# Top **URL:** https://discuss.elastic.co/top.md?page=332&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 333 --- ## [Analyzing why ES Node has lots of i-o waits](https://discuss.elastic.co/t/analyzing-why-es-node-has-lots-of-i-o-waits/12645)
**Author:** [@Eran\_Eidinger](https://discuss.elastic.co/u/Eran_Eidinger)\ **Replies:** 6\ **Last updated:** [July 7, 2013, 3:20am UTC](https://discuss.elastic.co/t/analyzing-why-es-node-has-lots-of-i-o-waits/12645 "2013-07-07T03:20:07Z")
My cluster shows a lot of io-waits (about 50%). I do a lot of indexing and reindexing. I'm not terribly bothered with consistency, but more with "eventual" consistency. I can go as long as 5 minutes before data n… --- ## [Error: undefined method \`\[\]' for nil:NilClass in logstash](https://discuss.elastic.co/t/error-undefined-method-for-nil-nilclass-in-logstash/54234)
**Author:** [@hongyuan1306](https://discuss.elastic.co/u/hongyuan1306)\ **Replies:** 5\ **Last updated:** [July 1, 2016, 7:54pm UTC](https://discuss.elastic.co/t/error-undefined-method-for-nil-nilclass-in-logstash/54234 "2016-07-01T19:54:01Z")
With logstash 2.3.3 I encounter the following error with elasticssearch input plugin: Error: undefined method\[\]' for nil:NilClass\` Following is my logstash config file: input { elasticsearch { hosts =\> 'vhost… --- ## [Filebeat to Logstash over SSL](https://discuss.elastic.co/t/filebeat-to-logstash-over-ssl/122735)
**Author:** [@Lazarbeam](https://discuss.elastic.co/u/Lazarbeam)\ **Replies:** 5\ **Last updated:** [March 9, 2018, 7:17am UTC](https://discuss.elastic.co/t/filebeat-to-logstash-over-ssl/122735 "2018-03-09T07:17:35Z")
Team -- We're encountering some issues getting Filebeat to send data to Logstash over SSL. All products are versioned 6.2.2. Filebeat is on a linux machine, and Logstash on Winodws Server. For testing/development purpos… --- ## [How to delete documents older than 10 days - cant use daily indices](https://discuss.elastic.co/t/how-to-delete-documents-older-than-10-days-cant-use-daily-indices/259119)
**Author:** [@Jana\_P](https://discuss.elastic.co/u/Jana_P)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 11:13pm UTC](https://discuss.elastic.co/t/how-to-delete-documents-older-than-10-days-cant-use-daily-indices/259119 "2020-12-18T23:13:14Z")
Hello, I'm trying to figure out how to delete documents older than 10 days. It sounds simple (curator etc.) - but my situation is quite complicated - I have 3 nodes cluster for DEV logs from about 30 environments. So … --- ## [Exclude pattern in pie chart](https://discuss.elastic.co/t/exclude-pattern-in-pie-chart/69736)
**Author:** [@anonymous4](https://discuss.elastic.co/u/anonymous4)\ **Replies:** 1\ **Last updated:** [December 22, 2016, 5:18pm UTC](https://discuss.elastic.co/t/exclude-pattern-in-pie-chart/69736 "2016-12-22T17:18:17Z")
I am trying to exclude some data from the pie chart and using exclude pattern from advanced option but it is not working. Syntax i am using is : -remote\_host : 192\* But it is not working. --- ## [I got received plaintext http traffic on an https channel, closing connection Netty4HttpChannel](https://discuss.elastic.co/t/i-got-received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/302973)
**Author:** [@moazmahmoud\_saad](https://discuss.elastic.co/u/moazmahmoud_saad)\ **Replies:** 1\ **Last updated:** [April 26, 2022, 1:13am UTC](https://discuss.elastic.co/t/i-got-received-plaintext-http-traffic-on-an-https-channel-closing-connection-netty4httpchannel/302973 "2022-04-26T01:13:41Z")
i got this error on Elasticsearch 8.1.3 , how can i solve it i see many solutions but it doesn't work here is the output of the terminal when i go ot "http://localhost:9200/" it shows no data come and on the terminal i … --- ## [Watcher, Transform UTC timestamp on the payload to local time](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/249724)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [September 24, 2020, 6:08am UTC](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/249724 "2020-09-24T06:08:08Z")
