# Top **URL:** https://discuss.elastic.co/top.md?page=161&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 162 --- ## [Install script failing with python error (new)](https://discuss.elastic.co/t/install-script-failing-with-python-error-new/221082)
**Author:** [@andrew.luke](https://discuss.elastic.co/u/andrew.luke)\ **Replies:** 11\ **Last updated:** [March 3, 2020, 5:27pm UTC](https://discuss.elastic.co/t/install-script-failing-with-python-error-new/221082 "2020-03-03T17:27:00Z")
This morning we had two different groups setting up a new ECE lab on prem and in Azure. Both are hitting the same error with the install script. We are both installing on RHEL 7.7 that has been prepared according to th… --- ## [1.4.0 data node can't join existing 1.3.4 cluster](https://discuss.elastic.co/t/1-4-0-data-node-cant-join-existing-1-3-4-cluster/20719)
**Author:** [@Eric\_Jain](https://discuss.elastic.co/u/Eric_Jain)\ **Replies:** 28\ **Last updated:** [November 24, 2014, 10:01pm UTC](https://discuss.elastic.co/t/1-4-0-data-node-cant-join-existing-1-3-4-cluster/20719 "2014-11-24T22:01:38Z")
(using elasticsearch-cloud-aws 2.4) This should work, right? Or do I need to upgrade the cluster to 1.3.5 first? The connection fails after a few errors like: 2014-11-13 07:18:22,498 \[WARN\] org.elasticsearch.dis… --- ## [Exception on ingest an attachment using client.index()](https://discuss.elastic.co/t/exception-on-ingest-an-attachment-using-client-index/193641)
**Author:** [@n2nelastic](https://discuss.elastic.co/u/n2nelastic)\ **Replies:** 10\ **Last updated:** [August 6, 2019, 11:48pm UTC](https://discuss.elastic.co/t/exception-on-ingest-an-attachment-using-client-index/193641 "2019-08-06T23:48:02Z")
I have properly set up an index and pipeline to ingest base64 encoded documents. Using the elasticsearch client, I call client.index() to process a base64 document, but I get "ResponseError: Exception" from client.index… --- ## [Auditbeat sending path through has hex](https://discuss.elastic.co/t/auditbeat-sending-path-through-has-hex/128353)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 16\ **Last updated:** [April 24, 2018, 7:43am UTC](https://discuss.elastic.co/t/auditbeat-sending-path-through-has-hex/128353 "2018-04-24T07:43:39Z")
Having a painful problem. Using auditbeat to monitor a directory. It would be nice if it gave the full path to whatever was happening rather than the relative path (unless there is a setting for ensuring the full path al… --- ## [Creation/error of a x.509 certificate](https://discuss.elastic.co/t/creation-error-of-a-x-509-certificate/317201)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 11\ **Last updated:** [October 22, 2022, 1:35pm UTC](https://discuss.elastic.co/t/creation-error-of-a-x-509-certificate/317201 "2022-10-22T13:35:43Z")
Hello, I'm trying to produce x.509 crt and key for 4 instances that I have saved in a .yml file(Elastic, Kibana, Winlogbeat and Metricbeat) I was trying to ro run the command /usr/share/elasticsearch/bin/elasticsearch-… --- ## [SPAN start gives abstraction error using ElasticApmTracer](https://discuss.elastic.co/t/span-start-gives-abstraction-error-using-elasticapmtracer/203513)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 13\ **Last updated:** [October 16, 2019, 7:14pm UTC](https://discuss.elastic.co/t/span-start-gives-abstraction-error-using-elasticapmtracer/203513 "2019-10-16T19:14:50Z")
Kibana version: 7.3.2 Elasticsearch version: 7.3.2 APM Server version: 7.3.2 APM Agent language and version: java 1.9.0 Fresh install or upgraded from other version? fresh install Hi I am trying to use open traci… --- ## [Corrupt index creation when elasticsearch is killed just after index is created](https://discuss.elastic.co/t/corrupt-index-creation-when-elasticsearch-is-killed-just-after-index-is-created/15018)
