# Top

**URL:** https://discuss.elastic.co/top.md?page=404&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 405

---

## [How to remove backslash from weird formatted json](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084)

<div class="topic-metadata">

**Author:** [@MaxenceVacheron](https://discuss.elastic.co/u/MaxenceVacheron)\
**Replies:** 4\
**Last updated:** [July 21, 2021, 10:11am UTC](https://discuss.elastic.co/t/how-to-remove-backslash-from-weird-formatted-json/279084 "2021-07-21T10:11:19Z")

</div>

Hello :raised\_hand\_with\_fingers\_splayed:, I have the following (valid) formatted json of which I can't change the formatting : \[{ "id": "1", "sn": "00:1E:C0:8D:9A:CD", "log": "{\\"date\\":\\"16\\/04\\/2021\\",\\"t…

---

## [Syslog + Beats](https://discuss.elastic.co/t/syslog-beats/43048)

<div class="topic-metadata">

**Author:** [@matthieurobin](https://discuss.elastic.co/u/matthieurobin)\
**Replies:** 4\
**Last updated:** [March 1, 2016, 9:17pm UTC](https://discuss.elastic.co/t/syslog-beats/43048 "2016-03-01T21:17:43Z")

</div>

Hello guys, I'm currently configuring my ELK cluster to receive syslog from ESXi and Winlogbeats events from Windows. On input file, i got: input { udp { port =\> 3514 type =\> "syslog" } beats { …

---

## [Connected/Disconnected from node / NodeDisconnectedException](https://discuss.elastic.co/t/connected-disconnected-from-node-nodedisconnectedexception/7358)

<div class="topic-metadata">

**Author:** [@Hovanes](https://discuss.elastic.co/u/Hovanes)\
**Replies:** 5\
**Last updated:** [April 21, 2012, 2:26pm UTC](https://discuss.elastic.co/t/connected-disconnected-from-node-nodedisconnectedexception/7358 "2012-04-21T14:26:13Z")

</div>

Hi, I am getting the following messages in the log files of my application: 2012-04-16 10:39:40,867 DEBUG \[org.elasticsearch.transport.netty\] \[Hamilton, Bart\] Connected to node \[\[#transport#-1\]\[inet\[es.vm.local/ …

---

## [Is Filebeat, Log courier and logstash supported for CentOS RHEL 5?](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740)

<div class="topic-metadata">

**Author:** [@ajeevpk](https://discuss.elastic.co/u/ajeevpk)\
**Replies:** 8\
**Last updated:** [November 21, 2016, 7:17pm UTC](https://discuss.elastic.co/t/is-filebeat-log-courier-and-logstash-supported-for-centos-rhel-5/66740 "2016-11-21T19:17:07Z")

</div>

Hi , I want a light weight log forwarder in RHEL5 machine, looks like Filebeat, Log courier and logstash NOT supported for CentOS RHEL 5. Can some one help me resolve this error \[root@ctp-fcpld1app11 ~\]# service file…

---

## [MongoDB River Plugin for ElasticSearch](https://discuss.elastic.co/t/mongodb-river-plugin-for-elasticsearch/6540)

<div class="topic-metadata">

**Author:** [@Richard\_Louapre](https://discuss.elastic.co/u/Richard_Louapre)\
**Replies:** 8\
**Last updated:** [March 7, 2012, 9:26pm UTC](https://discuss.elastic.co/t/mongodb-river-plugin-for-elasticsearch/6540 "2012-03-07T21:26:35Z")

</div>

Hi, You can find \[0\] a first implementation of MongoDB plugin for ES. This version has the following features: - Monitoring MongoDB using oplog.rs collection. - Support for GridFS. Please check the wiki \[1\] fo…

---

## [Endpoint Security Intergration vs. Windows and System Intergrations](https://discuss.elastic.co/t/endpoint-security-intergration-vs-windows-and-system-intergrations/295731)

<div class="topic-metadata">

**Author:** [@TTCD](https://discuss.elastic.co/u/TTCD)\
**Replies:** 2\
**Last updated:** [February 9, 2022, 2:32pm UTC](https://discuss.elastic.co/t/endpoint-security-intergration-vs-windows-and-system-intergrations/295731 "2022-02-09T14:32:48Z")

