# Top **URL:** https://discuss.elastic.co/top.md?page=1606&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1607 --- ## [Aggregations for dynamic key value pairs](https://discuss.elastic.co/t/aggregations-for-dynamic-key-value-pairs/200083)
**Author:** [@bkdavis](https://discuss.elastic.co/u/bkdavis)\ **Replies:** 1\ **Last updated:** [September 20, 2019, 6:47pm UTC](https://discuss.elastic.co/t/aggregations-for-dynamic-key-value-pairs/200083 "2019-09-20T18:47:20Z")
Trying to figure out the best way to 'count' values for aggregating dynamic data. For instance the 2 records below is a sampling of data where 'key' data is not static. Some records may have height:21 and width:28 whil… --- ## [CPU 100 without activity](https://discuss.elastic.co/t/cpu-100-without-activity/189478)
**Author:** [@NakMuay](https://discuss.elastic.co/u/NakMuay)\ **Replies:** 7\ **Last updated:** [July 9, 2019, 11:19am UTC](https://discuss.elastic.co/t/cpu-100-without-activity/189478 "2019-07-09T11:19:27Z")
Hi, (Sorry for my english ;)) My CPU is always 100% without any activity... what's wrong please ?... What kind of informations can I give you to help me ? Thanks, --- ## [Having trouble with synonyms and match query](https://discuss.elastic.co/t/having-trouble-with-synonyms-and-match-query/179407)
**Author:** [@EFJunior](https://discuss.elastic.co/u/EFJunior)\ **Replies:** 1\ **Last updated:** [May 3, 2019, 8:45am UTC](https://discuss.elastic.co/t/having-trouble-with-synonyms-and-match-query/179407 "2019-05-03T08:45:51Z")
I'm trying to search using match query the following products : 1 - Suco SUCO E SÓ Tangerina Integral; 2 - Suco SUCO E SÓ Laranja Integral; 3 - Suco SUCO E SÓ Uva Integral 300ml The query : "query": { "bool": {… --- ## [Can we add fields value based on regex patterns in include\_lines for the same log](https://discuss.elastic.co/t/can-we-add-fields-value-based-on-regex-patterns-in-include-lines-for-the-same-log/156604)
**Author:** [@krishanagrawal](https://discuss.elastic.co/u/krishanagrawal)\ **Replies:** 1\ **Last updated:** [November 14, 2018, 3:41pm UTC](https://discuss.elastic.co/t/can-we-add-fields-value-based-on-regex-patterns-in-include-lines-for-the-same-log/156604 "2018-11-14T15:41:06Z")
I am parsing a log file which has error from 3 different process. I have added the input file in path and have added the 3 regex pattern in include line unique to 3 processes. Can I add field column which will be popul… --- ## [Group by timestamp proximity](https://discuss.elastic.co/t/group-by-timestamp-proximity/115339)
**Author:** [@Tomas\_Law](https://discuss.elastic.co/u/Tomas_Law)\ **Replies:** 1\ **Last updated:** [January 12, 2018, 5:55pm UTC](https://discuss.elastic.co/t/group-by-timestamp-proximity/115339 "2018-01-12T17:55:51Z")
Hello, I have several logs with a timestamp field and I want them to group by similar timestamps. For example, group all the logs with timestamps that are spaced less than 30min between each log. What I want is simila… --- ## [Logstash 5.2.2 logstash-output-elastic plugin exception](https://discuss.elastic.co/t/logstash-5-2-2-logstash-output-elastic-plugin-exception/78002)
**Author:** [@Yahya\_Can](https://discuss.elastic.co/u/Yahya_Can)\ **Replies:** 1\ **Last updated:** [March 10, 2017, 2:43pm UTC](https://discuss.elastic.co/t/logstash-5-2-2-logstash-output-elastic-plugin-exception/78002 "2017-03-10T14:43:59Z")
Hi, I wanna move the data between csv to elastic in windows machine. When i run my config file with logstash.bat, i am getting following result. I checked plugin list. "logstash-output-elastic" is there. I updated plug… --- ## [How to Fix unassigned shards STATUS: RED](https://discuss.elastic.co/t/how-to-fix-unassigned-shards-status-red/72440)