**Author:** [@tarang\_dawer](https://discuss.elastic.co/u/tarang_dawer)\ **Replies:** 13\ **Last updated:** [January 9, 2014, 5:17pm UTC](https://discuss.elastic.co/t/corrupt-index-creation-when-elasticsearch-is-killed-just-after-index-is-created/15018 "2014-01-09T17:17:52Z")
Hi all I am facing an issue of corrupt index creation, whenever the es node is killed just after the index is created. When the node is restarted, the index shows 3/4 shards corrupt, with 503 status, which never recov… --- ## [\_grokparsfailure on core patterns](https://discuss.elastic.co/t/-grokparsfailure-on-core-patterns/58263)
**Author:** [@m0n0lith](https://discuss.elastic.co/u/m0n0lith)\ **Replies:** 9\ **Last updated:** [August 19, 2016, 12:31pm UTC](https://discuss.elastic.co/t/-grokparsfailure-on-core-patterns/58263 "2016-08-19T12:31:31Z")
Hello! I'm getting weird grok failures after adding my own patterns. And I have checked my patterns they shouldn't even come close to match the standard once in the core patterns. This is for Cisco ASA firewalls and foll… --- ## [Percolation time varies a lot](https://discuss.elastic.co/t/percolation-time-varies-a-lot/38870)
**Author:** [@anishek](https://discuss.elastic.co/u/anishek)\ **Replies:** 10\ **Last updated:** [January 19, 2016, 1:24pm UTC](https://discuss.elastic.co/t/percolation-time-varies-a-lot/38870 "2016-01-19T13:24:11Z")
Hello, I am just testing the below on a single 40 core machine. It has 171 percolation documents under a single index (index1). I create a test document to percolate against them. The test document is not changing an… --- ## [Alert in single node](https://discuss.elastic.co/t/alert-in-single-node/281595)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 13\ **Last updated:** [August 16, 2021, 11:36pm UTC](https://discuss.elastic.co/t/alert-in-single-node/281595 "2021-08-16T23:36:46Z")
I'm using Machine learning 7.13 and planning to create alert rule for warning. But I saw this After searching I found these steps to enable TLS. But I saw in Set up minimal security for Elasticsearch | Elasticsearch … --- ## [Logstash.conf not building pipeline.yml file](https://discuss.elastic.co/t/logstash-conf-not-building-pipeline-yml-file/291259)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 12\ **Last updated:** [December 13, 2021, 3:36pm UTC](https://discuss.elastic.co/t/logstash-conf-not-building-pipeline-yml-file/291259 "2021-12-13T15:36:58Z")
Good Afternoon Elastic Peeps; I am in the process of creating a second logstash.conf file on my server. It is intended to pull data from a microsoft database. To that end I downloaded and extracted the sqljdbc9.4.jar … --- ## [Elasticsearch aliases not visible in Kibana Dashboard-xpack by normal user](https://discuss.elastic.co/t/elasticsearch-aliases-not-visible-in-kibana-dashboard-xpack-by-normal-user/161179)
**Author:** [@praboosingh](https://discuss.elastic.co/u/praboosingh)\ **Replies:** 11\ **Last updated:** [December 20, 2018, 11:43am UTC](https://discuss.elastic.co/t/elasticsearch-aliases-not-visible-in-kibana-dashboard-xpack-by-normal-user/161179 "2018-12-20T11:43:58Z")
Dear Team, I have ELK version - 6.3.1 and installed xpack trial version to check rules and privileges for normal user and admin user. So I have created an user (user1) with only one indices aliases(event\_aliases01), wh… --- ## [Setting for option discovery.zen.ping.unicast.hosts in elasticsearch.yml](https://discuss.elastic.co/t/setting-for-option-discovery-zen-ping-unicast-hosts-in-elasticsearch-yml/155710)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 11\ **Last updated:** [November 8, 2018, 6:25pm UTC](https://discuss.elastic.co/t/setting-for-option-discovery-zen-ping-unicast-hosts-in-elasticsearch-yml/155710 "2018-11-08T18:25:14Z")
