# Top **URL:** https://discuss.elastic.co/top.md?page=1613&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1614 --- ## [Query is obsolete after filters and queries have been merged?](https://discuss.elastic.co/t/query-is-obsolete-after-filters-and-queries-have-been-merged/59230)
**Author:** [@dhondup](https://discuss.elastic.co/u/dhondup)\ **Replies:** 3\ **Last updated:** [August 29, 2016, 8:03pm UTC](https://discuss.elastic.co/t/query-is-obsolete-after-filters-and-queries-have-been-merged/59230 "2016-08-29T20:03:13Z")
It is mentioned in the breaking changes section of elasticsearch 5.0.0 that query is obsolete after filters and queries have been merged. What does that mean? Can someone explain this with an example? --- ## [Cannot use elasticsearch output module twice](https://discuss.elastic.co/t/cannot-use-elasticsearch-output-module-twice/53112)
**Author:** [@maxlock](https://discuss.elastic.co/u/maxlock)\ **Replies:** 3\ **Last updated:** [June 22, 2016, 2:48pm UTC](https://discuss.elastic.co/t/cannot-use-elasticsearch-output-module-twice/53112 "2016-06-22T14:48:26Z")
Hi All, I'm trying to configure Logstash 2.3.2 to call the elasticsearch output module twice as I'm migrating to a new cluster. Calling the module once for either cluster works fine, but if I call it twice no packets a… --- ## [Error: \_analyze request throws NPE](https://discuss.elastic.co/t/error--analyze-request-throws-npe/44564)
**Author:** [@ralphlevan](https://discuss.elastic.co/u/ralphlevan)\ **Replies:** 3\ **Last updated:** [March 16, 2016, 5:26pm UTC](https://discuss.elastic.co/t/error--analyze-request-throws-npe/44564 "2016-03-16T17:26:33Z")
When I send "GET \_analyze?analyzer=bob&text="test"" to ES (using Sense), I get no response. When I look in the logs, I see that TransportSingleShardAction$AsyncSingleAction has thrown a NullPointerException. \[2016-03-… --- ## [How to improve search performance in ES?](https://discuss.elastic.co/t/how-to-improve-search-performance-in-es/18608)
**Author:** [@dark\_shadow](https://discuss.elastic.co/u/dark_shadow)\ **Replies:** 3\ **Last updated:** [July 11, 2014, 11:17pm UTC](https://discuss.elastic.co/t/how-to-improve-search-performance-in-es/18608 "2014-07-11T23:17:46Z")
Hi, I'm working on improving the search response of ES but not able to do anything. My scenario is something like this: I'm using 3 ES queries to get relevant results for my autocompleter. 1. A function score … --- ## [Upgrades causing Elastic Search downtime](https://discuss.elastic.co/t/upgrades-causing-elastic-search-downtime/15127)
**Author:** [@Jenny\_Sivapalan](https://discuss.elastic.co/u/Jenny_Sivapalan)\ **Replies:** 8\ **Last updated:** [January 10, 2014, 12:05am UTC](https://discuss.elastic.co/t/upgrades-causing-elastic-search-downtime/15127 "2014-01-10T00:05:10Z")
Hello, We've upgraded Elastic Search twice over the last month and have experienced downtime (roughly 8 minutes) during the roll out. I'm not sure if it something we are doing wrong or not. We use EC2 instances… --- ## [Elastic-endpoint installed although defend integration is not applied to policy](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632)
**Author:** [@Pinpin](https://discuss.elastic.co/u/Pinpin)\ **Replies:** 4\ **Last updated:** [February 8, 2024, 3:05pm UTC](https://discuss.elastic.co/t/elastic-endpoint-installed-although-defend-integration-is-not-applied-to-policy/352632 "2024-02-08T15:05:01Z")
Hi ! I'm kind of new to the whole elastic stack and I was tasked to put in place some sort of log monitoring and siem solution. After deploying the stack on some test hosts, everything was fine so I deployed the agent o… --- ## [ES 7.8.1 crashing, insufficient memory... why?!](https://discuss.elastic.co/t/es-7-8-1-crashing-insufficient-memory-why/347050)
