# Top **URL:** https://discuss.elastic.co/top.md?page=319&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 320 --- ## [Inputting JSON object to logstash - unable to remove certain fields or parse as JSON](https://discuss.elastic.co/t/inputting-json-object-to-logstash-unable-to-remove-certain-fields-or-parse-as-json/26401)
**Author:** [@s\_gonzales](https://discuss.elastic.co/u/s_gonzales)\ **Replies:** 4\ **Last updated:** [July 28, 2015, 11:42am UTC](https://discuss.elastic.co/t/inputting-json-object-to-logstash-unable-to-remove-certain-fields-or-parse-as-json/26401 "2015-07-28T11:42:47Z")
For some context, I am completeley new to logstash and am interested in filtering this data in three ways: 1. remove ceratin fields such as "anonymousId" or "library" (which is nested within context) 2. extract fields fr… --- ## [Received plaintext http traffic on an https channel](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel/324074)
**Author:** [@Cruz](https://discuss.elastic.co/u/Cruz)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 10:01am UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel/324074 "2023-01-27T10:01:14Z")
Is it normal for this to appear as a warning in the elasticsearch logs? The first time I installed elasticsearch, this is what I saw in the elasticsearch logs. \[2023-01-27T06:18:35,815\]\[WARN \]\[o.e.x.s.t.n.SecurityNetty… --- ## [Prevent logging to /var/log/messages](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199)
**Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 6\ **Last updated:** [July 22, 2016, 9:34am UTC](https://discuss.elastic.co/t/prevent-logging-to-var-log-messages/54199 "2016-07-22T09:34:38Z")
Hi all Elasticsearchers, Is it possible to prevent logging to /var/log/messages? The /var/log/elasticsearch logs are sufficient and logging to /v/l/m is causing us some bother. Thanks, Dan. We're using RHEL and the R… --- ## [How to fix UNASSIGNED shard in Elasticsearch](https://discuss.elastic.co/t/how-to-fix-unassigned-shard-in-elasticsearch/29257)
**Author:** [@Fernando\_Gamboa](https://discuss.elastic.co/u/Fernando_Gamboa)\ **Replies:** 5\ **Last updated:** [November 9, 2015, 12:47am UTC](https://discuss.elastic.co/t/how-to-fix-unassigned-shard-in-elasticsearch/29257 "2015-11-09T00:47:43Z")
While monitoring Elasticsearch logs it was observed a shard failure, please see below: The cluster (1 nodes) is in red state and while troubleshooting this it was found via curl localhost:9200/\_cat/shards 1 unassign… --- ## [Frequent GC brings down cluster without obvious load](https://discuss.elastic.co/t/frequent-gc-brings-down-cluster-without-obvious-load/27049)
**Author:** [@niulin](https://discuss.elastic.co/u/niulin)\ **Replies:** 7\ **Last updated:** [August 8, 2015, 3:40am UTC](https://discuss.elastic.co/t/frequent-gc-brings-down-cluster-without-obvious-load/27049 "2015-08-08T03:40:44Z")
Hi experts, We have a cluster with 10 nodes which used to work very well. Recently, the cluster become unstable, after some debugging, we found that JVM can go into an unstable state some times without obvious load. JV… --- ## [\[Index Lifecycle Management\] Dynamic rollover alias and template name](https://discuss.elastic.co/t/index-lifecycle-management-dynamic-rollover-alias-and-template-name/169614)