As per the documentation setting can be - discovery.zen.ping.unicast.hosts: \["host1", "host2"\]. Both hosts host1 and host2 are in their private networks e.g. in 20.x.x.x and 30.x.x.x. These 2 networks can't talk to each… --- ## [Heap JVM memory leak in ElasticSearch 2.4.5](https://discuss.elastic.co/t/heap-jvm-memory-leak-in-elasticsearch-2-4-5/161545)
**Author:** [@Shkarbatov\_Dmitiry](https://discuss.elastic.co/u/Shkarbatov_Dmitiry)\ **Replies:** 15\ **Last updated:** [December 31, 2018, 9:21pm UTC](https://discuss.elastic.co/t/heap-jvm-memory-leak-in-elasticsearch-2-4-5/161545 "2018-12-31T21:21:41Z")
Hi all, I use ElasticSearch 2.4.5 I attache image heap-memory ElasticSearch. In the end I need to restart my server and it started again. I have 3 node in my claster, but one of them looks different from other: Mem… --- ## [Ssl setup for filebeat and logstash in docker getting desperate now](https://discuss.elastic.co/t/ssl-setup-for-filebeat-and-logstash-in-docker-getting-desperate-now/365078)
**Author:** [@daverodgers](https://discuss.elastic.co/u/daverodgers)\ **Replies:** 12\ **Last updated:** [August 21, 2024, 10:30am UTC](https://discuss.elastic.co/t/ssl-setup-for-filebeat-and-logstash-in-docker-getting-desperate-now/365078 "2024-08-21T10:30:08Z")
Morning everyone. im getting desperate now so i really need your help please. I cannot find a guide anywhere that is for a production setup , where you have nodes and beats running on different servers, it all seems to … --- ## [Configuration of OpenID connect for Elasticsearch 7.14.1 is getting failed with trial version](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477)
**Author:** [@hari97](https://discuss.elastic.co/u/hari97)\ **Replies:** 9\ **Last updated:** [September 21, 2021, 4:54am UTC](https://discuss.elastic.co/t/configuration-of-openid-connect-for-elasticsearch-7-14-1-is-getting-failed-with-trial-version/284477 "2021-09-21T04:54:33Z")
I have installed latest elasticsearch and kibana (7.14.1) version using docker images. My setup is single-node elasticsearch. Initiated trial version for 30 days and enabled https for elasticsearch using ssl certificate… --- ## [Elasticsearch not update](https://discuss.elastic.co/t/elasticsearch-not-update/226341)
**Author:** [@111306](https://discuss.elastic.co/u/111306)\ **Replies:** 9\ **Last updated:** [April 6, 2020, 10:38am UTC](https://discuss.elastic.co/t/elasticsearch-not-update/226341 "2020-04-06T10:38:26Z")
I met a strange thing, that is, I can use \_update\_by\_query locally to successfully update, but not on the server. I considered the problem of multithreading and added a lock, but it still doesn't work. Can anyone have id… --- ## [Logstash fails after upgrading to version - 8.15.1](https://discuss.elastic.co/t/logstash-fails-after-upgrading-to-version-8-15-1/366333)
**Author:** [@mohanss08](https://discuss.elastic.co/u/mohanss08)\ **Replies:** 18\ **Last updated:** [October 18, 2024, 4:35am UTC](https://discuss.elastic.co/t/logstash-fails-after-upgrading-to-version-8-15-1/366333 "2024-10-18T04:35:07Z")
Hi Team, Today i upgraded my Elasticsearch, Logstash, and Kibana stack from version 8.6.2 to 8.15.1. My setup is based on Docker Compose. After the upgrade, the Logstash container fails to start and throws the following… --- ## [Type:flow missing source fields](https://discuss.elastic.co/t/type-flow-missing-source-fields/126752)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 12\ **Last updated:** [April 5, 2018, 2:29pm UTC](https://discuss.elastic.co/t/type-flow-missing-source-fields/126752 "2018-04-05T14:29:15Z")
