# Top **URL:** https://discuss.elastic.co/top.md?page=368&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 369 --- ## [Large log entries getting truncated](https://discuss.elastic.co/t/large-log-entries-getting-truncated/34874)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 8\ **Last updated:** [June 15, 2016, 5:30pm UTC](https://discuss.elastic.co/t/large-log-entries-getting-truncated/34874 "2016-06-15T17:30:10Z")
Using filebeat v1.0.0~rc2 on Ubuntu 12.04.3 LTS, our large php-error log entries are getting truncated. The log entries are typically between 3k and 8k, common ones are around 4k. The first 1024 bytes is what seems to be… --- ## [Beats (filebeat/metricbeat etc.) log to syslog with "logging.to\_syslog: false"](https://discuss.elastic.co/t/beats-filebeat-metricbeat-etc-log-to-syslog-with-logging-to-syslog-false/179085)
**Author:** [@bcsmith](https://discuss.elastic.co/u/bcsmith)\ **Replies:** 5\ **Last updated:** [May 1, 2019, 8:08pm UTC](https://discuss.elastic.co/t/beats-filebeat-metricbeat-etc-log-to-syslog-with-logging-to-syslog-false/179085 "2019-05-01T20:08:37Z")
Hello I am looking at a host running Ubuntu Xenial, Logging goes to the /var/log/filebeat/filebeat fine, until an index it is writing to goes read only. Then filebeat spams /var/log/syslog with messages like the followi… --- ## [RE: /usr/local/bin/docker-entrypoint: line 8: exec: filebeat: not found](https://discuss.elastic.co/t/re-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/177648)
**Author:** [@Michele\_Chersich](https://discuss.elastic.co/u/Michele_Chersich)\ **Replies:** 3\ **Last updated:** [April 26, 2019, 5:14pm UTC](https://discuss.elastic.co/t/re-usr-local-bin-docker-entrypoint-line-8-exec-filebeat-not-found/177648 "2019-04-26T17:14:01Z")
I basically have the same problem as this other topic, but I am reposting it since no solution was found. Deploying filebeats via docker-compose produces the following error: /usr/local/bin/docker-entrypoint: line 8: e… --- ## [Compress and copy elasticsearc indexes](https://discuss.elastic.co/t/compress-and-copy-elasticsearc-indexes/86331)
**Author:** [@rwagner](https://discuss.elastic.co/u/rwagner)\ **Replies:** 6\ **Last updated:** [May 24, 2017, 12:07pm UTC](https://discuss.elastic.co/t/compress-and-copy-elasticsearc-indexes/86331 "2017-05-24T12:07:43Z")
Hi Guys! My elasticsearch indexes are filling the disk. I would like to compress these indexes. Is it possible to compress these indexes and copy to another computer in a way that I can restore when needed? Would any… --- ## [Watcher alerts for failed logons](https://discuss.elastic.co/t/watcher-alerts-for-failed-logons/92517)
**Author:** [@Izayuh](https://discuss.elastic.co/u/Izayuh)\ **Replies:** 7\ **Last updated:** [July 25, 2017, 1:08pm UTC](https://discuss.elastic.co/t/watcher-alerts-for-failed-logons/92517 "2017-07-25T13:08:38Z")
I am currently using Winlogbeat to send security logs from multiple domain controllers. I want to set up a watcher alert that would trigger on x amount of failed logon attempts to the same user in a certain time range. W… --- ## [How to pass multiple field values of a table to URL](https://discuss.elastic.co/t/how-to-pass-multiple-field-values-of-a-table-to-url/86143)
**Author:** [@kabali12345](https://discuss.elastic.co/u/kabali12345)\ **Replies:** 8\ **Last updated:** [May 19, 2017, 4:44pm UTC](https://discuss.elastic.co/t/how-to-pass-multiple-field-values-of-a-table-to-url/86143 "2017-05-19T16:44:44Z")
how to pass multiple field values of a table to URL where i am able to pass a single field value http://example.com/{{rawValue}}/ but i want pass two field values to URL is there any way for that to do.....? Thanks … --- ## [Elasticsearch JDBC importer is not working](https://discuss.elastic.co/t/elasticsearch-jdbc-importer-is-not-working/26972)
