# Top **URL:** https://discuss.elastic.co/top.md?page=247&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 248 --- ## [Occasionally missing data when making both gt + lte queries with a single isoformatted date](https://discuss.elastic.co/t/occasionally-missing-data-when-making-both-gt-lte-queries-with-a-single-isoformatted-date/323284)
**Author:** [@jsun-m](https://discuss.elastic.co/u/jsun-m)\ **Replies:** 9\ **Last updated:** [January 17, 2023, 8:45am UTC](https://discuss.elastic.co/t/occasionally-missing-data-when-making-both-gt-lte-queries-with-a-single-isoformatted-date/323284 "2023-01-17T08:45:34Z")
Use case: I'm trying to build a realtime logging client that allows the user to search old logs as well as see new logs come in realtime. So far everything mostly functions as expected except when the first queries are … --- ## [Updating index.mapping.depth.limit for index template](https://discuss.elastic.co/t/updating-index-mapping-depth-limit-for-index-template/369189)
**Author:** [@brandon.n](https://discuss.elastic.co/u/brandon.n)\ **Replies:** 14\ **Last updated:** [October 30, 2024, 12:39pm UTC](https://discuss.elastic.co/t/updating-index-mapping-depth-limit-for-index-template/369189 "2024-10-30T12:39:12Z")
Hello, We are attempting to set the index.mapping.depth.limit to 3 for a new index template as we are seeing dynamically created objects that keep adding new fields (4,000+). Is there a way to set the depth limit in the… --- ## [Change timestamp in logstash](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909)
**Author:** [@sudharsanam132](https://discuss.elastic.co/u/sudharsanam132)\ **Replies:** 10\ **Last updated:** [March 8, 2024, 9:04am UTC](https://discuss.elastic.co/t/change-timestamp-in-logstash/354909 "2024-03-08T09:04:53Z")
Im having logs like below from logstash 8.9.1 2024-03-06T23:43:37.317829530Z 192.168.1.132 \<14\> 2024-03-06T23:43:37Z forwarder.tmes.trendmicro.com tmes\[1\]: CEF:0|Trend Micro|TMES|1.0.0.0|100101|DETECTION|6|rt=2024-03-06… --- ## [Why mutate will influence different pipelines?](https://discuss.elastic.co/t/why-mutate-will-influence-different-pipelines/328210)
**Author:** [@AlanChan](https://discuss.elastic.co/u/AlanChan)\ **Replies:** 9\ **Last updated:** [March 31, 2023, 6:44am UTC](https://discuss.elastic.co/t/why-mutate-will-influence-different-pipelines/328210 "2023-03-31T06:44:11Z")
Hi I'd like to process the same input data in different ways to get different results, so I'm trying to do with multiple pipelines. However, I notice that using mutate will influence other pipelines. Does anyone know ho… --- ## [Messaging.message.conversation\_id visible in Traces but not searchable in Discover](https://discuss.elastic.co/t/messaging-message-conversation-id-visible-in-traces-but-not-searchable-in-discover/390038)
**Author:** [@ex.ko](https://discuss.elastic.co/u/ex.ko)\ **Replies:** 9\ **Last updated:** [September 8, 2026, 10:50am UTC](https://discuss.elastic.co/t/messaging-message-conversation-id-visible-in-traces-but-not-searchable-in-discover/390038 "2026-09-08T10:50:29Z")
Hi everyone, We're using the JMS Correlation ID in our application. In Elastic APM / Traces, I can see the field and its value on individual spans in the field: attributes.messaging.message.conversation\_id However, I c… --- ## [Fields are not shown in KIbana](https://discuss.elastic.co/t/fields-are-not-shown-in-kibana/364634)
**Author:** [@peter170805](https://discuss.elastic.co/u/peter170805)\ **Replies:** 9\ **Last updated:** [August 12, 2024, 4:11pm UTC](https://discuss.elastic.co/t/fields-are-not-shown-in-kibana/364634 "2024-08-12T16:11:57Z")
Hello dear friends of the community. I wanted to know if you could give me some clues as to why I can't view the data loaded in Kibana in an index that I created. I created an index with the mapping to load all the data … --- ## [Stop elastic shard store on old elastic node](https://discuss.elastic.co/t/stop-elastic-shard-store-on-old-elastic-node/365175)
