# Top **URL:** https://discuss.elastic.co/top.md?page=295&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 296 --- ## [Dec 16th, 2019: \[EN\]\[Logstash\] Indexing Github Events for Fun and Profit](https://discuss.elastic.co/t/dec-16th-2019-en-logstash-indexing-github-events-for-fun-and-profit/211392)
**Author:** [@Ron\_Toland](https://discuss.elastic.co/u/Ron_Toland)\ **Replies:** 0\ **Last updated:** [December 16, 2019, 8:00am UTC](https://discuss.elastic.co/t/dec-16th-2019-en-logstash-indexing-github-events-for-fun-and-profit/211392 "2019-12-16T08:00:00Z")
Indexing Github Events for Fun and Profit Idea Like a lot of companies, we lean on Github for more than just git repo hosting. We use it to track work via tickets, asynchronously pair on code via PR reviews, and even use… --- ## [Illegal\_argument\_exception: failed to parse date field, date\_time\_parse\_exception](https://discuss.elastic.co/t/illegal-argument-exception-failed-to-parse-date-field-date-time-parse-exception/198737)
**Author:** [@holobolo0815](https://discuss.elastic.co/u/holobolo0815)\ **Replies:** 5\ **Last updated:** [September 10, 2019, 11:58am UTC](https://discuss.elastic.co/t/illegal-argument-exception-failed-to-parse-date-field-date-time-parse-exception/198737 "2019-09-10T11:58:19Z")
Hey, I'm currently getting this all the time \[2019-09-09T18:10:24,175\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-201… --- ## [Equivalent to SQL window functions](https://discuss.elastic.co/t/equivalent-to-sql-window-functions/44527)
**Author:** [@sergeyb](https://discuss.elastic.co/u/sergeyb)\ **Replies:** 6\ **Last updated:** [March 11, 2019, 12:27pm UTC](https://discuss.elastic.co/t/equivalent-to-sql-window-functions/44527 "2019-03-11T12:27:00Z")
Is there any way to implement SQL window functions? Here is my use case: Multiple events reported with "Type" and "Timestamp" fields. I'm looking for a way to extract the latest occurrence of each type. In SQL this ca… --- ## [Elasticsearch 7 cluster setup with 3 nodes ---](https://discuss.elastic.co/t/elasticsearch-7-cluster-setup-with-3-nodes/177016)
**Author:** [@hari.v](https://discuss.elastic.co/u/hari.v)\ **Replies:** 5\ **Last updated:** [April 16, 2019, 8:28am UTC](https://discuss.elastic.co/t/elasticsearch-7-cluster-setup-with-3-nodes/177016 "2019-04-16T08:28:55Z")
hi, i tried to setup elasticsearch 7 setup with 3 nodes in rhel7. my config files: node1 cluster.name: master-node node.name: elk-tst1 node.master: true node.data: false path.data: /var/lib/elasticsearch path.lo… --- ## [Must not query not working](https://discuss.elastic.co/t/must-not-query-not-working/107759)
**Author:** [@aravind\_apalya](https://discuss.elastic.co/u/aravind_apalya)\ **Replies:** 8\ **Last updated:** [December 1, 2017, 11:46am UTC](https://discuss.elastic.co/t/must-not-query-not-working/107759 "2017-12-01T11:46:37Z")
Hi, I have a bunch of documents in my database. I need to filter the contents which are not matching with my condition. For this, I have used filter must\_not , but not working. Below is the code snippet. filter.must… --- ## [Rally 0.5.3 released](https://discuss.elastic.co/t/rally-0-5-3-released/82122)
**Author:** [@danielmitterdorfer](https://discuss.elastic.co/u/danielmitterdorfer)\ **Replies:** 0\ **Last updated:** [April 12, 2017, 8:58am UTC](https://discuss.elastic.co/t/rally-0-5-3-released/82122 "2017-04-12T08:58:35Z")
We have just released Rally 0.5.3. This is a maintenance release that fixes a couple of bugs but also brings a few new features. How to...? ... upgrade: pip3 install --upgrade esrally ... install: pip3 install esrally … --- ## [ES default - async or sync](https://discuss.elastic.co/t/es-default-async-or-sync/19654)
