL:** https://discuss.elastic.co/top.md?page=1563&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1564

---

## [Поиск по нескольким полям с вхождением части строки или полной строки в разных полях](https://discuss.elastic.co/t/topic/281513)

<div class="topic-metadata">

**Author:** [@vitaliy\_sheverov](https://discuss.elastic.co/u/vitaliy_sheverov)\
**Replies:** 2\
**Last updated:** [August 16, 2021, 3:37pm UTC](https://discuss.elastic.co/t/topic/281513 "2021-08-16T15:37:41Z")

</div>

Добрый день, помогите пожалуйста составить запрос Мне нужно чтобы, поиск сначала находил хотя бы по одному слову в каждом поле, если найдет все слова в одном поле, тоже подходит. В данном случае меня интересует только Т…

---

## [Change defauit volume size for elastic](https://discuss.elastic.co/t/change-defauit-volume-size-for-elastic/215421)

<div class="topic-metadata">

**Author:** [@KapitanPlaneta](https://discuss.elastic.co/u/KapitanPlaneta)\
**Replies:** 2\
**Last updated:** [January 17, 2020, 9:34am UTC](https://discuss.elastic.co/t/change-defauit-volume-size-for-elastic/215421 "2020-01-17T09:34:40Z")

</div>

Elasticsearch comes with a 1GB storage by default \> NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE \> elasticsearch-data-…

---

## [Logstash keeps restarting after clean install // Ubuntu 18.04 + Java 11](https://discuss.elastic.co/t/logstash-keeps-restarting-after-clean-install-ubuntu-18-04-java-11/200094)

<div class="topic-metadata">

**Author:** [@alilland](https://discuss.elastic.co/u/alilland)\
**Replies:** 2\
**Last updated:** [September 19, 2019, 12:21am UTC](https://discuss.elastic.co/t/logstash-keeps-restarting-after-clean-install-ubuntu-18-04-java-11/200094 "2019-09-19T00:21:45Z")

</div>

Steps to reproduce error: prerequisites: a clean install of Ubuntu 18.04 (I am running on Ec2) Step 1) $ sudo apt-get update Step 2) $ java -version Command 'java' not found, but can be installed with: sudo apt ins…

---

## [Setting field data cache for query performance](https://discuss.elastic.co/t/setting-field-data-cache-for-query-performance/169365)

<div class="topic-metadata">

**Author:** [@Rosmi](https://discuss.elastic.co/u/Rosmi)\
**Replies:** 2\
**Last updated:** [February 21, 2019, 10:13am UTC](https://discuss.elastic.co/t/setting-field-data-cache-for-query-performance/169365 "2019-02-21T10:13:53Z")

</div>

One of the elasticsearch search query with aggregation, is taking more than 10s and getting timed out in my application. The data set being aggregated is very huge .As part of tuning the search query,I am trying to set …

---

## [Got 400 with system\_api\_version \[6\] is not supported by system\_id \[beats\]](https://discuss.elastic.co/t/got-400-with-system-api-version-6-is-not-supported-by-system-id-beats/119012)

<div class="topic-metadata">

**Author:** [@Moshe\_Nadler](https://discuss.elastic.co/u/Moshe_Nadler)\
**Replies:** 2\
**Last updated:** [February 9, 2018, 6:18am UTC](https://discuss.elastic.co/t/got-400-with-system-api-version-6-is-not-supported-by-system-id-beats/119012 "2018-02-09T06:18:46Z")

</div>

I get the following 400 when trying to send monitoring data from filebeat to elasticsearch: ERROR pipeline/output.go:92 Failed to publish events: 400 Bad Request: {"error":{"root\_cause":\[{"type":"illegal\_argument\_ex…

---

## [Winglobeat via Logstash for a new indices](https://discuss.elastic.co/t/winglobeat-via-logstash-for-a-new-indices/99764)

<div class="topic-metadata">

**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\
**Replies:** 2\
**Last updated:** [September 12, 2017, 6:58am UTC](https://discuss.elastic.co/t/winglobeat-via-logstash-for-a-new-indices/99764 "2017-09-12T06:58:54Z")

</div>

Hi, I have installed the winlogbeat 5.4 on a Windows Server 2016 machine. The servie is started. I have configured the ELK server this server is also running fine. output.logstash: The Logstash hosts hosts: \["192.168…

