# Top **URL:** https://discuss.elastic.co/top.md?page=250&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 251 --- ## [2 way search by query and incoming docs](https://discuss.elastic.co/t/2-way-search-by-query-and-incoming-docs/363170)
**Author:** [@elsaticnoob](https://discuss.elastic.co/u/elsaticnoob)\ **Replies:** 15\ **Last updated:** [July 22, 2024, 12:17pm UTC](https://discuss.elastic.co/t/2-way-search-by-query-and-incoming-docs/363170 "2024-07-22T12:17:36Z")
I am working on an app where the goal is to find likeminded people in your area, nothing revolutionary. Given a user's age, minAge,maxAge fields, we want to query for other docs that meet the criteria. However, the sear… --- ## [AWS integration 7.1 fleet agent bug or UI glitch](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 10\ **Last updated:** [July 30, 2026, 3:01pm UTC](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899 "2026-07-30T15:01:48Z")
Recently upgraded ELK cluster from 9.3.2 to 9.4.4. On older version had AWS integration of version 6.20, on new cluster upgraded it to 7.1 latest. Prior to upgrade, we had 1 Elastic agent with this integration 6.2 (agent… --- ## [Nodes not electing mater when master goes down](https://discuss.elastic.co/t/nodes-not-electing-mater-when-master-goes-down/371257)
**Author:** [@Wajahat\_Iqbal](https://discuss.elastic.co/u/Wajahat_Iqbal)\ **Replies:** 11\ **Last updated:** [December 2, 2024, 6:26pm UTC](https://discuss.elastic.co/t/nodes-not-electing-mater-when-master-goes-down/371257 "2024-12-02T18:26:54Z")
ERROR THIS \[2024-11-30T10:19:13,234\]\[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[node-3\] master not discovered yet: have discovered \[{node-3}{CpTTLncQTpq2jmzKCp6BfQ}{OdGCenkKT52GKc75CphmxQ}{10.0.0.6}{10.0.0.6:9300}{c… --- ## [How does shards-per-node contribute to indexing latency/throughput?](https://discuss.elastic.co/t/how-does-shards-per-node-contribute-to-indexing-latency-throughput/365905)
**Author:** [@Neha\_Gulla](https://discuss.elastic.co/u/Neha_Gulla)\ **Replies:** 11\ **Last updated:** [September 3, 2024, 12:26pm UTC](https://discuss.elastic.co/t/how-does-shards-per-node-contribute-to-indexing-latency-throughput/365905 "2024-09-03T12:26:52Z")
Hello, In our environment, we have 12 nodes, 597 indices, total shards 1201, 0 unassigned shard. How and what are the correct steps to get shards-per-node contribute to indexing latency/throughput. --- ## [Winlogbeat was mistakenly killed by 360 antivirus software, how to solve it](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156)
**Author:** [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Replies:** 9\ **Last updated:** [April 2, 2025, 9:55am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156 "2025-04-02T09:55:29Z")
When the program is running, it is always mistakenly killed by 360 antivirus software --- ## [Are date indexes not allowed anymore?](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 10\ **Last updated:** [December 11, 2025, 6:31pm UTC](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941 "2025-12-11T18:31:56Z")
My indexes are created from a template as ‘name-year.month.date’. It seems that this isn’t acceptable for index-lifecycle-policies anymore. I get this error “index name \[name-2025.12.09\] does not match pattern '^.\*-\\d+$'… --- ## [\[6.7.1\]how to set ccs with kerberos](https://discuss.elastic.co/t/6-7-1-how-to-set-ccs-with-kerberos/363546)
