# Top **URL:** https://discuss.elastic.co/top.md?page=502&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 503 --- ## [Multiple ES nodes point on same data location](https://discuss.elastic.co/t/multiple-es-nodes-point-on-same-data-location/11897)
**Author:** [@Ankit\_Jain](https://discuss.elastic.co/u/Ankit_Jain)\ **Replies:** 6\ **Last updated:** [May 27, 2013, 1:29pm UTC](https://discuss.elastic.co/t/multiple-es-nodes-point-on-same-data-location/11897 "2013-05-27T13:29:10Z")
Hi All, We are using Elasticsearch for indexing and storage. ES supports to run multiple nodes on one machines, but it creates different data locations by using the node ids. For example: Index location for Node1… --- ## [Load data into Elastic Search using Log-stash](https://discuss.elastic.co/t/load-data-into-elastic-search-using-log-stash/88052)
**Author:** [@BunnyV](https://discuss.elastic.co/u/BunnyV)\ **Replies:** 8\ **Last updated:** [June 2, 2017, 1:02pm UTC](https://discuss.elastic.co/t/load-data-into-elastic-search-using-log-stash/88052 "2017-06-02T13:02:49Z")
Well the question may be already exists or there will be lots of solutions are available, but here the requirement is different. Here I have a huge file around 44GB and it is increasing day by day. Q1:- Can we load t… --- ## [Write-only cluster / index? Auditing porpouse](https://discuss.elastic.co/t/write-only-cluster-index-auditing-porpouse/49494)
**Author:** [@sirkubax\_1](https://discuss.elastic.co/u/sirkubax_1)\ **Replies:** 8\ **Last updated:** [May 11, 2016, 10:52pm UTC](https://discuss.elastic.co/t/write-only-cluster-index-auditing-porpouse/49494 "2016-05-11T22:52:31Z")
Hi I have a goal of creating audit-prof solution, where logs (indices) can not be modified nor deleted (like write-only). The indices would have configurable TTL (like 365 days), and they would remove the date itself, … --- ## [Timezone that handles daylight saving change](https://discuss.elastic.co/t/timezone-that-handles-daylight-saving-change/85808)
**Author:** [@gtorrance](https://discuss.elastic.co/u/gtorrance)\ **Replies:** 3\ **Last updated:** [May 18, 2017, 11:22am UTC](https://discuss.elastic.co/t/timezone-that-handles-daylight-saving-change/85808 "2017-05-18T11:22:22Z")
I have searched for an answer to this, but I'm still not clear. I have some logs that contain a timestamp, but no timezone. I understand that I can specify a timezone using filter.date.timezone in the Logstash pipeline… --- ## [How to change kibana host](https://discuss.elastic.co/t/how-to-change-kibana-host/72407)
**Author:** [@murali\_choppa](https://discuss.elastic.co/u/murali_choppa)\ **Replies:** 2\ **Last updated:** [February 5, 2017, 7:40am UTC](https://discuss.elastic.co/t/how-to-change-kibana-host/72407 "2017-02-05T07:40:19Z")
Hi All, i am install Kibana (kibana-5.0.2-windows-x86) , working fine and running localhost url (http://localhost:5601/), how to change localhost to my machine ip address Or host name ?? --- ## [Is it possible to set custom colors for Lens filters on a Pie/Donut?](https://discuss.elastic.co/t/is-it-possible-to-set-custom-colors-for-lens-filters-on-a-pie-donut/280590)
**Author:** [@PanoramicPanda](https://discuss.elastic.co/u/PanoramicPanda)\ **Replies:** 4\ **Last updated:** [August 9, 2021, 4:09pm UTC](https://discuss.elastic.co/t/is-it-possible-to-set-custom-colors-for-lens-filters-on-a-pie-donut/280590 "2021-08-09T16:09:07Z")
Trying to convert legacy visualizations to Lens ones, and the thing that's sticking out to me as a sore spot is that I can't figure out how to get specific colors for keywords/filters. The colors in Lens group into the … --- ## [ntopng-ELK setup](https://discuss.elastic.co/t/ntopng-elk-setup/160549)