---

## [Logstash Output Avro](https://discuss.elastic.co/t/logstash-output-avro/96245)

<div class="topic-metadata">

**Author:** [@JoseJR](https://discuss.elastic.co/u/JoseJR)\
**Replies:** 2\
**Last updated:** [August 11, 2017, 9:08am UTC](https://discuss.elastic.co/t/logstash-output-avro/96245 "2017-08-11T09:08:05Z")

</div>

Is the pipeline config below possible? input { beats { port =\> “5601” } } filter { mutate { remove\_field =\> \["@version","@timestamp",“path”,“host”, “beat”, “message”\] } } output { stdout { codec =\> avro { sc…

---

## [Delete by query, noob question](https://discuss.elastic.co/t/delete-by-query-noob-question/46684)

<div class="topic-metadata">

**Author:** [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\
**Replies:** 2\
**Last updated:** [April 7, 2016, 1:58pm UTC](https://discuss.elastic.co/t/delete-by-query-noob-question/46684 "2016-04-07T13:58:29Z")

</div>

Hello Guys, I'm using the new ELK version 2.3 and I installed the new plugin delete-by-query. In the old version to delete by query is in this way: curl -XDELETE 'http://localhost:9200/twitter/tweet/…

---

## [What is the order of evaluation of the TermsFilter (or the newer TermsQuery) when multiple TermsFilter are chained together?](https://discuss.elastic.co/t/what-is-the-order-of-evaluation-of-the-termsfilter-or-the-newer-termsquery-when-multiple-termsfilter-are-chained-together/36704)

<div class="topic-metadata">

**Author:** [@swamirajamohan](https://discuss.elastic.co/u/swamirajamohan)\
**Replies:** 2\
**Last updated:** [December 11, 2015, 8:18pm UTC](https://discuss.elastic.co/t/what-is-the-order-of-evaluation-of-the-termsfilter-or-the-newer-termsquery-when-multiple-termsfilter-are-chained-together/36704 "2015-12-11T20:18:13Z")

</div>

What is the order of evaluation of the TermsFilter (or the newer TermsQuery) when multiple TermsFilter are chained together? for eg. should { termsquery1, termsquery2} And what is the order of evaluation in the ev…

---

## [Importing data from AWS RDS to AWS Elasticsearch hosted service](https://discuss.elastic.co/t/importing-data-from-aws-rds-to-aws-elasticsearch-hosted-service/35670)

<div class="topic-metadata">

**Author:** [@ashish\_saraf](https://discuss.elastic.co/u/ashish_saraf)\
**Replies:** 0\
**Last updated:** [November 26, 2015, 12:58pm UTC](https://discuss.elastic.co/t/importing-data-from-aws-rds-to-aws-elasticsearch-hosted-service/35670 "2015-11-26T12:58:36Z")

</div>

Have been playing aroung with this issue for sometime and unable to get the right way to solve the subject.I used jdbc importer but for that i had to setup ec2 instance which could be more dirty when it gets to managing …

---

## [Not able to start enterprise search once I change the ip adress of ent\_search.listen\_host](https://discuss.elastic.co/t/not-able-to-start-enterprise-search-once-i-change-the-ip-adress-of-ent-search-listen-host/255315)

<div class="topic-metadata">

**Author:** [@Axelle\_Eynde](https://discuss.elastic.co/u/Axelle_Eynde)\
**Replies:** 4\
**Last updated:** [November 13, 2020, 11:22am UTC](https://discuss.elastic.co/t/not-able-to-start-enterprise-search-once-i-change-the-ip-adress-of-ent-search-listen-host/255315 "2020-11-13T11:22:33Z")

</div>

Hi, I'm running enterprise search 7.9.3 with docker on a server. When I try to run it on the localhost everything appears to be looking fine but I can't acess the interface. And when I change the ent-search.listen\_host…

---

## [Failed to decrypt report job data. Please re-generate this report. Kibana 6.7.1](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-re-generate-this-report-kibana-6-7-1/200679)

<div class="topic-metadata">

**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\
**Replies:** 4\
**Last updated:** [October 1, 2019, 5:37pm UTC](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-re-generate-this-report-kibana-6-7-1/200679 "2019-10-01T17:37:59Z")

