# Top **URL:** https://discuss.elastic.co/top.md?page=1616&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1617 --- ## [Using a threshold on doc\_count within a nested aggregation](https://discuss.elastic.co/t/using-a-threshold-on-doc-count-within-a-nested-aggregation/260357)
**Author:** [@pschwippert](https://discuss.elastic.co/u/pschwippert)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-a-threshold-on-doc-count-within-a-nested-aggregation/260357 "2021-01-07T09:06:10Z")
Hi, I am currnetly working on a watcher that send out an alert when a user has too many failed login attempts. I am aggregating the documents first based on the realm then based on the username. Now within the compare … --- ## [Rollup of apm indices](https://discuss.elastic.co/t/rollup-of-apm-indices/236327)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 4\ **Last updated:** [June 10, 2020, 2:51pm UTC](https://discuss.elastic.co/t/rollup-of-apm-indices/236327 "2020-06-10T14:51:42Z")
Hello! Has anyone tried to rollup APM indices? Is it even possible? Thank you in advance for any feedback :slight\_smile: --- ## [Recover .kibana index from file backup](https://discuss.elastic.co/t/recover-kibana-index-from-file-backup/235456)
**Author:** [@EricW](https://discuss.elastic.co/u/EricW)\ **Replies:** 4\ **Last updated:** [June 3, 2020, 5:46am UTC](https://discuss.elastic.co/t/recover-kibana-index-from-file-backup/235456 "2020-06-03T05:46:33Z")
Hi All, I was silly enough to delete the .kibana index without a restore, but I do have a file based backup of previous state. Unfortunately, I can't find any documentation that details the process for restoring just t… --- ## [Add field in logstash of Winlogbeats input](https://discuss.elastic.co/t/add-field-in-logstash-of-winlogbeats-input/226672)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 4\ **Last updated:** [April 6, 2020, 2:51pm UTC](https://discuss.elastic.co/t/add-field-in-logstash-of-winlogbeats-input/226672 "2020-04-06T14:51:23Z")
Hello there ! I have the following Winlogbeat ouput in Logstash : { "ecs" =\> { "version" =\> "1.4.0" }, "log" =\> { "level" =\> "information" }, "@version" =\> "1", … --- ## [Update document without id](https://discuss.elastic.co/t/update-document-without-id/178654)
**Author:** [@dililili](https://discuss.elastic.co/u/dililili)\ **Replies:** 4\ **Last updated:** [April 29, 2019, 11:56am UTC](https://discuss.elastic.co/t/update-document-without-id/178654 "2019-04-29T11:56:17Z")
I'm pretty new to logstash. I have an index called person in Kibana. The index includes firstname, lastname, email, address... Now I need to update person's address by using a table in database. My table only have emails… --- ## [Allocate\_stale\_primary appears to succeed on wrong node](https://discuss.elastic.co/t/allocate-stale-primary-appears-to-succeed-on-wrong-node/172452)
**Author:** [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Replies:** 4\ **Last updated:** [March 15, 2019, 8:35am UTC](https://discuss.elastic.co/t/allocate-stale-primary-appears-to-succeed-on-wrong-node/172452 "2019-03-15T08:35:16Z")
Hi, I'm facing the same issue in v6.4.2 version and this is fixed in v6.5.1 as per below mentioned link. I just want to know that is there any workaround to fix this problem in v6.4.2. Regards, Harsh Bajaj --- ## [Elasticsearch First Response is very slow](https://discuss.elastic.co/t/elasticsearch-first-response-is-very-slow/164245)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 4\ **Last updated:** [January 15, 2019, 7:30am UTC](https://discuss.elastic.co/t/elasticsearch-first-response-is-very-slow/164245 "2019-01-15T07:30:10Z")
I have 7 days of data in 3 node cluster. 1 shard per index with one segment. I am planning to have data for 90 days later. I try to view data for last 90 days(only 7 days of data really available) using date picker in k… --- ## [Disappered keyword type when create index-pattern in Kibana](https://discuss.elastic.co/t/disappered-keyword-type-when-create-index-pattern-in-kibana/152342)