**Author:** [@remram](https://discuss.elastic.co/u/remram)\ **Replies:** 8\ **Last updated:** [January 11, 2017, 8:03am UTC](https://discuss.elastic.co/t/elasticsearch-jdbc-importer-is-not-working/26972 "2017-01-11T08:03:57Z")
Hi all, I was trying to import my data with elasticsearch-jdbc importer from jprante. The execution seems to be successful. But when i look at my index. It's still empty. This is my execution from the terminal: ec… --- ## [Caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292440)
**Author:** [@haipeng.zhao](https://discuss.elastic.co/u/haipeng.zhao)\ **Replies:** 2\ **Last updated:** [December 21, 2021, 5:34am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-netty4httpchannel-localaddress/292440 "2021-12-21T05:34:38Z")
My hot node is already outputting this log. What is the problem? {"type": "server", "timestamp": "2021-12-17T19:45:21,865Z", "level": "WARN", "component": "o.e.h.AbstractHttpServerTransport", "cluster.name": "dev", "nod… --- ## [Convert Multiple Fields - Ingest Node - Convert Processor](https://discuss.elastic.co/t/convert-multiple-fields-ingest-node-convert-processor/95988)
**Author:** [@brandont](https://discuss.elastic.co/u/brandont)\ **Replies:** 1\ **Last updated:** [August 5, 2017, 9:05pm UTC](https://discuss.elastic.co/t/convert-multiple-fields-ingest-node-convert-processor/95988 "2017-08-05T21:05:16Z")
I want to configure an ingest node to convert multiple fields coming through a pipeline but when I define more than one “convert” processor, I get a duplicate key error in the Kibana console and they overwrite each other… --- ## [Elasticsearch remote code execution CVE-2015-5377](https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736)
**Author:** [@KevinKluge](https://discuss.elastic.co/u/KevinKluge)\ **Replies:** 0\ **Last updated:** [July 16, 2015, 5:30pm UTC](https://discuss.elastic.co/t/elasticsearch-remote-code-execution-cve-2015-5377/25736 "2015-07-16T17:30:03Z")
Summary Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol that enables remote code execution. This issue is related to the Groovy announcement in CVE-2015-3253. D… --- ## [Terms query with large number of items increase latency by number of shards](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769)
**Author:** [@nickcanz](https://discuss.elastic.co/u/nickcanz)\ **Replies:** 3\ **Last updated:** [January 5, 2021, 5:57pm UTC](https://discuss.elastic.co/t/terms-query-with-large-number-of-items-increase-latency-by-number-of-shards/259769 "2021-01-05T17:57:48Z")
For requests with a very high terms count, Elasticsearch is taking multiple seconds to return an HTTP 400 error. We had an issue with a production system that produced a query that had 250K items in a terms query and thi… --- ## [One node cluster stuck on initializing\_shards](https://discuss.elastic.co/t/one-node-cluster-stuck-on-initializing-shards/84588)
**Author:** [@jmngpt](https://discuss.elastic.co/u/jmngpt)\ **Replies:** 3\ **Last updated:** [June 1, 2017, 4:06pm UTC](https://discuss.elastic.co/t/one-node-cluster-stuck-on-initializing-shards/84588 "2017-06-01T16:06:57Z")
Hi, I have a 2.4.4 cluster with a single server/node (esnode1) containing only one 220GB index with 1 shard and zero replicas. The index was responding fine, but after I cleanly restarted the server (ec2 with 2cpu 4GB … --- ## [duplicateNames with multiple fields?](https://discuss.elastic.co/t/duplicatenames-with-multiple-fields/120209)