**Author:** [@daa\_qqu](https://discuss.elastic.co/u/daa_qqu)\ **Replies:** 3\ **Last updated:** [February 2, 2015, 2:26pm UTC](https://discuss.elastic.co/t/es-default-async-or-sync/19654 "2015-02-02T14:26:56Z")
What is the default replication policy in Elasticsearch? Does it push changes to replicas asynchronously or synchronously? Or does it use different mode with different operations. asynchronous replication By def… --- ## [Limit on number of indices?](https://discuss.elastic.co/t/limit-on-number-of-indices/5825)
**Author:** [@searchersteve](https://discuss.elastic.co/u/searchersteve)\ **Replies:** 8\ **Last updated:** [November 13, 2011, 8:44am UTC](https://discuss.elastic.co/t/limit-on-number-of-indices/5825 "2011-11-13T08:44:46Z")
Is it problematic to create a large number of indices? Because the memory drain on my machine is growing with the number of documents I've placed in ES (I've logged some OutOfMemory errors lately), I am working on a… --- ## [Kibana visualization - different ways to show filesystem usage](https://discuss.elastic.co/t/kibana-visualization-different-ways-to-show-filesystem-usage/85762)
**Author:** [@arun\_prasath1](https://discuss.elastic.co/u/arun_prasath1)\ **Replies:** 6\ **Last updated:** [May 17, 2017, 7:26pm UTC](https://discuss.elastic.co/t/kibana-visualization-different-ways-to-show-filesystem-usage/85762 "2017-05-17T19:26:40Z")
I am suppose to show all the filesystem (local and mounted) usage in kibana. I could not understand how disk usage (free, available, total) can be shown from the files available using Kibana. I mean what visualization wi… --- ## [How to escape square bracket in Logstash Grok filter?](https://discuss.elastic.co/t/how-to-escape-square-bracket-in-logstash-grok-filter/123721)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 6\ **Last updated:** [March 13, 2018, 1:08pm UTC](https://discuss.elastic.co/t/how-to-escape-square-bracket-in-logstash-grok-filter/123721 "2018-03-13T13:08:46Z")
Hi, I am using ELK GA 5.0.0. I am consuming from Kafka topic using Logstash. Messages are JSON encoded. In the message, I have date field like \\t\[05/Feb/2018:10:39:47 +0000\]\\t. In the grok filter, I am parsing it like; … --- ## [Kibana 4.5.1 and 4.1.7 Released](https://discuss.elastic.co/t/kibana-4-5-1-and-4-1-7-released/50360)
**Author:** [@Court](https://discuss.elastic.co/u/Court)\ **Replies:** 0\ **Last updated:** [May 18, 2016, 4:08pm UTC](https://discuss.elastic.co/t/kibana-4-5-1-and-4-1-7-released/50360 "2016-05-18T16:08:40Z")
Today, we’re releasing Kibana patch versions 4.5.1 and 4.1.7 that include an updated version of Node.js with a fix for a high severity vulnerability in OpenSSL (CVE-2016-2107). We recommend any users that have configur… --- ## [Error: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106)
**Author:** [@Saber.Tala](https://discuss.elastic.co/u/Saber.Tala)\ **Replies:** 5\ **Last updated:** [August 7, 2019, 4:28am UTC](https://discuss.elastic.co/t/error-failed-to-start-filebeat-sends-log-files-to-logstash-or-directly-to-elasticsearch/192106 "2019-08-07T04:28:00Z")
Got following error when tried to start Filebeat service: \[root@VM1 filebeat\]# systemctl start filebeat Exiting: no modules or inputs enabled and configuration reloading disabled. What files do you want me to watch? \*\*F… --- ## [Best approach to summarize data?](https://discuss.elastic.co/t/best-approach-to-summarize-data/35218)
