# Top **URL:** https://discuss.elastic.co/top.md?page=294&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 295 --- ## [\[SOLVED\] Grok and split fields](https://discuss.elastic.co/t/solved-grok-and-split-fields/61010)
**Author:** [@Romain\_PZK](https://discuss.elastic.co/u/Romain_PZK)\ **Replies:** 4\ **Last updated:** [September 21, 2016, 12:26pm UTC](https://discuss.elastic.co/t/solved-grok-and-split-fields/61010 "2016-09-21T12:26:33Z")
Hello, I want to put logs from a Fortigate firewall into elasticsearch. My fortigate sends logs to my syslog-ng, and logstash reads the log file. I use a grok to parse my log, but I don't understand how to split the "m… --- ## [Extracting filename from log.file.path not working](https://discuss.elastic.co/t/extracting-filename-from-log-file-path-not-working/222156)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 8\ **Last updated:** [March 5, 2020, 12:38am UTC](https://discuss.elastic.co/t/extracting-filename-from-log-file-path-not-working/222156 "2020-03-05T00:38:44Z")
I am trying to extract filename from log.file.path and then apply grok filter based on those as shown below. But the filename isnt being extracted. How can I extract the name and use the name to apply filters on? filter… --- ## ["Format version is not supported"](https://discuss.elastic.co/t/format-version-is-not-supported/69027)
**Author:** [@larstobi](https://discuss.elastic.co/u/larstobi)\ **Replies:** 4\ **Last updated:** [December 15, 2016, 9:37am UTC](https://discuss.elastic.co/t/format-version-is-not-supported/69027 "2016-12-15T09:37:09Z")
Hi, I upgraded from Elasticsearch 2.1.1 to 5.1.1, then by mistake down to 2.1.1 again, and back up to 5.1.1. Now, two of my indices are out of services, with reason below. What can I do to recover? $ curl -XGET 'ht… --- ## [Progress for Logstash contributions](https://discuss.elastic.co/t/progress-for-logstash-contributions/27796)
**Author:** [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Replies:** 4\ **Last updated:** [September 1, 2015, 7:05pm UTC](https://discuss.elastic.co/t/progress-for-logstash-contributions/27796 "2015-09-01T19:05:41Z")
It seems the progress for outside pull requests to the Logstash gits is very slow. Or am I looking in the wrong place? If not, what's the plan to improve the situation? I have a laundry list of things to look into, but w… --- ## [Kibana Failed to authenticate in elasticsearch](https://discuss.elastic.co/t/kibana-failed-to-authenticate-in-elasticsearch/209955)
**Author:** [@redfish462](https://discuss.elastic.co/u/redfish462)\ **Replies:** 5\ **Last updated:** [December 4, 2019, 2:41pm UTC](https://discuss.elastic.co/t/kibana-failed-to-authenticate-in-elasticsearch/209955 "2019-12-04T14:41:07Z")
I am trying to have a simple docker-compose with an elastic container and kibana. In the logs, kibana failed to authenticate to elastic and I can't find why. version: '3.7' services: elasticsearch: container\_name… --- ## [Maximum size for index limit size](https://discuss.elastic.co/t/maximum-size-for-index-limit-size/146020)
**Author:** [@deepsing](https://discuss.elastic.co/u/deepsing)\ **Replies:** 6\ **Last updated:** [August 28, 2018, 9:38am UTC](https://discuss.elastic.co/t/maximum-size-for-index-limit-size/146020 "2018-08-28T09:38:36Z")
Hi Elastic search Team I was facing below issue: java.lang.IllegalArgumentException: Limit of total fields \[1000\] in index \[event-2018.08.24\] has been exceeded at org.elasticsearch.index.mapper.MapperService.checkTota… --- ## [Filter on array of object](https://discuss.elastic.co/t/filter-on-array-of-object/270004)