**Author:** [@Siva\_Sai](https://discuss.elastic.co/u/Siva_Sai)\ **Replies:** 1\ **Last updated:** [January 23, 2017, 7:55am UTC](https://discuss.elastic.co/t/how-to-fix-unassigned-shards-status-red/72440 "2017-01-23T07:55:15Z")
I got 20-30% of unassigned shards in a cluster and showing status red. How to Fix that issue. Some nodes are down at certain point of time and they are OFF now for around 2 hrs. and now they are Up and showing status r… --- ## [How much time takes for shards rebalancing for adding a new node?](https://discuss.elastic.co/t/how-much-time-takes-for-shards-rebalancing-for-adding-a-new-node/70710)
**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\ **Replies:** 1\ **Last updated:** [January 5, 2017, 6:28pm UTC](https://discuss.elastic.co/t/how-much-time-takes-for-shards-rebalancing-for-adding-a-new-node/70710 "2017-01-05T18:28:13Z")
how much time takes for shards rebalancing for adding a new node? Is the cluster ready for use immediately when adding a new node? Anyone did this test before? --- ## [Logstash package install -e not working](https://discuss.elastic.co/t/logstash-package-install-e-not-working/65704)
**Author:** [@jobou](https://discuss.elastic.co/u/jobou)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 6:48pm UTC](https://discuss.elastic.co/t/logstash-package-install-e-not-working/65704 "2016-11-10T18:48:59Z")
Hi, I have just installed logstash on an Ubuntu 16.10 using the APT repository. I wanted to do the "Stashing your first event" tutorial. So I ran : /usr/share/logstash/bin/logstash --path.settings /etc/logstash -e … --- ## [Cannot determine license type. Please check that you have the license plugin installed and configured in Elasticsearch with a valid license](https://discuss.elastic.co/t/cannot-determine-license-type-please-check-that-you-have-the-license-plugin-installed-and-configured-in-elasticsearch-with-a-valid-license/60307)
**Author:** [@vmcleitao](https://discuss.elastic.co/u/vmcleitao)\ **Replies:** 1\ **Last updated:** [September 12, 2016, 7:03pm UTC](https://discuss.elastic.co/t/cannot-determine-license-type-please-check-that-you-have-the-license-plugin-installed-and-configured-in-elasticsearch-with-a-valid-license/60307 "2016-09-12T19:03:38Z")
Hi Everyone, I would like to know if anyone gets the same error when tried to generate a report. Comparing with what it is explained in the online manual on https://www.elastic.co/downloads/reporting I have some difere… --- ## [Need a custom action for Watcher](https://discuss.elastic.co/t/need-a-custom-action-for-watcher/44459)
**Author:** [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Replies:** 1\ **Last updated:** [March 17, 2016, 12:23pm UTC](https://discuss.elastic.co/t/need-a-custom-action-for-watcher/44459 "2016-03-17T12:23:16Z")
I have an Elasticsearch 2.1.x cluster + Shield + Watcher installed on AWS EC2 instances. Would like to be able to send email using AWS Simple Email Service (SES), but security team insists that IAM roles be used instead… --- ## [Elasticsearch logstach](https://discuss.elastic.co/t/elasticsearch-logstach/33715)
**Author:** [@sylv](https://discuss.elastic.co/u/sylv)\ **Replies:** 1\ **Last updated:** [November 4, 2015, 9:13am UTC](https://discuss.elastic.co/t/elasticsearch-logstach/33715 "2015-11-04T09:13:02Z")
is there someone with these errors messages? l\\logstash\_titulaires\_config\_file.txt io/console not supported; tty will not be manipulated ←\[31mUnknown setting 'protocol' for elasticsearch {:level=\>:error}←\[0m ←\[31mUnkno… --- ## [Top Hits aggregator from example not working for me](https://discuss.elastic.co/t/top-hits-aggregator-from-example-not-working-for-me/18869)
