# Top **URL:** https://discuss.elastic.co/top.md?page=199&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 200 --- ## [How to delete document from the same index in 3 elasticsearch instances](https://discuss.elastic.co/t/how-to-delete-document-from-the-same-index-in-3-elasticsearch-instances/175437)
**Author:** [@ali1](https://discuss.elastic.co/u/ali1)\ **Replies:** 15\ **Last updated:** [April 8, 2019, 1:56pm UTC](https://discuss.elastic.co/t/how-to-delete-document-from-the-same-index-in-3-elasticsearch-instances/175437 "2019-04-08T13:56:44Z")
Hello , i have one index (same structure) in 3 elasticsearch instances (1,2,3) and all works fine , my issue is : when i delete a document from the index in ES instance 1 , i want also delete the same document fro… --- ## [Add module threatintel to filebeat](https://discuss.elastic.co/t/add-module-threatintel-to-filebeat/312456)
**Author:** [@dounia](https://discuss.elastic.co/u/dounia)\ **Replies:** 18\ **Last updated:** [August 23, 2022, 8:18am UTC](https://discuss.elastic.co/t/add-module-threatintel-to-filebeat/312456 "2022-08-23T08:18:46Z")
Hi, I'm adding threatintel module to filebeat , but when I restart filebeat service it failed, I get this error : Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch.. --- ## [Possibility to use single index template for all application indices](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 14\ **Last updated:** [October 22, 2021, 5:19pm UTC](https://discuss.elastic.co/t/possibility-to-use-single-index-template-for-all-application-indices/285741 "2021-10-22T17:19:16Z")
Hi Team, I have multiple applications running and each has their application logs captured by filebeat and it sends to logstash. Below is the logstash configuration /etc/logstash/conf.d/logstash.conf file. ( showing o… --- ## [Logstash fell under load](https://discuss.elastic.co/t/logstash-fell-under-load/269766)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 14\ **Last updated:** [April 12, 2021, 4:54pm UTC](https://discuss.elastic.co/t/logstash-fell-under-load/269766 "2021-04-12T16:54:31Z")
Hello. I have three clients. They send logs via filebeat to main server with logstash. A few days ago there are a lot of logs somewhere around 12 M in an amount. The logstash couldn't process all this logs and it fell. … --- ## [High CPU load](https://discuss.elastic.co/t/high-cpu-load/302102)
**Author:** [@hebph001](https://discuss.elastic.co/u/hebph001)\ **Replies:** 9\ **Last updated:** [April 12, 2022, 2:58pm UTC](https://discuss.elastic.co/t/high-cpu-load/302102 "2022-04-12T14:58:25Z")
Hi Elastic community, I have a cloud cluster with 3 hot nodes. Stack monitoring data is showing me that 2 out of 3 are constantly under heavy load. CPU usage is nearly 100% all the time. I would like to know how can I t… --- ## [I would like to know if the configuration of my ELK server is correct](https://discuss.elastic.co/t/i-would-like-to-know-if-the-configuration-of-my-elk-server-is-correct/181440)
**Author:** [@zenimagine](https://discuss.elastic.co/u/zenimagine)\ **Replies:** 13\ **Last updated:** [May 19, 2019, 4:26pm UTC](https://discuss.elastic.co/t/i-would-like-to-know-if-the-configuration-of-my-elk-server-is-correct/181440 "2019-05-19T16:26:35Z")
Hi, I would like to know if the configuration of my ELK server is correct : --- ## [Search\_phase\_execution\_exception error with all\_shared failes](https://discuss.elastic.co/t/search-phase-execution-exception-error-with-all-shared-failes/334169)
**Author:** [@Kapildev](https://discuss.elastic.co/u/Kapildev)\ **Replies:** 15\ **Last updated:** [May 25, 2023, 6:18am UTC](https://discuss.elastic.co/t/search-phase-execution-exception-error-with-all-shared-failes/334169 "2023-05-25T06:18:32Z")
hi team i am facing this search\_phase\_execution\_exception Please find the details. curl -X GET "localhost:9200/\_cluster/health?filter\_path=status,\*\_shards&pretty" { "status" : "red", "active\_primary\_shards" : 0, "… --- ## [Enabling SSL with Elasticsearch cause logstash pipeline error](https://discuss.elastic.co/t/enabling-ssl-with-elasticsearch-cause-logstash-pipeline-error/319131)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 9\ **Last updated:** [November 29, 2022, 2:05am UTC](https://discuss.elastic.co/t/enabling-ssl-with-elasticsearch-cause-logstash-pipeline-error/319131 "2022-11-29T02:05:32Z")