**Author:** [@Julian\_Fazri](https://discuss.elastic.co/u/Julian_Fazri)\ **Replies:** 10\ **Last updated:** [August 20, 2024, 4:43pm UTC](https://discuss.elastic.co/t/stop-elastic-shard-store-on-old-elastic-node/365175 "2024-08-20T16:43:06Z")
Hi All, I want to migrate existing elastic nodes to the new nodes using the join cluster method, So I don't have to backup-restore the data and kibana feature configuration. The details are below: I have 3 existing el… --- ## [Allocation awarenes vs data tiering problems](https://discuss.elastic.co/t/allocation-awarenes-vs-data-tiering-problems/378820)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 16\ **Last updated:** [June 18, 2025, 3:03pm UTC](https://discuss.elastic.co/t/allocation-awarenes-vs-data-tiering-problems/378820 "2025-06-18T15:03:02Z")
Minimal setup is like this: Node Data tier Rack 1 data\_hot,data\_content A 2 data\_hot,data\_content B 3 data\_hot,data\_content B 4 data\_cold A 5 data\_cold B Node 1 failed. I expected elastic create new … --- ## [Translate filter with yml file](https://discuss.elastic.co/t/translate-filter-with-yml-file/367264)
**Author:** [@Honestabe](https://discuss.elastic.co/u/Honestabe)\ **Replies:** 17\ **Last updated:** [September 30, 2024, 11:28pm UTC](https://discuss.elastic.co/t/translate-filter-with-yml-file/367264 "2024-09-30T23:28:36Z")
I made trying to use translate filter with a yml file to add geo\_point this is the yml file configuration JP.558-0045:\[135.4949, 34.6134\] \` yet when I run the pipeline with this config translate { field =\> … --- ## [Way to align Text in Discovery View](https://discuss.elastic.co/t/way-to-align-text-in-discovery-view/372804)
**Author:** [@samer\_saleh](https://discuss.elastic.co/u/samer_saleh)\ **Replies:** 11\ **Last updated:** [January 7, 2025, 11:41am UTC](https://discuss.elastic.co/t/way-to-align-text-in-discovery-view/372804 "2025-01-07T11:41:06Z")
Hi, I have created a Discovery View that I would like to use in a dashboard , but I could not find a way to align text in certain columns. Is there a way to do it? I understand Discovery are just for looking up data wit… --- ## [Elastic APM shows 100% CPU usage but the cause is unclear – need help!](https://discuss.elastic.co/t/elastic-apm-shows-100-cpu-usage-but-the-cause-is-unclear-need-help/376173)
**Author:** [@truongsontn96](https://discuss.elastic.co/u/truongsontn96)\ **Replies:** 9\ **Last updated:** [July 7, 2025, 1:17pm UTC](https://discuss.elastic.co/t/elastic-apm-shows-100-cpu-usage-but-the-cause-is-unclear-need-help/376173 "2025-07-07T13:17:27Z")
I am experiencing an issue with Elastic APM where the system.cpu.total.norm.pct metric for a specific service is always 1, indicating that CPU usage is constantly at 100%, However, when I check inside the container, I d… --- ## [Some fields are missing after rename.](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459)
**Author:** [@JHub-Wei](https://discuss.elastic.co/u/JHub-Wei)\ **Replies:** 11\ **Last updated:** [December 16, 2023, 2:22am UTC](https://discuss.elastic.co/t/some-fields-are-missing-after-rename/349459 "2023-12-16T02:22:57Z")
After logstash-oss is upgraded from 7.6.0 to 7.12.1, some fields are lost after parsing the nested JSON data of Kafka. Kafka JSON example data: {"timestamp":1702630468791,"region":"cn-north-3","eventId":"QER\_INFO","args… --- ## [Winlogbeat error connecting to ElasticSearch](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch/365316)
