# Top **URL:** https://discuss.elastic.co/top.md?page=402&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 403 --- ## [numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516)
**Author:** [@Casper\_Skydt](https://discuss.elastic.co/u/Casper_Skydt)\ **Replies:** 4\ **Last updated:** [April 7, 2020, 2:10pm UTC](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516 "2020-04-07T14:10:24Z")
Once in a while i get the following error: numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count The query is the following, with varying 'from', but never larger than 750: { … --- ## [Aggregate X-axis on Count](https://discuss.elastic.co/t/aggregate-x-axis-on-count/106934)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 8\ **Last updated:** [November 10, 2017, 5:13pm UTC](https://discuss.elastic.co/t/aggregate-x-axis-on-count/106934 "2017-11-10T17:13:54Z")
I am trying to measure Nginx latency for a given load, but having issues doing it, as I'm seemingly unable to aggregate 'count' into buckets. I can do the opposite relatively simply -- bucketizing Nginx latency in interv… --- ## [What algorithm is ElasticSearch create Document \_Id based on?Could somebody answer me，plz](https://discuss.elastic.co/t/what-algorithm-is-elasticsearch-create-document-id-based-on-could-somebody-answer-me-plz/166317)
**Author:** [@ennian001](https://discuss.elastic.co/u/ennian001)\ **Replies:** 2\ **Last updated:** [January 31, 2019, 2:56am UTC](https://discuss.elastic.co/t/what-algorithm-is-elasticsearch-create-document-id-based-on-could-somebody-answer-me-plz/166317 "2019-01-31T02:56:37Z")
the \_id is UUID? If I want to specify my own ID, according to the formula（shard = hash(routing) % number\_of\_primary\_shards）, will it result in uneven sharding? I'm confused about this. Can someone help me? plz, i'd … --- ## [Switch case in Logstash](https://discuss.elastic.co/t/switch-case-in-logstash/127408)
**Author:** [@seungtae](https://discuss.elastic.co/u/seungtae)\ **Replies:** 2\ **Last updated:** [April 10, 2018, 5:53am UTC](https://discuss.elastic.co/t/switch-case-in-logstash/127408 "2018-04-10T05:53:25Z")
Can I use switch~case in Logstash? I can't find it in reference.. --- ## [Write ES error with Spark 2.0 release](https://discuss.elastic.co/t/write-es-error-with-spark-2-0-release/56967)
**Author:** [@blunt](https://discuss.elastic.co/u/blunt)\ **Replies:** 8\ **Last updated:** [December 19, 2016, 8:32am UTC](https://discuss.elastic.co/t/write-es-error-with-spark-2-0-release/56967 "2016-12-19T08:32:47Z")
Hi, I met a problem when I write rdd to ES with the Spark 2.0.0 release. But it works well in the Spark 1.6.1 Here is my testing code. import org.elasticsearch.spark.\_ val conf = new org.apache.spark.SparkConf(true) … --- ## [Error: initialize: name or service not known](https://discuss.elastic.co/t/error-initialize-name-or-service-not-known/141357)
**Author:** [@prashansa1](https://discuss.elastic.co/u/prashansa1)\ **Replies:** 4\ **Last updated:** [July 30, 2018, 10:26pm UTC](https://discuss.elastic.co/t/error-initialize-name-or-service-not-known/141357 "2018-07-30T22:26:05Z")
I'm trying to execute logstash script from local to connect with external server. but It is throwing these errors. ERROR logstash.pipeline - A plugin had an unrecoverable error. Will restart this plugin Plugin: \ **Author:** [@ashok6](https://discuss.elastic.co/u/ashok6)\ **Replies:** 3\ **Last updated:** [February 4, 2020, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-process-is-killed-by-oom-killer/217792 "2020-02-04T13:17:57Z") Hi, We have a 32GB c5.4xlarge ( 4 nodes cluster ) for the elastic search and the elastic search process is getting killed after a period of 3 weeks and there is no enough memopry left to restart the process. So had to m… --- ## [How to add/remove fields in index pattern](https://discuss.elastic.co/t/how-to-add-remove-fields-in-index-pattern/152691)