**Author:** [@andrsuh13](https://discuss.elastic.co/u/andrsuh13)\ **Replies:** 4\ **Last updated:** [October 18, 2018, 8:47am UTC](https://discuss.elastic.co/t/disappered-keyword-type-when-create-index-pattern-in-kibana/152342 "2018-10-18T08:47:28Z")
Hello, I have an such index: { "mapping": { "\_default\_": { "\_all": { "enabled": false }, "properties": { "name": { "type": "keyword" } } }, "doc"… --- ## [ES Script reusing the values](https://discuss.elastic.co/t/es-script-reusing-the-values/105451)
**Author:** [@samatha\_kankipati](https://discuss.elastic.co/u/samatha_kankipati)\ **Replies:** 4\ **Last updated:** [November 14, 2017, 3:24pm UTC](https://discuss.elastic.co/t/es-script-reusing-the-values/105451 "2017-11-14T15:24:09Z")
Hi, We have script field stored in file. We need script field to display and also for sorting. Looks like script is executed two times, one for showing the field in the response and another time for sorting. Is there … --- ## [/\_snapshot endpoint API documentation](https://discuss.elastic.co/t/snapshot-endpoint-api-documentation/103404)
**Author:** [@SimoneCafiero](https://discuss.elastic.co/u/SimoneCafiero)\ **Replies:** 4\ **Last updated:** [October 10, 2017, 5:05pm UTC](https://discuss.elastic.co/t/snapshot-endpoint-api-documentation/103404 "2017-10-10T17:05:41Z")
Hi guys, is there a complete documentation of the following API endpoint: /\_snapshot I would like to know if it's possible to edit backup metadata names (snap-CUSTOM\_NAME or meta-CUSTOM\_NAME instead of having a rando… --- ## [Count of orders in a certain state](https://discuss.elastic.co/t/count-of-orders-in-a-certain-state/95943)
**Author:** [@jessxyz](https://discuss.elastic.co/u/jessxyz)\ **Replies:** 4\ **Last updated:** [August 9, 2017, 2:13pm UTC](https://discuss.elastic.co/t/count-of-orders-in-a-certain-state/95943 "2017-08-09T14:13:17Z")
I have data coming into elastic search throughout the day. Each data consist of an order or an order update. For example: Order A created, Order B created, Order A processed, Order A Shipped, etc… The state of the order… --- ## [Unexpected match\_phrase\_prefix query result](https://discuss.elastic.co/t/unexpected-match-phrase-prefix-query-result/81111)
**Author:** [@heni](https://discuss.elastic.co/u/heni)\ **Replies:** 4\ **Last updated:** [April 8, 2017, 3:48pm UTC](https://discuss.elastic.co/t/unexpected-match-phrase-prefix-query-result/81111 "2017-04-08T15:48:50Z")
Any explanation why match\_phrase\_prefix search for "good m" failes while "good mo" search is successfull? The doc in my index is: { "index": "searchltv\_2017-04-02t08:40:01.000z", "\_type": "eng", "id": "uri:prg:pass… --- ## [FALSE Drupal indexing counter](https://discuss.elastic.co/t/false-drupal-indexing-counter/46516)
**Author:** [@fadi](https://discuss.elastic.co/u/fadi)\ **Replies:** 4\ **Last updated:** [April 7, 2016, 7:03am UTC](https://discuss.elastic.co/t/false-drupal-indexing-counter/46516 "2016-04-07T07:03:40Z")
Hi, I have installed on Centos server: \* Elasticsearch 1.7 \* Logstash 1.5 Installed on Drupal 7: \* Elasticsearch Connector \* Elasticsearch Connector Search API When i index manually from admin/config/search/search\_ap… --- ## [Wares Plugin : Dynamic & Config Mappings question](https://discuss.elastic.co/t/wares-plugin-dynamic-config-mappings-question/5460)
**Author:** [@antonio\_fernandez](https://discuss.elastic.co/u/antonio_fernandez)\ **Replies:** 4\ **Last updated:** [October 3, 2011, 7:45am UTC](https://discuss.elastic.co/t/wares-plugin-dynamic-config-mappings-question/5460 "2011-10-03T07:45:53Z")
Hi, this is my first post on this mailing list, Greetings from Málaga, Spain :D @shay : Congratulations, the ES approach seems very, very interesting. A few notes : - We find very attractive the ability to … --- ## [Performance bottleneck enriching documents due to only a single node processing the ingest pipelines](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950)