</div>

Hey there, I need some help figuring out what the best practice is for collecting logs. What I would like to accomplish is to replace my current XDR solution with Elastic Endpoint Security (all without breaking the bank…

---

## [Filebeat setup x509: certificate signed by unknown authority](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068)

<div class="topic-metadata">

**Author:** [@Badr\_Atouhlaten](https://discuss.elastic.co/u/Badr_Atouhlaten)\
**Replies:** 3\
**Last updated:** [June 16, 2022, 3:45am UTC](https://discuss.elastic.co/t/filebeat-setup-x509-certificate-signed-by-unknown-authority/307068 "2022-06-16T03:45:33Z")

</div>

can some help i get the error below when i try to run "sudo filebeat setup" Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GET reques…

---

## [Logstash double quote escape](https://discuss.elastic.co/t/logstash-double-quote-escape/98089)

<div class="topic-metadata">

**Author:** [@Kevin\_Liang](https://discuss.elastic.co/u/Kevin_Liang)\
**Replies:** 4\
**Last updated:** [September 8, 2017, 8:07pm UTC](https://discuss.elastic.co/t/logstash-double-quote-escape/98089 "2017-09-08T20:07:11Z")

</div>

I have a JSON message that is not escaping well due to a double quote after "\<?xml as below: \[2017-08-21T23:59:59,133\]\[WARN \]\[logstash.codecs.jsonlines\] JSON parse error, original data now in message field {:error=\>#\<L…

---

## [Elasticsearch Injection Attacks](https://discuss.elastic.co/t/elasticsearch-injection-attacks/79759)

<div class="topic-metadata">

**Author:** [@JagjitSingh1](https://discuss.elastic.co/u/JagjitSingh1)\
**Replies:** 1\
**Last updated:** [March 23, 2017, 3:09pm UTC](https://discuss.elastic.co/t/elasticsearch-injection-attacks/79759 "2017-03-23T15:09:03Z")

</div>

INTRODUCTION: We have a system where we store job applications from candidates into Elasticsearch. We further present all candidates who have applied for a job in a candidate list(grid with candidates). We also have …

---

## [Kibana logs shows HTTP 403 (Forbidden)](https://discuss.elastic.co/t/kibana-logs-shows-http-403-forbidden/183216)

<div class="topic-metadata">

**Author:** [@ksunil](https://discuss.elastic.co/u/ksunil)\
**Replies:** 6\
**Last updated:** [July 24, 2019, 2:51am UTC](https://discuss.elastic.co/t/kibana-logs-shows-http-403-forbidden/183216 "2019-07-24T02:51:10Z")

</div>

Hi, We are using kibana for monitoring where we defined the a custom files for url and TCP monitoring in heartbeat with all details a month back.Since last week URL and TCP monitoring data shows "No results found" in …

---

## [\[ERROR\]\[logstash.config.sourceloader\] No configuration found in the configured sources](https://discuss.elastic.co/t/error-logstash-config-sourceloader-no-configuration-found-in-the-configured-sources/267798)

<div class="topic-metadata">

**Author:** [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\
**Replies:** 2\
**Last updated:** [March 19, 2021, 2:57pm UTC](https://discuss.elastic.co/t/error-logstash-config-sourceloader-no-configuration-found-in-the-configured-sources/267798 "2021-03-19T14:57:13Z")

</div>

Hello, I am very new to ELK, I am trying to setup ELK (7.11.2) in my local windows 10 laptop. I am able to successfully run Elasticsearch and Kibana but I have issue with Logstash. I tried to figure out this issue by …

---

## [Unable to create short URL. Error: Internal Server Error](https://discuss.elastic.co/t/unable-to-create-short-url-error-internal-server-error/165919)

<div class="topic-metadata">

**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\
**Replies:** 8\
**Last updated:** [January 28, 2019, 6:07pm UTC](https://discuss.elastic.co/t/unable-to-create-short-url-error-internal-server-error/165919 "2019-01-28T18:07:43Z")

</div>

Hello World! Kibana' user is reporting following issue: frontend: Unable to create short URL. Error: Internal Server Error backend: kibana-custom | {"type":"error","@timestamp":"2019-01-27T21:51:25Z","tags":\[\],"pi…

