# Top **URL:** https://discuss.elastic.co/top.md?page=576&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 577 --- ## [RED Status Cluster - UNASSIGNED CLUSTER\_RECOVERED](https://discuss.elastic.co/t/red-status-cluster-unassigned-cluster-recovered/96304)
**Author:** [@ELK\_GB](https://discuss.elastic.co/u/ELK_GB)\ **Replies:** 2\ **Last updated:** [August 10, 2017, 8:15am UTC](https://discuss.elastic.co/t/red-status-cluster-unassigned-cluster-recovered/96304 "2017-08-10T08:15:39Z")
Hi, I have read many resources on red cluster, but I would really appreciate it if someone can tell me what to do here, as I’m stuck at this point not knowing what could work. \*\*\*Please note I took out cluster status d… --- ## [Simple\_query\_string and multi terms synonyms](https://discuss.elastic.co/t/simple-query-string-and-multi-terms-synonyms/174780)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 8\ **Last updated:** [April 5, 2019, 4:45pm UTC](https://discuss.elastic.co/t/simple-query-string-and-multi-terms-synonyms/174780 "2019-04-05T16:45:13Z")
I have a field with the following search\_analyzer: "name\_search\_en" : { "filter" : \[ "english\_possessive\_stemmer", "lowercase", "name\_synonyms\_en", "english\_stop", "english\_stemmer", "as… --- ## [Kibana не дает авторизоваться](https://discuss.elastic.co/t/kibana/100309)
**Author:** [@111140](https://discuss.elastic.co/u/111140)\ **Replies:** 5\ **Last updated:** [September 14, 2017, 10:43am UTC](https://discuss.elastic.co/t/kibana/100309 "2017-09-14T10:43:59Z")
Здравствуйте! Использую 1 ноду. Обновил облачный кластер до 5.6.0. После обновления не могу залогинится в kibana, ошибка "Login is currently disabled because the license could not be determined. Please check that Elast… --- ## [Shard initialization stuck - RecoveryFailedException](https://discuss.elastic.co/t/shard-initialization-stuck-recoveryfailedexception/170508)
**Author:** [@gri](https://discuss.elastic.co/u/gri)\ **Replies:** 4\ **Last updated:** [March 5, 2019, 8:56am UTC](https://discuss.elastic.co/t/shard-initialization-stuck-recoveryfailedexception/170508 "2019-03-05T08:56:39Z")
Hi, INITIAL PROBLEM: It seems that shards do not manage to finish their initialization. I keep getting the following exception in the logs 00:00:02.100 WARN org.elasticsearch.indices.cluster - \[00848fc0-8093-4f0f-97… --- ## [Getting Error "all shards failed" when I go for re-indexing](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577)
**Author:** [@Sarwar\_Kori](https://discuss.elastic.co/u/Sarwar_Kori)\ **Replies:** 7\ **Last updated:** [August 12, 2020, 6:46am UTC](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577 "2020-08-12T06:46:01Z")
{ "error" : { "root\_cause" : , "type" : "search\_phase\_execution\_exception", "reason" : "all shards failed", "phase" : "query", "grouped" : true, "failed\_shards" : }, "status" : 503 } --- ## [Log-stash not showing output in stdout](https://discuss.elastic.co/t/log-stash-not-showing-output-in-stdout/223610)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 7\ **Last updated:** [March 15, 2020, 7:17pm UTC](https://discuss.elastic.co/t/log-stash-not-showing-output-in-stdout/223610 "2020-03-15T19:17:49Z")
config -\> my config file logstash -f "C:\\busapps\\drsb\\gbl0\\logstash\\7.0.0\\bin\\pipelines\\logstash.conf" above is my command below is the output : \[2020-03-14T10:43:12,670\]\[WARN \]\[logstash.config.source.multilocal… --- ## [Mejorar rendimiento visualización Kibana](https://discuss.elastic.co/t/mejorar-rendimiento-visualizacion-kibana/117453)