**Author:** [@kritikajj](https://discuss.elastic.co/u/kritikajj)\ **Replies:** 2\ **Last updated:** [October 17, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-add-remove-fields-in-index-pattern/152691 "2018-10-17T11:24:16Z")
Hi, I have ELK stack 6.2.2 installed and filebeat 6.4.1. I am using filebeat to send logs from "Loader" application installed on windows to ELK. The index fields I see in my Kibana Index Pattern, have fields like kubern… --- ## [Private ip geoip from dictionary](https://discuss.elastic.co/t/private-ip-geoip-from-dictionary/156763)
**Author:** [@ppafford](https://discuss.elastic.co/u/ppafford)\ **Replies:** 7\ **Last updated:** [December 4, 2018, 4:41am UTC](https://discuss.elastic.co/t/private-ip-geoip-from-dictionary/156763 "2018-12-04T04:41:10Z")
Related question Private ip geoip JSON object / structure and some questions but this is option 2 some other useful resources https://cinhtau.net/2018/01/26/enrich-geopoints/ https://www.elastic.co/assets/bltc44f784ba… --- ## [Attempted to send a bulk request to Elasticsearch](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch/152052)
**Author:** [@Dani\_Pinol](https://discuss.elastic.co/u/Dani_Pinol)\ **Replies:** 7\ **Last updated:** [October 12, 2018, 7:05pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch/152052 "2018-10-12T19:05:44Z")
Hi, My ELK stack has been running great for months, until recently. I've been receiving the following error: timestamp=\>"2018-10-10T22:00:08.928000+0200", :message=\>"Attempted to send a bulk request to Elasticsearch co… --- ## [Load balancing data from Filebeat to Logstash using Nginx](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473)
**Author:** [@Nikhil04](https://discuss.elastic.co/u/Nikhil04)\ **Replies:** 8\ **Last updated:** [August 9, 2021, 9:35am UTC](https://discuss.elastic.co/t/load-balancing-data-from-filebeat-to-logstash-using-nginx/179473 "2021-08-09T09:35:16Z")
Hello, I have ELK cluster with 3 nodes for elasticsearch(master+data) , 2 nodes for logstash(Active and Passive) and 2 for kibana.I have to utilize both the logstash nodes. I am using filebeat to parse logs and send da… --- ## [How to install Kibana Plugin in Ubuntu offline?](https://discuss.elastic.co/t/how-to-install-kibana-plugin-in-ubuntu-offline/102484)
**Author:** [@amruth](https://discuss.elastic.co/u/amruth)\ **Replies:** 7\ **Last updated:** [December 29, 2017, 6:44am UTC](https://discuss.elastic.co/t/how-to-install-kibana-plugin-in-ubuntu-offline/102484 "2017-12-29T06:44:58Z")
Hi, I am trying to install Kibana Vega based visualizations plugin on ubuntu offline. When I downloaded, it's a Zip file. I am not sure how to install zip file on ubuntu and what commands to use. Can someone please help… --- ## [Show last n records in Kibana ascending order](https://discuss.elastic.co/t/show-last-n-records-in-kibana-ascending-order/178717)
**Author:** [@Sabri\_Mutlucag](https://discuss.elastic.co/u/Sabri_Mutlucag)\ **Replies:** 2\ **Last updated:** [April 27, 2019, 7:27am UTC](https://discuss.elastic.co/t/show-last-n-records-in-kibana-ascending-order/178717 "2019-04-27T07:27:25Z")
Hi, I have docs on ElasticSearch. Each document has idx field. idx field values start from 1. Also all my docs has duration field. They are also number. It can vary from 900 to 1000. I want to visualize last 10 (accordi… --- ## [Logstash as a service config not working](https://discuss.elastic.co/t/logstash-as-a-service-config-not-working/219836)
**Author:** [@sdkeslar](https://discuss.elastic.co/u/sdkeslar)\ **Replies:** 6\ **Last updated:** [February 20, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-as-a-service-config-not-working/219836 "2020-02-20T16:47:28Z")
Trying to get a new install of LogStash running as a service on Ubuntu 18.04 LTS. I can start it ok as root, but it won't start using systemctl. /etc/systemd/system/logstash.service: \[Unit\] Description=logstash \[Serv… --- ## [Filebeat not detecting log files](https://discuss.elastic.co/t/filebeat-not-detecting-log-files/143939)
