# Top **URL:** https://discuss.elastic.co/top.md?page=469&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 470 --- ## [Metricbeat Kibana dashboard](https://discuss.elastic.co/t/metricbeat-kibana-dashboard/58725)
**Author:** [@Crai](https://discuss.elastic.co/u/Crai)\ **Replies:** 8\ **Last updated:** [August 31, 2016, 5:14am UTC](https://discuss.elastic.co/t/metricbeat-kibana-dashboard/58725 "2016-08-31T05:14:05Z")
After I updated to 5 alpha 5 for ES, Kibana, and Metricbeat I've noticed the metrics being collected from servers output has changed and look very wrong in comparison to what they were prior to the update. I even went … --- ## [How do you break up long lines in logstash.conf? \[answered\]](https://discuss.elastic.co/t/how-do-you-break-up-long-lines-in-logstash-conf-answered/48270)
**Author:** [@kwmullet](https://discuss.elastic.co/u/kwmullet)\ **Replies:** 3\ **Last updated:** [April 26, 2016, 7:07pm UTC](https://discuss.elastic.co/t/how-do-you-break-up-long-lines-in-logstash-conf-answered/48270 "2016-04-26T19:07:41Z")
I'm trying to use logstash to pull some data from a REST endpoint. Some of the GET queries will have lines that are quite long. I'd like to break up really long lines like in this example... input { http\_poller {… --- ## [How to parse a json message](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652)
**Author:** [@Navinder](https://discuss.elastic.co/u/Navinder)\ **Replies:** 7\ **Last updated:** [October 12, 2017, 11:02am UTC](https://discuss.elastic.co/t/how-to-parse-a-json-message/103652 "2017-10-12T11:02:03Z")
I have the following input in grok. { "payload": { "user\_id": "323232323323223233", "order\_id": "4232313-32323232-232322323", "ts": "2017-09-01T00:59:00.0138639Z", "promo\_codes": \[{ "amount": 10.0, }\], "shipping… --- ## [Metricbeat 7.16.3 error determining cgroups version: error reading /proc/\/cgroup:](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [February 2, 2022, 4:55pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-3-error-determining-cgroups-version-error-reading-proc-pid-cgroup/296100 "2022-02-02T16:55:45Z")
These errors keep being generated in the metricbeat logs. 2022-02-02T16:11:02.411Z ERROR metrics/metrics.go:304 error determining cgroups version: error reading /proc/3950736/cgroup: open /proc/3950736/cgroup:… --- ## [Filebeat 5.x can't send logs to Logstash (SSL and EOF)](https://discuss.elastic.co/t/filebeat-5-x-cant-send-logs-to-logstash-ssl-and-eof/63216)
**Author:** [@Mohammad\_Mahzoun](https://discuss.elastic.co/u/Mohammad_Mahzoun)\ **Replies:** 8\ **Last updated:** [October 18, 2016, 1:27pm UTC](https://discuss.elastic.co/t/filebeat-5-x-cant-send-logs-to-logstash-ssl-and-eof/63216 "2016-10-18T13:27:46Z")
I Have filebeat on one server and logstash on another server. I checked the certificates and they are correct. also logstash is running on 5044. but filebeat can't send anything and this is the log: 2016-10-17T14:50:0… --- ## [Logstash mutate replace field](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530)
**Author:** [@Jonesthomas](https://discuss.elastic.co/u/Jonesthomas)\ **Replies:** 6\ **Last updated:** [April 18, 2017, 9:45am UTC](https://discuss.elastic.co/t/logstash-mutate-replace-field/82530 "2017-04-18T09:45:54Z")
I'm trying to replace the field "message" with value . My example input message is: \[{ "logID": 1, "organizationID": 1, "userID": 1001, "appID": 123, "moduleID": 1, "screenID": 213, "timeStamp": "2017-03-15 10:06:… --- ## [Logstash and syslog: logs from specific IP](https://discuss.elastic.co/t/logstash-and-syslog-logs-from-specific-ip/39976)