**Author:** [@davidsoler95](https://discuss.elastic.co/u/davidsoler95)\ **Replies:** 7\ **Last updated:** [January 31, 2018, 12:09pm UTC](https://discuss.elastic.co/t/mejorar-rendimiento-visualizacion-kibana/117453 "2018-01-31T12:09:04Z")
Hola, Estamos usando el stack 5.6.6 Kibana+ElasticSearch+Filebeat (no podemos subir la versión porque las máquinas son de 32 bits) para representar trazas de log con Kibana. El rendimiento ha sido el adecuado hasta que… --- ## [Kibana 7.10 searching with special characters and wildcard](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 6\ **Last updated:** [September 7, 2021, 8:40am UTC](https://discuss.elastic.co/t/kibana-7-10-searching-with-special-characters-and-wildcard/283397 "2021-09-07T08:40:48Z")
I want to use \* with some special characters. e.g. url.path: "/apis/aa.bb.io/v1/checking"\* and user: "system"\* keep getting the error messages: KQLSyntaxError: Expected AND, OR, end of input, whitespace but "" found. … --- ## [Upgraded ES 5.6 \> 6.1 Now \_bulk not accepting header text/json](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448)
**Author:** [@ericohtake](https://discuss.elastic.co/u/ericohtake)\ **Replies:** 6\ **Last updated:** [December 20, 2017, 1:03pm UTC](https://discuss.elastic.co/t/upgraded-es-5-6-6-1-now-bulk-not-accepting-header-text-json/112448 "2017-12-20T13:03:57Z")
Hello, Today we updated ES to version 6.1 coming from 5.6 and all went good except for indexing Linux logs via a RSYSLOG plugin called omelasticsearch. I've setup an error output file that tells that the Content-Type he… --- ## [Duration\_in\_millis shows too high values](https://discuss.elastic.co/t/duration-in-millis-shows-too-high-values/108563)
**Author:** [@mathias](https://discuss.elastic.co/u/mathias)\ **Replies:** 2\ **Last updated:** [November 22, 2017, 1:22pm UTC](https://discuss.elastic.co/t/duration-in-millis-shows-too-high-values/108563 "2017-11-22T13:22:49Z")
Hi, I am using ELK 5.6.3 I am looking at the delay of events and I can't understand the output values. curl -s logstash:9600/\_node/stats/pipeline | jq .pipeline.plugins.outputs \[ { "id": "events\_output\_to\_elasti… --- ## [Logstash InfluxDB Output Plugin preformance](https://discuss.elastic.co/t/logstash-influxdb-output-plugin-preformance/102446)
**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\ **Replies:** 8\ **Last updated:** [October 5, 2017, 8:53am UTC](https://discuss.elastic.co/t/logstash-influxdb-output-plugin-preformance/102446 "2017-10-05T08:53:44Z")
Hello, I am using Logstash 5.6.1-1 on Centos 7. I have my input configured as an HTTP input, some filters and an output writing to InfluxDB, which is on another Linux server. My output configuration is as follows: outp… --- ## [No space left on device when elasticsearch 2.1.1stopped](https://discuss.elastic.co/t/no-space-left-on-device-when-elasticsearch-2-1-1stopped/38513)
**Author:** [@noemie](https://discuss.elastic.co/u/noemie)\ **Replies:** 1\ **Last updated:** [January 6, 2016, 7:51pm UTC](https://discuss.elastic.co/t/no-space-left-on-device-when-elasticsearch-2-1-1stopped/38513 "2016-01-06T19:51:02Z")
Hello, when trying to run Elasticsearch 2.1.1, I have " 'java.io.IOException No space left on device' due to disk space" error message and Elasticsearch fails to launch. I looked into the documentation, search on the i… --- ## [Make use of http.request.headers.Origin in kibana visualization](https://discuss.elastic.co/t/make-use-of-http-request-headers-origin-in-kibana-visualization/260671)