**Author:** [@JvSPV](https://discuss.elastic.co/u/JvSPV)\ **Replies:** 6\ **Last updated:** [October 12, 2022, 3:24pm UTC](https://discuss.elastic.co/t/performance-bottleneck-enriching-documents-due-to-only-a-single-node-processing-the-ingest-pipelines/315950 "2022-10-12T15:24:03Z")
We have a cluster of 4 nodes: A, B, C, and D. All four have all default roles assigned, including the ingest role. We also have a separate master node. We have recently put new ingest pipelines into use with which we en… --- ## [Logstash is not picking up the files](https://discuss.elastic.co/t/logstash-is-not-picking-up-the-files/232132)
**Author:** [@srinjan\_dutta](https://discuss.elastic.co/u/srinjan_dutta)\ **Replies:** 6\ **Last updated:** [May 14, 2020, 12:26pm UTC](https://discuss.elastic.co/t/logstash-is-not-picking-up-the-files/232132 "2020-05-14T12:26:47Z")
Hi All, I am stuck with this for 3 -4 weeks . I have a configuration file as below and trying to pick up a xml file using logstash. I have used all the resources available under the sun to resolve it but to no avail. I… --- ## [How to ingest searchservice in Plugin](https://discuss.elastic.co/t/how-to-ingest-searchservice-in-plugin/141945)
**Author:** [@hiral2cool](https://discuss.elastic.co/u/hiral2cool)\ **Replies:** 6\ **Last updated:** [August 8, 2018, 11:59am UTC](https://discuss.elastic.co/t/how-to-ingest-searchservice-in-plugin/141945 "2018-08-08T11:59:57Z")
I want to create a REST Plugin in that I want to inject SearchService to play around with the tokens and frequencies so please suggest how to achieve the same --- ## [How to create separate index for separate devices?](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 6\ **Last updated:** [March 20, 2018, 6:50pm UTC](https://discuss.elastic.co/t/how-to-create-separate-index-for-separate-devices/124410 "2018-03-20T18:50:30Z")
Hi there, I have around 8-10 devices which are sending logs to logstash over syslog. I need to if I can have separate index created per dvice? like logstash-router1-, logstash-firewall-, logstash-nginx-\* and so on? Wha… --- ## [There is huge delay starting up logstash 5.0.0-alpha5](https://discuss.elastic.co/t/there-is-huge-delay-starting-up-logstash-5-0-0-alpha5/59935)
**Author:** [@madkoala](https://discuss.elastic.co/u/madkoala)\ **Replies:** 6\ **Last updated:** [September 8, 2016, 3:19am UTC](https://discuss.elastic.co/t/there-is-huge-delay-starting-up-logstash-5-0-0-alpha5/59935 "2016-09-08T03:19:40Z")
We're using Elastic Stack 5.0.0-alpha5. We have very big trouble starting up Logstash. Logstash won't start up after executing (as a service) over 1+ hours. Process is alive, but there's no messages or logs even with … --- ## [How to remove brackets on grok patterns?](https://discuss.elastic.co/t/how-to-remove-brackets-on-grok-patterns/310547)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [August 12, 2022, 11:34pm UTC](https://discuss.elastic.co/t/how-to-remove-brackets-on-grok-patterns/310547 "2022-08-12T23:34:44Z")
Continuing the discussion from Remove characters in grok: On the previous post is an example of how to remove "," in grok. I was wondering if there is something to remove the "\[,\]" as well. I still don't know if is it'… --- ## [Elastic Agent with fleet policy refuses to start properly](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [June 21, 2022, 6:14pm UTC](https://discuss.elastic.co/t/elastic-agent-with-fleet-policy-refuses-to-start-properly/307700 "2022-06-21T18:14:54Z")
My Elastic Agent that runs the Fleet policy stopped working a week or two ago. As it cannot start the Fleet server. # elastic-agent status Status: FAILED Message: (no message) Applications: \* filebeat (C… --- ## [Transaction duration in micro seconds](https://discuss.elastic.co/t/transaction-duration-in-micro-seconds/220713)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [February 25, 2020, 6:57pm UTC](https://discuss.elastic.co/t/transaction-duration-in-micro-seconds/220713 "2020-02-25T18:57:19Z")
Kibana version : 7.6 Elasticsearch version : 7.6 APM Server version : 7.3.2 APM Agent language and version : java 1.9.0 Fresh install or upgraded from other version? fresh install Is there anything special in your s… --- ## [High DiskIO with Proxmox + Ceph](https://discuss.elastic.co/t/high-diskio-with-proxmox-ceph/173851)