**Author:** [@swathikothapu](https://discuss.elastic.co/u/swathikothapu)\ **Replies:** 5\ **Last updated:** [December 13, 2018, 11:28am UTC](https://discuss.elastic.co/t/ntopng-elk-setup/160549 "2018-12-13T11:28:12Z")
Hello, Could you please help us on this, how to see ntopng data in Kibana dashboard, and how to setup ELK in linux --- ## [URGENT: ERR Failed to publish events caused by: write tcp \[::1\]:60383-\>\[::1\]:5044: wsasend: An established connection was aborted by the software in your host machine](https://discuss.elastic.co/t/urgent-err-failed-to-publish-events-caused-by-write-tcp-1-60383-1-5044-wsasend-an-established-connection-was-aborted-by-the-software-in-your-host-machine/89621)
**Author:** [@debashree13](https://discuss.elastic.co/u/debashree13)\ **Replies:** 4\ **Last updated:** [June 28, 2017, 8:39pm UTC](https://discuss.elastic.co/t/urgent-err-failed-to-publish-events-caused-by-write-tcp-1-60383-1-5044-wsasend-an-established-connection-was-aborted-by-the-software-in-your-host-machine/89621 "2017-06-28T20:39:32Z")
Hi team, Please help urgently as we are doing Production deployment this week. I am getting errors in filebeat logs and data is not read and sent to logstash ...my data flow is filebeat-\>logstash-\>elasticsearch ERR Fai… --- ## [Elastic Stack commercial usage](https://discuss.elastic.co/t/elastic-stack-commercial-usage/87358)
**Author:** [@Schakron](https://discuss.elastic.co/u/Schakron)\ **Replies:** 1\ **Last updated:** [May 28, 2017, 8:29am UTC](https://discuss.elastic.co/t/elastic-stack-commercial-usage/87358 "2017-05-28T08:29:40Z")
Hi, First of all I want to say "GREAT WORK" to the elastic team. Secondly I have a licencing question. Is the whole elastic stack available for creating a commercial product on base of it? I am thinking about provi… --- ## [Tag input name file](https://discuss.elastic.co/t/tag-input-name-file/130308)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 4\ **Last updated:** [May 4, 2018, 7:39am UTC](https://discuss.elastic.co/t/tag-input-name-file/130308 "2018-05-04T07:39:00Z")
It 's possible to tag multiple input file name ? I have many txt file and I want to tag all file maybe with name file if it's possible. input { file { path =\> "/var/log/testing/\*.txt" start\_position =\> "begi… --- ## [Issues with outside certificate provider - nodes not connecting](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 7\ **Last updated:** [September 15, 2022, 10:02pm UTC](https://discuss.elastic.co/t/issues-with-outside-certificate-provider-nodes-not-connecting/312307 "2022-09-15T22:02:50Z")
Hello, I set up a test instance of elasticsearch 7.11.1 on a Windows VM and created the certificates for SSL encryption following the processes in the documentation, which worked without an issue. I then created CSR's … --- ## [Reindexing Performance](https://discuss.elastic.co/t/reindexing-performance/119166)
**Author:** [@olanamramoj2](https://discuss.elastic.co/u/olanamramoj2)\ **Replies:** 4\ **Last updated:** [February 14, 2018, 6:03am UTC](https://discuss.elastic.co/t/reindexing-performance/119166 "2018-02-14T06:03:09Z")
Hi, We are having problems with reindexing our data. Can you advice what to do on how to reindex while not affecting search speed of other indices? reindexing takes alot of resource. Thanks! --- ## [Filebeat is not sending logs due to ignore\_older](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-due-to-ignore-older/190567)
