# Top **URL:** https://discuss.elastic.co/top.md?page=239&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 240 --- ## [ERROR CONSULTING/MANAGING RULES - Alerts and Insights](https://discuss.elastic.co/t/error-consulting-managing-rules-alerts-and-insights/378970)
**Author:** [@dudahl](https://discuss.elastic.co/u/dudahl)\ **Replies:** 18\ **Last updated:** [June 17, 2025, 6:00pm UTC](https://discuss.elastic.co/t/error-consulting-managing-rules-alerts-and-insights/378970 "2025-06-17T18:00:16Z")
The message error ("Unable to load rules") below appears when I try to consult or manage the rules on Stack Management \> Alerts and Insights. I've already tried to look for similar bugs here, but all of them were found … --- ## [How to pull data from Elasticsearch to Splunk without data duplication?](https://discuss.elastic.co/t/how-to-pull-data-from-elasticsearch-to-splunk-without-data-duplication/380000)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 16\ **Last updated:** [July 16, 2025, 12:59pm UTC](https://discuss.elastic.co/t/how-to-pull-data-from-elasticsearch-to-splunk-without-data-duplication/380000 "2025-07-16T12:59:22Z")
Hello, I have data in Elasticsearch that I’ve stored across 3 indices. I want to copy the data to Splunk — I want only the data from the last minute, and I want to store the data from each Elasticsearch index into a se… --- ## [Higher search rate when added final data node to cluster](https://discuss.elastic.co/t/higher-search-rate-when-added-final-data-node-to-cluster/302912)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 10\ **Last updated:** [May 17, 2022, 7:32am UTC](https://discuss.elastic.co/t/higher-search-rate-when-added-final-data-node-to-cluster/302912 "2022-05-17T07:32:39Z")
We've got a 5 data node v.6.8.23 cluster in production, that seems to increase search rate and cpu usage when the fifth node (exrhel0212) has joined the cluster, running on four nodes cluster is much calmer. Hints on ho… --- ## [Error ingestion two csv in elastic search](https://discuss.elastic.co/t/error-ingestion-two-csv-in-elastic-search/229435)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 11\ **Last updated:** [May 11, 2020, 2:08pm UTC](https://discuss.elastic.co/t/error-ingestion-two-csv-in-elastic-search/229435 "2020-05-11T14:08:32Z")
Hello it is possible to ingest of two csv files in elastic using file beat and logstsh with the same index --- ## [Ha in two node elasticsearch](https://discuss.elastic.co/t/ha-in-two-node-elasticsearch/330819)
**Author:** [@Monish22](https://discuss.elastic.co/u/Monish22)\ **Replies:** 9\ **Last updated:** [April 26, 2023, 12:58pm UTC](https://discuss.elastic.co/t/ha-in-two-node-elasticsearch/330819 "2023-04-26T12:58:07Z")
Hi, Currently, we setup two node elasticsearch cluster in my lab and configured ha. We set the both the nodes are master and data. but when the elk01 master node is down, the elk02 doesnt take the leader process. ELK02… --- ## [Is logstash taking packets?](https://discuss.elastic.co/t/is-logstash-taking-packets/130955)
**Author:** [@MrNerd](https://discuss.elastic.co/u/MrNerd)\ **Replies:** 9\ **Last updated:** [May 8, 2018, 1:04pm UTC](https://discuss.elastic.co/t/is-logstash-taking-packets/130955 "2018-05-08T13:04:09Z")
Hi, is there any way I can look if my logstash is taking the pakets that arrives at port 5000? Thanks MrNerd --- ## [Brand new master doesn't join cluster bootstrap error](https://discuss.elastic.co/t/brand-new-master-doesnt-join-cluster-bootstrap-error/322567)
**Author:** [@faxm0dem](https://discuss.elastic.co/u/faxm0dem)\ **Replies:** 10\ **Last updated:** [January 9, 2023, 9:48am UTC](https://discuss.elastic.co/t/brand-new-master-doesnt-join-cluster-bootstrap-error/322567 "2023-01-09T09:48:36Z")
Hi, We have a 7.10.2 cluster with multiple data-only nodes and 3 master-only nodes. We wiped one of the 3 masters clean (reinstall), and now it refuses to join the cluster: master not discovered yet, this node has not… --- ## [Update initially fast, but then crawls](https://discuss.elastic.co/t/update-initially-fast-but-then-crawls/168754)