**Author:** [@Daniel\_Yim](https://discuss.elastic.co/u/Daniel_Yim)\ **Replies:** 7\ **Last updated:** [July 24, 2014, 8:45pm UTC](https://discuss.elastic.co/t/top-hits-aggregator-from-example-not-working-for-me/18869 "2014-07-24T20:45:48Z")
Hello, I am trying to follow the \*field collapse example\* on this page , which uses the new 1.3.0 \*top\_hits\* aggregator to return the top scoring document for a given criteria. To my knowledge, I set up the setting… --- ## [ParNew and ConcurrentMarkSweep seen in logs](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 4\ **Last updated:** [November 9, 2021, 7:37pm UTC](https://discuss.elastic.co/t/parnew-and-concurrentmarksweep-seen-in-logs/288806 "2021-11-09T19:37:22Z")
Good Afternoon everyone; I am seeing the following lines when I place my Logstash in Debug mode to collect logs. I have a feeling that it is what is stopping me from seeing any syslog that has been forwarded to the logs… --- ## [Esrally when gave "index": "\_all", it executes search queries on all the indices instead of search only the defined indices](https://discuss.elastic.co/t/esrally-when-gave-index-all-it-executes-search-queries-on-all-the-indices-instead-of-search-only-the-defined-indices/280207)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 4\ **Last updated:** [August 4, 2021, 5:04am UTC](https://discuss.elastic.co/t/esrally-when-gave-index-all-it-executes-search-queries-on-all-the-indices-instead-of-search-only-the-defined-indices/280207 "2021-08-04T05:04:58Z")
I have a requirement to do a simultaneous multiple search query execution in 3 indices . So I defiend them in below track.json and added "index": "\_all", as per the answer of Can't configure multiple indices on which … --- ## [Difference betwwen logs and apm](https://discuss.elastic.co/t/difference-betwwen-logs-and-apm/277008)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 4\ **Last updated:** [June 25, 2021, 6:28pm UTC](https://discuss.elastic.co/t/difference-betwwen-logs-and-apm/277008 "2021-06-25T18:28:33Z")
hi guys, i've been adding apm into my applications, then I noticed that apm elk adds some indices into my elasticsearch, such as transactions, errors and etc my questions is, if I have all this data in these indices, w… --- ## [Kibana 7.7.0 docker keeps crashing](https://discuss.elastic.co/t/kibana-7-7-0-docker-keeps-crashing/233973)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 4\ **Last updated:** [May 25, 2020, 1:21pm UTC](https://discuss.elastic.co/t/kibana-7-7-0-docker-keeps-crashing/233973 "2020-05-25T13:21:32Z")
Can someone please provide insights as to how to get it running? Elastic search docker is stable however. This is the 7.7.0 release which is constantly updated. I tried downloading a few times past 3 days. No success. … --- ## [\[7.2-7.3\] Plugin development routes best practices](https://discuss.elastic.co/t/7-2-7-3-plugin-development-routes-best-practices/204967)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 4\ **Last updated:** [October 30, 2019, 2:14pm UTC](https://discuss.elastic.co/t/7-2-7-3-plugin-development-routes-best-practices/204967 "2019-10-30T14:14:18Z")
Hi there! I'm developing (trying to, actually) a Kibana plugin (already opened couple of threads about it). Here I wanted to ask you which was the best way to implement routing across the plugin pages. Let's say in th… --- ## [About indices stored size](https://discuss.elastic.co/t/about-indices-stored-size/150290)