**Author:** [@maciej.kola](https://discuss.elastic.co/u/maciej.kola)\ **Replies:** 6\ **Last updated:** [January 27, 2016, 10:04am UTC](https://discuss.elastic.co/t/logstash-and-syslog-logs-from-specific-ip/39976 "2016-01-27T10:04:32Z")
Hi there, Firstly, let me just say that I am new in elk stack but I already think it's great solution. I use elk with syslog, to collect and search logs from multiple client systems. What I did so far: syslog is liste… --- ## [Setting "xpack.security.enabled" hasn't been registered](https://discuss.elastic.co/t/setting-xpack-security-enabled-hasnt-been-registered/110573)
**Author:** [@rj-reilly](https://discuss.elastic.co/u/rj-reilly)\ **Replies:** 2\ **Last updated:** [December 8, 2017, 3:40pm UTC](https://discuss.elastic.co/t/setting-xpack-security-enabled-hasnt-been-registered/110573 "2017-12-08T15:40:13Z")
Hi, I installed x-pack on elasticsearch, logstash and kibana set the appropriate settings kibana and elasticsearch are working just fine but i get the following error in logstash. An unexpected error occurred! {:error=\>#… --- ## [Stopping a snapshot](https://discuss.elastic.co/t/stopping-a-snapshot/23650)
**Author:** [@natefox](https://discuss.elastic.co/u/natefox)\ **Replies:** 1\ **Last updated:** [May 24, 2015, 12:06am UTC](https://discuss.elastic.co/t/stopping-a-snapshot/23650 "2015-05-24T00:06:06Z")
We do nightly snapshots to S3. They normally take ~2hrs. I have one that has been running for 4 days now. I've tried to stop it with this command: time curl -XDELETE -s localhost:9200/\_snapshot/sim-s3-backup/sim-au… --- ## [How to debug log entries which just contain "%{host} %{message}" solved!](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597)
**Author:** [@davidweir](https://discuss.elastic.co/u/davidweir)\ **Replies:** 5\ **Last updated:** [May 11, 2016, 9:27pm UTC](https://discuss.elastic.co/t/how-to-debug-log-entries-which-just-contain-host-message-solved/49597 "2016-05-11T21:27:04Z")
I configured logstash to updload to s3. When I check the files on s3, they are full of entries like this: 2016-05-09T23:27:31.811Z %{host} %{message} 2016-05-09T23:27:31.811Z %{host} %{message} 2016-05-09T23:27:31.809Z %… --- ## [Logstash 6.2.1 , jdk9 - Unsupported platform: x86\_64-windows](https://discuss.elastic.co/t/logstash-6-2-1-jdk9-unsupported-platform-x86-64-windows/120213)
**Author:** [@jmota](https://discuss.elastic.co/u/jmota)\ **Replies:** 6\ **Last updated:** [February 20, 2018, 1:18pm UTC](https://discuss.elastic.co/t/logstash-6-2-1-jdk9-unsupported-platform-x86-64-windows/120213 "2018-02-20T13:18:42Z")
confirmed tat 6.2.1 works with oracle j9 but i m getting unsupported platform- thxs for any help. https://www.elastic.co/support/matrix#matrix\_jvm C:\\Kibana\_ElasticSearch\\logstash-6.2.1\>bin/logstash -f my\_logstash-sim… --- ## [Filebeat monitoring via proxy](https://discuss.elastic.co/t/filebeat-monitoring-via-proxy/129415)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 3\ **Last updated:** [April 27, 2018, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-monitoring-via-proxy/129415 "2018-04-27T13:44:56Z")
Hi All, I am using filebeat and I want to add xpack monitoring configuration. I do not have direct access to ES so I need to use a proxy. Does some have an example config with use of a proxy server? Also would it be pos… --- ## [Events Per Second - JSON for Metric Visualization](https://discuss.elastic.co/t/events-per-second-json-for-metric-visualization/43739)
**Author:** [@BigPete](https://discuss.elastic.co/u/BigPete)\ **Replies:** 3\ **Last updated:** [March 9, 2016, 3:15pm UTC](https://discuss.elastic.co/t/events-per-second-json-for-metric-visualization/43739 "2016-03-09T15:15:27Z")
Hello, I'm trying to work out how to do an Events Per Second metric that over-rides the page specified time period. I tried {"interval":"1s"} but this didn't change the value. Anyone any ideas? Thanks! --- ## [Select \* works but select count(\*) fails. please help](https://discuss.elastic.co/t/select-works-but-select-count-fails-please-help/79660)