**Author:** [@faZhift](https://discuss.elastic.co/u/faZhift)\ **Replies:** 9\ **Last updated:** [February 18, 2019, 12:17pm UTC](https://discuss.elastic.co/t/update-initially-fast-but-then-crawls/168754 "2019-02-18T12:17:59Z")
I am noticing that performing many "update\_by\_query" calls is very fast initially, handling several thousand a second. As time progresses though, this crawls to only a few per second. Looking at memory/CPU usage, it does… --- ## [Indexes in database](https://discuss.elastic.co/t/indexes-in-database/7636)
**Author:** [@tullio0106](https://discuss.elastic.co/u/tullio0106)\ **Replies:** 9\ **Last updated:** [May 10, 2012, 10:04pm UTC](https://discuss.elastic.co/t/indexes-in-database/7636 "2012-05-10T22:04:36Z")
I'm investigating about elastic searc and I've a question about indexes. I didn't understand where indexes are stored and if it's possible to store them in a Sql Database (like Oracle or MySql). Tks Tullio --- ## [How to filter dashboard by field maximum value](https://discuss.elastic.co/t/how-to-filter-dashboard-by-field-maximum-value/380129)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 13\ **Last updated:** [July 29, 2025, 7:00am UTC](https://discuss.elastic.co/t/how-to-filter-dashboard-by-field-maximum-value/380129 "2025-07-29T07:00:41Z")
Hi all. This seems easy enough, but I'm being unable to achieve it, and don't find an answer on internet. In our use case, we've built a dashboard with several lens graphs. Users reach that dashboard through a shared l… --- ## [Children aggregation (1.4.0.Beta1) Round-Robin result](https://discuss.elastic.co/t/children-aggregation-1-4-0-beta1-round-robin-result/20355)
**Author:** [@Vlad\_Vlaskin](https://discuss.elastic.co/u/Vlad_Vlaskin)\ **Replies:** 10\ **Last updated:** [November 3, 2014, 9:13am UTC](https://discuss.elastic.co/t/children-aggregation-1-4-0-beta1-round-robin-result/20355 "2014-11-03T09:13:42Z")
Dear ES group, we've been using ES in production for a while and test eagerly all new-coming features such as cardinality and others. We try data modeling with parent-child relations (ES version 1.4.0.Beta1, 8 no… --- ## [Efficiency of GET by doc id](https://discuss.elastic.co/t/efficiency-of-get-by-doc-id/15932)
**Author:** [@Mohit\_Anchlia](https://discuss.elastic.co/u/Mohit_Anchlia)\ **Replies:** 10\ **Last updated:** [February 21, 2014, 5:43pm UTC](https://discuss.elastic.co/t/efficiency-of-get-by-doc-id/15932 "2014-02-21T17:43:58Z")
When using routing is GET by doc id still efficient? I am assuming when routing is used the hash algorithm uses routing value instead of doc value so based on that fact is the GET by doc id still efficient? -- You… --- ## [Installation on ubantu](https://discuss.elastic.co/t/installation-on-ubantu/316961)
**Author:** [@smitak](https://discuss.elastic.co/u/smitak)\ **Replies:** 15\ **Last updated:** [December 13, 2022, 7:30am UTC](https://discuss.elastic.co/t/installation-on-ubantu/316961 "2022-12-13T07:30:02Z")
Hello Sir, I have done the search functionality with fscrawler on local server. It is working good. Now I am uploading on ubantu server. Elastic search is active. But for fscralwer getting error for file content. Elast… --- ## [Has\_child in facet?](https://discuss.elastic.co/t/has-child-in-facet/3977)
**Author:** [@Matt\_Paul\_2](https://discuss.elastic.co/u/Matt_Paul_2)\ **Replies:** 12\ **Last updated:** [March 1, 2011, 9:05pm UTC](https://discuss.elastic.co/t/has-child-in-facet/3977 "2011-03-01T21:05:12Z")
Hi, Very new to elasticsearch, but also very impressed (coming from using FAST ESP). One question that I've come up to, is that I'm trying to determine if it's possible to use a has\_child (either filter or query) i… --- ## [How to get index rollover last digit](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010)