In the payload of a watcher I have the timestamp field "@timestamp" : "2020-09-23T23:11:24.359Z", But this field is in UTC, and I want to change it to local time, I have tried the folowing "actions": { "send\_ema… --- ## [GraphQL integration](https://discuss.elastic.co/t/graphql-integration/112102)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 4\ **Last updated:** [December 17, 2017, 12:54pm UTC](https://discuss.elastic.co/t/graphql-integration/112102 "2017-12-17T12:54:32Z")
Now that Facebook has alleviated licensing issues with GraphQL, has there been any talk of integrating the GraphQL protocol as a way to query Elasticsearch? Do you think this might be something a plugin would be able to … --- ## [XML Filter Help Required](https://discuss.elastic.co/t/xml-filter-help-required/1387)
**Author:** [@Shaun\_Wells](https://discuss.elastic.co/u/Shaun_Wells)\ **Replies:** 6\ **Last updated:** [June 4, 2015, 2:12pm UTC](https://discuss.elastic.co/t/xml-filter-help-required/1387 "2015-06-04T14:12:07Z")
Hello All, I'm trying to get my head around the XML Filter, I have the following configuration for my filter. xml { source =\> "message" target =\> "message\_parsed" add\_tag =\> \["xml\_parsed"\] When… --- ## [Compare two fields in a query](https://discuss.elastic.co/t/compare-two-fields-in-a-query/69575)
**Author:** [@stylabs](https://discuss.elastic.co/u/stylabs)\ **Replies:** 3\ **Last updated:** [December 21, 2016, 6:36am UTC](https://discuss.elastic.co/t/compare-two-fields-in-a-query/69575 "2016-12-21T06:36:21Z")
I'm trying to compare two fields and ensure one is greater than other. Something like this: "doc\['key1'\].value \> doc\['key2'\].value" But this isn't working as scripting is disabled with my provider. Is there any other a… --- ## [Invalid NEST response built from a unsuccessful () low level call on POST using .NET Nest](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583)
**Author:** [@bensalerno](https://discuss.elastic.co/u/bensalerno)\ **Replies:** 2\ **Last updated:** [September 21, 2021, 5:16pm UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-post-using-net-nest/284583 "2021-09-21T17:16:47Z")
New to ElasticSearch. I've seen a couple posts with similar titles but didn't seem to apply to me. I'm having trouble querying my ES cluster for the first time. Someone else creaed the cluster and gave me login info. My… --- ## [Failed unmarshalling json: invalid character ':' after array element](https://discuss.elastic.co/t/failed-unmarshalling-json-invalid-character-after-array-element/33566)
**Author:** [@djdance](https://discuss.elastic.co/u/djdance)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 1:59pm UTC](https://discuss.elastic.co/t/failed-unmarshalling-json-invalid-character-after-array-element/33566 "2015-11-03T13:59:10Z")
getting subject error. how do I resolve it ? { "network": { "servers": \[localhost:5043" \], "timeout": 15 }, "files": \[ "paths:" \[ "/data/logs/cog\*.log" \], "fields": \[ "type": … --- ## [Logstash Jdbc input not updating last run](https://discuss.elastic.co/t/logstash-jdbc-input-not-updating-last-run/115108)