**Author:** [@lammm4](https://discuss.elastic.co/u/lammm4)\ **Replies:** 9\ **Last updated:** [July 23, 2024, 3:25am UTC](https://discuss.elastic.co/t/6-7-1-how-to-set-ccs-with-kerberos/363546 "2024-07-23T03:25:17Z")
we use es 6.7.1 with kerberos, but after set remote cluster, the state connect is always false, and the seeds is empty. does it support ccs with using kerberos? --- ## [Error message": "getting node from external cluster \[RC\_Test\] failed" between nodes on 2 docker hosts](https://discuss.elastic.co/t/error-message-getting-node-from-external-cluster-rc-test-failed-between-nodes-on-2-docker-hosts/374980)
**Author:** [@poke1710](https://discuss.elastic.co/u/poke1710)\ **Replies:** 10\ **Last updated:** [February 25, 2025, 4:21pm UTC](https://discuss.elastic.co/t/error-message-getting-node-from-external-cluster-rc-test-failed-between-nodes-on-2-docker-hosts/374980 "2025-02-25T16:21:15Z")
Hi, We are facing problem while connecting remote cluster. I am using docker compose to build elasticsearch with local ip 10.1.1.2 on docker host 1 and same on docker host 2, when trying to connect remote cluster it is … --- ## [How should I encrypt data at rest with Elasticsearch?](https://discuss.elastic.co/t/how-should-i-encrypt-data-at-rest-with-elasticsearch/96)
**Author:** [@shaunak](https://discuss.elastic.co/u/shaunak)\ **Replies:** 0\ **Last updated:** [May 1, 2015, 10:40am UTC](https://discuss.elastic.co/t/how-should-i-encrypt-data-at-rest-with-elasticsearch/96 "2015-05-01T10:40:15Z")
Note: while we recommend these options, we cannot provide support for any particular tool or help debugging issues with dm-crypt itself. For the purpose of protecting Data at Rest through encryption, from the Elasticsea… --- ## [Different Cluster Behavior When Two Master-Eligible Nodes Are Stopped](https://discuss.elastic.co/t/different-cluster-behavior-when-two-master-eligible-nodes-are-stopped/380752)
**Author:** [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\ **Replies:** 10\ **Last updated:** [August 5, 2025, 2:32pm UTC](https://discuss.elastic.co/t/different-cluster-behavior-when-two-master-eligible-nodes-are-stopped/380752 "2025-08-05T14:32:12Z")
I’m working with two different Elasticsearch clusters (version 8.17.5) and noticed different behavior when stopping master-eligible nodes. Here's the setup for both clusters: Cluster A: 3 dedicated master nodes 3 dedi… --- ## [I am encountering an issue while attempting to verify a snapshot repository in Elasticsearch. The repository is named old-indices. Below is the relevant log entry from the Elasticsearch cluster:](https://discuss.elastic.co/t/i-am-encountering-an-issue-while-attempting-to-verify-a-snapshot-repository-in-elasticsearch-the-repository-is-named-old-indices-below-is-the-relevant-log-entry-from-the-elasticsearch-cluster/372658)
**Author:** [@abdelkriem](https://discuss.elastic.co/u/abdelkriem)\ **Replies:** 9\ **Last updated:** [January 6, 2025, 2:12pm UTC](https://discuss.elastic.co/t/i-am-encountering-an-issue-while-attempting-to-verify-a-snapshot-repository-in-elasticsearch-the-repository-is-named-old-indices-below-is-the-relevant-log-entry-from-the-elasticsearch-cluster/372658 "2025-01-06T14:12:07Z")
\[2024-12-31T17:06:04,282\] \[WARN \] \[r.suppressed \] \[Elastic-Master-1\] path: /\_snapshot/old-indices/\_verify, params: {repository=old-indices}, status: 500org.elasticsearch.repositories.RepositoryVerificationException: \[old… --- ## [Logstash email image problem](https://discuss.elastic.co/t/logstash-email-image-problem/373713)
