# Top **URL:** https://discuss.elastic.co/top.md?page=245&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 246 --- ## [Latest rolled over data not searchable in Discover menu](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937)
**Author:** [@Geeboy](https://discuss.elastic.co/u/Geeboy)\ **Replies:** 10\ **Last updated:** [August 31, 2023, 1:16am UTC](https://discuss.elastic.co/t/latest-rolled-over-data-not-searchable-in-discover-menu/341937 "2023-08-31T01:16:59Z")
Im new to ELK (Im using td-agent as log forwarder) I have created ILM rollover in my dev environment, my index was successfully rolling over, but I can't search the new index in the latest rollover in the discover. i hav… --- ## [\_dateparseerror for timestamp in this format: 2023-01-11T05:07:30.648881Z,](https://discuss.elastic.co/t/dateparseerror-for-timestamp-in-this-format-2023-01-11t0530-648881z/322959)
**Author:** [@rickfish](https://discuss.elastic.co/u/rickfish)\ **Replies:** 10\ **Last updated:** [January 11, 2023, 8:54pm UTC](https://discuss.elastic.co/t/dateparseerror-for-timestamp-in-this-format-2023-01-11t0530-648881z/322959 "2023-01-11T20:54:45Z")
I am trying to parse a field called create\_ts with a value of 2023-01-11T05:07:30.648881Z and then add fields for year, month and day. I have scoured everything to figure out the correct timestamp pattern and cannot see… --- ## [I want to migrate an index from a cluster to another index in the another cluster but I get error](https://discuss.elastic.co/t/i-want-to-migrate-an-index-from-a-cluster-to-another-index-in-the-another-cluster-but-i-get-error/354314)
**Author:** [@Hatef\_Alipour](https://discuss.elastic.co/u/Hatef_Alipour)\ **Replies:** 9\ **Last updated:** [February 28, 2024, 4:11pm UTC](https://discuss.elastic.co/t/i-want-to-migrate-an-index-from-a-cluster-to-another-index-in-the-another-cluster-but-i-get-error/354314 "2024-02-28T16:11:46Z")
Hi, I want to migrate an index to another cluster. I can't use reindex because source IP is not whitelisted. also I can't use snapshot I decided to do this task by writing a logstash pipeline you can see my pipeline be… --- ## [Elasticsearch G1 GC: “To-space Exhausted” and Eden Not Cleared Leading to Potential OOM](https://discuss.elastic.co/t/elasticsearch-g1-gc-to-space-exhausted-and-eden-not-cleared-leading-to-potential-oom/380432)
**Author:** [@VietBui](https://discuss.elastic.co/u/VietBui)\ **Replies:** 10\ **Last updated:** [July 29, 2025, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-g1-gc-to-space-exhausted-and-eden-not-cleared-leading-to-potential-oom/380432 "2025-07-29T11:25:30Z")
Hi Elasticsearch Community, I’m running Elasticsearch in a Docker container (version 6.8.22), 3 nodes, each node with a 14GB heap using the G1 garbage collector. My GC logs show issues with “To-space exhausted” and Eden… --- ## [Cannot renew free Basic license on 5.2.2 — register.elastic.co reCAPTCHA shows "Invalid site key"](https://discuss.elastic.co/t/cannot-renew-free-basic-license-on-5-2-2-register-elastic-co-recaptcha-shows-invalid-site-key/387409)
**Author:** [@gbl0915](https://discuss.elastic.co/u/gbl0915)\ **Replies:** 12\ **Last updated:** [July 10, 2026, 12:07am UTC](https://discuss.elastic.co/t/cannot-renew-free-basic-license-on-5-2-2-register-elastic-co-recaptcha-shows-invalid-site-key/387409 "2026-07-10T00:07:11Z")
Hi, I'm trying to renew the free Basic license for a self-managed Elasticsearch/Kibana 5.2.2 cluster (X-Pack), which uses the one-year Basic license that has to be re-registered. The official self-service page no longe… --- ## [Migrate node from master + data to data only](https://discuss.elastic.co/t/migrate-node-from-master-data-to-data-only/375882)