In research to find a solution for capturing and visualizing all kinds of traffic on a few remote dedicated servers with the lack of firewall syslogs and tried out packetbeats. It does not do the same, i know, but it giv… --- ## [TWO Clusters unable to communicate for remote search](https://discuss.elastic.co/t/two-clusters-unable-to-communicate-for-remote-search/172299)
**Author:** [@srirama](https://discuss.elastic.co/u/srirama)\ **Replies:** 10\ **Last updated:** [March 15, 2019, 11:40am UTC](https://discuss.elastic.co/t/two-clusters-unable-to-communicate-for-remote-search/172299 "2019-03-15T11:40:53Z")
In my local development servers, we created two clusters, each having single node. The cluster status for each of them made green by making number of replicas to 0. Below is the cluster configurations. { "persistent… --- ## [Replay rule on old index dates](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857)
**Author:** [@priamai](https://discuss.elastic.co/u/priamai)\ **Replies:** 9\ **Last updated:** [May 18, 2021, 2:56pm UTC](https://discuss.elastic.co/t/replay-rule-on-old-index-dates/272857 "2021-05-18T14:56:34Z")
Hi there, I have 90 days worth of windows event logs (partitioned per day) and a set of rules that I want to apply on those days. I noticed that when I activate a rule it can only go forward in time, is there a way to … --- ## [Memory usage is at extreme high level](https://discuss.elastic.co/t/memory-usage-is-at-extreme-high-level/198085)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 9\ **Last updated:** [September 11, 2019, 8:25pm UTC](https://discuss.elastic.co/t/memory-usage-is-at-extreme-high-level/198085 "2019-09-11T20:25:13Z")
Hello World! Memory usage seems a bit excessive for metricbeat, is it not? I # systemctl status metricbeat.service ● metricbeat.service - Metricbeat is a lightweight shipper for metrics. Loaded: loaded (/lib/system… --- ## [Problem with the code. Only parsing one grok pattern and not overwriting message field](https://discuss.elastic.co/t/problem-with-the-code-only-parsing-one-grok-pattern-and-not-overwriting-message-field/198625)
**Author:** [@rajdeep101](https://discuss.elastic.co/u/rajdeep101)\ **Replies:** 16\ **Last updated:** [September 11, 2019, 6:42am UTC](https://discuss.elastic.co/t/problem-with-the-code-only-parsing-one-grok-pattern-and-not-overwriting-message-field/198625 "2019-09-11T06:42:55Z")
Hi all, i am trying to parse certain log lines and fetch only required information. I am using if else statements to differentiate according to which my lines should parse. But all log line are parsing using first grok p… --- ## [Can dissect use a variable number of fields?](https://discuss.elastic.co/t/can-dissect-use-a-variable-number-of-fields/200952)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 10\ **Last updated:** [September 26, 2019, 11:47pm UTC](https://discuss.elastic.co/t/can-dissect-use-a-variable-number-of-fields/200952 "2019-09-26T23:47:27Z")
I'm trying to use Logstash to ingest some old, OLD IAS/RRAS logs that seem to be customized. They all begin the same, so I can get dissect to ingest this correctly: filter { dissect { mapping =\> { "message" =\> "%{… --- ## [How to plot timestamp field against a float field in kibana](https://discuss.elastic.co/t/how-to-plot-timestamp-field-against-a-float-field-in-kibana/183351)