**Author:** [@Venkatesh\_Kumar](https://discuss.elastic.co/u/Venkatesh_Kumar)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:39pm UTC](https://discuss.elastic.co/t/make-use-of-http-request-headers-origin-in-kibana-visualization/260671 "2021-01-11T12:39:12Z")
I need to add http.request.headers.Origin in visualization lens for chart preparation. Those fields are not available for filtering. Any leads on this is much appreciated !!! Thanks --- ## [Multiple output to elasticsearch?](https://discuss.elastic.co/t/multiple-output-to-elasticsearch/27477)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 4\ **Last updated:** [August 17, 2015, 8:16am UTC](https://discuss.elastic.co/t/multiple-output-to-elasticsearch/27477 "2015-08-17T08:16:17Z")
Hi All, I would like to do multiple output to elasticsearch by logstash conf, but the following syntax of logstash conf seems incorrect I check redis (redis-cli monitor) received two keys miki and miki2, and sent it … --- ## [General Guidance on Updating ELK with minimum Fuss](https://discuss.elastic.co/t/general-guidance-on-updating-elk-with-minimum-fuss/232828)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 5\ **Last updated:** [May 17, 2020, 7:02pm UTC](https://discuss.elastic.co/t/general-guidance-on-updating-elk-with-minimum-fuss/232828 "2020-05-17T19:02:43Z")
I might be missing something but ELK updates (even minor versions like 7.6.2 to 7.7) can be a real pain with much downtime. Is there a guide which explains how to upgrade? We generally download the latest version, copy d… --- ## [Providing config files in docker command](https://discuss.elastic.co/t/providing-config-files-in-docker-command/108708)
**Author:** [@Sanju\_Mon](https://discuss.elastic.co/u/Sanju_Mon)\ **Replies:** 5\ **Last updated:** [November 23, 2017, 6:49am UTC](https://discuss.elastic.co/t/providing-config-files-in-docker-command/108708 "2017-11-23T06:49:10Z")
Hi, I am trying to run logstash on docker by using the custom configuration for logstash. Logstash for Docker was pulled using the following commands: docker pull docker.elastic.co/logstash/logstash:6.0.0 docker pull … --- ## [Elasticsearch primary stuck in initializing status,help?](https://discuss.elastic.co/t/elasticsearch-primary-stuck-in-initializing-status-help/57396)
**Author:** [@win1027](https://discuss.elastic.co/u/win1027)\ **Replies:** 5\ **Last updated:** [August 6, 2016, 10:36am UTC](https://discuss.elastic.co/t/elasticsearch-primary-stuck-in-initializing-status-help/57396 "2016-08-06T10:36:10Z")
elasticsearch 2.1.1. i have 147 index, 5shards 2 rep, and 7data note, now data note timeout and soon into cluster。now i have 40 index is in red status,and i see pri is in initializing status. what does is doing, and how … --- ## [What is the best way to profile Logstash?](https://discuss.elastic.co/t/what-is-the-best-way-to-profile-logstash/29956)
**Author:** [@thehybridtech](https://discuss.elastic.co/u/thehybridtech)\ **Replies:** 5\ **Last updated:** [October 1, 2015, 2:10pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-profile-logstash/29956 "2015-10-01T14:10:01Z")
A friend and I wrote a codec to parse syslog data for SAR files. The codec works great but performance is slow. What is the best way to profile logstash? VisualVM or jruby profiler? Is there any documentation on this… --- ## [How do I index an \_id with + symbol?](https://discuss.elastic.co/t/how-do-i-index-an-id-with-symbol/154946)