**Author:** [@piyushgupta](https://discuss.elastic.co/u/piyushgupta)\ **Replies:** 13\ **Last updated:** [March 17, 2025, 12:45pm UTC](https://discuss.elastic.co/t/migrate-node-from-master-data-to-data-only/375882 "2025-03-17T12:45:35Z")
we are running 5 node Elasticsearch cluster with 3 master and 3 data node one node is acting as both master + data () This is my cluster configuration xx.yy.zz.qq 53 93 7 1.58 1.00 1.10 hilrstw - elsdata02 xx.y… --- ## [502 error when indexing a large (?) document](https://discuss.elastic.co/t/502-error-when-indexing-a-large-document/373209)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 13\ **Last updated:** [January 21, 2025, 6:09am UTC](https://discuss.elastic.co/t/502-error-when-indexing-a-large-document/373209 "2025-01-21T06:09:03Z")
Hello I am having trouble diagnosing and resolving a large document upload issue... I'm using elasticsearch SaaS and there is a document which is approximately 42MB, when my software attempts to index it I get an error: … --- ## [Inconsistencies between platforms](https://discuss.elastic.co/t/inconsistencies-between-platforms/350261)
**Author:** [@nml1988](https://discuss.elastic.co/u/nml1988)\ **Replies:** 11\ **Last updated:** [January 3, 2024, 3:35pm UTC](https://discuss.elastic.co/t/inconsistencies-between-platforms/350261 "2024-01-03T15:35:06Z")
Hello! I need help with a problem I'm having between 2 versions of ELK. These versions correspond to two different platforms that consume data from the same source. The first image corresponds to an ELK stack 7.9, where… --- ## [Migration Strategy (ES7 → ES8) via Dual‑Write + Snapshot Restore + Selective Merge by updated\_at](https://discuss.elastic.co/t/migration-strategy-es7-es8-via-dual-write-snapshot-restore-selective-merge-by-updated-at/383235)
**Author:** [@Aditya\_Rathi](https://discuss.elastic.co/u/Aditya_Rathi)\ **Replies:** 10\ **Last updated:** [November 5, 2025, 4:41pm UTC](https://discuss.elastic.co/t/migration-strategy-es7-es8-via-dual-write-snapshot-restore-selective-merge-by-updated-at/383235 "2025-11-05T16:41:51Z")
Environment / Versions: Source cluster: Elasticsearch 7.x ( live on production ) Target cluster: Elasticsearch 8.x Data volume: ~1 TB across ~100+ indices Write throughput: ~53 requests/sec, ~1,100 docs/sec (… --- ## [Using Logstash to read from a log file and then output each log lines to Kafka topic, cannot understand why it is not putting file content to kafka topic specified in conf file](https://discuss.elastic.co/t/using-logstash-to-read-from-a-log-file-and-then-output-each-log-lines-to-kafka-topic-cannot-understand-why-it-is-not-putting-file-content-to-kafka-topic-specified-in-conf-file/365499)
**Author:** [@pranchalm](https://discuss.elastic.co/u/pranchalm)\ **Replies:** 17\ **Last updated:** [August 26, 2024, 6:49pm UTC](https://discuss.elastic.co/t/using-logstash-to-read-from-a-log-file-and-then-output-each-log-lines-to-kafka-topic-cannot-understand-why-it-is-not-putting-file-content-to-kafka-topic-specified-in-conf-file/365499 "2024-08-26T18:49:57Z")
Details of the issue-: logstash version used-: 8.15.0 Kafka broker version - : 3.8.0- up at port 9092 Machine-: Windows Following is my logstash.conf-: input { file { path =\> "C:\\Users\\LENOVO\\Downloads\\ms1\\logs\\xe… --- ## [Logstash has a lag in pushing events to Elastic](https://discuss.elastic.co/t/logstash-has-a-lag-in-pushing-events-to-elastic/374798)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 18\ **Last updated:** [March 5, 2025, 7:28am UTC](https://discuss.elastic.co/t/logstash-has-a-lag-in-pushing-events-to-elastic/374798 "2025-03-05T07:28:14Z")
logstash config input { file { path =\> "C:/Program Files (x86)/db/Server/logs/oracle.log" type =\> "localhost\_access\_log" start\_position =\> "beginning" ignore\_older =\> 86400 # ignore files older than 24 … --- ## [ILM with rollovers breaking data integrity](https://discuss.elastic.co/t/ilm-with-rollovers-breaking-data-integrity/369426)