**Author:** [@karthik\_s1](https://discuss.elastic.co/u/karthik_s1)\ **Replies:** 6\ **Last updated:** [January 16, 2018, 6:22am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-not-updating-last-run/115108 "2018-01-16T06:22:51Z")
Hi, We are pulling data from mysql and pushing to elasticsearch through logstash. Following is the configuration for jdbc input: jdbc\_driver\_library =\> '/home/software/mysql-connector-java-5.1.42/mysql-connector-java-… --- ## [Logstash Configuration Error (Failed to execute action)](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action/131475)
**Author:** [@NotPete](https://discuss.elastic.co/u/NotPete)\ **Replies:** 3\ **Last updated:** [May 15, 2018, 2:31pm UTC](https://discuss.elastic.co/t/logstash-configuration-error-failed-to-execute-action/131475 "2018-05-15T14:31:53Z")
Hi, I am literally 2 days old with ELK Stack and I know I have missed something. I'm running version 6.2.4 on RHEL 7.4. I'm getting the following error looping in /var/log/logstash/logstash-plain.log: \[2018-05-11T07:… --- ## [Sorting Parent Documents by nested inner hits](https://discuss.elastic.co/t/sorting-parent-documents-by-nested-inner-hits/96137)
**Author:** [@BLZB0B](https://discuss.elastic.co/u/BLZB0B)\ **Replies:** 7\ **Last updated:** [August 11, 2017, 2:54pm UTC](https://discuss.elastic.co/t/sorting-parent-documents-by-nested-inner-hits/96137 "2017-08-11T14:54:37Z")
Hi, We have a set of documents that need sorting when querying. sorting at the nested level seems to be ok, but we need to sort by a field on a nested object within another nested object and can’t for the life of us wo… --- ## [Reindexing is slow process](https://discuss.elastic.co/t/reindexing-is-slow-process/281766)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 6\ **Last updated:** [September 14, 2021, 6:33am UTC](https://discuss.elastic.co/t/reindexing-is-slow-process/281766 "2021-09-14T06:33:43Z")
Running ELK stack 7.13.2 Reindexing is a slow process it takes one day or more than one day. we have 10 indices of 101.4gb reindexing this size of data is costlier even though we close the logstash but nothing happened… --- ## [How to return only matched texts in Elasticsearch aggregation and in source too](https://discuss.elastic.co/t/how-to-return-only-matched-texts-in-elasticsearch-aggregation-and-in-source-too/38774)
**Author:** [@jayphate](https://discuss.elastic.co/u/jayphate)\ **Replies:** 4\ **Last updated:** [January 18, 2016, 5:54am UTC](https://discuss.elastic.co/t/how-to-return-only-matched-texts-in-elasticsearch-aggregation-and-in-source-too/38774 "2016-01-18T05:54:20Z")
My query : POST /testqueryidx/testQuery/\_search { "size" : 10, "query" : { "bool" : { "must" : \[ { "multi\_match": { "query": "sales\*", "fields": \["skills"\] } }, { … --- ## [Octagon Analytics - Native iOS App - Kibana](https://discuss.elastic.co/t/octagon-analytics-native-ios-app-kibana/250889)
**Author:** [@octagon.mobile](https://discuss.elastic.co/u/octagon.mobile)\ **Replies:** 1\ **Last updated:** [October 25, 2020, 4:00pm UTC](https://discuss.elastic.co/t/octagon-analytics-native-ios-app-kibana/250889 "2020-10-25T16:00:22Z")
Octagon Analytics - Kibana iOS App. Visualizer for Kibana Dashboards. Supported Features: Login Dashboards Canvas Timeline Video Officially Supported Kibana Version's: 7.3.2 6.5.4 Configuration: … --- ## [Kibana traffic light](https://discuss.elastic.co/t/kibana-traffic-light/130425)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 6:18pm UTC](https://discuss.elastic.co/t/kibana-traffic-light/130425 "2018-05-03T18:18:14Z")