**Author:** [@venky1987](https://discuss.elastic.co/u/venky1987)\ **Replies:** 5\ **Last updated:** [November 23, 2015, 12:24pm UTC](https://discuss.elastic.co/t/best-approach-to-summarize-data/35218 "2015-11-23T12:24:03Z")
We need to summarize data from raw index. We could think of two approaches as below: 1) Writing a program in any of the languages (Java,Python etc) using the exposed APIs and schedule the same through cron. 2) To write… --- ## [Helpers.scan throws a key error on ES python package 7.1 but not on 7.0.0](https://discuss.elastic.co/t/helpers-scan-throws-a-key-error-on-es-python-package-7-1-but-not-on-7-0-0/223567)
**Author:** [@Okhtay](https://discuss.elastic.co/u/Okhtay)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 7:12pm UTC](https://discuss.elastic.co/t/helpers-scan-throws-a-key-error-on-es-python-package-7-1-but-not-on-7-0-0/223567 "2020-03-13T19:12:29Z")
I have a pipeline in production that ingests some data into an elasticsearch index. Recently we upgraded from version 5.4 to 7.4. We also upgraded the python package to v. 7.1. Now, elasticsearch.helpers.scan command th… --- ## [How to convert a field string to long in logstash](https://discuss.elastic.co/t/how-to-convert-a-field-string-to-long-in-logstash/49453)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 3\ **Last updated:** [May 7, 2016, 8:24am UTC](https://discuss.elastic.co/t/how-to-convert-a-field-string-to-long-in-logstash/49453 "2016-05-07T08:24:23Z")
HI, How to convert string field to long in logstash. When i configured data type as long like below logstash not running. mutate { convert =\> { "clientid" =\> "long" } convert =\> { "groupid" =\> "long" } … --- ## [Copy field value to a new field in existing index](https://discuss.elastic.co/t/copy-field-value-to-a-new-field-in-existing-index/224595)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 6\ **Last updated:** [March 25, 2020, 5:50am UTC](https://discuss.elastic.co/t/copy-field-value-to-a-new-field-in-existing-index/224595 "2020-03-25T05:50:43Z")
Hey all, I had a field name with a typo. Let's say it was called Helo.keyword. I have created a new field with the correct name Hello.keyword. New data is populating the new field. How can I copy the old values to th… --- ## [Cant find installed plugin](https://discuss.elastic.co/t/cant-find-installed-plugin/97098)
**Author:** [@jaime\_loom](https://discuss.elastic.co/u/jaime_loom)\ **Replies:** 7\ **Last updated:** [September 19, 2017, 5:01pm UTC](https://discuss.elastic.co/t/cant-find-installed-plugin/97098 "2017-09-19T17:01:19Z")
Hi I am creating a new logstash output plugin and I’m trying to test it with logstash 5.5.1 I install it with bin/logstash-plugin install path/to/logstash-output-azure-0.1.1.gem the out put is Validating /path/to/logs… --- ## [Lucene Meetup London 23rd March - find out about the Marple index inspector](https://discuss.elastic.co/t/lucene-meetup-london-23rd-march-find-out-about-the-marple-index-inspector/79455)
**Author:** [@Charlie\_Hull](https://discuss.elastic.co/u/Charlie_Hull)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 3:30pm UTC](https://discuss.elastic.co/t/lucene-meetup-london-23rd-march-find-out-about-the-marple-index-inspector/79455 "2017-03-21T15:30:22Z")
We run the London Lucene/Solr Meetup and this Thursday we'll be presenting Marple, a new Lucene index inspector, with some examples of inspecting indexes created by Elasticsearch. Please come along if you can! --- ## [Sorting rows in Kibana based on keyword field](https://discuss.elastic.co/t/sorting-rows-in-kibana-based-on-keyword-field/109968)
