# Top **URL:** https://discuss.elastic.co/top.md?page=354&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 355 --- ## [Dashboard setup fails: Unable to bulk\_create index-pattern](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 4\ **Last updated:** [December 16, 2021, 9:07am UTC](https://discuss.elastic.co/t/dashboard-setup-fails-unable-to-bulk-create-index-pattern/292007 "2021-12-16T09:07:46Z")
Hello, I have encountered the same problem as the user in this post. I configured metricbeat and filebeat with the kibana\_system user. Should I create a new user that runs as a kibana\_system user and add some rights? W… --- ## [Processors configuration (available\_processors)](https://discuss.elastic.co/t/processors-configuration-available-processors/21274)
**Author:** [@Robin\_Clarke](https://discuss.elastic.co/u/Robin_Clarke)\ **Replies:** 2\ **Last updated:** [December 16, 2014, 11:19am UTC](https://discuss.elastic.co/t/processors-configuration-available-processors/21274 "2014-12-16T11:19:45Z")
I have a machine with 132GB of memory and 32 cores on which I am running two elasticsearch nodes. Each node should have only half the total number of CPU cores available so that both nodes can work at full capacity … --- ## [Have watcher send several emails for payload with several search results](https://discuss.elastic.co/t/have-watcher-send-several-emails-for-payload-with-several-search-results/57887)
**Author:** [@cs1](https://discuss.elastic.co/u/cs1)\ **Replies:** 5\ **Last updated:** [August 23, 2016, 1:59pm UTC](https://discuss.elastic.co/t/have-watcher-send-several-emails-for-payload-with-several-search-results/57887 "2016-08-23T13:59:03Z")
Hi there! Please excuse my newbie question, I've been trying to figure it out using the docs by myself, however, I failed. :confused: I'd like to do this: I have an index which contains alerts. I'm trying to configur… --- ## [Monitoring execution failed](https://discuss.elastic.co/t/monitoring-execution-failed/110956)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 2\ **Last updated:** [December 12, 2017, 4:39am UTC](https://discuss.elastic.co/t/monitoring-execution-failed/110956 "2017-12-12T04:39:16Z")
Hi ALL, my cluster is as follow : \[root@es-data-01 ~\]# curl -u elastic:\*\*\*\*\*\* -XGET http://172.24.69.16:9200/\_cat/nodes 172.24.69.20 33 98 2 0.03 0.06 0.07 m \* es-master-02 172.24.69.13 19 98 0 0.02 0.02 0.… --- ## [Unable to Connect to Elasticsearch 6.1.0 via the javaclient](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-6-1-0-via-the-javaclient/112358)
**Author:** [@pallavJha](https://discuss.elastic.co/u/pallavJha)\ **Replies:** 7\ **Last updated:** [December 25, 2017, 6:57pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-6-1-0-via-the-javaclient/112358 "2017-12-25T18:57:01Z")
I'm able to connect to elastic search 6.1.0 and index, update, delete and query the documents via cURL and plugin head but I'm unable to connect to the same via the java client, i.e, /\*\* \* Elasticsearch \*/… --- ## [Logstash elastichsearch output in case of ES cluster](https://discuss.elastic.co/t/logstash-elastichsearch-output-in-case-of-es-cluster/34782)
**Author:** [@gildor7](https://discuss.elastic.co/u/gildor7)\ **Replies:** 7\ **Last updated:** [July 12, 2016, 9:35am UTC](https://discuss.elastic.co/t/logstash-elastichsearch-output-in-case-of-es-cluster/34782 "2016-07-12T09:35:03Z")
Hello, I have the following situation: - 1 node with Logstash indexer - 3 nodes with Elastichsearch How should I set the output logstash? output { elasticsearch { host =\> "?" cluster =\> "ES-cluster" } } Hav… --- ## [How does Logstash process Configs? Order that is processes input?](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 4\ **Last updated:** [January 28, 2016, 8:05pm UTC](https://discuss.elastic.co/t/how-does-logstash-process-configs-order-that-is-processes-input/40413 "2016-01-28T20:05:36Z")