**Author:** [@Edzel\_Severino](https://discuss.elastic.co/u/Edzel_Severino)\ **Replies:** 10\ **Last updated:** [August 26, 2024, 12:58am UTC](https://discuss.elastic.co/t/winlogbeat-error-connecting-to-elasticsearch/365316 "2024-08-26T00:58:22Z")
Hello, can someone help me? I am having a problem after winlogbeat installation. when i run .\\winlogbeat.exe setup -e is show error: Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: \[error… --- ## [Elastic search parsing error](https://discuss.elastic.co/t/elastic-search-parsing-error/368666)
**Author:** [@miiroslavkardos](https://discuss.elastic.co/u/miiroslavkardos)\ **Replies:** 10\ **Last updated:** [October 14, 2024, 6:38pm UTC](https://discuss.elastic.co/t/elastic-search-parsing-error/368666 "2024-10-14T18:38:10Z")
Hello, i have same problem as Logstash json parse error, but i am not using any codec =\> json or not handling json data. But when i use output { if \[type\] == "mssql-audit-dwh" { stdout { codec … --- ## [Logstash's Elasticsearch filter plugin bottleneck](https://discuss.elastic.co/t/logstashs-elasticsearch-filter-plugin-bottleneck/372666)
**Author:** [@lethargicsnailspider](https://discuss.elastic.co/u/lethargicsnailspider)\ **Replies:** 11\ **Last updated:** [January 8, 2025, 4:34pm UTC](https://discuss.elastic.co/t/logstashs-elasticsearch-filter-plugin-bottleneck/372666 "2025-01-08T16:34:29Z")
I have a Logstash pipeline set up with multiple Elasticsearch filter plugins to do a lookup of field values ingested via an input filter. Processing and writing the events into Elasticsearch is around 500,000 events per … --- ## [AIOps no data views or saved searches found](https://discuss.elastic.co/t/aiops-no-data-views-or-saved-searches-found/344981)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 10\ **Last updated:** [October 18, 2023, 8:59am UTC](https://discuss.elastic.co/t/aiops-no-data-views-or-saved-searches-found/344981 "2023-10-18T08:59:26Z")
Hello, AIOps no data views or saved searches found.. We definitely have data views / saves searches. So why don't we find them? Willem --- ## [\[Resolved\] LS pipeline.id not being honoured in logstash.yml](https://discuss.elastic.co/t/resolved-ls-pipeline-id-not-being-honoured-in-logstash-yml/362760)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 9\ **Last updated:** [July 9, 2024, 3:38pm UTC](https://discuss.elastic.co/t/resolved-ls-pipeline-id-not-being-honoured-in-logstash-yml/362760 "2024-07-09T15:38:32Z")
I have a logstash instance running as a docker continer. Since it is using only a single pipeline, I've not bothered configuring the pipeline.yml. Instead, I've defined the pipeline params in the logstash.yml file itself… --- ## [Cluster currently at 1000/1000 shards open, but \_nodes/stats shows only 526 used?](https://discuss.elastic.co/t/cluster-currently-at-1000-1000-shards-open-but-nodes-stats-shows-only-526-used/379893)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 17\ **Last updated:** [July 9, 2025, 10:13am UTC](https://discuss.elastic.co/t/cluster-currently-at-1000-1000-shards-open-but-nodes-stats-shows-only-526-used/379893 "2025-07-09T10:13:44Z")
We recently started to get messages from logstash stating that "Could not index event to Elasticsearch... Validation failed: 1: this action would add \[2\] shards, but this cluster currently has \[1000\]/\[1000\] maximum norma… --- ## [ES7.17.5 All nodes BKD readDeltaVInt](https://discuss.elastic.co/t/es7-17-5-all-nodes-bkd-readdeltavint/357882)
**Author:** [@yangchenyu1997](https://discuss.elastic.co/u/yangchenyu1997)\ **Replies:** 11\ **Last updated:** [April 22, 2024, 8:46am UTC](https://discuss.elastic.co/t/es7-17-5-all-nodes-bkd-readdeltavint/357882 "2024-04-22T08:46:06Z")
--- ## [High sustained read traffic from Elasticsearch hot pods](https://discuss.elastic.co/t/high-sustained-read-traffic-from-elasticsearch-hot-pods/385508)