**Author:** [@Kruttika](https://discuss.elastic.co/u/Kruttika)\ **Replies:** 16\ **Last updated:** [January 8, 2025, 8:28am UTC](https://discuss.elastic.co/t/ilm-with-rollovers-breaking-data-integrity/369426 "2025-01-08T08:28:35Z")
Hello, We have an index where we need to continuously write new docs, run full-text searches and update the matched docs with a flag. The data consists of social media posts and news articles with timestamps. We previo… --- ## [Logstash does not accept SSL connections from beats](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 11\ **Last updated:** [May 7, 2025, 1:12pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775 "2025-05-07T13:12:04Z")
I was trying to set up SSL/TLS between beats and input beats in logstash. To create the certificates, I used the following commands: ### creating logstash.p12 elasticsearch-certutil crl --ca /usr/share/elasticsearch/con… --- ## [Subtracting one value out of another and showing the percentage difference](https://discuss.elastic.co/t/subtracting-one-value-out-of-another-and-showing-the-percentage-difference/348926)
**Author:** [@Dor-Alter](https://discuss.elastic.co/u/Dor-Alter)\ **Replies:** 9\ **Last updated:** [December 8, 2023, 7:18pm UTC](https://discuss.elastic.co/t/subtracting-one-value-out-of-another-and-showing-the-percentage-difference/348926 "2023-12-08T19:18:22Z")
I am trying to get a pie dashboard of successful vs abendent processes out of my logs. My issue is that there is no way to filter the abendent processes. So what I can do is filter based on the values that are successf… --- ## [Enrichement process not consistently enrching](https://discuss.elastic.co/t/enrichement-process-not-consistently-enrching/371270)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 16\ **Last updated:** [December 12, 2024, 7:04am UTC](https://discuss.elastic.co/t/enrichement-process-not-consistently-enrching/371270 "2024-12-12T07:04:04Z")
Enrichment is not consistent. I have source index from where i am enriching the a field on the basis of the destination ip. enrichemnt is working but sometime its not enriching the field even the same destination.ip is t… --- ## [Kafka can collect java stack log but elastic search cannot. How to fix?](https://discuss.elastic.co/t/kafka-can-collect-java-stack-log-but-elastic-search-cannot-how-to-fix/332612)
**Author:** [@Alwyn\_Tiu](https://discuss.elastic.co/u/Alwyn_Tiu)\ **Replies:** 12\ **Last updated:** [May 9, 2023, 3:40am UTC](https://discuss.elastic.co/t/kafka-can-collect-java-stack-log-but-elastic-search-cannot-how-to-fix/332612 "2023-05-09T03:40:19Z")
Kafka can collect java stack log but Elasticsearch cannot. How to fix? --- ## [Elasticsearch Not Freeing Disk Space After Shard Relocation](https://discuss.elastic.co/t/elasticsearch-not-freeing-disk-space-after-shard-relocation/373075)
**Author:** [@09a9373743777d8430c4](https://discuss.elastic.co/u/09a9373743777d8430c4)\ **Replies:** 13\ **Last updated:** [January 14, 2025, 6:54pm UTC](https://discuss.elastic.co/t/elasticsearch-not-freeing-disk-space-after-shard-relocation/373075 "2025-01-14T18:54:40Z")
We are experiencing an issue where Elasticsearch is not properly freeing up disk space after relocating shards. Specifically, even though the shards are relocated, disk space is not being released as expected. This issue… --- ## [Logstash never picked up any logs. I mean it never parse any logs except 2 log lines for the entire day](https://discuss.elastic.co/t/logstash-never-picked-up-any-logs-i-mean-it-never-parse-any-logs-except-2-log-lines-for-the-entire-day/344063)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 9\ **Last updated:** [September 28, 2023, 3:55pm UTC](https://discuss.elastic.co/t/logstash-never-picked-up-any-logs-i-mean-it-never-parse-any-logs-except-2-log-lines-for-the-entire-day/344063 "2023-09-28T15:55:40Z")