I have a Syslog tcp input thats my catch all when I cant setup a defined input. Anyway, the input file sets the type as "syslog" tcp { port =\> 5140 type =\> "syslog" } I then have another config file, called 01… --- ## [Filebeat connection reset by peer - new install](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer-new-install/73495)
**Author:** [@Charles\_Holtzkampf](https://discuss.elastic.co/u/Charles_Holtzkampf)\ **Replies:** 8\ **Last updated:** [February 6, 2017, 9:50am UTC](https://discuss.elastic.co/t/filebeat-connection-reset-by-peer-new-install/73495 "2017-02-06T09:50:51Z")
ELK stack versions Logstash: 5.1.2 Kibana: 5.1.2 Elasticsearch:5.1.2 Logstash stack successfully receives syslog events on port 5514, but any filebeat logs send to port 5044 are failing. This has never worked. /var… --- ## [Security Exception with data/write/bulk](https://discuss.elastic.co/t/security-exception-with-data-write-bulk/69696)
**Author:** [@ggp](https://discuss.elastic.co/u/ggp)\ **Replies:** 6\ **Last updated:** [December 23, 2016, 3:54pm UTC](https://discuss.elastic.co/t/security-exception-with-data-write-bulk/69696 "2016-12-23T15:54:45Z")
I am trying to run logstash pipeline and getting below exception 13:10:00.102 \[\[main\]\>worker0\] WARN logstash.outputs.elasticsearch - Failed action. {:status=\>403, :action=\>\["index", {:\_id=\>"notifyuserprofile-webservic… --- ## [How to index XML data](https://discuss.elastic.co/t/how-to-index-xml-data/9226)
**Author:** [@Billy\_Newman](https://discuss.elastic.co/u/Billy_Newman)\ **Replies:** 6\ **Last updated:** [October 6, 2012, 9:56am UTC](https://discuss.elastic.co/t/how-to-index-xml-data/9226 "2012-10-06T09:56:28Z")
Hello again. Does Elasticsearch support pulling xml data from various URLs into an index out of the box, or with a plugin. I.E. given a set or URLs can I have Elasticsearch hit those URLs and index the data that … --- ## [ElasticSearch Node goes down](https://discuss.elastic.co/t/elasticsearch-node-goes-down/188152)
**Author:** [@Sourabh](https://discuss.elastic.co/u/Sourabh)\ **Replies:** 5\ **Last updated:** [June 29, 2019, 7:08pm UTC](https://discuss.elastic.co/t/elasticsearch-node-goes-down/188152 "2019-06-29T19:08:02Z")
I am having a cluster with 5 master nodes,12 coordinator nodes and 60 data nodes .Currently i am doing heavy indexing in this es cluster around 15 billion documents spread through the day.We have 3 index which are under… --- ## [Logstash : error when running](https://discuss.elastic.co/t/logstash-error-when-running/93728)
**Author:** [@marwa](https://discuss.elastic.co/u/marwa)\ **Replies:** 6\ **Last updated:** [July 20, 2017, 10:10am UTC](https://discuss.elastic.co/t/logstash-error-when-running/93728 "2017-07-20T10:10:26Z")
Hello i jaust installed logsatsh-5.5.0 on my server then when i first tryed to run it by the command line bin/logstash -e 'input { stdin { } } output { stdout {} }' many errors appeared 2017-07-19 09:54:23,269 main ERR… --- ## [Elasticsearch v5.0.0: No log4j2 configuration file found](https://discuss.elastic.co/t/elasticsearch-v5-0-0-no-log4j2-configuration-file-found/65476)
**Author:** [@kevinZ](https://discuss.elastic.co/u/kevinZ)\ **Replies:** 3\ **Last updated:** [November 9, 2016, 1:11pm UTC](https://discuss.elastic.co/t/elasticsearch-v5-0-0-no-log4j2-configuration-file-found/65476 "2016-11-09T13:11:59Z")
I'm using elasticsearch(v5.0.0) in java application. Everything is good except the console print an error message: ERROR StatusLogger No log4j2 configuration file found. Using default configuration: logging only erro… --- ## [Kibanaの環境構築が上手くいきません・・・。](https://discuss.elastic.co/t/kibana/2000)