**Author:** [@af615dbd55cac2cacf32](https://discuss.elastic.co/u/af615dbd55cac2cacf32)\ **Replies:** 4\ **Last updated:** [September 29, 2018, 12:23am UTC](https://discuss.elastic.co/t/about-indices-stored-size/150290 "2018-09-29T00:23:35Z")
Hello, My Logstash creates 17 indices daily basis, and stored size is as below. Should I reduce Shard number for small sized indices? OR merge some of indices? e.g. combine "access\_xpg\_prd\_20180928", "access\_ui50\_prd… --- ## [RabbitMQ cluster - node metrics reported multiple times](https://discuss.elastic.co/t/rabbitmq-cluster-node-metrics-reported-multiple-times/123592)
**Author:** [@Constantin07](https://discuss.elastic.co/u/Constantin07)\ **Replies:** 4\ **Last updated:** [March 15, 2018, 9:53am UTC](https://discuss.elastic.co/t/rabbitmq-cluster-node-metrics-reported-multiple-times/123592 "2018-03-15T09:53:56Z")
Hello, I've deployed metricbeat 6.2.2 on a cluster of 3 RabbitMQ nodes. It works fine and I see node & queue metrics in Elasticsearch/Kibana coming through. But for some reason for the node metrics every 10 seconds I ge… --- ## [Adjacent entries of a specific entry](https://discuss.elastic.co/t/adjacent-entries-of-a-specific-entry/80112)
**Author:** [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)\ **Replies:** 4\ **Last updated:** [March 27, 2017, 10:35am UTC](https://discuss.elastic.co/t/adjacent-entries-of-a-specific-entry/80112 "2017-03-27T10:35:47Z")
Hi All, We are using Kibana-4.2.1. Can anyone tell me is the feature of viewing adjacent log entries of a particular event is available in kibana? --- ## [Kibana doesn't visualize logdate's field](https://discuss.elastic.co/t/kibana-doesnt-visualize-logdates-field/60536)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 4\ **Last updated:** [September 17, 2016, 9:04am UTC](https://discuss.elastic.co/t/kibana-doesnt-visualize-logdates-field/60536 "2016-09-17T09:04:37Z")
Hi everyone, I have a problem with Logstash. In this case is about date's creation. I create a new field (logdate) based on severals fields which I have created with Grok. I don't receive any "error parsing", however, w… --- ## [Issue with master nodes being deleted and no new master being selected](https://discuss.elastic.co/t/issue-with-master-nodes-being-deleted-and-no-new-master-being-selected/300062)
**Author:** [@arvinds](https://discuss.elastic.co/u/arvinds)\ **Replies:** 3\ **Last updated:** [March 18, 2022, 3:51pm UTC](https://discuss.elastic.co/t/issue-with-master-nodes-being-deleted-and-no-new-master-being-selected/300062 "2022-03-18T15:51:24Z")
Hi, all, thanks in advance for taking the time to read through this: I am running a cluster on a docker swarm on a bare metal server and I have gotten into a state where the master node is never selected: { "type":… --- ## [Keep differences from going negative](https://discuss.elastic.co/t/keep-differences-from-going-negative/297300)
**Author:** [@agiddens](https://discuss.elastic.co/u/agiddens)\ **Replies:** 3\ **Last updated:** [February 17, 2022, 3:14pm UTC](https://discuss.elastic.co/t/keep-differences-from-going-negative/297300 "2022-02-17T15:14:05Z")
I have a couple of questions and I think they are related but I could be wrong. Currently using Kibana 7.15.0 My data comes in every 5 minutes and looks like this. \[{Server:"id", requests\_since\_server\_started: , times… --- ## [Unable to find elasticsearch, logstash, kibana metrics on stackmonitoring even after having all the .monitoring-\* indices created and the Cluster\_uuid is right](https://discuss.elastic.co/t/unable-to-find-elasticsearch-logstash-kibana-metrics-on-stackmonitoring-even-after-having-all-the-monitoring-indices-created-and-the-cluster-uuid-is-right/269513)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 2:19pm UTC](https://discuss.elastic.co/t/unable-to-find-elasticsearch-logstash-kibana-metrics-on-stackmonitoring-even-after-having-all-the-monitoring-indices-created-and-the-cluster-uuid-is-right/269513 "2021-04-08T14:19:09Z")