**Author:** [@Jaepyoung\_Kim](https://discuss.elastic.co/u/Jaepyoung_Kim)\ **Replies:** 6\ **Last updated:** [July 19, 2019, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-due-to-ignore-older/190567 "2019-07-19T20:02:23Z")
The filebeat stop sending few hours after log files are rotated. I found out that ignore\_older is the reason of not sending data from some files. I haven't set config ignore\_older. So I disabled by ignore\_older: 0 exp… --- ## [How to update a index based on fields other than the document\_id using logstash?](https://discuss.elastic.co/t/how-to-update-a-index-based-on-fields-other-than-the-document-id-using-logstash/133481)
**Author:** [@Rajkumar\_Selvakumar](https://discuss.elastic.co/u/Rajkumar_Selvakumar)\ **Replies:** 6\ **Last updated:** [June 22, 2018, 6:05am UTC](https://discuss.elastic.co/t/how-to-update-a-index-based-on-fields-other-than-the-document-id-using-logstash/133481 "2018-06-22T06:05:09Z")
Here is my use case, I have created a elastic index ( name : order\_index) and I able to load the index with the inputs from my database through logstash jdbc plugin ( all is fine ). the index looks like this seq\_id (d… --- ## [Elasticsearch - JSON date payload being converted to type long, cannot use for range queries](https://discuss.elastic.co/t/elasticsearch-json-date-payload-being-converted-to-type-long-cannot-use-for-range-queries/119552)
**Author:** [@BruceLeroy](https://discuss.elastic.co/u/BruceLeroy)\ **Replies:** 6\ **Last updated:** [February 13, 2018, 11:33am UTC](https://discuss.elastic.co/t/elasticsearch-json-date-payload-being-converted-to-type-long-cannot-use-for-range-queries/119552 "2018-02-13T11:33:28Z")
Hi! I create a mapping like: \> { "test3" : { "mappings" : { "doc" : { "properties" : { "alerttype" : { "type" : "text" }, "devicename" : { … --- ## [Trouble Reindexing Child Documents with join field in ES 5.6](https://discuss.elastic.co/t/trouble-reindexing-child-documents-with-join-field-in-es-5-6/143568)
**Author:** [@mstruve](https://discuss.elastic.co/u/mstruve)\ **Replies:** 7\ **Last updated:** [August 12, 2018, 8:24am UTC](https://discuss.elastic.co/t/trouble-reindexing-child-documents-with-join-field-in-es-5-6/143568 "2018-08-12T08:24:15Z")
My issue is similar to this closed topic. I am trying to reindex parent/child documents in ES 5.6 in preparation for an ES 6.x upgrade. I was able to reindex the parent documents without a problem, however when I try to … --- ## [How to show specific fields only?](https://discuss.elastic.co/t/how-to-show-specific-fields-only/165586)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [January 24, 2019, 11:50am UTC](https://discuss.elastic.co/t/how-to-show-specific-fields-only/165586 "2019-01-24T11:50:22Z")
Hi there, We are having events which includes following fields: stacktrace exceptionName user request response functionCalled ... As you can imagine some of these fields can be really long (e.g. response, request, s… --- ## [Action \[indices:data/read/search\[phase/query\]\] is unauthorized for user \[kibana4\_server\]](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880)
**Author:** [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 5:46am UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880 "2016-10-04T05:46:44Z")
I've installed shield on elasticsearch but not on kibana. And I configured kibana to use kibana4\_server user when talking to elasticsearch. However when I go to kibana it still asks me username and password with a prom… --- ## [TImelion serie per field value](https://discuss.elastic.co/t/timelion-serie-per-field-value/43891)