**Author:** [@dixitnikhil2004](https://discuss.elastic.co/u/dixitnikhil2004)\ **Replies:** 4\ **Last updated:** [March 28, 2017, 7:59pm UTC](https://discuss.elastic.co/t/select-works-but-select-count-fails-please-help/79660 "2017-03-28T19:59:00Z")
works fine: select \* from hivetbl\_betateamcity\_webhook\_payloads fails: select count(1) from hivetbl\_betateamcity\_webhook\_payloads fails: select count(\*) from hivetbl\_betateamcity\_webhook\_payloads External table definit… --- ## [Elasticsearchにデータを保存する方法について](https://discuss.elastic.co/t/elasticsearch/26616)
**Author:** [@konchan](https://discuss.elastic.co/u/konchan)\ **Replies:** 4\ **Last updated:** [August 5, 2015, 3:41am UTC](https://discuss.elastic.co/t/elasticsearch/26616 "2015-08-05T03:41:31Z")
今、Javaからelasticsearchにデータを保存して、kibanaで表示するプログラムを作成しています。 プログラムから入力したデータはファイルに書き込んでいるのですが、 書き込んだファイルを使用してインデックスを生成する方法が分かりません。 教えてください。 --- ## [Append an object (nested) from Logstash to Elasticsearch](https://discuss.elastic.co/t/append-an-object-nested-from-logstash-to-elasticsearch/62162)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 2\ **Last updated:** [March 19, 2017, 7:57am UTC](https://discuss.elastic.co/t/append-an-object-nested-from-logstash-to-elasticsearch/62162 "2017-03-19T07:57:32Z")
Hello Elasticusers, I have a little issue, I have a the following configuration in Logstash : input : jdbc to execute a SQL query filter : mutate to rename the fields of the SQL query and to create some objects outpu… --- ## [Logstash-6.2.4 Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting](https://discuss.elastic.co/t/logstash-6-2-4-logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-if-you-wish-to-run-multiple-instances-you-must-change-the-path-data-setting/132963)
**Author:** [@Vadim\_Klimenko](https://discuss.elastic.co/u/Vadim_Klimenko)\ **Replies:** 1\ **Last updated:** [May 23, 2018, 10:04am UTC](https://discuss.elastic.co/t/logstash-6-2-4-logstash-could-not-be-started-because-there-is-already-another-instance-using-the-configured-data-directory-if-you-wish-to-run-multiple-instances-you-must-change-the-path-data-setting/132963 "2018-05-23T10:04:31Z")
I start Logstash: bin/logstash -f logstash-simple.conf Sending Logstash's logs to /home/vadim/www/FULL/Search/logstash-6.2.4/logs which is now configured via log4j2.properties \[2018-05-23T12:24:31,891\]\[INFO \]\[logstash… --- ## [Generic "Something is wrong with your configuration"](https://discuss.elastic.co/t/generic-something-is-wrong-with-your-configuration/134342)
**Author:** [@Michael\_Hatch](https://discuss.elastic.co/u/Michael_Hatch)\ **Replies:** 3\ **Last updated:** [June 4, 2018, 9:16am UTC](https://discuss.elastic.co/t/generic-something-is-wrong-with-your-configuration/134342 "2018-06-04T09:16:47Z")
I would think that if you could detect an issue with plugin configuration, you would be able to supply a useful error message, but alas...Any thoughts? Elastic 6.2 jdbc plugin conf input { jdbc { id =\> "new\_user" j… --- ## [Elasticsearch aggregation on million or more data](https://discuss.elastic.co/t/elasticsearch-aggregation-on-million-or-more-data/293641)
**Author:** [@Nowrin\_Hossain](https://discuss.elastic.co/u/Nowrin_Hossain)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 9:42am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-on-million-or-more-data/293641 "2022-01-10T09:42:08Z")
I have an index which can have millions of documents with time. I need to make several aggregation on those huge amount of documents fields. In these documents, I need to count number of unique value of a field which may… --- ## [Output json](https://discuss.elastic.co/t/output-json/86278)