**Author:** [@jsamhall](https://discuss.elastic.co/u/jsamhall)\ **Replies:** 4\ **Last updated:** [November 14, 2023, 8:48am UTC](https://discuss.elastic.co/t/es-7-8-1-crashing-insufficient-memory-why/347050 "2023-11-14T08:48:12Z")
Hello, I am new to being a sysadmin for ES and in this case, it is backing a Magento2 installation running on Ubuntu 18.04 LTS Problem: Occasionally, and I'm not sure why, ES performance begins to degrade and then cra… --- ## [Linux agent system hang / disk IO stall](https://discuss.elastic.co/t/linux-agent-system-hang-disk-io-stall/338873)
**Author:** [@Florian\_Heigl](https://discuss.elastic.co/u/Florian_Heigl)\ **Replies:** 4\ **Last updated:** [July 20, 2023, 11:40pm UTC](https://discuss.elastic.co/t/linux-agent-system-hang-disk-io-stall/338873 "2023-07-20T23:40:43Z")
Hi, I'm seeing an issue with two systems that cease functioning after a while if the agent is active. I've watched it happen for 2-3 months now, and gone through some tests like disabling prevention for one of them. I… --- ## [Exclude user access using regular expressions in kibana](https://discuss.elastic.co/t/exclude-user-access-using-regular-expressions-in-kibana/322833)
**Author:** [@Shivani\_Hadke](https://discuss.elastic.co/u/Shivani_Hadke)\ **Replies:** 4\ **Last updated:** [January 10, 2023, 12:45pm UTC](https://discuss.elastic.co/t/exclude-user-access-using-regular-expressions-in-kibana/322833 "2023-01-10T12:45:45Z")
I would like to exclude only a particular index and have access to rest of all indexes in a cluster. Right now, I'm adding every index by clicking on it and in roles and it is a hectic task to do just to exclude one ind… --- ## [Subtracting two values of a field](https://discuss.elastic.co/t/subtracting-two-values-of-a-field/306915)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [June 16, 2022, 8:36pm UTC](https://discuss.elastic.co/t/subtracting-two-values-of-a-field/306915 "2022-06-16T20:36:41Z")
Hello All, I have a set up which parses the following line in a log file: \[2022-06-10T19:52:05.017+0000\]\[info\]\[gc \] GC(35959) Pause Full (Diagnostic Command) 1850M-\>1140M(2560M) 506.831ms The resultant get… --- ## [Anomaly Detection Categorization: Kibana Signs used for Severities(warning, minor, major, critical)](https://discuss.elastic.co/t/anomaly-detection-categorization-kibana-signs-used-for-severities-warning-minor-major-critical/303039)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 4\ **Last updated:** [April 26, 2022, 5:59am UTC](https://discuss.elastic.co/t/anomaly-detection-categorization-kibana-signs-used-for-severities-warning-minor-major-critical/303039 "2022-04-26T05:59:51Z")
Hi, I am using Elasticsearch 8.1.0 and kibana 8.1.0 I have created a Categorization job in kibana. As input, I have given the index field which contains the log messages. After the job gets completed processing, I can… --- ## [Elastic search : Can query include kind of a subquery or subqueries using multiple indices?](https://discuss.elastic.co/t/elastic-search-can-query-include-kind-of-a-subquery-or-subqueries-using-multiple-indices/269443)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 10:01am UTC](https://discuss.elastic.co/t/elastic-search-can-query-include-kind-of-a-subquery-or-subqueries-using-multiple-indices/269443 "2021-04-12T10:01:21Z")
I have index1 with geo-point data, index2 with polygons. Index2 has multiple polygon rows for given say id value. I would like to find all geo-points from index1 that are inside any of the polygons from index2 having sa… --- ## [32-BIT Metricbeat (7.8.0) return abnormal value for system.network.in.bytes](https://discuss.elastic.co/t/32-bit-metricbeat-7-8-0-return-abnormal-value-for-system-network-in-bytes/254369)