**Author:** [@Cyril\_Berber](https://discuss.elastic.co/u/Cyril_Berber)\ **Replies:** 7\ **Last updated:** [August 13, 2019, 7:28pm UTC](https://discuss.elastic.co/t/index-lifecycle-management-dynamic-rollover-alias-and-template-name/169614 "2019-08-13T19:28:17Z")
Use Case: ELK pipeline with Filebeat \> Logstash \> Elasticsearch Many Filebeat instances read different logs files and Docker output Logstash processes messages to parse and route them in different indices Use ILM on th… --- ## [Indexing same document twice](https://discuss.elastic.co/t/indexing-same-document-twice/59306)
**Author:** [@egens](https://discuss.elastic.co/u/egens)\ **Replies:** 4\ **Last updated:** [August 30, 2016, 8:46pm UTC](https://discuss.elastic.co/t/indexing-same-document-twice/59306 "2016-08-30T20:46:22Z")
Suppose I have some document id=1 { "foo":"bar" } What happens if I'm trying to index the same document? Will it be reindexed? Is it the same as if some field changed? (I see that version number grows so I expect s… --- ## [Marking the missing words in search results](https://discuss.elastic.co/t/marking-the-missing-words-in-search-results/66986)
**Author:** [@itasyurt](https://discuss.elastic.co/u/itasyurt)\ **Replies:** 7\ **Last updated:** [November 23, 2016, 5:41pm UTC](https://discuss.elastic.co/t/marking-the-missing-words-in-search-results/66986 "2016-11-23T17:41:03Z")
Hello, I want to implement a feature to show missing search terms in search results similar to Google's. Is there any proper way to do in Elasticsearch. Current Elasticsearch version we are using is 1.5.2. Thank you. … --- ## [Kibana import/export dashboard api](https://discuss.elastic.co/t/kibana-import-export-dashboard-api/108180)
**Author:** [@tsullivan93](https://discuss.elastic.co/u/tsullivan93)\ **Replies:** 6\ **Last updated:** [November 17, 2017, 7:20pm UTC](https://discuss.elastic.co/t/kibana-import-export-dashboard-api/108180 "2017-11-17T19:20:39Z")
Is there any documentation on how to use the new import/export dashboard api for kibana? --- ## [Is it possible to run elastic on 1 GB of RAM for testing purposes?](https://discuss.elastic.co/t/is-it-possible-to-run-elastic-on-1-gb-of-ram-for-testing-purposes/64594)
**Author:** [@mmoxam](https://discuss.elastic.co/u/mmoxam)\ **Replies:** 2\ **Last updated:** [November 1, 2016, 6:41pm UTC](https://discuss.elastic.co/t/is-it-possible-to-run-elastic-on-1-gb-of-ram-for-testing-purposes/64594 "2016-11-01T18:41:18Z")
I have a dev box with low memory and so far I've been unable to start elastic search. Is there a way to lower the heap memory required and still be functional for dev purposes? --- ## [How to convert Apache timestamp(HTTPDATE) to ISO8601 format log](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146)
**Author:** [@yokawasa](https://discuss.elastic.co/u/yokawasa)\ **Replies:** 6\ **Last updated:** [April 25, 2017, 10:12am UTC](https://discuss.elastic.co/t/how-to-convert-apache-timestamp-httpdate-to-iso8601-format-log/83146 "2017-04-25T10:12:04Z")
Hi experts, Currently I'm forwarding apache access log to output target with the configuration, and I'd like to convert current timestamp which is Apache timestamp format (HTTPDATE) to ISO8601 format and add it to out… --- ## [Elasticsearch "failed to send ping" error](https://discuss.elastic.co/t/elasticsearch-failed-to-send-ping-error/55125)
**Author:** [@jsmith](https://discuss.elastic.co/u/jsmith)\ **Replies:** 7\ **Last updated:** [July 11, 2016, 7:48pm UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-send-ping-error/55125 "2016-07-11T19:48:55Z")
I am trying to create an Elasticsearch cluster in AWS (without success). Currently on two nodes I have the yml files below. When I run "curl status" on the second node ( where master is false and data is true) the m… --- ## [Multiline pattern on basis of timestamp](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162)
