# Top

**URL:** https://discuss.elastic.co/top.md?page=557&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 558

---

## [Any issue store integer values in text field](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143)

<div class="topic-metadata">

**Author:** [@jsjs2](https://discuss.elastic.co/u/jsjs2)\
**Replies:** 6\
**Last updated:** [February 10, 2022, 5:21pm UTC](https://discuss.elastic.co/t/any-issue-store-integer-values-in-text-field/296143 "2022-02-10T17:21:26Z")

</div>

Hi, I have type text field, the value for this field sometimes comes in as integer, it is store in ES as integer. any issue when querying this field later on? will the integer value be indexed as string value by ES? th…

---

## [Logstash - Unknown setting 'ssl\_certificate' & 'ssl\_key' for elasticsearch](https://discuss.elastic.co/t/logstash-unknown-setting-ssl-certificate-ssl-key-for-elasticsearch/256887)

<div class="topic-metadata">

**Author:** [@atharvak](https://discuss.elastic.co/u/atharvak)\
**Replies:** 6\
**Last updated:** [November 28, 2020, 10:38am UTC](https://discuss.elastic.co/t/logstash-unknown-setting-ssl-certificate-ssl-key-for-elasticsearch/256887 "2020-11-28T10:38:12Z")

</div>

Hi guys, I am trying to connect logstash with elasticsearch that has security enabled. While elasticsearch is running well with the SSL Certificates/keys, the same certificates/keys are not working for the Logstash. Fol…

---

## [Docker pull docker.elastic.co/elasticsearch/elasticsearch:7.5.2 getting "authentication required"](https://discuss.elastic.co/t/docker-pull-docker-elastic-co-elasticsearch-elasticsearch-7-5-2-getting-authentication-required/221918)

<div class="topic-metadata">

**Author:** [@achang77](https://discuss.elastic.co/u/achang77)\
**Replies:** 5\
**Last updated:** [March 3, 2020, 10:47pm UTC](https://discuss.elastic.co/t/docker-pull-docker-elastic-co-elasticsearch-elasticsearch-7-5-2-getting-authentication-required/221918 "2020-03-03T22:47:28Z")

</div>

Can anyone replicate?

---

## [Query/Filter amongs multiple indexes with specific query definition for each index](https://discuss.elastic.co/t/query-filter-amongs-multiple-indexes-with-specific-query-definition-for-each-index/56534)

<div class="topic-metadata">

**Author:** [@Kamil\_Hurajt](https://discuss.elastic.co/u/Kamil_Hurajt)\
**Replies:** 5\
**Last updated:** [July 27, 2016, 4:26pm UTC](https://discuss.elastic.co/t/query-filter-amongs-multiple-indexes-with-specific-query-definition-for-each-index/56534 "2016-07-27T16:26:12Z")

</div>

Hi I came into a problem with searching among multiple indexes. Let's say we have 2 indexes both indexes have almost same structure but one index got more fields what are not exist in first index. What I need to do…

---

## [Messages in Kibana appear truncated](https://discuss.elastic.co/t/messages-in-kibana-appear-truncated/239381)

<div class="topic-metadata">

**Author:** [@TomWBM](https://discuss.elastic.co/u/TomWBM)\
**Replies:** 2\
**Last updated:** [July 1, 2020, 12:48am UTC](https://discuss.elastic.co/t/messages-in-kibana-appear-truncated/239381 "2020-07-01T00:48:23Z")

</div>

I have an ELK implementation on a single server as a test box, I am receiving log data from a Mulesoft cluster via Filebeats at the source, received by Logstash at the server. When I view what should be a 3000+ line of l…

---

## [Elasticsearch.service: Main process exited, code=exited, status=1/FAILURE when setting TLS](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure-when-setting-tls/187870)

<div class="topic-metadata">

**Author:** [@derekmizak](https://discuss.elastic.co/u/derekmizak)\
**Replies:** 4\
**Last updated:** [June 27, 2019, 6:59pm UTC](https://discuss.elastic.co/t/elasticsearch-service-main-process-exited-code-exited-status-1-failure-when-setting-tls/187870 "2019-06-27T18:59:02Z")