**Author:** [@My-project-repositor](https://discuss.elastic.co/u/My-project-repositor)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:16am UTC](https://discuss.elastic.co/t/filter-on-array-of-object/270004 "2021-04-14T10:16:39Z")
I have a documents with many nested fields and array of objects inside them. So when I perform search, how can I get only the matching object inside the array of object, not the entire document? { "name": "Olivia", … --- ## [Cannot create Elasticsearch users with ECK](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377)
**Author:** [@maxdanilov](https://discuss.elastic.co/u/maxdanilov)\ **Replies:** 2\ **Last updated:** [June 9, 2020, 3:59pm UTC](https://discuss.elastic.co/t/cannot-create-elasticsearch-users-with-eck/236377 "2020-06-09T15:59:32Z")
I'm following this tutorial: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html to set up users in Elasticsearch programmatically. I have eck 1.1.2 installed in the cluster, Elasticsearch and … --- ## [SSL Certificate error when connecting to elastic search from python](https://discuss.elastic.co/t/ssl-certificate-error-when-connecting-to-elastic-search-from-python/182977)
**Author:** [@udara](https://discuss.elastic.co/u/udara)\ **Replies:** 5\ **Last updated:** [May 30, 2019, 7:01am UTC](https://discuss.elastic.co/t/ssl-certificate-error-when-connecting-to-elastic-search-from-python/182977 "2019-05-30T07:01:40Z")
I have set up the elastic search 7.1 in my local server under port 9650. And Signed with a self-generated CA. We have connected kibana using the steps mentioned in the below documentation. https://www.elastic.co/guide/… --- ## [No node available : Elasticsearch Transport Client can't connect to Docker container](https://discuss.elastic.co/t/no-node-available-elasticsearch-transport-client-cant-connect-to-docker-container/94883)
**Author:** [@Jessec](https://discuss.elastic.co/u/Jessec)\ **Replies:** 8\ **Last updated:** [July 28, 2017, 8:46pm UTC](https://discuss.elastic.co/t/no-node-available-elasticsearch-transport-client-cant-connect-to-docker-container/94883 "2017-07-28T20:46:06Z")
Hi , I have issue connecting to elasticsearch in Docker container using Elasticsearch Transport Client. If I curl to elasticsearch from terminal, it seems fine: $ curl -XGET http://elasticsearch:9200/\_nodes/http?pretty… --- ## [Dec 23rd, 2020: \[EN\] New additions to the keyword family: constant\_keyword and wildcard](https://discuss.elastic.co/t/dec-23rd-2020-en-new-additions-to-the-keyword-family-constant-keyword-and-wildcard/257213)
**Author:** [@Imma](https://discuss.elastic.co/u/Imma)\ **Replies:** 0\ **Last updated:** [December 23, 2020, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2020-en-new-additions-to-the-keyword-family-constant-keyword-and-wildcard/257213 "2020-12-23T08:00:03Z")
Spanish version We’ve recently introduced two additional keyword types, wildcard and constant\_keyword. In this post, we’ll try to briefly introduce them. The wildcard field is optimized for matching any part of string … --- ## [Changing the index pattern that a visualisation is based on](https://discuss.elastic.co/t/changing-the-index-pattern-that-a-visualisation-is-based-on/268290)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 6\ **Last updated:** [April 1, 2021, 6:49am UTC](https://discuss.elastic.co/t/changing-the-index-pattern-that-a-visualisation-is-based-on/268290 "2021-04-01T06:49:57Z")
I have found a set of visualisation on github that I want to use. But they are build around a different pattern of index name to what I have even though the mapping are the same (or at least mostly). I have the ndjson … --- ## [ThreadPool Setting's for bulk indexing in elasticsearch.yml](https://discuss.elastic.co/t/threadpool-settings-for-bulk-indexing-in-elasticsearch-yml/48959)