**Author:** [@Suresh\_Pal](https://discuss.elastic.co/u/Suresh_Pal)\ **Replies:** 5\ **Last updated:** [July 3, 2018, 8:47am UTC](https://discuss.elastic.co/t/multiline-pattern-on-basis-of-timestamp/138162 "2018-07-03T08:47:11Z")
I'm trying to implement multiline pattern on the basis of timestamp. My grok pattern in logstash are as follows: match =\> { "message" =\> "(?m)%{TIMESTAMP\_ISO8601:timestamp}\\s\*-\\s\*%{LOGLEVEL\_TEST:level}\\s\*-\\s\*%{GREEDYD… --- ## [Create Visualization on Dashboard (Filtering) and Save](https://discuss.elastic.co/t/create-visualization-on-dashboard-filtering-and-save/64710)
**Author:** [@TWalter](https://discuss.elastic.co/u/TWalter)\ **Replies:** 6\ **Last updated:** [November 8, 2016, 11:53pm UTC](https://discuss.elastic.co/t/create-visualization-on-dashboard-filtering-and-save/64710 "2016-11-08T23:53:44Z")
Hello there, if i have a Master-Dashboard with a lot of datatables and i filter the data step by step. Finally i get a Line Chart with the clicked filters. With this workaround, you don't have to write the filter by… --- ## [Failed to create shard, failure IOException\[failed to obtain in-memory shard lock\]](https://discuss.elastic.co/t/failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/236973)
**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Replies:** 4\ **Last updated:** [June 14, 2020, 7:50am UTC](https://discuss.elastic.co/t/failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/236973 "2020-06-14T07:50:03Z")
We just rebuilt our cluster and are running into a problem we have not had before. We see almost constant relocating. During this process, we will eventually (every couple hours) run into a node or two stuck in Uninitial… --- ## [How to use case\_insensitive option in DSL Terms Query](https://discuss.elastic.co/t/how-to-use-case-insensitive-option-in-dsl-terms-query/267371)
**Author:** [@Sangeetha-Murugesan](https://discuss.elastic.co/u/Sangeetha-Murugesan)\ **Replies:** 2\ **Last updated:** [March 18, 2021, 4:42am UTC](https://discuss.elastic.co/t/how-to-use-case-insensitive-option-in-dsl-terms-query/267371 "2021-03-18T04:42:50Z")
In elastic we have Term and Terms level query .Term will be used for matching the field with exact value whereas Terms query is an equivalent to SQL IN Clause operation and tried to implement like: Term Query: { "q… --- ## [Filebeat : how to exclude lines](https://discuss.elastic.co/t/filebeat-how-to-exclude-lines/282306)
**Author:** [@thomas7467](https://discuss.elastic.co/u/thomas7467)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 2:17pm UTC](https://discuss.elastic.co/t/filebeat-how-to-exclude-lines/282306 "2021-09-07T14:17:55Z")
Hi, Using ELK 7.14.0 release. I'm trying to excludes lines from IIS access log files. I've tried several methods but It still will not work. I've done that previously with logstash, but I prefer use a simplified archi… --- ## [Add a tag if a field exists](https://discuss.elastic.co/t/add-a-tag-if-a-field-exists/97634)
**Author:** [@Bitdog](https://discuss.elastic.co/u/Bitdog)\ **Replies:** 3\ **Last updated:** [August 24, 2017, 11:46am UTC](https://discuss.elastic.co/t/add-a-tag-if-a-field-exists/97634 "2017-08-24T11:46:26Z")
I’ve been working with Logstash for about 6 weeks. Trying to tag a message based on a field. When the grok match fails I get a \_grokparsefailure tag. Here is the add\_tag section and the entire filter below. When I ne… --- ## [Getting the error - Request cannot be executed; I/O reactor status: STOPPED](https://discuss.elastic.co/t/getting-the-error-request-cannot-be-executed-i-o-reactor-status-stopped/223702)