Hi everyone, I'm trying to create a traffic light display on Kibana. I found a project on Github ( Link ), however I would like to know if there is a way to do it without installing it. For instance, if we have a switch … --- ## [Kibana dashboard multiple wildcard filters](https://discuss.elastic.co/t/kibana-dashboard-multiple-wildcard-filters/112530)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 4\ **Last updated:** [December 22, 2017, 3:39pm UTC](https://discuss.elastic.co/t/kibana-dashboard-multiple-wildcard-filters/112530 "2017-12-22T15:39:31Z")
I want to build a dashboard with filters that check for a list of phrases with wildcards to a kibana dashboard so if any one of these(or multiple) appear in the log field I want it to appear in the dash, if not, the das… --- ## [Use of Indicator Match Rules using Cross Cluster Search](https://discuss.elastic.co/t/use-of-indicator-match-rules-using-cross-cluster-search/323163)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 7\ **Last updated:** [February 7, 2023, 8:44pm UTC](https://discuss.elastic.co/t/use-of-indicator-match-rules-using-cross-cluster-search/323163 "2023-02-07T20:44:02Z")
Hello! We have set up an infrastrucure of SIEM using Elastic Security and we are using multiple elasticsearch clusters distributed in different locations (multiples datacenters) and we have configured CCS (Cross Cluster… --- ## [Unable to find the cluster in the selected time range. HTTP 404](https://discuss.elastic.co/t/unable-to-find-the-cluster-in-the-selected-time-range-http-404/260656)
**Author:** [@Finley](https://discuss.elastic.co/u/Finley)\ **Replies:** 5\ **Last updated:** [January 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/unable-to-find-the-cluster-in-the-selected-time-range-http-404/260656 "2021-01-14T16:40:08Z")
Hello, I have an elastic cluster and i'm trying to setup the stack monitoring. I followed the instructions on these pages : Collect Kibana monitoring data with Metricbeat | Kibana Guide \[8.11\] | Elastic View monitori… --- ## [Logstash.outputs.elasticsearch: Elasticsearch appears to be unreachable or down!](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-elasticsearch-appears-to-be-unreachable-or-down/106473)
**Author:** [@alexhuang](https://discuss.elastic.co/u/alexhuang)\ **Replies:** 2\ **Last updated:** [November 7, 2017, 10:54am UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-elasticsearch-appears-to-be-unreachable-or-down/106473 "2017-11-07T10:54:22Z")
I'm using the latest version of ELK(logstash 5.6.0, elasticsearch 5.6.0), and sometimes i will get the following error message in logstash logfile, but the elasticsearch cluster is really heathly. here is the error mes… --- ## [Greater than based on value from another field](https://discuss.elastic.co/t/greater-than-based-on-value-from-another-field/129089)
**Author:** [@Dave\_Clissold](https://discuss.elastic.co/u/Dave_Clissold)\ **Replies:** 8\ **Last updated:** [April 23, 2018, 10:17pm UTC](https://discuss.elastic.co/t/greater-than-based-on-value-from-another-field/129089 "2018-04-23T22:17:20Z")
Hi, I am trying to build a query that will match when an value of a field is greater than another nested field, but am stuck as to where to begin. Can anyone help or suggest somewhere to begin reading. Example data: { … --- ## [Issues installing / starting ES 2.1.0 when installed from a repository](https://discuss.elastic.co/t/issues-installing-starting-es-2-1-0-when-installed-from-a-repository/36320)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 5\ **Last updated:** [September 9, 2016, 6:22pm UTC](https://discuss.elastic.co/t/issues-installing-starting-es-2-1-0-when-installed-from-a-repository/36320 "2016-09-09T18:22:52Z")