**Author:** [@rinmalavi](https://discuss.elastic.co/u/rinmalavi)\ **Replies:** 5\ **Last updated:** [December 6, 2017, 10:57am UTC](https://discuss.elastic.co/t/sorting-rows-in-kibana-based-on-keyword-field/109968 "2017-12-06T10:57:33Z")
Is there a way to get those up down arrows next to field name in Kibana so I could sort by small strings in that field. Seems pretty trivial but I can't find a way. Thought it was done adding "fielddata" but still no s… --- ## [Best way to configure load balancer before elastic search cluster](https://discuss.elastic.co/t/best-way-to-configure-load-balancer-before-elastic-search-cluster/131695)
**Author:** [@shobhana](https://discuss.elastic.co/u/shobhana)\ **Replies:** 1\ **Last updated:** [May 14, 2018, 1:20pm UTC](https://discuss.elastic.co/t/best-way-to-configure-load-balancer-before-elastic-search-cluster/131695 "2018-05-14T13:20:25Z")
Currently we have a 3 node cluster running 6.2 version in GCP with no dedicated master nodes. All are identical in terms of configuration (4 vCPU, 15 GB RAM nodes - 7GB set as xmx for ES) and settings. We use org.elastic… --- ## [Regex field starts with a string](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 1:12pm UTC](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235 "2020-09-11T13:12:29Z")
I want to add a new field if a field start with a certain string. Added below code in filter { }, to set a new field error as "Y" if text starts with ERROR: . Doesnt seem to work. if "\[dest\]\[text\]" =~ /^ERROR: .\*/ { … --- ## [How to query elasticsearch: I keep getting index\_not\_found\_exception](https://discuss.elastic.co/t/how-to-query-elasticsearch-i-keep-getting-index-not-found-exception/156750)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 5\ **Last updated:** [November 15, 2018, 1:40am UTC](https://discuss.elastic.co/t/how-to-query-elasticsearch-i-keep-getting-index-not-found-exception/156750 "2018-11-15T01:40:44Z")
Elasticsearch 6.4.3 Issue: /\_search command returns: index\_not\_found\_exception Specifically: $ curl -X GET "192.168.2.2:9200/MyNew\_Index/\_search" -H 'Content-Type: application/json' { "from": 0, "size": 40, "sort": … --- ## [Handling empty/zero values in Scripted Fields](https://discuss.elastic.co/t/handling-empty-zero-values-in-scripted-fields/89600)
**Author:** [@thinkdffrnt](https://discuss.elastic.co/u/thinkdffrnt)\ **Replies:** 7\ **Last updated:** [June 16, 2017, 2:09pm UTC](https://discuss.elastic.co/t/handling-empty-zero-values-in-scripted-fields/89600 "2017-06-16T14:09:24Z")
version 2.4 Below are my two epoch times in Number format doc\['actual'\].value-doc\['expected'\].value \< 0?1:0 I'm looking for a percentage of actual time not meeting the expected time. But I have challenge where few docu… --- ## [Count nested documents only?](https://discuss.elastic.co/t/count-nested-documents-only/113248)
**Author:** [@bkazez](https://discuss.elastic.co/u/bkazez)\ **Replies:** 7\ **Last updated:** [December 29, 2017, 5:57am UTC](https://discuss.elastic.co/t/count-nested-documents-only/113248 "2017-12-29T05:57:26Z")
Hi, in my index, each document represents a Record Group, which includes an array of Records - type: nested. I need the count of Records only, not Record Groups. I've seen several people looking for this kind of thing o… --- ## [Three-node Elasticsearch Cluster with docker-compose failing with stacktrace--\["org.elasticsearch.bootstrap.StartupException: ElasticsearchException\[failed to bind service\]; nested: AccessDeniedException\[/usr/share/elasticsearch/data/nodes](https://discuss.elastic.co/t/three-node-elasticsearch-cluster-with-docker-compose-failing-with-stacktrace-org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failed-to-bind-service-nested-accessdeniedexception-usr-share-elasticsearch-data-nodes/258619)