**Author:** [@Robina\_Dhingra1](https://discuss.elastic.co/u/Robina_Dhingra1)\ **Replies:** 10\ **Last updated:** [July 7, 2022, 8:47am UTC](https://discuss.elastic.co/t/how-to-get-index-rollover-last-digit/309010 "2022-07-07T08:47:24Z")
Hello team ES, In our project, we have a datename index. Index is using a policy that rolls over daily. Sometimes, we might need to update documents in rolled over indices. For that we have a pipeline, that figures out… --- ## [How to Remove Gaps between graphs, once hour filter is applied](https://discuss.elastic.co/t/how-to-remove-gaps-between-graphs-once-hour-filter-is-applied/336530)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 9\ **Last updated:** [June 23, 2023, 12:17pm UTC](https://discuss.elastic.co/t/how-to-remove-gaps-between-graphs-once-hour-filter-is-applied/336530 "2023-06-23T12:17:20Z")
Hello Team, I have been trying to put filter of hour on my graphical dashboard, which I did by putting a scripted field of Hour, and the same I have added as filter on my graphical dashboard However, their are gaps … --- ## [How can I extract a sub-field from a field and print it as a separate field in filebeat?](https://discuss.elastic.co/t/how-can-i-extract-a-sub-field-from-a-field-and-print-it-as-a-separate-field-in-filebeat/334103)
**Author:** [@varunsingla](https://discuss.elastic.co/u/varunsingla)\ **Replies:** 9\ **Last updated:** [May 26, 2023, 5:46pm UTC](https://discuss.elastic.co/t/how-can-i-extract-a-sub-field-from-a-field-and-print-it-as-a-separate-field-in-filebeat/334103 "2023-05-26T17:46:03Z")
"msg":"{"appName":"abc","eventCategory":"Authentication event","eventType":"Operator record change","id":"12345","ipAddress":"0.0.1.1","nodeID":"nodeabc","operation":"update","operatorID":"admin","operatorRecID":"DATAADM… --- ## [What is the process to index the .txt using logsth and filebeat?](https://discuss.elastic.co/t/what-is-the-process-to-index-the-txt-using-logsth-and-filebeat/234379)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 9\ **Last updated:** [May 27, 2020, 8:42am UTC](https://discuss.elastic.co/t/what-is-the-process-to-index-the-txt-using-logsth-and-filebeat/234379 "2020-05-27T08:42:02Z")
What is the process to index the .txt using logsth and filebeat ?? --- ## [Using for loop](https://discuss.elastic.co/t/using-for-loop/209810)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 9\ **Last updated:** [November 29, 2019, 7:24am UTC](https://discuss.elastic.co/t/using-for-loop/209810 "2019-11-29T07:24:01Z")
Hey I've a file which includes ip addresses and there corresponding mac addresses. Now, is there any way I can use that file inside filter tag to match the ip address with my log file and allot them corresponding mac ad… --- ## [Wrong number of result using match\_phrase\_prefix](https://discuss.elastic.co/t/wrong-number-of-result-using-match-phrase-prefix/318838)
**Author:** [@Gorelldk](https://discuss.elastic.co/u/Gorelldk)\ **Replies:** 12\ **Last updated:** [December 8, 2022, 8:15am UTC](https://discuss.elastic.co/t/wrong-number-of-result-using-match-phrase-prefix/318838 "2022-12-08T08:15:22Z")
Hi all I have a on-premise ELK instance where i have an index with roughly 50.000 documents with 30 columns. One of the columns is name, indexed as a text. I have 4500 documents called VFCXXXX where the X is numbers, i… --- ## [Frequent Creation of Threads by elastic.clients](https://discuss.elastic.co/t/frequent-creation-of-threads-by-elastic-clients/362505)
**Author:** [@tom\_ding](https://discuss.elastic.co/u/tom_ding)\ **Replies:** 10\ **Last updated:** [July 5, 2024, 1:41am UTC](https://discuss.elastic.co/t/frequent-creation-of-threads-by-elastic-clients/362505 "2024-07-05T01:41:50Z")
I am using Elasticsearch Java API Client \[8.13\] and Elasticsearch (8.13), but I encounter the following exception: 复制代码 unable to create native thread: possibly out of memory or process/resource limits reached at j… --- ## [Getting duplicate log entry in dashboard](https://discuss.elastic.co/t/getting-duplicate-log-entry-in-dashboard/311041)