**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\ **Replies:** 5\ **Last updated:** [March 26, 2020, 4:38pm UTC](https://discuss.elastic.co/t/getting-the-error-request-cannot-be-executed-i-o-reactor-status-stopped/223702 "2020-03-26T16:38:44Z")
We are getting the below error when we are trying to do a getById call using high level rest client. We are using elasticsearch version 7.5.0. java.lang.RuntimeException: Request cannot be executed; I/O reactor status: … --- ## [GREEDYDATA and newlines](https://discuss.elastic.co/t/greedydata-and-newlines/45268)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 6\ **Last updated:** [March 24, 2016, 12:50pm UTC](https://discuss.elastic.co/t/greedydata-and-newlines/45268 "2016-03-24T12:50:40Z")
I have a log file from a java program coming from filebeat. Some of the events have stacktraces and so are multiline. I'm using the multiline option in filebeat and a grok filter in logstash to parse the event. Everythin… --- ## [Logstash port 5044 problem not listening!](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396)
**Author:** [@analistajeff](https://discuss.elastic.co/u/analistajeff)\ **Replies:** 4\ **Last updated:** [April 10, 2018, 9:52pm UTC](https://discuss.elastic.co/t/logstash-port-5044-problem-not-listening/127396 "2018-04-10T21:52:16Z")
logstash port 5044 not binding, i tried to change port to 9066 in my client everything looks ok !! 2018-04-09T19:07:06.934-0300 DEBUG \[prospector\] log/prospector.go:168 Prospector states cleaned up. Before: 1, … --- ## [How to add filter in Timelion?](https://discuss.elastic.co/t/how-to-add-filter-in-timelion/106815)
**Author:** [@Telstra\_Aus](https://discuss.elastic.co/u/Telstra_Aus)\ **Replies:** 1\ **Last updated:** [November 8, 2017, 1:58pm UTC](https://discuss.elastic.co/t/how-to-add-filter-in-timelion/106815 "2017-11-08T13:58:43Z")
Hi, I have a field 'source' in my elasticsearch(please refer the below image) and i want to use the values in source field to add filter in my timelion grapg \[Source\] Timelion expression .es(index=server-\*, q='com.cl… --- ## [Setting up HTTPS for Elasticsearch 7.1](https://discuss.elastic.co/t/setting-up-https-for-elasticsearch-7-1/181913)
**Author:** [@Krushna\_Bagde](https://discuss.elastic.co/u/Krushna_Bagde)\ **Replies:** 6\ **Last updated:** [May 24, 2019, 6:46am UTC](https://discuss.elastic.co/t/setting-up-https-for-elasticsearch-7-1/181913 "2019-05-24T06:46:19Z")
Hello, It looks like the basic elastic license allows encrypted communications as listed here - https://www.elastic.co/subscriptions but the documentation says security is only available as a part of x-pack (https://www… --- ## [Excluding multiple documents from query](https://discuss.elastic.co/t/excluding-multiple-documents-from-query/15556)
**Author:** [@bruskie24](https://discuss.elastic.co/u/bruskie24)\ **Replies:** 3\ **Last updated:** [February 3, 2014, 3:57pm UTC](https://discuss.elastic.co/t/excluding-multiple-documents-from-query/15556 "2014-02-03T15:57:14Z")
I'm trying to use a Boolean query to exclude multiple documents from my result set using the must\_not operator, when I specify a single \_id using the term facet, it works just fine, but when I try more than one \_id w… --- ## [Unable to login to localhost:9200](https://discuss.elastic.co/t/unable-to-login-to-localhost-9200/300416)