**Author:** [@moni15moni](https://discuss.elastic.co/u/moni15moni)\ **Replies:** 4\ **Last updated:** [June 3, 2016, 7:45pm UTC](https://discuss.elastic.co/t/threadpool-settings-for-bulk-indexing-in-elasticsearch-yml/48959 "2016-06-03T19:45:38Z")
Hi I have configured the below settings in elasticsearch.yml as follows. threadpool.bulk.type: fixed threadpool.bulk.size: 24 threadpool.bulk.queue\_size: 1000 threadpool.search.type: fixed threadpool.search.size: … --- ## [Kibana.yml file](https://discuss.elastic.co/t/kibana-yml-file/70560)
**Author:** [@JohnG](https://discuss.elastic.co/u/JohnG)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 8:28am UTC](https://discuss.elastic.co/t/kibana-yml-file/70560 "2017-01-05T08:28:43Z")
Hi, I've just installed Kibana and all the installation guides I've seen tell me I need to slightly amend this file. However they all give it's location as /opt/kibana/config/kibana.yml but mine is in /etc/kibana/kiba… --- ## [Kibana Alerts vs Watcher](https://discuss.elastic.co/t/kibana-alerts-vs-watcher/256551)
**Author:** [@fran6ssl](https://discuss.elastic.co/u/fran6ssl)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 5:31am UTC](https://discuss.elastic.co/t/kibana-alerts-vs-watcher/256551 "2020-11-26T05:31:57Z")
Hi, I would like to know what is included with Kibana Alerts in the Basic Plan ? I need to setup email alerts when certain conditions are met. For exemple, send an email when a new log entry exists where the user ha… --- ## [Connection Reset By Peer IOException](https://discuss.elastic.co/t/connection-reset-by-peer-ioexception/257457)
**Author:** [@surabhi11](https://discuss.elastic.co/u/surabhi11)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 8:06am UTC](https://discuss.elastic.co/t/connection-reset-by-peer-ioexception/257457 "2020-12-04T08:06:04Z")
Hi All, We are getting Connection reset by peer issue with ElasticSearch Rest Client connection. Below issue is faced with both single & multi node cluster setup. Can someone please help in resolving this issue? Than… --- ## [Reset the version value of a document](https://discuss.elastic.co/t/reset-the-version-value-of-a-document/211404)
**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\ **Replies:** 2\ **Last updated:** [December 12, 2019, 1:19am UTC](https://discuss.elastic.co/t/reset-the-version-value-of-a-document/211404 "2019-12-12T01:19:01Z")
Hi, I want to reset the version value of a document I read about in this blog on how to: and at this end it's written: For most practical use cases, 60 second is enough for the system to catch up and for delayed req… --- ## [Authorization Required](https://discuss.elastic.co/t/authorization-required/45849)
**Author:** [@renevdm](https://discuss.elastic.co/u/renevdm)\ **Replies:** 7\ **Last updated:** [April 1, 2016, 4:25pm UTC](https://discuss.elastic.co/t/authorization-required/45849 "2016-04-01T16:25:26Z")
Just installed Graph, and when checking it out, when I select the index and fields, hit search, then a dialog pops up "Authorization Required", although I have no autorization configured for Elasticsearch. Just hitting e… --- ## [Accent insensitive search with search analyzer](https://discuss.elastic.co/t/accent-insensitive-search-with-search-analyzer/113037)
**Author:** [@Valentin](https://discuss.elastic.co/u/Valentin)\ **Replies:** 7\ **Last updated:** [January 2, 2018, 12:49pm UTC](https://discuss.elastic.co/t/accent-insensitive-search-with-search-analyzer/113037 "2018-01-02T12:49:00Z")
Hi, I have some problems to configure my ES index. I want to perform a case-insensitive, accent-insensitive with special charachters search. Here is the index creation script : DELETE index-test PUT index-test { "s… --- ## [Dec 4th, 2025: \[EN\] Let's migrate this expense tool from n8n to Elastic One Workflow](https://discuss.elastic.co/t/dec-4th-2025-en-lets-migrate-this-expense-tool-from-n8n-to-elastic-one-workflow/383586)