hi, I am using 8.4.3, for both elastic and logstash. We have enabled ssl with Elasticsearch. with the ssl our logstash fails to output data there, without ssl it works fine. the output settings: output{ elasticsearch… --- ## [Applying ILM Policy but data not getting deleted](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 9\ **Last updated:** [September 20, 2020, 2:52am UTC](https://discuss.elastic.co/t/applying-ilm-policy-but-data-not-getting-deleted/248605 "2020-09-20T02:52:01Z")
Hello, I am working on configuring an ILM policy to delete any data in an index which is older than 30 days / more than 50GB. I have an index which has data about 97GB at the moment. I have configured an alias for … --- ## [How update the nested element in ES through Groovy](https://discuss.elastic.co/t/how-update-the-nested-element-in-es-through-groovy/99184)
**Author:** [@yogeswararao](https://discuss.elastic.co/u/yogeswararao)\ **Replies:** 9\ **Last updated:** [September 5, 2017, 3:31am UTC](https://discuss.elastic.co/t/how-update-the-nested-element-in-es-through-groovy/99184 "2017-09-05T03:31:56Z")
How to update the nested field values in the ES Groovey. curl -XPOST ‘localhost:9200/iapi-log-dev-lorain/log/Sample.Test/\_update’ -d ‘{“script” : “ctx.\_source.@fields.Metrics.TOTAL\_MSGS = TOTAL\_MSGS”,“params” : {“TOTAL\_… --- ## [Heap Allocation Failures on 8.17](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 9\ **Last updated:** [January 8, 2025, 3:20pm UTC](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211 "2025-01-08T15:20:15Z")
We've had 2 different 8.x clusters running for a number of years without issue however since upgrading to 8.17 (from 8.15.1) a couple of days ago we are seeing frequent heap allocation failures such as below: # # There … --- ## [Error watcher with multiple terms and a metric](https://discuss.elastic.co/t/error-watcher-with-multiple-terms-and-a-metric/282604)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 10\ **Last updated:** [August 27, 2021, 3:03pm UTC](https://discuss.elastic.co/t/error-watcher-with-multiple-terms-and-a-metric/282604 "2021-08-27T15:03:19Z")
Hello, good people. I have a problem with an alert, I get the following error: { "watch\_id": "\_inlined\_", "node": "ELuSGxpSRICZb2ZHJp4paA", "state": "failed", "user": "elastic", "status": { "state": { … --- ## [Endpoint 7.9.x Process/Folder exemptions with ingest manager?](https://discuss.elastic.co/t/endpoint-7-9-x-process-folder-exemptions-with-ingest-manager/248866)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 10\ **Last updated:** [September 22, 2020, 4:33pm UTC](https://discuss.elastic.co/t/endpoint-7-9-x-process-folder-exemptions-with-ingest-manager/248866 "2020-09-22T16:33:51Z")
This may seem like a really simple question... For some reason the obvious answers are escaping me at the moment. For Endpoint how do you set an exemption for a folder and process? This is not for an entire fleet of mac… --- ## [Geoip.location.lat and geoip.location.lon showing as number, cannot convert to geoip type](https://discuss.elastic.co/t/geoip-location-lat-and-geoip-location-lon-showing-as-number-cannot-convert-to-geoip-type/233475)
**Author:** [@mostafa\_kamal](https://discuss.elastic.co/u/mostafa_kamal)\ **Replies:** 10\ **Last updated:** [May 22, 2020, 6:22pm UTC](https://discuss.elastic.co/t/geoip-location-lat-and-geoip-location-lon-showing-as-number-cannot-convert-to-geoip-type/233475 "2020-05-22T18:22:10Z")
I actually want to make a user-location based map in kibana, but I cannot do that because geoip.location.lat and geoip.location.lon showing as number, I cannot convert to geoip type. this is my logstash conf filter { … --- ## [Filter specific information](https://discuss.elastic.co/t/filter-specific-information/329695)