**Author:** [@liamwazherealso](https://discuss.elastic.co/u/liamwazherealso)\ **Replies:** 7\ **Last updated:** [February 21, 2018, 7:07pm UTC](https://discuss.elastic.co/t/duplicatenames-with-multiple-fields/120209 "2018-02-21T19:07:38Z")
Hello, I'm able to preform a query and find duplicate results with. query = { "aggs": { "duplicateNames": { "terms": { "field": comparison\_field, "size": 0, … --- ## [Help with JSON output format](https://discuss.elastic.co/t/help-with-json-output-format/89839)
**Author:** [@aganatra13](https://discuss.elastic.co/u/aganatra13)\ **Replies:** 3\ **Last updated:** [June 18, 2017, 11:59pm UTC](https://discuss.elastic.co/t/help-with-json-output-format/89839 "2017-06-18T23:59:14Z")
Can someone help me with writing correct configuration file such that JSON output 1) Does not contain metadata like source file name, time stamp, host name etc.. 2) Each column in input does not become a JSON document … --- ## [\[SOLVED\] Filebeat creating high CPU usage](https://discuss.elastic.co/t/solved-filebeat-creating-high-cpu-usage/42419)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 3\ **Last updated:** [February 24, 2016, 1:51pm UTC](https://discuss.elastic.co/t/solved-filebeat-creating-high-cpu-usage/42419 "2016-02-24T13:51:56Z")
All, I have filebeat installed on a handful of CentOS servers. Most installations are behaving well. However, one server constatntly reports extremely high CPU usage, as in the following from top: 30459 root 2… --- ## [Filebeat output to console not work](https://discuss.elastic.co/t/filebeat-output-to-console-not-work/56692)
**Author:** [@caoping](https://discuss.elastic.co/u/caoping)\ **Replies:** 4\ **Last updated:** [July 29, 2016, 6:59am UTC](https://discuss.elastic.co/t/filebeat-output-to-console-not-work/56692 "2016-07-29T06:59:46Z")
I found there was a similar question here posted last year, and a guy answered that filebeat didn't support that feature yet. But now, I suppose it does. So why I'm still encountering the same error? Below is filebeat ou… --- ## [ELK 5.5: Query with term and range filter](https://discuss.elastic.co/t/elk-5-5-query-with-term-and-range-filter/93876)
**Author:** [@prott8gf](https://discuss.elastic.co/u/prott8gf)\ **Replies:** 2\ **Last updated:** [July 24, 2017, 12:56pm UTC](https://discuss.elastic.co/t/elk-5-5-query-with-term-and-range-filter/93876 "2017-07-24T12:56:11Z")
Hi, I'm quite new to the beautiful world of elasticsearch and ran into a problem using the query language. So I've installed a ELK 5.5 test environment including the WINLOGBEAT component, everthing is working fine. … --- ## [How to loop through array in Logstash?](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747)
**Author:** [@rijo\_joseph](https://discuss.elastic.co/u/rijo_joseph)\ **Replies:** 4\ **Last updated:** [January 11, 2022, 9:15am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747 "2022-01-11T09:15:10Z")
{ "modifiedTime": "2021-12-13T06:47:11.138Z", "task\_owner\_name": null, "contents": \[ { "eligible": false, "rawResponse": "454536251", "id": 868286622 }, { "eligible": false, … --- ## [Tuning indices.memory.max\_index\_buffer\_size for indexing throughput](https://discuss.elastic.co/t/tuning-indices-memory-max-index-buffer-size-for-indexing-throughput/61275)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 3:25pm UTC](https://discuss.elastic.co/t/tuning-indices-memory-max-index-buffer-size-for-indexing-throughput/61275 "2016-09-22T15:25:09Z")
