# Top **URL:** https://discuss.elastic.co/top.md?page=187&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 188 --- ## [EC2 Cluster Failure](https://discuss.elastic.co/t/ec2-cluster-failure/4602)
**Author:** [@James\_Cook](https://discuss.elastic.co/u/James_Cook)\ **Replies:** 17\ **Last updated:** [June 16, 2011, 1:48pm UTC](https://discuss.elastic.co/t/ec2-cluster-failure/4602 "2011-06-16T13:48:27Z")
I'm experiencing a new problem with EC2 clustering using 0.16.0. I am starting two nodes on EC2, and during the discovery process I see this log: https://gist.github.com/1019038 My two nodes do not discover each … --- ## [Http.response 404](https://discuss.elastic.co/t/http-response-404/131322)
**Author:** [@ikrot](https://discuss.elastic.co/u/ikrot)\ **Replies:** 14\ **Last updated:** [June 13, 2018, 9:04am UTC](https://discuss.elastic.co/t/http-response-404/131322 "2018-06-13T09:04:50Z")
Hi, Could you help me please to figure out what is going on? Packetbeat returns http.response 404 for existing files. But in the same time when I check it manually with CURL it returns 200 packetbeat version 5.6.4 e… --- ## [Auditing Security Events visualizing](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 13\ **Last updated:** [October 31, 2018, 9:14am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929 "2018-10-31T09:14:13Z")
Hi All , I am going to enable Auditing Security Events . Its out put will be an index and a log file . My question is , how can we use this index and log file ? Is this events are visualizing in kibana ? In monitorin… --- ## [Сравнение документов внутри индекса](https://discuss.elastic.co/t/topic/268688)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 11\ **Last updated:** [April 13, 2021, 5:16pm UTC](https://discuss.elastic.co/t/topic/268688 "2021-04-13T17:16:23Z")
Всем привет. В индексе есть несколько типов документов. Одни документы - Input, другие - Output. В каждом документе есть поле session\_ID, которое отвечает за уникальность передачи сесии. Вопросы: Как связать/сопост… --- ## [Scripted field getting 12 hours date time difference](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999)
**Author:** [@ahmadsayeed3](https://discuss.elastic.co/u/ahmadsayeed3)\ **Replies:** 11\ **Last updated:** [October 8, 2020, 10:16am UTC](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999 "2020-10-08T10:16:22Z")
Hi, I am trying to get difference between current date time and a field(date time). Timezone for date formatting: UTC Date format: MM/D/YYYY HH:mm:ss.SSS Date with nanoseconds format: MMM D, YYYY @ HH:mm:ss.SSSSSSSS… --- ## [Logstash-filter-http Post Body error](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532)
**Author:** [@zurb3](https://discuss.elastic.co/u/zurb3)\ **Replies:** 9\ **Last updated:** [April 29, 2022, 3:24pm UTC](https://discuss.elastic.co/t/logstash-filter-http-post-body-error/303532 "2022-04-29T15:24:49Z")
I'm trying to get some kind of data enrichment using an API call to Abuse.ch as documents come into the pipeline. The logstash-filter-http plugin seems like the right answer, however it isn't working for what I need it t… --- ## [Versioning problem with ElasticSearch](https://discuss.elastic.co/t/versioning-problem-with-elasticsearch/80624)
**Author:** [@Gynidark](https://discuss.elastic.co/u/Gynidark)\ **Replies:** 9\ **Last updated:** [March 30, 2017, 9:05am UTC](https://discuss.elastic.co/t/versioning-problem-with-elasticsearch/80624 "2017-03-30T09:05:38Z")
Hello, So, here I have updated Kibana but I am with an elasticsearch version more old... my version kibana : 5.0 Where to find version 6.0.0 of elasticsearch ? cordially. --- ## [Did elasticsearch cluster name includes special characters](https://discuss.elastic.co/t/did-elasticsearch-cluster-name-includes-special-characters/248329)