**Author:** [@Razby](https://discuss.elastic.co/u/Razby)\ **Replies:** 4\ **Last updated:** [November 16, 2020, 10:00am UTC](https://discuss.elastic.co/t/32-bit-metricbeat-7-8-0-return-abnormal-value-for-system-network-in-bytes/254369 "2020-11-16T10:00:35Z")
Hi, 32-BIT Metricbeat (7.8.0) return abnormal high value for system.network.in.bytes such as "6,424,932,420,939,677,696". :worried: With 64-BIT version I got acceptable value such as "3,652,142,427" I really don’t kno… --- ## [Ошибка в логах Logstash:\[ERROR\]\[logstash.outputs.elasticsearch\] An unknown error occurred sending a bulk request to Elasticsearch. We will retry indefinitely {:error\_message=\>"Broken pipe (Write failed)](https://discuss.elastic.co/t/logstash-error-logstash-outputs-elasticsearch-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch-we-will-retry-indefinitely-error-message-broken-pipe-write-failed/210741)
**Author:** [@111229](https://discuss.elastic.co/u/111229)\ **Replies:** 4\ **Last updated:** [December 6, 2019, 7:32am UTC](https://discuss.elastic.co/t/logstash-error-logstash-outputs-elasticsearch-an-unknown-error-occurred-sending-a-bulk-request-to-elasticsearch-we-will-retry-indefinitely-error-message-broken-pipe-write-failed/210741 "2019-12-06T07:32:47Z")
Коллеги, приветствую! Помогите, пожалуйста. Кто-нибудь сталкивался с ошибкой в logstash Broken pipe (Write failed)? Суть всё работало замечательно, бед не знали и в какой-то день просто валом посыпались ошибки ниже. … --- ## [Clear cache not working properly](https://discuss.elastic.co/t/clear-cache-not-working-properly/98444)
**Author:** [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Replies:** 4\ **Last updated:** [August 26, 2017, 9:58am UTC](https://discuss.elastic.co/t/clear-cache-not-working-properly/98444 "2017-08-26T09:58:37Z")
Hello. I did below command my ELK box for clear cache: # curl -XDELETE 'http://localhost:9200/\_all' {"acknowledged":true} but when I restart my server then cache back: # curl -XGET 'http://localhost:9200/\_cat/indices?… --- ## [Different multilines in one input](https://discuss.elastic.co/t/different-multilines-in-one-input/87683)
**Author:** [@JIELOGAN](https://discuss.elastic.co/u/JIELOGAN)\ **Replies:** 4\ **Last updated:** [June 1, 2017, 9:59am UTC](https://discuss.elastic.co/t/different-multilines-in-one-input/87683 "2017-06-01T09:59:46Z")
hi everyone,I have a problem here about multiline plugin,I have different log data in one file,and need use multiline to collapse multiline messages and merge them into a single event. my code is: input { file { … --- ## [Temporarily disable ID lookup](https://discuss.elastic.co/t/temporarily-disable-id-lookup/78238)
**Author:** [@Zaid\_Amir](https://discuss.elastic.co/u/Zaid_Amir)\ **Replies:** 4\ **Last updated:** [March 11, 2017, 4:51pm UTC](https://discuss.elastic.co/t/temporarily-disable-id-lookup/78238 "2017-03-11T16:51:15Z")
Hi, I am trying to index an initial workload of ~1 billion documents into ES 5.2. The documents are pulled from an MYSQL database and they already contain a unique ID and I want to use the same IDs in ES for a quick re… --- ## [Querying 2D-geometry data](https://discuss.elastic.co/t/querying-2d-geometry-data/73199)
**Author:** [@manuschiller](https://discuss.elastic.co/u/manuschiller)\ **Replies:** 4\ **Last updated:** [February 6, 2017, 2:44pm UTC](https://discuss.elastic.co/t/querying-2d-geometry-data/73199 "2017-02-06T14:44:23Z")
I got a huge amount of tracking data from a research study (26 Objects \* 25 frames per second \* 90 minutes \* 50 = ~175 500 000 records in my Database). The reference system of the tracking data is a fixed environment o… --- ## [X-Pack watcher alarm "one new document indexed"](https://discuss.elastic.co/t/x-pack-watcher-alarm-one-new-document-indexed/65201)