**Author:** [@Vladimir\_Filonov](https://discuss.elastic.co/u/Vladimir_Filonov)\ **Replies:** 0\ **Last updated:** [December 4, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-4th-2025-en-lets-migrate-this-expense-tool-from-n8n-to-elastic-one-workflow/383586 "2025-12-04T08:00:40Z")
Building a Conversational Expense Assistant with Elastic One Workflow, Gemini, and Telegram A little while back I stumbled on an excellent walkthrough by Som (published yesterday): "Build a Conversational Expense Ass… --- ## [Is watcher free for now?](https://discuss.elastic.co/t/is-watcher-free-for-now/1054)
**Author:** [@kitex](https://discuss.elastic.co/u/kitex)\ **Replies:** 8\ **Last updated:** [July 28, 2015, 4:19am UTC](https://discuss.elastic.co/t/is-watcher-free-for-now/1054 "2015-07-28T04:19:18Z")
Can I use watcher beta for free forever? --- ## ["Unable to revive connection: http://localhost:9200/" & No living connections](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200-no-living-connections/170086)
**Author:** [@mugdha](https://discuss.elastic.co/u/mugdha)\ **Replies:** 3\ **Last updated:** [February 28, 2019, 8:44pm UTC](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200-no-living-connections/170086 "2019-02-28T20:44:30Z")
I created DNS entries in route 53 for my elasticsearch data machines and after that i was observing this in my kibana status: Feb 27 01:25:02 elasticsearch-client-node-2 kibana\[1026\]: {"type":"log","@timestamp":"2019-02… --- ## [Filebeat's elasticsearch module output wrong timestamp on Kibana Logs](https://discuss.elastic.co/t/filebeats-elasticsearch-module-output-wrong-timestamp-on-kibana-logs/182986)
**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\ **Replies:** 0\ **Last updated:** [May 28, 2019, 5:31am UTC](https://discuss.elastic.co/t/filebeats-elasticsearch-module-output-wrong-timestamp-on-kibana-logs/182986 "2019-05-28T05:31:02Z")
Hello, I am running 3 elasticsearch nodes and trying to output their logs using filebeat elasticsearch modules. I was setting up filebeat logging for elasticsearch module and the logs for system.yml modules is in the c… --- ## [How to join two indexes or use an index as a lookup](https://discuss.elastic.co/t/how-to-join-two-indexes-or-use-an-index-as-a-lookup/328073)
**Author:** [@alissan](https://discuss.elastic.co/u/alissan)\ **Replies:** 5\ **Last updated:** [March 21, 2023, 1:19am UTC](https://discuss.elastic.co/t/how-to-join-two-indexes-or-use-an-index-as-a-lookup/328073 "2023-03-21T01:19:15Z")
I have log indexes with 500 million records daily in one index (logs-20230320,logs-20230321,...) And i have malicious IP addresses list ( ~150.000 records) in another index (blacklist-202303) (rebuilt every day) I need… --- ## [Kibana Vega - Multiple Buckets visualization - how?](https://discuss.elastic.co/t/kibana-vega-multiple-buckets-visualization-how/131822)
**Author:** [@Vannazux](https://discuss.elastic.co/u/Vannazux)\ **Replies:** 3\ **Last updated:** [May 17, 2018, 10:07pm UTC](https://discuss.elastic.co/t/kibana-vega-multiple-buckets-visualization-how/131822 "2018-05-17T22:07:39Z")
I can't figure out how to deal with 2 buckets to draw a multi-view graph in Vega for Kibana. My index in Kibana contains orderbooks that aggregates orders per label bucket (e.g: USD/CAD). How do I build a VEGA chart in… --- ## [The length of text to be analyzed for highlighting \[18031\] exceeded the allowed maximum of \[10000\] set for the next major Elastic version. For large texts, indexing with offsets or term vectors is recommended!](https://discuss.elastic.co/t/the-length-of-text-to-be-analyzed-for-highlighting-18031-exceeded-the-allowed-maximum-of-10000-set-for-the-next-major-elastic-version-for-large-texts-indexing-with-offsets-or-term-vectors-is-recommended/128740)