</div>

ES 7.2 When following article about setting up cluster security https://www.elastic.co/blog/getting-started-with-elasticsearch-security I am unable to start elasticsearch instance, after adding the following to elastic…

---

## [APM Agent in Scala application](https://discuss.elastic.co/t/apm-agent-in-scala-application/138850)

<div class="topic-metadata">

**Author:** [@neirda](https://discuss.elastic.co/u/neirda)\
**Replies:** 4\
**Last updated:** [July 6, 2018, 10:03am UTC](https://discuss.elastic.co/t/apm-agent-in-scala-application/138850 "2018-07-06T10:03:49Z")

</div>

Hello. I am trying to use the APM with the java agent into a Scala application, built by sbt. I have installed and launched with success Elasticsearch and Kibana. I have also integrated the java agent into my applicat…

---

## [Optimizing and caching bundles for multiple Kibana instances](https://discuss.elastic.co/t/optimizing-and-caching-bundles-for-multiple-kibana-instances/40929)

<div class="topic-metadata">

**Author:** [@pemontto](https://discuss.elastic.co/u/pemontto)\
**Replies:** 1\
**Last updated:** [February 19, 2016, 10:07pm UTC](https://discuss.elastic.co/t/optimizing-and-caching-bundles-for-multiple-kibana-instances/40929 "2016-02-19T22:07:23Z")

</div>

We're currently using Kibana 4.1.4 and run multiple instances off the same install folder with different reverse proxies in front. During pilot testing with 4.3 and 4.4 we've noticed it creates bundle files but doesn't u…

---

## [How to use Elasticsearch from a SPA?](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522)

<div class="topic-metadata">

**Author:** [@kazza](https://discuss.elastic.co/u/kazza)\
**Replies:** 3\
**Last updated:** [July 26, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-from-a-spa/279522 "2021-07-26T12:23:19Z")

</div>

I have been wondering what is the best practice when wanting to query Elasticsearch directly from browser javascript. E.g. such as a React/VueJS/Angular application. I hoped that it would be possible to use a standard o…

---

## [The question on search: docs.count not equal hits.total](https://discuss.elastic.co/t/the-question-on-search-docs-count-not-equal-hits-total/19356)

<div class="topic-metadata">

**Author:** [@Arvin\_Wong](https://discuss.elastic.co/u/Arvin_Wong)\
**Replies:** 3\
**Last updated:** [August 20, 2014, 6:32am UTC](https://discuss.elastic.co/t/the-question-on-search-docs-count-not-equal-hits-total/19356 "2014-08-20T06:32:12Z")

</div>

Hi, When I scan my indices, it shows that: health index pri rep docs.count docs.deleted store.size pri.store.siz…

---

## [\[include\_in\_all\] is not allowed for indices (after upgrading to 6.0.0)](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769)

<div class="topic-metadata">

**Author:** [@dulman](https://discuss.elastic.co/u/dulman)\
**Replies:** 2\
**Last updated:** [December 4, 2017, 12:13pm UTC](https://discuss.elastic.co/t/include-in-all-is-not-allowed-for-indices-after-upgrading-to-6-0-0/109769 "2017-12-04T12:13:03Z")

</div>

Hello, we have upgraded our Elastic Stack (Elasticsearch, Logstash, Kibana, Beats) to version 6.0.0. Our Logstash config: input { tcp { type =\> app port =\> 5140 } } output { elasticsearch { hosts=\>…

---

## [Getting sum sub aggregation](https://discuss.elastic.co/t/getting-sum-sub-aggregation/93437)

<div class="topic-metadata">

**Author:** [@SamA](https://discuss.elastic.co/u/SamA)\
**Replies:** 1\
**Last updated:** [July 18, 2017, 8:26am UTC](https://discuss.elastic.co/t/getting-sum-sub-aggregation/93437 "2017-07-18T08:26:07Z")

</div>

I'd like to get the sum of a sub aggregation. For example, I have group by smartphones, group by carrier and then the average price for that carrier. I'd like to get the sum of all prices for all carriers for a specific …

---

## [Unable to see nginx response time field on kibana](https://discuss.elastic.co/t/unable-to-see-nginx-response-time-field-on-kibana/274563)