---

## [Too many Deleted Docs](https://discuss.elastic.co/t/too-many-deleted-docs/84964)

<div class="topic-metadata">

**Author:** [@ABILASH](https://discuss.elastic.co/u/ABILASH)\
**Replies:** 5\
**Last updated:** [May 10, 2017, 5:20pm UTC](https://discuss.elastic.co/t/too-many-deleted-docs/84964 "2017-05-10T17:20:42Z")

</div>

Hi, We have a update heavy index with lot of nested documents. We are using elasticsearch 2.3 and I am concerned about the amount of deleted documents in the index. We are seeing upto 50% deleted documents. I have trie…

---

## [Max number of segments in elasticsearch](https://discuss.elastic.co/t/max-number-of-segments-in-elasticsearch/62210)

<div class="topic-metadata">

**Author:** [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)\
**Replies:** 3\
**Last updated:** [October 5, 2016, 8:32am UTC](https://discuss.elastic.co/t/max-number-of-segments-in-elasticsearch/62210 "2016-10-05T08:32:08Z")

</div>

Is there a parameter in elasticsearch to set the max number of underlying segments in the whole cluster? Or is there any parameters about segments? I know there's a max\_num\_segments when using the optimize API, but I'm…

---

## [Able to configure Filebeat and index in Kibana, but no data is appearing](https://discuss.elastic.co/t/able-to-configure-filebeat-and-index-in-kibana-but-no-data-is-appearing/144222)

<div class="topic-metadata">

**Author:** [@JustTheDr](https://discuss.elastic.co/u/JustTheDr)\
**Replies:** 5\
**Last updated:** [August 17, 2018, 2:46pm UTC](https://discuss.elastic.co/t/able-to-configure-filebeat-and-index-in-kibana-but-no-data-is-appearing/144222 "2018-08-17T14:46:22Z")

</div>

I was able to configure the Filebeat yaml and index it in Kibana, but no data is appearing. Service is running but no information is displaying in my discover tab or in my filebeat iis dashboard. Below is my filebeat.y…

---

## [Is Elasticsearch 7.17.9 is compatible withOpenJDK 1.8?](https://discuss.elastic.co/t/is-elasticsearch-7-17-9-is-compatible-withopenjdk-1-8/330654)

<div class="topic-metadata">

**Author:** [@kirankumarb](https://discuss.elastic.co/u/kirankumarb)\
**Replies:** 7\
**Last updated:** [April 25, 2023, 5:59am UTC](https://discuss.elastic.co/t/is-elasticsearch-7-17-9-is-compatible-withopenjdk-1-8/330654 "2023-04-25T05:59:59Z")

</div>

Is OpenJDK 1.8 version is compatible with elasticsearch 7.17.9 version? If not Which version of OpenJDK is compatible with elasticsearch 7.17.9?

---

## [Need definition of log1p,log2p, ln1p, and ln2p of field\_value\_factor modifier](https://discuss.elastic.co/t/need-definition-of-log1p-log2p-ln1p-and-ln2p-of-field-value-factor-modifier/29101)

<div class="topic-metadata">

**Author:** [@ivern](https://discuss.elastic.co/u/ivern)\
**Replies:** 2\
**Last updated:** [September 11, 2015, 1:07pm UTC](https://discuss.elastic.co/t/need-definition-of-log1p-log2p-ln1p-and-ln2p-of-field-value-factor-modifier/29101 "2015-09-11T13:07:32Z")

</div>

Hi All, I found that field\_value\_factor modifier could be none, log, log1p, log2p, ln, ln1p,ln2p, square, sqrt, or reciprocal. I am not sure about the definition of these modifiers: 1. log1p = log(1+p) 2. log2p = log(2…

---

## [Elastic search is still initializing the kibana index issue](https://discuss.elastic.co/t/elastic-search-is-still-initializing-the-kibana-index-issue/89830)

<div class="topic-metadata">

**Author:** [@ram\_vr](https://discuss.elastic.co/u/ram_vr)\
**Replies:** 6\
**Last updated:** [June 20, 2017, 7:36am UTC](https://discuss.elastic.co/t/elastic-search-is-still-initializing-the-kibana-index-issue/89830 "2017-06-20T07:36:27Z")

</div>

Hello .. I am getting Elastic search is still initializing the kibana index error while starting kibana. It was working and after few days i am getting this error while restarting elastic kibana. I have gone through si…