**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\ **Replies:** 6\ **Last updated:** [December 16, 2020, 5:34pm UTC](https://discuss.elastic.co/t/three-node-elasticsearch-cluster-with-docker-compose-failing-with-stacktrace-org-elasticsearch-bootstrap-startupexception-elasticsearchexception-failed-to-bind-service-nested-accessdeniedexception-usr-share-elasticsearch-data-nodes/258619 "2020-12-16T17:34:35Z")
Hi, I am trying to spin up a three node Elasticsearch cluster with a docker-compose file. While spinning up the cluster only one Elasticsearch container is coming up whereas other two containers on different nodes are f… --- ## [Logstash 6.2.2 high CPU usage](https://discuss.elastic.co/t/logstash-6-2-2-high-cpu-usage/122672)
**Author:** [@JulianYuan](https://discuss.elastic.co/u/JulianYuan)\ **Replies:** 2\ **Last updated:** [March 9, 2018, 12:42am UTC](https://discuss.elastic.co/t/logstash-6-2-2-high-cpu-usage/122672 "2018-03-09T00:42:40Z")
I upgraded Elastic Stack from 5.6.3 to 6.2.2, but the Logstash CPU usage go high and no error logs. Start command: ./logstash -f '/data/conf/main.conf' -l /data/logs/logstash/ Logstash config: input { beats { p… --- ## [Unable to change index name for Filebeat](https://discuss.elastic.co/t/unable-to-change-index-name-for-filebeat/122890)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 2\ **Last updated:** [March 8, 2018, 8:25pm UTC](https://discuss.elastic.co/t/unable-to-change-index-name-for-filebeat/122890 "2018-03-08T20:25:18Z")
Hello, I am trying to change index name for filebeat configuration and it still complain about missing template name and pattern. After googling and checking documentation I have finished with this configration syntax: … --- ## [IndexName with current date](https://discuss.elastic.co/t/indexname-with-current-date/51413)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 11:41am UTC](https://discuss.elastic.co/t/indexname-with-current-date/51413 "2016-05-31T11:41:02Z")
Hi All, Please suggest how to create index name with current date. PFB snippet from my logstash config file- output { elasticsearch { action =\> "index" index =\> "\[datewise-\]YYYY.MM.DD" } I … --- ## [Kibana 4.1.1 unable to map timestamp which is in UNIX Epoch format](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244)
**Author:** [@cloud\_admin](https://discuss.elastic.co/u/cloud_admin)\ **Replies:** 8\ **Last updated:** [December 16, 2015, 3:57pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244 "2015-12-16T15:57:54Z")
Hi Team, I have recently upgraded my Kibana from 3 to 4.1.1, my nginx access logs has Epoch Time format like 1434589605.318 and kibana is not able to detect this time stamp field, hence I am not able to segregate the … --- ## [Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template/167209)
**Author:** [@andymelichar](https://discuss.elastic.co/u/andymelichar)\ **Replies:** 3\ **Last updated:** [February 6, 2019, 3:46pm UTC](https://discuss.elastic.co/t/connection-marked-as-failed-because-the-onconnect-callback-failed-error-loading-elasticsearch-template/167209 "2019-02-06T15:46:09Z")
Having trouble getting metricbeats 6.6 running on a Kubernetes cluster. Used https://github.com/elastic/beats/blob/master/deploy/kubernetes/metricbeat-kubernetes.yaml as my deploy file for kubectl. Edited the file for m… --- ## [Grok pattern for space OR double space](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725)
**Author:** [@Saplog](https://discuss.elastic.co/u/Saplog)\ **Replies:** 8\ **Last updated:** [May 15, 2017, 9:33am UTC](https://discuss.elastic.co/t/grok-pattern-for-space-or-double-space/85725 "2017-05-15T09:33:53Z")
Hi, I have logs like that , Wed May 10 02:50:43 2017 Wed May 3 12:23:21 2017 My grok pattern works when they are only 1 space , like the "Wed May 10 02:50:43 2017" but with "Wed May 3 12:23:21 2017", it doesn't work. … --- ## [Elasticsearch Master not discovered exception](https://discuss.elastic.co/t/elasticsearch-master-not-discovered-exception/133599)