**Author:** [@chernals](https://discuss.elastic.co/u/chernals)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 4:29pm UTC](https://discuss.elastic.co/t/x-pack-watcher-alarm-one-new-document-indexed/65201 "2016-11-07T16:29:22Z")
I might have missed something in the doc, or just lack basic knowledge, but how could I define a watch to get alerted when one more document is indexed ? I have an external system that triggers an "alert" by indexing o… --- ## [X GB data in Elasticsearch then X GB memory used?](https://discuss.elastic.co/t/x-gb-data-in-elasticsearch-then-x-gb-memory-used/36687)
**Author:** [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\ **Replies:** 4\ **Last updated:** [December 9, 2015, 9:23am UTC](https://discuss.elastic.co/t/x-gb-data-in-elasticsearch-then-x-gb-memory-used/36687 "2015-12-09T09:23:22Z")
We deployed a 2 node Elasticsearch cluster with 2\*30 GB memory. I noticed when there is X GB data in cluster, then roughly X GB memory used. Today es used 35 GB memory already with 55.9 GB data , what will happens i… --- ## [\> Project :benchmarks declares a dependency from configuration 'compile' t configuration 'default' which is not declared in the descriptor for project :c re](https://discuss.elastic.co/t/project-benchmarks-declares-a-dependency-from-configuration-compile-t-configuration-default-which-is-not-declared-in-the-descriptor-for-project-c-re/98518)
**Author:** [@saliormoon](https://discuss.elastic.co/u/saliormoon)\ **Replies:** 0\ **Last updated:** [August 28, 2017, 8:06am UTC](https://discuss.elastic.co/t/project-benchmarks-declares-a-dependency-from-configuration-compile-t-configuration-default-which-is-not-declared-in-the-descriptor-for-project-c-re/98518 "2017-08-28T08:06:25Z")
elasticsearch version: 5.5.2 Operating System: Windows Gradle version: 3.5 When I use gradle 3.5 to build elasticsearch source code 5.5.2, it has a exception, like this: What went wrong: ould not determine the depen… --- ## [Elasticsearch 5.0 and syslog-ng: a getting started](https://discuss.elastic.co/t/elasticsearch-5-0-and-syslog-ng-a-getting-started/66391)
**Author:** [@czanik](https://discuss.elastic.co/u/czanik)\ **Replies:** 0\ **Last updated:** [November 17, 2016, 1:20pm UTC](https://discuss.elastic.co/t/elasticsearch-5-0-and-syslog-ng-a-getting-started/66391 "2016-11-17T13:20:04Z")
Hi All, I just published a blog about how to get started using syslog-ng together with Elasticsearch 5.0. My examples are for RHEL / CentOS 7. Let me know if you are interested in other Linux distributions! It's availa… --- ## [Maximum characters limit text fields in elasticsearch](https://discuss.elastic.co/t/maximum-characters-limit-text-fields-in-elasticsearch/376616)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [April 1, 2025, 3:27pm UTC](https://discuss.elastic.co/t/maximum-characters-limit-text-fields-in-elasticsearch/376616 "2025-04-01T15:27:16Z")
Hi Team, We are using an API to get the data into elasticsearch and the API will give the entire documents in the response body which will be stored into elasticsearch into message or event.original. Could you please le… --- ## [Kibana security must be enabled to use Fleet](https://discuss.elastic.co/t/kibana-security-must-be-enabled-to-use-fleet/372628)
**Author:** [@aalaskapedh](https://discuss.elastic.co/u/aalaskapedh)\ **Replies:** 1\ **Last updated:** [January 20, 2025, 3:11pm UTC](https://discuss.elastic.co/t/kibana-security-must-be-enabled-to-use-fleet/372628 "2025-01-20T15:11:38Z")
Dec 30 22:33:17 master kibana\[2375\]: \[2024-12-30T22:33:17.627+05:45\]\[INFO \] \[plugins.fleet.fleet\_authz\_router\] Kibana security must be enabled to use Fleet This is the error that I have been getting When I attempt t… --- ## ["doc\_as\_upsert" overwrites logs instead of appending the logs](https://discuss.elastic.co/t/doc-as-upsert-overwrites-logs-instead-of-appending-the-logs/306898)