**Author:** [@csreddy.ennam](https://discuss.elastic.co/u/csreddy.ennam)\ **Replies:** 7\ **Last updated:** [July 6, 2022, 7:08am UTC](https://discuss.elastic.co/t/unable-to-login-to-localhost-9200/300416 "2022-07-06T07:08:09Z")
we were using Elasticsearch from more than 2 years, now we are unable to open localhost:9200 (latest version: Using Elasticsearch 8.1.0 ) --- ## [\[doc\]\[xxxxx\], source\[n/a, actual length: \[5.1kb\], max length: 2kb\]}\]](https://discuss.elastic.co/t/doc-xxxxx-source-n-a-actual-length-5-1kb-max-length-2kb/130421)
**Author:** [@liweigao](https://discuss.elastic.co/u/liweigao)\ **Replies:** 2\ **Last updated:** [May 4, 2018, 2:32am UTC](https://discuss.elastic.co/t/doc-xxxxx-source-n-a-actual-length-5-1kb-max-length-2kb/130421 "2018-05-04T02:32:21Z")
Hello Everyone, I have a trouble. This is my logs \[2018-05-03T16:47:04,105\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[sc\_cms\_api-2018.05.03\]\[4\] failed to execute bulk item (index) BulkShardRequest \[\[sc\_cms\_api-2018.05.… --- ## [Indexing very large document in ES](https://discuss.elastic.co/t/indexing-very-large-document-in-es/12890)
**Author:** [@shgeorge](https://discuss.elastic.co/u/shgeorge)\ **Replies:** 5\ **Last updated:** [September 8, 2014, 5:15pm UTC](https://discuss.elastic.co/t/indexing-very-large-document-in-es/12890 "2014-09-08T17:15:46Z")
Hi ES team I am facing issues indexing large documents (~ 35 MB). Is there any size limitation to the documents that we index? We are using nested type and nested query and it is working fine for smaller documents.… --- ## [ElasticSearch status is yellow (Unassigned Shards)](https://discuss.elastic.co/t/elasticsearch-status-is-yellow-unassigned-shards/27663)
**Author:** [@Aditya\_Patel](https://discuss.elastic.co/u/Aditya_Patel)\ **Replies:** 8\ **Last updated:** [August 20, 2015, 7:20am UTC](https://discuss.elastic.co/t/elasticsearch-status-is-yellow-unassigned-shards/27663 "2015-08-20T07:20:39Z")
Hi My current Elasticsearch on querying for cluster health is "yellow" curl 'localhost:9200/\_cluster/health?pretty' { "cluster\_name" : "elasticsearch", "status" : "yellow", "timed\_out" : false, "number\_of\_nodes… --- ## [How to convert a json field to string](https://discuss.elastic.co/t/how-to-convert-a-json-field-to-string/49898)
**Author:** [@changxy](https://discuss.elastic.co/u/changxy)\ **Replies:** 2\ **Last updated:** [May 23, 2016, 3:12am UTC](https://discuss.elastic.co/t/how-to-convert-a-json-field-to-string/49898 "2016-05-23T03:12:37Z")
my log (json) content is： {"release\_time": "1998-01-01", "home\_url": "http://www.777.com/show\_page/id\_001.html", "isVip": "", "channel": "777"} {"release\_time": "2009", "home\_url": "http://www.666.com/show\_page/i… --- ## [java.lang.NoClassDefFoundError: org/elasticsearch/index/query/QueryBuilder](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-index-query-querybuilder/191311)
**Author:** [@kalyanikolimali93](https://discuss.elastic.co/u/kalyanikolimali93)\ **Replies:** 6\ **Last updated:** [July 22, 2019, 5:10am UTC](https://discuss.elastic.co/t/java-lang-noclassdeffounderror-org-elasticsearch-index-query-querybuilder/191311 "2019-07-22T05:10:33Z")
Hi Sir, I am Kalyani Naidu, Working as an IT Professional in India. I am facing a problem java.lang.ClassNotFoundException: org.elasticsearch.index.query.QueryBuilder --- It is happening when an trying to build a cu… --- ## [Retrieving all log events sorted by timestamp](https://discuss.elastic.co/t/retrieving-all-log-events-sorted-by-timestamp/173932)