**Author:** [@gintokisama](https://discuss.elastic.co/u/gintokisama)\ **Replies:** 6\ **Last updated:** [May 30, 2018, 10:50am UTC](https://discuss.elastic.co/t/elasticsearch-master-not-discovered-exception/133599 "2018-05-30T10:50:04Z")
I'm running a 5 node elasticsearch cluster (2 data nodes, 2 master nodes, 1 kibana). I'm getting the following error when use the command curl -X GET "192.168.107.75:9200/\_cat/master?v" {"error":{"root\_cause":\[{"type"… --- ## [Logstash tutorial: index\_not\_found\_exception \[SOLVED\]](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 3\ **Last updated:** [March 15, 2016, 10:32am UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786 "2016-03-15T10:32:57Z")
Hello, I am following the Logstash tutorial. This command curl -XGET '192.168.77.200:9200/logstash-2016.03.08/\_search?q=response=200' returns the following error, instead of the data shown in the tutorial: {"error"… --- ## [How to attach pipeline to index](https://discuss.elastic.co/t/how-to-attach-pipeline-to-index/77844)
**Author:** [@nan008](https://discuss.elastic.co/u/nan008)\ **Replies:** 8\ **Last updated:** [March 10, 2017, 7:18pm UTC](https://discuss.elastic.co/t/how-to-attach-pipeline-to-index/77844 "2017-03-10T19:18:19Z")
I want to use the pipeline use a pipeline as parameter on an index. Going with info on the ingest node page I was using curl -XPUT 'http://localhost:9200/demo\_old/\_type/0?pipeline=old\_index&pretty' -H 'Content-Type:… --- ## [What is the Machine learning algorithm in Elastic?](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527)
**Author:** [@NOUR](https://discuss.elastic.co/u/NOUR)\ **Replies:** 6\ **Last updated:** [March 16, 2018, 2:04pm UTC](https://discuss.elastic.co/t/what-is-the-machine-learning-algorithm-in-elastic/123527 "2018-03-16T14:04:16Z")
Hello world, I'm using kibana 6.2.2 and elastic 6.2.2 for my final academic project. I prepared some analyses using ml plugin under x-pack like this \[1\] But i still confused about the algorithm using in background. … --- ## [Multiple Logstash Instances on Single Server](https://discuss.elastic.co/t/multiple-logstash-instances-on-single-server/28947)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 6\ **Last updated:** [May 24, 2016, 6:16am UTC](https://discuss.elastic.co/t/multiple-logstash-instances-on-single-server/28947 "2016-05-24T06:16:01Z")
Hi, I would like to have several distinct logstash instances running on the same server. What is the best way to accomplish this? I already have a single instance of logstash running, it monitors a large number of fi… --- ## [“Permission Denied” starting Elasticsearch-7.0](https://discuss.elastic.co/t/permission-denied-starting-elasticsearch-7-0/179336)
**Author:** [@kthy](https://discuss.elastic.co/u/kthy)\ **Replies:** 2\ **Last updated:** [May 2, 2019, 11:03am UTC](https://discuss.elastic.co/t/permission-denied-starting-elasticsearch-7-0/179336 "2019-05-02T11:03:17Z")
I'm getting a permission denied error for /etc/default/elasticsearch when starting Elasticsearch: $ sudo systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/… --- ## [Connection Closed Error](https://discuss.elastic.co/t/connection-closed-error/310980)
**Author:** [@Reskun](https://discuss.elastic.co/u/Reskun)\ **Replies:** 7\ **Last updated:** [August 16, 2022, 4:22pm UTC](https://discuss.elastic.co/t/connection-closed-error/310980 "2022-08-16T16:22:50Z")
Hi I've successfully created a multinode elasticsearch cluster using a docker-compose.yml file by following the steps in the link: Install Elasticsearch with Docker | Elasticsearch Guide \[8.3\] | Elastic localhost:9200… --- ## [Restore index from another cluster](https://discuss.elastic.co/t/restore-index-from-another-cluster/167329)