**Author:** [@frankkoornstra](https://discuss.elastic.co/u/frankkoornstra)\ **Replies:** 2\ **Last updated:** [March 16, 2016, 3:38pm UTC](https://discuss.elastic.co/t/timelion-serie-per-field-value/43891 "2016-03-16T15:38:17Z")
I can't seem to find a way to create multiple series in Timelion based on the values of a field in the data set. For example, I have interface data from collectd in logstash and want to split it per host. I get the right… --- ## [Internal load balancing and cross-region replication](https://discuss.elastic.co/t/internal-load-balancing-and-cross-region-replication/96798)
**Author:** [@Steve\_Best](https://discuss.elastic.co/u/Steve_Best)\ **Replies:** 3\ **Last updated:** [August 15, 2017, 11:41pm UTC](https://discuss.elastic.co/t/internal-load-balancing-and-cross-region-replication/96798 "2017-08-15T23:41:45Z")
Hi folks, we are looking to deploy our stack to 2 different AWS regions for high availability in case one region goes dark for any period of time. I have gotten a cluster up and replicating across the 2 regions over a si… --- ## [Pid(/var/run/logstash.pid) file is not being created](https://discuss.elastic.co/t/pid-var-run-logstash-pid-file-is-not-being-created/70771)
**Author:** [@blnprasad](https://discuss.elastic.co/u/blnprasad)\ **Replies:** 3\ **Last updated:** [January 10, 2017, 7:46am UTC](https://discuss.elastic.co/t/pid-var-run-logstash-pid-file-is-not-being-created/70771 "2017-01-10T07:46:49Z")
Hi, I started using latest logstash(5.0) on ubuntu16.0 version and finding that /var/run/logstash.pid is not being created. I'm able run log stash successfully using sysctrl start logstash.service but pid file is not… --- ## [Can't delete index - Bad Request](https://discuss.elastic.co/t/cant-delete-index-bad-request/319870)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 4\ **Last updated:** [November 27, 2022, 4:04pm UTC](https://discuss.elastic.co/t/cant-delete-index-bad-request/319870 "2022-11-27T16:04:16Z")
Trying to delete index: Bad Request, any idea? I used to be able to delete them in earlier versions of Elastic Cloud. --- ## [Is there a guide from creating uber jar with spark core and elasticsearch-spark?](https://discuss.elastic.co/t/is-there-a-guide-from-creating-uber-jar-with-spark-core-and-elasticsearch-spark/25427)
**Author:** [@HeartSaVioR](https://discuss.elastic.co/u/HeartSaVioR)\ **Replies:** 6\ **Last updated:** [July 14, 2015, 8:33am UTC](https://discuss.elastic.co/t/is-there-a-guide-from-creating-uber-jar-with-spark-core-and-elasticsearch-spark/25427 "2015-07-14T08:33:37Z")
Hi! I'm using Spark 1.4.0, and just start experimenting elasticsearch-hadoop. I don't want to let Spark adding some libraries, so I made a uber jar whenever I made a new drivers. I added "org.elasticsearch" %% "elasti… --- ## [Receiving an error with a new installation of Kibana 7 beta1](https://discuss.elastic.co/t/receiving-an-error-with-a-new-installation-of-kibana-7-beta1/169285)
**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\ **Replies:** 2\ **Last updated:** [February 21, 2019, 2:04pm UTC](https://discuss.elastic.co/t/receiving-an-error-with-a-new-installation-of-kibana-7-beta1/169285 "2019-02-21T14:04:19Z")
Hello. I'm working with a fresh installation of Kibana (and ES) 7.0 Beta 1 on Windows. The install went OK, but Kibana is logging the following message on startup: error \[19:43:39.229\] \[warning\]\[process\] UnhandledPr… --- ## [How to install Fs Crawler in ubuntu?](https://discuss.elastic.co/t/how-to-install-fs-crawler-in-ubuntu/166932)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [February 4, 2019, 12:02pm UTC](https://discuss.elastic.co/t/how-to-install-fs-crawler-in-ubuntu/166932 "2019-02-04T12:02:29Z")