**Author:** [@James\_Woods](https://discuss.elastic.co/u/James_Woods)\ **Replies:** 10\ **Last updated:** [May 30, 2019, 3:38pm UTC](https://discuss.elastic.co/t/how-to-plot-timestamp-field-against-a-float-field-in-kibana/183351 "2019-05-30T15:38:19Z")
So I have a timestamp and float field in my index. I want to plot timestamp on the x axis and the float value on the y axis, but when I go to data visualisation, I can't see the float field at all. All I can see is time… --- ## [Filebeat missed one complete log file in log rotation](https://discuss.elastic.co/t/filebeat-missed-one-complete-log-file-in-log-rotation/79733)
**Author:** [@siddharthgoel88](https://discuss.elastic.co/u/siddharthgoel88)\ **Replies:** 9\ **Last updated:** [April 19, 2017, 11:53am UTC](https://discuss.elastic.co/t/filebeat-missed-one-complete-log-file-in-log-rotation/79733 "2017-04-19T11:53:50Z")
We are using Filebeat version 1.3.1 for our system and following is it's config : filebeat: prospectors: paths: - "/path/to/file.log\*" fields\_under\_root: true document\_type: "event-type" fields: host: "host-xyz" … --- ## [Disable auto\_import\_dangled for ES 6.2](https://discuss.elastic.co/t/disable-auto-import-dangled-for-es-6-2/124801)
**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\ **Replies:** 11\ **Last updated:** [March 21, 2018, 1:29pm UTC](https://discuss.elastic.co/t/disable-auto-import-dangled-for-es-6-2/124801 "2018-03-21T13:29:35Z")
It seems like the setting "gateway.local.auto\_import\_dangled: no" is not supported for the Elasticsearch 6.2. I'm getting the below exception if I use this setting. java.lang.IllegalArgumentException: unknown setting \[… --- ## [Create multiple logstash configurations for different Filebeat instances](https://discuss.elastic.co/t/create-multiple-logstash-configurations-for-different-filebeat-instances/296781)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 9\ **Last updated:** [February 10, 2022, 7:51pm UTC](https://discuss.elastic.co/t/create-multiple-logstash-configurations-for-different-filebeat-instances/296781 "2022-02-10T19:51:49Z")
As of now, I am using Docker compose to set up an image of Logstash. Here is my use case: I have Filebeat installed on 5 machines, each with different log paths and log formats. Instead of having one logstash.conf file … --- ## [Duplicates after index rollover](https://discuss.elastic.co/t/duplicates-after-index-rollover/344084)
**Author:** [@elk-user-0001](https://discuss.elastic.co/u/elk-user-0001)\ **Replies:** 16\ **Last updated:** [September 28, 2023, 6:49pm UTC](https://discuss.elastic.co/t/duplicates-after-index-rollover/344084 "2023-09-28T18:49:49Z")
Good afternoon. The problem that I am going to comment is a common problem but I do not know if elastic has already given a solution. We have an api ingest via logstash that we have to attack it 7 days ago because thro… --- ## [Anomaly Detection for input logs (Elastic Agents)](https://discuss.elastic.co/t/anomaly-detection-for-input-logs-elastic-agents/346073)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 20\ **Last updated:** [November 27, 2023, 5:26pm UTC](https://discuss.elastic.co/t/anomaly-detection-for-input-logs-elastic-agents/346073 "2023-11-27T17:26:14Z")
I want to create something like a Machine Learning or Threshold rule that triggers when my infrastructure loses events from elastic agents. For example, the medium of events per day is 500k logs. But if I will get only … --- ## [Auditbeat vs testing ES output](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 20\ **Last updated:** [March 6, 2020, 7:09am UTC](https://discuss.elastic.co/t/auditbeat-vs-testing-es-output/221252 "2020-03-06T07:09:44Z")
