# Top **URL:** https://discuss.elastic.co/top.md?page=409&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 410 --- ## [Skip\_on\_invalid\_json skipping all filters](https://discuss.elastic.co/t/skip-on-invalid-json-skipping-all-filters/215195)
**Author:** [@jfcantu](https://discuss.elastic.co/u/jfcantu)\ **Replies:** 3\ **Last updated:** [January 16, 2020, 12:06am UTC](https://discuss.elastic.co/t/skip-on-invalid-json-skipping-all-filters/215195 "2020-01-16T00:06:54Z")
Hi, I ran across something unexpected yesterday, that doesn't seem to line up with the Logstash documentation, and I was wondering if this was intended behavior (or if I did something wrong.) TL;DR - if you have multip… --- ## [Function: cloudwatch, could not deploy, error: bucket 'functionbeat-deploy' already exist and you don't have permission to access it](https://discuss.elastic.co/t/function-cloudwatch-could-not-deploy-error-bucket-functionbeat-deploy-already-exist-and-you-dont-have-permission-to-access-it/293455)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 5\ **Last updated:** [February 28, 2022, 9:10am UTC](https://discuss.elastic.co/t/function-cloudwatch-could-not-deploy-error-bucket-functionbeat-deploy-already-exist-and-you-dont-have-permission-to-access-it/293455 "2022-02-28T09:10:26Z")
I had version 7.12 deployed of functionbeat, i removed it successfully using ./functionbeat -v -e -d "\*" remove cloudwatch I then configurd version 7.16 version of functionbeat and i am trying to deploy it but i get the… --- ## ["\_grokparsefailure"](https://discuss.elastic.co/t/-grokparsefailure/24786)
**Author:** [@ABecker](https://discuss.elastic.co/u/ABecker)\ **Replies:** 4\ **Last updated:** [July 10, 2015, 11:09am UTC](https://discuss.elastic.co/t/-grokparsefailure/24786 "2015-07-10T11:09:12Z")
Hello, I have a problem with one of my grok-filters. I know why this problem occur, but I don't know how I can fix it. The grokparsefailure occur because of the smaller "\<" and greater "\>" characters within the mess… --- ## [ES 6.2 Percolator causes very high CPU utilization](https://discuss.elastic.co/t/es-6-2-percolator-causes-very-high-cpu-utilization/128093)
**Author:** [@meghna1292](https://discuss.elastic.co/u/meghna1292)\ **Replies:** 1\ **Last updated:** [April 18, 2018, 12:20pm UTC](https://discuss.elastic.co/t/es-6-2-percolator-causes-very-high-cpu-utilization/128093 "2018-04-18T12:20:25Z")
Hi, I am currently using AWS ES 6.2 for the percolator. I have a dedicated cluster for the percolator which has a single index that contains ~16,000 percolator queries (~30MB). I have about 10000 percolator query invoc… --- ## [Fail to install Elastic-Agent](https://discuss.elastic.co/t/fail-to-install-elastic-agent/322495)
**Author:** [@pntmky](https://discuss.elastic.co/u/pntmky)\ **Replies:** 8\ **Last updated:** [January 5, 2023, 7:46am UTC](https://discuss.elastic.co/t/fail-to-install-elastic-agent/322495 "2023-01-05T07:46:33Z")
First of all, I installed Elastic Agent by DEB successfully, but I realize that cannot upgrade, so I uninstall Elastic Agent and remove installation layout of Elastic Agent. And now when I install by Linux Tar, it fai… --- ## [Could not execute action: PipelineAction::Create\](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main/298454)
**Author:** [@sath](https://discuss.elastic.co/u/sath)\ **Replies:** 6\ **Last updated:** [March 1, 2022, 7:17pm UTC](https://discuss.elastic.co/t/could-not-execute-action-pipelineaction-create-main/298454 "2022-03-01T19:17:41Z")
Hello, Logstash isn't able to create the index, that's what my conclusion is after checking the logs. pipeline.yml - pipeline.id: main path.config: "/etc/logstash/conf.d/1.conf" 1.conf: input { beats { … --- ## [Adding Labels to Visualizations](https://discuss.elastic.co/t/adding-labels-to-visualizations/56650)