**Author:** [@Marc\_Jacques](https://discuss.elastic.co/u/Marc_Jacques)\ **Replies:** 1\ **Last updated:** [June 11, 2022, 4:19am UTC](https://discuss.elastic.co/t/doc-as-upsert-overwrites-logs-instead-of-appending-the-logs/306898 "2022-06-11T04:19:12Z")
Hello Elastic, I have a filebeat agent that harvests logs. It sends the logs to Logstash on the same server, which sends it after to Elastic Cloud, the field "message" has the value of the log on Elastic cloud. After a… --- ## [Logstash input Kafka error](https://discuss.elastic.co/t/logstash-input-kafka-error/291345)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 1\ **Last updated:** [December 13, 2021, 1:27pm UTC](https://discuss.elastic.co/t/logstash-input-kafka-error/291345 "2021-12-13T13:27:04Z")
Hi evrery one, i'm facing an issue while using kafka as my logstash input. when i started logstash i have this error : Unable to poll Kafka consumer {:kafka\_error\_message=\>org.apache.kafka.common.KafkaException: Recei… --- ## [Sorting on keyword not working as expected](https://discuss.elastic.co/t/sorting-on-keyword-not-working-as-expected/253959)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 1\ **Last updated:** [November 2, 2020, 11:56am UTC](https://discuss.elastic.co/t/sorting-on-keyword-not-working-as-expected/253959 "2020-11-02T11:56:37Z")
I am storing Windows UNC paths in a path field with the following mapping: "path": { "type": "text", "fields": { "keyword": { "type": "keyword" }, "tree": { "type"… --- ## [Dead Letter Queue (DLQ) issue](https://discuss.elastic.co/t/dead-letter-queue-dlq-issue/146757)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [August 31, 2018, 10:02am UTC](https://discuss.elastic.co/t/dead-letter-queue-dlq-issue/146757 "2018-08-31T10:02:42Z")
Hello, I'm using Logstash 6.3.2 and I've enabled the DLQ but it doesn't appear to be indexing the events back into Elasticsearch; the log files in the DLQ data directory just keep growing and all i'm seeing in logstash-… --- ## [Elasticsearch-hive Storage handler exception](https://discuss.elastic.co/t/elasticsearch-hive-storage-handler-exception/119993)
**Author:** [@sat](https://discuss.elastic.co/u/sat)\ **Replies:** 1\ **Last updated:** [March 1, 2018, 9:38pm UTC](https://discuss.elastic.co/t/elasticsearch-hive-storage-handler-exception/119993 "2018-03-01T21:38:41Z")
Hi i am trying to get elasticsearch data in to hive external table, CREATE EXTERNAL TABLE eshadoop( name String ) STORED BY 'org.elasticsearch.hadoop.hive.EsStorageHandler' TBLPROPERTIES('es.nodes' = 'XXXX:9200', … --- ## [Painless script : Appender deprecation\_rolling java.security.AccessContaccess denied](https://discuss.elastic.co/t/painless-script-appender-deprecation-rolling-java-security-accesscontaccess-denied/117313)
**Author:** [@anon24174512](https://discuss.elastic.co/u/anon24174512)\ **Replies:** 1\ **Last updated:** [January 31, 2018, 6:04pm UTC](https://discuss.elastic.co/t/painless-script-appender-deprecation-rolling-java-security-accesscontaccess-denied/117313 "2018-01-31T18:04:15Z")
Hello, I setup a painless script in Kibana which generates the following error (full exception below): AccessControlException: access denied ("java.io.FilePermission" "/opt/elasticsearch/elasticsearch-6.1.1/logs" "rea… --- ## [Logstash multiline codec not working with my pattern](https://discuss.elastic.co/t/logstash-multiline-codec-not-working-with-my-pattern/30085)