<div class="topic-metadata">

**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Replies:** 4\
**Last updated:** [June 3, 2021, 6:32am UTC](https://discuss.elastic.co/t/unable-to-see-nginx-response-time-field-on-kibana/274563 "2021-06-03T06:32:50Z")

</div>

Hello Team, Our architecture is Beats--\>Logstash--\>Elasticsaerch--\>Kibana and version is 7.10.2 for whole ELK stack. We are sending the nginx access logs on logstash using Filebeat nginx module and at logstash we are u…

---

## [Getting duplicate records with logstash JDBC plugin](https://discuss.elastic.co/t/getting-duplicate-records-with-logstash-jdbc-plugin/72716)

<div class="topic-metadata">

**Author:** [@praveen.nangunoori](https://discuss.elastic.co/u/praveen.nangunoori)\
**Replies:** 3\
**Last updated:** [January 26, 2017, 6:46am UTC](https://discuss.elastic.co/t/getting-duplicate-records-with-logstash-jdbc-plugin/72716 "2017-01-26T06:46:24Z")

</div>

Hi, I'm getting duplicate records when i run query for every one minute. Here is my conf file. input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@dbhost:port:SID" # The user we wish to execut…

---

## [Simple Elasticsearch cluster with 2 data nodes](https://discuss.elastic.co/t/simple-elasticsearch-cluster-with-2-data-nodes/41833)

<div class="topic-metadata">

**Author:** [@Alex\_Harvey](https://discuss.elastic.co/u/Alex_Harvey)\
**Replies:** 8\
**Last updated:** [February 17, 2016, 3:38am UTC](https://discuss.elastic.co/t/simple-elasticsearch-cluster-with-2-data-nodes/41833 "2016-02-17T03:38:15Z")

</div>

Hi all I am struggling a bit with the ES 2.2 documentation on clustering. Seems like there are many ways of building ES clusters and lots of blog posts out there from different stages of this project's history but a b…

---

## [Kibana 7.5 Data Table percentage using Json input](https://discuss.elastic.co/t/kibana-7-5-data-table-percentage-using-json-input/217740)

<div class="topic-metadata">

**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\
**Replies:** 7\
**Last updated:** [February 11, 2020, 7:51am UTC](https://discuss.elastic.co/t/kibana-7-5-data-table-percentage-using-json-input/217740 "2020-02-11T07:51:27Z")

</div>

I have problem, i have data and i want make kibana data Table like this, but i want create percentage beside each Col. like percentage DLV H-1, can i make it with Json input? i create Json input like { "script" : "do…

---

## [Removing fields with certain value (or if mapping is not found) from the output](https://discuss.elastic.co/t/removing-fields-with-certain-value-or-if-mapping-is-not-found-from-the-output/180941)

<div class="topic-metadata">

**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\
**Replies:** 7\
**Last updated:** [May 15, 2019, 1:21pm UTC](https://discuss.elastic.co/t/removing-fields-with-certain-value-or-if-mapping-is-not-found-from-the-output/180941 "2019-05-15T13:21:25Z")

</div>

Hello Guys, I have a Logstash pipeline, responsible for pulling xml files. Each xml is split as suggested here by @Badger : https://discuss.elastic.co/t/turning-one-xml-into-multiple-events-where-not-all-values-are-alwa…

---

## [Pvc s should not deleted while deleting a cluster](https://discuss.elastic.co/t/pvc-s-should-not-deleted-while-deleting-a-cluster/254846)

<div class="topic-metadata">

**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\
**Replies:** 6\
**Last updated:** [November 10, 2020, 7:01am UTC](https://discuss.elastic.co/t/pvc-s-should-not-deleted-while-deleting-a-cluster/254846 "2020-11-10T07:01:41Z")

</div>

While deleting a elasticsearch cluster, pvcs are also getting deleted. Is there any annotation that would remain pvc after deleting cluster?