I have using logstash 8.10.0 for windows and linux downloaded from elastic.co downloads. I could hardly see 2 events ingested by logstash. logstash-plain.log does not have any error after pipeline\_running. configura… --- ## [Warm data nodes receiving documents without warm data ILM](https://discuss.elastic.co/t/warm-data-nodes-receiving-documents-without-warm-data-ilm/283486)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 9\ **Last updated:** [September 10, 2021, 4:38am UTC](https://discuss.elastic.co/t/warm-data-nodes-receiving-documents-without-warm-data-ilm/283486 "2021-09-10T04:38:58Z")
Today I added 2 warm data nodes to our 3 node cluster. This is the first time we are using anything besides hot nodes so I have some observations and questions. The 3 hot data nodes have roles as below "roles" : \[… --- ## [\[solved\] Kibana Monitoring \[illegal\_argument\_exception\]](https://discuss.elastic.co/t/solved-kibana-monitoring-illegal-argument-exception/187974)
**Author:** [@rog\_NB](https://discuss.elastic.co/u/rog_NB)\ **Replies:** 0\ **Last updated:** [June 28, 2019, 5:32am UTC](https://discuss.elastic.co/t/solved-kibana-monitoring-illegal-argument-exception/187974 "2019-06-28T05:32:58Z")
I'm on my Lab to update from 6.6.1 to 7.2 After all work done, I had on the tab Monitoring this error on the lower right corner of the browser: Monitoring Request Error \[illegal\_argument\_exception\] Fielddata is disa… --- ## [Possible bug in TopChildrenQuery](https://discuss.elastic.co/t/possible-bug-in-topchildrenquery/12643)
**Author:** [@Rodrigo\_Ribeiro](https://discuss.elastic.co/u/Rodrigo_Ribeiro)\ **Replies:** 9\ **Last updated:** [July 4, 2013, 8:03pm UTC](https://discuss.elastic.co/t/possible-bug-in-topchildrenquery/12643 "2013-07-04T20:03:27Z")
I'm getting this error using the TopChildrenQuery: ClassCastException\[org.elasticsearch.index.search.child.TopChildrenQuery cannot be cast to org.elasticsearch.index.search.child.HasChildFilter\]; Debugging, i found… --- ## [NotFoundError](https://discuss.elastic.co/t/notfounderror/365150)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 11\ **Last updated:** [August 19, 2024, 6:35pm UTC](https://discuss.elastic.co/t/notfounderror/365150 "2024-08-19T18:35:49Z")
Hi, I have alias in which a number of index are associated When I want to update documents using alias it returns this error to me From Update Method-\> NotFoundError(404, 'document missing exception', '\[ks5N 44B1PKbf… --- ## [Elasticsearch cluster migration from 7.12 to 8.5](https://discuss.elastic.co/t/elasticsearch-cluster-migration-from-7-12-to-8-5/319271)
**Author:** [@satendra1987](https://discuss.elastic.co/u/satendra1987)\ **Replies:** 10\ **Last updated:** [November 21, 2022, 5:02am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-migration-from-7-12-to-8-5/319271 "2022-11-21T05:02:30Z")
Hi, we are running an 1 node elasticsearch cluster on 7.12. we want to setup a 3 node cluster on 8.5. can someone let me know how to migrate the existing indexes to new cluster. Thanks Satendra --- ## [Regarding ignore fieds](https://discuss.elastic.co/t/regarding-ignore-fieds/317803)
**Author:** [@yasar](https://discuss.elastic.co/u/yasar)\ **Replies:** 9\ **Last updated:** [November 3, 2022, 7:48am UTC](https://discuss.elastic.co/t/regarding-ignore-fieds/317803 "2022-11-03T07:48:42Z")
Hi team, We would like to explore the ignore fields in Filebeat. Our purpose is to deleted the older files after denoted the value looks below. After implemented the ignore\_older as 2h in filebeat. The logs has stop… --- ## [Exaggerated consumption of ES instance](https://discuss.elastic.co/t/exaggerated-consumption-of-es-instance/328616)