**Author:** [@Esity](https://discuss.elastic.co/u/Esity)\ **Replies:** 1\ **Last updated:** [March 26, 2019, 8:38am UTC](https://discuss.elastic.co/t/high-diskio-with-proxmox-ceph/173851 "2019-03-26T08:38:38Z")
Hello, I am currently running a Proxmox + Ceph cluster. It is backed by 17 256gb SSDs. I have noticed that my iowait times for CPU were terrible. a 2 core VM was spending 50-75% of it's cpu on IOWait. The only thing run… --- ## [Get correct disk usage stats ES API vs. x-pack monitoring](https://discuss.elastic.co/t/get-correct-disk-usage-stats-es-api-vs-x-pack-monitoring/135522)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 1\ **Last updated:** [June 12, 2018, 1:29pm UTC](https://discuss.elastic.co/t/get-correct-disk-usage-stats-es-api-vs-x-pack-monitoring/135522 "2018-06-12T13:29:25Z")
Hello all, I'm trying to improve my Elasticsearch monitoring and would need to be able to reliably query the total free disk space (that is available for Elasticsearch) of the cluster. In Kibana \> Monitoring I see U… --- ## [Elasticsearch curator installation amazon linux ami](https://discuss.elastic.co/t/elasticsearch-curator-installation-amazon-linux-ami/126793)
**Author:** [@Jathin](https://discuss.elastic.co/u/Jathin)\ **Replies:** 1\ **Last updated:** [April 4, 2018, 10:10pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-installation-amazon-linux-ami/126793 "2018-04-04T22:10:58Z")
Trying to install curator on amazon linux ami using RHEL7 yum repo and it fails with below error. Can you please help me to install it. And is RHEL7 the right repo? yum install elasticsearch-curator Loaded plugins: p… --- ## [Restarting Filebeat, replay all data of a file](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630)
**Author:** [@onezero-jung](https://discuss.elastic.co/u/onezero-jung)\ **Replies:** 1\ **Last updated:** [November 7, 2017, 2:13pm UTC](https://discuss.elastic.co/t/restarting-filebeat-replay-all-data-of-a-file/106630 "2017-11-07T14:13:51Z")
Filebeat sand data again in a file when restarting paths property is setted with absolute path. It is work well( Restarting filbert, does not send duplicate data) but setting with relative path, send duplicate data. … --- ## [Elasticsearch not starting on Debian 8](https://discuss.elastic.co/t/elasticsearch-not-starting-on-debian-8/69288)
**Author:** [@mysticmode](https://discuss.elastic.co/u/mysticmode)\ **Replies:** 1\ **Last updated:** [December 17, 2016, 1:10am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-on-debian-8/69288 "2016-12-17T01:10:25Z")
I have installed ES through deb package. and set the right file permissions (elasticsearch:elasticsearch) to the necessary folders including logs. But when I start it is showing this error. nirmal@magician:~$ sudo /e… --- ## [Trying to find the plugin download url for Kibana](https://discuss.elastic.co/t/trying-to-find-the-plugin-download-url-for-kibana/342179)
**Author:** [@Max\_Karimi](https://discuss.elastic.co/u/Max_Karimi)\ **Replies:** 8\ **Last updated:** [September 19, 2023, 12:57pm UTC](https://discuss.elastic.co/t/trying-to-find-the-plugin-download-url-for-kibana/342179 "2023-09-19T12:57:00Z")
Hi, I am trying to download and install APM plugin for Kibana according to this document Install Kibana plugins | Elastic Cloud on Kubernetes \[2.9\] | Elastic but I cannot find any download link for that plugin. anyone c… --- ## [Using two kibana for HA(active-active) - Pointing to the same Elastic cluster](https://discuss.elastic.co/t/using-two-kibana-for-ha-active-active-pointing-to-the-same-elastic-cluster/304283)
**Author:** [@jonatiao](https://discuss.elastic.co/u/jonatiao)\ **Replies:** 3\ **Last updated:** [May 9, 2022, 8:50pm UTC](https://discuss.elastic.co/t/using-two-kibana-for-ha-active-active-pointing-to-the-same-elastic-cluster/304283 "2022-05-09T20:50:36Z")
Hello, Is it possible to have two kibana, in different VMs, in an active-active state responding the the same address via LB? Browser(kibana.mydomain.com) -\> LB -\> kibana1,kibana2 If yes, what are the configurations w… --- ## [「APM .NET Agent」の「ASP.NET」の設定方法](https://discuss.elastic.co/t/apm-net-agent-asp-net/258235)