**Author:** [@chandu2](https://discuss.elastic.co/u/chandu2)\ **Replies:** 10\ **Last updated:** [September 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/did-elasticsearch-cluster-name-includes-special-characters/248329 "2020-09-14T12:50:19Z")
Did elasticsearch cluster name includes special characters. If Iam including I am getting error. Please anyone clarify on this. How can I use special characters also --- ## [Timelion request error ---\> \[parsing exception\]](https://discuss.elastic.co/t/timelion-request-error-parsing-exception/205695)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 14\ **Last updated:** [November 1, 2019, 3:28pm UTC](https://discuss.elastic.co/t/timelion-request-error-parsing-exception/205695 "2019-11-01T15:28:54Z")
Hi there, I'm trying to visualize and compare a daily unique count of "player\_id" from 2 different indices (session\_data and gameplay\_stat) using timelion. The request just for the first index vizualization looks like: … --- ## [What is the fastest storage type suitable for elasticsaerch than the HDD?](https://discuss.elastic.co/t/what-is-the-fastest-storage-type-suitable-for-elasticsaerch-than-the-hdd/371161)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 36\ **Last updated:** [December 11, 2024, 3:01pm UTC](https://discuss.elastic.co/t/what-is-the-fastest-storage-type-suitable-for-elasticsaerch-than-the-hdd/371161 "2024-12-11T15:01:24Z")
Hello can you help In order to store big data, what is the best type of HDD storage that is fast For example Qnap NAS is there a faster type than it? --- ## [Elasticsearch 7.10.2 backup](https://discuss.elastic.co/t/elasticsearch-7-10-2-backup/332642)
**Author:** [@jomaguca](https://discuss.elastic.co/u/jomaguca)\ **Replies:** 20\ **Last updated:** [May 8, 2023, 11:21am UTC](https://discuss.elastic.co/t/elasticsearch-7-10-2-backup/332642 "2023-05-08T11:21:52Z")
Hi everyone My name is José Manuel and I am trying to make a back from elasticsearch 7.10.2, but show me the next error # curl -X PUT localhost:9200/\_snapshot/my\_backup?pretty -H 'Content-Type: application/json' -d '{… --- ## [Office 365 Module - not an IP string literal](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727)
**Author:** [@ericbarnes](https://discuss.elastic.co/u/ericbarnes)\ **Replies:** 10\ **Last updated:** [June 9, 2020, 4:27pm UTC](https://discuss.elastic.co/t/office-365-module-not-an-ip-string-literal/232727 "2020-06-09T16:27:14Z")
Getting the following error with default o365 module setup. Casual glance seems to say this is mostly happening on Exchange related audit data but not enough to know yet. May 14 16:51:23 ainfcp1esl00001 filebeat: 2020-… --- ## [Time to timestamp issue](https://discuss.elastic.co/t/time-to-timestamp-issue/113455)
**Author:** [@uvarisubash](https://discuss.elastic.co/u/uvarisubash)\ **Replies:** 10\ **Last updated:** [January 18, 2018, 9:54pm UTC](https://discuss.elastic.co/t/time-to-timestamp-issue/113455 "2018-01-18T21:54:58Z")
Hi All, I use filter to extract the @time into a field of its own called "@time" message ==\> "@time": "2017-12-04T17:44:34" "@timestamp" =\> 2017-12-28T12:29:22.096Z, .conf file content input { file { path =\> "/hom… --- ## [Help Designing Index for PDF Documents](https://discuss.elastic.co/t/help-designing-index-for-pdf-documents/73790)
**Author:** [@coogle](https://discuss.elastic.co/u/coogle)\ **Replies:** 9\ **Last updated:** [February 3, 2017, 9:35pm UTC](https://discuss.elastic.co/t/help-designing-index-for-pdf-documents/73790 "2017-02-03T21:35:42Z")
Hello, I'm hoping someone can help a relative newbie on the best way to design a search index for a project I'm working on. Basically what I have is \< 1000 PDF documents sorted into a bit of a parent child relationship… --- ## [Filebeat error: log/prospector.go:437](https://discuss.elastic.co/t/filebeat-error-log-prospector-go-437/139741)
**Author:** [@\_kyllr](https://discuss.elastic.co/u/_kyllr)\ **Replies:** 16\ **Last updated:** [July 26, 2018, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-error-log-prospector-go-437/139741 "2018-07-26T14:10:45Z")
Hi, anyone from the team help me fix this issue. 2018-07-12T07:11:34.266-0400 ERROR log/prospector.go:437 Harvester could not be started on new file: d:\\logs\\azure\\data\\SignInEvent\_accenture.onmicrosoft.com\_2018-07-03T… --- ## [Default value http.content\_content\_length does not restricts ingestion of large documents](https://discuss.elastic.co/t/default-value-http-content-content-length-does-not-restricts-ingestion-of-large-documents/138853)