**Author:** [@shaharz](https://discuss.elastic.co/u/shaharz)\ **Replies:** 2\ **Last updated:** [May 23, 2017, 10:53am UTC](https://discuss.elastic.co/t/output-json/86278 "2017-05-23T10:53:43Z")
hi, Im running logstash to collect json log file. the log file contains lines of logs in json format. here is my configuration input { file { codec =\> "json" path =\> "C:\\Logs\\Client.txt" path =\> "C:\\Logs\\Server.txt… --- ## [TypeError: Cannot read property 'error' of undefined while creating Kibana Plugin](https://discuss.elastic.co/t/typeerror-cannot-read-property-error-of-undefined-while-creating-kibana-plugin/41554)
**Author:** [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Replies:** 4\ **Last updated:** [February 25, 2016, 9:01pm UTC](https://discuss.elastic.co/t/typeerror-cannot-read-property-error-of-undefined-while-creating-kibana-plugin/41554 "2016-02-25T21:01:56Z")
Following advice from here: here: https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md and here: https://www.npmjs.com/package/generator-kibana-plugin Generated base plugin from the base yeoman, and can't… --- ## [Kibana 7.5.1 Unable to use Kibana Keystore due to Permissions Problem](https://discuss.elastic.co/t/kibana-7-5-1-unable-to-use-kibana-keystore-due-to-permissions-problem/215050)
**Author:** [@nmm](https://discuss.elastic.co/u/nmm)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 9:29pm UTC](https://discuss.elastic.co/t/kibana-7-5-1-unable-to-use-kibana-keystore-due-to-permissions-problem/215050 "2020-03-02T21:29:16Z")
I installed Kibana on an Ubuntu 16.04.6 VM using a user with sudo permissions (basically, a user with root-like permissions). I have enabled and started kibana with systemctl. I have security enabled, the built-in users … --- ## [Lucene commit failed: checksum failed, while indexing](https://discuss.elastic.co/t/lucene-commit-failed-checksum-failed-while-indexing/253215)
**Author:** [@SuperToma](https://discuss.elastic.co/u/SuperToma)\ **Replies:** 1\ **Last updated:** [January 17, 2021, 8:44am UTC](https://discuss.elastic.co/t/lucene-commit-failed-checksum-failed-while-indexing/253215 "2021-01-17T08:44:07Z")
Hello guys ! I'm faced with this error while indexing: \[2020-10-24T18:18:31,520\]\[WARN \]\[o.e.i.e.Engine \] \[mini-server\] \[release\]\[0\] failed engine \[lucene commit failed\] org.apache.lucene.index.CorruptInde… --- ## [OpenJDK 64-Bit Server VM warning: Cannot open file logs/gc.log due to No such file or directory](https://discuss.elastic.co/t/openjdk-64-bit-server-vm-warning-cannot-open-file-logs-gc-log-due-to-no-such-file-or-directory/195887)
**Author:** [@Mike\_Fritzsche](https://discuss.elastic.co/u/Mike_Fritzsche)\ **Replies:** 1\ **Last updated:** [August 20, 2019, 11:32am UTC](https://discuss.elastic.co/t/openjdk-64-bit-server-vm-warning-cannot-open-file-logs-gc-log-due-to-no-such-file-or-directory/195887 "2019-08-20T11:32:29Z")
I installed on my Mac OS 14.0.6 Elasticsearch with brew. It must be ES V 6 - not 7. But I tied to install 7 too - same error. So must be problem with the jdk? I was also installing java 8 with brew (was asking to install… --- ## [Filebeat - It is not creating index on Elasticsearch](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-elasticsearch/39913)
**Author:** [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-it-is-not-creating-index-on-elasticsearch/39913 "2016-04-04T18:59:21Z")
Hello! I'm trying to configure the FIlebeat. My configuration is Filebeat \> Logstash \> Elasticsearch \> Kibana. However there is something wrong and I couldn't figure it out. There are some errors in the log and the ind… --- ## [Elastic agent and SvcHost DnsCache very high CPU usage](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536)