**Author:** [@sthropp](https://discuss.elastic.co/u/sthropp)\ **Replies:** 1\ **Last updated:** [July 29, 2016, 11:49pm UTC](https://discuss.elastic.co/t/adding-labels-to-visualizations/56650 "2016-07-29T23:49:48Z")
I have just started working with Kibana and I wondering if there is a way to add labels to the actual parts of a visualization (e.g., add a text string label to the parts of a pie chart). Right now I can hover over the … --- ## [\[Parent-child deletion\] documentation says routing is required but without routing it works. \[ES 6.5v\]](https://discuss.elastic.co/t/parent-child-deletion-documentation-says-routing-is-required-but-without-routing-it-works-es-6-5v/163290)
**Author:** [@mashhur](https://discuss.elastic.co/u/mashhur)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 4:49am UTC](https://discuss.elastic.co/t/parent-child-deletion-documentation-says-routing-is-required-but-without-routing-it-works-es-6-5v/163290 "2019-01-10T04:49:24Z")
Hi there, I have started using Elasticsearch 6.5 version with parent-child actions (mapping, indexing, updating, deleting). In case of delete, documentation says ROUTING value is required. In a reality ROUTING value is … --- ## [Create mapping error！——primary shard is not active Timeout](https://discuss.elastic.co/t/create-mapping-error-primary-shard-is-not-active-timeout/88174)
**Author:** [@laoyang360](https://discuss.elastic.co/u/laoyang360)\ **Replies:** 1\ **Last updated:** [June 9, 2017, 11:29am UTC](https://discuss.elastic.co/t/create-mapping-error-primary-shard-is-not-active-timeout/88174 "2017-06-09T11:29:22Z")
The original ES2.3.4 with 1 node, create mapping and index success. And later changed to distributed, extended to three nodes. Build a distributed environment successfully. However, after creating the index, the foll… --- ## [Visualization of processes](https://discuss.elastic.co/t/visualization-of-processes/49740)
**Author:** [@fred-d](https://discuss.elastic.co/u/fred-d)\ **Replies:** 8\ **Last updated:** [May 18, 2016, 7:00am UTC](https://discuss.elastic.co/t/visualization-of-processes/49740 "2016-05-18T07:00:53Z")
I'm trying to visualize data from process or workflow executions and I encountered a few challenges: They have a duration (start and stop time). They can have inputs and outputs. They can have an explicit structure (proc… --- ## [Hit Counts within a Document](https://discuss.elastic.co/t/hit-counts-within-a-document/19643)
**Author:** [@Darren\_Trzynka](https://discuss.elastic.co/u/Darren_Trzynka)\ **Replies:** 6\ **Last updated:** [September 10, 2014, 10:41am UTC](https://discuss.elastic.co/t/hit-counts-within-a-document/19643 "2014-09-10T10:41:16Z")
In our current application, it is important to know the number of times hits were found within a document for a given search. We are considering using elasticsearch but this is one area I have yet to find a solution… --- ## [Grok filter with spaces in field](https://discuss.elastic.co/t/grok-filter-with-spaces-in-field/91796)
**Author:** [@matt.wilcock](https://discuss.elastic.co/u/matt.wilcock)\ **Replies:** 4\ **Last updated:** [July 5, 2017, 12:18pm UTC](https://discuss.elastic.co/t/grok-filter-with-spaces-in-field/91796 "2017-07-05T12:18:36Z")
Hi, I'm trying to work out how to build a grok filter with spaces in one of the fields but I'm not sure how to do it. The log looks like this: 2017-06-28 14:13:05 Coordinated Universal Time INFO \[1234:0x0000019f\] Loa… --- ## [Logstash runs from command line but not as a service](https://discuss.elastic.co/t/logstash-runs-from-command-line-but-not-as-a-service/2599)