**Author:** [@Apollo](https://discuss.elastic.co/u/Apollo)\ **Replies:** 6\ **Last updated:** [November 2, 2018, 12:18am UTC](https://discuss.elastic.co/t/how-do-i-index-an-id-with-symbol/154946 "2018-11-02T00:18:41Z")
Making the switch from ES2 to ES6 and having a serious problem. Whenever I index a record with an id that contains a + symbol, Elasticsearch replaces the + with a space. The “id” field is correct, but the “\_id” field c… --- ## [Esrally stuck Running large\_terms](https://discuss.elastic.co/t/esrally-stuck-running-large-terms/141541)
**Author:** [@Andrew\_Yu](https://discuss.elastic.co/u/Andrew_Yu)\ **Replies:** 6\ **Last updated:** [July 27, 2018, 4:48am UTC](https://discuss.elastic.co/t/esrally-stuck-running-large-terms/141541 "2018-07-27T04:48:56Z")
Hi, I was running esrally to test the performance of an elasticsearch cluster of version 5.6.10. Esrally version is 1.0.0. It stucks when running large\_terms at percentage 3% for a very long time( more than 4 hours). He… --- ## [\[Solved\] Fingerprint does not work as expected II](https://discuss.elastic.co/t/solved-fingerprint-does-not-work-as-expected-ii/51560)
**Author:** [@Swen](https://discuss.elastic.co/u/Swen)\ **Replies:** 6\ **Last updated:** [June 1, 2016, 4:04pm UTC](https://discuss.elastic.co/t/solved-fingerprint-does-not-work-as-expected-ii/51560 "2016-06-01T16:04:07Z")
I want to use a fingerprint to put it into the document\_id. fingerprint { key =\> "78787878" method =\> "SHA1" } I expect this to make a hash from my 'message' and to see a 'fingerprint' variable with the hash in t… --- ## [Allocate specific shards on specific nodes](https://discuss.elastic.co/t/allocate-specific-shards-on-specific-nodes/45950)
**Author:** [@Jayme](https://discuss.elastic.co/u/Jayme)\ **Replies:** 4\ **Last updated:** [April 4, 2016, 8:36am UTC](https://discuss.elastic.co/t/allocate-specific-shards-on-specific-nodes/45950 "2016-04-04T08:36:57Z")
Hi, given that I have a cluster with for example 8 nodes elastic1 -\> elastic8 and I create an index with 8 shards, is there a way to enforce the following from the start: shard 1 should be on elastic1, shard 2 on el… --- ## [How many threads does a typical search use?](https://discuss.elastic.co/t/how-many-threads-does-a-typical-search-use/150934)
**Author:** [@maxshortzp](https://discuss.elastic.co/u/maxshortzp)\ **Replies:** 8\ **Last updated:** [October 13, 2018, 12:36am UTC](https://discuss.elastic.co/t/how-many-threads-does-a-typical-search-use/150934 "2018-10-13T00:36:26Z")
I'm trying to figure out if expensive queries are causing our search queues to back up and have some questions related to how elasticsearch counts threads. When a search request fans over multiple shards, does it use th… --- ## [Error and Warning messages](https://discuss.elastic.co/t/error-and-warning-messages/232668)
**Author:** [@meneses.pt](https://discuss.elastic.co/u/meneses.pt)\ **Replies:** 2\ **Last updated:** [May 26, 2020, 9:10am UTC](https://discuss.elastic.co/t/error-and-warning-messages/232668 "2020-05-26T09:10:33Z")
Is it possible to disable error/warning messages in kibana dashboards, or to somehow give a more generic error message? I'm getting an error/warning "1 of 48 shards failed" and I was wondering if there is a way to make … --- ## [Retrying failed action with response code 429](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-429/92502)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [July 11, 2017, 9:32am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-429/92502 "2017-07-11T09:32:37Z")
I'm seeing following message in elasticsearch's log: elk | \[2017-07-08T23:59:51,847\]\[INFO \]\[logstash.outputs.elasticsearch\] retrying failed action with response code: 429 ({"type"=\>"es\_rejected\_execution\_exception",… --- ## [Types Multiple Inputs / Filters / Outputs](https://discuss.elastic.co/t/types-multiple-inputs-filters-outputs/50487)