**Author:** [@ssksraja](https://discuss.elastic.co/u/ssksraja)\ **Replies:** 9\ **Last updated:** [August 29, 2022, 9:46am UTC](https://discuss.elastic.co/t/getting-duplicate-log-entry-in-dashboard/311041 "2022-08-29T09:46:44Z")
Hi All , iam using filebeat for the dasbboard creation for monitoring the jobs and i find log.flags:dissect\_parsing\_error as error and can any one please help to resolve this issue. --- ## [Disappearing Shards](https://discuss.elastic.co/t/disappearing-shards/3681)
**Author:** [@Jacob\_Perkins](https://discuss.elastic.co/u/Jacob_Perkins)\ **Replies:** 9\ **Last updated:** [December 21, 2010, 7:40pm UTC](https://discuss.elastic.co/t/disappearing-shards/3681 "2010-12-21T19:40:24Z")
I'm experiencing what I believe may be a bug in the elasticsearch recovery process. That is, when a node goes down (either from load or otherwise) and I bring it back up, one or more shards go missing. From the logs i… --- ## [Rally race crushes right after start](https://discuss.elastic.co/t/rally-race-crushes-right-after-start/342254)
**Author:** [@lokinehn](https://discuss.elastic.co/u/lokinehn)\ **Replies:** 10\ **Last updated:** [September 6, 2023, 4:32pm UTC](https://discuss.elastic.co/t/rally-race-crushes-right-after-start/342254 "2023-09-06T16:32:09Z")
I want to run a benchmark for my existing 8.9.0 cluster (honestly I've already run tests on that cluster earlier, and everything was great) and i get error right after start. Command i execute: esrally race --track=sql… --- ## [Highlight output changed in 0.16](https://discuss.elastic.co/t/highlight-output-changed-in-0-16/4306)
**Author:** [@ruflin\_2](https://discuss.elastic.co/u/ruflin_2)\ **Replies:** 10\ **Last updated:** [April 28, 2011, 8:37pm UTC](https://discuss.elastic.co/t/highlight-output-changed-in-0-16/4306 "2011-04-28T20:37:36Z")
With 0.16 the highlight output changed a little bit: 1) Elastica\_Query\_HighlightTest::testHightlightSearch Failed asserting that two arrays are equal. --- Expected +++ Actual @@ @@ Array ( \[email\] =\> A… --- ## [Timestamp format](https://discuss.elastic.co/t/timestamp-format/344951)
**Author:** [@hta](https://discuss.elastic.co/u/hta)\ **Replies:** 9\ **Last updated:** [October 16, 2023, 1:02pm UTC](https://discuss.elastic.co/t/timestamp-format/344951 "2023-10-16T13:02:47Z")
We get the timestamps in this format: '2023-10-01T01:22:33.123Z'. Where can I set the format? And which time zone is preset? How can I find out the timezone from the timestamp? Is that UTC? We use filebeat agents to co… --- ## [Logstash connecting to both QA and PROD?](https://discuss.elastic.co/t/logstash-connecting-to-both-qa-and-prod/173987)
**Author:** [@titan1978](https://discuss.elastic.co/u/titan1978)\ **Replies:** 9\ **Last updated:** [March 26, 2019, 10:01pm UTC](https://discuss.elastic.co/t/logstash-connecting-to-both-qa-and-prod/173987 "2019-03-26T22:01:11Z")
When Logstash bootstraps in my container, the logstash output is indicating it is registering BOTH my qa and prod endpoints. I have a series of if-else checks to connect to one or the other. But it doesn't look like logs… --- ## [\[hadoop\] newbie question](https://discuss.elastic.co/t/hadoop-newbie-question/23520)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 9\ **Last updated:** [May 5, 2015, 1:06pm UTC](https://discuss.elastic.co/t/hadoop-newbie-question/23520 "2015-05-05T13:06:51Z")
hi, i have few basic questions about es-hadoop, and i would really appreciate your kind help 1. if i have currently ES cluster, do i have motivation to add hadoop layer? 2. is the idea of ES-hadoop, that hadoo… --- ## [Winlogbeat to Logstash over SSL](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705)
**Author:** [@Mark\_Marais](https://discuss.elastic.co/u/Mark_Marais)\ **Replies:** 11\ **Last updated:** [January 16, 2023, 1:56pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-over-ssl/322705 "2023-01-16T13:56:11Z")
Good day, Can someone assist me with a secure connection from my beats to my logstash instances. Thanks. --- ## [Cluster not forming](https://discuss.elastic.co/t/cluster-not-forming/374581)