**Author:** [@Hannah\_J\_Swystun](https://discuss.elastic.co/u/Hannah_J_Swystun)\ **Replies:** 11\ **Last updated:** [January 31, 2025, 1:52pm UTC](https://discuss.elastic.co/t/logstash-email-image-problem/373713 "2025-01-31T13:52:28Z")
Hi everybody, i try to send email from logstash version 7.8.0 but, images are never shown! however attachments are added to email and can be opened! i used different kind of images, none of them work ? can someone he… --- ## [Elastic Agent 9.1.3 – system\_audit.package on Rocky Linux 9.6 – no DNF install/remove events](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 9\ **Last updated:** [November 11, 2025, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289 "2025-11-11T13:28:10Z")
Hi, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) in a Podman container. image: \`\`docker.e… --- ## [Two field visualization in one table column, each in it's own row](https://discuss.elastic.co/t/two-field-visualization-in-one-table-column-each-in-its-own-row/378988)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 9\ **Last updated:** [June 10, 2025, 2:14pm UTC](https://discuss.elastic.co/t/two-field-visualization-in-one-table-column-each-in-its-own-row/378988 "2025-06-10T14:14:45Z")
Hello, trying to figure out solution for the following case. I have log line which is structured as: Action=MarketingAction,Max Duration=400ms,Max Calls=3 Any ideas how to parse message using logstash filter in order … --- ## [Occasional spike in data indexing of Elasticsearch](https://discuss.elastic.co/t/occasional-spike-in-data-indexing-of-elasticsearch/366288)
**Author:** [@Priyansh\_Maheshwari](https://discuss.elastic.co/u/Priyansh_Maheshwari)\ **Replies:** 11\ **Last updated:** [September 11, 2024, 11:11am UTC](https://discuss.elastic.co/t/occasional-spike-in-data-indexing-of-elasticsearch/366288 "2024-09-11T11:11:35Z")
Hi, we are currently working with a single node ES instance, to which we connect with our application using ESJavaClient. Recently we re-indexed all our indexes after enabling search on a time based field. Post migration… --- ## [Indices managed by Index Lifecycle Policy don't get deleted](https://discuss.elastic.co/t/indices-managed-by-index-lifecycle-policy-dont-get-deleted/373296)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 10\ **Last updated:** [January 21, 2025, 3:21pm UTC](https://discuss.elastic.co/t/indices-managed-by-index-lifecycle-policy-dont-get-deleted/373296 "2025-01-21T15:21:59Z")
I'm using Filebeat to ingest network logs. I have an Index Lifecycle Policy that applies to all Filebeat indices\*. I have set the Delete Phase to move data into the phase when it's 30 days old. However, indices don't see… --- ## [Dec 12th, 2018: \[EN\]\[Elasticsearch\] Automatically adding a timestamp to documents](https://discuss.elastic.co/t/dec-12th-2018-en-elasticsearch-automatically-adding-a-timestamp-to-documents/159314)
**Author:** [@abdon](https://discuss.elastic.co/u/abdon)\ **Replies:** 0\ **Last updated:** [December 12, 2018, 12:00am UTC](https://discuss.elastic.co/t/dec-12th-2018-en-elasticsearch-automatically-adding-a-timestamp-to-documents/159314 "2018-12-12T00:00:02Z")
Sometimes, it can be useful to know at what time a document was indexed by Elasticsearch. For example, when you want to see how long it takes for log files to end up in Elasticsearch after being generated. Back in the o… --- ## [Problems with displaying the map in the dashboard](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771)
**Author:** [@Alberto\_Russo](https://discuss.elastic.co/u/Alberto_Russo)\ **Replies:** 11\ **Last updated:** [October 24, 2025, 3:06am UTC](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771 "2025-10-24T03:06:38Z")
I installed the official Elastic integration to collect 365 logs. Using the dashboard that provides the integration, I see nothing in the map section (see image). Has anyone encountered this issue? Or does anyone know ho… --- ## [Logstash locks the file during the file rotation in windows server](https://discuss.elastic.co/t/logstash-locks-the-file-during-the-file-rotation-in-windows-server/377793)