**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\ **Replies:** 8\ **Last updated:** [May 31, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elastic-agent-and-svchost-dnscache-very-high-cpu-usage/304536 "2022-05-31T21:16:01Z")
Hi everyone, We've been happy users of the ELK stack and endpoint security components for quite some time now. During the past few months we've been living with occasional, weird performance issues which seem to be rela… --- ## [elasticsearch.requestTimeout config setting being ignored by visualisations](https://discuss.elastic.co/t/elasticsearch-requesttimeout-config-setting-being-ignored-by-visualisations/166549)
**Author:** [@jong99](https://discuss.elastic.co/u/jong99)\ **Replies:** 2\ **Last updated:** [February 3, 2019, 3:48am UTC](https://discuss.elastic.co/t/elasticsearch-requesttimeout-config-setting-being-ignored-by-visualisations/166549 "2019-02-03T03:48:07Z")
I'm using Kibana 6.6.0, installed through the official Docker image. The elasticsearch.requestTimeout seems to be being ignored by visualisations. Here is my kibana.yml config: server.name: kibana server.host: "0" ela… --- ## [Logstash HTTP(s) output not working](https://discuss.elastic.co/t/logstash-http-s-output-not-working/57900)
**Author:** [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 7:59am UTC](https://discuss.elastic.co/t/logstash-http-s-output-not-working/57900 "2016-08-22T07:59:42Z")
Hi, I downloaded latest logstash 2.3.4 and deployed on Windows machine with the following output configuration http { url =\> "https://127.0.0.1:443/collectionstats" http\_method =\> "post" … --- ## [Filebeat not creating index daily](https://discuss.elastic.co/t/filebeat-not-creating-index-daily/243181)
**Author:** [@daniel\_fablius](https://discuss.elastic.co/u/daniel_fablius)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 9:37am UTC](https://discuss.elastic.co/t/filebeat-not-creating-index-daily/243181 "2020-07-30T09:37:29Z")
Hi, so i use filebeat to send logs to Elasticsearch and i see an index is created with name "filebeat-7.7.1-2020.07.29-000002" i assume that filebeat will keep creating a new index based on the datetime of the data eve… --- ## [Compress elasticsearch bulkrequest using java high level rest client and bulk processor](https://discuss.elastic.co/t/compress-elasticsearch-bulkrequest-using-java-high-level-rest-client-and-bulk-processor/280425)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 7\ **Last updated:** [August 6, 2021, 9:32pm UTC](https://discuss.elastic.co/t/compress-elasticsearch-bulkrequest-using-java-high-level-rest-client-and-bulk-processor/280425 "2021-08-06T21:32:36Z")
Is there anyway to compress the elasticsearch bulk request payload using java high level rest client and bulk processor? I have tried below requestConfigBuilder.setContentCompressionEnabled(true); But it do… --- ## [Filebeat for Sophos XG Firewall](https://discuss.elastic.co/t/filebeat-for-sophos-xg-firewall/192952)
**Author:** [@kal1s](https://discuss.elastic.co/u/kal1s)\ **Replies:** 8\ **Last updated:** [August 7, 2019, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-for-sophos-xg-firewall/192952 "2019-08-07T16:15:41Z")
Hi, Will be possible to have Filebeat for Sophos XG FIrewall and integrated with Elastic SIEM like Filebeat Cisco? Best Regards, Ricardo Calimanis --- ## [Exception=\>"NoMethodError", :message=\>"undefined method \`unlock' for nil:NilClass"](https://discuss.elastic.co/t/exception-nomethoderror-message-undefined-method-unlock-for-nil-nilclass/165470)
**Author:** [@Marcos\_OS](https://discuss.elastic.co/u/Marcos_OS)\ **Replies:** 8\ **Last updated:** [January 23, 2019, 8:53pm UTC](https://discuss.elastic.co/t/exception-nomethoderror-message-undefined-method-unlock-for-nil-nilclass/165470 "2019-01-23T20:53:55Z")
Could someone help me with the following situation: When I have the filter below, I have the expected result filter { ruby { code =\> ' fieldname = event.get("type") + "datref" event.set("datref", event.get(fie… --- ## [Failed to parse value \[no\]](https://discuss.elastic.co/t/failed-to-parse-value-no/107982)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 4\ **Last updated:** [November 16, 2017, 6:33pm UTC](https://discuss.elastic.co/t/failed-to-parse-value-no/107982 "2017-11-16T18:33:21Z")