**Author:** [@hase\_gawa](https://discuss.elastic.co/u/hase_gawa)\ **Replies:** 4\ **Last updated:** [May 26, 2016, 5:23am UTC](https://discuss.elastic.co/t/kibana/2000 "2016-05-26T05:23:54Z")
elasticsearchの環境構築が上手く行ったため、kibanaの環境構築も 行ってみました。 kibanaの環境はこちらを真似てやりました。 http://qiita.com/kasaharu/items/b36c3c4fcd3dd969f544 記事ではubuntuになっておりますが、私はcentOSを使っております。 記事通りの手順で構築をし、http://192.168.33.10/kibana/ にアクセスして… --- ## [Split in Timelion](https://discuss.elastic.co/t/split-in-timelion/92204)
**Author:** [@vineetgoel](https://discuss.elastic.co/u/vineetgoel)\ **Replies:** 2\ **Last updated:** [July 8, 2017, 1:53am UTC](https://discuss.elastic.co/t/split-in-timelion/92204 "2017-07-08T01:53:27Z")
Hi, I am trying to use split in Kibana/Timelion. I am not being able to split by term when I use the parameter .es(split:"foo.bar:10"). Note here: foo.bar is a nested field in my document. Is this a known issue? I am no … --- ## [APM RUM Roadmap: Will there be RUM for Swift(iOS), Java(Android) and React Native?](https://discuss.elastic.co/t/apm-rum-roadmap-will-there-be-rum-for-swift-ios-java-android-and-react-native/218313)
**Author:** [@ckho](https://discuss.elastic.co/u/ckho)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 11:12am UTC](https://discuss.elastic.co/t/apm-rum-roadmap-will-there-be-rum-for-swift-ios-java-android-and-react-native/218313 "2020-02-07T11:12:46Z")
As subject. We are planning to build an end-to-end monitoring solution for the whole platform, and the monitoring starts from the Mobile Application. Will there be a RUM agent for Swift(iOS), Java(Android) and React Na… --- ## ["Could not fetch URL" while using http output plugin](https://discuss.elastic.co/t/could-not-fetch-url-while-using-http-output-plugin/98414)
**Author:** [@rajesh](https://discuss.elastic.co/u/rajesh)\ **Replies:** 4\ **Last updated:** [September 5, 2017, 1:21pm UTC](https://discuss.elastic.co/t/could-not-fetch-url-while-using-http-output-plugin/98414 "2017-09-05T13:21:22Z")
Hi… I am using http output plugin in logstash and the error am getting is, ERROR logstash.outputs.http - \[HTTP Output Failure\] Could not fetch URL {:url=\>"http://xxx.xx.xx:xxx" name=memoryStats.numBytesAllocated origi… --- ## ['type': 'illegal\_argument\_exception', 'reason': 'cannot parse empty date'}](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date/194239)
**Author:** [@Saurabh\_Sharma\_IIT](https://discuss.elastic.co/u/Saurabh_Sharma_IIT)\ **Replies:** 4\ **Last updated:** [August 8, 2019, 8:49am UTC](https://discuss.elastic.co/t/type-illegal-argument-exception-reason-cannot-parse-empty-date/194239 "2019-08-08T08:49:01Z")
Hi, I am using bulk api to inject pandas dataframe into elasticsearch index. I first converted dataframe to dict and then used bulk. In my .csv data file , I have a column name "start\_date", I have converted it into dat… --- ## [How to get filebeat to output to ES multiple servers](https://discuss.elastic.co/t/how-to-get-filebeat-to-output-to-es-multiple-servers/78835)
**Author:** [@eddie4](https://discuss.elastic.co/u/eddie4)\ **Replies:** 3\ **Last updated:** [March 17, 2017, 4:02pm UTC](https://discuss.elastic.co/t/how-to-get-filebeat-to-output-to-es-multiple-servers/78835 "2017-03-17T16:02:06Z")
Hello everyone, Am using the filebeat for Suricata & ES server. Now my colleague have decided to use filebeat as well. But they are using a completely different setup. I have been attempting to set different configurat… --- ## ["Permission Denied" starting Elasticsearch](https://discuss.elastic.co/t/permission-denied-starting-elasticsearch/129882)