---

## [Getting data into Elasticsearch?](https://discuss.elastic.co/t/getting-data-into-elasticsearch/25666)

<div class="topic-metadata">

**Author:** [@ziocho](https://discuss.elastic.co/u/ziocho)\
**Replies:** 6\
**Last updated:** [July 18, 2015, 4:26am UTC](https://discuss.elastic.co/t/getting-data-into-elasticsearch/25666 "2015-07-18T04:26:35Z")

</div>

Hello! This is my first large project in working with aggregating and searching data. I understand how to use Elasticsearch querying, however I'm unsure of how to actually give it the data I want. I'm looking to index …

---

## [Logstash hangs after few days and stops processing logfiles](https://discuss.elastic.co/t/logstash-hangs-after-few-days-and-stops-processing-logfiles/29780)

<div class="topic-metadata">

**Author:** [@wdijkerman](https://discuss.elastic.co/u/wdijkerman)\
**Replies:** 5\
**Last updated:** [April 4, 2016, 9:56am UTC](https://discuss.elastic.co/t/logstash-hangs-after-few-days-and-stops-processing-logfiles/29780 "2016-04-04T09:56:47Z")

</div>

Hi, We have an logstash running on an server and after a few days (3 - 5), it stops processing logfiles. The process is still running on the system, but it looks like it is hanging. In Kibana we see an gap for all data…

---

## [Filebeat & kafka integration not working](https://discuss.elastic.co/t/filebeat-kafka-integration-not-working/45207)

<div class="topic-metadata">

**Author:** [@rkarra](https://discuss.elastic.co/u/rkarra)\
**Replies:** 5\
**Last updated:** [March 23, 2016, 5:36pm UTC](https://discuss.elastic.co/t/filebeat-kafka-integration-not-working/45207 "2016-03-23T17:36:49Z")

</div>

Hello, I have probleme to communicate filebeat with Kafka. My working configuration is : Filebeat -\> Kafka -\> Logstash -\> Elasticsearch her is my filebeat.yml filebeat: prospectors: - paths: - /appli/okad/logs/…

---

## [UnsupportedDataTypeException when trying to send email](https://discuss.elastic.co/t/unsupporteddatatypeexception-when-trying-to-send-email/28634)

<div class="topic-metadata">

**Author:** [@graham\_](https://discuss.elastic.co/u/graham_)\
**Replies:** 5\
**Last updated:** [September 24, 2015, 2:11am UTC](https://discuss.elastic.co/t/unsupporteddatatypeexception-when-trying-to-send-email/28634 "2015-09-24T02:11:27Z")

</div>

On 2.0.0-beta1 \[ERROR\]\[org.elasticsearch.watcher.actions.email\] \[Morbius\] failed to execute action \[log\_error\_watch/send\_email\] javax.mail.MessagingException: failed to send email with subject \[Airphrame Error\] via acc…

---

## [Easiest way to check which visualizations are unused?](https://discuss.elastic.co/t/easiest-way-to-check-which-visualizations-are-unused/219354)

<div class="topic-metadata">

**Author:** [@TimB1](https://discuss.elastic.co/u/TimB1)\
**Replies:** 2\
**Last updated:** [February 14, 2020, 3:17pm UTC](https://discuss.elastic.co/t/easiest-way-to-check-which-visualizations-are-unused/219354 "2020-02-14T15:17:19Z")

</div>

Hi, I'm trying to tidy up our Elastic Stack instance getting rid of old dashboards and visualizations that aren't used anymore. For visualizations is there an easy way to see which visualizations aren't used on any das…

---

## [Counting each key of an array inside aggregation](https://discuss.elastic.co/t/counting-each-key-of-an-array-inside-aggregation/296060)

<div class="topic-metadata">

**Author:** [@hugomeloo](https://discuss.elastic.co/u/hugomeloo)\
**Replies:** 4\
**Last updated:** [February 3, 2022, 3:06pm UTC](https://discuss.elastic.co/t/counting-each-key-of-an-array-inside-aggregation/296060 "2022-02-03T15:06:41Z")

</div>

I am trying to make an aggregation in which I can count the number of times each key specific of an array is repeated. As an example: curl -XPUT "localhost:9200/products/\_mapping" -H 'Content-Type: application/json' -d'…

---

## [How to get a previous page from elasticsearch using search\_after?](https://discuss.elastic.co/t/how-to-get-a-previous-page-from-elasticsearch-using-search-after/105028)

<div class="topic-metadata">

**Author:** [@Evgeniy\_Kosinsky](https://discuss.elastic.co/u/Evgeniy_Kosinsky)\
**Replies:** 1\
**Last updated:** [November 1, 2017, 8:40pm UTC](https://discuss.elastic.co/t/how-to-get-a-previous-page-from-elasticsearch-using-search-after/105028 "2017-11-01T20:40:16Z")