Hello All, I am working on improving our indexing throughput. We create a fresh index on the same cluster as our production index every 6 hours so we want to minimize harm to search performance on that index while we … --- ## [Elasticsearch 7.12 High CPU usage](https://discuss.elastic.co/t/elasticsearch-7-12-high-cpu-usage/270757)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 7\ **Last updated:** [April 30, 2021, 6:51am UTC](https://discuss.elastic.co/t/elasticsearch-7-12-high-cpu-usage/270757 "2021-04-30T06:51:04Z")
Hi all, Last week in need to install a new cluster and I decided to use the 7.12 version. Initially I've configure a three node cluster (two data+master nodes, one master node). In this version elasticsearch automatic… --- ## [Write a Scripted field that calculates a rate by dividing the count of 2 text fields](https://discuss.elastic.co/t/write-a-scripted-field-that-calculates-a-rate-by-dividing-the-count-of-2-text-fields/46966)
**Author:** [@Jeremy\_Colton](https://discuss.elastic.co/u/Jeremy_Colton)\ **Replies:** 5\ **Last updated:** [April 13, 2016, 3:26pm UTC](https://discuss.elastic.co/t/write-a-scripted-field-that-calculates-a-rate-by-dividing-the-count-of-2-text-fields/46966 "2016-04-13T15:26:01Z")
Hi, I collect many events from websites and visualize them using Kibana. The events include page loaded", "image clicked". My Kibana index contains an 'event' field that stores these event text values. I want to show … --- ## [Distance calculation](https://discuss.elastic.co/t/distance-calculation/146060)
**Author:** [@suresh1](https://discuss.elastic.co/u/suresh1)\ **Replies:** 4\ **Last updated:** [August 28, 2018, 7:48am UTC](https://discuss.elastic.co/t/distance-calculation/146060 "2018-08-28T07:48:01Z")
Hi, I am trying to calculate the distance please find the below PUT my\_index { "mappings": { "doc": { "properties": { "location": { "type": "geo\_point" } } } } POST my\_index/doc { "location": \[ { "lat":… --- ## [Kibana vega viz plug-in:multiple aggregations: how-to?](https://discuss.elastic.co/t/kibana-vega-viz-plug-in-multiple-aggregations-how-to/121893)
**Author:** [@nielsen-at-cgt](https://discuss.elastic.co/u/nielsen-at-cgt)\ **Replies:** 3\ **Last updated:** [March 30, 2018, 7:38pm UTC](https://discuss.elastic.co/t/kibana-vega-viz-plug-in-multiple-aggregations-how-to/121893 "2018-03-30T19:38:49Z")
The vega viz plugin for kibana is really good! I'm having a slight problem though, and I fear I might be going past the capability of the plugin. What I would like to produce is a graphic with multiple rows, one for ea… --- ## [Index metadata](https://discuss.elastic.co/t/index-metadata/6251)
**Author:** [@MC1](https://discuss.elastic.co/u/MC1)\ **Replies:** 7\ **Last updated:** [December 30, 2011, 6:39pm UTC](https://discuss.elastic.co/t/index-metadata/6251 "2011-12-30T18:39:44Z")
Is it possible to retrieve index metadata via the API? In terms of metadata, I am looking to be able to dynamically retrieve things like: 1. The date/time at which an index was last updated 2. The field names (curr… --- ## [Error Java heap space](https://discuss.elastic.co/t/error-java-heap-space/271837)
**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\ **Replies:** 3\ **Last updated:** [May 1, 2021, 1:02am UTC](https://discuss.elastic.co/t/error-java-heap-space/271837 "2021-05-01T01:02:20Z")
I created an ElasticSearch server, but today it stopped and in the log it reported that the error was: \[ERROR\]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[main-node\] fatal error in thread \[elasticsearch\[main-node\]\[sea… --- ## [Error 403 after login with kibana](https://discuss.elastic.co/t/error-403-after-login-with-kibana/183328)