Is anyone else having issues getting a fresh install of 2.1.0 when installed repository? It is as though all the paths are screwed up. I get this when I try to start it: ElasticsearchException\[Failed to load logging c… --- ## [\[geoip.location is not of type geo\_point\] Index pattern does not contain any of the following field types: geo\_point](https://discuss.elastic.co/t/geoip-location-is-not-of-type-geo-point-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/95536)
**Author:** [@Kshitij\_Karthick](https://discuss.elastic.co/u/Kshitij_Karthick)\ **Replies:** 3\ **Last updated:** [August 3, 2017, 5:51am UTC](https://discuss.elastic.co/t/geoip-location-is-not-of-type-geo-point-index-pattern-does-not-contain-any-of-the-following-field-types-geo-point/95536 "2017-08-03T05:51:41Z")
Problem I am not able to plot any coordinate map as index pattern does not contain any of the following field types: geo\_point. Upon further investigating the index pattern - the geoip.location has properties \[loc, lat\]… --- ## [How to determine when dissect fails and branch to try a different dissect clause?](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824)
**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\ **Replies:** 4\ **Last updated:** [December 13, 2018, 3:58pm UTC](https://discuss.elastic.co/t/how-to-determine-when-dissect-fails-and-branch-to-try-a-different-dissect-clause/159824 "2018-12-13T15:58:32Z")
When a dissect clause pattern fails to match the message in hand, it would be nice to try another. This arises in the case where the distinction between log entries cannot be discriminated via any available condition. I… --- ## [Elasticsearch bulk upload error with PHP - Limit of total fields \[1000\] in index has been exceeded](https://discuss.elastic.co/t/elasticsearch-bulk-upload-error-with-php-limit-of-total-fields-1000-in-index-has-been-exceeded/67427)
**Author:** [@Suresh\_Kumar\_Majhi](https://discuss.elastic.co/u/Suresh_Kumar_Majhi)\ **Replies:** 4\ **Last updated:** [November 29, 2016, 7:18am UTC](https://discuss.elastic.co/t/elasticsearch-bulk-upload-error-with-php-limit-of-total-fields-1000-in-index-has-been-exceeded/67427 "2016-11-29T07:18:36Z")
Hi, We are planning use ElasticSearch in one of our projects. Currently, we are testing ElasticSearch 5.0.1 with our data. One issue we are facing is when we are doing a bulk upload from our MySQL tables to elasticsearch… --- ## [Compress output from logstash](https://discuss.elastic.co/t/compress-output-from-logstash/121104)
**Author:** [@yofa](https://discuss.elastic.co/u/yofa)\ **Replies:** 6\ **Last updated:** [February 23, 2018, 11:53am UTC](https://discuss.elastic.co/t/compress-output-from-logstash/121104 "2018-02-23T11:53:36Z")
Greetings, I'm new to ELK and all the stuff. I've been reading the documentation to have a better understanding of elastic's products and, as far I've seen, couldn't find a solution for the case below: I'm trying to re… --- ## ["json\_error": "Error decoding JSON: invalid character 'S' looking for beginning of value](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 1\ **Last updated:** [July 5, 2019, 10:20pm UTC](https://discuss.elastic.co/t/json-error-error-decoding-json-invalid-character-s-looking-for-beginning-of-value/189124 "2019-07-05T22:20:01Z")
Hello Currently getting the error json\_error": "Error decoding JSON: invalid character 'S' looking for beginning of value Full error "input\_type": "log", "json\_error": "Error decoding JSON: invalid characte… --- ## [Formatting Windows DNS logs](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231)