**Author:** [@Jigar\_Sheth](https://discuss.elastic.co/u/Jigar_Sheth)\ **Replies:** 1\ **Last updated:** [September 27, 2015, 6:39pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-not-working-with-my-pattern/30085 "2015-09-27T18:39:00Z")
I had been using the multline codec of logstash for my java exceptions. However, recently I wanted to capture more things and hence used another pattern. This causes my logstash not to read file even though I am using… --- ## [Sharing Case ID value using Elastic Case Management webhook](https://discuss.elastic.co/t/sharing-case-id-value-using-elastic-case-management-webhook/328641)
**Author:** [@yzaritskyi](https://discuss.elastic.co/u/yzaritskyi)\ **Replies:** 2\ **Last updated:** [March 30, 2023, 2:05pm UTC](https://discuss.elastic.co/t/sharing-case-id-value-using-elastic-case-management-webhook/328641 "2023-03-30T14:05:45Z")
Greetings! I'm on the way to implementing the automation solution for our Elastic Security Cases. While working on some automation scripts, I got a problem with the response to Cases. For example, when the Case is crea… --- ## [Set a global TLS CA for security, snapshot , reindex etc](https://discuss.elastic.co/t/set-a-global-tls-ca-for-security-snapshot-reindex-etc/297389)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [February 17, 2022, 7:18am UTC](https://discuss.elastic.co/t/set-a-global-tls-ca-for-security-snapshot-reindex-etc/297389 "2022-02-17T07:18:38Z")
Dont know if this is possible already? How to setup TLS CA for everything: snapshot S3 against custom repositories clustering security TLS --- ## [Indices eating too much space (~50 GB each)](https://discuss.elastic.co/t/indices-eating-too-much-space-50-gb-each/216609)
**Author:** [@The-Big-K](https://discuss.elastic.co/u/The-Big-K)\ **Replies:** 2\ **Last updated:** [January 28, 2020, 10:19am UTC](https://discuss.elastic.co/t/indices-eating-too-much-space-50-gb-each/216609 "2020-01-28T10:19:12Z")
I'm using Elasticsearch 7.5.2 on uBuntu. Recently, I began using elasticsearch to display relevant search results on every page load. This shot up the volume; but I also found out that it has created large index files. N… --- ## [Import yaml pipeline](https://discuss.elastic.co/t/import-yaml-pipeline/236184)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 2\ **Last updated:** [June 8, 2020, 7:18pm UTC](https://discuss.elastic.co/t/import-yaml-pipeline/236184 "2020-06-08T19:18:55Z")
Hello, I'd like to manually insert ingest pipelines defined in filebeat, which is not yet released. In filebeat, these ingest pipelines are in yaml format, but are defined in json format in elasticsearch. How can I ea… --- ## [Kibana Unreachable from Network, Only local](https://discuss.elastic.co/t/kibana-unreachable-from-network-only-local/174463)
**Author:** [@teamg](https://discuss.elastic.co/u/teamg)\ **Replies:** 2\ **Last updated:** [April 1, 2019, 2:34pm UTC](https://discuss.elastic.co/t/kibana-unreachable-from-network-only-local/174463 "2019-04-01T14:34:58Z")
Just installed ELK 6.7 on a single node and it's working fine with the exception of Kibana. I can get to Kibana if I access it from a browser on the localhost but from a remote browser it times out. I have server.host … --- ## [Timelion - top hits aggregation](https://discuss.elastic.co/t/timelion-top-hits-aggregation/166731)
**Author:** [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)\ **Replies:** 2\ **Last updated:** [March 1, 2019, 3:28pm UTC](https://discuss.elastic.co/t/timelion-top-hits-aggregation/166731 "2019-03-01T15:28:11Z")
Hello, Is it possible to use top hits aggregation in Kibana Timelion? I do not found that metric in the list of metrics, but there is any solution to workaround? Thank you. --- ## [Filebeat 6.2.4 not processing JSON log and not submitting to Logstsash](https://discuss.elastic.co/t/filebeat-6-2-4-not-processing-json-log-and-not-submitting-to-logstsash/130715)