**Author:** [@guru\_dev](https://discuss.elastic.co/u/guru_dev)\ **Replies:** 9\ **Last updated:** [May 6, 2025, 3:48pm UTC](https://discuss.elastic.co/t/logstash-locks-the-file-during-the-file-rotation-in-windows-server/377793 "2025-05-06T15:48:24Z")
Below is the error from logstash-plain.logstash \[2025-05-05T05:04:45,597\]\[WARN \]\[filewatch.tailmode.handlers.create\]\[main\]\[c1077e68a0985da91e9d9117b4ed7833cd278b44745ff7a8664043bc8322aec5\] failed to open file {:path=\>"C… --- ## [Dial tcp \*.\*.\*.\*:9200 connct : cannot assign requested](https://discuss.elastic.co/t/dial-tcp-9200-connct-cannot-assign-requested/370779)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 11\ **Last updated:** [November 20, 2024, 7:08pm UTC](https://discuss.elastic.co/t/dial-tcp-9200-connct-cannot-assign-requested/370779 "2024-11-20T19:08:42Z")
Hi How to get elasticsearch to receive orders up to 100,000 Because when I search elasticsearch I get the following error dial tcp ...:9200 connct : cannot assign requested --- ## [Management of illegal characters](https://discuss.elastic.co/t/management-of-illegal-characters/377159)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 9\ **Last updated:** [April 30, 2025, 2:56pm UTC](https://discuss.elastic.co/t/management-of-illegal-characters/377159 "2025-04-30T14:56:40Z")
Hello Everyone, I am in the process of converting a "in-house" Delphi application that receives an XML string over udp port and send it to an elasticsearch instance, doing a conversion from XML to JSON and sending it th… --- ## [Combine two index in one using Kibana](https://discuss.elastic.co/t/combine-two-index-in-one-using-kibana/370673)
**Author:** [@amity.nidhi](https://discuss.elastic.co/u/amity.nidhi)\ **Replies:** 9\ **Last updated:** [December 2, 2024, 2:46am UTC](https://discuss.elastic.co/t/combine-two-index-in-one-using-kibana/370673 "2024-12-02T02:46:15Z")
Hello, I have a requirement to combine two index in Elasticsearch on basis of below criteria - index1: Record1: {"service": "abc", "opened\_at":"2024-11-04T16:48:04.000Z","closed\_at":"2024-11-05T18:00:10.000Z") Record… --- ## [Output in kibana not expected](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 10\ **Last updated:** [December 9, 2025, 3:13pm UTC](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888 "2025-12-09T15:13:39Z")
i use filebeat to parse a json file and the expected output is showing all the fields in the different lines and not as one document This the input file { "source": "10.200.10.1:57500", "subscription-name": "defau… --- ## [Result limitation](https://discuss.elastic.co/t/result-limitation/366648)
**Author:** [@HermannSamimi](https://discuss.elastic.co/u/HermannSamimi)\ **Replies:** 9\ **Last updated:** [September 18, 2024, 1:08am UTC](https://discuss.elastic.co/t/result-limitation/366648 "2024-09-18T01:08:14Z")
Hello, I created a dashboard in Kibana, and for a particular visualization, I want to limit the results to 500 documents. Is it possible to display only the last 500 documents? Thanks --- ## [Heterogeneous Cluster](https://discuss.elastic.co/t/heterogeneous-cluster/366184)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 10\ **Last updated:** [September 8, 2024, 5:57am UTC](https://discuss.elastic.co/t/heterogeneous-cluster/366184 "2024-09-08T05:57:03Z")
Do elasticsearch support Heterogeneous Cluster? Like if I have 1 master node at 7.17.6 , 2 data nodes at 7.17.6 & 1 data node at 8.11.1 will that work? This is to confirm that whether we can rolling upgrade ES without … --- ## [Elasticsearch data encryption](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100)