**Author:** [@sachinkarora](https://discuss.elastic.co/u/sachinkarora)\ **Replies:** 11\ **Last updated:** [July 25, 2018, 9:48am UTC](https://discuss.elastic.co/t/default-value-http-content-content-length-does-not-restricts-ingestion-of-large-documents/138853 "2018-07-25T09:48:25Z")
I am using FSCrawler to perform rich documents (PDF/PPT/DOCX etc.) ingestion into ElasticSearch and while doing some validation to check how much big file i can ingest, i tried ingesting a TXT file of 1GB and 2GB as well… --- ## [Grokparsefailure error is occurring](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295)
**Author:** [@vvsvinu](https://discuss.elastic.co/u/vvsvinu)\ **Replies:** 9\ **Last updated:** [February 14, 2018, 6:29am UTC](https://discuss.elastic.co/t/grokparsefailure-error-is-occurring/117295 "2018-02-14T06:29:54Z")
Hai, I have been receiving the grokparsefailure error lately. Plz find the output that contains the "\_grokparsefailure" and my configuration files are mentioned below. Plz help.. #######################################… --- ## [APM-server autodiscovery](https://discuss.elastic.co/t/apm-server-autodiscovery/288814)
**Author:** [@Sergio\_Ferreyra](https://discuss.elastic.co/u/Sergio_Ferreyra)\ **Replies:** 10\ **Last updated:** [November 15, 2021, 6:14pm UTC](https://discuss.elastic.co/t/apm-server-autodiscovery/288814 "2021-11-15T18:14:45Z")
Hi guys! I am using APM 7.15.0 version with kibana same version (ELK stack) We are using on kubernetes, and I like to know if APM supports autodiscovery, we are using it for filebeat metricbeat and heartbeat to add a cus… --- ## [How elastic ML detect anomaly?](https://discuss.elastic.co/t/how-elastic-ml-detect-anomaly/321551)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 11\ **Last updated:** [January 4, 2023, 5:01pm UTC](https://discuss.elastic.co/t/how-elastic-ml-detect-anomaly/321551 "2023-01-04T17:01:14Z")
Hi Community, In above screenshot the upper bound values is between 1 to 4.8 something On dec 12th at 9:15 it detect major anomaly it actual value was 3 , upper bound value was 0.754 and lower bound was 0 so in … --- ## [Count API Performance Downgraded After cluster upgrade from 6.8.4 to 7.5](https://discuss.elastic.co/t/count-api-performance-downgraded-after-cluster-upgrade-from-6-8-4-to-7-5/210783)
**Author:** [@jihua.zhong](https://discuss.elastic.co/u/jihua.zhong)\ **Replies:** 11\ **Last updated:** [December 16, 2019, 7:56pm UTC](https://discuss.elastic.co/t/count-api-performance-downgraded-after-cluster-upgrade-from-6-8-4-to-7-5/210783 "2019-12-16T19:56:20Z")
Hi, After cluster upgraded from 6.8.4 to 7.5.0. the performance on count api in 7.5 is much slower than in 6.8.4 in Kibana run this GET /myindex or alias/\_count in 6.8.4 all count API response time is under sub se… --- ## [Is kibana send e-mail bug fixed in 6.1.2?](https://discuss.elastic.co/t/is-kibana-send-e-mail-bug-fixed-in-6-1-2/117285)
**Author:** [@yuluopiaoyang](https://discuss.elastic.co/u/yuluopiaoyang)\ **Replies:** 9\ **Last updated:** [January 30, 2018, 4:36am UTC](https://discuss.elastic.co/t/is-kibana-send-e-mail-bug-fixed-in-6-1-2/117285 "2018-01-30T04:36:53Z")
Is kibana alert send e-mail bug fixed in 6.1.2? I still can't send e-mail.Or I have some wrong in config?This is my config. xpack.notification.email.account: outlook\_account: profile: outlook email\_defaults: from: c… --- ## [How to handle case when the INDEX value is not included in the "path" value?](https://discuss.elastic.co/t/how-to-handle-case-when-the-index-value-is-not-included-in-the-path-value/68510)