trying to test auditbeat connectivity to elastic, connectivity seems fine only service is unavailable. Wondering where I possible could see the RC, tried ingesting nodes' elasticsearch + audit logs, beat log, but nothin… --- ## [Data size on disk increase 15 times when moved from hive to elasticsearch](https://discuss.elastic.co/t/data-size-on-disk-increase-15-times-when-moved-from-hive-to-elasticsearch/305654)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 26\ **Last updated:** [June 9, 2022, 1:21pm UTC](https://discuss.elastic.co/t/data-size-on-disk-increase-15-times-when-moved-from-hive-to-elasticsearch/305654 "2022-06-09T13:21:56Z")
I am using hive-hadoop jar to move data from hive to Elasticsearch. The data size on disk is ~ 35GB which when moved to ES becomes ~600GB. Is this expected behaviour? Or is there that something is missing from our end. R… --- ## [Elasticsearch 7.8.0 user authentication with X-Pack security fails](https://discuss.elastic.co/t/elasticsearch-7-8-0-user-authentication-with-x-pack-security-fails/249889)
**Author:** [@dzyubanv](https://discuss.elastic.co/u/dzyubanv)\ **Replies:** 10\ **Last updated:** [September 29, 2020, 9:03pm UTC](https://discuss.elastic.co/t/elasticsearch-7-8-0-user-authentication-with-x-pack-security-fails/249889 "2020-09-29T21:03:00Z")
Hello, I'm experiencing user authentication issues for custom user, roles with X-Pack security. I'm using elasticsearch REST API for the user, roles, etc. setup (Not using Kibana). Responses with errors when checking … --- ## [Query cache gets invalidated](https://discuss.elastic.co/t/query-cache-gets-invalidated/216032)
**Author:** [@royal\_man](https://discuss.elastic.co/u/royal_man)\ **Replies:** 10\ **Last updated:** [January 24, 2020, 1:41pm UTC](https://discuss.elastic.co/t/query-cache-gets-invalidated/216032 "2020-01-24T13:41:43Z")
I am making this query with request\_cache=true { "query": { "bool": { "should": \[ { "term": { "status": "online" } }, { "term": { … --- ## [\[Filebeat\] Postgres module](https://discuss.elastic.co/t/filebeat-postgres-module/173283)
**Author:** [@YoubaYT](https://discuss.elastic.co/u/YoubaYT)\ **Replies:** 13\ **Last updated:** [April 8, 2019, 3:08am UTC](https://discuss.elastic.co/t/filebeat-postgres-module/173283 "2019-04-08T03:08:39Z")
Bonjour à tous, Je suis débutant sur Elastic Stack, après l'installation et l'utilisation de quelques dashboards j'ai voulu intégrer quelques modules. Avec Filebeat mon problème est que je récupère des logs postgresql … --- ## [Struggling with storage management](https://discuss.elastic.co/t/struggling-with-storage-management/145978)
**Author:** [@seanva](https://discuss.elastic.co/u/seanva)\ **Replies:** 12\ **Last updated:** [September 5, 2018, 2:50pm UTC](https://discuss.elastic.co/t/struggling-with-storage-management/145978 "2018-09-05T14:50:44Z")
I'm at about 50 windows servers that index weekly (i.e. winlogbeat 2018.34 would be the latest week of the year) Storage is coming out to be about 10 gigs a week, depending on amount of activity on the servers. This is … --- ## [Ошибка Index lifecycle error: index\_closed\_exception: closed](https://discuss.elastic.co/t/index-lifecycle-error-index-closed-exception-closed/236724)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 9\ **Last updated:** [June 15, 2020, 4:49pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-index-closed-exception-closed/236724 "2020-06-15T16:49:04Z")
Добрый день! В Elasticsearch 7.3.1 возникает ошибка ilm Index lifecycle error index\_closed\_exception: closed Индекс при этом открыт - 100% уверен, для надежности даже делал POST logs-servicename-2020.05.29-001972/\_o… --- ## [Improve Search Performance](https://discuss.elastic.co/t/improve-search-performance/359306)