Unable to find elasticsearch, logstash, kibana metrics on stackmonitoring even after having all the .monitoring-\* indices created and the Cluster\_uuid is right. --- ## [Is it possible to count tokens which matched documents?](https://discuss.elastic.co/t/is-it-possible-to-count-tokens-which-matched-documents/267338)
**Author:** [@kwang\_hee\_Han](https://discuss.elastic.co/u/kwang_hee_Han)\ **Replies:** 3\ **Last updated:** [March 17, 2021, 8:18am UTC](https://discuss.elastic.co/t/is-it-possible-to-count-tokens-which-matched-documents/267338 "2021-03-17T08:18:34Z")
Hello, I want to find which term matched on documents that results of query. I tried to using "highlight" but it does responsed with poor results.(I need more digging time to with them) I want to know alternative way t… --- ## [Max\_num\_segments is not working for forcemerge](https://discuss.elastic.co/t/max-num-segments-is-not-working-for-forcemerge/226855)
**Author:** [@quweiyu](https://discuss.elastic.co/u/quweiyu)\ **Replies:** 3\ **Last updated:** [April 8, 2020, 1:11am UTC](https://discuss.elastic.co/t/max-num-segments-is-not-working-for-forcemerge/226855 "2020-04-08T01:11:57Z")
All, I am going to do force merge for one of index (4 primary shard and 0 replica). To reduce the IO impact, I'd like to merge into 4 segments for each shard. So I use following command, POST /rms\_pl\_03-viewer-cdr-invi… --- ## [System module: error when defining syslog.input.processors](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865)
**Author:** [@TatsuKishi](https://discuss.elastic.co/u/TatsuKishi)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 11:28am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865 "2020-03-04T11:28:37Z")
Hey, I'm trying to define a processor in the system module just for syslog to drop certain spammy, non-relevant events. But when I define a drop\_event I get an error about a processor having multiple actions: #011ERROR#… --- ## [Removing items from an ArrayList with script](https://discuss.elastic.co/t/removing-items-from-an-arraylist-with-script/203729)
**Author:** [@Dennis\_Monsewicz](https://discuss.elastic.co/u/Dennis_Monsewicz)\ **Replies:** 3\ **Last updated:** [October 16, 2019, 1:48pm UTC](https://discuss.elastic.co/t/removing-items-from-an-arraylist-with-script/203729 "2019-10-16T13:48:44Z")
I'm attempting to try to remove items from an ArrayList on a doc, but not having any luck. source: "for(item in params.tags) { if(ctx.\_source.tag\_list.indexOf(item) !== -1) { ctx.\_source.tag\_list.remove(item) } … --- ## [Features of a cold node/warm node](https://discuss.elastic.co/t/features-of-a-cold-node-warm-node/203355)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 3\ **Last updated:** [October 14, 2019, 9:59am UTC](https://discuss.elastic.co/t/features-of-a-cold-node-warm-node/203355 "2019-10-14T09:59:24Z")
Hi, I'm looking for some confirmation regarding warm nodes and cold nodes. I can't find any pointers on if nodes I've defined as cold nodes and warm nodes should also be ingest nodes. I'm guessing they shouldn't to prev… --- ## [Fork/exec /var/task/functionbeat: exec format error: PathError null](https://discuss.elastic.co/t/fork-exec-var-task-functionbeat-exec-format-error-patherror-null/198630)
**Author:** [@Gavin\_Hardy](https://discuss.elastic.co/u/Gavin_Hardy)\ **Replies:** 0\ **Last updated:** [September 9, 2019, 8:19am UTC](https://discuss.elastic.co/t/fork-exec-var-task-functionbeat-exec-format-error-patherror-null/198630 "2019-09-09T08:19:59Z")
Hi, When deploying functionbeat, I can get it to successfully deploy to Lambda. However, when looking at logs I get the following error- fork/exec /var/task/functionbeat: exec format error: PathError null functionbeat.… --- ## [Premade dashboard/viz](https://discuss.elastic.co/t/premade-dashboard-viz/184056)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [June 5, 2019, 8:15pm UTC](https://discuss.elastic.co/t/premade-dashboard-viz/184056 "2019-06-05T20:15:49Z")