**Author:** [@SilasMuniz1](https://discuss.elastic.co/u/SilasMuniz1)\ **Replies:** 11\ **Last updated:** [April 25, 2023, 6:58pm UTC](https://discuss.elastic.co/t/filter-specific-information/329695 "2023-04-25T18:58:19Z")
Hello, I am trying filter a specific information inside of determite field. I used kv for split my log. It's work well. After that I need get apelido information inside request field. But It didn't work. This … --- ## [Logstash filter drop message with $ into string](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784)
**Author:** [@davide.stallone](https://discuss.elastic.co/u/davide.stallone)\ **Replies:** 9\ **Last updated:** [August 20, 2020, 3:54pm UTC](https://discuss.elastic.co/t/logstash-filter-drop-message-with-into-string/245784 "2020-08-20T15:54:22Z")
Hi, I'm trying to build a logstash filter to drop message that contains dollar at the end of string. I'm receiving log from a domain controller and I would like to get message that has in the field "user.name" only rea… --- ## [Mapping and Dynamic Mapping](https://discuss.elastic.co/t/mapping-and-dynamic-mapping/4554)
**Author:** [@Slava\_G](https://discuss.elastic.co/u/Slava_G)\ **Replies:** 13\ **Last updated:** [June 4, 2011, 6:39pm UTC](https://discuss.elastic.co/t/mapping-and-dynamic-mapping/4554 "2011-06-04T18:39:11Z")
Hi, I'm trying to disable \_source field, using this: XContentBuilder data = jsonBuilder().startObject() .startObject("type") .startObject("\_source") .field("enabled", false) .endObject() … --- ## [Java 6u23 and ES 0.14.2 crashing on signal (6/SIGABT)](https://discuss.elastic.co/t/java-6u23-and-es-0-14-2-crashing-on-signal-6-sigabt/3812)
**Author:** [@dbenson](https://discuss.elastic.co/u/dbenson)\ **Replies:** 11\ **Last updated:** [March 9, 2011, 9:44pm UTC](https://discuss.elastic.co/t/java-6u23-and-es-0-14-2-crashing-on-signal-6-sigabt/3812 "2011-03-09T21:44:20Z")
To try and address a non-ES issue, I attempted to upgrade one node in a cluster from JDK 1.6.0\_21 to 1.6.0\_23. After several minutes of ES syncing indexes, it crashes with a SIGABT. From the wrapper logs (nothing dump… --- ## [Logstash km filter](https://discuss.elastic.co/t/logstash-km-filter/148857)
**Author:** [@gopisa](https://discuss.elastic.co/u/gopisa)\ **Replies:** 17\ **Last updated:** [September 24, 2018, 8:52am UTC](https://discuss.elastic.co/t/logstash-km-filter/148857 "2018-09-24T08:52:13Z")
Hi All, need help on Km filter. i am using the logstash 2.3V. my logs files look like below } "version" : "123" "Keywords" : "1", "Level" : "Verbose", "Message" : "", "Opcode" : "Info", } logstash conf: input… --- ## [Kibana Point to point aggregation](https://discuss.elastic.co/t/kibana-point-to-point-aggregation/236500)
**Author:** [@Pablo95](https://discuss.elastic.co/u/Pablo95)\ **Replies:** 9\ **Last updated:** [June 11, 2020, 1:15pm UTC](https://discuss.elastic.co/t/kibana-point-to-point-aggregation/236500 "2020-06-11T13:15:08Z")
Hi, I've been searching a lot about the point to point aggregation and I still have some doubts of what are the requisites to be able to make this layer. Do I have to map a field (f.ex: source) with two sub fields (f.e… --- ## [Filestream multiple file reading issue](https://discuss.elastic.co/t/filestream-multiple-file-reading-issue/378847)
**Author:** [@BnB](https://discuss.elastic.co/u/BnB)\ **Replies:** 15\ **Last updated:** [June 24, 2025, 12:39pm UTC](https://discuss.elastic.co/t/filestream-multiple-file-reading-issue/378847 "2025-06-24T12:39:59Z")
So here's my case: Im using Custom Logs (Filestream) integration on Elasticsearch. The way the files I want it to read is as follows: There are already multiple files that fit the "Paths" config, so it looks like this … --- ## [Stop logsstash](https://discuss.elastic.co/t/stop-logsstash/165279)