Can any one let me know how to setup FsCrawler in ubuntu and how to index pdf or text files to elasticsearch. Thanks in advance Kartheek --- ## [Elastic agent does not send logs](https://discuss.elastic.co/t/elastic-agent-does-not-send-logs/281799)
**Author:** [@john12](https://discuss.elastic.co/u/john12)\ **Replies:** 7\ **Last updated:** [August 31, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-does-not-send-logs/281799 "2021-08-31T09:31:20Z")
Hello, i have problem that i do not receiving logs by elastic agents managed by a fleet. fleet server working fine, and agents connected to fleet server status is "Healthy" i tried different machines, and i had enabled… --- ## [Multi-tenancy for Kibana, once again](https://discuss.elastic.co/t/multi-tenancy-for-kibana-once-again/91874)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 4\ **Last updated:** [July 6, 2017, 10:15am UTC](https://discuss.elastic.co/t/multi-tenancy-for-kibana-once-again/91874 "2017-07-06T10:15:57Z")
I was already starting to build the cluster and buying the license for X-Pack but I noticed that Kibana is not multi-tenant and that is a huge deal breaker. What I need, is that the users can only see the indices they … --- ## [ElasticSearch 503 - ClusterBlockException\[blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]](https://discuss.elastic.co/t/elasticsearch-503-clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/10486)
**Author:** [@Max\_Malecki](https://discuss.elastic.co/u/Max_Malecki)\ **Replies:** 1\ **Last updated:** [January 24, 2013, 11:11am UTC](https://discuss.elastic.co/t/elasticsearch-503-clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/10486 "2013-01-24T11:11:17Z")
Hi! I'm using ES in 0.19.3 under ubuntu 12.10 64bit. After my system start i got: curl http://localhost:9200 { "ok" : true, "status" : 503, "name" : "Selene", "version" : { "number" : "0.19.3", "snapshot\_build… --- ## [Logstash sending the complete file when new data is added to the log file](https://discuss.elastic.co/t/logstash-sending-the-complete-file-when-new-data-is-added-to-the-log-file/55629)
**Author:** [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Replies:** 6\ **Last updated:** [July 27, 2016, 1:48pm UTC](https://discuss.elastic.co/t/logstash-sending-the-complete-file-when-new-data-is-added-to-the-log-file/55629 "2016-07-27T13:48:57Z")
Hi, Given the log file (apache.log) as input to Logstash, after applying some filter the output data is stored in Elasticsearch. Here, whenever the new data is added to the log file, logstash is sending the complete fi… --- ## [Metricbeat "System Overview" dashboards in Kibana are blank](https://discuss.elastic.co/t/metricbeat-system-overview-dashboards-in-kibana-are-blank/274812)
**Author:** [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Replies:** 7\ **Last updated:** [June 5, 2021, 7:38pm UTC](https://discuss.elastic.co/t/metricbeat-system-overview-dashboards-in-kibana-are-blank/274812 "2021-06-05T19:38:13Z")
Hello, I've been trying to figure this out for a while now.. and initially I thought it had to do with my beats agent no matching my ELK version, but I updated everything today and the problem persists. On the Kibana da… --- ## [Filebeat service looses track of files (restart required)](https://discuss.elastic.co/t/filebeat-service-looses-track-of-files-restart-required/56162)
**Author:** [@Dmitry\_Belyakov](https://discuss.elastic.co/u/Dmitry_Belyakov)\ **Replies:** 7\ **Last updated:** [July 28, 2016, 1:13pm UTC](https://discuss.elastic.co/t/filebeat-service-looses-track-of-files-restart-required/56162 "2016-07-28T13:13:16Z")
Hi! I'm having somewhat similar issue to other people here in discussions. Here's what happens: When run manually with sudo filebeat -c /etc/filebeat/filemeat.yml all works fine and filebeat continuously ships new e… --- ## [How can I create plugin for custom analyzer](https://discuss.elastic.co/t/how-can-i-create-plugin-for-custom-analyzer/37213)