</div>

We are trying to make fast pagination with search\_after. It is possible to move forward by search\_after. We are using next request: { "size":5, "search\_after": \[1508827804000, "data#123"\], "sort": \[{ "d…

---

## [Kibanaのアラート機能について](https://discuss.elastic.co/t/kibana/86025)

<div class="topic-metadata">

**Author:** [@Genta](https://discuss.elastic.co/u/Genta)\
**Replies:** 2\
**Last updated:** [May 17, 2017, 3:05am UTC](https://discuss.elastic.co/t/kibana/86025 "2017-05-17T03:05:01Z")

</div>

はじめての投稿です。よろしくお願いいたします。 Elasticsearch,Kibanaともに5.3.2を使用しています。 Kibanaで、データ抽出クエリにある閾値を設定して、更新した際にその閾値を超えればアラートがでる機能（またはそれに近い機能）はあるのでしょうか？ たとえば、あるシステムへのアクセス回数の日次統計を取得していて、1日のアクセス回数が10回を超えれば何らかのアラート（メール通知やポップアップ画面）がでるような。 ど…

---

## [Loading cluster information is taking too long. Try increasing the refresh interval](https://discuss.elastic.co/t/loading-cluster-information-is-taking-too-long-try-increasing-the-refresh-interval/28723)

<div class="topic-metadata">

**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Replies:** 2\
**Last updated:** [September 5, 2015, 9:22pm UTC](https://discuss.elastic.co/t/loading-cluster-information-is-taking-too-long-try-increasing-the-refresh-interval/28723 "2015-09-05T21:22:22Z")

</div>

Hello, I keep seeing this message repeating in the kopf interface: Loading cluster information is taking too long. Try increasing the refresh interval I tried setting my refresh interval to 60s, then 120s: index.r…

---

## [Node upgraded 2.0.0 to 2.3.2 can't communicate with other nodes in cluster](https://discuss.elastic.co/t/node-upgraded-2-0-0-to-2-3-2-cant-communicate-with-other-nodes-in-cluster/55925)

<div class="topic-metadata">

**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Replies:** 8\
**Last updated:** [July 21, 2016, 7:48pm UTC](https://discuss.elastic.co/t/node-upgraded-2-0-0-to-2-3-2-cant-communicate-with-other-nodes-in-cluster/55925 "2016-07-21T19:48:19Z")

</div>

We have a 4-node Elasticsearch cluster running 2.0.0. We upgraded our test environment to 2.3.2, but are running into problems upgrading our production environment. I followed the process for rolling upgrade. When the up…

---

## [Logstash unable to identify tags from filebeat ( grokparsefailure)](https://discuss.elastic.co/t/logstash-unable-to-identify-tags-from-filebeat-grokparsefailure/96129)

<div class="topic-metadata">

**Author:** [@Nikhilpawar1985](https://discuss.elastic.co/u/Nikhilpawar1985)\
**Replies:** 5\
**Last updated:** [August 8, 2017, 3:09pm UTC](https://discuss.elastic.co/t/logstash-unable-to-identify-tags-from-filebeat-grokparsefailure/96129 "2017-08-08T15:09:52Z")

</div>

Hi, i am sending two different logs files with filebeat agent with different tags on filebeat side to logstash but logstash only able to parse one file and failing for other . Below is my config. Can someone help . i…

---

## [Watcher license](https://discuss.elastic.co/t/watcher-license/24703)

<div class="topic-metadata">

**Author:** [@gphadke](https://discuss.elastic.co/u/gphadke)\
**Replies:** 4\
**Last updated:** [July 31, 2015, 8:02am UTC](https://discuss.elastic.co/t/watcher-license/24703 "2015-07-31T08:02:47Z")

</div>

Regarding the license of watcher, I am currently using it on a VM. If I reinstall my VM, will the license still be valid? What do I need to do to extend the development license? And also if I need additional dev licenses…

---

## [Running \_optimize, best practices](https://discuss.elastic.co/t/running--optimize-best-practices/10744)

<div class="topic-metadata">

**Author:** [@Milan\_Gornik](https://discuss.elastic.co/u/Milan_Gornik)\
**Replies:** 3\
**Last updated:** [February 16, 2013, 3:18pm UTC](https://discuss.elastic.co/t/running--optimize-best-practices/10744 "2013-02-16T15:18:06Z")