**Author:** [@Dave\_Foster](https://discuss.elastic.co/u/Dave_Foster)\ **Replies:** 4\ **Last updated:** [April 5, 2016, 1:07am UTC](https://discuss.elastic.co/t/formatting-windows-dns-logs/46231 "2016-04-05T01:07:06Z")
I'm successfully using filebeat to ship DNS debug logs from our Windows DC servers to elk. I've finally figured out turning off 'analyzed' on the domain name field so that the name isn't broken into chunks (ie Microsof… --- ## [Grok filter for log4j logs inorder to parse messages from logs](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700)
**Author:** [@ritika](https://discuss.elastic.co/u/ritika)\ **Replies:** 4\ **Last updated:** [January 25, 2017, 7:16pm UTC](https://discuss.elastic.co/t/grok-filter-for-log4j-logs-inorder-to-parse-messages-from-logs/72700 "2017-01-25T19:16:35Z")
Hi, I am completely new to ELK and installed ELK stack on my windows computer. My goal is to read and analyse log files (which are actually log4j files) sitting on different server. I am able make logstash read my fil… --- ## [Auto offset commit failed for group logstash](https://discuss.elastic.co/t/auto-offset-commit-failed-for-group-logstash/72636)
**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 1:15pm UTC](https://discuss.elastic.co/t/auto-offset-commit-failed-for-group-logstash/72636 "2017-01-24T13:15:59Z")
Hi, I have a set-up with Kafka and ELK. In the logstash side, I frequently receive the following warning message. 23:41:29.767 \[Ruby-0-Thread-7: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5… --- ## ["socket hang up"](https://discuss.elastic.co/t/socket-hang-up/87763)
**Author:** [@hailaeos.troy](https://discuss.elastic.co/u/hailaeos.troy)\ **Replies:** 4\ **Last updated:** [June 2, 2017, 2:14pm UTC](https://discuss.elastic.co/t/socket-hang-up/87763 "2017-06-02T14:14:59Z")
Hi all getting some strange timeouts. I have serveral kibana instances. When I go to the management tab and refresh the fields I the the following logs messages {"type":"response","@timestamp":"2017-05-31T14:17:04Z","t… --- ## [Cannot downgrade a node from version \[7.3.0\] to version \[7.2.0\]](https://discuss.elastic.co/t/cannot-downgrade-a-node-from-version-7-3-0-to-version-7-2-0/196241)
**Author:** [@valentine-dev](https://discuss.elastic.co/u/valentine-dev)\ **Replies:** 2\ **Last updated:** [August 26, 2019, 5:30pm UTC](https://discuss.elastic.co/t/cannot-downgrade-a-node-from-version-7-3-0-to-version-7-2-0/196241 "2019-08-26T17:30:06Z")
I have such error when trying different configuration parameters for ES at GCP: org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: cannot downgrade a node from version \[7.3.0\] to version \[7.2… --- ## [What is the name of a parameter "retry\_on\_conflict" in Bulk Update API](https://discuss.elastic.co/t/what-is-the-name-of-a-parameter-retry-on-conflict-in-bulk-update-api/65185)
**Author:** [@Ilya\_Levin](https://discuss.elastic.co/u/Ilya_Levin)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 10:18am UTC](https://discuss.elastic.co/t/what-is-the-name-of-a-parameter-retry-on-conflict-in-bulk-update-api/65185 "2016-11-07T10:18:30Z")
I'm performing a bulk update with parameter "retry\_on\_conflict". In a documentation about Update API and Bulk Update and found a different naming of the same parameter. talking about "\_retry\_on\_conflict" requires … --- ## [Odd Number of master nodes](https://discuss.elastic.co/t/odd-number-of-master-nodes/229396)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 2\ **Last updated:** [April 23, 2020, 10:52am UTC](https://discuss.elastic.co/t/odd-number-of-master-nodes/229396 "2020-04-23T10:52:48Z")
I was informed to use odd number of nodes to avoid split brain problem and also voting of master node is easy if the odd number of master nodes is configured. However, say the cluster is configured with 5 nodes and one … --- ## [Ruby filter for parsing deeply nested JSON in pipeline](https://discuss.elastic.co/t/ruby-filter-for-parsing-deeply-nested-json-in-pipeline/161050)