**Author:** [@gongon](https://discuss.elastic.co/u/gongon)\ **Replies:** 14\ **Last updated:** [January 29, 2019, 5:30pm UTC](https://discuss.elastic.co/t/stop-logsstash/165279 "2019-01-29T17:30:31Z")
Hello, I can't stop Logstash so I can't test any config file on my mac. Here the error : I3893-2:6.4.1 gongon$ logstash -f first-pipeline.conf Sending Logstash logs to /usr/local/Cellar/logstash/6.4.1/libexec/logs whic… --- ## [Downgrading from 1.4 to1.3](https://discuss.elastic.co/t/downgrading-from-1-4-to1-3/21069)
**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\ **Replies:** 11\ **Last updated:** [December 5, 2014, 9:43pm UTC](https://discuss.elastic.co/t/downgrading-from-1-4-to1-3/21069 "2014-12-05T21:43:45Z")
"Upgrading" to 1.4 has been a clusterfuck for us. It's broken pretty much everything we rely on. I need to go back to 1.3, can I use the snapshot feature? Will a snapshot taken on a 1.4 cluster restore to a separate 1.3… --- ## [Logstash Date Filter not working on Kibana](https://discuss.elastic.co/t/logstash-date-filter-not-working-on-kibana/245822)
**Author:** [@userR](https://discuss.elastic.co/u/userR)\ **Replies:** 9\ **Last updated:** [August 21, 2020, 4:52pm UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-on-kibana/245822 "2020-08-21T16:52:48Z")
date { match =\> \["logdate", "YYYY.MM.dd HH:mm:ss,SSS"\] target =\> "logdate" } Above is my date filter configuration on my logstash config file. On kibana, when I create an index pattern, the only date option that sh… --- ## [Netflow Module Not Creating ES Index](https://discuss.elastic.co/t/netflow-module-not-creating-es-index/180222)
**Author:** [@etsai7](https://discuss.elastic.co/u/etsai7)\ **Replies:** 9\ **Last updated:** [May 15, 2019, 5:00pm UTC](https://discuss.elastic.co/t/netflow-module-not-creating-es-index/180222 "2019-05-15T17:00:12Z")
Hello, When I launch logstash 6.5.4 with the netflow module, using the line: bin/logstash --modules netflow --setup -M netflow.var.input.udp.port=2055 it does not seem to create an ES index for Netflow as the docs s… --- ## [Regex running on version 5.4](https://discuss.elastic.co/t/regex-running-on-version-5-4/109501)
**Author:** [@paulohss](https://discuss.elastic.co/u/paulohss)\ **Replies:** 9\ **Last updated:** [December 5, 2017, 11:08pm UTC](https://discuss.elastic.co/t/regex-running-on-version-5-4/109501 "2017-12-05T23:08:21Z")
Hi guys, I'm not able to find yet what I'm doing wrong here. So, this is the scenario: 1. Config set (script.painless.regex.enabled: true) 2. The Field I'm interested is called "DESCRIPTION". 3. I've tried these quer… --- ## [Elasticsearch data directory](https://discuss.elastic.co/t/elasticsearch-data-directory/70989)
**Author:** [@rheng](https://discuss.elastic.co/u/rheng)\ **Replies:** 9\ **Last updated:** [January 10, 2017, 6:52am UTC](https://discuss.elastic.co/t/elasticsearch-data-directory/70989 "2017-01-10T06:52:55Z")
Is there a reason why a new directory was created for the elasticsearch data indices. When elasticsearch was initially installed, it create a path ../data/elasticsearch/../nodes/0 Now i see ../data/elasticsearch/../n… --- ## [Delete Indices/index/documents but 404 NotFound](https://discuss.elastic.co/t/delete-indices-index-documents-but-404-notfound/351250)
**Author:** [@martel](https://discuss.elastic.co/u/martel)\ **Replies:** 14\ **Last updated:** [January 17, 2024, 2:15pm UTC](https://discuss.elastic.co/t/delete-indices-index-documents-but-404-notfound/351250 "2024-01-17T14:15:27Z")
Hey, I want delete all indices, document, but want keep Template index. i have already try many operations see here in forum, but nothing clean my path data. A) \_settings with index.blocks.read\_only\_allow\_delete an… --- ## [Cluster state is yellow due to unassigned shrads](https://discuss.elastic.co/t/cluster-state-is-yellow-due-to-unassigned-shrads/230462)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 18\ **Last updated:** [May 7, 2020, 5:12am UTC](https://discuss.elastic.co/t/cluster-state-is-yellow-due-to-unassigned-shrads/230462 "2020-05-07T05:12:31Z")