**Author:** [@Kesavan](https://discuss.elastic.co/u/Kesavan)\ **Replies:** 10\ **Last updated:** [July 13, 2026, 10:17am UTC](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100 "2026-07-13T10:17:42Z")
HI Everyone, Currently i am using elastic 7.17.5 along with spring boot. Index creation and data save and retrieval is happening via Java only. Below is my requirement, I need to have a data saved in the Elasticsearch… --- ## [New nodes added to cluster are not rebalancing](https://discuss.elastic.co/t/new-nodes-added-to-cluster-are-not-rebalancing/370715)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [November 21, 2024, 12:12pm UTC](https://discuss.elastic.co/t/new-nodes-added-to-cluster-are-not-rebalancing/370715 "2024-11-21T12:12:11Z")
I have 50 nodes in the Elasticsearch 7.5 cluster and added five new nodes. All shards are balancing between nodes . These five new nodes for some reason do not go into balance, and their disks are near empty. There are… --- ## [PII security with Elastic.Clients.Elasticsearch 9.2.1](https://discuss.elastic.co/t/pii-security-with-elastic-clients-elasticsearch-9-2-1/383609)
**Author:** [@Davyd\_McColl](https://discuss.elastic.co/u/Davyd_McColl)\ **Replies:** 10\ **Last updated:** [November 26, 2025, 3:09pm UTC](https://discuss.elastic.co/t/pii-security-with-elastic-clients-elasticsearch-9-2-1/383609 "2025-11-26T15:09:06Z")
Good day I’m not sure if I’m posting this in the right place, but here goes. I’m trying to implement an ES index with an object that has mainly numeric fields, and some text fields. I want to be able to search by any f… --- ## [Elastic Dashboard](https://discuss.elastic.co/t/elastic-dashboard/370316)
**Author:** [@Rafael\_Vitor](https://discuss.elastic.co/u/Rafael_Vitor)\ **Replies:** 11\ **Last updated:** [November 14, 2024, 11:07am UTC](https://discuss.elastic.co/t/elastic-dashboard/370316 "2024-11-14T11:07:40Z")
I need to create a custom dashboard, I would like to do something within ELK like the image below. --- ## [How to display multi-select variables on bar charts as a percentage of records](https://discuss.elastic.co/t/how-to-display-multi-select-variables-on-bar-charts-as-a-percentage-of-records/377263)
**Author:** [@Michal714](https://discuss.elastic.co/u/Michal714)\ **Replies:** 9\ **Last updated:** [April 21, 2025, 6:16pm UTC](https://discuss.elastic.co/t/how-to-display-multi-select-variables-on-bar-charts-as-a-percentage-of-records/377263 "2025-04-21T18:16:42Z")
I want to show responses to a multi-select question as a percentage of response IDs. In a survey we used, we asked respondents to select all the options that apply to them. This means that we have more responses than re… --- ## [Logstash reading events from March 14th on March 16th](https://discuss.elastic.co/t/logstash-reading-events-from-march-14th-on-march-16th/375982)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 10\ **Last updated:** [March 24, 2025, 12:48pm UTC](https://discuss.elastic.co/t/logstash-reading-events-from-march-14th-on-march-16th/375982 "2025-03-24T12:48:05Z")
\[2025-03-16T00:07:37,943\]\[INFO \]\[logstash.outputs.opensearch\]\[main\]\[f636cb73983bcc650332a7ed143a2c1655e1be6017f7947da7fc02b194adad2d\] Retrying failed action {:status=\>429, :action=\>\["index", {:\_id=\>nil, :\_index=\>"http\_se… --- ## [Logstash file output - pipeline stop working after flush error](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505)