**Author:** [@cjpowers](https://discuss.elastic.co/u/cjpowers)\ **Replies:** 16\ **Last updated:** [April 14, 2026, 1:40pm UTC](https://discuss.elastic.co/t/high-sustained-read-traffic-from-elasticsearch-hot-pods/385508 "2026-04-14T13:40:32Z")
I’m running an EFK stack in an RKE2 cluster on RHEL 8.5. The VMs are hosted in vSphere and use centralized NetApp storage. Our Elasticsearch footprint currently looks like this: 2 master nodes 2 client nodes 2 hot da… --- ## [My kibana.service failed after i made a change in kibana.yml](https://discuss.elastic.co/t/my-kibana-service-failed-after-i-made-a-change-in-kibana-yml/375420)
**Author:** [@Duong\_Hieu](https://discuss.elastic.co/u/Duong_Hieu)\ **Replies:** 13\ **Last updated:** [March 7, 2025, 9:06am UTC](https://discuss.elastic.co/t/my-kibana-service-failed-after-i-made-a-change-in-kibana-yml/375420 "2025-03-07T09:06:03Z")
i installed kibana by rpm, it was running til i made some change to kibana.yml, after that it failed immediately. This is what i changed: server.port: 5601 server.host:"10.6.145.226" elasticsearch.hosts: \["https:/\_/10… --- ## [Filebeat now processor seams to be buggy](https://discuss.elastic.co/t/filebeat-now-processor-seams-to-be-buggy/389776)
**Author:** [@Toony](https://discuss.elastic.co/u/Toony)\ **Replies:** 14\ **Last updated:** [August 20, 2026, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-now-processor-seams-to-be-buggy/389776 "2026-08-20T12:15:47Z")
Hi, It seems the now processor behaves strangely If I set a now processor in filebeat at the top yaml level like this: processors: - now: field: metadata.timeline.t1 and configure Logstash like this: input {… --- ## [Not send logs to elasticsearch](https://discuss.elastic.co/t/not-send-logs-to-elasticsearch/363017)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 9\ **Last updated:** [August 9, 2024, 10:53pm UTC](https://discuss.elastic.co/t/not-send-logs-to-elasticsearch/363017 "2024-08-09T22:53:19Z")
filebeat.yml filebeat.inputs: - type: container enabled: true paths: - /var/lib/docker/containers/\*/\*.log processors: - add\_docker\_metadata: ~ output.elasticsearch: hosts: \["172.20.111.199:9200"\] pipe… --- ## [How we can manage to large shards on index?](https://discuss.elastic.co/t/how-we-can-manage-to-large-shards-on-index/372652)
**Author:** [@calvin01](https://discuss.elastic.co/u/calvin01)\ **Replies:** 11\ **Last updated:** [January 2, 2025, 4:19pm UTC](https://discuss.elastic.co/t/how-we-can-manage-to-large-shards-on-index/372652 "2025-01-02T16:19:13Z")
Hello, community Issue Overview: We are encountering an issue with one of our indices, which has entered an alerting state. The shard size for this index is currently 129.27GB, and it continues to increase. The index i… --- ## [.geoip\_database index created in es7 prevents es9 upgrade](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 14\ **Last updated:** [July 24, 2026, 6:22am UTC](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618 "2026-07-24T06:22:49Z")
We follow an es upgrade approach where we reindex the index on every major version upgrade. We noticed during our es9 upgrade from es8, there is a system index .geoip\_database which was created in es7 is not allowing es… --- ## [Cassandra database tls connection issue on logstash](https://discuss.elastic.co/t/cassandra-database-tls-connection-issue-on-logstash/356367)