**Author:** [@esoulkitchen](https://discuss.elastic.co/u/esoulkitchen)\ **Replies:** 1\ **Last updated:** [May 19, 2016, 9:48pm UTC](https://discuss.elastic.co/t/types-multiple-inputs-filters-outputs/50487 "2016-05-19T21:48:40Z")
My inputs are a couple windows server, a linux server, and a Fortinet router. I am using Beats for the windows and linux servers. The Fortinet is forwarding it's logs. I am assigning a different type for each input (type… --- ## [Restrict User to a dashboard](https://discuss.elastic.co/t/restrict-user-to-a-dashboard/24145)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 5\ **Last updated:** [May 10, 2016, 12:57am UTC](https://discuss.elastic.co/t/restrict-user-to-a-dashboard/24145 "2016-05-10T00:57:45Z")
Hi Experts, Is it possible to restrict some users to a dashboard . I read about Shield , but is it possible without shield. My requirement is restricting sales user to sales dashboard only . They should not be autho… --- ## [Slow transform performance](https://discuss.elastic.co/t/slow-transform-performance/239785)
**Author:** [@magnalite](https://discuss.elastic.co/u/magnalite)\ **Replies:** 6\ **Last updated:** [July 3, 2020, 3:01pm UTC](https://discuss.elastic.co/t/slow-transform-performance/239785 "2020-07-03T15:01:27Z")
I'm currently running a simple transform across ~500M docs but it is doing so super slowly, seemingly searching at \<1000 docs/s, slower than we ingest them live. The nodes are barely getting their CPU or network used and… --- ## [Logstash gives error while trying to start multiple config files](https://discuss.elastic.co/t/logstash-gives-error-while-trying-to-start-multiple-config-files/60728)
**Author:** [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Replies:** 6\ **Last updated:** [September 19, 2016, 2:35pm UTC](https://discuss.elastic.co/t/logstash-gives-error-while-trying-to-start-multiple-config-files/60728 "2016-09-19T14:35:45Z")
Hi, We are collecting the application logs generated on one server, sending them to logstash using Filebeat. There are different format/types of log data, we had individual logstash config file to parse the data( i.e. … --- ## [How to connect ES in java](https://discuss.elastic.co/t/how-to-connect-es-in-java/37086)
**Author:** [@Arun\_Kumar](https://discuss.elastic.co/u/Arun_Kumar)\ **Replies:** 4\ **Last updated:** [December 16, 2015, 6:29pm UTC](https://discuss.elastic.co/t/how-to-connect-es-in-java/37086 "2015-12-16T18:29:51Z")
Hi ALL I m newbie of ES spend too much time for how to communicate ES with java find many article and example but get different-2 problem is there any simple example to how to done this ... any example , Step .. ple… --- ## [Multiple files, multiple outputs](https://discuss.elastic.co/t/multiple-files-multiple-outputs/38888)
**Author:** [@R\_T](https://discuss.elastic.co/u/R_T)\ **Replies:** 2\ **Last updated:** [January 12, 2016, 4:46pm UTC](https://discuss.elastic.co/t/multiple-files-multiple-outputs/38888 "2016-01-12T16:46:05Z")
I've an application that produces three files, each with very different multiline configs. Because of the multiline processing I created three different beats inputs in logstash, all on their own port, each handling th… --- ## [Kubernetes or VM?](https://discuss.elastic.co/t/kubernetes-or-vm/140966)