**Author:** [@stuayre](https://discuss.elastic.co/u/stuayre)\ **Replies:** 2\ **Last updated:** [June 12, 2015, 8:50pm UTC](https://discuss.elastic.co/t/logstash-runs-from-command-line-but-not-as-a-service/2599 "2015-06-12T20:50:00Z")
I have logstash and elastic search installed. I'm trying to get logstash to read a csv file and populate ES everything works fine when I run logstash from the command line using: sudo /opt/logstash/bin/logstash -f… --- ## [Reducing Memory Consuption while Bulk Indexing](https://discuss.elastic.co/t/reducing-memory-consuption-while-bulk-indexing/26447)
**Author:** [@klahnakoski](https://discuss.elastic.co/u/klahnakoski)\ **Replies:** 8\ **Last updated:** [July 29, 2015, 5:57pm UTC](https://discuss.elastic.co/t/reducing-memory-consuption-while-bulk-indexing/26447 "2015-07-29T17:57:18Z")
I seems bulk indexing is using a lot of memory. It is not for long, but the day sees much more indexing demand than shown here. Is there a way I can reduce memory required during indexing, while still keeping the indexi… --- ## [Dissect Filter Special Characters](https://discuss.elastic.co/t/dissect-filter-special-characters/98296)
**Author:** [@AO-StreetArt](https://discuss.elastic.co/u/AO-StreetArt)\ **Replies:** 6\ **Last updated:** [September 8, 2017, 5:25pm UTC](https://discuss.elastic.co/t/dissect-filter-special-characters/98296 "2017-09-08T17:25:52Z")
I am trying to use dissect to break apart a multi-line string which contains the characters ‘{’ and ‘}’ in what will be a delimiter. To do this, I would need to use escape characters (such as ‘\\n’) within the dissect fi… --- ## [Logstash hardware requirements](https://discuss.elastic.co/t/logstash-hardware-requirements/316851)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 1\ **Last updated:** [October 18, 2022, 1:55pm UTC](https://discuss.elastic.co/t/logstash-hardware-requirements/316851 "2022-10-18T13:55:32Z")
Hello, I'm going to install logstash in a Linux VM. I'm trying to find out the best hardware requirements for this VM so that logstash could handle the amount of data expected as smooth as possible. The amount of data … --- ## [How to define multiple indexes for different logs in Filebeat and Logstash?](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498)
**Author:** [@daiyue](https://discuss.elastic.co/u/daiyue)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 4:10am UTC](https://discuss.elastic.co/t/how-to-define-multiple-indexes-for-different-logs-in-filebeat-and-logstash/57498 "2016-08-09T04:10:16Z")
Hi, I have configured a log server, i.e. Filebeat -\> Logstash -\> Elasticsearch -\> Kibana. I am wondering how to create separated indexes for different logs (fetched using Filebeat) in logstash (which were later passed on… --- ## [Cannot uninstall X-pack](https://discuss.elastic.co/t/cannot-uninstall-x-pack/121173)
**Author:** [@Suryakumar](https://discuss.elastic.co/u/Suryakumar)\ **Replies:** 4\ **Last updated:** [February 26, 2018, 10:38am UTC](https://discuss.elastic.co/t/cannot-uninstall-x-pack/121173 "2018-02-26T10:38:15Z")
Hi, I have installed X-Pack in a curiosity to know how it works. Now I want to uninstall it. But I cannot uninstall. When I try uninstalling with these commands: bin/elasticsearch-plugin remove x-pack I am getting a… --- ## [Elasticsearch: OpenJDK 64-Bit Server VM warning](https://discuss.elastic.co/t/elasticsearch-openjdk-64-bit-server-vm-warning/109428)