---

## [Rsyslog to Redis to logstash to elasticsearch without logstash forwarder?](https://discuss.elastic.co/t/rsyslog-to-redis-to-logstash-to-elasticsearch-without-logstash-forwarder/26435)

<div class="topic-metadata">

**Author:** [@kurtcoke](https://discuss.elastic.co/u/kurtcoke)\
**Replies:** 5\
**Last updated:** [December 29, 2015, 10:52pm UTC](https://discuss.elastic.co/t/rsyslog-to-redis-to-logstash-to-elasticsearch-without-logstash-forwarder/26435 "2015-12-29T22:52:50Z")

</div>

I see lots of tutorials like this one: http://www.everybodyhertz.co.uk/setting-up-a-relk-stack-a-how-to/ suggesting that you use logstash forwarder to send logs to redis before sending it to logstash and then to elastics…

---

## [How to match a word which includes white spaces?](https://discuss.elastic.co/t/how-to-match-a-word-which-includes-white-spaces/253655)

<div class="topic-metadata">

**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\
**Replies:** 2\
**Last updated:** [October 29, 2020, 9:51am UTC](https://discuss.elastic.co/t/how-to-match-a-word-which-includes-white-spaces/253655 "2020-10-29T09:51:22Z")

</div>

I have a text field named profile (with default analyzer), and I want to query with words including white spaces. For example, when I wanted to search by vice president, I created a query { "query": { { …

---

## [Field not converting to integer](https://discuss.elastic.co/t/field-not-converting-to-integer/78004)

<div class="topic-metadata">

**Author:** [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)\
**Replies:** 2\
**Last updated:** [March 9, 2017, 3:25pm UTC](https://discuss.elastic.co/t/field-not-converting-to-integer/78004 "2017-03-09T15:25:09Z")

</div>

Hi, Can anyone see why my hour field isnt converting to an integer. But my size field is. Im not getting any obvious errors anywhere to explain why input { file { type =\> "csv" path =\> "/home/callum…

---

## [Nest client. How to serialize date field to a custom format?](https://discuss.elastic.co/t/nest-client-how-to-serialize-date-field-to-a-custom-format/201562)

<div class="topic-metadata">

**Author:** [@einfoman](https://discuss.elastic.co/u/einfoman)\
**Replies:** 2\
**Last updated:** [October 6, 2019, 7:44pm UTC](https://discuss.elastic.co/t/nest-client-how-to-serialize-date-field-to-a-custom-format/201562 "2019-10-06T19:44:21Z")

</div>

Hi! I use Nest 7.3 and a default serializer. And I have a problem with date serialization. Suppose we have a model: public class SearchEntity { \[Date(Format = "date\_time\_no\_millis")\] public DateTime Timestamp …

---

## [Preventing the Logstash Log File from Filling Up Disk](https://discuss.elastic.co/t/preventing-the-logstash-log-file-from-filling-up-disk/47504)

<div class="topic-metadata">

**Author:** [@Michael1](https://discuss.elastic.co/u/Michael1)\
**Replies:** 4\
**Last updated:** [April 17, 2016, 9:25am UTC](https://discuss.elastic.co/t/preventing-the-logstash-log-file-from-filling-up-disk/47504 "2016-04-17T09:25:12Z")

</div>

Hello All, Recently I had an issue on one of my ELK nodes where it would not start for some reason. The issue was investigated further and it turns out that the Logstash log file was eating up all of the disk space for…

---

## [Slow speed of ANN dense vector search using \_knn\_search](https://discuss.elastic.co/t/slow-speed-of-ann-dense-vector-search-using-knn-search/307448)

<div class="topic-metadata">

**Author:** [@jalustig](https://discuss.elastic.co/u/jalustig)\
**Replies:** 7\
**Last updated:** [June 24, 2022, 2:40am UTC](https://discuss.elastic.co/t/slow-speed-of-ann-dense-vector-search-using-knn-search/307448 "2022-06-24T02:40:03Z")

</div>

I'm building out a vector search application with 384 dimensional vectors. So far I have about 3 million documents in my Elasticsearch database using with a dense\_vector field. There are currently 8 shards (I am expectin…

---

## [Expected numeric type on field \[...\], but got \[keyword\]](https://discuss.elastic.co/t/expected-numeric-type-on-field-but-got-keyword/131997)