</div>

Hello, I am wondering about best practices in running \_optimize on index. Our index has around 25% of deleted\_docs in it right now. We noticed performance degradation as time passed. Since this is a lot of space t…

---

## [Where to set ElasticSearch request timeout?](https://discuss.elastic.co/t/where-to-set-elasticsearch-request-timeout/108732)

<div class="topic-metadata">

**Author:** [@imranazad](https://discuss.elastic.co/u/imranazad)\
**Replies:** 1\
**Last updated:** [November 27, 2017, 6:10pm UTC](https://discuss.elastic.co/t/where-to-set-elasticsearch-request-timeout/108732 "2017-11-27T18:10:10Z")

</div>

I've looked everywhere including the documentation regarding where I can set the request timeout for elasticsearch without much luck. In Visual Studio the intelliSense label for the property 'requestTimeout' states \`Not…

---

## [Error Discover](https://discuss.elastic.co/t/error-discover/230597)

<div class="topic-metadata">

**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\
**Replies:** 2\
**Last updated:** [April 30, 2020, 6:28pm UTC](https://discuss.elastic.co/t/error-discover/230597 "2020-04-30T18:28:23Z")

</div>

After indexing and choosing the time filter in "index Patterns", I go to "Discover" and present the following error. No results match your search criteria Expand your time range One or more of the indices you’re look…

---

## [File read chunk sizes](https://discuss.elastic.co/t/file-read-chunk-sizes/13145)

<div class="topic-metadata">

**Author:** [@Anand\_Nalya](https://discuss.elastic.co/u/Anand_Nalya)\
**Replies:** 7\
**Last updated:** [August 13, 2013, 10:11am UTC](https://discuss.elastic.co/t/file-read-chunk-sizes/13145 "2013-08-13T10:11:58Z")

</div>

Hi, I'm using NIOFS and I want to know what is the chunk size of the read requests given to the filesystem by ES while any search request is submitted. Is there any configuration for the same? Thanks, Anand …

---

## [Add custom field and its value needs to be derived from one of the source field](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119)

<div class="topic-metadata">

**Author:** [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)\
**Replies:** 5\
**Last updated:** [May 6, 2021, 4:48am UTC](https://discuss.elastic.co/t/add-custom-field-and-its-value-needs-to-be-derived-from-one-of-the-source-field/272119 "2021-05-06T04:48:03Z")

</div>

I need to add one custom field 'log.level' into filebeat.yml. ITs value needs to be derived from one of source field 'message'. I need to extract log level (INFO or DEBUG or ERROR etc.) from message. Message field looks …

---

## [Disk space, delete-by-query, forcemerge](https://discuss.elastic.co/t/disk-space-delete-by-query-forcemerge/147113)

<div class="topic-metadata">

**Author:** [@tmarly](https://discuss.elastic.co/u/tmarly)\
**Replies:** 5\
**Last updated:** [September 4, 2018, 5:04pm UTC](https://discuss.elastic.co/t/disk-space-delete-by-query-forcemerge/147113 "2018-09-04T17:04:43Z")

</div>

Hi, I have an index with ~ 100k doc. Every 5 minutes, I add in this index ~ 50k docs and delete the same number. This is not that much, however, each time, the disk space increase by ~ 15Mo, so after 12 hours the disk…

---

## [Display total sum in Kibana Dashboards](https://discuss.elastic.co/t/display-total-sum-in-kibana-dashboards/238302)

<div class="topic-metadata">

**Author:** [@Sherrie](https://discuss.elastic.co/u/Sherrie)\
**Replies:** 4\
**Last updated:** [June 25, 2020, 10:28am UTC](https://discuss.elastic.co/t/display-total-sum-in-kibana-dashboards/238302 "2020-06-25T10:28:36Z")

</div>

The following are my log messages: These together with date and time are grouped under "message" Read 24 records from duplicate error queue into database 30s, 39 Read 22 records from duplicate error queue into database…