**Author:** [@perryparktung](https://discuss.elastic.co/u/perryparktung)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-not-detecting-log-files/143939 "2018-08-13T12:58:56Z")
Hi, I am setting my filebeat on Windows, but for somehow it did not detect the files in the path I configured in filebeat.yml. I do have .log files in c:\\var\\logs\\oob-demo\\ , but apparently those were not detected. An… --- ## [Mapper\_parsing\_exception out of range long](https://discuss.elastic.co/t/mapper-parsing-exception-out-of-range-long/60117)
**Author:** [@jay224](https://discuss.elastic.co/u/jay224)\ **Replies:** 1\ **Last updated:** [September 9, 2016, 10:55am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-out-of-range-long/60117 "2016-09-09T10:55:00Z")
Error: TransportError(400, u'mapper\_parsing\_exception', u'json\_parse\_exception: Numeric value (25826625147376967617854956785651883234) out of range of long (-9223372036854775808 - 9223372036854775807)\\n at \[Source: I … --- ## [Elasticsearch process is killed on Centos 7](https://discuss.elastic.co/t/elasticsearch-process-is-killed-on-centos-7/68103)
**Author:** [@NextAngel](https://discuss.elastic.co/u/NextAngel)\ **Replies:** 5\ **Last updated:** [December 5, 2016, 9:23pm UTC](https://discuss.elastic.co/t/elasticsearch-process-is-killed-on-centos-7/68103 "2016-12-05T21:23:30Z")
Elasticsearch service can't start, I think some other process is killing it. Can you help me? \[root@vagrantbox ~\]# systemctl status elasticsearch ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/syst… --- ## [Running Kibana as Windows Service](https://discuss.elastic.co/t/running-kibana-as-windows-service/130420)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 2\ **Last updated:** [May 3, 2018, 2:02pm UTC](https://discuss.elastic.co/t/running-kibana-as-windows-service/130420 "2018-05-03T14:02:04Z")
I am using Kibana 5.5. How can I run this as a Windows service? --- ## [Batch request failed with status 0 meaning](https://discuss.elastic.co/t/batch-request-failed-with-status-0-meaning/272321)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 3\ **Last updated:** [June 7, 2021, 11:40am UTC](https://discuss.elastic.co/t/batch-request-failed-with-status-0-meaning/272321 "2021-06-07T11:40:43Z")
I'm getting this error on my visuals and I can't find information anywhere about what it may mean. Can anyone tell me? --- ## [Failed to determine the health of the cluster. , with exit code 69](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-with-exit-code-69/351919)
**Author:** [@coolin\_dady](https://discuss.elastic.co/u/coolin_dady)\ **Replies:** 1\ **Last updated:** [January 29, 2024, 1:16pm UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-the-cluster-with-exit-code-69/351919 "2024-01-29T13:16:44Z")
\`\`i got that error when tried to create enrollment tocken for the first time .i installed elk version 8.12.0 --- ## [Mapping Netflow Data](https://discuss.elastic.co/t/mapping-netflow-data/1411)
**Author:** [@Ginja](https://discuss.elastic.co/u/Ginja)\ **Replies:** 4\ **Last updated:** [July 6, 2015, 4:54pm UTC](https://discuss.elastic.co/t/mapping-netflow-data/1411 "2015-07-06T16:54:19Z")
Hi All, Just some context, I originally raised this issue in Kibana's issue tracker, but was told that it's an Elasticsearch issue and that it would be best to raise it here. When attempting to view my Netflow data … --- ## [Filebeat/Modules Cannot index event publisher.Event](https://discuss.elastic.co/t/filebeat-modules-cannot-index-event-publisher-event/141419)
**Author:** [@jdomsic](https://discuss.elastic.co/u/jdomsic)\ **Replies:** 3\ **Last updated:** [July 26, 2018, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-modules-cannot-index-event-publisher-event/141419 "2018-07-26T12:15:53Z")
Hi, I just enabled and started filebeat with 2 modules (system and auditd) and my index (filebeat-\*) is not created/populated in elasticsearch. Filebeat config: filebeat.config.modules.path: ${path.config}/modules.d/\*… --- ## [How to implement TCP/UDP protocol in Packetbeats](https://discuss.elastic.co/t/how-to-implement-tcp-udp-protocol-in-packetbeats/52982)