</div>

Hi team, i get error while generate PDF report. However, all server settings listed are made correctly. Use one instance of kibana. Couldn't create report for dashboard 'New Dashboard'. Failed to decrypt report job data…

---

## [Document count is lesser than the number of document indexed](https://discuss.elastic.co/t/document-count-is-lesser-than-the-number-of-document-indexed/161686)

<div class="topic-metadata">

**Author:** [@msmani](https://discuss.elastic.co/u/msmani)\
**Replies:** 4\
**Last updated:** [December 21, 2018, 1:14pm UTC](https://discuss.elastic.co/t/document-count-is-lesser-than-the-number-of-document-indexed/161686 "2018-12-21T13:14:12Z")

</div>

I am indexing via bulk api (provided by org.elasticsearch.client.RestHighLevelClient ), the number of document I index is 381942 but when I use the \_count api of elasticsearch it shows lesser count, that number varies…

---

## [Elasticsearch Cluster , Xpack security and User management](https://discuss.elastic.co/t/elasticsearch-cluster-xpack-security-and-user-management/150980)

<div class="topic-metadata">

**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\
**Replies:** 4\
**Last updated:** [October 4, 2018, 10:20am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-xpack-security-and-user-management/150980 "2018-10-04T10:20:33Z")

</div>

Hi All , I want to clarify the xpack security management in en elasticsearch cluster . I have experience in 1 elasticsearch and xpack installation and enabling security. I am created an elasticsearch cluster with 3 …

---

## [Dns Indexing Problem](https://discuss.elastic.co/t/dns-indexing-problem/120349)

<div class="topic-metadata">

**Author:** [@harrunisk](https://discuss.elastic.co/u/harrunisk)\
**Replies:** 4\
**Last updated:** [February 18, 2018, 2:19pm UTC](https://discuss.elastic.co/t/dns-indexing-problem/120349 "2018-02-18T14:19:15Z")

</div>

Hi all. I am trying to do this example. Packetbeat can capture traffic but there is indexing problem about dns. I have already installed elasticsearch, kibana, x-pack, packetbeat and logstash. I haven't configured logst…

---

## [How do I delete a single "Types" from Indices?](https://discuss.elastic.co/t/how-do-i-delete-a-single-types-from-indices/102329)

<div class="topic-metadata">

**Author:** [@Rahul\_Saxena](https://discuss.elastic.co/u/Rahul_Saxena)\
**Replies:** 4\
**Last updated:** [September 30, 2017, 9:55am UTC](https://discuss.elastic.co/t/how-do-i-delete-a-single-types-from-indices/102329 "2017-09-30T09:55:13Z")

</div>

Hello there. I am new in elastic search and I'm .net developer. I am using elastic search nest for my data, having One Indices name "XYZ" having multiple Types named like "AA", "BB", "CC" and "DD". My question is that …

---

## [Can elasticsearch only store results?](https://discuss.elastic.co/t/can-elasticsearch-only-store-results/26141)

<div class="topic-metadata">

**Author:** [@kinory](https://discuss.elastic.co/u/kinory)\
**Replies:** 4\
**Last updated:** [July 23, 2015, 12:31pm UTC](https://discuss.elastic.co/t/can-elasticsearch-only-store-results/26141 "2015-07-23T12:31:39Z")

</div>

HI, We use ELK for analyze Nginx log(200G/d)，now， we feed the log to elasticsearch after filter it by Logstash(so slow..)，then construct visualizations of search results and create some dashbord with them. but the or…

---

## [Problem with pipeline, grok and dashboards](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818)

<div class="topic-metadata">

**Author:** [@roonick](https://discuss.elastic.co/u/roonick)\
**Replies:** 7\
**Last updated:** [December 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818 "2021-12-30T15:04:53Z")

</div>

Good day! I had following task. There was necessary to add additional field of client ip address from nginx logs. I composed next pipeline: filebeat -\> logstash (beats pipeline, frok) -\> Elasticsearch. Grok pattern wo…

---

## [Can I combine a single fields search results and get a hash?](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212)

<div class="topic-metadata">

**Author:** [@ChristoKiwi](https://discuss.elastic.co/u/ChristoKiwi)\
**Replies:** 1\
**Last updated:** [December 10, 2020, 5:06am UTC](https://discuss.elastic.co/t/can-i-combine-a-single-fields-search-results-and-get-a-hash/258212 "2020-12-10T05:06:59Z")