**Author:** [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Replies:** 9\ **Last updated:** [December 1, 2025, 12:35pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505 "2025-12-01T12:35:21Z")
Have a nice day everyone. Not long ago, I started to notice missing syslog logs from random host groups. At first, I simply restarted our Logstash nodes that act as syslog forwarders, and the problem went away. But ov… --- ## [ElasticsearchClient.healthReport() give cluster status as yellow even though cluster is green](https://discuss.elastic.co/t/elasticsearchclient-healthreport-give-cluster-status-as-yellow-even-though-cluster-is-green/370695)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 9\ **Last updated:** [November 21, 2024, 6:36am UTC](https://discuss.elastic.co/t/elasticsearchclient-healthreport-give-cluster-status-as-yellow-even-though-cluster-is-green/370695 "2024-11-21T06:36:44Z")
Hi Noticing one weird issue where ElasticsearchClient.healthReport() gives status as Yellow even though the cluster status is green /\_cluster/health { "cluster\_name": "es\_cluster", "status": "green", "timed\_out"… --- ## [The same search statement multiple times gets different total results](https://discuss.elastic.co/t/the-same-search-statement-multiple-times-gets-different-total-results/368688)
**Author:** [@deserts](https://discuss.elastic.co/u/deserts)\ **Replies:** 9\ **Last updated:** [October 31, 2024, 9:41am UTC](https://discuss.elastic.co/t/the-same-search-statement-multiple-times-gets-different-total-results/368688 "2024-10-31T09:41:46Z")
I am not sure if there is a teacher who is familiar with the elasticsearch source code to help me look at this issue I raised on github. At present, I cannot get stable query results using the same conditions. The reason… --- ## [Http port 9200 behind Citrix ADC loadbalancing](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 12\ **Last updated:** [April 1, 2026, 5:18pm UTC](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721 "2026-04-01T17:18:34Z")
Trying desperately to avoid our Citrix ADC health monitoring of elasticsearch https port 9200 backend services from seeing LB monitoring traffic as plain text and thus avoid log error events like: received plaintext htt… --- ## [Logstash not reading log files from Windows network share folder](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144)
**Author:** [@dalal404](https://discuss.elastic.co/u/dalal404)\ **Replies:** 10\ **Last updated:** [December 19, 2025, 12:14pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144 "2025-12-19T12:14:47Z")
Hello, I am running Logstash 9.1.2 on Windows Server 2019, and i am trying to read logs from a network share folder - //MACHINE-1/folder$/somedir/star\*/some\*star.log ( read the “star” as star character ). But it doesnt… --- ## [Does "Serverless" mean it cant be used on self hosted intances?](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267)
**Author:** [@ItsMeBrille](https://discuss.elastic.co/u/ItsMeBrille)\ **Replies:** 11\ **Last updated:** [March 2, 2026, 7:38pm UTC](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267 "2026-03-02T19:38:56Z")
Does the "Serverless" tag mean I can’t use those services on self hosted intances? I want to connect to the MCP endpoint /api/agent\_builder/mcp, but it says the docs have the “tag” Serverless. Does this mean I cannot … --- ## [Kibana metric, can I get: sum of \`NumberOfPeople\` who attended clinics with a unique\`ClinicName\`?](https://discuss.elastic.co/t/kibana-metric-can-i-get-sum-of-numberofpeople-who-attended-clinics-with-a-unique-clinicname/377789)