**Author:** [@joelatgrayv](https://discuss.elastic.co/u/joelatgrayv)\ **Replies:** 14\ **Last updated:** [February 19, 2025, 12:10pm UTC](https://discuss.elastic.co/t/cluster-not-forming/374581 "2025-02-19T12:10:01Z")
I’m trying to get an ES cluster working with a cloud formation. I have it all up and running but the cluster is not forming correctly. This is the error that I’m getting: {"@timestamp":"2025-02-14T22:02:57.598Z", "log.… --- ## [AD Entity Analytics - invalid Base DN](https://discuss.elastic.co/t/ad-entity-analytics-invalid-base-dn/362071)
**Author:** [@PhilA](https://discuss.elastic.co/u/PhilA)\ **Replies:** 10\ **Last updated:** [July 3, 2024, 10:16pm UTC](https://discuss.elastic.co/t/ad-entity-analytics-invalid-base-dn/362071 "2024-07-03T22:16:00Z")
I'm aware that the Active Directory Entity Analytics is new and Technical Preview but wanted to check if its me doing something wrong and if not, perhaps it is worth raising for the developers feedback. During configura… --- ## [Slow Ingestion of Final Log Chunks (Filebeat + Logstash + Elasticsearch)](https://discuss.elastic.co/t/slow-ingestion-of-final-log-chunks-filebeat-logstash-elasticsearch/377214)
**Author:** [@RafaelXokito](https://discuss.elastic.co/u/RafaelXokito)\ **Replies:** 22\ **Last updated:** [May 7, 2025, 1:08pm UTC](https://discuss.elastic.co/t/slow-ingestion-of-final-log-chunks-filebeat-logstash-elasticsearch/377214 "2025-05-07T13:08:54Z")
Setup We are using the ELK stack to ingest logs from a file share. The logs are pre-existing files, and ingestion starts from scratch when the stack is brought up. Our setup: Elasticsearch 6 GB heap 6 replicas L… --- ## [EDOT pushing to elastic fails with HTTP status message: Bad Request](https://discuss.elastic.co/t/edot-pushing-to-elastic-fails-with-http-status-message-bad-request/375661)
**Author:** [@yev](https://discuss.elastic.co/u/yev)\ **Replies:** 12\ **Last updated:** [March 26, 2026, 2:32pm UTC](https://discuss.elastic.co/t/edot-pushing-to-elastic-fails-with-http-status-message-bad-request/375661 "2026-03-26T14:32:46Z")
Hi there, I'm exploring the capabilities of EDOT and I have an issue: Logs from my spring-boot app \[otel.javaagent 2025-03-10 16:31:10:565 +0100\] \[OkHttp http://localhost:9200/...\] WARN io.opentelemetry.exporter.inter… --- ## [Timelion visualization](https://discuss.elastic.co/t/timelion-visualization/244989)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 10\ **Last updated:** [August 18, 2020, 10:25am UTC](https://discuss.elastic.co/t/timelion-visualization/244989 "2020-08-18T10:25:23Z")
Hi, i use kibana 7.7.0 , this is my data documents : {"took":0,"timed\_out":false,"\_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":8,"relation":"eq"},"max\_score":1,"hits":\[{"\_index"… --- ## [Assistance with my Logstash filter](https://discuss.elastic.co/t/assistance-with-my-logstash-filter/251342)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 9\ **Last updated:** [October 9, 2020, 1:21pm UTC](https://discuss.elastic.co/t/assistance-with-my-logstash-filter/251342 "2020-10-09T13:21:03Z")
Hello, I am trying to use a variation of the filter provided here - https://github.com/bromiley/olaf/blob/master/logstash/o365.config but I keep getting the following error, \[FATAL\]\[logstash.runner \] The given… --- ## [Elasticsearch node under utilising file descriptors](https://discuss.elastic.co/t/elasticsearch-node-under-utilising-file-descriptors/17502)
**Author:** [@Tamanjit\_Bindra](https://discuss.elastic.co/u/Tamanjit_Bindra)\ **Replies:** 9\ **Last updated:** [May 14, 2014, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-node-under-utilising-file-descriptors/17502 "2014-05-14T22:58:24Z")
Hi, I have read here, that we should set the soft and hard values of nooffiles for ES to utilise. I have done that, but somehow my BigDesk console shows that even though the upper limit is 65535, ES is only using… --- ## [Zen unicast discovery -- pulling hair out :-(](https://discuss.elastic.co/t/zen-unicast-discovery-pulling-hair-out/7690)