**Author:** [@nousees](https://discuss.elastic.co/u/nousees)\ **Replies:** 1\ **Last updated:** [February 6, 2019, 9:22pm UTC](https://discuss.elastic.co/t/restore-index-from-another-cluster/167329 "2019-02-06T21:22:25Z")
Hi, I'm struggle trying to restore an index from a snapshot to another cluster. The steps I've following are: make a backup of the index on the original cluster create the snapshot repository on the other cluster, just… --- ## [How to query for most recent entry?](https://discuss.elastic.co/t/how-to-query-for-most-recent-entry/687)
**Author:** [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\ **Replies:** 2\ **Last updated:** [May 14, 2015, 1:52pm UTC](https://discuss.elastic.co/t/how-to-query-for-most-recent-entry/687 "2015-05-14T13:52:14Z")
Sorry if this is a dumb question, we're using ES for lots of different things across our environment. I am the infrastructure guy and one of the things I am tasked with is monitoring functionality. What I would like to k… --- ## [Logstash and ElasticSearch setup not working for Netflow logs](https://discuss.elastic.co/t/logstash-and-elasticsearch-setup-not-working-for-netflow-logs/27698)
**Author:** [@akshayukey](https://discuss.elastic.co/u/akshayukey)\ **Replies:** 7\ **Last updated:** [February 18, 2016, 2:24am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-setup-not-working-for-netflow-logs/27698 "2016-02-18T02:24:21Z")
Hi Folks, I have done a basic setup/configuration for storing Netflow logs into ElasticSearch using Logstash. My logstash config looks like: input { udp { port =\> 9995 codec =\> netflow { definit… --- ## [Where can I find info on the status of G1GC in Lucene and ES?](https://discuss.elastic.co/t/where-can-i-find-info-on-the-status-of-g1gc-in-lucene-and-es/149526)
**Author:** [@martiansnoop](https://discuss.elastic.co/u/martiansnoop)\ **Replies:** 7\ **Last updated:** [October 30, 2018, 10:42am UTC](https://discuss.elastic.co/t/where-can-i-find-info-on-the-status-of-g1gc-in-lucene-and-es/149526 "2018-10-30T10:42:46Z")
I read in this doc this doc that CMS is still the recommended garbage collector for ES. That doc has a warning at the top that it is for ES 2.x and so might be out of date, though. I see that as of last December it isn'… --- ## [org.elasticsearch.discovery.MasterNotDiscoveredException: nul](https://discuss.elastic.co/t/org-elasticsearch-discovery-masternotdiscoveredexception-nul/108317)
**Author:** [@manikesh](https://discuss.elastic.co/u/manikesh)\ **Replies:** 7\ **Last updated:** [November 22, 2017, 4:33am UTC](https://discuss.elastic.co/t/org-elasticsearch-discovery-masternotdiscoveredexception-nul/108317 "2017-11-22T04:33:04Z")
Everything was working fine until I restarted my cluster this weekend, post that same error is keep on coming no matter what I am doing.. First this issue came in prod and then UAT. not sure what is going on My cluster… --- ## [Remove event.original from logstash as it comes in every document of logstash version 8.8.2(ECS)](https://discuss.elastic.co/t/remove-event-original-from-logstash-as-it-comes-in-every-document-of-logstash-version-8-8-2-ecs/342612)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [September 8, 2023, 3:12pm UTC](https://discuss.elastic.co/t/remove-event-original-from-logstash-as-it-comes-in-every-document-of-logstash-version-8-8-2-ecs/342612 "2023-09-08T15:12:18Z")