<div class="topic-metadata">

**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\
**Replies:** 5\
**Last updated:** [May 16, 2018, 3:10pm UTC](https://discuss.elastic.co/t/expected-numeric-type-on-field-but-got-keyword/131997 "2018-05-16T15:10:55Z")

</div>

In 6.2.4 I have a machine learning job with a summary count that is set to a keyword field. It runs just fine. In the anomaly explorer I select an anomaly and click on Open Link / View series. That opens a new window tha…

---

## [Show Current Date and Time in Kibana Dashboard](https://discuss.elastic.co/t/show-current-date-and-time-in-kibana-dashboard/217312)

<div class="topic-metadata">

**Author:** [@Aadesh\_Sharma](https://discuss.elastic.co/u/Aadesh_Sharma)\
**Replies:** 4\
**Last updated:** [January 31, 2020, 11:35am UTC](https://discuss.elastic.co/t/show-current-date-and-time-in-kibana-dashboard/217312 "2020-01-31T11:35:45Z")

</div>

Hi, Is there any way to show current date and time in kibana dashboard. I have tried so many ways but nothing worked

---

## [Install .gem file offline in Logstash](https://discuss.elastic.co/t/install-gem-file-offline-in-logstash/107207)

<div class="topic-metadata">

**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\
**Replies:** 3\
**Last updated:** [November 13, 2017, 6:28am UTC](https://discuss.elastic.co/t/install-gem-file-offline-in-logstash/107207 "2017-11-13T06:28:37Z")

</div>

Hi i am trying to install the logstash-codec-json\_lines plugin on one of our Logstash server which does not have internet access . I get following error below message when trying to install the plugin . I have tried to…

---

## [Metricbeat for SQL Server](https://discuss.elastic.co/t/metricbeat-for-sql-server/135436)

<div class="topic-metadata">

**Author:** [@tgspacelabs](https://discuss.elastic.co/u/tgspacelabs)\
**Replies:** 6\
**Last updated:** [June 13, 2018, 2:42pm UTC](https://discuss.elastic.co/t/metricbeat-for-sql-server/135436 "2018-06-13T14:42:33Z")

</div>

I am trying to create perfmon counters for SQL Server in metricbeat. I added the following to my metricbeat.yml file but the service will not start properly. The service starts fine when the SQL Server perfmon counter …

---

## [Problem Computing Euclidean Distance using script score query](https://discuss.elastic.co/t/problem-computing-euclidean-distance-using-script-score-query/148823)

<div class="topic-metadata">

**Author:** [@Vaibhav\_Thapliyal](https://discuss.elastic.co/u/Vaibhav_Thapliyal)\
**Replies:** 7\
**Last updated:** [September 17, 2018, 8:02pm UTC](https://discuss.elastic.co/t/problem-computing-euclidean-distance-using-script-score-query/148823 "2018-09-17T20:02:58Z")

</div>

Hi Everyone, I am trying to build a reverse image/Image Similarity functionality using Elasticsearch. I have successfully indexed the feature vectors in Elasticsearch as an array which looks something like this: "featu…

---

## [Docs for manually enrolling cluster nodes without enrollment tokens?](https://discuss.elastic.co/t/docs-for-manually-enrolling-cluster-nodes-without-enrollment-tokens/332681)

<div class="topic-metadata">

**Author:** [@andrew.klaassen](https://discuss.elastic.co/u/andrew.klaassen)\
**Replies:** 2\
**Last updated:** [May 8, 2023, 6:40pm UTC](https://discuss.elastic.co/t/docs-for-manually-enrolling-cluster-nodes-without-enrollment-tokens/332681 "2023-05-08T18:40:38Z")

</div>

I'm trying to set up an Elasticsearch cluster using auto-renewing certs with certmonger from our enterprise CA. I'm running into a problem that has been discussed in many threads, where the answer always seems to be som…

---

## [Timelion split not showing descending results](https://discuss.elastic.co/t/timelion-split-not-showing-descending-results/97586)

<div class="topic-metadata">

**Author:** [@Oferkes](https://discuss.elastic.co/u/Oferkes)\
**Replies:** 7\
**Last updated:** [August 24, 2017, 3:56am UTC](https://discuss.elastic.co/t/timelion-split-not-showing-descending-results/97586 "2017-08-24T03:56:53Z")