I am getting this error after my upgrade to 6.0 GA \[2017-11-16T11:16:50,464\]\[DEBUG\]\[o.e.a.b.TransportShardBulkAction\] \[logs.web-2017.11.01\]\[0\] failed to execute bulk item (index) BulkShardRequest \[\[logs.web-2017.11.01\]\[… --- ## [Index vs Update](https://discuss.elastic.co/t/index-vs-update/280637)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [August 6, 2021, 10:27am UTC](https://discuss.elastic.co/t/index-vs-update/280637 "2021-08-06T10:27:08Z")
Hello I'd like to ask the same question again raised here: What's the benefit of the Update API (POST /\_update) vs Index (PUT /\_doc). As far as I can see Update (with doc\_as\_upsert: true) is identical in effect to Inde… --- ## [Request header field Content-Type is not allowed by Access-Control-Allow-Headers in preflight response](https://discuss.elastic.co/t/request-header-field-content-type-is-not-allowed-by-access-control-allow-headers-in-preflight-response/52566)
**Author:** [@Adnan\_Nuruddin](https://discuss.elastic.co/u/Adnan_Nuruddin)\ **Replies:** 2\ **Last updated:** [July 11, 2016, 9:45am UTC](https://discuss.elastic.co/t/request-header-field-content-type-is-not-allowed-by-access-control-allow-headers-in-preflight-response/52566 "2016-07-11T09:45:19Z")
I have a Elasticsearch cluster running on Centos 6 with Java. Whenever I am trying to run a query from my client side made with AngularJs I get the following error, Request header field Content-Type is not allowed by … --- ## [Getting search.max\_buckets Warning message in deprecation.log file](https://discuss.elastic.co/t/getting-search-max-buckets-warning-message-in-deprecation-log-file/134851)
**Author:** [@sureshsubramaniyan](https://discuss.elastic.co/u/sureshsubramaniyan)\ **Replies:** 1\ **Last updated:** [June 7, 2018, 11:32am UTC](https://discuss.elastic.co/t/getting-search-max-buckets-warning-message-in-deprecation-log-file/134851 "2018-06-07T11:32:16Z")
while creating term aggregation in kibana , getting below error in elasticsearch deprecation.log file \[2018-06-06T17:40:58,684\]\[WARN \]\[o.e.d.s.a.MultiBucketConsumerService\] This aggregation creates too many buckets (100… --- ## [Best practices for automated incremental backups](https://discuss.elastic.co/t/best-practices-for-automated-incremental-backups/124504)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 1\ **Last updated:** [March 19, 2018, 5:31pm UTC](https://discuss.elastic.co/t/best-practices-for-automated-incremental-backups/124504 "2018-03-19T17:31:56Z")
Hi, I've been looking into the backup and restore plan for our modest elasticsearch cluster. We are currently setup in a "Hot/Warm" architecture with curator moving old indexs from hot to warm. We currently have 2x Hot … --- ## [Difference between df and du in linux](https://discuss.elastic.co/t/difference-between-df-and-du-in-linux/4287)
**Author:** [@Mustafa\_Sener](https://discuss.elastic.co/u/Mustafa_Sener)\ **Replies:** 6\ **Last updated:** [August 8, 2012, 6:39am UTC](https://discuss.elastic.co/t/difference-between-df-and-du-in-linux/4287 "2012-08-08T06:39:38Z")
Hi, In one of our production clusters we saw that there is a big difference between df and du disk size reports. df shows 100% and du shows as 70%. This remains as it is while cluster is running. Do you have any ideas… --- ## [Elasticsearch files in tmp folder: how to change there location](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543)