**Author:** [@gadde36256](https://discuss.elastic.co/u/gadde36256)\ **Replies:** 9\ **Last updated:** [March 31, 2024, 11:28am UTC](https://discuss.elastic.co/t/cassandra-database-tls-connection-issue-on-logstash/356367 "2024-03-31T11:28:02Z")
Hello All, Recently we made changes on Cassandra database to connect with tls, I don't find much details to configuring tls on logstash. Can you pls share the any help link for configuring the ssl with logstash. Thanks… --- ## [Severe Performance Degradation After Adding High-Cardinality Text Field to Large Index](https://discuss.elastic.co/t/severe-performance-degradation-after-adding-high-cardinality-text-field-to-large-index/378571)
**Author:** [@Dimitris\_Makris](https://discuss.elastic.co/u/Dimitris_Makris)\ **Replies:** 12\ **Last updated:** [December 15, 2025, 9:23pm UTC](https://discuss.elastic.co/t/severe-performance-degradation-after-adding-high-cardinality-text-field-to-large-index/378571 "2025-12-15T21:23:59Z")
I'm experiencing a significant performance issue after adding a new multi-valued text field to a large Elasticsearch index and would appreciate insights from anyone who has faced similar challenges. Setup: Elasticsear… --- ## [Replica shards of newly created indices remain UNASSIGNED](https://discuss.elastic.co/t/replica-shards-of-newly-created-indices-remain-unassigned/379459)
**Author:** [@onel](https://discuss.elastic.co/u/onel)\ **Replies:** 12\ **Last updated:** [July 4, 2025, 7:44pm UTC](https://discuss.elastic.co/t/replica-shards-of-newly-created-indices-remain-unassigned/379459 "2025-07-04T19:44:16Z")
hello We haven’t experienced this issue before, but recently we noticed that the primary shards of rollover-created indices are allocated normally, while the replica shards always remain in an UNASSIGNED state. We creat… --- ## [How to do a distance sort over entities which each have multiple locations](https://discuss.elastic.co/t/how-to-do-a-distance-sort-over-entities-which-each-have-multiple-locations/352439)
**Author:** [@BradDotyBWell](https://discuss.elastic.co/u/BradDotyBWell)\ **Replies:** 12\ **Last updated:** [February 2, 2024, 7:30pm UTC](https://discuss.elastic.co/t/how-to-do-a-distance-sort-over-entities-which-each-have-multiple-locations/352439 "2024-02-02T19:30:50Z")
Your product is simple-minded when it comes to distance searches. We have organizations who have multiple locations each. When a user does a search, we MUST use the closest location for each org to that user. Your pro… --- ## [Elasticsearch snapshot issue in kubernets](https://discuss.elastic.co/t/elasticsearch-snapshot-issue-in-kubernets/364878)
**Author:** [@Nauman\_Kyani](https://discuss.elastic.co/u/Nauman_Kyani)\ **Replies:** 17\ **Last updated:** [August 14, 2024, 11:57am UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-issue-in-kubernets/364878 "2024-08-14T11:57:54Z")
Hi , I am currently running an Elasticsearch cluster on Kubernetes using the Elastic Operator. My setup includes 3 master nodes, 2 client nodes, and 3 worker nodes. I have configured the cluster to use an NFS path for s… --- ## [Does using phonetic analyzer using .json file kills the effect of Fuzzy Search](https://discuss.elastic.co/t/does-using-phonetic-analyzer-using-json-file-kills-the-effect-of-fuzzy-search/357916)
**Author:** [@satadru\_biswas](https://discuss.elastic.co/u/satadru_biswas)\ **Replies:** 10\ **Last updated:** [April 23, 2024, 2:44pm UTC](https://discuss.elastic.co/t/does-using-phonetic-analyzer-using-json-file-kills-the-effect-of-fuzzy-search/357916 "2024-04-23T14:44:51Z")
So created an entity class. @Data @Document(indexName = "ABC") @Setting(settingPath = "analyzer/search-analyzer.json") @JsonIgnoreProperties(ignoreUnknown = true) @Slf4j @EqualsAndHashCode public class XYZ { @Field(ty… --- ## [Open Source Vulnerabilities](https://discuss.elastic.co/t/open-source-vulnerabilities/378456)