**Author:** [@tigerby](https://discuss.elastic.co/u/tigerby)\ **Replies:** 7\ **Last updated:** [December 16, 2015, 12:10am UTC](https://discuss.elastic.co/t/how-can-i-create-plugin-for-custom-analyzer/37213 "2015-12-16T00:10:08Z")
Hi. ES team. I'm using Elasticsearch 2.1.0. I want to create custom analyzer using plugin, but I don't know how. I read ES doc for plugin, and found some project like below, but Following those can't works for me (… --- ## [Get seconds from the timestamp and put the into separate field](https://discuss.elastic.co/t/get-seconds-from-the-timestamp-and-put-the-into-separate-field/35056)
**Author:** [@nkoleff](https://discuss.elastic.co/u/nkoleff)\ **Replies:** 5\ **Last updated:** [May 13, 2016, 10:43am UTC](https://discuss.elastic.co/t/get-seconds-from-the-timestamp-and-put-the-into-separate-field/35056 "2016-05-13T10:43:16Z")
Hello, I am trying to do the following: If the field mymessage contains My string, create another field called seconds and put there the bolded value of my timestamp - November 15th 2015, 08:42:29.779. In other words I … --- ## [Curl の PUT と POST に関する初歩的な質問](https://discuss.elastic.co/t/curl-put-post/50073)
**Author:** [@arum](https://discuss.elastic.co/u/arum)\ **Replies:** 2\ **Last updated:** [May 16, 2016, 1:00pm UTC](https://discuss.elastic.co/t/curl-put-post/50073 "2016-05-16T13:00:13Z")
問1) POSTとPUTの違いについて (a)更新の場合はPOST、新規作成の場合はPUT (b)新規作成の場合はPOST、更新の場合はPUT の2つの説明を見かけたのですが どちらが正しいのでしょうか。 問2) IDを指定せずにElasticSearchにIDを決定させる時は PUTではなくPOSTを使用しますが、 IDを新規に作成するわけだから新規作成になると 思いますが、そうするとPOSTは新規作成となるので 問1) は(b)… --- ## [Elastic Search is still initializing Kibana Index error](https://discuss.elastic.co/t/elastic-search-is-still-initializing-kibana-index-error/28449)
**Author:** [@BrianMu](https://discuss.elastic.co/u/BrianMu)\ **Replies:** 3\ **Last updated:** [September 2, 2015, 9:29pm UTC](https://discuss.elastic.co/t/elastic-search-is-still-initializing-kibana-index-error/28449 "2015-09-02T21:29:15Z")
Hi, recently created an elastic search cluster, set up Kibana 4, created dashboards and visualizations and all was working. Today, Kibana stopped working and when I try to restart it I get the message "Elastic Search i… --- ## [How to search an email](https://discuss.elastic.co/t/how-to-search-an-email/15729)
**Author:** [@Tiago\_Rodrigues](https://discuss.elastic.co/u/Tiago_Rodrigues)\ **Replies:** 2\ **Last updated:** [February 11, 2014, 1:29pm UTC](https://discuss.elastic.co/t/how-to-search-an-email/15729 "2014-02-11T13:29:12Z")
Hello to all, I need a query to search for an email. I tried using the query and match query term. But I did not get the results I expected. For example, I tried to search for 'tiago@email.com', match query giv… --- ## [Question regarding new logstash / netflow config](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992)
**Author:** [@Gary\_Wright](https://discuss.elastic.co/u/Gary_Wright)\ **Replies:** 5\ **Last updated:** [July 11, 2016, 11:33pm UTC](https://discuss.elastic.co/t/question-regarding-new-logstash-netflow-config/54992 "2016-07-11T23:33:14Z")
Hello All, I have a new ubuntu 16.04 instance in which I have just loaded a fresh install of the ELK stack on. I currently have logstash 2.3.4-1 installed and have also installed the netflow codec using the following … --- ## [Elasticsearch don't remove old shards](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272)