**Author:** [@chunji08](https://discuss.elastic.co/u/chunji08)\ **Replies:** 9\ **Last updated:** [December 21, 2016, 6:15pm UTC](https://discuss.elastic.co/t/how-to-handle-case-when-the-index-value-is-not-included-in-the-path-value/68510 "2016-12-21T18:15:21Z")
Hi there, I am working on a Elastic project that generally of this model: " Several LogStash Shippers that resides on respective hosts \<==\> one single Redis Server \<==\> multiple LogStash Indexer \<==\> one ElasticSear… --- ## [User defined dictionary in lingo3g for Elasticsearch wrt label/word/synonym](https://discuss.elastic.co/t/user-defined-dictionary-in-lingo3g-for-elasticsearch-wrt-label-word-synonym/16516)
**Author:** [@Prashant\_Pal](https://discuss.elastic.co/u/Prashant_Pal)\ **Replies:** 9\ **Last updated:** [April 17, 2014, 7:38am UTC](https://discuss.elastic.co/t/user-defined-dictionary-in-lingo3g-for-elasticsearch-wrt-label-word-synonym/16516 "2014-04-17T07:38:32Z")
While browsing the lingo3g manual I came across with http://download.carrotsearch.com/lingo3g/1.9.0/manual/#chapter.lexical-resources Which states that we can customize the name of the label as per pre defined Word/… --- ## [Access data event and field in logstash condition error](https://discuss.elastic.co/t/access-data-event-and-field-in-logstash-condition-error/112109)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 10\ **Last updated:** [December 17, 2017, 9:46am UTC](https://discuss.elastic.co/t/access-data-event-and-field-in-logstash-condition-error/112109 "2017-12-17T09:46:24Z")
Im ussing LS 6.1 When i use condition in logstash, it not work. i dont know that why? I should be run into condition (True) instead of False. It not run in " if \[nginx\]\[access\]\[remote\_ip\] { ... } " Sample log { "\_i… --- ## [Filebeat ship logs verbatim](https://discuss.elastic.co/t/filebeat-ship-logs-verbatim/69096)
**Author:** [@surajs](https://discuss.elastic.co/u/surajs)\ **Replies:** 10\ **Last updated:** [January 5, 2017, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-ship-logs-verbatim/69096 "2017-01-05T18:53:31Z")
I'm configuring filebeat 5.1.1 to output to kafka. I would like filebeat to output to the kafka topic the lines in the log file verbatim. Or move these fields under the \> beat field? This would allow us to easily mig… --- ## [How to reindex a single index into several time-indexed indexes](https://discuss.elastic.co/t/how-to-reindex-a-single-index-into-several-time-indexed-indexes/186109)
**Author:** [@DigitalMachinist](https://discuss.elastic.co/u/DigitalMachinist)\ **Replies:** 12\ **Last updated:** [June 19, 2019, 5:22pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-single-index-into-several-time-indexed-indexes/186109 "2019-06-19T17:22:58Z")
My company is running elastic 6.5.1 on Elastic Cloud. In the last couple of months our memory pressure maxed out our 2GB nodes, so we resized to 4GB. Very recently our memory pressure has maxed out again at 4GB and we're… --- ## [Es got blocked](https://discuss.elastic.co/t/es-got-blocked/6129)
**Author:** [@Sisu\_Alexandru](https://discuss.elastic.co/u/Sisu_Alexandru)\ **Replies:** 12\ **Last updated:** [December 19, 2011, 6:40pm UTC](https://discuss.elastic.co/t/es-got-blocked/6129 "2011-12-19T18:40:52Z")
Hello all, Our es suddenly got blocked for 15 minutes. That means: it suddenly stopped handling search requests and also status requests:curl -XGET http://localhost:9200/\_status. ES version: 0.18.5 The size of… --- ## [High memory taken by segments.terms\_memory\_in\_bytes](https://discuss.elastic.co/t/high-memory-taken-by-segments-terms-memory-in-bytes/299134)
**Author:** [@Vikrant\_Aggarwal](https://discuss.elastic.co/u/Vikrant_Aggarwal)\ **Replies:** 11\ **Last updated:** [March 9, 2022, 10:18am UTC](https://discuss.elastic.co/t/high-memory-taken-by-segments-terms-memory-in-bytes/299134 "2022-03-09T10:18:11Z")
Hello Experts, ES : 6.4 We have 21 data nodes cluster. Seeing high memory consumed by segments.terms\_memory\_in\_bytes which causing circuit breaker issues for us. Wanted to understand why segments are taking so much mem… --- ## [Elasticsearch 1.0.0 is now GA](https://discuss.elastic.co/t/elasticsearch-1-0-0-is-now-ga/15766)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 21\ **Last updated:** [February 28, 2014, 8:27pm UTC](https://discuss.elastic.co/t/elasticsearch-1-0-0-is-now-ga/15766 "2014-02-28T20:27:01Z")