</div>

Hi, the following timelion query: .es(index='9x',timefield='SampleTime',metric='avg:volume\_nfs\_write\_data',split='volume\_instance\_name:10',q='volume\_instance\_name:x123').add(0.0001).fit('average').subtract(0.0001).divi…

---

## [Performance under concurrent queries](https://discuss.elastic.co/t/performance-under-concurrent-queries/5973)

<div class="topic-metadata">

**Author:** [@Hugh\_Miles](https://discuss.elastic.co/u/Hugh_Miles)\
**Replies:** 6\
**Last updated:** [November 30, 2011, 4:06pm UTC](https://discuss.elastic.co/t/performance-under-concurrent-queries/5973 "2011-11-30T16:06:48Z")

</div>

Hi, I've been testing concurrent search queries using JMeter. I have an index with two types: commenttab contains around 725k documents, hierarchy contains just 2600 documents. I run faceted and straight queries.…

---

## [Partial snapshot of a cluster](https://discuss.elastic.co/t/partial-snapshot-of-a-cluster/88666)

<div class="topic-metadata">

**Author:** [@shubham9799](https://discuss.elastic.co/u/shubham9799)\
**Replies:** 3\
**Last updated:** [June 12, 2017, 2:50pm UTC](https://discuss.elastic.co/t/partial-snapshot-of-a-cluster/88666 "2017-06-12T14:50:05Z")

</div>

I want to know about snapshot feature of elasticSearch. While taking snapshot what if one of my node is not working? Can I still take the snapshot. If yes, will elastic search able to take the snapshot of all the shards(…

---

## [Discover empty fields fails in 4.0.2](https://discuss.elastic.co/t/discover-empty-fields-fails-in-4-0-2/1841)

<div class="topic-metadata">

**Author:** [@tmoeller](https://discuss.elastic.co/u/tmoeller)\
**Replies:** 4\
**Last updated:** [March 19, 2017, 3:29am UTC](https://discuss.elastic.co/t/discover-empty-fields-fails-in-4-0-2/1841 "2017-03-19T03:29:37Z")

</div>

Hi, during analysis i found some fields in my index were empty. For quality improvement in the source system (needs manual updates) i tried to discover all rows where specific fields are empty. But non of the searches …

---

## [Stashing Your First Event - Unknown Command '{' error](https://discuss.elastic.co/t/stashing-your-first-event-unknown-command-error/129686)

<div class="topic-metadata">

**Author:** [@yckoh](https://discuss.elastic.co/u/yckoh)\
**Replies:** 2\
**Last updated:** [April 27, 2018, 1:01am UTC](https://discuss.elastic.co/t/stashing-your-first-event-unknown-command-error/129686 "2018-04-27T01:01:01Z")

</div>

Hi, sorry I'm new to Logstash but I tried following the guide and got stuck with the following in my cmd prompt (I'm running on Windows). Is there something I missed?: \[image\]

---

## [Logstash always tries to connect to ES](https://discuss.elastic.co/t/logstash-always-tries-to-connect-to-es/86188)

<div class="topic-metadata">

**Author:** [@John\_06](https://discuss.elastic.co/u/John_06)\
**Replies:** 5\
**Last updated:** [May 22, 2017, 3:57pm UTC](https://discuss.elastic.co/t/logstash-always-tries-to-connect-to-es/86188 "2017-05-22T15:57:48Z")

</div>

I am forwarding logs from Logstash to Kafka but Logstash always tries to connect to ES at http://localhost:9200/ \[2017-05-18T03:45:49,875\]\[INFO \]\[logstash.agent \] Successfully started Logstash API endpoint {:…

---

## [Enable SSL/TLS on Windows](https://discuss.elastic.co/t/enable-ssl-tls-on-windows/75058)

<div class="topic-metadata">

**Author:** [@mduckett1](https://discuss.elastic.co/u/mduckett1)\
**Replies:** 4\
**Last updated:** [February 15, 2017, 1:19pm UTC](https://discuss.elastic.co/t/enable-ssl-tls-on-windows/75058 "2017-02-15T13:19:04Z")

</div>

Hi, I've installed ELK 5.2 with x-pack and am currently trying to implement secure communication but can't seem to get it to work. I have followed Setting Up TLS on a Cluster | X-Pack for the Elastic Stack \[6.2\] | Elas…