**Author:** [@Josh\_McDonald](https://discuss.elastic.co/u/Josh_McDonald)\ **Replies:** 5\ **Last updated:** [April 30, 2018, 1:31pm UTC](https://discuss.elastic.co/t/permission-denied-starting-elasticsearch/129882 "2018-04-30T13:31:26Z")
I am trying to start Elasticsearch and I'm getting an error: /usr/share/elasticsearch/bin/elasticsearch-env: line 70: /etc/default/elasticsearch: Permission denied --- ## [How does the bundling mechanism works?](https://discuss.elastic.co/t/how-does-the-bundling-mechanism-works/48817)
**Author:** [@napcoder](https://discuss.elastic.co/u/napcoder)\ **Replies:** 8\ **Last updated:** [May 12, 2016, 1:12pm UTC](https://discuss.elastic.co/t/how-does-the-bundling-mechanism-works/48817 "2016-05-12T13:12:14Z")
Hi there, I'm trying to change some little things in the core view (like not showing the toolbar or removing all the tabs on the right of the logo). I'm using the distribution downloaded from the download page of Kibana … --- ## [Errors after updating to 6.2.4](https://discuss.elastic.co/t/errors-after-updating-to-6-2-4/135724)
**Author:** [@Kvin](https://discuss.elastic.co/u/Kvin)\ **Replies:** 7\ **Last updated:** [June 19, 2018, 8:35am UTC](https://discuss.elastic.co/t/errors-after-updating-to-6-2-4/135724 "2018-06-19T08:35:24Z")
As suggested by the documentations I've made a rolling update from 5.2 from 5.6.9, and then from there to 6.2.4. Only Elasticsearch is at this state now, Kibana is still 5.6.9 and no Logstash is running at the moment. E… --- ## ["Detected ambiguous Field Reference" warnings in Logstash 6.4.0](https://discuss.elastic.co/t/detected-ambiguous-field-reference-warnings-in-logstash-6-4-0/149825)
**Author:** [@vicpav](https://discuss.elastic.co/u/vicpav)\ **Replies:** 1\ **Last updated:** [September 26, 2018, 1:05am UTC](https://discuss.elastic.co/t/detected-ambiguous-field-reference-warnings-in-logstash-6-4-0/149825 "2018-09-26T01:05:05Z")
Hi, After upgrading ELK cluster to 6.4.0 version, we have started to get Logstash warnings that make me puzzled: {"level":"WARN","loggerName":"org.logstash.FieldReference","timeMillis":1537825989853,"thread":"Ruby-0-Th… --- ## [Configure multi node configuration with enrollment token - Elasticsearch 8.0.0](https://discuss.elastic.co/t/configure-multi-node-configuration-with-enrollment-token-elasticsearch-8-0-0/297486)
**Author:** [@Abdul\_Gaffar\_Shaikh](https://discuss.elastic.co/u/Abdul_Gaffar_Shaikh)\ **Replies:** 6\ **Last updated:** [February 22, 2022, 7:07am UTC](https://discuss.elastic.co/t/configure-multi-node-configuration-with-enrollment-token-elasticsearch-8-0-0/297486 "2022-02-22T07:07:20Z")
hi team, i am trying to install Elasticsearch 8.0.0 and form a multi node cluster, but using enrollment token , the other node is not accepting and joining the cluster. the error i faced is it does not support multi no… --- ## [Restoring deleted elasticsearch indices](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 4\ **Last updated:** [December 21, 2020, 7:44am UTC](https://discuss.elastic.co/t/restoring-deleted-elasticsearch-indices/259017 "2020-12-21T07:44:20Z")
In kibana (two node cluster ) following indices got deleted from the file system and now kibana is not accessible : bxexbuIpRXqA0n4VyXiDQA - .security-7 3R2woj\_jRVCf58Q8b9--Yg - .apm-agent-configuration RGR9AneMRx6nnQGH… --- ## [BindTransportException when starting Elasticsearch server](https://discuss.elastic.co/t/bindtransportexception-when-starting-elasticsearch-server/57932)