**Author:** [@Ravi\_Shanker\_Reddy](https://discuss.elastic.co/u/Ravi_Shanker_Reddy)\ **Replies:** 8\ **Last updated:** [June 17, 2016, 2:52pm UTC](https://discuss.elastic.co/t/how-to-implement-tcp-udp-protocol-in-packetbeats/52982 "2016-06-17T14:52:09Z")
Hi, I am very new to this packet beats. I tried to add TCP/UDP protocols to my packet beats as directed in the "learn docs" I downloaded "go" & "beats-master" from GitHub. But the lines mentioned in the docs cant find an… --- ## [Data at rest encryption. Is it coming for Elasticsearch?](https://discuss.elastic.co/t/data-at-rest-encryption-is-it-coming-for-elasticsearch/48766)
**Author:** [@ashrose](https://discuss.elastic.co/u/ashrose)\ **Replies:** 5\ **Last updated:** [March 30, 2017, 10:59pm UTC](https://discuss.elastic.co/t/data-at-rest-encryption-is-it-coming-for-elasticsearch/48766 "2017-03-30T22:59:51Z")
From my searching it appears that there is still no ability to encrypt "data at rest", only during communications. It has been mentioned that this is on the roadmap. I am referring to on-premise hosting of Elasticsearc… --- ## [Can I still use Threat Intelligence?](https://discuss.elastic.co/t/can-i-still-use-threat-intelligence/319962)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 6\ **Last updated:** [November 29, 2022, 12:06am UTC](https://discuss.elastic.co/t/can-i-still-use-threat-intelligence/319962 "2022-11-29T00:06:20Z")
Hello Community, I just upgraded one of my test machines from 8.1.2 to 8.5.2 and I noticed that there is now a menu in the security section called "Intelligence", but when I click on it it says "Start a free trial or up… --- ## [Convert epoch milli to datetime](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656)
**Author:** [@sumitbiswas](https://discuss.elastic.co/u/sumitbiswas)\ **Replies:** 5\ **Last updated:** [November 21, 2018, 1:24pm UTC](https://discuss.elastic.co/t/convert-epoch-milli-to-datetime/157656 "2018-11-21T13:24:07Z")
Logstash version: 6.5.0 How do we convert epoch millisecond to datetime? Thanks in advance. Below parses data and in Kibana is seen as below which is wrong. (t) epoch\_time: 1542765548000000000 (t) myTime: 48890264-01… --- ## [Filebeat high memory usage v6.4.2](https://discuss.elastic.co/t/filebeat-high-memory-usage-v6-4-2/155186)
**Author:** [@grantk](https://discuss.elastic.co/u/grantk)\ **Replies:** 6\ **Last updated:** [November 2, 2018, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-high-memory-usage-v6-4-2/155186 "2018-11-02T21:57:56Z")
I am running a test using filebeat and 5 json log files each writing about 200 entries/second into its own json log file. I have not changed the defaults in filebeat other than the json entries: json.message\_key: level … --- ## [TLS not working with x-pack for es cluster](https://discuss.elastic.co/t/tls-not-working-with-x-pack-for-es-cluster/109061)
**Author:** [@subin](https://discuss.elastic.co/u/subin)\ **Replies:** 8\ **Last updated:** [November 27, 2017, 8:56am UTC](https://discuss.elastic.co/t/tls-not-working-with-x-pack-for-es-cluster/109061 "2017-11-27T08:56:28Z")
Hi, I've a four-node es cluster with 3 data/master-eligible nodes and 1 coordinating-only node. I've installed x-pack on all of them. But, configuring the TLS part is where I'm lost. I'm following: https://www.elastic.… --- ## [Name or service not known](https://discuss.elastic.co/t/name-or-service-not-known/284831)
**Author:** [@mahalanobis](https://discuss.elastic.co/u/mahalanobis)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 12:29pm UTC](https://discuss.elastic.co/t/name-or-service-not-known/284831 "2021-09-29T12:29:50Z")
I'm trying to setup an Elasticsearch cluster but I'm getting "Name or service not known" Below you can find configuration and logs first node logs: https://gist.github.com/sintonag/d6ee4e4c68084a0941c28afcf251b519 sec… --- ## [Can't search on specific field](https://discuss.elastic.co/t/cant-search-on-specific-field/27353)
**Author:** [@nomlaran](https://discuss.elastic.co/u/nomlaran)\ **Replies:** 3\ **Last updated:** [August 14, 2015, 9:07am UTC](https://discuss.elastic.co/t/cant-search-on-specific-field/27353 "2015-08-14T09:07:48Z")
I'm unable to retrieve results using a filter on the field called "series": This search returns 92 results: GET /foos/Thing/\_search { "query": { "filtered": { "query": { "term": { "entit… --- ## [Elasticsearch再起動後のシャードが再配置されない](https://discuss.elastic.co/t/elasticsearch/185164)