**Author:** [@vaishali1](https://discuss.elastic.co/u/vaishali1)\ **Replies:** 6\ **Last updated:** [May 1, 2018, 3:36pm UTC](https://discuss.elastic.co/t/the-length-of-text-to-be-analyzed-for-highlighting-18031-exceeded-the-allowed-maximum-of-10000-set-for-the-next-major-elastic-version-for-large-texts-indexing-with-offsets-or-term-vectors-is-recommended/128740 "2018-05-01T15:36:52Z")
\[2018-04-17T15:00:25,855\]\[WARN \]\[d.o.a.l.s.u.CustomUnifiedHighlighter\] The length of text to be analyzed for highlighting \[18031\] exceeded the allowed maximum of \[10000\] set for the next major Elastic version. For large … --- ## [Upsert with logstash](https://discuss.elastic.co/t/upsert-with-logstash/59116)
**Author:** [@vtangutoori](https://discuss.elastic.co/u/vtangutoori)\ **Replies:** 6\ **Last updated:** [June 26, 2017, 12:58pm UTC](https://discuss.elastic.co/t/upsert-with-logstash/59116 "2017-06-26T12:58:53Z")
Hi, I am looking to upsert a value to a field in existing document in an array, i have the below config file but the system is throwing error with message shown after config file, can anyone please help. File: input { … --- ## [Problem in elasticsearch-create-enrollment-token for Kibana](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645)
**Author:** [@Clonky](https://discuss.elastic.co/u/Clonky)\ **Replies:** 6\ **Last updated:** [November 28, 2022, 3:18pm UTC](https://discuss.elastic.co/t/problem-in-elasticsearch-create-enrollment-token-for-kibana/319645 "2022-11-28T15:18:49Z")
Hello all, I have a new installation of Elasticsearch 8.2 and KIbana 8.2 on my Windows Server. I have installed it on a Windows Server. Elasticsearch is up and running and configured to be an Windows Service. I can ac… --- ## [Painless: access params.\_source in script filter in 6.1](https://discuss.elastic.co/t/painless-access-params-source-in-script-filter-in-6-1/115449)
**Author:** [@mahtuag](https://discuss.elastic.co/u/mahtuag)\ **Replies:** 4\ **Last updated:** [January 22, 2018, 5:22pm UTC](https://discuss.elastic.co/t/painless-access-params-source-in-script-filter-in-6-1/115449 "2018-01-22T17:22:07Z")
Within painless scripts I use for script queries (in a filter context), sort scripts and script fields, I need to refer to the JSON structure of the source document, which is fairly complex and has several arrays of obje… --- ## [How to connect to an API using Logstash?](https://discuss.elastic.co/t/how-to-connect-to-an-api-using-logstash/192123)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 8\ **Last updated:** [August 14, 2019, 11:21pm UTC](https://discuss.elastic.co/t/how-to-connect-to-an-api-using-logstash/192123 "2019-08-14T23:21:08Z")
I have an API library written in Python, and I also have data that comes from AWS Athena through queries. Is there any way to merge these two data sources together using only Logstash? If not what are other suggestions? … --- ## [🎉 Elastic Stack 5.5.0 and Elastic Stack Monitoring Service released!](https://discuss.elastic.co/t/elastic-stack-5-5-0-and-elastic-stack-monitoring-service-released/92175)
**Author:** [@michelle](https://discuss.elastic.co/u/michelle)\ **Replies:** 0\ **Last updated:** [July 6, 2017, 10:37pm UTC](https://discuss.elastic.co/t/elastic-stack-5-5-0-and-elastic-stack-monitoring-service-released/92175 "2017-07-06T22:37:07Z")
:tada: Elastic Stack 5.5.0 and Elastic Stack Monitoring Service released! Some notable changes with today's release: Machine Learning is now GA, we've got a shiny new Windows installer for Elasticsearch, Logstash has … --- ## [Query and multiple filters](https://discuss.elastic.co/t/query-and-multiple-filters/42263)