**Author:** [@mukai](https://discuss.elastic.co/u/mukai)\ **Replies:** 3\ **Last updated:** [December 16, 2020, 2:09pm UTC](https://discuss.elastic.co/t/apm-net-agent-asp-net/258235 "2020-12-16T14:09:48Z")
こんにちは。 ASP.NET (Full .NET Framework)に、elasticのAPM Agentを導入したいと考えています。 関連する部分のドキュメントを見たのですが、他のソフトと違い詳細な手順が書かれておらず、うまく設定できません。 (何をダウンロードするか・具体的にどこの設定ファイルにどの様に書けば動作するかの例) 日本語・英語は問いませんので、何か参考になりそうな記事(実践例・手順書)がありまし… --- ## [Merge field message and msg](https://discuss.elastic.co/t/merge-field-message-and-msg/232644)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 3\ **Last updated:** [May 14, 2020, 2:37pm UTC](https://discuss.elastic.co/t/merge-field-message-and-msg/232644 "2020-05-14T14:37:53Z")
Hi guys, I noticed today that for some pods log messages are available in the message field, while for others they in the msg field. Is there some way to merge this field or make them all available over a pointer that l… --- ## [New config adds mappings to other indicies](https://discuss.elastic.co/t/new-config-adds-mappings-to-other-indicies/188669)
**Author:** [@sfio](https://discuss.elastic.co/u/sfio)\ **Replies:** 8\ **Last updated:** [July 4, 2019, 1:05pm UTC](https://discuss.elastic.co/t/new-config-adds-mappings-to-other-indicies/188669 "2019-07-04T13:05:18Z")
Hi everybody, I´ve got a problem with a config file, which updates mappings of existing ones. Environment: one Debian Server with ES 7.1.1 Configs: system\_action\_job.conf input { jdbc { jdbc\_driver\_library =\> … --- ## [Logstash 에서 여러개의 구분자가 포함된 string 에 대한 split 작업시 질문 드립니다.](https://discuss.elastic.co/t/logstash-string-split/164484)
**Author:** [@Jinam\_Lee](https://discuss.elastic.co/u/Jinam_Lee)\ **Replies:** 0\ **Last updated:** [January 16, 2019, 2:42pm UTC](https://discuss.elastic.co/t/logstash-string-split/164484 "2019-01-16T14:42:39Z")
안녕하세요. 먼저 설치 환경 정보는 아래와 같습니다. 환경 : Logstash 6.5.0 (windows x64) "3000=A.B.C.D,4000=A.B.C.D.E" 위의 데이터를 가져와서 , (콤마) 기호로 split 을 처리하는 작업은 성공하였으나 다시 .(dot) 기호로 split 을 하여 array 로 표현을 하고 싶습니다. 아래와 같이 데이가 output 이 되고 있으나 … --- ## [How to identify logstash pipeline status as complete?](https://discuss.elastic.co/t/how-to-identify-logstash-pipeline-status-as-complete/140515)
**Author:** [@abhisheksimion](https://discuss.elastic.co/u/abhisheksimion)\ **Replies:** 3\ **Last updated:** [July 20, 2018, 6:39am UTC](https://discuss.elastic.co/t/how-to-identify-logstash-pipeline-status-as-complete/140515 "2018-07-20T06:39:53Z")
I have below 2 queries Is there a specific key in logstash API response which can identify that a pipeline (incremental) completed successfully? I checked this where the Pipeline stats give an event response ...in, fi… --- ## [Snapshot & Minio](https://discuss.elastic.co/t/snapshot-minio/125075)
**Author:** [@bitva77](https://discuss.elastic.co/u/bitva77)\ **Replies:** 3\ **Last updated:** [April 10, 2018, 8:03am UTC](https://discuss.elastic.co/t/snapshot-minio/125075 "2018-04-10T08:03:49Z")
Hi! Is it possible to change the S3 URL to be something custom? Like a Minio server, for example. I tried setting s3.client.default.endpoint to our internal Minio server yet ES is still trying to hit AWS. I'm POST'i… --- ## [Complex Config Options via Command Line](https://discuss.elastic.co/t/complex-config-options-via-command-line/119306)
**Author:** [@ace1](https://discuss.elastic.co/u/ace1)\ **Replies:** 3\ **Last updated:** [February 14, 2018, 6:13pm UTC](https://discuss.elastic.co/t/complex-config-options-via-command-line/119306 "2018-02-14T18:13:00Z")
Is there any way to pass the more complex config items, such as regionmap, via the command line when starting Kibana? --- ## [Event field in logstash output](https://discuss.elastic.co/t/event-field-in-logstash-output/115717)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 3\ **Last updated:** [January 16, 2018, 6:39pm UTC](https://discuss.elastic.co/t/event-field-in-logstash-output/115717 "2018-01-16T18:39:37Z")