Is there pre-made dashboard/viz like metricbeats for Rally? Once I run a test I have index created in Elasticsearch it would be good if there is something premade for it. --- ## [Elasticsearch connect to Cosmos DB](https://discuss.elastic.co/t/elasticsearch-connect-to-cosmos-db/140144)
**Author:** [@Saeb](https://discuss.elastic.co/u/Saeb)\ **Replies:** 0\ **Last updated:** [July 16, 2018, 11:59am UTC](https://discuss.elastic.co/t/elasticsearch-connect-to-cosmos-db/140144 "2018-07-16T11:59:38Z")
Hello everybody, I have a small question. Is it possible or better has someone any experience to use an azure cosmos DB with elasticsearch. Thanks in advance. --- ## [Cutom Realm build JarHell with Guava](https://discuss.elastic.co/t/cutom-realm-build-jarhell-with-guava/127338)
**Author:** [@jhn134910](https://discuss.elastic.co/u/jhn134910)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 12:12pm UTC](https://discuss.elastic.co/t/cutom-realm-build-jarhell-with-guava/127338 "2018-04-10T12:12:51Z")
Hello there, I'm using elastic-search v6.2.3, with x-pack plugin-in v6.2.3 installed. The deployment used RPMs and my OS is centos 7. I've conducted a recent upgrade from 5.4.0 to 5.6.8 to 6.2.3. As part of the upgrad… --- ## [Logstash codecs (multiline,json) uncomplete messages from file lines](https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286)
**Author:** [@Ged](https://discuss.elastic.co/u/Ged)\ **Replies:** 3\ **Last updated:** [January 20, 2018, 5:18pm UTC](https://discuss.elastic.co/t/logstash-codecs-multiline-json-uncomplete-messages-from-file-lines/115286 "2018-01-20T17:18:33Z")
Hi, Elasticsearch 5.5.0 Logstash 5.5.0 logstash-codec-multiline 3.0.5 logstash-codec-json 3.0.3. I'm reading file (NFS) containing JSON lines using above codecs and from time to time receiving only part of line as m… --- ## [Kibana 5.4 DOT SIZE not able to reduce the circle](https://discuss.elastic.co/t/kibana-5-4-dot-size-not-able-to-reduce-the-circle/88964)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 3\ **Last updated:** [June 12, 2017, 7:46pm UTC](https://discuss.elastic.co/t/kibana-5-4-dot-size-not-able-to-reduce-the-circle/88964 "2017-06-12T19:46:14Z")
Recently upgraded to 5.4.0 and the dot size is not able to reduce. If I looking for 2days graph. It is not view able. Because it filled with dots. Is there any option to reduce the dot size. I tried the uncheck the "S… --- ## [Terms query takes lots of cpu usage](https://discuss.elastic.co/t/terms-query-takes-lots-of-cpu-usage/86765)
**Author:** [@Tamizh](https://discuss.elastic.co/u/Tamizh)\ **Replies:** 3\ **Last updated:** [May 23, 2017, 4:03pm UTC](https://discuss.elastic.co/t/terms-query-takes-lots-of-cpu-usage/86765 "2017-05-23T16:03:59Z")
I am using terms query to find the followers of a user. For that, I fetch the follower ids of that user and use terms query to get the user result from elasticsearch. But when I run the query it took lots of CPU. I gues… --- ## [Logstash 2.2.2 stops sending messages](https://discuss.elastic.co/t/logstash-2-2-2-stops-sending-messages/58998)
**Author:** [@Dennis\_Au](https://discuss.elastic.co/u/Dennis_Au)\ **Replies:** 3\ **Last updated:** [August 26, 2016, 10:14pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-stops-sending-messages/58998 "2016-08-26T22:14:25Z")
I'm having an issue with Logstash 2.2.2 with Oracle Java 1.8 just stopping and can't figure out what the issue is. There are multiple logstash processes running (one for windows, and one for syslog) listening on diff… --- ## [How to predict or estimate merge will be triggered](https://discuss.elastic.co/t/how-to-predict-or-estimate-merge-will-be-triggered/56823)