I didn't see anything on the list, but there's a blog post about 1.0.0 hitting general availability! http://www.elasticsearch.org/blog/1-0-0-released/ Regards, Mark Walkom Infrastructure Engineer Campaign Mon… --- ## [Dataview with some columns excluded](https://discuss.elastic.co/t/dataview-with-some-columns-excluded/328942)
**Author:** [@joerg55](https://discuss.elastic.co/u/joerg55)\ **Replies:** 9\ **Last updated:** [March 30, 2023, 3:16pm UTC](https://discuss.elastic.co/t/dataview-with-some-columns-excluded/328942 "2023-03-30T15:16:35Z")
Hi community, I want to create a data view of an index without some columns. The background is that these columns lead to the display of 'no results' with certain filters. I only have this one index and I don't have the… --- ## [Issues with elasticsearch + autocomplete](https://discuss.elastic.co/t/issues-with-elasticsearch-autocomplete/8760)
**Author:** [@Niranjan](https://discuss.elastic.co/u/Niranjan)\ **Replies:** 9\ **Last updated:** [September 14, 2012, 7:49pm UTC](https://discuss.elastic.co/t/issues-with-elasticsearch-autocomplete/8760 "2012-09-14T19:49:56Z")
Hello everyone, I have implemented an autocomplete feature to my search input box and am using ngram filter for this. My index\_analyzer is ngram and search\_analyzer is standard. Along with this, I also use highli… --- ## [Not getting whole response when I search using java api client](https://discuss.elastic.co/t/not-getting-whole-response-when-i-search-using-java-api-client/359425)
**Author:** [@Rohini1](https://discuss.elastic.co/u/Rohini1)\ **Replies:** 13\ **Last updated:** [May 17, 2024, 9:37am UTC](https://discuss.elastic.co/t/not-getting-whole-response-when-i-search-using-java-api-client/359425 "2024-05-17T09:37:10Z")
I am using below code to search using java api client, SearchResponse searchResponse = esClient.search(searchRequest,Object.class); When I test it using postman - I am getting below response {"took":4,"timed\_out":fals… --- ## [Security for Elasticsearch](https://discuss.elastic.co/t/security-for-elasticsearch/269210)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 17\ **Last updated:** [April 8, 2021, 6:18am UTC](https://discuss.elastic.co/t/security-for-elasticsearch/269210 "2021-04-08T06:18:26Z")
I have followed everything on YouTube: Getting Star but I just made 1 elastic not 2 as requested. is that a problem? I have made the cert in / config and also I have followed everything I made the xpack in elasticsearc… --- ## [How to properly use Publicly signed Certifiate in kibana to communicate witih elastic?](https://discuss.elastic.co/t/how-to-properly-use-publicly-signed-certifiate-in-kibana-to-communicate-witih-elastic/345034)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 19\ **Last updated:** [October 17, 2023, 12:17am UTC](https://discuss.elastic.co/t/how-to-properly-use-publicly-signed-certifiate-in-kibana-to-communicate-witih-elastic/345034 "2023-10-17T00:17:01Z")
My elasticsearch.yml configuration xpack.security.http.ssl: enabled: true keystore.path: certs/certificates.p12 Bellow procedure has been followed to create certificate.p12 \> cat private-key.key certificate.crt \> … --- ## [Percentage repeats year over year](https://discuss.elastic.co/t/percentage-repeats-year-over-year/217680)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 9\ **Last updated:** [February 6, 2020, 9:54pm UTC](https://discuss.elastic.co/t/percentage-repeats-year-over-year/217680 "2020-02-06T21:54:26Z")
I am relatively new to ELK. Unfortunately I'm a sysadmin and definitely not an analytics person. This means that while I've been able to setup the ELK stack and even injest and work with data, I am pretty novice at doi… --- ## [Combining metricbeat and winlogbeat](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 9\ **Last updated:** [May 15, 2018, 11:59am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177 "2018-05-15T11:59:41Z")
Is it possible to save winlogbeat output and metricbeat output to same index in elasticsearch ? if yes, what do i need to do for that ? --- ## [Recherche et priorisation des résultat](https://discuss.elastic.co/t/recherche-et-priorisation-des-resultat/133529)