**Author:** [@Chris\_Lyons](https://discuss.elastic.co/u/Chris_Lyons)\ **Replies:** 5\ **Last updated:** [January 14, 2019, 2:30pm UTC](https://discuss.elastic.co/t/ruby-filter-for-parsing-deeply-nested-json-in-pipeline/161050 "2019-01-14T14:30:27Z")
We use Logstash extensively within my team as our ETL engine. Things started out simple enough with log file data, but we are at a point where our primary use case is centered around Business Intelligence. All our Inci… --- ## [How to pass the MAX\_OPEN\_FILES argument to JVM?](https://discuss.elastic.co/t/how-to-pass-the-max-open-files-argument-to-jvm/31807)
**Author:** [@terrasacer](https://discuss.elastic.co/u/terrasacer)\ **Replies:** 7\ **Last updated:** [October 8, 2015, 7:13pm UTC](https://discuss.elastic.co/t/how-to-pass-the-max-open-files-argument-to-jvm/31807 "2015-10-08T19:13:15Z")
Hi there, I'm trying to pass MAX\_OPEN\_FILES parameter to JVM. Actually, I am trying to increase fd on mac os x. I made it with launchctl command but the default behavior is to set the limit value by JVM, which is 102… --- ## [X-Pack Monitoring screen error after ES upgrade](https://discuss.elastic.co/t/x-pack-monitoring-screen-error-after-es-upgrade/93602)
**Author:** [@Lean](https://discuss.elastic.co/u/Lean)\ **Replies:** 7\ **Last updated:** [July 31, 2017, 3:57pm UTC](https://discuss.elastic.co/t/x-pack-monitoring-screen-error-after-es-upgrade/93602 "2017-07-31T15:57:08Z")
Hello all, I upgraded from previous (5.4.1) to latest release in order to be able to use .keyword fields in building a new advanced job in machine learning. Since the upgrade, cluster monitoring screens give "Error 404… --- ## [Is it possible to put dots on lines in Timelion?](https://discuss.elastic.co/t/is-it-possible-to-put-dots-on-lines-in-timelion/83675)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [April 26, 2017, 10:46am UTC](https://discuss.elastic.co/t/is-it-possible-to-put-dots-on-lines-in-timelion/83675 "2017-04-26T10:46:30Z")
Hi, I am using ELK GA 5.0.0. I am trying to plot a line in Timelion, with dots on it, I tried below, but it shows only dots, and not lines; .points(radius=4, weight=0, fill=5).lines(width=2).color(#F00) I am trying … --- ## [What's the difference between terms and term(with bool should)?](https://discuss.elastic.co/t/whats-the-difference-between-terms-and-term-with-bool-should/285186)
**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 8:50am UTC](https://discuss.elastic.co/t/whats-the-difference-between-terms-and-term-with-bool-should/285186 "2021-09-28T08:50:24Z")
I've always wondered, for example, about the following statements. A: { "bool": { "should": \[ { "term": { "userType": { "value": 0 } } }, { "term": { "userType": { "value": 1 } } }, { "term": { "use… --- ## [Elasticsearch内のデータの結合について](https://discuss.elastic.co/t/elasticsearch/175429)
**Author:** [@iasenust](https://discuss.elastic.co/u/iasenust)\ **Replies:** 7\ **Last updated:** [April 23, 2019, 12:34am UTC](https://discuss.elastic.co/t/elasticsearch/175429 "2019-04-23T00:34:06Z")
初心者の者です。 Aというログには、「コマンドID、コマンド名」Bというログには、「コマンドID、コマンド応答」が多数記載されています。 それぞれのログをlogstashから取り込んで、「コマンドID、コマンド名、コマンド応答」 というドキュメントにしたい場合、どのようにすればよいのでしょうか？ ログを取り込む前に、kibanaのdevtoolsに何か設定しておいてうまくできるのでしょうか？ 基本的なことで申し訳ありませんがご… --- ## [Drop event](https://discuss.elastic.co/t/drop-event/127328)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 7\ **Last updated:** [April 11, 2018, 8:25am UTC](https://discuss.elastic.co/t/drop-event/127328 "2018-04-11T08:25:24Z")