**Author:** [@oskargranlund](https://discuss.elastic.co/u/oskargranlund)\ **Replies:** 5\ **Last updated:** [April 2, 2019, 12:20pm UTC](https://discuss.elastic.co/t/retrieving-all-log-events-sorted-by-timestamp/173932 "2019-04-02T12:20:27Z")
I'm trying to retrieve all log events from an index by using python elasticsearch interface. Currently I use this line of code in order to execute the query: scan(es, index="filebeat-2019.03.19", scroll="2m", query={"q… --- ## [Return \_version with query hits](https://discuss.elastic.co/t/return--version-with-query-hits/10316)
**Author:** [@Jilles\_van\_Gurp](https://discuss.elastic.co/u/Jilles_van_Gurp)\ **Replies:** 3\ **Last updated:** [January 14, 2013, 10:41pm UTC](https://discuss.elastic.co/t/return--version-with-query-hits/10316 "2013-01-14T22:41:31Z")
I'm using the \_version attribute to ensure a put to particular document id only succeeds if the correct version is specified This works great except I don't seem to be able to get elasticsearch to return the correct … --- ## [Model bounds are not available](https://discuss.elastic.co/t/model-bounds-are-not-available/132529)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 2\ **Last updated:** [May 21, 2018, 6:50am UTC](https://discuss.elastic.co/t/model-bounds-are-not-available/132529 "2018-05-21T06:50:41Z")
Hello, Why model bounds is not available? I cannot figure out the reason and the documentation does not mention this case \[image\] --- ## [Slow scrolling speed](https://discuss.elastic.co/t/slow-scrolling-speed/8088)
**Author:** [@andym](https://discuss.elastic.co/u/andym)\ **Replies:** 8\ **Last updated:** [June 19, 2012, 6:01pm UTC](https://discuss.elastic.co/t/slow-scrolling-speed/8088 "2012-06-19T18:01:14Z")
Hi I am trying to copy data from one cluster to another -- using scroll api to get scroll\_id (/\_search?search\_type=scan&scroll=10m&size=ABC) and then search-scroll (/\_search/scroll?scroll=10m&scroll\_id=XYZ) API t… --- ## [Logstash mutate - rename field that occurs as an array](https://discuss.elastic.co/t/logstash-mutate-rename-field-that-occurs-as-an-array/50096)
**Author:** [@lpiera](https://discuss.elastic.co/u/lpiera)\ **Replies:** 5\ **Last updated:** [May 18, 2016, 5:57am UTC](https://discuss.elastic.co/t/logstash-mutate-rename-field-that-occurs-as-an-array/50096 "2016-05-18T05:57:31Z")
Hi, I'm trying to rename a field within an Elasticsearch type using the mutate filter. This particular field occurs within a zero-to-many array. Here is a mapping that closely resembles mine (the names have been change… --- ## [Kibana 4 - Map with Country Codes](https://discuss.elastic.co/t/kibana-4-map-with-country-codes/40140)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 3\ **Last updated:** [April 21, 2016, 2:14pm UTC](https://discuss.elastic.co/t/kibana-4-map-with-country-codes/40140 "2016-04-21T14:14:57Z")
Hello, My data doesn't contain the IP of the client but only a country code. How can I make a geohash with the country code? Thank you! --- ## [Trend Micro: Control Manager, Deep Security, Deep Discovery Inspector](https://discuss.elastic.co/t/trend-micro-control-manager-deep-security-deep-discovery-inspector/116940)
**Author:** [@GlennH](https://discuss.elastic.co/u/GlennH)\ **Replies:** 1\ **Last updated:** [February 9, 2018, 9:42pm UTC](https://discuss.elastic.co/t/trend-micro-control-manager-deep-security-deep-discovery-inspector/116940 "2018-02-09T21:42:34Z")
Im a bit new to elastic and spend too much time trying to figure out how to configure these so figured I would share so someone can either show me a better way or use this and save some time. FYI this thing still needs w… --- ## [Matching two fields with the same value across two indices](https://discuss.elastic.co/t/matching-two-fields-with-the-same-value-across-two-indices/101828)