Hi, in my logstash config in output part I have sns settings: sns { region =\> "eu-west-1" arn =\> "xxxx" } It works but every event has inside field called "SNSregion" that contains region (we get it from user gui...). … --- ## [Configuring logstash-input-jms plugin to read WebSphere JMS queue](https://discuss.elastic.co/t/configuring-logstash-input-jms-plugin-to-read-websphere-jms-queue/77490)
**Author:** [@Ranieri\_Mazili\_de\_Ol](https://discuss.elastic.co/u/Ranieri_Mazili_de_Ol)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 11:31am UTC](https://discuss.elastic.co/t/configuring-logstash-input-jms-plugin-to-read-websphere-jms-queue/77490 "2017-03-06T11:31:11Z")
I'm trying to connect to a WebSphere JMS. I can connect to it using HermesJMS and below are the steps need to connect to my queue using HermesJMS and then what I tried to connection using logstash-plugin-jms. Please, I r… --- ## [Always get max results using search from browser](https://discuss.elastic.co/t/always-get-max-results-using-search-from-browser/61387)
**Author:** [@dkarnecki](https://discuss.elastic.co/u/dkarnecki)\ **Replies:** 3\ **Last updated:** [September 23, 2016, 2:00pm UTC](https://discuss.elastic.co/t/always-get-max-results-using-search-from-browser/61387 "2016-09-23T14:00:02Z")
We recently began using browsers to make Elastic Search searches. No matter what I enter into the browser for a \_search "search string" I receive ALL records as a result. Am I formatting my searches incorrectly or wha… --- ## [Why is (RPM) elasticsearch installed in /usr/share?](https://discuss.elastic.co/t/why-is-rpm-elasticsearch-installed-in-usr-share/60251)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 3\ **Last updated:** [September 12, 2016, 2:28pm UTC](https://discuss.elastic.co/t/why-is-rpm-elasticsearch-installed-in-usr-share/60251 "2016-09-12T14:28:19Z")
I noticed that both Kibana and Logstash, the RPM versions, install by default in /opt. This is correct, imo. On the other hand, Elasticsearch installs by default in /usr/share. According to the FHS, this directory is for… --- ## [Performance of Elasticsearch based on number of doc counts](https://discuss.elastic.co/t/performance-of-elasticsearch-based-on-number-of-doc-counts/54902)
**Author:** [@KaranPanchal](https://discuss.elastic.co/u/KaranPanchal)\ **Replies:** 3\ **Last updated:** [July 11, 2016, 7:08am UTC](https://discuss.elastic.co/t/performance-of-elasticsearch-based-on-number-of-doc-counts/54902 "2016-07-11T07:08:56Z")
Hi, I am using Elasticsearch 2.2.0. I want to know that, will Elasticsearch compromise with the search performance if we index data on a single index with doc counts of more than 30,00,000 events. (doc counts can be more… --- ## [How to format memory number to show](https://discuss.elastic.co/t/how-to-format-memory-number-to-show/43612)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 3\ **Last updated:** [March 7, 2016, 9:00pm UTC](https://discuss.elastic.co/t/how-to-format-memory-number-to-show/43612 "2016-03-07T21:00:47Z")
How to format the digital display. For example: memory beat, 8GB acquisition is 8504496128, I want to show as 8GB, so that it looks more intuitive. Thanks --- ## [Pulling logs into logstash without running an agent on every vm](https://discuss.elastic.co/t/pulling-logs-into-logstash-without-running-an-agent-on-every-vm/42605)
**Author:** [@cshawler](https://discuss.elastic.co/u/cshawler)\ **Replies:** 3\ **Last updated:** [February 24, 2016, 6:59pm UTC](https://discuss.elastic.co/t/pulling-logs-into-logstash-without-running-an-agent-on-every-vm/42605 "2016-02-24T18:59:33Z")
Is there away to pull logs into logstash without installing a shipper agent on every vm? --- ## [Question about node sniffing in the Java Client](https://discuss.elastic.co/t/question-about-node-sniffing-in-the-java-client/41477)