---

## [Node.js client and ECONNRESET](https://discuss.elastic.co/t/node-js-client-and-econnreset/1930)

<div class="topic-metadata">

**Author:** [@stejcz](https://discuss.elastic.co/u/stejcz)\
**Replies:** 1\
**Last updated:** [June 8, 2015, 6:57am UTC](https://discuss.elastic.co/t/node-js-client-and-econnreset/1930 "2015-06-08T06:57:28Z")

</div>

Hi, I'm trying to query elasticsearch from node.js and from time to time I get error \[Error: read ECONNRESET\] code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read'. The queries goes one after other, quite quickly…

---

## [RemoteTransportException - AlreadyClosedException\[this IndexReader is closed\]](https://discuss.elastic.co/t/remotetransportexception-alreadyclosedexception-this-indexreader-is-closed/49577)

<div class="topic-metadata">

**Author:** [@brettinman](https://discuss.elastic.co/u/brettinman)\
**Replies:** 5\
**Last updated:** [June 15, 2016, 3:13pm UTC](https://discuss.elastic.co/t/remotetransportexception-alreadyclosedexception-this-indexreader-is-closed/49577 "2016-06-15T15:13:34Z")

</div>

This looks like an error on the internal transport but I'm not sure why it's happening. The cluster is green and otherwise happy, ingesting 6-700GB a day across 20 data nodes (20 shards per index). We are having some iss…

---

## [Changing the default operator for search API](https://discuss.elastic.co/t/changing-the-default-operator-for-search-api/47033)

<div class="topic-metadata">

**Author:** [@tchatterjee](https://discuss.elastic.co/u/tchatterjee)\
**Replies:** 5\
**Last updated:** [April 19, 2016, 2:04pm UTC](https://discuss.elastic.co/t/changing-the-default-operator-for-search-api/47033 "2016-04-19T14:04:59Z")

</div>

Hi, I am new to Elastic search. The default\_operator for search is configured as OR in the engine and I would like to change it to AND at the back end so that the client API does not need to change. Can someone please he…

---

## [Elasticsearch fills the heap then spends all its time doing garbage collection](https://discuss.elastic.co/t/elasticsearch-fills-the-heap-then-spends-all-its-time-doing-garbage-collection/21293)

<div class="topic-metadata">

**Author:** [@Wilfred\_Hughes](https://discuss.elastic.co/u/Wilfred_Hughes)\
**Replies:** 4\
**Last updated:** [December 17, 2014, 5:44pm UTC](https://discuss.elastic.co/t/elasticsearch-fills-the-heap-then-spends-all-its-time-doing-garbage-collection/21293 "2014-12-17T17:44:14Z")

</div>

Hi folks After a few hours/days of uptime, our elasticsearch cluster is spending all its time in GC. We're forced to restart nodes to bring response times back to what they should be. We're using G1GC with a 25 Gi…

---

## [How to search in an array passing multiple values](https://discuss.elastic.co/t/how-to-search-in-an-array-passing-multiple-values/196603)

<div class="topic-metadata">

**Author:** [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Replies:** 2\
**Last updated:** [August 29, 2019, 7:15pm UTC](https://discuss.elastic.co/t/how-to-search-in-an-array-passing-multiple-values/196603 "2019-08-29T19:15:04Z")

</div>

I have filed with multiple values, { "applids": \[ "6512708", " 8234215" \] } how to pass multiple values and search ?

---

## [Creating arrays in ruby](https://discuss.elastic.co/t/creating-arrays-in-ruby/102109)

<div class="topic-metadata">

**Author:** [@fluffierbump](https://discuss.elastic.co/u/fluffierbump)\
**Replies:** 4\
**Last updated:** [September 28, 2017, 1:52pm UTC](https://discuss.elastic.co/t/creating-arrays-in-ruby/102109 "2017-09-28T13:52:28Z")

</div>

I am trying to set an event with multiple records in an array as follows ruby { code =\> " begin event.set('\[fieldname\]\[0\]', 'This is record 0') event.set('\[fieldna…

---

## [Acronym Search](https://discuss.elastic.co/t/acronym-search/27077)

<div class="topic-metadata">

**Author:** [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\
**Replies:** 4\
**Last updated:** [August 10, 2015, 3:59am UTC](https://discuss.elastic.co/t/acronym-search/27077 "2015-08-10T03:59:08Z")