**Author:** [@Gabriel1](https://discuss.elastic.co/u/Gabriel1)\ **Replies:** 3\ **Last updated:** [July 23, 2018, 4:20am UTC](https://discuss.elastic.co/t/kubernetes-or-vm/140966 "2018-07-23T04:20:18Z")
Hi ! I would like to understand the pros / cons of deploying Elasticsearch on Kubernetes or VMs ? many thanks !! : ) Gab --- ## [\[SOLVED\] Reindex with index pattern](https://discuss.elastic.co/t/solved-reindex-with-index-pattern/52331)
**Author:** [@axelfelix](https://discuss.elastic.co/u/axelfelix)\ **Replies:** 2\ **Last updated:** [June 9, 2016, 1:42pm UTC](https://discuss.elastic.co/t/solved-reindex-with-index-pattern/52331 "2016-06-09T13:42:25Z")
Hi all, I want to test the reindex API follow the documentation. Did anybody try to reindex based on pattern index, like: POST /\_reindex { "source": { "index": "test\*" }, "dest": { "index": "new\_test\*" … --- ## [Metricbeat not reporting on port 10255 anymore using latest kubernetes, how to use the secured port 10250?](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605)
**Author:** [@pastorsx](https://discuss.elastic.co/u/pastorsx)\ **Replies:** 5\ **Last updated:** [October 30, 2018, 11:42am UTC](https://discuss.elastic.co/t/metricbeat-not-reporting-on-port-10255-anymore-using-latest-kubernetes-how-to-use-the-secured-port-10250/153605 "2018-10-30T11:42:19Z")
Hi all, I've been using metricbeat through its helm chart to install in a kubernetes cluster. It used to work by going though port 10255 which was a non-secured read only port.. but it seems latest releases of kubernete… --- ## [Retrieving a date range in c#](https://discuss.elastic.co/t/retrieving-a-date-range-in-c/152304)
**Author:** [@donElk](https://discuss.elastic.co/u/donElk)\ **Replies:** 5\ **Last updated:** [October 24, 2018, 2:27am UTC](https://discuss.elastic.co/t/retrieving-a-date-range-in-c/152304 "2018-10-24T02:27:07Z")
Hello, I am trying to get a list of records from my Elasticsearch client using C#. Within my Elasticsearch index I have a field called startdate. I am looking to query a date range based off this code. List\ **Author:** [@Zachary\_Buckholz](https://discuss.elastic.co/u/Zachary_Buckholz)\ **Replies:** 5\ **Last updated:** [August 20, 2015, 10:07pm UTC](https://discuss.elastic.co/t/proactive-elk-stack-monitoring/27759 "2015-08-20T22:07:21Z") I am looking for ideas on how to send an automated UUID through the ELK stack and make sure it arrives in the elasticsearch cluster. Basically some sort of elasticsearch process that generates the UUID inserts a record… --- ## [Logstash input/ouput limits per/sec](https://discuss.elastic.co/t/logstash-input-ouput-limits-per-sec/110239)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 4\ **Last updated:** [December 8, 2017, 4:48am UTC](https://discuss.elastic.co/t/logstash-input-ouput-limits-per-sec/110239 "2017-12-08T04:48:55Z")
hi everyone. could someone point out the logstash limit, plz? let me say my scenario first. i use cloudwatch\_logs input \> do 50-line grok match filter \> elasticsearch output base on my script, i would like to know fe… --- ## [Get "elasticesearch conflicts with elasticsearch-oss-0:6.6.1-1.noarch" during upgrade](https://discuss.elastic.co/t/get-elasticesearch-conflicts-with-elasticsearch-oss-0-6-6-1-1-noarch-during-upgrade/172701)
**Author:** [@John\_Zhang1](https://discuss.elastic.co/u/John_Zhang1)\ **Replies:** 6\ **Last updated:** [March 18, 2019, 3:38am UTC](https://discuss.elastic.co/t/get-elasticesearch-conflicts-with-elasticsearch-oss-0-6-6-1-1-noarch-during-upgrade/172701 "2019-03-18T03:38:44Z")
Dears, I am new to ELK and just take over from another colleague. I need to upgrade current Elasticsearch 6.2.3 to 6.6.1, and because of license limitation, have to use the opensource version. As the guide https://www.e… --- ## [Capture environment variable](https://discuss.elastic.co/t/capture-environment-variable/33635)