**Author:** [@rajesh\_raghav](https://discuss.elastic.co/u/rajesh_raghav)\ **Replies:** 9\ **Last updated:** [May 28, 2025, 4:22am UTC](https://discuss.elastic.co/t/open-source-vulnerabilities/378456 "2025-05-28T04:22:20Z")
We observed there are several components used in Elasticsearch package(8.17.1) which even when upgraded refer to old libraries with Open Vulnerabilities. In our orgnaization, these vulnerabilities are flagged on a regula… --- ## [Elastic search 8.7.1 cluster is not forming, Here is yml: and command to create a token run on CENTOS7](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 9\ **Last updated:** [January 10, 2024, 7:10pm UTC](https://discuss.elastic.co/t/elastic-search-8-7-1-cluster-is-not-forming-here-is-yml-and-command-to-create-a-token-run-on-centos7/350613 "2024-01-10T19:10:56Z")
path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch xpack.security.enabled: false xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: false keystore.path: certs/http.p12 xpack… --- ## [Elasticsearch log show kibana\_version\_mismatch](https://discuss.elastic.co/t/elasticsearch-log-show-kibana-version-mismatch/371190)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 11\ **Last updated:** [December 4, 2024, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-log-show-kibana-version-mismatch/371190 "2024-12-04T07:57:54Z")
Dears, In elasticsearch log file there is many errors like this: \[2024-11-28T14:17:45,307\]\[ERROR\]\[o.e.x.w.i.s.ExecutableSearchInput\] \[elastic03\] failed to execute \[search\] input for watch \[kfkGWL45QVSehYfLGLGl8g\_kibana… --- ## [Elasticsearch Not Logging Query Details Despite Enabling Audit Logs](https://discuss.elastic.co/t/elasticsearch-not-logging-query-details-despite-enabling-audit-logs/376790)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 10\ **Last updated:** [April 7, 2025, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-not-logging-query-details-despite-enabling-audit-logs/376790 "2025-04-07T06:59:17Z")
I have enabled the xpack.security.audit.enabled: true and also added xpack.security.audit.logfile.events.emit\_request\_body: true but when i query from postman but that does not seems to logging as i can only two streams … --- ## [Unable to configure Elastic APM on .NET 4.8](https://discuss.elastic.co/t/unable-to-configure-elastic-apm-on-net-4-8/377418)
**Author:** [@rahulsamsung](https://discuss.elastic.co/u/rahulsamsung)\ **Replies:** 9\ **Last updated:** [July 29, 2025, 2:09pm UTC](https://discuss.elastic.co/t/unable-to-configure-elastic-apm-on-net-4-8/377418 "2025-07-29T14:09:11Z")
Dear All, We are trying to setup Elastic APM on one of our application running on the .NET 4.8. And completed the below configuration on the application side. But the service is still not showing on the ELK APM dashboa… --- ## [Template setting is not honored by the index](https://discuss.elastic.co/t/template-setting-is-not-honored-by-the-index/361903)
**Author:** [@siakc](https://discuss.elastic.co/u/siakc)\ **Replies:** 10\ **Last updated:** [June 24, 2024, 1:14pm UTC](https://discuss.elastic.co/t/template-setting-is-not-honored-by-the-index/361903 "2024-06-24T13:14:55Z")
I created an index template with settings: { 'index.mapping.total\_fields.limit': 1500, 'index.mapping.ignore\_malformed': true } After that I create an index with matching pattern. But the index hi… --- ## [Как сделать правельно запро в котором исключаются одни записи из других](https://discuss.elastic.co/t/topic/351560)
**Author:** [@vsemirmd](https://discuss.elastic.co/u/vsemirmd)\ **Replies:** 9\ **Last updated:** [January 24, 2024, 2:26pm UTC](https://discuss.elastic.co/t/topic/351560 "2024-01-24T14:26:35Z")
в таблице всего 6 записей { "query": { "bool": { "must": \[ { "term": { "meta\_key.normalized": "Content" } } \] } } } { "meta\_key.normalized": "Content" } содержится только у некоторых поэтому получаю 4 записи {… --- ## [Elasticsearch design feasibility](https://discuss.elastic.co/t/elasticsearch-design-feasibility/344621)