**Author:** [@dal](https://discuss.elastic.co/u/dal)\ **Replies:** 5\ **Last updated:** [August 12, 2016, 6:21pm UTC](https://discuss.elastic.co/t/bindtransportexception-when-starting-elasticsearch-server/57932 "2016-08-12T18:21:01Z")
I am trying to start my elasticsearch server by running bin/elasticsearch from my ES directory but I keep getting a bindtransport exception. What should I do? idea! \[2016-08-11 04:57:45,143\]\[INFO \]\[node … --- ## [Date parsing with am:pm and timezone](https://discuss.elastic.co/t/date-parsing-with-am-pm-and-timezone/108616)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 4\ **Last updated:** [November 21, 2017, 10:49pm UTC](https://discuss.elastic.co/t/date-parsing-with-am-pm-and-timezone/108616 "2017-11-21T22:49:50Z")
The date in my logs looks like that: Nov 5, 2017 11:06:30 PM CST I tried to parse it like that: date { match =\> \[ "timestamp" , "MMM dd, yyyy KK:mm:ss aa Z" \] } or like that: date { … --- ## [Elasticsearch document locking concept](https://discuss.elastic.co/t/elasticsearch-document-locking-concept/95924)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 4\ **Last updated:** [September 7, 2017, 9:43pm UTC](https://discuss.elastic.co/t/elasticsearch-document-locking-concept/95924 "2017-09-07T21:43:53Z")
Hi, This is how i creates lock for particular document with the help of \_id PUT logstash-titanic123/lock { "create": { "\_id": 879}, { "process\_id": 321 } } response is { "took": 573, "errors": false, "items": \[… --- ## [Illegal Character Authority Error Elasticsearch Filter](https://discuss.elastic.co/t/illegal-character-authority-error-elasticsearch-filter/190825)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [July 16, 2019, 10:17pm UTC](https://discuss.elastic.co/t/illegal-character-authority-error-elasticsearch-filter/190825 "2019-07-16T22:17:31Z")
When performing an Elasticsearch filter query, I get the below error (I've replaced sensitive values with an equivilent number of Xs. \[WARN \]\[logstash.filters.elasticsearch\] Failed to query elasticsearch for previous ev… --- ## [Advent calendar 2020](https://discuss.elastic.co/t/advent-calendar-2020/254134)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [November 30, 2020, 8:00am UTC](https://discuss.elastic.co/t/advent-calendar-2020/254134 "2020-11-30T08:00:03Z")
:christmas\_tree::christmas\_tree::christmas\_tree: Following on from the awesomeness of last year, we will be posting at 08:00UTC every day another series of topics from the 1st until the 25th December, in a bunch of lang… --- ## [High level Java rest client date range greater than showing from and to in query formed](https://discuss.elastic.co/t/high-level-java-rest-client-date-range-greater-than-showing-from-and-to-in-query-formed/129649)
**Author:** [@Omprakash\_Verma](https://discuss.elastic.co/u/Omprakash_Verma)\ **Replies:** 8\ **Last updated:** [May 1, 2018, 7:08am UTC](https://discuss.elastic.co/t/high-level-java-rest-client-date-range-greater-than-showing-from-and-to-in-query-formed/129649 "2018-05-01T07:08:06Z")
Hi All, I am stucked in 1 elastic search query. I need to execute following query. select \* from history where (start\_date is null OR start\_date \< SOME\_DATE) AND (end\_date is null OR end\_date \< SOME\_DATE). I have adde… --- ## [Problem with gathering logs from syslog with logstash](https://discuss.elastic.co/t/problem-with-gathering-logs-from-syslog-with-logstash/71107)