</div>

I have a large ES index (7.7) that has a couple of million rows. I want to be able to pull a days worth of data and using their UUID id values generate a hash (MD5 or SHA1 ideally). I can do this easily using SQL: SEL…

---

## [Scripted fields to calculate %](https://discuss.elastic.co/t/scripted-fields-to-calculate/235114)

<div class="topic-metadata">

**Author:** [@katara](https://discuss.elastic.co/u/katara)\
**Replies:** 1\
**Last updated:** [June 10, 2020, 4:10pm UTC](https://discuss.elastic.co/t/scripted-fields-to-calculate/235114 "2020-06-10T16:10:15Z")

</div>

Hi, I have a field in Kibana which would say if my ticket is passed or failed. has\_passed is the field. I wanna write a scripted\_field based on this value. \> target % = (count(has\_passed='passed')/count(total)) \*100 …

---

## [Elasticsearch update by query problem](https://discuss.elastic.co/t/elasticsearch-update-by-query-problem/226611)

<div class="topic-metadata">

**Author:** [@111306](https://discuss.elastic.co/u/111306)\
**Replies:** 1\
**Last updated:** [April 6, 2020, 9:42am UTC](https://discuss.elastic.co/t/elasticsearch-update-by-query-problem/226611 "2020-04-06T09:42:45Z")

</div>

遇到一个问题，我的 elasticsearch 版本是 7.6.1 ，使用的系统是 Debian 9 。我们在线上运行 elasticsearch 时，发现使用 update\_by\_query 接口发现有时并没有更新，但单个请求又是成功的。什么情况下会显示更新成功，但并没有发生更新呢？请问这个是什么问题，困扰很久了。

---

## [Filtering by nonexistent value returns all results](https://discuss.elastic.co/t/filtering-by-nonexistent-value-returns-all-results/207752)

<div class="topic-metadata">

**Author:** [@Ryan\_Peters](https://discuss.elastic.co/u/Ryan_Peters)\
**Replies:** 1\
**Last updated:** [November 15, 2019, 12:02pm UTC](https://discuss.elastic.co/t/filtering-by-nonexistent-value-returns-all-results/207752 "2019-11-15T12:02:24Z")

</div>

My query: { engine\_key: 'ENGINE\_KEY', q: '', page: 1, per\_page: 12, sort\_field: { page: 'published\_date' }, filters: { page: { search\_category: 'How-To Tips & Tricks' } } } If there are no pages with this se…

---

## [Creating a new field through painless scripts](https://discuss.elastic.co/t/creating-a-new-field-through-painless-scripts/202251)

<div class="topic-metadata">

**Author:** [@maheshamruthaluri](https://discuss.elastic.co/u/maheshamruthaluri)\
**Replies:** 1\
**Last updated:** [October 7, 2019, 7:10am UTC](https://discuss.elastic.co/t/creating-a-new-field-through-painless-scripts/202251 "2019-10-07T07:10:17Z")

</div>

Hello, I am trying to create a new field based on a particular condition. if (doc\['foo.keyword'\].value == 'bar'){ doc\['foo2.keyword'\].value = 'bar2' } But it gives my an error saying Script is invalid. View script pre…

---

## [How to eliminate swapping of logstash container](https://discuss.elastic.co/t/how-to-eliminate-swapping-of-logstash-container/151873)

<div class="topic-metadata">

**Author:** [@netvmdb](https://discuss.elastic.co/u/netvmdb)\
**Replies:** 1\
**Last updated:** [October 12, 2018, 6:22pm UTC](https://discuss.elastic.co/t/how-to-eliminate-swapping-of-logstash-container/151873 "2018-10-12T18:22:36Z")

</div>

elasticsearch / logstash / kibana oss 6.2.4 running as docker containers in one physical host. Already set vm.swappiness=1 on the host. But swappiness still happening. I tried following setting for elasticsearch nodes,…

---

## [Machine Learning Multiple Split Data Fields](https://discuss.elastic.co/t/machine-learning-multiple-split-data-fields/144344)