Hello All, I am facing major issue with logstash after migration from 7.9.1 to 8.8.2 version. Elasticsearch/Logstash 8.X version has ECS compatibility enabled by default.This adds new field event.original in every do… --- ## [How to sum a field from top\_hits results](https://discuss.elastic.co/t/how-to-sum-a-field-from-top-hits-results/81499)
**Author:** [@Nestor\_Manrique](https://discuss.elastic.co/u/Nestor_Manrique)\ **Replies:** 0\ **Last updated:** [April 6, 2017, 4:02pm UTC](https://discuss.elastic.co/t/how-to-sum-a-field-from-top-hits-results/81499 "2017-04-06T16:02:35Z")
Hello, From time to time I poll from an API the state of a bunch of virtual machines. In the virtual machine type mapping I have a "cpuCount" integer field. Let's say I want to sum the latest "cpuCount" for a bunch of … --- ## [Kibana 4.2.0 Plugin OFFLINE installation?](https://discuss.elastic.co/t/kibana-4-2-0-plugin-offline-installation/33223)
**Author:** [@Thorsten\_Nickel](https://discuss.elastic.co/u/Thorsten_Nickel)\ **Replies:** 8\ **Last updated:** [April 21, 2016, 12:34pm UTC](https://discuss.elastic.co/t/kibana-4-2-0-plugin-offline-installation/33223 "2016-04-21T12:34:52Z")
Hello, is there a possibility to have the plugin installed from the local file ? I tried a syntax similar to the elasticsearch plugin installation, where I can do it offline, as long as i can provide the file. Exampl… --- ## [Convert @timestamp date format](https://discuss.elastic.co/t/convert-timestamp-date-format/125966)
**Author:** [@Bhairavi](https://discuss.elastic.co/u/Bhairavi)\ **Replies:** 8\ **Last updated:** [March 29, 2018, 7:40pm UTC](https://discuss.elastic.co/t/convert-timestamp-date-format/125966 "2018-03-29T19:40:36Z")
Hi! This is the sample logs which I am trying to store in elasticsearch index. Mar 26 08:48:21 ip-192-168-0-94 sshd\[18576\]: Received disconnect from 115.238.245.2: 11: \[preauth\] I want to convert this date pattern to … --- ## [Reading packets from pcap file](https://discuss.elastic.co/t/reading-packets-from-pcap-file/26278)
**Author:** [@catwallader](https://discuss.elastic.co/u/catwallader)\ **Replies:** 4\ **Last updated:** [July 28, 2015, 8:49am UTC](https://discuss.elastic.co/t/reading-packets-from-pcap-file/26278 "2015-07-28T08:49:30Z")
Is it possible to read packets from an exiting pcap file. I see that packetbeat has a -I option, which I thought would be an input file, but it doesn't seem to be. --- ## [Failed to flush export bulks](https://discuss.elastic.co/t/failed-to-flush-export-bulks/71020)
**Author:** [@shaonbean](https://discuss.elastic.co/u/shaonbean)\ **Replies:** 0\ **Last updated:** [January 10, 2017, 5:11am UTC](https://discuss.elastic.co/t/failed-to-flush-export-bulks/71020 "2017-01-10T05:11:08Z")
failed to flush export bulks org.elasticsearch.xpack.monitoring.exporter.ExportException: failed to flush export bulks at org.elasticsearch.xpack.monitoring.exporter.ExportBulk$Compound.doFlush(ExportBulk.java:148) ~\[x… --- ## [Running out of space in /var/lib/elasticsearch](https://discuss.elastic.co/t/running-out-of-space-in-var-lib-elasticsearch/148398)
**Author:** [@popa](https://discuss.elastic.co/u/popa)\ **Replies:** 5\ **Last updated:** [September 19, 2018, 5:40am UTC](https://discuss.elastic.co/t/running-out-of-space-in-var-lib-elasticsearch/148398 "2018-09-19T05:40:03Z")
I currently have a single node Elastic Stack (with Winlogbeat) instance setup using mostly default settings. We're running out of storage space, so we need to add another location for Elasticsearch data nodes to store i… [Previous page](https://discuss.elastic.co/top.md?page=294&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=296&per_page=50&period=all)