**Author:** [@RSTMAN](https://discuss.elastic.co/u/RSTMAN)\ **Replies:** 14\ **Last updated:** [June 8, 2018, 9:33am UTC](https://discuss.elastic.co/t/recherche-et-priorisation-des-resultat/133529 "2018-06-08T09:33:16Z")
Bonjour, j'ai des données dans elasticsearch qui ressemblent à ça: { "took": 1, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 }, "hits": { "total"… --- ## [Aggregations failing on fields with custom analyzer](https://discuss.elastic.co/t/aggregations-failing-on-fields-with-custom-analyzer/22259)
**Author:** [@Anil\_Karaka](https://discuss.elastic.co/u/Anil_Karaka)\ **Replies:** 11\ **Last updated:** [March 10, 2015, 1:30pm UTC](https://discuss.elastic.co/t/aggregations-failing-on-fields-with-custom-analyzer/22259 "2015-03-10T13:30:25Z")
I wanted a custom analyzer that behaves exactly like not\_analyzed, except that fields are case insensitive.. I have my analyzer as below, "index": { "analysis": { "analyzer"… --- ## [Elasticsearch 5.4, delete\_by\_query, merge, TB scale](https://discuss.elastic.co/t/elasticsearch-5-4-delete-by-query-merge-tb-scale/90810)
**Author:** [@seilat](https://discuss.elastic.co/u/seilat)\ **Replies:** 10\ **Last updated:** [July 5, 2017, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-5-4-delete-by-query-merge-tb-scale/90810 "2017-07-05T18:04:59Z")
Hi, We are planning a xxTB (double digit) cluster of Elasticsearch 5.4. The data model is ~10K indices, each index ~10GB of data accumulated over a period of one month per index (or ~330MB per day per index), with new … --- ## [Where elasticsearch stores policy? and how it picks up?](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622)
**Author:** [@abb](https://discuss.elastic.co/u/abb)\ **Replies:** 17\ **Last updated:** [August 1, 2020, 5:03am UTC](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622 "2020-08-01T05:03:03Z")
I am using Opendistro for ES 1.9.0 , logstash and kibana. I have created few index templates and policies. Now as per this I placed all my templates. It didn't got picked up.. And also where do I need to copy all my… --- ## [Newbie in Painless](https://discuss.elastic.co/t/newbie-in-painless/294700)
**Author:** [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\ **Replies:** 13\ **Last updated:** [January 19, 2022, 12:08pm UTC](https://discuss.elastic.co/t/newbie-in-painless/294700 "2022-01-19T12:08:13Z")
Hi Team, I'm struggling so bad to find good examples on how to use painless. I need a script that sums a count of 4 weeks and does the mean of it. Please, can someone share something that could help me do it? A course… --- ## [Uptime (Monitor Status) doesn't show my 22 services (show randonly) but not the total](https://discuss.elastic.co/t/uptime-monitor-status-doesnt-show-my-22-services-show-randonly-but-not-the-total/218988)
**Author:** [@rafaelcassau](https://discuss.elastic.co/u/rafaelcassau)\ **Replies:** 9\ **Last updated:** [February 24, 2020, 2:48pm UTC](https://discuss.elastic.co/t/uptime-monitor-status-doesnt-show-my-22-services-show-randonly-but-not-the-total/218988 "2020-02-24T14:48:42Z")
I've configured heart-beat and uptime in the elastic stack cloud, but after I've added my 22 endpoints I noticed that the sections "All monitors are up" and "Pings over time" are work correctly but the section "Monitor S… --- ## [Elasticsearch returns two documents with same ID but different versions](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802)
**Author:** [@Andrey\_Tyutyunov](https://discuss.elastic.co/u/Andrey_Tyutyunov)\ **Replies:** 11\ **Last updated:** [August 10, 2022, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-returns-two-documents-with-same-id-but-different-versions/311802 "2022-08-10T08:13:59Z")
ES version: 5.3.1 Some documents returns twice, updated and previous version rq /purchases/payments/\_search?q=\_id:AYKCmqWVUjd1dFdxujwy&version=true Why it happens? How to fix it? --- ## [Undefined method \`get' for](https://discuss.elastic.co/t/undefined-method-get-for/255214)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 12\ **Last updated:** [November 12, 2020, 4:32pm UTC](https://discuss.elastic.co/t/undefined-method-get-for/255214 "2020-11-12T16:32:47Z")