**Author:** [@jessejlt](https://discuss.elastic.co/u/jessejlt)\ **Replies:** 9\ **Last updated:** [February 19, 2014, 6:30am UTC](https://discuss.elastic.co/t/zen-unicast-discovery-pulling-hair-out/7690 "2014-02-19T06:30:55Z")
I'm having a difficult time getting two nodes to communicate with each other using Zen unicast discovery. I've setup a gist at https://gist.github.com/2695724 that describes the issue, shows the logs, and lists the tw… --- ## [Some Agent Do Not Send Data Custom Logs (Filestream)](https://discuss.elastic.co/t/some-agent-do-not-send-data-custom-logs-filestream/382112)
**Author:** [@lomar](https://discuss.elastic.co/u/lomar)\ **Replies:** 16\ **Last updated:** [September 26, 2025, 3:19pm UTC](https://discuss.elastic.co/t/some-agent-do-not-send-data-custom-logs-filestream/382112 "2025-09-26T15:19:32Z")
I've created a cronjob that runs a script and outputs ndjson to a file. Then I've created a integration policy that reads the log file using Custom Logs Filestream integration and add it to agent policies. Some of the a… --- ## [Scripted Field in Kibana](https://discuss.elastic.co/t/scripted-field-in-kibana/252037)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 13\ **Last updated:** [October 15, 2020, 5:58am UTC](https://discuss.elastic.co/t/scripted-field-in-kibana/252037 "2020-10-15T05:58:31Z")
Hi all, i want to calculate the capacity of every room using scripted field: my data looks ike this: rooms { "board": "Soft All Inclusive", "quantity": 1, "roomId": 42114, "paxes": { "infant": 1, "adults": 2, … --- ## [Feedback on data model (over 1 billion documents)](https://discuss.elastic.co/t/feedback-on-data-model-over-1-billion-documents/6603)
**Author:** [@Nitish\_Sharma](https://discuss.elastic.co/u/Nitish_Sharma)\ **Replies:** 10\ **Last updated:** [February 15, 2012, 7:53pm UTC](https://discuss.elastic.co/t/feedback-on-data-model-over-1-billion-documents/6603 "2012-02-15T19:53:17Z")
Hi, We are planning to use ES to search through almost 2 billion documents (and growing fast). Each document has one or more social interaction associated with it. A search should be performed on document data as wel… --- ## [Advise for logstash filter](https://discuss.elastic.co/t/advise-for-logstash-filter/128604)
**Author:** [@Maddy\_M](https://discuss.elastic.co/u/Maddy_M)\ **Replies:** 9\ **Last updated:** [April 20, 2018, 7:34pm UTC](https://discuss.elastic.co/t/advise-for-logstash-filter/128604 "2018-04-20T19:34:35Z")
Hi, I am trying to parse below line and due to time stamp and varying delimiter I am unable to use it. Could you please advise? 18/09/2016 11:09:12:AYS2345:2 dcs:0 meta-\>info:0 … --- ## [Elasticsearch Kibana](https://discuss.elastic.co/t/elasticsearch-kibana/357049)
**Author:** [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Replies:** 13\ **Last updated:** [April 24, 2024, 2:06am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049 "2024-04-24T02:06:01Z")
Hi I recently started testing Elasticsearch Kibana's anomaly detection and so far it is working fine where anomalies are detected. However I am wondering if I am able to click something that brings me to the log that was… --- ## [Dense Vector Field Extremely Large](https://discuss.elastic.co/t/dense-vector-field-extremely-large/382380)
**Author:** [@nicky](https://discuss.elastic.co/u/nicky)\ **Replies:** 12\ **Last updated:** [October 6, 2025, 11:57pm UTC](https://discuss.elastic.co/t/dense-vector-field-extremely-large/382380 "2025-10-06T23:57:16Z")
Hi all, Have been experimenting with applying both forms of compression to our dense vectors and doing performance comparisons, but while bbq\_hnsw has been performing relatively well at 1-3s per query average, int8 has … --- ## [Elastic Defend Windows Defender question](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 9\ **Last updated:** [November 3, 2025, 1:44pm UTC](https://discuss.elastic.co/t/elastic-defend-windows-defender-question/383157 "2025-11-03T13:44:45Z")