**Author:** [@sravan\_kaheti](https://discuss.elastic.co/u/sravan_kaheti)\ **Replies:** 19\ **Last updated:** [June 10, 2024, 2:17pm UTC](https://discuss.elastic.co/t/improve-search-performance/359306 "2024-06-10T14:17:26Z")
Hi Team , I ingested huge amount of data (3-4 B records)with bellow index configuration Index - Data Stream Primaries - 5 replicas - 0 Master and Master eligible node - 3 Voting only node - 1 coordinator node - 1 … --- ## [Logstash/Filebeat lag issue - Logs delayed by hours](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101)
**Author:** [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)\ **Replies:** 45\ **Last updated:** [March 5, 2026, 1:02pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101 "2026-03-05T13:02:46Z")
Hello Elastic Community, I am experiencing a significant lag in log ingestion where logs are arriving with a variable delay (sometimes hours late) despite having a high-performance environment. I would appreciate your a… --- ## [How does other field work in Kibana's Piechart](https://discuss.elastic.co/t/how-does-other-field-work-in-kibanas-piechart/138859)
**Author:** [@gevmart](https://discuss.elastic.co/u/gevmart)\ **Replies:** 9\ **Last updated:** [July 6, 2018, 3:04pm UTC](https://discuss.elastic.co/t/how-does-other-field-work-in-kibanas-piechart/138859 "2018-07-06T15:04:34Z")
Hey there, I was playing around with Kibana 6.3 piecharts, and exploring the other field of the piechart. I was exploring the following situation. Suppose the documents stored in kibana have a text type value name, and… --- ## [Logstash speed - virtual vs physical environment](https://discuss.elastic.co/t/logstash-speed-virtual-vs-physical-environment/60358)
**Author:** [@andreas\_at\_work](https://discuss.elastic.co/u/andreas_at_work)\ **Replies:** 9\ **Last updated:** [September 15, 2016, 10:16am UTC](https://discuss.elastic.co/t/logstash-speed-virtual-vs-physical-environment/60358 "2016-09-15T10:16:33Z")
Hey, we are using the ELK stack for some detecting/alerting in incident response cases. Some time ago a college created a python framework to automate the creation and configuration of the complete ELK stack + RabbitMQ… --- ## [openNlp don't return valid result in pdf](https://discuss.elastic.co/t/opennlp-dont-return-valid-result-in-pdf/123566)
**Author:** [@akml\_kk](https://discuss.elastic.co/u/akml_kk)\ **Replies:** 18\ **Last updated:** [March 15, 2018, 8:35pm UTC](https://discuss.elastic.co/t/opennlp-dont-return-valid-result-in-pdf/123566 "2018-03-15T20:35:18Z")
Hello, i've succeded, recently thanks to this site to link opennlp ,to my pdf. However the result wasn't as good as i expected. This the pdf : \[image\] and this what i get : \[image\] what is wrong with plugin is th… --- ## [Index type effective utilization](https://discuss.elastic.co/t/index-type-effective-utilization/58706)
**Author:** [@pranay.pramod](https://discuss.elastic.co/u/pranay.pramod)\ **Replies:** 13\ **Last updated:** [August 28, 2016, 7:49am UTC](https://discuss.elastic.co/t/index-type-effective-utilization/58706 "2016-08-28T07:49:16Z")
I am trying to understand and effectively use the index type available in elasticsearch. However, I am still not clear how \_type meta field is different from any regular field of an index in terms of storage/implementa… --- ## [Can't install logstash-output-influxdb plugin](https://discuss.elastic.co/t/cant-install-logstash-output-influxdb-plugin/323890)