**Author:** [@pbala2018](https://discuss.elastic.co/u/pbala2018)\ **Replies:** 2\ **Last updated:** [May 10, 2018, 2:00pm UTC](https://discuss.elastic.co/t/filebeat-6-2-4-not-processing-json-log-and-not-submitting-to-logstsash/130715 "2018-05-10T14:00:22Z")
Hi, I am trying to process a simple JSON file into Logstash but i see the logstash which is listening at port 5045 is not receiving any data from filebeat. Here is my filebeat and logstash config #====================… --- ## [Is publishing events thread safe?](https://discuss.elastic.co/t/is-publishing-events-thread-safe/102877)
**Author:** [@jmegin](https://discuss.elastic.co/u/jmegin)\ **Replies:** 2\ **Last updated:** [October 6, 2017, 1:56pm UTC](https://discuss.elastic.co/t/is-publishing-events-thread-safe/102877 "2017-10-06T13:56:14Z")
The developer guide shows how to create an instance of publisher.Client, but I'm wondering if it's PublishEvent and PublishEvents methods are thread safe. I'm currently working on a beat that receives HTTP requests and … --- ## [Flows detected on port 6379, but no Redis Protocol logs generated?](https://discuss.elastic.co/t/flows-detected-on-port-6379-but-no-redis-protocol-logs-generated/97007)
**Author:** [@Bobby](https://discuss.elastic.co/u/Bobby)\ **Replies:** 2\ **Last updated:** [August 15, 2017, 8:50pm UTC](https://discuss.elastic.co/t/flows-detected-on-port-6379-but-no-redis-protocol-logs-generated/97007 "2017-08-15T20:50:47Z")
I'm not seeing Redis Protocol logs, but I am seeing flows to and from the Redis port. Why would that the case? I have the Redis Protocol enabled in my packetbeat.yml file: packetbeat.protocols.redis: # Configure the … --- ## [Elasticsearch docker - logs are spammed with "Content type detection for rest requests is deprecated."](https://discuss.elastic.co/t/elasticsearch-docker-logs-are-spammed-with-content-type-detection-for-rest-requests-is-deprecated/92779)
**Author:** [@Josef\_Cech](https://discuss.elastic.co/u/Josef_Cech)\ **Replies:** 2\ **Last updated:** [July 12, 2017, 8:56am UTC](https://discuss.elastic.co/t/elasticsearch-docker-logs-are-spammed-with-content-type-detection-for-rest-requests-is-deprecated/92779 "2017-07-12T08:56:54Z")
Hi. When I start elasticsearch 5.5.0 via docker then it keeps spamming logs with this message (it's generated every two seconds or so): elasticsearch\_1 | \[2017-07-12T08:07:23,432\]\[WARN \]\[o.e.d.r.RestController … --- ## [Missing docvalue fields on reindex](https://discuss.elastic.co/t/missing-docvalue-fields-on-reindex/83039)
**Author:** [@Xavi\_Ametller](https://discuss.elastic.co/u/Xavi_Ametller)\ **Replies:** 2\ **Last updated:** [May 4, 2017, 6:34am UTC](https://discuss.elastic.co/t/missing-docvalue-fields-on-reindex/83039 "2017-05-04T06:34:02Z")
Hello there, I'm using the reindex api endpoint to create a reduced version of an index: POST /\_reindex { "size": 10, "source": { "index": "big-index", "\_source": \["\*"\], "query": { "match\_all": … --- ## [Marvel Sense is not working in Internet Explorer](https://discuss.elastic.co/t/marvel-sense-is-not-working-in-internet-explorer/22424)
**Author:** [@Anandkumar\_Gunasekar](https://discuss.elastic.co/u/Anandkumar_Gunasekar)\ **Replies:** 2\ **Last updated:** [February 27, 2015, 10:12am UTC](https://discuss.elastic.co/t/marvel-sense-is-not-working-in-internet-explorer/22424 "2015-02-27T10:12:47Z")
Hi All, I am unable to execute any commands in Marvel Sense in Internet Explorer browser where as in Chrome / Mozilla it is working properly. Could you please advise how to fix this issue? Also, please let me… --- ## [ElasticSearch DocumentId](https://discuss.elastic.co/t/elasticsearch-documentid/21396)