**Author:** [@Robin\_Gorry](https://discuss.elastic.co/u/Robin_Gorry)\ **Replies:** 9\ **Last updated:** [May 15, 2025, 7:52pm UTC](https://discuss.elastic.co/t/kibana-metric-can-i-get-sum-of-numberofpeople-who-attended-clinics-with-a-unique-clinicname/377789 "2025-05-15T19:52:27Z")
v 8.17.4 In my metric visualisation I would like to show the sum of NumberOfPeople who attended clinics with a uniqueClinicName . Is this possible? I can see how I can get sum(NumberOfPeople) and unique\_count(ClinicNam… --- ## [Adding new raw data, requesting suggestions](https://discuss.elastic.co/t/adding-new-raw-data-requesting-suggestions/372607)
**Author:** [@Trent-alex](https://discuss.elastic.co/u/Trent-alex)\ **Replies:** 9\ **Last updated:** [December 30, 2024, 8:17pm UTC](https://discuss.elastic.co/t/adding-new-raw-data-requesting-suggestions/372607 "2024-12-30T20:17:31Z")
Hello Community, I appreciate you. Ok, on to my question. I have 30 TB of data on a windows drive that I plan to move to my linux cluster, hosting elastic stack. All resources are self managed on premises. For referen… --- ## [Logstash 8.9.0: How to match messages containing words starting with "sap" (e.g., sapxxx) using a filter?](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889)
**Author:** [@Pan\_Vad](https://discuss.elastic.co/u/Pan_Vad)\ **Replies:** 11\ **Last updated:** [December 8, 2025, 1:18pm UTC](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889 "2025-12-08T13:18:45Z")
Could you please help me with a Logstash filter pipeline configuration that can catch messages of the following type: \<30\>Dec 5 15:01:05 saphcmdevdb systemd\[1\]: snapperd.service: Deactivated successfully. I need to d… --- ## [ES Search tutorial :: 'no such index \[my\_documents\]',](https://discuss.elastic.co/t/es-search-tutorial-no-such-index-my-documents/377538)
**Author:** [@A\_ai](https://discuss.elastic.co/u/A_ai)\ **Replies:** 9\ **Last updated:** [April 26, 2025, 6:07pm UTC](https://discuss.elastic.co/t/es-search-tutorial-no-such-index-my-documents/377538 "2025-04-26T18:07:17Z")
Hi Total noob to ES. I am doing the Search tutorial here: Search Basics - Elasticsearch Labs So far so good, but when I run the sample search term 'policy', it gives me a elasticsearch.NotFoundError: NotFoundError(404… --- ## [How to alert if two fields match](https://discuss.elastic.co/t/how-to-alert-if-two-fields-match/374143)
**Author:** [@SecurePete](https://discuss.elastic.co/u/SecurePete)\ **Replies:** 9\ **Last updated:** [February 6, 2025, 9:14pm UTC](https://discuss.elastic.co/t/how-to-alert-if-two-fields-match/374143 "2025-02-06T21:14:20Z")
I am very new to messing with Elastic pipelines and I need help. I want to alert based on whether two fields in a log match. I am not sure the correct way to do this. The logs are from a Cisco DUO integration. I want al… --- ## [Mapper-Size Plugin Breaks Parsing](https://discuss.elastic.co/t/mapper-size-plugin-breaks-parsing/374074)
**Author:** [@SomeRobot](https://discuss.elastic.co/u/SomeRobot)\ **Replies:** 10\ **Last updated:** [February 6, 2025, 2:11pm UTC](https://discuss.elastic.co/t/mapper-size-plugin-breaks-parsing/374074 "2025-02-06T14:11:27Z")
Hello, We want to enable mapper-size on our cloud clusters (we have done so on a single test cluster), and then we enabled \_size so that we can get ingest metrics for the cluster, but it breaks parsing. As soon as our d… --- ## [Logstash output](https://discuss.elastic.co/t/logstash-output/375237)
**Author:** [@JosephR](https://discuss.elastic.co/u/JosephR)\ **Replies:** 10\ **Last updated:** [March 3, 2025, 2:09pm UTC](https://discuss.elastic.co/t/logstash-output/375237 "2025-03-03T14:09:40Z")
I wrote a conf file and when it reads my ip addresses from the DB it outputs them as an integer instead of the ip address. I tried to do a mutate like the following: filter { mutate { convert =\> { "sourceipv4" =\> "st… --- ## [Multiple events all end up with the same result from an http filter query](https://discuss.elastic.co/t/multiple-events-all-end-up-with-the-same-result-from-an-http-filter-query/364071)