**Author:** [@devdevdev](https://discuss.elastic.co/u/devdevdev)\ **Replies:** 2\ **Last updated:** [June 13, 2019, 1:57pm UTC](https://discuss.elastic.co/t/elasticsearch/185164 "2019-06-13T13:57:31Z")
elasticsearch6.4.0 DataNode=3、shard=3、replica=1で運用しています。 再起動後、3台のノードは起動したのですが、起動したのですが healthを確認すると statusがredでunassigned\_shardsに数字が残っていました。 ※質問時cluster起動できないため、クエリ結果共有できないです。 そこで http://xxx.xxx.xxx.xxx:9200/\_cat/… --- ## [Elasticsearch 7.1.1 Failed to create native process factories for Machine Learning](https://discuss.elastic.co/t/elasticsearch-7-1-1-failed-to-create-native-process-factories-for-machine-learning/184006)
**Author:** [@Cadu\_Alves](https://discuss.elastic.co/u/Cadu_Alves)\ **Replies:** 7\ **Last updated:** [June 5, 2019, 6:08pm UTC](https://discuss.elastic.co/t/elasticsearch-7-1-1-failed-to-create-native-process-factories-for-machine-learning/184006 "2019-06-05T18:08:07Z")
Hi, I am trying to run the service from elastichsearch, when I start the service it runs for a few seconds and then it returns error, seeing the execution logs of elasticsearch I noticed the following error. And I … --- ## [java.util.zip.ZipException: error in opening zip file](https://discuss.elastic.co/t/java-util-zip-zipexception-error-in-opening-zip-file/124027)
**Author:** [@AntonQUT](https://discuss.elastic.co/u/AntonQUT)\ **Replies:** 7\ **Last updated:** [March 15, 2018, 10:20pm UTC](https://discuss.elastic.co/t/java-util-zip-zipexception-error-in-opening-zip-file/124027 "2018-03-15T22:20:26Z")
I already have a working version of 5.3.2 on my MAC, however i want to set up a new version on my external SSD where there is plenty of space. However the new copy failed to start. The logger error is: \[2018-03-15T15:… --- ## [How do I make dashes insignificant in a kibana search](https://discuss.elastic.co/t/how-do-i-make-dashes-insignificant-in-a-kibana-search/1674)
**Author:** [@Jeff\_Silverman](https://discuss.elastic.co/u/Jeff_Silverman)\ **Replies:** 4\ **Last updated:** [June 19, 2015, 1:13pm UTC](https://discuss.elastic.co/t/how-do-i-make-dashes-insignificant-in-a-kibana-search/1674 "2015-06-19T13:13:59Z")
I am logging messages that contain a UUID. When I do a search on a UUID, for example, fcaaec62-d9c5-4484-bccd-1c7b0982d1bc, there is a match on any document that contains the strings 4484 or bccd. If I search on fcaaec… --- ## [Elasticsearch method not being found in spring boot](https://discuss.elastic.co/t/elasticsearch-method-not-being-found-in-spring-boot/235093)
**Author:** [@momo94](https://discuss.elastic.co/u/momo94)\ **Replies:** 2\ **Last updated:** [June 3, 2020, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-method-not-being-found-in-spring-boot/235093 "2020-06-03T17:55:10Z")
Hello All. I am really glad I found this discussion forum. I have been stuck with this issue for a while now and any assistance is appreciated. I am running Spring Boot version 2.2.0 with the ElasticSearch high-level R… --- ## [Payload too large](https://discuss.elastic.co/t/payload-too-large/227858)
**Author:** [@fadjar340](https://discuss.elastic.co/u/fadjar340)\ **Replies:** 2\ **Last updated:** [April 14, 2020, 1:33pm UTC](https://discuss.elastic.co/t/payload-too-large/227858 "2020-04-14T13:33:34Z")
I use snmp input for logstash, and the fields more than 7000, the limit fields already covered, but the kibana index pattern shown this message: Payload Too Large. Below the error Wrapper@http://10.210.20.98/kibana/bu… --- ## [Kibana stuck with association errors on K8S](https://discuss.elastic.co/t/kibana-stuck-with-association-errors-on-k8s/329254)