**Author:** [@yaser](https://discuss.elastic.co/u/yaser)\ **Replies:** 4\ **Last updated:** [June 8, 2019, 5:29am UTC](https://discuss.elastic.co/t/error-403-after-login-with-kibana/183328 "2019-06-08T05:29:18Z")
why i get this error after login in kibana??? --- ## [\[Solved\] Logstash can't start up: not enough memory](https://discuss.elastic.co/t/solved-logstash-cant-start-up-not-enough-memory/51372)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 4\ **Last updated:** [May 31, 2016, 10:09am UTC](https://discuss.elastic.co/t/solved-logstash-cant-start-up-not-enough-memory/51372 "2016-05-31T10:09:15Z")
This is what top showed top - 13:28:06 up 837 days, 15:14, 6 users, load average: 0.17, 0.13, 0.16 Tasks: 352 total, 2 running, 350 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3%us, 0.1%sy, 0.0%ni, 99.3%id, 0.… --- ## [Fileset 6.4.0: Error: elasticsearch/log is configured but doesn't exist](https://discuss.elastic.co/t/fileset-6-4-0-error-elasticsearch-log-is-configured-but-doesnt-exist/146921)
**Author:** [@Alsheh](https://discuss.elastic.co/u/Alsheh)\ **Replies:** 4\ **Last updated:** [September 6, 2018, 5:45pm UTC](https://discuss.elastic.co/t/fileset-6-4-0-error-elasticsearch-log-is-configured-but-doesnt-exist/146921 "2018-09-06T17:45:40Z")
I'm using the Filebeat Elasticsearch module introduced in filebeat 6.4.0, but I get this error when I run filebeat: ERROR \[autodiscover\] cfgfile/list.go:104 Error creating runner from config: Fileset elasticsearch/log i… --- ## [Kibana Data Table to group by fields](https://discuss.elastic.co/t/kibana-data-table-to-group-by-fields/218232)
**Author:** [@Joseph\_Mak](https://discuss.elastic.co/u/Joseph_Mak)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 4:15pm UTC](https://discuss.elastic.co/t/kibana-data-table-to-group-by-fields/218232 "2020-02-07T16:15:52Z")
If I have something super simple like this, a bunch of records with a few fields and a timestamp. Is there a way to build a Data Table (or some other visualization), grouping by each of the fields? For example, in the … --- ## [Convert long date to date](https://discuss.elastic.co/t/convert-long-date-to-date/80291)
**Author:** [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Replies:** 6\ **Last updated:** [April 1, 2017, 12:29pm UTC](https://discuss.elastic.co/t/convert-long-date-to-date/80291 "2017-04-01T12:29:27Z")
Hi Guys, I want to transformthe creationDate from long to timestamp date ("format" : "MMM/dd/yyyy HH:mm:ss", ). I checked the documentation with no result. JSON serach result: "creationDate": 1490254211904, Mappi… --- ## [ES6.x - Prevent new index to be created with replica shards](https://discuss.elastic.co/t/es6-x-prevent-new-index-to-be-created-with-replica-shards/178168)
**Author:** [@EldrosKandar](https://discuss.elastic.co/u/EldrosKandar)\ **Replies:** 4\ **Last updated:** [May 14, 2019, 8:42am UTC](https://discuss.elastic.co/t/es6-x-prevent-new-index-to-be-created-with-replica-shards/178168 "2019-05-14T08:42:53Z")
This issue appears on ES 6.7 with the Filebeat Client still being 6.2. I've set the number of replicas to 0 with: curl -XPUT "http://localhost:9200/\_settings" -H 'Content-Type: application/json' -d' { "index" : { … --- ## [Count by regex pattern](https://discuss.elastic.co/t/count-by-regex-pattern/83395)
**Author:** [@Alexkl](https://discuss.elastic.co/u/Alexkl)\ **Replies:** 2\ **Last updated:** [April 26, 2017, 8:16am UTC](https://discuss.elastic.co/t/count-by-regex-pattern/83395 "2017-04-26T08:16:34Z")
I am struggling with a pie chart visualisation in kibana (5.2.2) I have a field url wich contains things like : https://fhfhf.jffjr.com/ping?toto=tata https://fhfhf.jffjr.com/user=tu https://fhfhf.jffjr.com/ping?tutu=t… --- ## [Generic way to read aggregations from JAVA API](https://discuss.elastic.co/t/generic-way-to-read-aggregations-from-java-api/1788)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 6\ **Last updated:** [November 2, 2016, 9:51am UTC](https://discuss.elastic.co/t/generic-way-to-read-aggregations-from-java-api/1788 "2016-11-02T09:51:54Z")