**Author:** [@OscarFilho](https://discuss.elastic.co/u/OscarFilho)\ **Replies:** 9\ **Last updated:** [March 28, 2023, 5:09pm UTC](https://discuss.elastic.co/t/exaggerated-consumption-of-es-instance/328616 "2023-03-28T17:09:54Z")
Hello! I have an Elastic cloud cluster where I have 2 instances. Each instance is 120GB in size and works as replicas in different Availability Zones for redundancy. Something strange happened that I can't understand w… --- ## [NOT ABLE TO INDEX DATA USING HTTP POLLER](https://discuss.elastic.co/t/not-able-to-index-data-using-http-poller/353251)
**Author:** [@rajatbhardwaj1393](https://discuss.elastic.co/u/rajatbhardwaj1393)\ **Replies:** 12\ **Last updated:** [February 15, 2024, 10:37am UTC](https://discuss.elastic.co/t/not-able-to-index-data-using-http-poller/353251 "2024-02-15T10:37:10Z")
want to index data from the third party api. trying to index data from response but the data is coming as array of results and ruby code below is not storing it as individual event. Can someone suggest what i am doing w… --- ## [Elasticsearch indexing\_pressure.memory.limit](https://discuss.elastic.co/t/elasticsearch-indexing-pressure-memory-limit/383670)
**Author:** [@ee99](https://discuss.elastic.co/u/ee99)\ **Replies:** 15\ **Last updated:** [December 2, 2025, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-pressure-memory-limit/383670 "2025-12-02T14:04:00Z")
When I try to index large log files through bulk\_index, I notice got logs missing. Suspecting it could be due to the memory issue of the elasticsearch nodes. I tried to change the indexing\_pressure.memory.limit to 40%. B… --- ## [Problem with an IF statement not working](https://discuss.elastic.co/t/problem-with-an-if-statement-not-working/351608)
**Author:** [@FaisalParkar](https://discuss.elastic.co/u/FaisalParkar)\ **Replies:** 10\ **Last updated:** [January 24, 2024, 10:15am UTC](https://discuss.elastic.co/t/problem-with-an-if-statement-not-working/351608 "2024-01-24T10:15:42Z")
Hello Everyone, I hope someone is able to assist. I am running ELK stack 8.11.3 and am using Logstash to ingest Syslogs in a CEF format. I have everything working and it works nicely, however I want to add an IF stateme… --- ## [Opposite of "Append" processor?](https://discuss.elastic.co/t/opposite-of-append-processor/355095)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 10\ **Last updated:** [March 14, 2024, 1:16pm UTC](https://discuss.elastic.co/t/opposite-of-append-processor/355095 "2024-03-14T13:16:02Z")
Hell guys, what ingest processor can I use to remove an item from an array? In my case I want to remove an "error tag" that was added to the "tags" field. --- ## [Elasticsearch rolling upgrade failed](https://discuss.elastic.co/t/elasticsearch-rolling-upgrade-failed/364907)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 9\ **Last updated:** [August 14, 2024, 6:20pm UTC](https://discuss.elastic.co/t/elasticsearch-rolling-upgrade-failed/364907 "2024-08-14T18:20:58Z")
I did rolling upgrade for my cluster with two nodes from 8.8 to 8.15. I got 503 error. Here is the result. curl -X GET -k -u elastic:PASSWORD 'https://localhost:9200' {"error":{"root\_cause":\[{"type":"status\_exception","… --- ## [Alerts indices custom components template](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731)
**Author:** [@aptfinf](https://discuss.elastic.co/u/aptfinf)\ **Replies:** 9\ **Last updated:** [June 4, 2025, 1:20pm UTC](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731 "2025-06-04T13:20:38Z")
Hello everyone, I have a question: I know that for the "logs" indices templates exists the component template "@custom" that gets automatically mapped to the index templates. Does this same thing exist for the ".intern… --- ## [Sending multiple events using a single POST with http output codec](https://discuss.elastic.co/t/sending-multiple-events-using-a-single-post-with-http-output-codec/365857)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 11\ **Last updated:** [September 3, 2024, 5:12pm UTC](https://discuss.elastic.co/t/sending-multiple-events-using-a-single-post-with-http-output-codec/365857 "2024-09-03T17:12:56Z")