<div class="topic-metadata">

**Author:** [@ryanrossiter](https://discuss.elastic.co/u/ryanrossiter)\
**Replies:** 1\
**Last updated:** [August 14, 2018, 1:45pm UTC](https://discuss.elastic.co/t/machine-learning-multiple-split-data-fields/144344 "2018-08-14T13:45:00Z")

</div>

Hi I'm working on creating Machine Learning jobs and was wondering if there is any way to use multiple fields in the "Split Data" field? I ask this because I would like one series to represent an individual node, but mul…

---

## [Repetitive JDBC input runs](https://discuss.elastic.co/t/repetitive-jdbc-input-runs/142257)

<div class="topic-metadata">

**Author:** [@daq](https://discuss.elastic.co/u/daq)\
**Replies:** 7\
**Last updated:** [August 2, 2018, 3:01pm UTC](https://discuss.elastic.co/t/repetitive-jdbc-input-runs/142257 "2018-08-02T15:01:23Z")

</div>

We have a stored procedure which returns data for the last hour when called without any parameters. We scheduled the JDBC input plugin to run every hour and it works well. Questions is, if I want to ingest older data I c…

---

## [Encrypted at rest files](https://discuss.elastic.co/t/encrypted-at-rest-files/94675)

<div class="topic-metadata">

**Author:** [@Paul\_Targett](https://discuss.elastic.co/u/Paul_Targett)\
**Replies:** 1\
**Last updated:** [July 28, 2017, 6:34am UTC](https://discuss.elastic.co/t/encrypted-at-rest-files/94675 "2017-07-28T06:34:18Z")

</div>

Last year I asked a question last year about using Elastic Search to store sensitive data. We need to have Elastic Search / Lucene hold the data in AES256 or better encryption. It's understood that we can run the se…

---

## [Puppet Module for Metricbeat?](https://discuss.elastic.co/t/puppet-module-for-metricbeat/64047)

<div class="topic-metadata">

**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\
**Replies:** 1\
**Last updated:** [October 28, 2016, 1:11pm UTC](https://discuss.elastic.co/t/puppet-module-for-metricbeat/64047 "2016-10-28T13:11:22Z")

</div>

I use puppet to deploy all of my ELK stack components. Is there any plans to create a module for Metricbeat?

---

## [How to map geo\_point in indices that are created automatically by elasticsearch-kopf?](https://discuss.elastic.co/t/how-to-map-geo-point-in-indices-that-are-created-automatically-by-elasticsearch-kopf/44186)

<div class="topic-metadata">

**Author:** [@Muhammad\_Alraddadi](https://discuss.elastic.co/u/Muhammad_Alraddadi)\
**Replies:** 1\
**Last updated:** [March 12, 2016, 1:40am UTC](https://discuss.elastic.co/t/how-to-map-geo-point-in-indices-that-are-created-automatically-by-elasticsearch-kopf/44186 "2016-03-12T01:40:15Z")

</div>

Hello community, This is my first topic in this forum, so I hope I am posting this in the right place...I recently have been using AWS cloudwatch logs combined with kinesis, kibana and elasticsearch-kopf plugin (which …

---

## [How to set up mapping for common property across all types in index](https://discuss.elastic.co/t/how-to-set-up-mapping-for-common-property-across-all-types-in-index/12777)

<div class="topic-metadata">

**Author:** [@Paul\_Bellora](https://discuss.elastic.co/u/Paul_Bellora)\
**Replies:** 7\
**Last updated:** [July 18, 2013, 3:51pm UTC](https://discuss.elastic.co/t/how-to-set-up-mapping-for-common-property-across-all-types-in-index/12777 "2013-07-18T15:51:27Z")

</div>

I have a property that is common to all my document types. I would now like to apply a custom mapping to this property across an entire index. I can't use default-mapping.json because that's applied to all indexes an…

---

## [Elastic Cloud Enterprise (ECE) 3.8.3 and 4.0.3 Security Update (ESA-2025-22)](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132)

<div class="topic-metadata">

**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Replies:** 0\
**Last updated:** [October 31, 2025, 5:36pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-3-and-4-0-3-security-update-esa-2025-22/383132 "2025-10-31T17:36:53Z")

</div>

Elastic Cloud Enterprise Improper Authorization (ESA-2025-22) Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed…

---

## [Unable to generate enrollment-token for new elasticsearch node](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234)