**Author:** [@chenfan](https://discuss.elastic.co/u/chenfan)\ **Replies:** 1\ **Last updated:** [November 28, 2017, 6:46pm UTC](https://discuss.elastic.co/t/elasticsearch-openjdk-64-bit-server-vm-warning/109428 "2017-11-28T18:46:49Z")
i hava a quesstion for it,when i have install x-pack6.0 and add "action.auto\_create\_index: .security,.monitoring\*,.watches,.triggered\_watches,.watcher-history\*,.ml\*"=\>/etc/elasticsearch/elasticsearch.yml /usr/share/ela… --- ## [Response mapping](https://discuss.elastic.co/t/response-mapping/11089)
**Author:** [@Mihai\_Cazacu](https://discuss.elastic.co/u/Mihai_Cazacu)\ **Replies:** 7\ **Last updated:** [March 12, 2013, 8:49am UTC](https://discuss.elastic.co/t/response-mapping/11089 "2013-03-12T08:49:26Z")
Hi, Is there an automatic way to map a search result like http://www.elasticsearch.org/guide/reference/api/search/fields.html to the correspondig object type? Let's say that I have stored a "Person" object with first… --- ## [Error 403 when log camin on logstah](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359)
**Author:** [@egalizia](https://discuss.elastic.co/u/egalizia)\ **Replies:** 6\ **Last updated:** [July 11, 2017, 9:11am UTC](https://discuss.elastic.co/t/error-403-when-log-camin-on-logstah/92359 "2017-07-11T09:11:53Z")
HI I install and configure ELK and all work I install the x-pack needed to get authentication to see log and got same problem on logstash when log start caming from nxlog I got this error \[2017-07-08T13:09:13,837\]\[ERR… --- ## [Have Logstash take a file containing an array of JSON objects](https://discuss.elastic.co/t/have-logstash-take-a-file-containing-an-array-of-json-objects/150233)
**Author:** [@Jedeu](https://discuss.elastic.co/u/Jedeu)\ **Replies:** 4\ **Last updated:** [September 28, 2018, 9:51pm UTC](https://discuss.elastic.co/t/have-logstash-take-a-file-containing-an-array-of-json-objects/150233 "2018-09-28T21:51:22Z")
Hi all, I've been trying to use various input and filter plugins to take a JSON file containing an array of prettified json objects and spit out an event for each object. I've scoured SO and this forum and found a coupl… --- ## [Download Logs from ELK](https://discuss.elastic.co/t/download-logs-from-elk/94806)
**Author:** [@JK\_T](https://discuss.elastic.co/u/JK_T)\ **Replies:** 1\ **Last updated:** [July 27, 2017, 5:12pm UTC](https://discuss.elastic.co/t/download-logs-from-elk/94806 "2017-07-27T17:12:35Z")
Hi Guys We are very new to ELK stack operation. It will be great if you can share us process or steps to download logs. Kibana verision is 4.3.1. We are unable to create visualization having all log entries to dow… --- ## [How to Load the Excel to Elastic Search in Windows Environment](https://discuss.elastic.co/t/how-to-load-the-excel-to-elastic-search-in-windows-environment/79851)
**Author:** [@Senthilkumar\_Veerara](https://discuss.elastic.co/u/Senthilkumar_Veerara)\ **Replies:** 2\ **Last updated:** [March 24, 2017, 9:30am UTC](https://discuss.elastic.co/t/how-to-load-the-excel-to-elastic-search-in-windows-environment/79851 "2017-03-24T09:30:09Z")
Dear All , I would like to Know , How to load the CSV Format file into the Elastic Search 5.2.2 Version. Since Im New to this I would like to know in details. Thanks for your Help ! BR, VPS --- ## [Shield Alternative](https://discuss.elastic.co/t/shield-alternative/51891)