</div>

Hi Is there any option to match Acronym from Indexed data. For example, In the indexed document I have Internet Of Things --\> IoT Master of Science -- \> MS United States --\> USA Thanks

---

## [Number of concurrent search requests on ElasticSearch cluster](https://discuss.elastic.co/t/number-of-concurrent-search-requests-on-elasticsearch-cluster/339144)

<div class="topic-metadata">

**Author:** [@Mohit\_Munjal](https://discuss.elastic.co/u/Mohit_Munjal)\
**Replies:** 3\
**Last updated:** [July 25, 2023, 6:22am UTC](https://discuss.elastic.co/t/number-of-concurrent-search-requests-on-elasticsearch-cluster/339144 "2023-07-25T06:22:35Z")

</div>

My objective is to calculate 2 things Q1: how many search requests can a elasticsearch cluster can work on at once Q2: how many search requests can a elasticsearch cluster hold in it's queue before starting rejecting i…

---

## [Logs and Metrics apps disappeared from Kibana after upgrading to 7.7](https://discuss.elastic.co/t/logs-and-metrics-apps-disappeared-from-kibana-after-upgrading-to-7-7/232753)

<div class="topic-metadata">

**Author:** [@dRm42](https://discuss.elastic.co/u/dRm42)\
**Replies:** 6\
**Last updated:** [May 15, 2020, 7:50pm UTC](https://discuss.elastic.co/t/logs-and-metrics-apps-disappeared-from-kibana-after-upgrading-to-7-7/232753 "2020-05-15T19:50:16Z")

</div>

Hi There, I've upgraded Elasticsearch and Kibana from 7.5.1 to 7.7. Apart from the monitoring (deprecation of some x-pack functionalities) the upgrade was reasonably smooth. However, when I loaded the new version of Kib…

---

## [Filebeat v6 and elasticsearch v6](https://discuss.elastic.co/t/filebeat-v6-and-elasticsearch-v6/107925)

<div class="topic-metadata">

**Author:** [@Gianluca\_Tranelli](https://discuss.elastic.co/u/Gianluca_Tranelli)\
**Replies:** 6\
**Last updated:** [December 5, 2017, 3:54pm UTC](https://discuss.elastic.co/t/filebeat-v6-and-elasticsearch-v6/107925 "2017-12-05T15:54:27Z")

</div>

I set up filebeat and elasticsearch on the same machine and till v5.6 all was working good. Now in elasticsearch log i found the following error line each per event: 2017-11-16T12:45:06+01:00 WARN Can not index event (…

---

## [Logstash different index names per input?](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806)

<div class="topic-metadata">

**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Replies:** 6\
**Last updated:** [October 13, 2016, 11:19am UTC](https://discuss.elastic.co/t/logstash-different-index-names-per-input/62806 "2016-10-13T11:19:49Z")

</div>

I have this logstash config but beats documents get created with index "log-2016.10.12" that is the document\_tpye instead of filebeat-xxx. Any idea on how i can set the index name to filebeat and snmptrap index to snmpt…

---

## [Aggregating by hour](https://discuss.elastic.co/t/aggregating-by-hour/18522)

<div class="topic-metadata">

**Author:** [@Jenny\_Blunt](https://discuss.elastic.co/u/Jenny_Blunt)\
**Replies:** 3\
**Last updated:** [July 9, 2014, 10:46am UTC](https://discuss.elastic.co/t/aggregating-by-hour/18522 "2014-07-09T10:46:57Z")

</div>

I was sort of expecting the following to give me an aggregation which groups the results only by hour: curl http://localhost:9000/stream/\_search -d '{ "aggs" : { "visitor\_count" : { "date\_histogram"…

---

## [ILM action status - Waiting for all shard copies to be active](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209)

<div class="topic-metadata">

**Author:** [@braham](https://discuss.elastic.co/u/braham)\
**Replies:** 8\
**Last updated:** [June 9, 2021, 5:27am UTC](https://discuss.elastic.co/t/ilm-action-status-waiting-for-all-shard-copies-to-be-active/274209 "2021-06-09T05:27:19Z")

</div>

Hello, We have configured ILM policy but it's changing the phase "hot" to "warm" but after that not changing further phases like "cold" and "delete". We see action status "Waiting for all shard copies to be active". I…

[Previous page](https://discuss.elastic.co/top.md?page=403&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=405&per_page=50&period=all)