**Author:** [@sijis](https://discuss.elastic.co/u/sijis)\ **Replies:** 6\ **Last updated:** [June 15, 2016, 1:51pm UTC](https://discuss.elastic.co/t/capture-environment-variable/33635 "2016-06-15T13:51:34Z")
Is it possible (or in the plans) to dynamically capture environment variable within a prospects entry or in tags on input section? Is there another way to do this instead? We have a lot of instances and its not feasibl… --- ## [Replicating Splunk query](https://discuss.elastic.co/t/replicating-splunk-query/96158)
**Author:** [@shroh](https://discuss.elastic.co/u/shroh)\ **Replies:** 3\ **Last updated:** [August 8, 2017, 5:48pm UTC](https://discuss.elastic.co/t/replicating-splunk-query/96158 "2017-08-08T17:48:10Z")
Hi I have injested my data into ELK and i can see the data in Kibana as well. in splunk i have this query index=app “verifyStatusCode” | stats ExecutionTime I can see the ExecutionTime field in kibana as per my GROK f… --- ## [Elastic document\_id](https://discuss.elastic.co/t/elastic-document-id/328738)
**Author:** [@bmagistro1](https://discuss.elastic.co/u/bmagistro1)\ **Replies:** 5\ **Last updated:** [March 30, 2023, 4:08pm UTC](https://discuss.elastic.co/t/elastic-document-id/328738 "2023-03-30T16:08:51Z")
Is there any defined behavior for document\_id (Elasticsearch output plugin | Logstash Reference \[8.6\] | Elastic) similar to pipeline (Elasticsearch output plugin | Logstash Reference \[8.6\] | Elastic)? We have at least o… --- ## [Unable to free disk space after deleting some documents](https://discuss.elastic.co/t/unable-to-free-disk-space-after-deleting-some-documents/47325)
**Author:** [@Pradeep\_Gowda](https://discuss.elastic.co/u/Pradeep_Gowda)\ **Replies:** 5\ **Last updated:** [April 14, 2016, 2:00am UTC](https://discuss.elastic.co/t/unable-to-free-disk-space-after-deleting-some-documents/47325 "2016-04-14T02:00:01Z")
Hey All, I deleted few documents using Java API using bulk API. The response was a success and when I check the disk space, I did not see any change. Later I used force merge to optimize the index as shown below F… --- ## [Logstash Exec Input Plugin throws OutofMemory Error](https://discuss.elastic.co/t/logstash-exec-input-plugin-throws-outofmemory-error/146172)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 0\ **Last updated:** [August 27, 2018, 12:04pm UTC](https://discuss.elastic.co/t/logstash-exec-input-plugin-throws-outofmemory-error/146172 "2018-08-27T12:04:15Z")
Hi, We are running a program to read some events off our API and send them to Elasticsearch. Since http poller plugin does not support dynamic parameters (in our case timestamp when last poll was done), we use a custom … --- ## [Rsyslog OR Filebeat, which is better for forwarding logs?](https://discuss.elastic.co/t/rsyslog-or-filebeat-which-is-better-for-forwarding-logs/88386)
**Author:** [@sLuvpreet33](https://discuss.elastic.co/u/sLuvpreet33)\ **Replies:** 1\ **Last updated:** [June 6, 2017, 10:44pm UTC](https://discuss.elastic.co/t/rsyslog-or-filebeat-which-is-better-for-forwarding-logs/88386 "2017-06-06T22:44:15Z")
I am using Filebeat to send logs to logstash and then to elasticsearch. But now, I am thinking of sending the logs to a single rsyslog-server(over UDP/TCP) and then to logstash to elasticsearch. By this way, I will not… --- ## [Logstash conditional for nested field](https://discuss.elastic.co/t/logstash-conditional-for-nested-field/131042)