**Author:** [@ivanandrianto95](https://discuss.elastic.co/u/ivanandrianto95)\ **Replies:** 5\ **Last updated:** [June 9, 2016, 6:58am UTC](https://discuss.elastic.co/t/shield-alternative/51891 "2016-06-09T06:58:55Z")
I protected Kibana and elasticsearch with shield. The problem is it's only 30-day trial. Is there another way to protect Kibana and elasticsearch and how to do it? --- ## [Calculating duration between two documents in Elasticsearch](https://discuss.elastic.co/t/calculating-duration-between-two-documents-in-elasticsearch/92858)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 2\ **Last updated:** [June 20, 2018, 10:22am UTC](https://discuss.elastic.co/t/calculating-duration-between-two-documents-in-elasticsearch/92858 "2018-06-20T10:22:13Z")
Hi, I'm collecting logs from an application recording the start time. Then another record is signifying the end time. Both records have to match on DeviceId and a CorrelationId. I'm using an ingest pipeline to proc… --- ## [Sorting on nested aggregation buckets](https://discuss.elastic.co/t/sorting-on-nested-aggregation-buckets/58898)
**Author:** [@amajumdarinfa](https://discuss.elastic.co/u/amajumdarinfa)\ **Replies:** 6\ **Last updated:** [August 25, 2016, 9:23pm UTC](https://discuss.elastic.co/t/sorting-on-nested-aggregation-buckets/58898 "2016-08-25T21:23:24Z")
Hi I was trying to create ElasticSearch query which is equivalent to the following SQL query -- SELECT colA, colB, colC, SUM(colD) as totalD from T GROUP BY colA, colB, colC ORDER BY totalD DESC, colB ASC, colC ASC … --- ## [Get index size result](https://discuss.elastic.co/t/get-index-size-result/138228)
**Author:** [@emil.mirzayev](https://discuss.elastic.co/u/emil.mirzayev)\ **Replies:** 8\ **Last updated:** [July 3, 2018, 11:14am UTC](https://discuss.elastic.co/t/get-index-size-result/138228 "2018-07-03T11:14:37Z")
Hi ! When I run GET indexname/\_stats do I get the size of that index without it's replicas, or with replicas included? If the 2nd, where I can find how many replicas of that index I have? thanks beforehand. Part of… --- ## [How to send a query as String with the Java API Rest](https://discuss.elastic.co/t/how-to-send-a-query-as-string-with-the-java-api-rest/190536)
**Author:** [@matheusribeirogarcia](https://discuss.elastic.co/u/matheusribeirogarcia)\ **Replies:** 7\ **Last updated:** [July 15, 2019, 6:20pm UTC](https://discuss.elastic.co/t/how-to-send-a-query-as-string-with-the-java-api-rest/190536 "2019-07-15T18:20:01Z")
Hello, I'm trying to send a Update request using a Query as String, but to write an query in JSON format in java, I have to use ", but the parser can't understand this characters, what could I do? For example, having th… --- ## [How set up to listen on external IP AND localhost?](https://discuss.elastic.co/t/how-set-up-to-listen-on-external-ip-and-localhost/110207)
**Author:** [@Jose\_Ramierez](https://discuss.elastic.co/u/Jose_Ramierez)\ **Replies:** 1\ **Last updated:** [December 4, 2017, 9:25pm UTC](https://discuss.elastic.co/t/how-set-up-to-listen-on-external-ip-and-localhost/110207 "2017-12-04T21:25:06Z")
5.6.4 So it comes up stock on localhost. Fine. Then I set "network.host" in .config to the system IP, and now it no longer listens on localhost. This is a pita, because I can't run the same commands on all the cluste… --- ## [:sql\_last\_value doesn't reiterate with multiple jdbc inputs](https://discuss.elastic.co/t/sql-last-value-doesnt-reiterate-with-multiple-jdbc-inputs/63523)
**Author:** [@wmedlen](https://discuss.elastic.co/u/wmedlen)\ **Replies:** 7\ **Last updated:** [October 30, 2016, 10:28pm UTC](https://discuss.elastic.co/t/sql-last-value-doesnt-reiterate-with-multiple-jdbc-inputs/63523 "2016-10-30T22:28:44Z")
I hope my title wasn't confusing - we have 2 jdbc inputs in our logstash config, one that pulls a commentid and one that pulls a messageid from our application. the messageid does not get added to logstash unless I … --- ## [Apm server error logs-apm.error not found](https://discuss.elastic.co/t/apm-server-error-logs-apm-error-not-found/298766)