**Author:** [@Wojter](https://discuss.elastic.co/u/Wojter)\ **Replies:** 8\ **Last updated:** [January 10, 2017, 9:04pm UTC](https://discuss.elastic.co/t/problem-with-gathering-logs-from-syslog-with-logstash/71107 "2017-01-10T21:04:51Z")
Hello there, I'm new here! What I want to achieve I want to set ELK stack on docker containers and configure it to listen and process logs coming from various applications in JSON form already, over tcp/udp/syslog (w… --- ## [Filter out String that are ""](https://discuss.elastic.co/t/filter-out-string-that-are/105352)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 3\ **Last updated:** [October 26, 2017, 7:53am UTC](https://discuss.elastic.co/t/filter-out-string-that-are/105352 "2017-10-26T07:53:30Z")
Hi, I want to make a filter that filters out logs if field "a" is "". How can I do so? I am using Kibana 5.6. \[image\] --- ## [Docker restarting with security.enabled:false](https://discuss.elastic.co/t/docker-restarting-with-security-enabled-false/122052)
**Author:** [@User\_2\_Guest\_Incomin](https://discuss.elastic.co/u/User_2_Guest_Incomin)\ **Replies:** 4\ **Last updated:** [March 3, 2018, 7:52am UTC](https://discuss.elastic.co/t/docker-restarting-with-security-enabled-false/122052 "2018-03-03T07:52:06Z")
Hi ppl, I'm trying to enable login on kibana 6.1, I read i must set xpack.security.enabled: false I got it like you'll see now, but the docker don't stop restarting. \[imagen\] When i try to start it with -i it says : … --- ## [Override discovery.type=single-node in docker-compose.yml](https://discuss.elastic.co/t/override-discovery-type-single-node-in-docker-compose-yml/231622)
**Author:** [@braddre](https://discuss.elastic.co/u/braddre)\ **Replies:** 2\ **Last updated:** [May 9, 2020, 5:47pm UTC](https://discuss.elastic.co/t/override-discovery-type-single-node-in-docker-compose-yml/231622 "2020-05-09T17:47:20Z")
I'm using two -c yaml files on the docker-compose command line to provide override of Elasticsearch settings. I have the base settings in docker-compose.yml in the services.elasticsearch.environment, and the override in… --- ## [Error while trying to start kibana: libstdc++.so.6: wrong ELF class: ELFCLASS32](https://discuss.elastic.co/t/error-while-trying-to-start-kibana-libstdc-so-6-wrong-elf-class-elfclass32/38274)
**Author:** [@andreynikk](https://discuss.elastic.co/u/andreynikk)\ **Replies:** 5\ **Last updated:** [January 23, 2017, 2:02pm UTC](https://discuss.elastic.co/t/error-while-trying-to-start-kibana-libstdc-so-6-wrong-elf-class-elfclass32/38274 "2017-01-23T14:02:41Z")
Hi, im testing an upgrade to ES 2.1 and kibana to 4.3.1 and when i try to start kibana i get the following error: ./kibana ./../node/bin/node: error while loading shared libraries: libstdc++.so.6: wrong ELF class: ELF… --- ## [ILM and alias confusion](https://discuss.elastic.co/t/ilm-and-alias-confusion/208753)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 8\ **Last updated:** [November 22, 2019, 4:22pm UTC](https://discuss.elastic.co/t/ilm-and-alias-confusion/208753 "2019-11-22T16:22:15Z")
Hi, I have a 5 node cluster. 3 ingestion nodes, 1 coordinator node and a cold node. All ingestion goes via my Logstash server and the output of each index is dated as so: elasticsearch { index =\> "firewall-traffic-… --- ## [Scroll Failure \[Solved\]](https://discuss.elastic.co/t/scroll-failure-solved/52966)
**Author:** [@Nathan\_F](https://discuss.elastic.co/u/Nathan_F)\ **Replies:** 6\ **Last updated:** [December 14, 2016, 2:44pm UTC](https://discuss.elastic.co/t/scroll-failure-solved/52966 "2016-12-14T14:44:57Z")
ES 1.7 When trying to scroll, I get the following: {"error":"ElasticsearchIllegalArgumentException\[Failed to decode scrollId\]; nested: IOException\[Bad Base64 input character decimal 123 in array position 0\]; ","statu… --- ## [\`document\_missing\_exception\` on Upsert?](https://discuss.elastic.co/t/document-missing-exception-on-upsert/82438)