**Author:** [@cuttlefishjones](https://discuss.elastic.co/u/cuttlefishjones)\ **Replies:** 7\ **Last updated:** [December 29, 2017, 6:58am UTC](https://discuss.elastic.co/t/matching-two-fields-with-the-same-value-across-two-indices/101828 "2017-12-29T06:58:19Z")
Hi, I'm trying to do a simple match of two fields from two indices but I'm not having much luck. So I've got two indices A and B and two fields with different names but the same values. How do I return all results from … --- ## [Missing Index 404](https://discuss.elastic.co/t/missing-index-404/34795)
**Author:** [@rabeetwaqar](https://discuss.elastic.co/u/rabeetwaqar)\ **Replies:** 4\ **Last updated:** [November 20, 2015, 6:44am UTC](https://discuss.elastic.co/t/missing-index-404/34795 "2015-11-20T06:44:42Z")
Hi, I'm facing this issue when i updated ES to 2.0.0. I updated my ES PHP client to ~2.0. Initializing client like this : $logger = ClientBuilder::defaultLogger(DIR.'/es.log', Logger::INFO); $params = array( … --- ## [Filter by empty or non-existing field](https://discuss.elastic.co/t/filter-by-empty-or-non-existing-field/69795)
**Author:** [@enp](https://discuss.elastic.co/u/enp)\ **Replies:** 1\ **Last updated:** [December 22, 2016, 2:29pm UTC](https://discuss.elastic.co/t/filter-by-empty-or-non-existing-field/69795 "2016-12-22T14:29:33Z")
Hi, Is it possible to not show documents in which some fileld is not exists or equal empty string? I can't find how to do this via query string - https://www.elastic.co/guide/en/elasticsearch/reference/current/query-ds… --- ## [How to specify Field weights](https://discuss.elastic.co/t/how-to-specify-field-weights/5279)
**Author:** [@Raul\_Jr\_Martinez](https://discuss.elastic.co/u/Raul_Jr_Martinez)\ **Replies:** 4\ **Last updated:** [December 2, 2011, 2:17am UTC](https://discuss.elastic.co/t/how-to-specify-field-weights/5279 "2011-12-02T02:17:52Z")
Hello to all, I've been looking into putting weight on a select number of fields for my project. I thought that doing \*fieldname^weight\* would work but it doesn't unfortunately. I know I read somewhere that using … --- ## [ES high CPU usage when idle](https://discuss.elastic.co/t/es-high-cpu-usage-when-idle/87950)
**Author:** [@jmngpt](https://discuss.elastic.co/u/jmngpt)\ **Replies:** 4\ **Last updated:** [June 21, 2017, 3:49pm UTC](https://discuss.elastic.co/t/es-high-cpu-usage-when-idle/87950 "2017-06-21T15:49:13Z")
I have a 220GB read-only index (1node, 1 shard and 0 replicas) on ES2.4 running on EC2 (2CPU, 4GB RAM, 50% free SSD, 3GB heap). Although no queries or indexing are running, I can see almost constant CPU usage around ~2… --- ## [Elasticsearch indices in data folder](https://discuss.elastic.co/t/elasticsearch-indices-in-data-folder/69130)
**Author:** [@Lucifer\_hbp](https://discuss.elastic.co/u/Lucifer_hbp)\ **Replies:** 7\ **Last updated:** [December 15, 2016, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-indices-in-data-folder/69130 "2016-12-15T09:48:28Z")
Hi, It would be great if someone could help!! I am facing following problem with elasticsearch 5.1.1 : I have downloaded elasticsearch 5.1.1 and whenever i am creating any index ,it is getting stored in elasticsearc… --- ## [Kibana show -\> No results found](https://discuss.elastic.co/t/kibana-show-no-results-found/75539)