I would like to drop particular events from a log message that coming from a socket input. How can I do this? --- ## [How to get Number type by using Grok](https://discuss.elastic.co/t/how-to-get-number-type-by-using-grok/150084)
**Author:** [@saad](https://discuss.elastic.co/u/saad)\ **Replies:** 3\ **Last updated:** [September 27, 2018, 3:36pm UTC](https://discuss.elastic.co/t/how-to-get-number-type-by-using-grok/150084 "2018-09-27T15:36:32Z")
Hi, I have this field below and I want to use grok to get the number 427 at the end and add it to new field as type number I did the following grok { match =\> { "name" =\> "%{GREEDYDATA}device: %{NUMBER:concurrent… --- ## [How to put Horizontal line in kibana visualization? put static threshold line?](https://discuss.elastic.co/t/how-to-put-horizontal-line-in-kibana-visualization-put-static-threshold-line/82737)
**Author:** [@FardinBehboudi](https://discuss.elastic.co/u/FardinBehboudi)\ **Replies:** 5\ **Last updated:** [April 21, 2017, 9:15am UTC](https://discuss.elastic.co/t/how-to-put-horizontal-line-in-kibana-visualization-put-static-threshold-line/82737 "2017-04-21T09:15:47Z")
hi i am using kibana 5.2, how can i add static Horizontal line in kibana visualization. i have a line chart which has Y axis between 0% and 100%. I want to have a threshold line at 95% . how can i build it? i had a sol… --- ## [Open Source vs Basic Licences](https://discuss.elastic.co/t/open-source-vs-basic-licences/189625)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 2\ **Last updated:** [July 10, 2019, 6:24pm UTC](https://discuss.elastic.co/t/open-source-vs-basic-licences/189625 "2019-07-10T18:24:08Z")
On the Subscriptions page, there's a feature comparison. The two free offerings, Open Source and Basic, point to the same downloads page. Therefore, I have no idea which one I got when I downloaded Elasticsearch. Can a… --- ## [Changing palette and default color in Kibana](https://discuss.elastic.co/t/changing-palette-and-default-color-in-kibana/114140)
**Author:** [@Arnaud\_Jaspart](https://discuss.elastic.co/u/Arnaud_Jaspart)\ **Replies:** 5\ **Last updated:** [January 9, 2018, 9:19pm UTC](https://discuss.elastic.co/t/changing-palette-and-default-color-in-kibana/114140 "2018-01-09T21:19:20Z")
Hello, for kibana-6.0.1-linux-x86\_64 We would like to change the palette and the default color in the graphs. We do not mind if we need to update the code everytime we update for the time being. I updated: ./src/ui… --- ## [Elasticsearch 6.2.2 not able to run as root user](https://discuss.elastic.co/t/elasticsearch-6-2-2-not-able-to-run-as-root-user/121703)
**Author:** [@tushar\_raut](https://discuss.elastic.co/u/tushar_raut)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 6:04am UTC](https://discuss.elastic.co/t/elasticsearch-6-2-2-not-able-to-run-as-root-user/121703 "2018-02-28T06:04:23Z")
I have downloaded the tar file elasticsearch-6.2.2.tar.gz and trying to run /bin/elasticsearch but it giving me error as following : \[root@tushar-nginx elasticsearch-6.2.2\]# bin/elasticsearch \[2018-02-27T17:14:42,298\]\[… --- ## [Comparison of data in kibana dashboard](https://discuss.elastic.co/t/comparison-of-data-in-kibana-dashboard/31487)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 5\ **Last updated:** [October 10, 2015, 5:44pm UTC](https://discuss.elastic.co/t/comparison-of-data-in-kibana-dashboard/31487 "2015-10-10T17:44:17Z")
I have a usecase which is as follows. I am counting no of db hits per second in application in kibana. I want to compare the db hits per second of last 15 mins with that of db hits which was 7 days ago in same time. I… [Previous page](https://discuss.elastic.co/top.md?page=331&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=333&per_page=50&period=all)