**Author:** [@Abhimanyu\_Nagrath](https://discuss.elastic.co/u/Abhimanyu_Nagrath)\ **Replies:** 2\ **Last updated:** [December 26, 2014, 8:30pm UTC](https://discuss.elastic.co/t/elasticsearch-documentid/21396 "2014-12-26T20:30:09Z")
Hi I am new to elastic search I want to know that how does elastic search maintain the doc\_id field for each document .and can we manually give the doc\_id while indexing and document? -- You received this messag… --- ## [Identifying User Who Acknowledged Security Alerts](https://discuss.elastic.co/t/identifying-user-who-acknowledged-security-alerts/363448)
**Author:** [@ej210](https://discuss.elastic.co/u/ej210)\ **Replies:** 1\ **Last updated:** [July 22, 2024, 10:45am UTC](https://discuss.elastic.co/t/identifying-user-who-acknowledged-security-alerts/363448 "2024-07-22T10:45:14Z")
Hello, I have not been able to find any documentation or threads but apparently there might be a way to track who acknowledged alerts within Kibana Security, it appears the field "kibana.alert.workflow\_assignment\_ids" co… --- ## [ElasticSearch Read/Write performance issue on Peak Load](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216)
**Author:** [@sahil441](https://discuss.elastic.co/u/sahil441)\ **Replies:** 3\ **Last updated:** [January 26, 2022, 3:26pm UTC](https://discuss.elastic.co/t/elasticsearch-read-write-performance-issue-on-peak-load/295216 "2022-01-26T15:26:21Z")
Context: We are running ES Cluster (ES Version - "7.9.1") with 3 Master-Nodes & 8 data-nodes (AWS-"r5.2xlarge") We are using the default ES thread pool configuration There are 2 indices having 5 shards each (used by th… --- ## [Close inactive option in filebeat](https://discuss.elastic.co/t/close-inactive-option-in-filebeat/292458)
**Author:** [@mangesh\_shinde](https://discuss.elastic.co/u/mangesh_shinde)\ **Replies:** 3\ **Last updated:** [December 20, 2021, 5:06pm UTC](https://discuss.elastic.co/t/close-inactive-option-in-filebeat/292458 "2021-12-20T17:06:15Z")
I do have file which may in active for long time so I cant use close\_inactive option in filebeat so is there any option to disable this. inactivity time might be days so --- ## [Watcher gmail notification in docker-compose](https://discuss.elastic.co/t/watcher-gmail-notification-in-docker-compose/245867)
**Author:** [@vicom\_sistemas](https://discuss.elastic.co/u/vicom_sistemas)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 4:12pm UTC](https://discuss.elastic.co/t/watcher-gmail-notification-in-docker-compose/245867 "2020-09-16T16:12:09Z")
Hi, I´m trying to setup watcher to send emails using gmail. I´m using a docker-compose but every time I add x-pack settings to it, I receive the following error: unknown setting \[xpack.notification.email.account.smtp.a… --- ## [Multiple Logstash to a single Elasticsearch](https://discuss.elastic.co/t/multiple-logstash-to-a-single-elasticsearch/216764)
**Author:** [@Prajwal\_Bhusari](https://discuss.elastic.co/u/Prajwal_Bhusari)\ **Replies:** 3\ **Last updated:** [January 29, 2020, 5:08am UTC](https://discuss.elastic.co/t/multiple-logstash-to-a-single-elasticsearch/216764 "2020-01-29T05:08:50Z")
I had to make a log analyzer. My friend has created a same thing last year to analyze log using ELK stack but it take 30-40 mins for logstash processing in his project. Is there any way that I can use multiple Logstash i… --- ## [CPU utilization by process name and cmdline](https://discuss.elastic.co/t/cpu-utilization-by-process-name-and-cmdline/125828)
**Author:** [@Wanderer](https://discuss.elastic.co/u/Wanderer)\ **Replies:** 3\ **Last updated:** [March 28, 2018, 2:18pm UTC](https://discuss.elastic.co/t/cpu-utilization-by-process-name-and-cmdline/125828 "2018-03-28T14:18:11Z")
Is there a way to chart CPU utilization by process name and cmdline? Example: QEMU-KVM runs per VM so if you are running multiple VM's there is a QEMU-KVM process for each. Is there a way to chart the CPU usage for eac… [Previous page](https://discuss.elastic.co/top.md?page=1612&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1614&per_page=50&period=all)