It seems to me that with the JAVA API when trying to read aggregation results, you have to know each specific bucket type. Is there a quick way to just loop through the aggs and dump them to file using JAVA API? --- ## [Problem in difference between two dates](https://discuss.elastic.co/t/problem-in-difference-between-two-dates/121655)
**Author:** [@nabilberd](https://discuss.elastic.co/u/nabilberd)\ **Replies:** 2\ **Last updated:** [February 28, 2018, 7:56am UTC](https://discuss.elastic.co/t/problem-in-difference-between-two-dates/121655 "2018-02-28T07:56:17Z")
Hello , I have problem with this script : if ( doc\['entities.status'\].value == doc\['entities.statusesInformation.statusName'\].value ) { return doc\['entities.executionDate'\].date - doc\['entities.creationDate'\].date ; … --- ## [Non-case sensitive search on termquery](https://discuss.elastic.co/t/non-case-sensitive-search-on-termquery/73389)
**Author:** [@SergeyP](https://discuss.elastic.co/u/SergeyP)\ **Replies:** 3\ **Last updated:** [February 4, 2017, 5:31pm UTC](https://discuss.elastic.co/t/non-case-sensitive-search-on-termquery/73389 "2017-02-04T17:31:04Z")
Hi There, I have already designed an application which is using term queries on keywords and I found out search is case sensitive. The problem is that my keyword fields represent the data as well. That means, I want to… --- ## [Hide filter bar in dashboard](https://discuss.elastic.co/t/hide-filter-bar-in-dashboard/176250)
**Author:** [@landy](https://discuss.elastic.co/u/landy)\ **Replies:** 5\ **Last updated:** [April 16, 2019, 2:10pm UTC](https://discuss.elastic.co/t/hide-filter-bar-in-dashboard/176250 "2019-04-16T14:10:40Z")
Hi! Is there any way to hide filter bar in shared dashboard (ex:iframe)? I don't want my users to filter data and have access to see all data. Also, I am confused why there is filter bar in dashboard because we can add … --- ## [Filebeat 6.7.0 not pushing logs to Elasticsearch 6.7.0 after upgrade](https://discuss.elastic.co/t/filebeat-6-7-0-not-pushing-logs-to-elasticsearch-6-7-0-after-upgrade/174365)
**Author:** [@a14b6b031b49e3a61207](https://discuss.elastic.co/u/a14b6b031b49e3a61207)\ **Replies:** 5\ **Last updated:** [April 2, 2019, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-6-7-0-not-pushing-logs-to-elasticsearch-6-7-0-after-upgrade/174365 "2019-04-02T15:13:37Z")
Filebeat stopped working after upgrading from 6.6.2 to 6.7.0 My Filebeat configuration is: filebeat.inputs: - type: log enabled: true paths: - /var/www/current/log/production.log - /var/www/current/log/api\_… --- ## [Filebeat - drop fields processor doesn't remove agent.\* and ecs fields. (Without Logstash)](https://discuss.elastic.co/t/filebeat-drop-fields-processor-doesnt-remove-agent-and-ecs-fields-without-logstash/200985)
**Author:** [@turgayozgur](https://discuss.elastic.co/u/turgayozgur)\ **Replies:** 3\ **Last updated:** [October 13, 2019, 11:44am UTC](https://discuss.elastic.co/t/filebeat-drop-fields-processor-doesnt-remove-agent-and-ecs-fields-without-logstash/200985 "2019-10-13T11:44:49Z")
The drop fields section is working for the other fields like kubernetes.pod.id but it is not working for agent.\* and ecs fields. Any workaround here? Version: 7.3.2 Operating System: Linux Steps to Reproduce: Apply th… --- ## [Heartbeat error "error when creating "heartbeat-kubernetes.yaml": Deployment in version "v1" cannot be handled as a Deployment: unable to parse quantity's suffix" when deploying on kubernetes](https://discuss.elastic.co/t/heartbeat-error-error-when-creating-heartbeat-kubernetes-yaml-deployment-in-version-v1-cannot-be-handled-as-a-deployment-unable-to-parse-quantitys-suffix-when-deploying-on-kubernetes/314597)