**Author:** [@Frederic\_Houbie](https://discuss.elastic.co/u/Frederic_Houbie)\ **Replies:** 7\ **Last updated:** [February 29, 2016, 2:33am UTC](https://discuss.elastic.co/t/query-and-multiple-filters/42263 "2016-02-29T02:33:34Z")
Hello, I'm afraid the question has already been asked before, but I could not find exactly the answer. I'm indexing documents with this mapping: - id - title - content - product - category I would like to do a query … --- ## [Error saying request body or source is required](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523)
**Author:** [@chitresh\_jain](https://discuss.elastic.co/u/chitresh_jain)\ **Replies:** 3\ **Last updated:** [December 2, 2021, 5:27pm UTC](https://discuss.elastic.co/t/error-saying-request-body-or-source-is-required/147523 "2021-12-02T17:27:20Z")
So I am testing my analyzer after I created it successfully using - { "settings" : { "analysis": { "filter": { "autocomplete\_filter" : { "type" : "edge\_ngram", "min\_gram" : 1, "max\_gram" : 20 } }, "analyzer":… --- ## [Logstash 2.3.3 released](https://discuss.elastic.co/t/logstash-2-3-3-released/53027)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [June 16, 2016, 4:29pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-released/53027 "2016-06-16T16:29:40Z")
We are pleased to announce that Logstash 2.3.3 has been released today. This is a bug fix release. You can see the detailed changelog or jump directly to our downloads page! Blog: https://www.elastic.co/blog/logstash-2… --- ## [Best practice of case insensitive keyword mapping in ES 5.x](https://discuss.elastic.co/t/best-practice-of-case-insensitive-keyword-mapping-in-es-5-x/74015)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 4\ **Last updated:** [February 8, 2017, 1:12am UTC](https://discuss.elastic.co/t/best-practice-of-case-insensitive-keyword-mapping-in-es-5-x/74015 "2017-02-08T01:12:12Z")
In my old ES 2.x index mapping, I had a custom analyzer to support case insensitive keyword search: { "settings": { "analyzer": { "lowercase\_keyword": { "type": "custom", "tokenizer… --- ## [Sql\_last\_value resets to 0 if logstash restart](https://discuss.elastic.co/t/sql-last-value-resets-to-0-if-logstash-restart/120397)
**Author:** [@Timotius\_Pamungkas](https://discuss.elastic.co/u/Timotius_Pamungkas)\ **Replies:** 1\ **Last updated:** [February 19, 2018, 5:55am UTC](https://discuss.elastic.co/t/sql-last-value-resets-to-0-if-logstash-restart/120397 "2018-02-19T05:55:12Z")
I'm collecting data from jdbc (MS SQL) with this configuration: jdbc { jdbc\_driver\_library =\> "C:\\dev\\script\\config\\mssql-jdbc-6.2.2.jre8.jar" jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" … --- ## [Any interest in an Elasticsearch client in delphi language?](https://discuss.elastic.co/t/any-interest-in-an-elasticsearch-client-in-delphi-language/25974)
**Author:** [@fabianobr](https://discuss.elastic.co/u/fabianobr)\ **Replies:** 1\ **Last updated:** [October 27, 2015, 1:08pm UTC](https://discuss.elastic.co/t/any-interest-in-an-elasticsearch-client-in-delphi-language/25974 "2015-10-27T13:08:26Z")
I have used elasticsearch solution in my challenges and projects. Actually my challenge is extract relevant information in some of millions of lines of executed methods at servers applications. Naturally I have produced… --- ## [Dec 14th, 2025: \[EN\] Build a map to compare metrics by country or region with ES|QL](https://discuss.elastic.co/t/dec-14th-2025-en-build-a-map-to-compare-metrics-by-country-or-region-with-es-ql/383243)