**Author:** [@Jennifer\_Klemisch](https://discuss.elastic.co/u/Jennifer_Klemisch)\ **Replies:** 8\ **Last updated:** [April 26, 2023, 8:10am UTC](https://discuss.elastic.co/t/kibana-stuck-with-association-errors-on-k8s/329254 "2023-04-26T08:10:32Z")
While attempting to troubleshoot why my enterprise search wouldn't deploy I ended up running into another error. The guide says after running the yaml for deploying enterprise search, to restart kibana. Which from what… --- ## [How to configure different machine servers log in filebeat and send it to logstash](https://discuss.elastic.co/t/how-to-configure-different-machine-servers-log-in-filebeat-and-send-it-to-logstash/162597)
**Author:** [@Vinit\_Kumar](https://discuss.elastic.co/u/Vinit_Kumar)\ **Replies:** 7\ **Last updated:** [January 7, 2019, 3:47pm UTC](https://discuss.elastic.co/t/how-to-configure-different-machine-servers-log-in-filebeat-and-send-it-to-logstash/162597 "2019-01-07T15:47:25Z")
Hi All, I'm trying to get logs (not syslog) from different machine servers and want to send those logs to logstash to elasticsearch to kibana. but in kibana I'm getting only system logs not other logs that I'm expecting… --- ## [After I restart a node or a node disconnected with cluster, all data will copy from remote, why not recovery from local](https://discuss.elastic.co/t/after-i-restart-a-node-or-a-node-disconnected-with-cluster-all-data-will-copy-from-remote-why-not-recovery-from-local/102233)
**Author:** [@gangxiong\_chen](https://discuss.elastic.co/u/gangxiong_chen)\ **Replies:** 1\ **Last updated:** [October 6, 2017, 10:15am UTC](https://discuss.elastic.co/t/after-i-restart-a-node-or-a-node-disconnected-with-cluster-all-data-will-copy-from-remote-why-not-recovery-from-local/102233 "2017-10-06T10:15:32Z")
es version 5.2.2 only few index will write, and others are BLOCK.WRITE setting a node left will cost 12+ hours to cluster becoming green --- ## [Can elasticsearch tribe nodes connect to other tribe nodes?](https://discuss.elastic.co/t/can-elasticsearch-tribe-nodes-connect-to-other-tribe-nodes/21193)
**Author:** [@Andre\_Encarnacao](https://discuss.elastic.co/u/Andre_Encarnacao)\ **Replies:** 1\ **Last updated:** [August 27, 2015, 10:25pm UTC](https://discuss.elastic.co/t/can-elasticsearch-tribe-nodes-connect-to-other-tribe-nodes/21193 "2015-08-27T22:25:07Z")
I'm wondering if elasticsearch can support a hierarchy of tribe nodes. For example, let's say we have a tribe node (A) connected to a set of 5 clusters, and then a tribe node (B) connected to a set of 3 clusters. Can… --- ## [Error: Cannot create pipeline](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255)
**Author:** [@kaochan](https://discuss.elastic.co/u/kaochan)\ **Replies:** 2\ **Last updated:** [October 25, 2017, 2:24pm UTC](https://discuss.elastic.co/t/error-cannot-create-pipeline/105255 "2017-10-25T14:24:00Z")
Hi, I'm new in ELK and i'm having a problem with logstash trying to filter my application log. This is my config file: input { file { path =\> "/var/log/application/application.log" start\_position =\> "beginning" ty… --- ## [Machine Learning Real-Time Job stopping after initial run](https://discuss.elastic.co/t/machine-learning-real-time-job-stopping-after-initial-run/96524)
**Author:** [@jcspino](https://discuss.elastic.co/u/jcspino)\ **Replies:** 8\ **Last updated:** [August 17, 2017, 5:23pm UTC](https://discuss.elastic.co/t/machine-learning-real-time-job-stopping-after-initial-run/96524 "2017-08-17T17:23:35Z")
Hello, I am working to create some real-time machine learning jobs and I am having a problem getting the jobs to continue running after their initial analysis. I have looked through some similar postings for troubleshoo… --- ## [Sum aggregation along with Unique Count aggregation](https://discuss.elastic.co/t/sum-aggregation-along-with-unique-count-aggregation/26802)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 4\ **Last updated:** [August 4, 2015, 3:36pm UTC](https://discuss.elastic.co/t/sum-aggregation-along-with-unique-count-aggregation/26802 "2015-08-04T15:36:34Z")
Hi, I have a query regarding Sum and Unique Count aggregations. I have fields "Total", "ID", "Date". "Date" "ID" "Total" "2013-05-14 14:30:10.02" "1" "2000" "2013-05-14 14:30:10.02" "1" "2000" "2013-0… --- ## [Handling persistent ES output failures](https://discuss.elastic.co/t/handling-persistent-es-output-failures/76387)