**Author:** [@09a9373743777d8430c4](https://discuss.elastic.co/u/09a9373743777d8430c4)\ **Replies:** 8\ **Last updated:** [September 28, 2021, 3:20pm UTC](https://discuss.elastic.co/t/elasticsearch-dont-remove-old-shards/284272 "2021-09-28T15:20:56Z")
Hi. This week after \_forcemerge?only\_expunge\_deletes=true I saw an increase in disk space usage (# 1 in the picture), after that I tried to reduce the number of replicas from 2 to 1 (# 2 in the picture), and also notice… --- ## [Es5 couldn't start due to the missing license plugin](https://discuss.elastic.co/t/es5-couldnt-start-due-to-the-missing-license-plugin/64630)
**Author:** [@andrezh](https://discuss.elastic.co/u/andrezh)\ **Replies:** 8\ **Last updated:** [November 2, 2016, 9:11pm UTC](https://discuss.elastic.co/t/es5-couldnt-start-due-to-the-missing-license-plugin/64630 "2016-11-02T21:11:17Z")
Hi, After upgrading es to 5.0, I couldn't launch it. I checked the log, and it initially says the plugin license is incompatible. I removed the license. Now I couldn't install the latest license to es 5.0. I search… --- ## [trustAnchors parameter must be non-empty](https://discuss.elastic.co/t/trustanchors-parameter-must-be-non-empty/131761)
**Author:** [@sarlacpit](https://discuss.elastic.co/u/sarlacpit)\ **Replies:** 4\ **Last updated:** [May 31, 2018, 7:29am UTC](https://discuss.elastic.co/t/trustanchors-parameter-must-be-non-empty/131761 "2018-05-31T07:29:29Z")
Hi folks, Using Ubuntu 18:04 LTS and the Elasticstack v6.1.3 and I seem to be running in to an error starting logstash: /usr/share/logstash/bin/logstash --debug --path.settings /etc/logstash OpenSSL::X509::StoreError: … --- ## [New way in which java\_execution breaks the aggregate filter](https://discuss.elastic.co/t/new-way-in-which-java-execution-breaks-the-aggregate-filter/239377)
**Author:** [@Badger](https://discuss.elastic.co/u/Badger)\ **Replies:** 4\ **Last updated:** [September 2, 2020, 12:47pm UTC](https://discuss.elastic.co/t/new-way-in-which-java-execution-breaks-the-aggregate-filter/239377 "2020-09-02T12:47:45Z")
When java\_execution is enabled, the periodic\_flush does not occur, so you cannot use a timeout to trigger flushing an event from an aggregate filter. I do not think the final flush occurs either. This is in 7.8.0, and I … --- ## [Error verifyng S3 repository with client name different from "default"](https://discuss.elastic.co/t/error-verifyng-s3-repository-with-client-name-different-from-default/197340)
**Author:** [@Ale\_R](https://discuss.elastic.co/u/Ale_R)\ **Replies:** 4\ **Last updated:** [September 25, 2019, 11:01am UTC](https://discuss.elastic.co/t/error-verifyng-s3-repository-with-client-name-different-from-default/197340 "2019-09-25T11:01:08Z")
Hi all, while configuring an S3 repository on my elasticsearch cluster (version 7.2) I get error " Unknown s3 client name \[elk4cohe\]. Existing client configs: default " Note: I'm trying to use an on-prem S3 storage (co… --- ## [Match all terms in document array](https://discuss.elastic.co/t/match-all-terms-in-document-array/24793)
**Author:** [@shah\_mcc](https://discuss.elastic.co/u/shah_mcc)\ **Replies:** 4\ **Last updated:** [July 3, 2015, 5:09pm UTC](https://discuss.elastic.co/t/match-all-terms-in-document-array/24793 "2015-07-03T17:09:35Z")
is there a way to match all terms in a document array? for eg. if my search array is \["1","2","3","4","5"\] and my documents have fields like "arr":\["1","3","5"\] "arr":\["1","2","7","9"\] "arr":\["1","8"\] Then only the fi… --- ## [Can I filter the logs using event IDs?](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 3:51pm UTC](https://discuss.elastic.co/t/can-i-filter-the-logs-using-event-ids/46639 "2016-04-07T15:51:45Z")