**Author:** [@swchandu](https://discuss.elastic.co/u/swchandu)\ **Replies:** 2\ **Last updated:** [March 8, 2022, 6:54am UTC](https://discuss.elastic.co/t/apm-server-error-logs-apm-error-not-found/298766 "2022-03-08T06:54:29Z")
Hi, I have done an upgrade to Elasticsearch 8 and after this, I am finding a strange message in the apm server (8.0.0) logs "precondition 'apm integration installed' failed: error querying Elasticsearch for integration… --- ## [Resize disk of a stateful set](https://discuss.elastic.co/t/resize-disk-of-a-stateful-set/219758)
**Author:** [@dg\_hivebrite](https://discuss.elastic.co/u/dg_hivebrite)\ **Replies:** 5\ **Last updated:** [March 2, 2021, 2:54pm UTC](https://discuss.elastic.co/t/resize-disk-of-a-stateful-set/219758 "2021-03-02T14:54:00Z")
Hi, I have a cluster and I want to resize disks in my cluster. The storage class is "ssd" a custom storage class name with the following definition: allowVolumeExpansion: true apiVersion: storage.k8s.io/v1 ki… --- ## [Creating custom fields and populating them from log data](https://discuss.elastic.co/t/creating-custom-fields-and-populating-them-from-log-data/75105)
**Author:** [@sam281](https://discuss.elastic.co/u/sam281)\ **Replies:** 4\ **Last updated:** [February 15, 2017, 8:59pm UTC](https://discuss.elastic.co/t/creating-custom-fields-and-populating-them-from-log-data/75105 "2017-02-15T20:59:21Z")
HI, Can somebody help me in creating and populating the custom fields from log data which is being ingested in to ES using file beats? I have gone through some of the documentation which discusses about Fields and Fields… --- ## [Unavailable Shard Exception](https://discuss.elastic.co/t/unavailable-shard-exception/6942)
**Author:** [@vibin](https://discuss.elastic.co/u/vibin)\ **Replies:** 2\ **Last updated:** [March 8, 2012, 12:04pm UTC](https://discuss.elastic.co/t/unavailable-shard-exception/6942 "2012-03-08T12:04:34Z")
Hi, I came across the following error while indexing when I have deleted some index folders from ES cluster UnavailableShardsException\[\[2012-03-07\]\[0\] \[2\] shardIt, \[0\] active : Timeout waiting for \[1m\], request: … --- ## [How to debug Logstash filter with dissect?](https://discuss.elastic.co/t/how-to-debug-logstash-filter-with-dissect/157616)
**Author:** [@RussellBateman](https://discuss.elastic.co/u/RussellBateman)\ **Replies:** 6\ **Last updated:** [November 21, 2018, 3:43pm UTC](https://discuss.elastic.co/t/how-to-debug-logstash-filter-with-dissect/157616 "2018-11-21T15:43:20Z")
There's a grok debugger, but how best to debug my dissect filter when none of my log data appear to "get caught" in it? My filter: filter { if( \[ type \] == "doc" ) { dissect { mapping =\> { … --- ## [exception=\>#\ **Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 2:37am UTC](https://discuss.elastic.co/t/exception-logstash-unexpected-character-code-58-expected-a-valid-value-number-string-array-object-true-false-or-null/241198 "2020-07-15T02:37:37Z") I need to parse and have all the JSON object in one message but it is splitting into different messages as you can see in stdout below JSON: \[ { "SOURCE": "Source A", "Model": "Mo… --- ## [Invalid\_index\_name\_exception with variable name](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435)