**Author:** [@1ac727ff300829bca0fa](https://discuss.elastic.co/u/1ac727ff300829bca0fa)\ **Replies:** 4\ **Last updated:** [November 19, 2021, 7:02am UTC](https://discuss.elastic.co/t/elasticsearch-files-in-tmp-folder-how-to-change-there-location/289543 "2021-11-19T07:02:16Z")
Hello guys, I have set up elk in linx server using tar, but my tmp directory gets filled with files in following formates /tmp/elasticsearch-17741669071348173933 How to change there location? --- ## [Search IPV6 only in Kibana for nginx access log](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 5\ **Last updated:** [March 13, 2020, 8:18pm UTC](https://discuss.elastic.co/t/search-ipv6-only-in-kibana-for-nginx-access-log/223561 "2020-03-13T20:18:56Z")
I have nginx access logs with IPV6 and IPV4 entries. Is there a way to write KQL (or Lucene), so I find only IPV6 entries in the source.ip field? Example of entries: Mar 13, 2020 @ 11:21:59.000 200 141.8.142.31 noty.p… --- ## [Filebeat fails to harvest if a file and a symlink to that file is in the same directory](https://discuss.elastic.co/t/filebeat-fails-to-harvest-if-a-file-and-a-symlink-to-that-file-is-in-the-same-directory/49743)
**Author:** [@treff7es1](https://discuss.elastic.co/u/treff7es1)\ **Replies:** 4\ **Last updated:** [May 20, 2016, 11:35am UTC](https://discuss.elastic.co/t/filebeat-fails-to-harvest-if-a-file-and-a-symlink-to-that-file-is-in-the-same-directory/49743 "2016-05-20T11:35:08Z")
Hi, It seems to me if symlink exists in the directory where filebeat should work on then filebeat won't harvest. Our system is writing logs in a format where every hour we name the logfile with the actual hour in the f… --- ## [Comparison of heartbeat and zabbix](https://discuss.elastic.co/t/comparison-of-heartbeat-and-zabbix/152002)
**Author:** [@mukai](https://discuss.elastic.co/u/mukai)\ **Replies:** 2\ **Last updated:** [October 17, 2018, 5:20am UTC](https://discuss.elastic.co/t/comparison-of-heartbeat-and-zabbix/152002 "2018-10-17T05:20:37Z")
I want to use Heartbeat in our office. Heartbeat is very easy to use and lightweight. However, there is already Zabbix in the office. What are the strengths of Heartbeat? (URL) Heartbeat https://www.elastic.co/produ… --- ## [APM Failed to publish events: temporary bulk send failure / Queue is full 503 error](https://discuss.elastic.co/t/apm-failed-to-publish-events-temporary-bulk-send-failure-queue-is-full-503-error/202884)
**Author:** [@tmihaldinec](https://discuss.elastic.co/u/tmihaldinec)\ **Replies:** 7\ **Last updated:** [October 14, 2019, 12:49pm UTC](https://discuss.elastic.co/t/apm-failed-to-publish-events-temporary-bulk-send-failure-queue-is-full-503-error/202884 "2019-10-14T12:49:59Z")
Hi, After upgrade from 7.3 to 7.4 APM-Servers are failing with common error Failed to publish events: temporary bulk send failure and Queue is full this is a very busy system and we have 6 APM servers and 5 ELK server… --- ## [Snapshot to minio S3 error](https://discuss.elastic.co/t/snapshot-to-minio-s3-error/260365)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 4\ **Last updated:** [January 6, 2021, 8:04pm UTC](https://discuss.elastic.co/t/snapshot-to-minio-s3-error/260365 "2021-01-06T20:04:37Z")
Hi, Elasticsearch 7.10. I'm trying to add an S3 snapshot repository, the endpoint is Minio. The repository-s3 plugin is installed on all nodes, and restarted. I've set the keys in the keystore: elasticsearch-keystor… --- ## [How to deploy elastic on k8s to avoid join validation on cluster state with a different cluster uuid error](https://discuss.elastic.co/t/how-to-deploy-elastic-on-k8s-to-avoid-join-validation-on-cluster-state-with-a-different-cluster-uuid-error/190850)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 8\ **Last updated:** [July 17, 2019, 2:38pm UTC](https://discuss.elastic.co/t/how-to-deploy-elastic-on-k8s-to-avoid-join-validation-on-cluster-state-with-a-different-cluster-uuid-error/190850 "2019-07-17T14:38:09Z")