Good Day, How do you send multiple events in a single POST using the http output codec? I can send the below events but they are sent as 2 individual POSTS and I need to send them as a single post due to restrictions o… --- ## [How to update fields that are not opened in the source document without affecting them](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 14\ **Last updated:** [November 11, 2025, 1:48am UTC](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175 "2025-11-11T01:48:32Z")
My template { "mappings":{"dynamic": "false","\_source":{"includes":\["a","b"\]},"properties":{"a":{"type": "keyword"},"b":{"type": "keyword"},"c":{"type": "keyword"}}}} PUT /your\_index\_name/\_doc/1 {"a": "value\_a","b": "… --- ## [Reindexed Documents are not showing up, Response says it has created but it does not show up in destination index](https://discuss.elastic.co/t/reindexed-documents-are-not-showing-up-response-says-it-has-created-but-it-does-not-show-up-in-destination-index/337987)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 9\ **Last updated:** [July 10, 2023, 2:15pm UTC](https://discuss.elastic.co/t/reindexed-documents-are-not-showing-up-response-says-it-has-created-but-it-does-not-show-up-in-destination-index/337987 "2023-07-10T14:15:13Z")
http://localhost:9201/restored\_index/\_search Response: { "took": 2, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 }, "hits":… --- ## [Logstash synced with MySQL taking to long to execute the queries](https://discuss.elastic.co/t/logstash-synced-with-mysql-taking-to-long-to-execute-the-queries/356646)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 17\ **Last updated:** [April 3, 2024, 10:07am UTC](https://discuss.elastic.co/t/logstash-synced-with-mysql-taking-to-long-to-execute-the-queries/356646 "2024-04-03T10:07:17Z")
Look at the below screenshot, you can see that while querying a table with just 146 records it's taking 6.2 seconds to execute. Now, take a look at my configuration files for logstash: base.conf: input { jdbc { … --- ## [ELK stack in docker](https://discuss.elastic.co/t/elk-stack-in-docker/378721)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 12\ **Last updated:** [June 10, 2025, 6:07am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721 "2025-06-10T06:07:18Z")
Hi All, I am working on a project to spin up ELK stack inside docker container. I have containers for elasticsearch/kibana up and running but whenever I am trying to run logstash it gives me the below error, I replace… --- ## [How to load emails into ES instance](https://discuss.elastic.co/t/how-to-load-emails-into-es-instance/364730)
**Author:** [@jaime\_solas](https://discuss.elastic.co/u/jaime_solas)\ **Replies:** 21\ **Last updated:** [August 15, 2024, 8:40am UTC](https://discuss.elastic.co/t/how-to-load-emails-into-es-instance/364730 "2024-08-15T08:40:11Z")
Hello, I am trying to upload emails in xml format, these xml files were obtained using apache tika to convert the .eml files to .xml I'm trying to load the data into ES with logstash but it's not working and I think it'… --- ## [Weird behaviour on document update to remove value from a field](https://discuss.elastic.co/t/weird-behaviour-on-document-update-to-remove-value-from-a-field/363427)
**Author:** [@Vijeya\_Nidhi](https://discuss.elastic.co/u/Vijeya_Nidhi)\ **Replies:** 13\ **Last updated:** [July 19, 2024, 2:52pm UTC](https://discuss.elastic.co/t/weird-behaviour-on-document-update-to-remove-value-from-a-field/363427 "2024-07-19T14:52:53Z")
Elasticsearch version 8.13.3 Assume there is a document with id test in index testindex with following fields. { "field1": "any1", "field2": "any2" } if i execute a update request like POST: \/testindex… --- ## [Elasticsearch 2.4.6 starts with warnings](https://discuss.elastic.co/t/elasticsearch-2-4-6-starts-with-warnings/356696)