<div class="topic-metadata">

**Author:** [@fabio.virive](https://discuss.elastic.co/u/fabio.virive)\
**Replies:** 3\
**Last updated:** [May 19, 2025, 11:35am UTC](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234 "2025-05-19T11:35:06Z")

</div>

When I use elasticsearch-create-enrollment-token -s node, to generate the token for enrol a new elastic node, I have the following error message: Unable to create enrollment token for scope \[node\] ERROR: Unable to crea…

---

## [ILM policy don't delete the index even though delete phase is applied](https://discuss.elastic.co/t/ilm-policy-dont-delete-the-index-even-though-delete-phase-is-applied/303022)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 3\
**Last updated:** [April 22, 2022, 2:24pm UTC](https://discuss.elastic.co/t/ilm-policy-dont-delete-the-index-even-though-delete-phase-is-applied/303022 "2022-04-22T14:24:27Z")

</div>

Hello All, I have appled ILM policy to the Index and policy is defined to go from hot phase: 1day,1gb max (rollover) to delete phase after 1day from rollover,The issue I am facing is that the Index dont get deleted and …

---

## [Logstash seems to copy the index indefinitely](https://discuss.elastic.co/t/logstash-seems-to-copy-the-index-indefinitely/297698)

<div class="topic-metadata">

**Author:** [@pain368](https://discuss.elastic.co/u/pain368)\
**Replies:** 3\
**Last updated:** [February 22, 2022, 2:23pm UTC](https://discuss.elastic.co/t/logstash-seems-to-copy-the-index-indefinitely/297698 "2022-02-22T14:23:00Z")

</div>

Hello ELK team, This is my first thread so i hope will be good enough to solve my problem. I have One primary cluster(A), and today i created second cluster(B) only for Machine Learning purpose ( i don;t want to connec…

---

## [Kibana issue with relative and absolute range combination](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972)

<div class="topic-metadata">

**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\
**Replies:** 3\
**Last updated:** [December 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/kibana-issue-with-relative-and-absolute-range-combination/291972 "2021-12-15T15:14:12Z")

</div>

Elasticsearch Platinum: 7.16.1 Hi! We recently found out that when we use relative as start date and absolute as end date it doesn't work as intended. For example when I select relative start date "14 days ago" and ab…

---

## [Restore from a 3-Node cluster to a stand alone cluster](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670)

<div class="topic-metadata">

**Author:** [@alpot](https://discuss.elastic.co/u/alpot)\
**Replies:** 3\
**Last updated:** [September 21, 2021, 7:56am UTC](https://discuss.elastic.co/t/restore-from-a-3-node-cluster-to-a-stand-alone-cluster/284670 "2021-09-21T07:56:01Z")

</div>

I have a test environment with a 3-node cluster and a stand alone cluster. I created an index ('products') in the 3-node cluster and then performed a snapshot. I deleted the index and then use restore API to restore it…

---

## [Double closing a Transaction in a try-with-resource?](https://discuss.elastic.co/t/double-closing-a-transaction-in-a-try-with-resource/264920)

<div class="topic-metadata">

**Author:** [@b333to](https://discuss.elastic.co/u/b333to)\
**Replies:** 3\
**Last updated:** [February 22, 2021, 5:13pm UTC](https://discuss.elastic.co/t/double-closing-a-transaction-in-a-try-with-resource/264920 "2021-02-22T17:13:53Z")

</div>

Hello I have the following WARN log: WARN co.elastic.apm.agent.impl.transaction.AbstractSpan - End has already been called:... And it's coming from this block of code: final Transaction transaction = ElasticApm.start…

---

## [Dynamic Title for Kibana visualization](https://discuss.elastic.co/t/dynamic-title-for-kibana-visualization/246241)

<div class="topic-metadata">

**Author:** [@subash](https://discuss.elastic.co/u/subash)\
**Replies:** 3\
**Last updated:** [August 26, 2020, 2:42pm UTC](https://discuss.elastic.co/t/dynamic-title-for-kibana-visualization/246241 "2020-08-26T14:42:40Z")

</div>

Hi, I have created a visualization for CPU load, Disk load, memory load for the devices in our network. User can filter any particular device and check its load. The requirement is to add the Device name as the title …