---

## [Arithmetic Operations in logstash](https://discuss.elastic.co/t/arithmetic-operations-in-logstash/177183)

<div class="topic-metadata">

**Author:** [@dinesh1](https://discuss.elastic.co/u/dinesh1)\
**Replies:** 1\
**Last updated:** [April 17, 2019, 12:57pm UTC](https://discuss.elastic.co/t/arithmetic-operations-in-logstash/177183 "2019-04-17T12:57:39Z")

</div>

Hi Team, How to perform arithmetic Operations in logstash Example: (((field1)+((($field2)-(field1))/2))/300) Thanks, Dinesh

---

## [Kibana - Port 5601 is already in use. Another instance of Kibana may be running!](https://discuss.elastic.co/t/kibana-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/213804)

<div class="topic-metadata">

**Author:** [@Vinoth\_kumar\_Ramasam](https://discuss.elastic.co/u/Vinoth_kumar_Ramasam)\
**Replies:** 4\
**Last updated:** [January 10, 2020, 4:36pm UTC](https://discuss.elastic.co/t/kibana-port-5601-is-already-in-use-another-instance-of-kibana-may-be-running/213804 "2020-01-10T16:36:51Z")

</div>

Im trying to setup ELK stack version 7.5.1 in my 64 bit windows machine. But, im always keep on getting the following error whenever i tried to start Kibana. Also, I checked using netstat -ano | findstr 5601. It returned…

---

## [Missing shards](https://discuss.elastic.co/t/missing-shards/39401)

<div class="topic-metadata">

**Author:** [@ograso](https://discuss.elastic.co/u/ograso)\
**Replies:** 4\
**Last updated:** [January 18, 2016, 12:11am UTC](https://discuss.elastic.co/t/missing-shards/39401 "2016-01-18T00:11:43Z")

</div>

Hey everyone, We lost some cluster nodes and some of primary shards was lost. and I need to know how can I reindex remain data. how can I fix this mess. Please help me to solve this situation.

---

## [Beats deployment error on ECK 1.2.0](https://discuss.elastic.co/t/beats-deployment-error-on-eck-1-2-0/242260)

<div class="topic-metadata">

**Author:** [@ssurenr](https://discuss.elastic.co/u/ssurenr)\
**Replies:** 5\
**Last updated:** [July 28, 2020, 10:18am UTC](https://discuss.elastic.co/t/beats-deployment-error-on-eck-1-2-0/242260 "2020-07-28T10:18:13Z")

</div>

I tried to deploy a simple metrics beat CRD with the following manifest (Taken from the samples). apiVersion: beat.k8s.elastic.co/v1beta1 kind: Beat metadata: name: heartbeat namespace: elastic-system spec: type: …

---

## [Why does Logstash not restart from JDBC I/O errors?](https://discuss.elastic.co/t/why-does-logstash-not-restart-from-jdbc-i-o-errors/114422)

<div class="topic-metadata">

**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\
**Replies:** 8\
**Last updated:** [January 9, 2018, 1:57pm UTC](https://discuss.elastic.co/t/why-does-logstash-not-restart-from-jdbc-i-o-errors/114422 "2018-01-09T13:57:55Z")

</div>

For some reason lately I've been experiencing JDBC input I/O errors in Logstash's logs, but Logstash evidently doesn't do anything when it encounters these. It just hangs and the pipeline can't continue anymore. I have t…

---

## [Grok multi-line mode](https://discuss.elastic.co/t/grok-multi-line-mode/335101)

<div class="topic-metadata">

**Author:** [@M\_D](https://discuss.elastic.co/u/M_D)\
**Replies:** 7\
**Last updated:** [June 6, 2023, 7:44pm UTC](https://discuss.elastic.co/t/grok-multi-line-mode/335101 "2023-06-06T19:44:27Z")

</div>

I am using (?ms) in my grok filter, but got an error (see RegexpError: undefined). What should be the right way to lookup multiple lines using grok? in regular regex i amd doing (?sm)(?\<starttime\>\[0-9\]{4}-\[0-9\]{2}-\[0-9…

---

## [Shield and Azure AD?](https://discuss.elastic.co/t/shield-and-azure-ad/654)

<div class="topic-metadata">

**Author:** [@bradleach](https://discuss.elastic.co/u/bradleach)\
**Replies:** 7\
**Last updated:** [December 15, 2016, 9:29am UTC](https://discuss.elastic.co/t/shield-and-azure-ad/654 "2016-12-15T09:29:17Z")

</div>

Does anyone know if it is possible to use Azure AD with Shield? I'd love to have it set up so that you could manage users in Azure AD and secure Kibana via Shield.