Since there are 207 unassigned shrads, my cluster status became yellow. I ran the API "\_cluster/allocation/explain" and got below results. { "index": "en\_y\_29", "shard": 1, "primary": false, "current\_state": "unassi… --- ## [ElasticSearch deletes documents in an index automatically](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316)
**Author:** [@joanjanku2000](https://discuss.elastic.co/u/joanjanku2000)\ **Replies:** 19\ **Last updated:** [November 7, 2022, 11:51am UTC](https://discuss.elastic.co/t/elasticsearch-deletes-documents-in-an-index-automatically/318316 "2022-11-07T11:51:17Z")
I have configured an ELK Cluster with 5 nodes, one being master and the other slaves. I index logs in the cluster once a day using logstash. I use a CronJOB (script) to copy the log files to the configured logstash direc… --- ## [Filtering buckets from aggs](https://discuss.elastic.co/t/filtering-buckets-from-aggs/74750)
**Author:** [@daaakeee](https://discuss.elastic.co/u/daaakeee)\ **Replies:** 10\ **Last updated:** [February 12, 2017, 9:42am UTC](https://discuss.elastic.co/t/filtering-buckets-from-aggs/74750 "2017-02-12T09:42:04Z")
Hi, I am trying to exclude all buckets that are contained in another buckets 'term' field. For example \`"buckets": \[ { "key": "1", "doc\_count": 2 }, … --- ## [GROK pattern](https://discuss.elastic.co/t/grok-pattern/322443)
**Author:** [@Hamunaptroid](https://discuss.elastic.co/u/Hamunaptroid)\ **Replies:** 9\ **Last updated:** [January 13, 2023, 11:39am UTC](https://discuss.elastic.co/t/grok-pattern/322443 "2023-01-13T11:39:49Z")
Hello, I have trouble with writing GROK pattern for system logs. My goal is to parse logs in form "systemctl -o verbose" which looks like this Wed 2022-10-12 09:08:42.759756 \_TRANSPORT=kernel SYSLOG\_IDENTIFIER=… --- ## [Curator: action allocated not working](https://discuss.elastic.co/t/curator-action-allocated-not-working/226017)
**Author:** [@Dmytro\_Kolodiaziev](https://discuss.elastic.co/u/Dmytro_Kolodiaziev)\ **Replies:** 10\ **Last updated:** [April 2, 2020, 5:24pm UTC](https://discuss.elastic.co/t/curator-action-allocated-not-working/226017 "2020-04-02T17:24:48Z")
Hi, I have problems with a curator, when I try to allocate my indices with a curator from hot to spinning, I have message "allocation" completed." but, indices didn't move to a different server My infrastructure: elast… --- ## [Logstash не удаляет вложенные поля из json](https://discuss.elastic.co/t/logstash-json/275113)
**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\ **Replies:** 9\ **Last updated:** [June 8, 2021, 6:40pm UTC](https://discuss.elastic.co/t/logstash-json/275113 "2021-06-08T18:40:46Z")
Привет. Возникла вопрос по работе logstash. Хочу сохранить в ES ответ nginx. Ответ представляет из себя json. Натравливаю на него json плагин и получаю структуру полей в ES. json { source =\> "response\_body" … --- ## [App Search Sort by Id ASC incorrect](https://discuss.elastic.co/t/app-search-sort-by-id-asc-incorrect/244857)
**Author:** [@Ben\_Flowers](https://discuss.elastic.co/u/Ben_Flowers)\ **Replies:** 9\ **Last updated:** [September 7, 2020, 3:52pm UTC](https://discuss.elastic.co/t/app-search-sort-by-id-asc-incorrect/244857 "2020-09-07T15:52:01Z")
Sorting by Id doesn't seem to work with AppSeach/Enterprise search. Please see the reference UI sort by id. For some reason the id starting with b is before the id starting with a. Am i missing something? Also is it… --- ## [Fielddata там, где ее быть не должно](https://discuss.elastic.co/t/fielddata/165062)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 9\ **Last updated:** [February 12, 2019, 2:01pm UTC](https://discuss.elastic.co/t/fielddata/165062 "2019-02-12T14:01:45Z")
У меня есть индекс (данные в него не индексируются, только поиск по нему осуществляется по средствам кибаны и ее дашбоардов) у которого постоянно растет размер fielddata. Стал разбираться и обнаружил с помощью запроса G… --- ## [Logs not back filled if logstash indexer pipeline is down](https://discuss.elastic.co/t/logs-not-back-filled-if-logstash-indexer-pipeline-is-down/41118)