**Author:** [@Aldahir\_Zamora](https://discuss.elastic.co/u/Aldahir_Zamora)\ **Replies:** 11\ **Last updated:** [April 3, 2024, 6:55pm UTC](https://discuss.elastic.co/t/elasticsearch-2-4-6-starts-with-warnings/356696 "2024-04-03T18:55:30Z")
Hello, I am having a problem with the elasticsearch service (2.4.6) that I am running on a centos server, currently the service goes down every so often (1-2 days) and when I start the service it gives me this warning, I… --- ## [Store last X documents per id](https://discuss.elastic.co/t/store-last-x-documents-per-id/356737)
**Author:** [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)\ **Replies:** 10\ **Last updated:** [April 5, 2024, 5:24am UTC](https://discuss.elastic.co/t/store-last-x-documents-per-id/356737 "2024-04-05T05:24:48Z")
Hello Elastic's team and community! I am looking for a way to keep only recent documents for a particular id. Ideally it happens automatically via some Elasticsearch configuration or with one hop request after a new doc… --- ## [\[node-frozen\] fatal exception while booting Elasticsearchjava.io.UncheckedIOException: java.io.IOException: Not enough free space \[55991361536\] for cache file of size \[131852140544\] in path \[/usr/bin/elasticsearch-node-frozen/elasticsearch-8.15.1/data\]](https://discuss.elastic.co/t/node-frozen-fatal-exception-while-booting-elasticsearchjava-io-uncheckedioexception-java-io-ioexception-not-enough-free-space-55991361536-for-cache-file-of-size-131852140544-in-path-usr-bin-elasticsearch-node-frozen-elasticsearch-8-15-1-data/368072)
**Author:** [@ax-va](https://discuss.elastic.co/u/ax-va)\ **Replies:** 9\ **Last updated:** [October 1, 2024, 3:27pm UTC](https://discuss.elastic.co/t/node-frozen-fatal-exception-while-booting-elasticsearchjava-io-uncheckedioexception-java-io-ioexception-not-enough-free-space-55991361536-for-cache-file-of-size-131852140544-in-path-usr-bin-elasticsearch-node-frozen-elasticsearch-8-15-1-data/368072 "2024-10-01T15:27:18Z")
I have a problem with adding a new frozen node. At first, I have installed Elasticsearch of version 8.15.1 on my local machine by extracting tar.gz on Ubuntu 22.04. LTS. It is working fine. Then, I have added a cold nod… --- ## [Inquiry on Elastic Search Terms for Prepositions](https://discuss.elastic.co/t/inquiry-on-elastic-search-terms-for-prepositions/358255)
**Author:** [@aisyaharifin](https://discuss.elastic.co/u/aisyaharifin)\ **Replies:** 9\ **Last updated:** [April 26, 2024, 4:22pm UTC](https://discuss.elastic.co/t/inquiry-on-elastic-search-terms-for-prepositions/358255 "2024-04-26T16:22:21Z")
Hello Elastic, My dev team did a testing on the search terms for Elasticsearch on our apps site and the findings is that Elastic didn't highlight I would group it as preposition terms, such as 'the', 'with', are and etc… --- ## [Parsing JSON Array In Event](https://discuss.elastic.co/t/parsing-json-array-in-event/328393)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 9\ **Last updated:** [March 24, 2023, 9:54pm UTC](https://discuss.elastic.co/t/parsing-json-array-in-event/328393 "2023-03-24T21:54:24Z")
I am using the jdbc\_streaming filter to pull additional data for an event from a database, the result looks like below. Any ideas on how I could have this parsed out so that I don't lose any of the data and keep it all … --- ## [Need to set yyyy-dd-mm in apm-server prcessor event index](https://discuss.elastic.co/t/need-to-set-yyyy-dd-mm-in-apm-server-prcessor-event-index/366472)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 14\ **Last updated:** [October 8, 2024, 2:59am UTC](https://discuss.elastic.co/t/need-to-set-yyyy-dd-mm-in-apm-server-prcessor-event-index/366472 "2024-10-08T02:59:32Z")