Hi, I am shipping auditing logs from Windows boxes to Elasticsearch server. I want to ship only auditing logs from the computer, how can I do it using Winlogbeat? --- ## [Shrink vs Reindex](https://discuss.elastic.co/t/shrink-vs-reindex/147426)
**Author:** [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\ **Replies:** 8\ **Last updated:** [September 6, 2018, 3:10pm UTC](https://discuss.elastic.co/t/shrink-vs-reindex/147426 "2018-09-06T15:10:32Z")
I am using curator to manage time-based indices, and am wanting to know if it would be better to use shrink action or the reindex action. My cluster has 2 "hot" nodes and one "cold" node. The hot nodes store incoming lo… --- ## [How to remove stuck persistent setting after upgrade](https://discuss.elastic.co/t/how-to-remove-stuck-persistent-setting-after-upgrade/113366)
**Author:** [@Jacket](https://discuss.elastic.co/u/Jacket)\ **Replies:** 8\ **Last updated:** [January 3, 2018, 4:26pm UTC](https://discuss.elastic.co/t/how-to-remove-stuck-persistent-setting-after-upgrade/113366 "2018-01-03T16:26:36Z")
I have just upgraded my cluster from 5.6 to 6.1. I did a rolling upgrade as the documentation specified. It looks like a setting that I was using isn't available anymore in 6.1. That would've been fine, but now I can't e… --- ## [Watcher: "daily" schedule doesn't work](https://discuss.elastic.co/t/watcher-daily-schedule-doesnt-work/143745)
**Author:** [@NatePrice](https://discuss.elastic.co/u/NatePrice)\ **Replies:** 5\ **Last updated:** [August 24, 2018, 2:52pm UTC](https://discuss.elastic.co/t/watcher-daily-schedule-doesnt-work/143745 "2018-08-24T14:52:31Z")
I am running Elastic 6.2.2. I have a Watcher query that works great as long as I use an "interval" as the trigger schedule, but does not fire if I use a "daily" specifier. The problem occurred when going from this: "tri… --- ## [JOIN different data sources](https://discuss.elastic.co/t/join-different-data-sources/47480)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 5\ **Last updated:** [April 23, 2016, 10:45pm UTC](https://discuss.elastic.co/t/join-different-data-sources/47480 "2016-04-23T22:45:34Z")
Hello, I wonder, if there is a way to join data that I'm currently receiving (in real time) with existing data (in elasticsearch). If yes, could you point me to how to do it? Thank you! --- ## [How to connect PostgreSQL Database using elastic Search?](https://discuss.elastic.co/t/how-to-connect-postgresql-database-using-elastic-search/36636)
**Author:** [@Rajnikant](https://discuss.elastic.co/u/Rajnikant)\ **Replies:** 5\ **Last updated:** [December 10, 2015, 8:06am UTC](https://discuss.elastic.co/t/how-to-connect-postgresql-database-using-elastic-search/36636 "2015-12-10T08:06:29Z")
I want to connect PostgreSQL database using Elasticsearch and use directly url of Elasticsearch in to js file. --- ## [Unable to use ctx.payload.hits.hits.0.\_source in transform script](https://discuss.elastic.co/t/unable-to-use-ctx-payload-hits-hits-0--source-in-transform-script/25672)
**Author:** [@crayy8](https://discuss.elastic.co/u/crayy8)\ **Replies:** 2\ **Last updated:** [July 17, 2015, 12:50pm UTC](https://discuss.elastic.co/t/unable-to-use-ctx-payload-hits-hits-0--source-in-transform-script/25672 "2015-07-17T12:50:04Z")
Can anyone tell me why I would not be able to use ctx.payload.hits.hits.index.\_source in a script? I get the bellow error when I try to assign it to a var ctx.vars.test1. However, when I do ctx.payload.hits and assign i… [Previous page](https://discuss.elastic.co/top.md?page=501&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=503&per_page=50&period=all)