**Author:** [@alexander2](https://discuss.elastic.co/u/alexander2)\ **Replies:** 1\ **Last updated:** [September 19, 2022, 3:05pm UTC](https://discuss.elastic.co/t/heartbeat-error-error-when-creating-heartbeat-kubernetes-yaml-deployment-in-version-v1-cannot-be-handled-as-a-deployment-unable-to-parse-quantitys-suffix-when-deploying-on-kubernetes/314597 "2022-09-19T15:05:29Z")
Hello everyone, i'm trying to deploy heartbeat on kubernetes to monitor kubernetes pods and services. i used the elastic official documentation yaml file. this is the full configuration file apiVersion: v1 kind: Config… --- ## [Docker Compose elastic Cluster setup](https://discuss.elastic.co/t/docker-compose-elastic-cluster-setup/87387)
**Author:** [@Abhishek\_Purohit](https://discuss.elastic.co/u/Abhishek_Purohit)\ **Replies:** 8\ **Last updated:** [June 20, 2017, 1:41am UTC](https://discuss.elastic.co/t/docker-compose-elastic-cluster-setup/87387 "2017-06-20T01:41:26Z")
Hi! Please find that we are able to set up a single elastic search server and kibana suing docker-compose. But when we try to set up a cluster using the following we face issues while starting elastic search. The ela… --- ## [Filebeat holding deleted files which consumes disk space](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415)
**Author:** [@arya](https://discuss.elastic.co/u/arya)\ **Replies:** 5\ **Last updated:** [May 30, 2017, 8:41am UTC](https://discuss.elastic.co/t/filebeat-holding-deleted-files-which-consumes-disk-space/87415 "2017-05-30T08:41:58Z")
Filebeat process in the server is holding the deleted files which are forwarded by logstash forwarder which makes the server disk space full. Currently a cron job is in place to restart filebeat at regular intervals. Bu… --- ## [Deploying ECK on AWS EKS with i3 and d2 instances and local volumes](https://discuss.elastic.co/t/deploying-eck-on-aws-eks-with-i3-and-d2-instances-and-local-volumes/235223)
**Author:** [@Chris\_Austin](https://discuss.elastic.co/u/Chris_Austin)\ **Replies:** 6\ **Last updated:** [September 28, 2021, 2:51pm UTC](https://discuss.elastic.co/t/deploying-eck-on-aws-eks-with-i3-and-d2-instances-and-local-volumes/235223 "2021-09-28T14:51:27Z")
I'm attempting to deploy Elasticsearch w/ ECK on EKS with i3 hot nodes and d2 warm nodes, with the EC2 instances created through Terraform as part of an autoscaling group so I can have failover across availability zones.… --- ## [Using Wildcard Cert with Elasticsearch](https://discuss.elastic.co/t/using-wildcard-cert-with-elasticsearch/189636)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 6\ **Last updated:** [July 16, 2019, 2:27am UTC](https://discuss.elastic.co/t/using-wildcard-cert-with-elasticsearch/189636 "2019-07-16T02:27:46Z")
We have a public CA wildcard cert that I want to use with elasticsearch. I have the cert and elasticsearch configured, but when I run elasticsearch, it fails because I don't have the IP address of the Elasticsearch serv… --- ## [How can split discovery message field?](https://discuss.elastic.co/t/how-can-split-discovery-message-field/96370)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 7\ **Last updated:** [August 28, 2017, 2:53pm UTC](https://discuss.elastic.co/t/how-can-split-discovery-message-field/96370 "2017-08-28T14:53:40Z")