**Author:** [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Replies:** 0\ **Last updated:** [December 14, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-14th-2025-en-build-a-map-to-compare-metrics-by-country-or-region-with-es-ql/383243 "2025-12-14T08:00:14Z")
Kibana map tutorial "Build a map to compare metrics by country or region" creates a map using Elasticsearch’s DSL querying. Recent ES|QL functions LOOKUP JOIN (8.18) and ST\_GEOTILE (9.2) allow the map in this tutorial… --- ## [Bootstrap error: Duplicate key org.elasticsearch.plugins.PluginsService$Bundle@24a783dd when Upgrade ES 6.2.1 to 6.30](https://discuss.elastic.co/t/bootstrap-error-duplicate-key-org-elasticsearch-plugins-pluginsservice-bundle-24a783dd-when-upgrade-es-6-2-1-to-6-30/135788)
**Author:** [@kaem2111](https://discuss.elastic.co/u/kaem2111)\ **Replies:** 2\ **Last updated:** [June 14, 2018, 4:16pm UTC](https://discuss.elastic.co/t/bootstrap-error-duplicate-key-org-elasticsearch-plugins-pluginsservice-bundle-24a783dd-when-upgrade-es-6-2-1-to-6-30/135788 "2018-06-14T16:16:55Z")
I upgraded Elasticsearch from Version 6.2.1 to 6.3.0 using yum upgrade /tmp/elasticsearch-6.3.0.rpm after start I got error: \[2018-06-13T21:34:40,344\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[by0rqo\] unca… --- ## [Repository verification exception](https://discuss.elastic.co/t/repository-verification-exception/91105)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 8\ **Last updated:** [June 29, 2017, 12:00pm UTC](https://discuss.elastic.co/t/repository-verification-exception/91105 "2017-06-29T12:00:05Z")
Hi all i have a 5 node cluster where 3 nodes are data nodes, 1 is master and 1 is client node on this cluster when trying to create snapshot i am getting following error { "error": { "root\_cause": \[ { … --- ## [Wildcard query performance](https://discuss.elastic.co/t/wildcard-query-performance/4348)
**Author:** [@frazer](https://discuss.elastic.co/u/frazer)\ **Replies:** 7\ **Last updated:** [May 5, 2011, 3:31pm UTC](https://discuss.elastic.co/t/wildcard-query-performance/4348 "2011-05-05T15:31:07Z")
I have the following query: { "sort": \[ "\_score" \], "query": { "bool": { "must": \[ { "term": … --- ## [Improving performance of reindex API?](https://discuss.elastic.co/t/improving-performance-of-reindex-api/58028)
**Author:** [@bw99](https://discuss.elastic.co/u/bw99)\ **Replies:** 6\ **Last updated:** [August 15, 2016, 5:14pm UTC](https://discuss.elastic.co/t/improving-performance-of-reindex-api/58028 "2016-08-15T17:14:15Z")
Hi all Have just started using the reindex API in ES 2.3.5. When it first set off, it was reindexing about 87,000 documents a minute. Over the course of about 10 minutes, this slowed to about 40,000 documents a minute.… --- ## [Creating and using variables across the logstash config](https://discuss.elastic.co/t/creating-and-using-variables-across-the-logstash-config/66823)
**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Replies:** 6\ **Last updated:** [December 1, 2016, 9:03am UTC](https://discuss.elastic.co/t/creating-and-using-variables-across-the-logstash-config/66823 "2016-12-01T09:03:54Z")
Hi, I'm using LS 2.2, reading a CSV of events. I want it to be completely automatic, so in order to create a meaningful index name, I tried to "implant" the name I want to use, and then parse it and use it in the outpu… --- ## [Is ES support transaction? such as rollback?](https://discuss.elastic.co/t/is-es-support-transaction-such-as-rollback/12579)
**Author:** [@dancer](https://discuss.elastic.co/u/dancer)\ **Replies:** 3\ **Last updated:** [June 29, 2013, 9:46am UTC](https://discuss.elastic.co/t/is-es-support-transaction-such-as-rollback/12579 "2013-06-29T09:46:26Z")
I cannot find any API about that. is that means ES doesnot support transaction? -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group an… --- ## [Filebeat vs syslog](https://discuss.elastic.co/t/filebeat-vs-syslog/50547)