**Author:** [@AlanChan](https://discuss.elastic.co/u/AlanChan)\ **Replies:** 19\ **Last updated:** [January 27, 2023, 6:23am UTC](https://discuss.elastic.co/t/cant-install-logstash-output-influxdb-plugin/323890 "2023-01-27T06:23:37Z")
Hi, I'm using Logstash (8.6.0) and want to send data to influxdb2 (2.6.1). But I find that logstash-output-infludb isn't installed by default, so I'm trying to install it. Some errors happen but no details are shown. C… --- ## [Elasicsearch cluster setup](https://discuss.elastic.co/t/elasicsearch-cluster-setup/210456)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 14\ **Last updated:** [December 5, 2019, 7:24am UTC](https://discuss.elastic.co/t/elasicsearch-cluster-setup/210456 "2019-12-05T07:24:06Z")
Hi I wan to setup a two node cluster in which i want only data node and master node is it possible? if it is then what will be the configuration done in both nodes --- ## [Updating documents without affecting search](https://discuss.elastic.co/t/updating-documents-without-affecting-search/168318)
**Author:** [@vijayaraj](https://discuss.elastic.co/u/vijayaraj)\ **Replies:** 12\ **Last updated:** [February 14, 2019, 9:20pm UTC](https://discuss.elastic.co/t/updating-documents-without-affecting-search/168318 "2019-02-14T21:20:35Z")
Hello Guys, I have 500,000 documents in my Index which are currently being consumed by search API. out of that there are 100,000 documents that I must update everyday. Buy my update shouldnt affect the current searc… --- ## [Filebeat 7.9.1 parsing http\_json data](https://discuss.elastic.co/t/filebeat-7-9-1-parsing-http-json-data/250314)
**Author:** [@cdroberts](https://discuss.elastic.co/u/cdroberts)\ **Replies:** 9\ **Last updated:** [October 2, 2020, 10:10am UTC](https://discuss.elastic.co/t/filebeat-7-9-1-parsing-http-json-data/250314 "2020-10-02T10:10:37Z")
Hi, I am having an issue parsing http\_json data with Filebeat. In the logs I can see the events come through fine. 2020-09-29T18:16:19.606+1000 DEBUG \[processors\] processing/processors.go:187 Publish event: { "@times… --- ## [Иерархическое применение синонимов](https://discuss.elastic.co/t/topic/202995)
**Author:** [@LLIyMAXEP](https://discuss.elastic.co/u/LLIyMAXEP)\ **Replies:** 9\ **Last updated:** [October 10, 2019, 3:20pm UTC](https://discuss.elastic.co/t/topic/202995 "2019-10-10T15:20:09Z")
Добрый день. Немного запутался с концепцией multiword synonyms. Объясню на примерах. Индекс и документы: PUT test\_index1 { "mappings": { "doc": { "properties": { "full\_text": { "type": "t… --- ## [Filebeat 6.3.0 is taking too much of memory on windows 2008R2](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715)
**Author:** [@Junble](https://discuss.elastic.co/u/Junble)\ **Replies:** 9\ **Last updated:** [August 7, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-6-3-0-is-taking-too-much-of-memory-on-windows-2008r2/141715 "2018-08-07T11:50:36Z")
hi: I've set up a filebeat service（version 6.3.0） running on windows2008 R2. I found the memory has gone up all the time Does filebeat have potential memory leaks? Rotated file： filebeat.yml: queue.mem: events… --- ## [How elastic cluster the number about nodes?](https://discuss.elastic.co/t/how-elastic-cluster-the-number-about-nodes/102050)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 9\ **Last updated:** [September 29, 2017, 6:21am UTC](https://discuss.elastic.co/t/how-elastic-cluster-the-number-about-nodes/102050 "2017-09-29T06:21:12Z")
how elasticsearch cluster plan? master data ingest coordinating the four nodes . how about Proportion about the fours nodes ? (as master:20% data: 60% ingest:10% coord:10%) can give a suggested reference … [Previous page](https://discuss.elastic.co/top.md?page=160&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=162&per_page=50&period=all)