**Author:** [@itplayer](https://discuss.elastic.co/u/itplayer)\ **Replies:** 3\ **Last updated:** [August 1, 2016, 1:40am UTC](https://discuss.elastic.co/t/how-to-predict-or-estimate-merge-will-be-triggered/56823 "2016-08-01T01:40:58Z")
Is there a way to predict or estimate merge will be triggered during indexing time? I use Elasticsearch 1.7.2 and all settings about merge is by default. --- ## [Java API for inserting nested documents](https://discuss.elastic.co/t/java-api-for-inserting-nested-documents/35226)
**Author:** [@Maarten\_Roosendaal](https://discuss.elastic.co/u/Maarten_Roosendaal)\ **Replies:** 0\ **Last updated:** [November 21, 2015, 5:37pm UTC](https://discuss.elastic.co/t/java-api-for-inserting-nested-documents/35226 "2015-11-21T17:37:41Z")
Hi, I'm trying to use the Java API to do insert/updates for nested documents. I have a collection with products and the nested documents are offers. Doing this via a json request works fine: { "script" : "ctx.\_sourc… --- ## [ES|QL "Unknown column \[process.name\]" after upgrading to 8.17](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083)
**Author:** [@isugg](https://discuss.elastic.co/u/isugg)\ **Replies:** 6\ **Last updated:** [February 4, 2025, 5:02pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083 "2025-02-04T17:02:09Z")
After upgrading our Elastic stack to 8.17, we have began having issues with our ES|QL queries. When searching for process.name or process.command\_line in all logs, we receive the error "Unknown column \[process.name\]" eve… --- ## [Ingestion not consistent, data loss](https://discuss.elastic.co/t/ingestion-not-consistent-data-loss/330512)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 6\ **Last updated:** [May 4, 2023, 6:44am UTC](https://discuss.elastic.co/t/ingestion-not-consistent-data-loss/330512 "2023-05-04T06:44:06Z")
Hi, We're ingesting a big amount of data from an oracle database into elastic through logstash. We import some oracle table information into different arrays in elastic. Each table corresponding to an array, and each r… --- ## [Issue after disk problem: java.lang.IllegalArgumentException: requested snapshot generation \[10\] is not available. Min referenced generation is \[11\]](https://discuss.elastic.co/t/issue-after-disk-problem-java-lang-illegalargumentexception-requested-snapshot-generation-10-is-not-available-min-referenced-generation-is-11/264305)
**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\ **Replies:** 6\ **Last updated:** [February 17, 2021, 3:01pm UTC](https://discuss.elastic.co/t/issue-after-disk-problem-java-lang-illegalargumentexception-requested-snapshot-generation-10-is-not-available-min-referenced-generation-is-11/264305 "2021-02-17T15:01:18Z")
Hi. We've had a disk problem last night, causing a whole slew of issues in our Elasticsearch cluster. We've been able to resolve all of them but one: 1 (replica-less) shard is problematic. However, this is an issue we ha… --- ## [Need help in setting production enviorment](https://discuss.elastic.co/t/need-help-in-setting-production-enviorment/64098)
**Author:** [@banu](https://discuss.elastic.co/u/banu)\ **Replies:** 6\ **Last updated:** [October 27, 2016, 9:57am UTC](https://discuss.elastic.co/t/need-help-in-setting-production-enviorment/64098 "2016-10-27T09:57:19Z")
I am new to elastic search. I am doing POC on set-up production environment. I need help to do this. 1) What are the production parameters we need to consider when setting the environment ? 3) what are all the waterm… --- ## [Date Aggregation Help](https://discuss.elastic.co/t/date-aggregation-help/19551)