---

## [Graph is unavailable for the current basic license. Please upgrade your license](https://discuss.elastic.co/t/graph-is-unavailable-for-the-current-basic-license-please-upgrade-your-license/152618)

<div class="topic-metadata">

**Author:** [@Paul-NamePros](https://discuss.elastic.co/u/Paul-NamePros)\
**Replies:** 6\
**Last updated:** [October 16, 2018, 9:45am UTC](https://discuss.elastic.co/t/graph-is-unavailable-for-the-current-basic-license-please-upgrade-your-license/152618 "2018-10-16T09:45:44Z")

</div>

I'm on a fresh 6.4.0 cluster. When I click Graph in Kibana, I get the following error: Graph: Graph is unavailable for the current basic license. Please upgrade your license. Likewise, for Machine Learning: Machin…

---

## [Recreate the automatically generated certificates](https://discuss.elastic.co/t/recreate-the-automatically-generated-certificates/350987)

<div class="topic-metadata">

**Author:** [@pxeedust](https://discuss.elastic.co/u/pxeedust)\
**Replies:** 2\
**Last updated:** [January 12, 2024, 10:25pm UTC](https://discuss.elastic.co/t/recreate-the-automatically-generated-certificates/350987 "2024-01-12T22:25:55Z")

</div>

Sorry for the beginner question, but I am having trouble regenerating the certificates that were made at deployment. I'm not familiar with how certificates work so I was hoping there might be a script that just regenerat…

---

## [Mitigation for Log4j2 vulnerability](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938)

<div class="topic-metadata">

**Author:** [@Programmer](https://discuss.elastic.co/u/Programmer)\
**Replies:** 4\
**Last updated:** [December 16, 2021, 1:21am UTC](https://discuss.elastic.co/t/mitigation-for-log4j2-vulnerability/291938 "2021-12-16T01:21:08Z")

</div>

Hi, I am using the below ELK stack versions. Might be old version. I would like to know whether these versions of ELK are vulnerable due to the log4j2 issue. Elasticsearch-2.3.3 logstash-2.3.1 kibana-4.5.1 I couldn'…

---

## [Yellow health for my indicies from Filebeat and Winlogbeat](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399)

<div class="topic-metadata">

**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\
**Replies:** 4\
**Last updated:** [June 27, 2018, 9:06am UTC](https://discuss.elastic.co/t/yellow-health-for-my-indicies-from-filebeat-and-winlogbeat/137399 "2018-06-27T09:06:37Z")

</div>

Hi, All my indicies from filebeat and winlogbeat have yellow status on Kibana monitoring. I have some shards on Unassigned Shards. What does it means that and how i can fix it? Best Regards, Thanos

---

## [Convert unix to standard date/time with milliseconds](https://discuss.elastic.co/t/convert-unix-to-standard-date-time-with-milliseconds/103411)

<div class="topic-metadata">

**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Replies:** 2\
**Last updated:** [October 10, 2017, 10:10pm UTC](https://discuss.elastic.co/t/convert-unix-to-standard-date-time-with-milliseconds/103411 "2017-10-10T22:10:07Z")

</div>

Elasticsearch 5.6 Logstash 5.6 I have a log that is created with the below field: unixTime: 1507655093 I am using the below logstash config to parse the date into the @timestamp field: date { match =\> \["unixTime", "…

---

## [Kibana data table](https://discuss.elastic.co/t/kibana-data-table/111089)

<div class="topic-metadata">

**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Replies:** 8\
**Last updated:** [December 15, 2017, 1:58pm UTC](https://discuss.elastic.co/t/kibana-data-table/111089 "2017-12-15T13:58:11Z")

</div>

Hi All, I want to export the raw file from the created data-table , so i created data table with seven columns and I was able to download the raw file, but I want to add one more column which is 8th column which is sol…

[Previous page](https://discuss.elastic.co/top.md?page=556&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=558&per_page=50&period=all)