Elasticsearch version 5.5.1 kibana version 5.5.1 Logstash version 5.5.1 Beats version 5.5.1 my message field: message:\[INFO \] Status =\> SENT | client : \[IPDC\] | cell : \[1746710009\] | message-delivery-time : \[2017-0… --- ## [How to stop Elastic Endpoint](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 5\ **Last updated:** [March 15, 2021, 11:40pm UTC](https://discuss.elastic.co/t/how-to-stop-elastic-endpoint/267283 "2021-03-15T23:40:05Z")
Hello, I am testing elastic Endpoint, I have installed it in a windows server machine, and when I try to install a malware in my machine it blocks it as expected so it works perfectly, The only problem is that I am not … --- ## [How cluster logstash?](https://discuss.elastic.co/t/how-cluster-logstash/33069)
**Author:** [@calle\_eman](https://discuss.elastic.co/u/calle_eman)\ **Replies:** 8\ **Last updated:** [October 30, 2015, 12:21pm UTC](https://discuss.elastic.co/t/how-cluster-logstash/33069 "2015-10-30T12:21:55Z")
I want to setup the logstash configuration described in the docs, but I don't understand how to set it up. Here's the sentence I'm struggling with: you can set up a load balancer between your data source machines and t… --- ## [Hour Extraction](https://discuss.elastic.co/t/hour-extraction/206624)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 5\ **Last updated:** [November 20, 2019, 3:19pm UTC](https://discuss.elastic.co/t/hour-extraction/206624 "2019-11-20T15:19:11Z")
Hello! I am trying to extract the hour from the timestamp using a scripted field. I haven't a clue how. Any thoughts? The reason I need to do it in a scripted field is because of the timezone change. When I pull the ho… --- ## [Memory dump question](https://discuss.elastic.co/t/memory-dump-question/39149)
**Author:** [@jchen](https://discuss.elastic.co/u/jchen)\ **Replies:** 5\ **Last updated:** [February 17, 2016, 4:37pm UTC](https://discuss.elastic.co/t/memory-dump-question/39149 "2016-02-17T16:37:15Z")
We are currently in the process of building out a new Elasticsearch cluster, with server nodes of 64GB of memory, of which 62GB are dedicated to Elasticsearch process. My question is, we noticed that by default, the java… --- ## [Get the only failed document response in Bulk API Elasticsearch](https://discuss.elastic.co/t/get-the-only-failed-document-response-in-bulk-api-elasticsearch/128873)
**Author:** [@ashishtiwari1993](https://discuss.elastic.co/u/ashishtiwari1993)\ **Replies:** 4\ **Last updated:** [May 5, 2018, 5:07pm UTC](https://discuss.elastic.co/t/get-the-only-failed-document-response-in-bulk-api-elasticsearch/128873 "2018-05-05T17:07:28Z")
I am struggling with Bulk API. I am sending 100 request (index, update) in every Bulk request. It gives me response with status of each request. Suppose my 97th request got fail, I have to make it loop to find the partic… --- ## [Groovy vs. Painless performance difference](https://discuss.elastic.co/t/groovy-vs-painless-performance-difference/82886)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 7\ **Last updated:** [May 3, 2017, 7:35am UTC](https://discuss.elastic.co/t/groovy-vs-painless-performance-difference/82886 "2017-05-03T07:35:16Z")
Hi, We are using ElasticSearch 5.3.0 and noticed a dramatic difference in performance between groovy and painless. The index has 5 shards and about 30M documents, with a simple mapping (about 15 fields, all strings ar… [Previous page](https://discuss.elastic.co/top.md?page=367&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=369&per_page=50&period=all)