**Author:** [@Terence\_Chuen](https://discuss.elastic.co/u/Terence_Chuen)\ **Replies:** 3\ **Last updated:** [February 20, 2017, 7:20am UTC](https://discuss.elastic.co/t/kibana-show-no-results-found/75539 "2017-02-20T07:20:49Z")
I install ELK 5.2.1 for test,and I get "No results found" on kibana Discover: I sure logstash and elasticsearch working properly and I have data in elasticsearch: And kibana can get index from elasticsearch: Did… --- ## [Subfield search question, please](https://discuss.elastic.co/t/subfield-search-question-please/11435)
**Author:** [@Tiglath](https://discuss.elastic.co/u/Tiglath)\ **Replies:** 3\ **Last updated:** [April 9, 2013, 6:57am UTC](https://discuss.elastic.co/t/subfield-search-question-please/11435 "2013-04-09T06:57:03Z")
if I index some data like this: { "ip" : "1.1.1.1", "reputation" : { "score : -3, "hacker" : { "name" : "BadB… --- ## [Remove or Hide Kibana and Signal fields in Elastic Security](https://discuss.elastic.co/t/remove-or-hide-kibana-and-signal-fields-in-elastic-security/294804)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 8\ **Last updated:** [January 26, 2022, 6:44pm UTC](https://discuss.elastic.co/t/remove-or-hide-kibana-and-signal-fields-in-elastic-security/294804 "2022-01-26T18:44:45Z")
Version: 7.16.3 Hi, everyone I would like to know whether it is possible to remove or hide Kibana and Signal fields in Elastic Security. When an alert is triggered, you can look over it, here you are a screenshot: I… --- ## [Getting 503 error](https://discuss.elastic.co/t/getting-503-error/73939)
**Author:** [@mywish1](https://discuss.elastic.co/u/mywish1)\ **Replies:** 7\ **Last updated:** [February 5, 2017, 9:52am UTC](https://discuss.elastic.co/t/getting-503-error/73939 "2017-02-05T09:52:17Z")
hi i m running elasticsearch and getting this error when i try to run that getting this error \[root@rr4 ~\]# curl -X GET 'http://localhost:9200' { "status" : 503, "name" : "es-master", "cluster\_name" : "es-tuxfixe… --- ## [Query match with range is not working](https://discuss.elastic.co/t/query-match-with-range-is-not-working/161450)
**Author:** [@nayun\_oh](https://discuss.elastic.co/u/nayun_oh)\ **Replies:** 5\ **Last updated:** [December 21, 2018, 10:00am UTC](https://discuss.elastic.co/t/query-match-with-range-is-not-working/161450 "2018-12-21T10:00:08Z")
I find out that match with range query is not working. When I search data using range query, I can see "ACTION" text in payload field. But when I search data using both range and match, I can see empty result. Than… --- ## [Set custom label feature to blank](https://discuss.elastic.co/t/set-custom-label-feature-to-blank/76759)
**Author:** [@avivc](https://discuss.elastic.co/u/avivc)\ **Replies:** 7\ **Last updated:** [February 28, 2017, 2:06pm UTC](https://discuss.elastic.co/t/set-custom-label-feature-to-blank/76759 "2017-02-28T14:06:39Z")
Continuing the discussion from Hidden field: Hi, Trying to solve in my Kibana the issue from this hidden field (topic) Not sure what this stands for set at the aggregation type level How & where to implement this? … --- ## [Parsing syslog entries](https://discuss.elastic.co/t/parsing-syslog-entries/24653)
**Author:** [@eacoimbra](https://discuss.elastic.co/u/eacoimbra)\ **Replies:** 5\ **Last updated:** [February 7, 2017, 4:05pm UTC](https://discuss.elastic.co/t/parsing-syslog-entries/24653 "2017-02-07T16:05:18Z")
I'm trying to structure my mail logs using the pattern %SYSLOGLINE (https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog). The parse is ok and I'm not getting grokparsefailure, b… [Previous page](https://discuss.elastic.co/top.md?page=318&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=320&per_page=50&period=all)