**Author:** [@skilledDeveloper](https://discuss.elastic.co/u/skilledDeveloper)\ **Replies:** 4\ **Last updated:** [May 3, 2017, 4:22pm UTC](https://discuss.elastic.co/t/document-missing-exception-on-upsert/82438 "2017-05-03T16:22:54Z")
I use bulk update and have set "doc\_as\_upsert": true However, SOMETIMES I get errors like this: "update": { "\_index": "artists", "\_type": "artist", "\_id": "fernanda-francis", "status": 404, "error": { "typ… --- ## [Elasticsearch plugin red request timeout to Elasticsearch](https://discuss.elastic.co/t/elasticsearch-plugin-red-request-timeout-to-elasticsearch/83894)
**Author:** [@Marjana](https://discuss.elastic.co/u/Marjana)\ **Replies:** 2\ **Last updated:** [May 2, 2017, 4:24pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-red-request-timeout-to-elasticsearch/83894 "2017-05-02T16:24:52Z")
Hello, I have a 3 node ES cluster, 5.2.2. Kibana is running on one of the nodes, also 5.2.2. Cluster state is green, and I can connect to it from all 3 nodes. Here is the state from node3 where kibana is running: curl 'h… --- ## [Elasticsearch client disconnects](https://discuss.elastic.co/t/elasticsearch-client-disconnects/26433)
**Author:** [@lhorsky1](https://discuss.elastic.co/u/lhorsky1)\ **Replies:** 6\ **Last updated:** [July 30, 2015, 4:16pm UTC](https://discuss.elastic.co/t/elasticsearch-client-disconnects/26433 "2015-07-30T16:16:05Z")
I have built a test environment with 1 master node, 2 data/master nodes, and 2 logstash client nodes (no master / no data). The logstash client nodes are configured to send output using elasticsearch with the http prot… --- ## [How to clear docs.deleted from cat-indices page of elasticsearch?](https://discuss.elastic.co/t/how-to-clear-docs-deleted-from-cat-indices-page-of-elasticsearch/106638)
**Author:** [@Aditi\_Shah](https://discuss.elastic.co/u/Aditi_Shah)\ **Replies:** 5\ **Last updated:** [November 7, 2017, 11:43am UTC](https://discuss.elastic.co/t/how-to-clear-docs-deleted-from-cat-indices-page-of-elasticsearch/106638 "2017-11-07T11:43:35Z")
There are a few document IDs that were rejected by elasticsearch and were added on the docs.deleted section of es. I have fixed the issue with those document IDs. My logstash is still reading the data and in es, instead … --- ## [Accidentally deleted all indices from the cluster. How do I restore the data?](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806)
**Author:** [@rshetty](https://discuss.elastic.co/u/rshetty)\ **Replies:** 7\ **Last updated:** [September 20, 2018, 9:14am UTC](https://discuss.elastic.co/t/accidentally-deleted-all-indices-from-the-cluster-how-do-i-restore-the-data/148806 "2018-09-20T09:14:33Z")
Hi, I know we messed up big time by accidentally deleting all the indices from the cluster but I needed input regarding what is the proper procedure to restore it back. While running the curator tool, accidentally gave… --- ## [Java.lang.UnsupportedOperationException: Not implemented by the TFS FileSystem implementation when starting spark](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-not-implemented-by-the-tfs-filesystem-implementation-when-starting-spark/25763)
**Author:** [@sandeep\_gunnam](https://discuss.elastic.co/u/sandeep_gunnam)\ **Replies:** 4\ **Last updated:** [July 31, 2015, 5:50am UTC](https://discuss.elastic.co/t/java-lang-unsupportedoperationexception-not-implemented-by-the-tfs-filesystem-implementation-when-starting-spark/25763 "2015-07-31T05:50:57Z")
Hi Below are the details of the setup i have Cluster running Hadoop 2.6, Spark 1.3.1, and Scala 2.10.4. I used the library "elasticsearch-spark\_2.10-2.1.0.jar" in my code along with other spark libraries (like spark-c… --- ## [Unassigned dangling\_index\_imported](https://discuss.elastic.co/t/unassigned-dangling-index-imported/97922)