---

## [Возвращение ноды в кластер после аварии и таймауты "all shards failed"](https://discuss.elastic.co/t/all-shards-failed/243326)

<div class="topic-metadata">

**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\
**Replies:** 3\
**Last updated:** [July 31, 2020, 2:21pm UTC](https://discuss.elastic.co/t/all-shards-failed/243326 "2020-07-31T14:21:16Z")

</div>

Добрый день! Произошла неприятная ситуация - из-за перегрева процессора (криво собранный сервер) вышла нода из строя (всего нод 5, в строю осталось 4 соответственно). Примерно через час была возвращена - но сервис посто…

---

## [Filebeat service terminated unexpectedly - Windows server 2016](https://discuss.elastic.co/t/filebeat-service-terminated-unexpectedly-windows-server-2016/198797)

<div class="topic-metadata">

**Author:** [@scottk](https://discuss.elastic.co/u/scottk)\
**Replies:** 0\
**Last updated:** [September 9, 2019, 10:03pm UTC](https://discuss.elastic.co/t/filebeat-service-terminated-unexpectedly-windows-server-2016/198797 "2019-09-09T22:03:38Z")

</div>

Hi, my filebeat service will not run all of a sudden. Whenever I try to start the service, I get an error that "Error 1067: The process terminated unexpectedly". The event log provides no more details than that, besides …

---

## [How to feed Logs from 11 different instances to Elasticsearch?](https://discuss.elastic.co/t/how-to-feed-logs-from-11-different-instances-to-elasticsearch/171680)

<div class="topic-metadata">

**Author:** [@groverjatin17](https://discuss.elastic.co/u/groverjatin17)\
**Replies:** 3\
**Last updated:** [March 12, 2019, 2:54pm UTC](https://discuss.elastic.co/t/how-to-feed-logs-from-11-different-instances-to-elasticsearch/171680 "2019-03-12T14:54:47Z")

</div>

Hi All, We have 11 instances running for an inhouse app. All of those produce logs in XML format. We want to collect data from all 11 instances and feed to in Elasticsearch and Create Kibana Dashboard for the same. I …

---

## [How to migrate data from Elasticsearch on AWS EC2 to AWS ElasticSearch Service?](https://discuss.elastic.co/t/how-to-migrate-data-from-elasticsearch-on-aws-ec2-to-aws-elasticsearch-service/150960)

<div class="topic-metadata">

**Author:** [@thachnv92](https://discuss.elastic.co/u/thachnv92)\
**Replies:** 3\
**Last updated:** [October 4, 2018, 11:04am UTC](https://discuss.elastic.co/t/how-to-migrate-data-from-elasticsearch-on-aws-ec2-to-aws-elasticsearch-service/150960 "2018-10-04T11:04:03Z")

</div>

Hello, I have 2 EC2 instance which i setup Elasticsearch. Now, I want to migrate to AWS Elasticsearch Service of AWS. Please help me to migrate... I read many articles, they suggest: Backup snapshot from Elasticsea…

---

## [Additional impacts of storing \_source?](https://discuss.elastic.co/t/additional-impacts-of-storing--source/85998)

<div class="topic-metadata">

**Author:** [@khyron4eva](https://discuss.elastic.co/u/khyron4eva)\
**Replies:** 3\
**Last updated:** [May 23, 2017, 1:56am UTC](https://discuss.elastic.co/t/additional-impacts-of-storing--source/85998 "2017-05-23T01:56:30Z")

</div>

Having read through https://www.elastic.co/guide/en/elasticsearch/reference/5.x/mapping-source-field.html a few times for different versions, I have to wonder what are the less obvious impacts of storing \_source besides …

---

## [Migration de Elastic Stack 5.2.2 vers 5.3](https://discuss.elastic.co/t/migration-de-elastic-stack-5-2-2-vers-5-3/82299)

<div class="topic-metadata">

**Author:** [@Maxou](https://discuss.elastic.co/u/Maxou)\
**Replies:** 3\
**Last updated:** [April 14, 2017, 7:04am UTC](https://discuss.elastic.co/t/migration-de-elastic-stack-5-2-2-vers-5-3/82299 "2017-04-14T07:04:41Z")