**Author:** [@mr\_zer0](https://discuss.elastic.co/u/mr_zer0)\ **Replies:** 9\ **Last updated:** [October 9, 2023, 10:15am UTC](https://discuss.elastic.co/t/elasticsearch-design-feasibility/344621 "2023-10-09T10:15:14Z")
Hello All, Would need your help in validation of few numbers, based on your experience. Would be happy to get a response or some feedback. I wanted to check if the below numbers are feasible to be handled by Elasticse… --- ## [Adjusting the numbers of docs retrieved via es python api](https://discuss.elastic.co/t/adjusting-the-numbers-of-docs-retrieved-via-es-python-api/365451)
**Author:** [@cazzz99](https://discuss.elastic.co/u/cazzz99)\ **Replies:** 13\ **Last updated:** [August 28, 2024, 1:09pm UTC](https://discuss.elastic.co/t/adjusting-the-numbers-of-docs-retrieved-via-es-python-api/365451 "2024-08-28T13:09:59Z")
I've been using the combination of lang chain retriever and ES python client API in searching, my code is like below: def embed\_query(self,query\_text,k =10,candidate\_num = 20): if query\_text is not None and len… --- ## [Alerting on field value change](https://discuss.elastic.co/t/alerting-on-field-value-change/383451)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 12\ **Last updated:** [November 16, 2025, 1:10pm UTC](https://discuss.elastic.co/t/alerting-on-field-value-change/383451 "2025-11-16T13:10:12Z")
I’m currently logging on-change data in ES, and I’m running a latest transform to store the most updated data into a separate index. I was advised that an ingest pipeline will help me compare any value coming in with th… --- ## [Heap sudenly full on all voting-only master nodes (7.17.28)](https://discuss.elastic.co/t/heap-sudenly-full-on-all-voting-only-master-nodes-7-17-28/379485)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 19\ **Last updated:** [July 2, 2025, 11:50am UTC](https://discuss.elastic.co/t/heap-sudenly-full-on-all-voting-only-master-nodes-7-17-28/379485 "2025-07-02T11:50:23Z")
I have no idea what happened. No clue in node logs. These nodes are data\_cold,master,voting\_only and they are very idle, GC happening like every three hours. Suddenly heap on both nodes filled and they crashed. ▶ 2025-… --- ## [Preventing document update based on field values](https://discuss.elastic.co/t/preventing-document-update-based-on-field-values/356858)
**Author:** [@ashish25](https://discuss.elastic.co/u/ashish25)\ **Replies:** 9\ **Last updated:** [April 12, 2024, 5:22am UTC](https://discuss.elastic.co/t/preventing-document-update-based-on-field-values/356858 "2024-04-12T05:22:17Z")
Is there anyway to prevent updating document based on some field? Eg- Below documents already present in elastic: { "business\_address" : "660 Sacramento St", "business\_city" : "San Francisco", "business\_id" : 22 } … --- ## [Bulk insert from file, SSL record too big](https://discuss.elastic.co/t/bulk-insert-from-file-ssl-record-too-big/366839)
**Author:** [@Terry\_Lowery](https://discuss.elastic.co/u/Terry_Lowery)\ **Replies:** 13\ **Last updated:** [October 18, 2024, 3:53pm UTC](https://discuss.elastic.co/t/bulk-insert-from-file-ssl-record-too-big/366839 "2024-10-18T15:53:09Z")
Hello all, I am trying to following along with an acloud.guru ES deep dive and there is a section that you bulk insert ndjson files. I also tried the curl examples from elasic.co I receive the follow from curl: \* Ab… --- ## [Kibana shows older version despite new docker image](https://discuss.elastic.co/t/kibana-shows-older-version-despite-new-docker-image/379157)