**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\ **Replies:** 8\ **Last updated:** [March 1, 2017, 10:16am UTC](https://discuss.elastic.co/t/handling-persistent-es-output-failures/76387 "2017-03-01T10:16:24Z")
Hi, I am trying to understand if there is a method in logstash to handle failures that occur when writing to ElasticSearch. I know that logstash has a retry policy for certain types of exceptions, but the failures I am… --- ## [Service logstash configtest gone](https://discuss.elastic.co/t/service-logstash-configtest-gone/64488)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 3\ **Last updated:** [November 1, 2016, 6:40pm UTC](https://discuss.elastic.co/t/service-logstash-configtest-gone/64488 "2016-11-01T18:40:18Z")
In pre 5.0 instances of logstash, after making changes to a config file it was possible to run: service logstash configtest After updating to version 5, this no longer works and returns back: The service command s… --- ## [Reserved character escaping understanding](https://discuss.elastic.co/t/reserved-character-escaping-understanding/85150)
**Author:** [@scotttam](https://discuss.elastic.co/u/scotttam)\ **Replies:** 1\ **Last updated:** [May 12, 2017, 6:51am UTC](https://discuss.elastic.co/t/reserved-character-escaping-understanding/85150 "2017-05-12T06:51:45Z")
I'm hoping someone can help me understand when it's necessary to escape query terms and query\_strings as defined here. Let's say I have an index with one field that's of type keyword: curl -s -XPUT 'localhost:9200/my… --- ## [Filebeat: Failed to connect to backoff async dial tcp connect connection refused](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-dial-tcp-connect-connection-refused/216556)
**Author:** [@mcmeathouse](https://discuss.elastic.co/u/mcmeathouse)\ **Replies:** 3\ **Last updated:** [January 29, 2020, 5:22am UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-async-dial-tcp-connect-connection-refused/216556 "2020-01-29T05:22:33Z")
I've gone through other posts with this same issue, and I have come up empty handed. I've set up ELK rigs before, and this is the first time encountering this problem. General Info: \*New cluster with 4 nodes. 1 for kib… --- ## [Match none or multiple words in parentheses in grok](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692)
**Author:** [@meggenberger](https://discuss.elastic.co/u/meggenberger)\ **Replies:** 2\ **Last updated:** [January 25, 2018, 9:05pm UTC](https://discuss.elastic.co/t/match-none-or-multiple-words-in-parentheses-in-grok/116692 "2018-01-25T21:05:53Z")
I have a question about grok. I'm a total beginner and was searching but couldn't find a solution. I have log files with data that is in parentheses. Sometimes there is no data in it. the log lines look like 2017-11-24 … --- ## [Tree Visualizations in Kibana](https://discuss.elastic.co/t/tree-visualizations-in-kibana/166995)
**Author:** [@Gaurav\_Bahl](https://discuss.elastic.co/u/Gaurav_Bahl)\ **Replies:** 4\ **Last updated:** [February 11, 2019, 8:35pm UTC](https://discuss.elastic.co/t/tree-visualizations-in-kibana/166995 "2019-02-11T20:35:16Z")
Hello everyone, I tried to find a kibana visualization plugin to display my data in tree format or hierarchy format. But I am not able to get any. Is there any plugin for that ? Secondly, I have seen so many D3.js visu… --- ## [Cluster instability if master leader is stopped](https://discuss.elastic.co/t/cluster-instability-if-master-leader-is-stopped/136180)
**Author:** [@rocketraman](https://discuss.elastic.co/u/rocketraman)\ **Replies:** 6\ **Last updated:** [June 29, 2018, 6:25am UTC](https://discuss.elastic.co/t/cluster-instability-if-master-leader-is-stopped/136180 "2018-06-29T06:25:58Z")
I have an ES 6.2.4 cluster. The cluster runs inside Kubernetes and contains 3 master and 3 data nodes with zen discovery. The cluster is idle. I am testing some failure scenarios and trying to get a handle on some odd be… [Previous page](https://discuss.elastic.co/top.md?page=401&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=403&per_page=50&period=all)