**Author:** [@Ale](https://discuss.elastic.co/u/Ale)\ **Replies:** 1\ **Last updated:** [May 20, 2016, 10:34am UTC](https://discuss.elastic.co/t/filebeat-vs-syslog/50547 "2016-05-20T10:34:48Z")
Hi there! we are evaluating ES Stack at our company and one of the questions that came up was: while filebeat is a lightweight log shipper, what are the benefits over just pointing syslog to logstash server? One of … --- ## [Unable to install syscall filter](https://discuss.elastic.co/t/unable-to-install-syscall-filter/77251)
**Author:** [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Replies:** 2\ **Last updated:** [March 7, 2017, 6:26am UTC](https://discuss.elastic.co/t/unable-to-install-syscall-filter/77251 "2017-03-07T06:26:22Z")
CentOS 6.8 off ipv6 yum install elastic start report error: \[2017-03-03T11:36:26,116\]\[WARN \]\[o.e.b.JNANatives \] unable to install syscall filter: java.lang.UnsupportedOperationException: seccomp unavailable: CO… --- ## [Out of memory: Kill process](https://discuss.elastic.co/t/out-of-memory-kill-process/65771)
**Author:** [@Chen\_Wei\_Hsu](https://discuss.elastic.co/u/Chen_Wei_Hsu)\ **Replies:** 4\ **Last updated:** [November 15, 2016, 4:47am UTC](https://discuss.elastic.co/t/out-of-memory-kill-process/65771 "2016-11-15T04:47:34Z")
Hi, I have a dev server running elasticsearch 2.3.5, kibana 4.5 on ubuntu 16.04.1 LTS. Originally, this server has only 1G RAM, but it is constantly killed due to OOM. This forces me to add more memories to the VM. Now i… --- ## [How to suppress DocumentMissingException?](https://discuss.elastic.co/t/how-to-suppress-documentmissingexception/42921)
**Author:** [@Attila\_Nagy](https://discuss.elastic.co/u/Attila_Nagy)\ **Replies:** 4\ **Last updated:** [March 3, 2016, 9:07am UTC](https://discuss.elastic.co/t/how-to-suppress-documentmissingexception/42921 "2016-03-03T09:07:44Z")
Hi, I have the following workflow in an application 1. update the doc with fresh data, if it succeeds, work is done 2. if the doc was missing, do some local work and when that succeeds, index the data In step 2 it's … --- ## [How exactly works "max\_expansions" in match\_phrase\_prefix query?](https://discuss.elastic.co/t/how-exactly-works-max-expansions-in-match-phrase-prefix-query/10815)
**Author:** [@JJack\_PL](https://discuss.elastic.co/u/JJack_PL)\ **Replies:** 2\ **Last updated:** [June 5, 2014, 6:49am UTC](https://discuss.elastic.co/t/how-exactly-works-max-expansions-in-match-phrase-prefix-query/10815 "2014-06-05T06:49:08Z")
Example from page: "match\_phrase\_prefix" : { "message" : { "query" : "this is a test", "max\_expansions" : 10 } } Can you give me some simple examples on this with dif… --- ## [Is X-Pack license needed for dedicated master node and dedicated coordinating node?](https://discuss.elastic.co/t/is-x-pack-license-needed-for-dedicated-master-node-and-dedicated-coordinating-node/151316)
**Author:** [@bienxanhst7](https://discuss.elastic.co/u/bienxanhst7)\ **Replies:** 0\ **Last updated:** [October 6, 2018, 11:55am UTC](https://discuss.elastic.co/t/is-x-pack-license-needed-for-dedicated-master-node-and-dedicated-coordinating-node/151316 "2018-10-06T11:55:34Z")
Our team is considering using x-pack for our elasticsearch cluster in production mode. Our cluster has 3 dedicated master-eligible nodes, 3 data nodes and 1 dedicated coordinating node. How many licenses we need in this… [Previous page](https://discuss.elastic.co/top.md?page=293&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=295&per_page=50&period=all)