**Author:** [@garetharmstrong](https://discuss.elastic.co/u/garetharmstrong)\ **Replies:** 11\ **Last updated:** [June 27, 2025, 1:42pm UTC](https://discuss.elastic.co/t/kibana-shows-older-version-despite-new-docker-image/379157 "2025-06-27T13:42:59Z")
Hey guys. I've got an Elasticsearch cluster (not in docker) that is currently running at version 8.18.2. I've upgraded that through apt, and the standard curl check confirms the version is above. However, my Kibana is ru… --- ## [\[BIG-IP ASM\] Could not index event to Elasticsearch](https://discuss.elastic.co/t/big-ip-asm-could-not-index-event-to-elasticsearch/373465)
**Author:** [@Plauda](https://discuss.elastic.co/u/Plauda)\ **Replies:** 11\ **Last updated:** [January 24, 2025, 4:42pm UTC](https://discuss.elastic.co/t/big-ip-asm-could-not-index-event-to-elasticsearch/373465 "2025-01-24T16:42:45Z")
Hi There, I try to put some F5 BIG-IP ASM logs in ELK. I configured a logstash syslog conf file and tried to , but I get an error during indexation step: Jan 21 17:12:17 cnclelk12 logstash\[162998\]: \[2025-01-21T17:12:1… --- ## [No rollover with data stream lifecycle](https://discuss.elastic.co/t/no-rollover-with-data-stream-lifecycle/382165)
**Author:** [@mikehaertl](https://discuss.elastic.co/u/mikehaertl)\ **Replies:** 12\ **Last updated:** [September 30, 2025, 1:51pm UTC](https://discuss.elastic.co/t/no-rollover-with-data-stream-lifecycle/382165 "2025-09-30T13:51:56Z")
For testing purposes I’ve configured a lifecycle on a data stream with a retention time of 1h. But the backing index does not get rolled over. According to this doc Data stream lifecycle settings in Elasticsearch | Refe… --- ## [Loghstash service is not getting started going in continues restart having error: Logstash stopped processing because of an error: (NoMethodError) private method \`run' called for #\](https://discuss.elastic.co/t/loghstash-service-is-not-getting-started-going-in-continues-restart-having-error-logstash-stopped-processing-because-of-an-error-nomethoderror-private-method-run-called-for-logstash-0x32a806ef/386799)
**Author:** [@ashish.jagtap](https://discuss.elastic.co/u/ashish.jagtap)\ **Replies:** 15\ **Last updated:** [June 12, 2026, 6:47am UTC](https://discuss.elastic.co/t/loghstash-service-is-not-getting-started-going-in-continues-restart-having-error-logstash-stopped-processing-because-of-an-error-nomethoderror-private-method-run-called-for-logstash-0x32a806ef/386799 "2026-06-12T06:47:06Z")
loghstash service is not getting started going in continues restart. Error: Logstash stopped processing because of an error: (NoMethodError) private method run' called for #\ Jun 10 16:15:03… --- ## [Uptime heartbeat service is failing](https://discuss.elastic.co/t/uptime-heartbeat-service-is-failing/373558)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 13\ **Last updated:** [January 24, 2025, 1:49pm UTC](https://discuss.elastic.co/t/uptime-heartbeat-service-is-failing/373558 "2025-01-24T13:49:27Z")
Hi all, I am trying observability uptime monitoring. elastic .17.1 kibana .17.1 heartbeat 7.17.1 ############################# Heartbeat ###################################### # Directory to load monitor definition… --- ## [Is there a way to determine what triggers shard movement?](https://discuss.elastic.co/t/is-there-a-way-to-determine-what-triggers-shard-movement/380047)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 10\ **Last updated:** [September 4, 2025, 2:47pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-determine-what-triggers-shard-movement/380047 "2025-09-04T14:47:57Z")
Our cluster all of a sudden starts to rebalance for no apparent reason. It's been going on for a day. I tweaked the setting "cluster.routing.allocation.balance.threshold" to 10 which means allow 10 shards difference be… [Previous page](https://discuss.elastic.co/top.md?page=246&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=248&per_page=50&period=all)