**Author:** [@amas](https://discuss.elastic.co/u/amas)\ **Replies:** 5\ **Last updated:** [June 28, 2018, 11:58am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-with-variable-name/137435 "2018-06-28T11:58:48Z")
I'm getting these warnings with the 6.3.0 stack: \[2018-06-26T12:45:22,619\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-… --- ## [Current recommendations for large heaps (64GB+)](https://discuss.elastic.co/t/current-recommendations-for-large-heaps-64gb/249827)
**Author:** [@lechuck](https://discuss.elastic.co/u/lechuck)\ **Replies:** 4\ **Last updated:** [September 28, 2020, 3:55pm UTC](https://discuss.elastic.co/t/current-recommendations-for-large-heaps-64gb/249827 "2020-09-28T15:55:55Z")
Hey folks, I'd like to get an opinion on current recommendations for running Elasticsearch with large heaps (64-128GB) please. I understand ~30GB is generally recommended for most installs in order to benefit from com… --- ## [Using Elasticsearch as a fast lookup table](https://discuss.elastic.co/t/using-elasticsearch-as-a-fast-lookup-table/11331)
**Author:** [@Umit\_Seren](https://discuss.elastic.co/u/Umit_Seren)\ **Replies:** 7\ **Last updated:** [March 28, 2013, 1:13pm UTC](https://discuss.elastic.co/t/using-elasticsearch-as-a-fast-lookup-table/11331 "2013-03-28T13:13:14Z")
I have following use case: I store scientific data in HDF5 files (approx. 6 million entries per file). There are two important fields (position and score) and all the 6 million entries are stored sorted by score … --- ## [What replacement should be used for rivers?](https://discuss.elastic.co/t/what-replacement-should-be-used-for-rivers/32188)
**Author:** [@Vankir1](https://discuss.elastic.co/u/Vankir1)\ **Replies:** 0\ **Last updated:** [October 14, 2015, 2:51pm UTC](https://discuss.elastic.co/t/what-replacement-should-be-used-for-rivers/32188 "2015-10-14T14:51:56Z")
I'm using mongodb river and found that rivers are dropped out from elasticsearch support and are not recommended for usage. Does somebody know replacement for mongodb river? --- ## [Could not retrieve remote IP address for beats input](https://discuss.elastic.co/t/could-not-retrieve-remote-ip-address-for-beats-input/104815)
**Author:** [@gotjoshua](https://discuss.elastic.co/u/gotjoshua)\ **Replies:** 5\ **Last updated:** [November 17, 2017, 2:43am UTC](https://discuss.elastic.co/t/could-not-retrieve-remote-ip-address-for-beats-input/104815 "2017-11-17T02:43:23Z")
"Could not retrieve remote IP address for beats input." https://github.com/logstash-plugins/logstash-input-beats/blob/master/lib/logstash/inputs/beats/message\_listener.rb#L34 I see this warning regularly. (even though … --- ## [How do I get past the 500 record limitation?](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319)
**Author:** [@a24](https://discuss.elastic.co/u/a24)\ **Replies:** 3\ **Last updated:** [September 7, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-do-i-get-past-the-500-record-limitation/283319 "2021-09-07T14:18:45Z")
I am brand new to kibana, how do I load more than the 500 record limit? I read somewhere in a post to go to settings. I have no clue where settings even is. I think I am on version 7.8.1. --- ## [Unable to connect to Elasticsearch at http://localhost:9200 on Kubernetes](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-at-http-localhost-9200-on-kubernetes/92573)
**Author:** [@dilliplkumar](https://discuss.elastic.co/u/dilliplkumar)\ **Replies:** 3\ **Last updated:** [July 11, 2017, 3:03pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-at-http-localhost-9200-on-kubernetes/92573 "2017-07-11T15:03:29Z")
I have deployed elasticsearch cluster with 3 master nodes, 3 data nodes and 2 client nodes inside kubernetes using elasticsearch:5.5.0 and kibana:2.1.0, I could able to check the cluster health which looks good. { "… --- ## [Is it possible to specify a partition key when using filebeat to send to a Kafka topic?](https://discuss.elastic.co/t/is-it-possible-to-specify-a-partition-key-when-using-filebeat-to-send-to-a-kafka-topic/94732)