**Author:** [@astro](https://discuss.elastic.co/u/astro)\ **Replies:** 9\ **Last updated:** [February 11, 2016, 1:21pm UTC](https://discuss.elastic.co/t/logs-not-back-filled-if-logstash-indexer-pipeline-is-down/41118 "2016-02-11T13:21:17Z")
Hi Everyone, I am not able to figure out why logs are not back filled when indexer logstash is down although logs are buffered in kafka . Regards Arvind --- ## [\[WARNING\] No throughput metrics available for \[index-append\]. Likely cause: The benchmark ended already during warmup](https://discuss.elastic.co/t/warning-no-throughput-metrics-available-for-index-append-likely-cause-the-benchmark-ended-already-during-warmup/306935)
**Author:** [@amitsa](https://discuss.elastic.co/u/amitsa)\ **Replies:** 9\ **Last updated:** [June 16, 2022, 11:11am UTC](https://discuss.elastic.co/t/warning-no-throughput-metrics-available-for-index-append-likely-cause-the-benchmark-ended-already-during-warmup/306935 "2022-06-16T11:11:16Z")
cluster is running on kubernetes NUMBER\_OF\_SHARDS=${NUMBER\_OF\_SHARDS:-10} NUMBER\_OF\_REPLICAS=${NUMBER\_OF\_REPLICAS:-0} INGEST\_PERCENTAGE=${INGEST\_PERCENTAGE:-100} BULK\_SIZE=${BULK\_SIZE:-5000} BULK\_INDEXING\_CLIENTS=${BULK… --- ## [Unable to allocate shards in ILM cold phase](https://discuss.elastic.co/t/unable-to-allocate-shards-in-ilm-cold-phase/273789)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 9\ **Last updated:** [June 18, 2021, 6:26pm UTC](https://discuss.elastic.co/t/unable-to-allocate-shards-in-ilm-cold-phase/273789 "2021-06-18T18:26:49Z")
hi, I have a 2 node cluster running 7.10.2. I have defined ILM policy to move index from hot-warm-cold phases. However the transition from warm to cold phase is not happening. I have not explicitly set any node roles. S… --- ## [Can we backup log in kibana](https://discuss.elastic.co/t/can-we-backup-log-in-kibana/248102)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 9\ **Last updated:** [September 10, 2020, 8:53am UTC](https://discuss.elastic.co/t/can-we-backup-log-in-kibana/248102 "2020-09-10T08:53:36Z")
Hi can we backup our log in kibana? --- ## [Add external libraries to elasticsearch](https://discuss.elastic.co/t/add-external-libraries-to-elasticsearch/186845)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 9\ **Last updated:** [June 24, 2019, 5:32am UTC](https://discuss.elastic.co/t/add-external-libraries-to-elasticsearch/186845 "2019-06-24T05:32:32Z")
I would want to add org.apache.http libraries to the gradle file .how do i do that thanks --- ## [Multiple Data Centers Replication](https://discuss.elastic.co/t/multiple-data-centers-replication/56877)
**Author:** [@Nitzan\_Dana](https://discuss.elastic.co/u/Nitzan_Dana)\ **Replies:** 9\ **Last updated:** [August 4, 2016, 9:00am UTC](https://discuss.elastic.co/t/multiple-data-centers-replication/56877 "2016-08-04T09:00:05Z")
Hi, We figured that Elasticsearch doesn’t provide a proper solution for a multiple data centers replication. I wonder if someone has a good other answer for this scenario. Your help would be much appreciated:) Nitza… --- ## [Problems with EST5EDT timezone in Kibana 7.17.0](https://discuss.elastic.co/t/problems-with-est5edt-timezone-in-kibana-7-17-0/300810)
**Author:** [@lifer](https://discuss.elastic.co/u/lifer)\ **Replies:** 17\ **Last updated:** [April 13, 2022, 1:32pm UTC](https://discuss.elastic.co/t/problems-with-est5edt-timezone-in-kibana-7-17-0/300810 "2022-04-13T13:32:52Z")
Hi team! I have some problems with EST5EDT timezone in Kibana v 7.17.0: So, when I set timezone to UTC on the "Slack Management -\> Advanced Settings" page - everything works fine and I see data with correct timezone. B… --- ## [Network failure resiliency](https://discuss.elastic.co/t/network-failure-resiliency/6400)