</div>

Bonjour à tous, juste une petite question sur la migration des versions de Elastic Stack, je souhaiterai migrer d'une version 5.2.2 en 5.3 pouvez-vous me dire s'il y a une méthode automatique ou une méthode manuelle pour…

---

## [Compare Kibana data with a static list?](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191)

<div class="topic-metadata">

**Author:** [@gildor7](https://discuss.elastic.co/u/gildor7)\
**Replies:** 3\
**Last updated:** [February 9, 2016, 9:08am UTC](https://discuss.elastic.co/t/compare-kibana-data-with-a-static-list/41191 "2016-02-09T09:08:21Z")

</div>

Hello, is it possible to compare data displayed in Kibana with a static list? Let me explain what I need: I'm reading the data of login to the servers via syslog, and I want to create a dashboard that shows me the logins…

---

## [Elasticsearch is logging sensitive infrastructure information](https://discuss.elastic.co/t/elasticsearch-is-logging-sensitive-infrastructure-information/376761)

<div class="topic-metadata">

**Author:** [@Daniel\_Abadi](https://discuss.elastic.co/u/Daniel_Abadi)\
**Replies:** 8\
**Last updated:** [April 4, 2025, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-is-logging-sensitive-infrastructure-information/376761 "2025-04-04T17:55:15Z")

</div>

Hello, I’m using Java Elastic 8 and would like to know if there is a way to prevent its logs from displaying sensitive data, such as its address. Example: request \[POST http://address:9200/5ddebbc7ec887eb5567af63c.5d65…

---

## [Funcionamiento pipelines](https://discuss.elastic.co/t/funcionamiento-pipelines/351553)

<div class="topic-metadata">

**Author:** [@marotaal](https://discuss.elastic.co/u/marotaal)\
**Replies:** 4\
**Last updated:** [January 23, 2024, 9:24pm UTC](https://discuss.elastic.co/t/funcionamiento-pipelines/351553 "2024-01-23T21:24:27Z")

</div>

Hola Estoy generando un laboratorio para la recogida de logs (Apache, Sophos,.....) Si tengo dos ficheros de apache (access y error) como especifico que cada fichero utilice su pipeline. filebeat-7.17.15-apache-access…

---

## [Index out of bound exception on aggregation](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763)

<div class="topic-metadata">

**Author:** [@Bob\_Strickland](https://discuss.elastic.co/u/Bob_Strickland)\
**Replies:** 1\
**Last updated:** [June 1, 2022, 9:23pm UTC](https://discuss.elastic.co/t/index-out-of-bound-exception-on-aggregation/303763 "2022-06-01T21:23:32Z")

</div>

Working on a small index that has 1556 documents. We are getting an exception when running the following: GET search\_stage\_jacked\_backup\_3/\_search?&error\_trace=true { "aggs": { "parentDealerName": { "terms"…

---

## [Adding a new node to a cluster with passwords already set](https://discuss.elastic.co/t/adding-a-new-node-to-a-cluster-with-passwords-already-set/276237)

<div class="topic-metadata">

**Author:** [@Timm\_Lehmberg](https://discuss.elastic.co/u/Timm_Lehmberg)\
**Replies:** 1\
**Last updated:** [June 17, 2021, 10:55am UTC](https://discuss.elastic.co/t/adding-a-new-node-to-a-cluster-with-passwords-already-set/276237 "2021-06-17T10:55:56Z")

</div>

Apologies if my approach in the described in the following is stupid. set up elasticsearch 7.13 on node-1 as a single node cluster, enabled TLS and ran bin/elasticsearch-setup-passwords interactive set up elasticsear…

---

## [Nodes crashing with unable to create native thread error](https://discuss.elastic.co/t/nodes-crashing-with-unable-to-create-native-thread-error/216701)

<div class="topic-metadata">

**Author:** [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)\
**Replies:** 1\
**Last updated:** [February 10, 2020, 4:19pm UTC](https://discuss.elastic.co/t/nodes-crashing-with-unable-to-create-native-thread-error/216701 "2020-02-10T16:19:45Z")

</div>

I have an elastic cluster that had some nodes crash due to the "java.lang.OutOfMemoryError: unable to create native thread" error. Found some other posts here with the same error, but no useful information yet. The clus…

[Previous page](https://discuss.elastic.co/top.md?page=1562&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1564&per_page=50&period=all)