**Author:** [@sw90000](https://discuss.elastic.co/u/sw90000)\ **Replies:** 6\ **Last updated:** [August 1, 2017, 4:54pm UTC](https://discuss.elastic.co/t/is-it-possible-to-specify-a-partition-key-when-using-filebeat-to-send-to-a-kafka-topic/94732 "2017-08-01T16:54:56Z")
I found a topic one years ago, it is not possible at that time. Can we do it now with filebeat 5.5.1? I want some part of the message to be the key of the kafka message. For example, the log message is like: 2017:07:21 i… --- ## [KIbana 6.7.0 broken upgrade](https://discuss.elastic.co/t/kibana-6-7-0-broken-upgrade/174162)
**Author:** [@paulsbuxton](https://discuss.elastic.co/u/paulsbuxton)\ **Replies:** 8\ **Last updated:** [April 1, 2019, 2:53pm UTC](https://discuss.elastic.co/t/kibana-6-7-0-broken-upgrade/174162 "2019-04-01T14:53:09Z")
Running on Ubuntu, and post upgrade of the stack from 6.6.1 to 6.7.0, kibana has a problem!! When trying to start Kibana, the outoput dumped to screen has the following entries log \[15:15:01.468\] \[info\]\[status\]\[plugi… --- ## [Aggregate on fields and get distinct documents](https://discuss.elastic.co/t/aggregate-on-fields-and-get-distinct-documents/43902)
**Author:** [@Imran\_Azad](https://discuss.elastic.co/u/Imran_Azad)\ **Replies:** 2\ **Last updated:** [March 9, 2016, 5:39pm UTC](https://discuss.elastic.co/t/aggregate-on-fields-and-get-distinct-documents/43902 "2016-03-09T17:39:44Z")
So I have three documents: Document 1: Title: Paracetamol Subject: SideEffects Body: "some content" Document 2: Title: Paracetamol Type: SideEffects Body: "some different content" Document 3: Title: Parac… --- ## ["template is missing" help please](https://discuss.elastic.co/t/template-is-missing-help-please/60198)
**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\ **Replies:** 3\ **Last updated:** [September 14, 2016, 5:46pm UTC](https://discuss.elastic.co/t/template-is-missing-help-please/60198 "2016-09-14T17:46:46Z")
For this seemingly simple template file: { "test": { "template": "test", "order" : 1 } } When I POST to .../\_template/test i get the following error: { "error": { "root\_cause": \[ { "type… --- ## [\[error\] All shards failed after migration to 6.7.1](https://discuss.elastic.co/t/error-all-shards-failed-after-migration-to-6-7-1/176872)
**Author:** [@Ludovic9](https://discuss.elastic.co/u/Ludovic9)\ **Replies:** 4\ **Last updated:** [April 15, 2019, 2:12pm UTC](https://discuss.elastic.co/t/error-all-shards-failed-after-migration-to-6-7-1/176872 "2019-04-15T14:12:34Z")
Hi I have done this morning an upgrade of my elk stack, to 6.3.0 to 6.7.0 here the steps disable shards allocation update elasticserach when the "active\_shards\_percent\_as\_number" was 50% (yellow state) update logst… --- ## [Fatal Error -- Kibana: Unable to connect to Elasticsearch](https://discuss.elastic.co/t/fatal-error-kibana-unable-to-connect-to-elasticsearch/26777)
**Author:** [@syakirharis](https://discuss.elastic.co/u/syakirharis)\ **Replies:** 7\ **Last updated:** [August 4, 2015, 10:43pm UTC](https://discuss.elastic.co/t/fatal-error-kibana-unable-to-connect-to-elasticsearch/26777 "2015-08-04T22:43:30Z")
Please help me, i am new to this ELK \[image\] [Previous page](https://discuss.elastic.co/top.md?page=408&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=410&per_page=50&period=all)