From the attached pic, I don’t understand this warning restriction. I also need some clarification with: Enable to register Elastic as an official Antivirus solution for Windows OS. This will also disable Windows Defe… --- ## [Problems with java api when upgrading elasticsearch](https://discuss.elastic.co/t/problems-with-java-api-when-upgrading-elasticsearch/13522)
**Author:** [@aldm](https://discuss.elastic.co/u/aldm)\ **Replies:** 9\ **Last updated:** [September 17, 2013, 4:46pm UTC](https://discuss.elastic.co/t/problems-with-java-api-when-upgrading-elasticsearch/13522 "2013-09-17T16:46:11Z")
Hi, we upgraded es version from 0.20.2 to 0.90.3 and we have some troubles. First of all, we had trouble getting terms facets using class InternalStringTermsFacet. 'term' os returning ByteText object in new vers… --- ## [Newbie issue](https://discuss.elastic.co/t/newbie-issue/9216)
**Author:** [@Matan\_Safriel](https://discuss.elastic.co/u/Matan_Safriel)\ **Replies:** 9\ **Last updated:** [October 3, 2012, 8:35am UTC](https://discuss.elastic.co/t/newbie-issue/9216 "2012-10-03T08:35:00Z")
Hi, As a newbie to elasticserach I today installed it on EC2, as per the suggested flow . I skipped the discovery and gateway stuff, as I seem to think I won't be needing that yet or too soon, it's just a singl… --- ## [Document ordering in index](https://discuss.elastic.co/t/document-ordering-in-index/22190)
**Author:** [@chuck](https://discuss.elastic.co/u/chuck)\ **Replies:** 10\ **Last updated:** [February 17, 2015, 6:24pm UTC](https://discuss.elastic.co/t/document-ordering-in-index/22190 "2015-02-17T18:24:16Z")
I'm researching the use of Elasticsearch as a key-value store for binary blobs. The nature of the data is such that documents with adjacent keys are more likely to be accessed together. Many documents could fit int… --- ## [TSVB dashboard - Performance issue with huge data](https://discuss.elastic.co/t/tsvb-dashboard-performance-issue-with-huge-data/357949)
**Author:** [@david89](https://discuss.elastic.co/u/david89)\ **Replies:** 13\ **Last updated:** [May 2, 2024, 9:16am UTC](https://discuss.elastic.co/t/tsvb-dashboard-performance-issue-with-huge-data/357949 "2024-05-02T09:16:06Z")
I have a performance issue with TSVB dashboard with 70 millions records and more (TSVB | Kibana Guide \[8.13\] | Elastic) I have applied rollover index in ILM, so caching can be used for normal query (request\_cache = true… --- ## [Analyzer on indexed documents](https://discuss.elastic.co/t/analyzer-on-indexed-documents/156596)
**Author:** [@Zahra\_Aminolroaya](https://discuss.elastic.co/u/Zahra_Aminolroaya)\ **Replies:** 10\ **Last updated:** [November 14, 2018, 9:48am UTC](https://discuss.elastic.co/t/analyzer-on-indexed-documents/156596 "2018-11-14T09:48:51Z")
I am new to elastic. I want to test phonetic in my documents. I used the link below to test phonetic: phonetic I tested the analyzer and I got the same result. However, in this example, you should give the text field.… --- ## [Date\_range field does not refresh my dashboard](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328)
**Author:** [@Ilyas\_Badr](https://discuss.elastic.co/u/Ilyas_Badr)\ **Replies:** 9\ **Last updated:** [November 9, 2022, 3:50pm UTC](https://discuss.elastic.co/t/date-range-field-does-not-refresh-my-dashboard/318328 "2022-11-09T15:50:47Z")
I am using kibana to search the document of elasticsearch, somehow my dashboard stopped to be refreshed I found that date\_range filed ,which represents the time that event occurred. any idea how to fix the issue? [Previous page](https://discuss.elastic.co/top.md?page=238&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=240&per_page=50&period=all)