**Author:** [@Grant](https://discuss.elastic.co/u/Grant)\ **Replies:** 13\ **Last updated:** [June 18, 2012, 10:08am UTC](https://discuss.elastic.co/t/network-failure-resiliency/6400 "2012-06-18T10:08:09Z")
Hi folks, So we're currently running an 8 node ES cluster with a well known hosting provider. About thrice now we've have issues that I'm attributing to network failure for a number of reasons, but I was wondering if… --- ## [Confluence connector - how to exclude some spaces](https://discuss.elastic.co/t/confluence-connector-how-to-exclude-some-spaces/313383)
**Author:** [@tonyfam](https://discuss.elastic.co/u/tonyfam)\ **Replies:** 12\ **Last updated:** [September 1, 2022, 5:05pm UTC](https://discuss.elastic.co/t/confluence-connector-how-to-exclude-some-spaces/313383 "2022-09-01T17:05:17Z")
Hi, We have a Confluence cloud site to index. There are 3 spaces on it, and I only want one, and definitely not the user pages. But I can't seem to get the indexing exclude to work. We only want the pages from one o… --- ## [Incomplete response JSON](https://discuss.elastic.co/t/incomplete-response-json/164454)
**Author:** [@shikhar\_singh](https://discuss.elastic.co/u/shikhar_singh)\ **Replies:** 12\ **Last updated:** [January 16, 2019, 3:07pm UTC](https://discuss.elastic.co/t/incomplete-response-json/164454 "2019-01-16T15:07:29Z")
Summary When I fire the query ( using curl -X GET ) from my Linux machine the output JSON is not complete. the aggregation output is missing. screenshots attached. Please help curl -X GET "http://10.5.245.31:9200/res… --- ## [Seems that Logstash stop shipping logs to ES / Problem into the logstash config](https://discuss.elastic.co/t/seems-that-logstash-stop-shipping-logs-to-es-problem-into-the-logstash-config/180946)
**Author:** [@Rodolphe\_Ghio](https://discuss.elastic.co/u/Rodolphe_Ghio)\ **Replies:** 13\ **Last updated:** [May 29, 2019, 1:41pm UTC](https://discuss.elastic.co/t/seems-that-logstash-stop-shipping-logs-to-es-problem-into-the-logstash-config/180946 "2019-05-29T13:41:49Z")
Hello everyone, I'm new in the ELK community. I'm trying to setup a kibana sandbox (linux vm). So I've put data into the logstash. I've created index / mapping thanks to the Dev tool. But when I'm trying to set a defaul… --- ## [Log Rotation with two events depending on each other](https://discuss.elastic.co/t/log-rotation-with-two-events-depending-on-each-other/65645)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 10\ **Last updated:** [November 15, 2016, 10:44am UTC](https://discuss.elastic.co/t/log-rotation-with-two-events-depending-on-each-other/65645 "2016-11-15T10:44:27Z")
Hi everybody, I have got a problem with file rotation and logging messages that depends on each other. Here my case: Usually events are written to the logfile in the correct order: my.log {id: "1", status: "Run… --- ## [Filter input data from Filebeat using logstash?](https://discuss.elastic.co/t/filter-input-data-from-filebeat-using-logstash/322078)
**Author:** [@camilovietnam](https://discuss.elastic.co/u/camilovietnam)\ **Replies:** 9\ **Last updated:** [January 2, 2023, 12:26pm UTC](https://discuss.elastic.co/t/filter-input-data-from-filebeat-using-logstash/322078 "2023-01-02T12:26:30Z")
Hello! I managed to set up the stack Filebeat-\>Logstash-\>Elasticsearch, but I am using journald as an input for my filebeat logs, which means that a lot of unnecessary data appears to be saved in the ES index. I thought … --- ## [Loading of Data in Elaticsearch](https://discuss.elastic.co/t/loading-of-data-in-elaticsearch/43154)
**Author:** [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Replies:** 9\ **Last updated:** [March 3, 2016, 6:19am UTC](https://discuss.elastic.co/t/loading-of-data-in-elaticsearch/43154 "2016-03-03T06:19:36Z")
Hi, I am working with something in which I loading data (around 2.5 GB) into ES per day and then Delete once in a week .I want a device that whether it will good to load data daily into single index or load the data d… [Previous page](https://discuss.elastic.co/top.md?page=198&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=200&per_page=50&period=all)