**Author:** [@Maeris](https://discuss.elastic.co/u/Maeris)\ **Replies:** 9\ **Last updated:** [August 1, 2024, 1:08pm UTC](https://discuss.elastic.co/t/multiple-events-all-end-up-with-the-same-result-from-an-http-filter-query/364071 "2024-08-01T13:08:16Z")
Hi, I'm having trouble with checking for a new IP for a user login with an HTTP filter query against my OpenSearch node. My filter code looks like: if \[event\_type\] == "user\_logged\_in" { http { url =\> "https:… --- ## [Need help in writing a multi condition Query](https://discuss.elastic.co/t/need-help-in-writing-a-multi-condition-query/367167)
**Author:** [@vkrishna](https://discuss.elastic.co/u/vkrishna)\ **Replies:** 10\ **Last updated:** [September 26, 2024, 7:30pm UTC](https://discuss.elastic.co/t/need-help-in-writing-a-multi-condition-query/367167 "2024-09-26T19:30:08Z")
Hi Team, Need help in writing JAVA API query. These are my elastic documents. { "number":1, "effective\_date":"2024-10-01T00:00:00.000Z" } { "number":2, "effective\_date":"2024-10-02T00:00:00.000Z" } { "number":3, … --- ## [Static Pie Chart](https://discuss.elastic.co/t/static-pie-chart/371202)
**Author:** [@Hannah\_J\_Swystun](https://discuss.elastic.co/u/Hannah_J_Swystun)\ **Replies:** 10\ **Last updated:** [November 29, 2024, 3:06pm UTC](https://discuss.elastic.co/t/static-pie-chart/371202 "2024-11-29T15:06:12Z")
Hi, I am using KIBANA 7.8.0 : Index type : app-YYYY-MM-DD which means an index is created every day Visualization : Pie Chart Data from a CSV files with logstash example : TIMESTAMP;APP1;PASSED;5.6 TIMESTAMP;APP2;PA… --- ## [Issue with logstash 8.17.4. Sincedb sometimes does not recognise the correct inode. After logstash restart it works](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 9\ **Last updated:** [May 8, 2025, 12:12am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867 "2025-05-08T00:12:13Z")
db.log rotates to db\_backup.log. input to logstash input { file { path =\> "C:/Program Files (x86)/webserver/db/logs/db.log" exclude =\> "db\_backup.log" type =\> "db" start\_position =\> "beginning" sin… --- ## [How to show the correct count in table visualization](https://discuss.elastic.co/t/how-to-show-the-correct-count-in-table-visualization/365445)
**Author:** [@chun](https://discuss.elastic.co/u/chun)\ **Replies:** 9\ **Last updated:** [August 26, 2024, 11:34am UTC](https://discuss.elastic.co/t/how-to-show-the-correct-count-in-table-visualization/365445 "2024-08-26T11:34:20Z")
I have a index file with single document ID, 2 items under the single document: "hits": \[ { "\_index": "dremio\_sys\_jobs", "\_id": "sys\_jobs", "\_score": 1, "\_ignored": \[ "dre… --- ## [Elasticsearch ingestion : Geo point and numerical fields not recognize](https://discuss.elastic.co/t/elasticsearch-ingestion-geo-point-and-numerical-fields-not-recognize/371623)
**Author:** [@Phildefer](https://discuss.elastic.co/u/Phildefer)\ **Replies:** 12\ **Last updated:** [December 7, 2024, 3:28am UTC](https://discuss.elastic.co/t/elasticsearch-ingestion-geo-point-and-numerical-fields-not-recognize/371623 "2024-12-07T03:28:30Z")
Hi all, I'm trying to ingest into an index my data (json) with a HTTP POST. Everything works fine but I have a geo point like this { "point\_location" : "11.0500,-0.2500" } which is not recognized as a geo point but like… [Previous page](https://discuss.elastic.co/top.md?page=249&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=251&per_page=50&period=all)