**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\ **Replies:** 2\ **Last updated:** [August 22, 2017, 5:13pm UTC](https://discuss.elastic.co/t/unassigned-dangling-index-imported/97922 "2017-08-22T17:13:13Z")
I have a cluster with status "red" $ curl -s http://127.0.0.1:9200/\_cluster/health | jq . { "active\_shards\_percent\_as\_number": 99.90479817212491, "task\_max\_waiting\_in\_queue\_millis": 0, "number\_of\_in\_flight\_fetch":… --- ## [Why ES doesn't stop my aggregation but just crashes?](https://discuss.elastic.co/t/why-es-doesnt-stop-my-aggregation-but-just-crashes/148170)
**Author:** [@arota](https://discuss.elastic.co/u/arota)\ **Replies:** 4\ **Last updated:** [September 12, 2018, 8:53am UTC](https://discuss.elastic.co/t/why-es-doesnt-stop-my-aggregation-but-just-crashes/148170 "2018-09-12T08:53:46Z")
Hello, I am learning Elasticsearch basics and I am dealing with an Out of Memory error when performing aggregations with a large number of buckets. I already know that for aggregations with 10000+ bucket I should use co… --- ## [When to use docvalue\_fields](https://discuss.elastic.co/t/when-to-use-docvalue-fields/103144)
**Author:** [@shaharmor](https://discuss.elastic.co/u/shaharmor)\ **Replies:** 5\ **Last updated:** [September 27, 2019, 5:40pm UTC](https://discuss.elastic.co/t/when-to-use-docvalue-fields/103144 "2019-09-27T17:40:03Z")
Hi, I see that Kibana is using docvalue\_fields all the time for the @timestamp field. When is using docvalue\_fields vs stored\_fields better? Is there a general use case? Aren't all fields fetched using doc\_values anywa… --- ## [How do I query for messages between two timestamps using the elasticsearch-dsl library?](https://discuss.elastic.co/t/how-do-i-query-for-messages-between-two-timestamps-using-the-elasticsearch-dsl-library/136278)
**Author:** [@exhuma](https://discuss.elastic.co/u/exhuma)\ **Replies:** 4\ **Last updated:** [June 21, 2018, 8:09am UTC](https://discuss.elastic.co/t/how-do-i-query-for-messages-between-two-timestamps-using-the-elasticsearch-dsl-library/136278 "2018-06-21T08:09:39Z")
I'm trying to run a simple query for messages that have a specific key using Python, but also limit the results between two timestamps. I managed to query for the existing key using the following: import sys from getpas… --- ## [Nested json field parsing in filter](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193)
**Author:** [@LmYjQ](https://discuss.elastic.co/u/LmYjQ)\ **Replies:** 3\ **Last updated:** [May 10, 2017, 7:30am UTC](https://discuss.elastic.co/t/nested-json-field-parsing-in-filter/85193 "2017-05-10T07:30:19Z")
I want to split the following data: "ext"=\>{"obj\_ids"=\>\[82748684, 83009084, 81688382, 79158756, 80577703, 83010154, 83022121, 83022241, 82890903, 82451572, 83010197, 83010748, 83010992, 83011106, 83012040, 83030525, 83… --- ## [Where can I find the grok pattern for the COMBINEDAPACHELOG in logstash?](https://discuss.elastic.co/t/where-can-i-find-the-grok-pattern-for-the-combinedapachelog-in-logstash/236990)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 4\ **Last updated:** [June 14, 2020, 2:41pm UTC](https://discuss.elastic.co/t/where-can-i-find-the-grok-pattern-for-the-combinedapachelog-in-logstash/236990 "2020-06-14T14:41:53Z")
When I try parsing the apache access logs with the following grok rule, it comes out with 0 grokparsefailures match =\> { "message" =\> \["%{COMBINEDAPACHELOG}"\] } But when I try doing the same with the following grok pa… [Previous page](https://discuss.elastic.co/top.md?page=353&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=355&per_page=50&period=all)