Kibana version: 7.17.23 Elasticsearch version:7.17.0 APM Server version: 7.17.20 Original install method (e.g. download page, yum, deb, from source, etc.) and version\*\*: deb Fresh install or upgraded from other versi… --- ## [Logstash output email plugin failure](https://discuss.elastic.co/t/logstash-output-email-plugin-failure/351847)
**Author:** [@shailendra1](https://discuss.elastic.co/u/shailendra1)\ **Replies:** 9\ **Last updated:** [February 5, 2024, 3:38am UTC](https://discuss.elastic.co/t/logstash-output-email-plugin-failure/351847 "2024-02-05T03:38:51Z")
Hello Team, i am using elk 8.5.3 and in the logstash output plugin , its failing with SMTP syntax error as pasted below ERROR\]\[logstash.outputs.email \]\[main\]\[9ab43dc1824014b9cc39372f569aeded7925e535ec037015bed8af1439… --- ## [Average calculations not consistent](https://discuss.elastic.co/t/average-calculations-not-consistent/321739)
**Author:** [@Wpq](https://discuss.elastic.co/u/Wpq)\ **Replies:** 9\ **Last updated:** [December 21, 2022, 2:58pm UTC](https://discuss.elastic.co/t/average-calculations-not-consistent/321739 "2022-12-21T14:58:43Z")
I have data of the type { "user": "john", "country": "japan", "applied": 1 }, { "user": "mary", "country": "japan", "applied": 1 }, { "user": "paul", "country": "japan", "applied": 0 }, { "user": "fr… --- ## [Filebeat sends no Logs to ELK](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-elk/380725)
**Author:** [@Elasticisti](https://discuss.elastic.co/u/Elasticisti)\ **Replies:** 11\ **Last updated:** [August 5, 2025, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-elk/380725 "2025-08-05T14:31:20Z")
Hello, ELK Version: 9.1.0 Elastic Agent 9.1.0 Filebeat Version 9.1.0 I have installed filebeat and runs: I have configured it on this way to send the atlassian Logs to ELK: Only output.elasticsearch is activa… --- ## [Using post filter to remove entries whereby collapsed inner hits total is less than X](https://discuss.elastic.co/t/using-post-filter-to-remove-entries-whereby-collapsed-inner-hits-total-is-less-than-x/371722)
**Author:** [@codeMonkey82](https://discuss.elastic.co/u/codeMonkey82)\ **Replies:** 9\ **Last updated:** [December 13, 2024, 12:24pm UTC](https://discuss.elastic.co/t/using-post-filter-to-remove-entries-whereby-collapsed-inner-hits-total-is-less-than-x/371722 "2024-12-13T12:24:24Z")
I have a query that collapses on a field representing a hash that can at most be shared between two entries. What I need to do is via a post filter (or alternative) remove the results from the final list whereby the inne… --- ## [Sum aggregation Giving incorrect resumt](https://discuss.elastic.co/t/sum-aggregation-giving-incorrect-resumt/378329)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 14\ **Last updated:** [May 23, 2025, 4:46pm UTC](https://discuss.elastic.co/t/sum-aggregation-giving-incorrect-resumt/378329 "2025-05-23T16:46:03Z")
I'm encountering an issue in Kibana. When I check a particular variable in Discover, I can see that it has a value of 0 on four different dates. For the remaining dates, there is no data shown for this variable in Discov… --- ## [Grok and parsing of logstash data](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 15\ **Last updated:** [July 17, 2025, 10:43am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408 "2025-07-17T10:43:26Z")
Good morning I am integrating data from an application called telegraf into logstash here is my telegraf conf file # Global Agent Configuration \[agent\] hostname = "" flush\_interval = "15s" interval = "1500s" … [Previous page](https://discuss.elastic.co/top.md?page=244&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=246&per_page=50&period=all)