**Author:** [@Dominik\_Stadler](https://discuss.elastic.co/u/Dominik_Stadler)\ **Replies:** 3\ **Last updated:** [February 11, 2016, 5:09pm UTC](https://discuss.elastic.co/t/question-about-node-sniffing-in-the-java-client/41477 "2016-02-11T17:09:13Z")
The documentation at https://www.elastic.co/guide/en/elasticsearch/client/java-api/current/transport-client.html just briefly mentions the option to make the Client find other nodes automatically via the option "client.t… --- ## [Use http output to send data](https://discuss.elastic.co/t/use-http-output-to-send-data/39862)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 3\ **Last updated:** [February 3, 2016, 11:30am UTC](https://discuss.elastic.co/t/use-http-output-to-send-data/39862 "2016-02-03T11:30:12Z")
At my company we have our own database. We can store data into it by making http requests to it. So I wanted to store logs to the database using http output method. Now there is a multitude of logs and its big data in it… --- ## [Issue with singleton analyzer in single JVM multi-index setup](https://discuss.elastic.co/t/issue-with-singleton-analyzer-in-single-jvm-multi-index-setup/22716)
**Author:** [@Dmitry\_Kan](https://discuss.elastic.co/u/Dmitry_Kan)\ **Replies:** 8\ **Last updated:** [March 20, 2015, 4:55am UTC](https://discuss.elastic.co/t/issue-with-singleton-analyzer-in-single-jvm-multi-index-setup/22716 "2015-03-20T04:55:11Z")
Hello! I'm a newbie in elasticsearch, so forgive if the question is lame. I have implemented a custom plugin using a custom lemmatizer and a tokenizer. The simplified class sequence: AnalysisMorphologyPlugi… --- ## [SearchContextMissingException](https://discuss.elastic.co/t/searchcontextmissingexception/4844)
**Author:** [@senthil\_prabhu](https://discuss.elastic.co/u/senthil_prabhu)\ **Replies:** 3\ **Last updated:** [July 13, 2011, 9:59am UTC](https://discuss.elastic.co/t/searchcontextmissingexception/4844 "2011-07-13T09:59:34Z")
Hi, i am using ES 16.0. while searching with child query and search type as dfs\_query\_then\_fetch. i have got below error. {"took":407125,"timed\_out":false,"\_shards":{"total":6,"successful": 2,"failed":4,"fail… --- ## [Return first/last/mid characters of a keyword field](https://discuss.elastic.co/t/return-first-last-mid-characters-of-a-keyword-field/306372)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 2\ **Last updated:** [June 29, 2022, 5:24am UTC](https://discuss.elastic.co/t/return-first-last-mid-characters-of-a-keyword-field/306372 "2022-06-29T05:24:46Z")
I have a field account name that has string values with spaces. I would like to return the first 5 and last 4 characters of each value in this field in a runtime painless field. how can this be done? thanks --- ## [Different cluster ID for nodes](https://discuss.elastic.co/t/different-cluster-id-for-nodes/277440)
**Author:** [@Rojal\_Paul](https://discuss.elastic.co/u/Rojal_Paul)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:05pm UTC](https://discuss.elastic.co/t/different-cluster-id-for-nodes/277440 "2021-07-13T13:05:50Z")
I tried to join the cluster, when i am see the status the cluster names are correct but cluster ID is different for each nodes. I have 3 nodes ELKN1,ELKN2,ELKN3. I also added the cluster status image it showing … --- ## [\[ERROR\]\[logstash.filters.ruby \] Ruby exception occurred: undefined method \`\[\]' for #\](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occurred-undefined-method-for-logstash-0x9a18b32/269301)
**Author:** [@rumala](https://discuss.elastic.co/u/rumala)\ **Replies:** 2\ **Last updated:** [April 8, 2021, 9:57am UTC](https://discuss.elastic.co/t/error-logstash-filters-ruby-ruby-exception-occurred-undefined-method-for-logstash-0x9a18b32/269301 "2021-04-08T09:57:12Z")
Hello experts, I'm still learning about ELK. last week i set up my ELK lab. And I got error in my Logstash. I'm using logstash 7.5.1. I would like to parse through all fields of my Logstash and convert field starting wi… [Previous page](https://discuss.elastic.co/top.md?page=1615&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=1617&per_page=50&period=all)