I am trying to deploy elastic stack on top of k8s with 2 client nodes, 3 master nodes and 3 data nodes. And all of them are configured on a different node now. For the 2 client nodes. I am using k8s deployment, and for … --- ## [Elasticsearch: 'x\_content\_parse\_exception' \[template\] unknown field \[lifecycle\]](https://discuss.elastic.co/t/elasticsearch-x-content-parse-exception-template-unknown-field-lifecycle/340009)
**Author:** [@anton3](https://discuss.elastic.co/u/anton3)\ **Replies:** 6\ **Last updated:** [August 10, 2023, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-x-content-parse-exception-template-unknown-field-lifecycle/340009 "2023-08-10T07:45:15Z")
I have elk stack deployed from deviantony/docker-elk version 8.9 . every component is 8.9 And i'm trying to create lifecycle with retention policy for my datastream as mentioned in official documentetion PUT \_index\_te… --- ## [Kibana: Courier Fetch Error: unhandled error Error: \[security\_exception\] action \[indices:data/read/mget\] is unauthorized for user \[chirag\]](https://discuss.elastic.co/t/kibana-courier-fetch-error-unhandled-error-error-security-exception-action-indices-data-read-mget-is-unauthorized-for-user-chirag/39226)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 5\ **Last updated:** [January 28, 2016, 3:47pm UTC](https://discuss.elastic.co/t/kibana-courier-fetch-error-unhandled-error-error-security-exception-action-indices-data-read-mget-is-unauthorized-for-user-chirag/39226 "2016-01-28T15:47:13Z")
I've used shield and protected my elasticsearch indexes. It also asks for credentials when I start kibana. But when I login using credentials I've configured, following error is displayed. Courier Fetch Error: unh… --- ## ["null\_pointer\_exception" encountered in latest ES/Marvel](https://discuss.elastic.co/t/null-pointer-exception-encountered-in-latest-es-marvel/35491)
**Author:** [@tguan](https://discuss.elastic.co/u/tguan)\ **Replies:** 7\ **Last updated:** [December 4, 2015, 7:53pm UTC](https://discuss.elastic.co/t/null-pointer-exception-encountered-in-latest-es-marvel/35491 "2015-12-04T19:53:19Z")
I have just installed latest Elasticsearch 2.0.0, Kibana-4.2.1, and then downloaded the latest Marvel plugin. Even put following line in elasticsearch.yml ( is this needed?) echo 'marvel.agent.enabled: false' \>\> ./config… --- ## [Data table with Sum metrics and percentage column](https://discuss.elastic.co/t/data-table-with-sum-metrics-and-percentage-column/25670)
**Author:** [@frank\_van](https://discuss.elastic.co/u/frank_van)\ **Replies:** 2\ **Last updated:** [November 25, 2016, 3:02pm UTC](https://discuss.elastic.co/t/data-table-with-sum-metrics-and-percentage-column/25670 "2016-11-25T15:02:00Z")
Hi, I have a use case looks fairly simple but I couldn't figure out how to build a visualization for it with Kibana. Given the following dataset: POST /test\_index/test\_type/\_bulk {"index":{"\_id":"1"}} {"host": "ww… --- ## [Top hits/bucket agg vs field collapse \[5.3\]](https://discuss.elastic.co/t/top-hits-bucket-agg-vs-field-collapse-5-3/117040)
**Author:** [@Thomas\_Millward\_Wrig](https://discuss.elastic.co/u/Thomas_Millward_Wrig)\ **Replies:** 1\ **Last updated:** [February 2, 2018, 9:32am UTC](https://discuss.elastic.co/t/top-hits-bucket-agg-vs-field-collapse-5-3/117040 "2018-02-02T09:32:29Z")
I'm trying to understand the difference between these types of query, and when to use each. I have documents that have a "unique\_hash" value, and want to return the latest document for each unique hash value within a gi… [Previous page](https://discuss.elastic.co/top.md?page=468&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=470&per_page=50&period=all)