I am facing bellow error while using http\_poller. I am trying to pull cloudflare API logs in json format. Here is my .conf file. I am using logstash 7.9.2 and logstash-input-http\_poller (5.0.2) Can anyone please help ? … --- ## [SIEM Signals not triggering](https://discuss.elastic.co/t/siem-signals-not-triggering/254151)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 10\ **Last updated:** [November 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/siem-signals-not-triggering/254151 "2020-11-09T12:50:07Z")
SIEM signals are not triggering even after the events are generated. But same KQL query used in signal is working fine in discover tab. Please help me to resolve this issue. --- ## [Grok pattern query for access logs](https://discuss.elastic.co/t/grok-pattern-query-for-access-logs/208413)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 9\ **Last updated:** [November 22, 2019, 1:58am UTC](https://discuss.elastic.co/t/grok-pattern-query-for-access-logs/208413 "2019-11-22T01:58:56Z")
I am using the below query to extract IP address, timestamp and such from an access log like this below: 192.168.10.182 - - - 18/Nov/2019:13:42:14 -0800 "GET /xxxx-xxxx-xxxx/xxxxxxxxxx/xxx/xxxx/xxxxxxxxxx HTTP/1.1" 200 … --- ## [How do I setup my cluster to maximize CPU util % while testing with Rally](https://discuss.elastic.co/t/how-do-i-setup-my-cluster-to-maximize-cpu-util-while-testing-with-rally/203726)
**Author:** [@Akshay\_Raj](https://discuss.elastic.co/u/Akshay_Raj)\ **Replies:** 9\ **Last updated:** [October 17, 2019, 6:17am UTC](https://discuss.elastic.co/t/how-do-i-setup-my-cluster-to-maximize-cpu-util-while-testing-with-rally/203726 "2019-10-17T06:17:31Z")
Hi, I have a cluster setup with the objective to test elasticsearch nodes using rally. As of now I have a benchmark coordinator, 2 load drivers and 3 elasticsearch nodes. I wish to maximize the load I can place upon the… --- ## [Memory and index size dependency - performance problems](https://discuss.elastic.co/t/memory-and-index-size-dependency-performance-problems/4776)
**Author:** [@Marek\_Skorek](https://discuss.elastic.co/u/Marek_Skorek)\ **Replies:** 9\ **Last updated:** [July 5, 2011, 2:38pm UTC](https://discuss.elastic.co/t/memory-and-index-size-dependency-performance-problems/4776 "2011-07-05T14:38:28Z")
Hi, I try to use Elasticsearch to index about 500M of docs. I firstly tried to index documents with 15 fields and the size for a single doc is about 1,2KB. While indexing these data I got a problem with elasticsear… --- ## [Issue for Elastic Observability Engineer Lab 2.1 - Elastic Agent](https://discuss.elastic.co/t/issue-for-elastic-observability-engineer-lab-2-1-elastic-agent/357717)
**Author:** [@ganesh.pawar](https://discuss.elastic.co/u/ganesh.pawar)\ **Replies:** 28\ **Last updated:** [August 11, 2025, 10:17am UTC](https://discuss.elastic.co/t/issue-for-elastic-observability-engineer-lab-2-1-elastic-agent/357717 "2025-08-11T10:17:04Z")
Hi, For Elastic Observability Engineer Lab 2.1 - Elastic Agent , I stuck on the point to connect agent to fleet server. The command I used is //~/elastic-agent-8.8.2-linux-x86\_64$ sudo ./elastic-agent install --//url… --- ## [Increased memory requirements for geo search queries in Elasticsearch 8](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594)
**Author:** [@Tomas\_Bartek](https://discuss.elastic.co/u/Tomas_Bartek)\ **Replies:** 15\ **Last updated:** [June 8, 2023, 2:33pm UTC](https://discuss.elastic.co/t/increased-memory-requirements-for-geo-search-queries-in-elasticsearch-8/334594 "2023-06-08T14:33:30Z")
After upgrading from Elasticsearch 7.17.10 to Elasticsearch 8.7.1, our geosearch workloads started to hit memory circuitbreaker leading to the unstable cluster (cluster rejecting requests which leads to degradation of … [Previous page](https://discuss.elastic.co/top.md?page=186&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=188&per_page=50&period=all)