**Author:** [@rmac](https://discuss.elastic.co/u/rmac)\ **Replies:** 2\ **Last updated:** [May 11, 2018, 5:05pm UTC](https://discuss.elastic.co/t/logstash-conditional-for-nested-field/131042 "2018-05-11T17:05:32Z")
I understand in Logstash you can access nested fields, for example like this in a filter block mutate { replace =\> { "timestamp" =\> "%{timestamp} %{\[beat\]\[timezone\]}" } } However I seem to be unable to access the… --- ## [How to update the date format of an exist date field with PUT mapping API?](https://discuss.elastic.co/t/how-to-update-the-date-format-of-an-exist-date-field-with-put-mapping-api/38786)
**Author:** [@Red](https://discuss.elastic.co/u/Red)\ **Replies:** 2\ **Last updated:** [January 10, 2016, 10:41am UTC](https://discuss.elastic.co/t/how-to-update-the-date-format-of-an-exist-date-field-with-put-mapping-api/38786 "2016-01-10T10:41:40Z")
im facing a problem that i must update the date format from "YYYY-MM-DD" to "YYYY-MM-DD HH:mm:ss", i want to implement without reindexing. and i found the answer in document: The format setting must have the same set… --- ## [Illegal User Settings](https://discuss.elastic.co/t/illegal-user-settings/65610)
**Author:** [@Sudhir\_Kumar](https://discuss.elastic.co/u/Sudhir_Kumar)\ **Replies:** 6\ **Last updated:** [November 15, 2016, 1:04pm UTC](https://discuss.elastic.co/t/illegal-user-settings/65610 "2016-11-15T13:04:55Z")
Hi I am getting an illegal User Settings error while updating user settings. I am using Elasticsearch 2.4.1 when i have updated user settings and click on Update getting an error saying Illegal User Settings. I am tryi… --- ## [Getting 404 shard\_not\_found\_exception frequently](https://discuss.elastic.co/t/getting-404-shard-not-found-exception-frequently/245033)
**Author:** [@ravib](https://discuss.elastic.co/u/ravib)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 3:06pm UTC](https://discuss.elastic.co/t/getting-404-shard-not-found-exception-frequently/245033 "2020-08-18T15:06:28Z")
I have an index with 2 replicas and 1 shard on a 3 node elastic search server (7.6.1). On bulk requests (index) I keep getting shard\_not\_found\_exception, any thoughts? --- ## [Http output not working : http output failure for Logstash 5.0\[SOLVED\]](https://discuss.elastic.co/t/http-output-not-working-http-output-failure-for-logstash-5-0-solved/71517)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 3\ **Last updated:** [January 30, 2017, 6:54pm UTC](https://discuss.elastic.co/t/http-output-not-working-http-output-failure-for-logstash-5-0-solved/71517 "2017-01-30T18:54:20Z")
Hi All Here is my output conf file, i am not able to post data to endpoint output { http { url =\> "https://abcd.com/dataEventRequests" http\_method =\> "post" content\_type =\> "application/vn… --- ## [Unable to load config file. access denied (/usr/share/elasticsearch/.aws/config)](https://discuss.elastic.co/t/unable-to-load-config-file-access-denied-usr-share-elasticsearch-aws-config/307583)
**Author:** [@wedas](https://discuss.elastic.co/u/wedas)\ **Replies:** 5\ **Last updated:** [June 28, 2022, 3:04pm UTC](https://discuss.elastic.co/t/unable-to-load-config-file-access-denied-usr-share-elasticsearch-aws-config/307583 "2022-06-28T15:04:53Z")
I'm setting elk stack with docker-compose. But I'm getting a warning. Does anyone know the cause or can guide me on what wrong step I took? Warning from Terminal{"@timestamp":"2022-06-19T10:40:48.631Z&quo… [Previous page](https://discuss.elastic.co/top.md?page=575&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=577&per_page=50&period=all)