**Author:** [@Simon\_Edwards](https://discuss.elastic.co/u/Simon_Edwards)\ **Replies:** 6\ **Last updated:** [September 1, 2014, 4:10pm UTC](https://discuss.elastic.co/t/date-aggregation-help/19551 "2014-09-01T16:10:08Z")
Hi, I was wondering if somebody familiar with aggregations, particularly date histogram aggregations, can point me in the right direction. I'm currently looking to get a total count of records over a specific tim… --- ## [All shards failed across multiple indexes](https://discuss.elastic.co/t/all-shards-failed-across-multiple-indexes/301033)
**Author:** [@adowney-lm](https://discuss.elastic.co/u/adowney-lm)\ **Replies:** 5\ **Last updated:** [May 5, 2022, 1:30am UTC](https://discuss.elastic.co/t/all-shards-failed-across-multiple-indexes/301033 "2022-05-05T01:30:29Z")
We are using 7.7.1 ELK and have a simple, single node, setup with a couple of dozen indexes. I'm finding a very large number of "all shards failed" messages in the logs, and have seen a connection failure for a minute o… --- ## [Logstash - based on filed type create a new field](https://discuss.elastic.co/t/logstash-based-on-filed-type-create-a-new-field/283684)
**Author:** [@antonisnyc94](https://discuss.elastic.co/u/antonisnyc94)\ **Replies:** 5\ **Last updated:** [September 9, 2021, 10:43am UTC](https://discuss.elastic.co/t/logstash-based-on-filed-type-create-a-new-field/283684 "2021-09-09T10:43:42Z")
Hello, I've been trying for 1-2 days to figure out why to create new fields when the type of the event is object but I cant seem to make it work.. This is the error im getting: Could not index event to Elasticsearch. … --- ## [Alert When - system\_fails\_to\_provide\_data - dynamic group of sending hosts](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094)
**Author:** [@bbek](https://discuss.elastic.co/u/bbek)\ **Replies:** 5\ **Last updated:** [March 9, 2021, 9:08am UTC](https://discuss.elastic.co/t/alert-when-system-fails-to-provide-data-dynamic-group-of-sending-hosts/265094 "2021-03-09T09:08:48Z")
I have a use case to alert when a host fails to send logs. There is a watcher configured here, which is similar to what I'm trying to achieve: I like the logic, aggregate hosts on last 24 hours, then check for last 5 … --- ## [Logstash throws runtime exception while parsing huge XML](https://discuss.elastic.co/t/logstash-throws-runtime-exception-while-parsing-huge-xml/231621)
**Author:** [@Saravana\_Maadavan](https://discuss.elastic.co/u/Saravana_Maadavan)\ **Replies:** 5\ **Last updated:** [May 21, 2020, 7:04am UTC](https://discuss.elastic.co/t/logstash-throws-runtime-exception-while-parsing-huge-xml/231621 "2020-05-21T07:04:22Z")
Hello, In Logstash I am trying to replace a prefix in the XML which is not having any definition and then indexing it to elastic. Receiving error while parsing some huge XMLs. I would be requiring the full XML to be sto… --- ## [Using packetbeat with macos/ios remote virutal interface](https://discuss.elastic.co/t/using-packetbeat-with-macos-ios-remote-virutal-interface/183604)
**Author:** [@stru](https://discuss.elastic.co/u/stru)\ **Replies:** 5\ **Last updated:** [July 22, 2019, 4:37pm UTC](https://discuss.elastic.co/t/using-packetbeat-with-macos-ios-remote-virutal-interface/183604 "2019-07-22T16:37:02Z")
Does packetbeat support use of the remote virtual interface on macOS? If so, what needs to be done to get it to work correctly. I am getting this error when trying to run packetbeat with rvi0 as an interface in packetbe… [Previous page](https://discuss.elastic.co/top.md?page=1605&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1607&per_page=50&period=all)