# Top **URL:** https://discuss.elastic.co/top.md?page=621&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 622 --- ## [Optimal chunk size for bulk & scan](https://discuss.elastic.co/t/optimal-chunk-size-for-bulk-scan/110941)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 3\ **Last updated:** [December 10, 2017, 9:59pm UTC](https://discuss.elastic.co/t/optimal-chunk-size-for-bulk-scan/110941 "2017-12-10T21:59:22Z")
We are using Elasticsearch python lib. We are doing a lot of bulk and scan operations. I wonder if there is any recommendation about the optimal bulk size for write/update operations and chuck size for scan read operatio… --- ## [Simple Scatter Plot - Vega Lite](https://discuss.elastic.co/t/simple-scatter-plot-vega-lite/233169)
**Author:** [@dilzeem](https://discuss.elastic.co/u/dilzeem)\ **Replies:** 5\ **Last updated:** [May 19, 2020, 5:29pm UTC](https://discuss.elastic.co/t/simple-scatter-plot-vega-lite/233169 "2020-05-19T17:29:16Z")
I am trying to create a simple scatter plot, using vega lite. I have tried a few different scenarios, and they all seem to be failing. First one is something like this { $schema: https://vega.github.io/schem… --- ## [Curator, delete old indices when cluster disk threshold is hit](https://discuss.elastic.co/t/curator-delete-old-indices-when-cluster-disk-threshold-is-hit/107400)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 5\ **Last updated:** [November 17, 2017, 9:56pm UTC](https://discuss.elastic.co/t/curator-delete-old-indices-when-cluster-disk-threshold-is-hit/107400 "2017-11-17T21:56:43Z")
Reading the curator documentation I can create a filter that is hit if total size of the cluster goes over X amount, and I can delete old indices if they are over a certain size. I can not for the life of me figure out … --- ## [Something like LEFT JOIN](https://discuss.elastic.co/t/something-like-left-join/51869)
**Author:** [@Jakub\_Koci](https://discuss.elastic.co/u/Jakub_Koci)\ **Replies:** 5\ **Last updated:** [June 5, 2016, 9:43pm UTC](https://discuss.elastic.co/t/something-like-left-join/51869 "2016-06-05T21:43:56Z")
I want to use elasticsearch for e-commerce project and have no idea how to model data of personalized products. There is list of base products and every user can personalize each product. What is the best choice how t… --- ## [Problem with logstash and beats](https://discuss.elastic.co/t/problem-with-logstash-and-beats/37376)
**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\ **Replies:** 5\ **Last updated:** [March 24, 2016, 6:48pm UTC](https://discuss.elastic.co/t/problem-with-logstash-and-beats/37376 "2016-03-24T18:48:43Z")
Hi, I have got the follow errors in logstash: {:timestamp=\>"2015-12-16T06:42:13.227000+0300", :message=\>"Beats input: unhandled exception", :exception=\>#\, :backtr… --- ## [ES nodes fail to start with floragunn search-guard installed](https://discuss.elastic.co/t/es-nodes-fail-to-start-with-floragunn-search-guard-installed/28648)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 1\ **Last updated:** [September 4, 2015, 3:04am UTC](https://discuss.elastic.co/t/es-nodes-fail-to-start-with-floragunn-search-guard-installed/28648 "2015-09-04T03:04:23Z")
Hey guys, I'd like to use an open source alternative to shield on my own non-work project. So I've read about floragunn search guard, but not had much luck with it. With the plugin installed #plugin --list Instal… --- ## [Date showing as UTC and indexed like it and not in local time](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382)
**Author:** [@LLK](https://discuss.elastic.co/u/LLK)\ **Replies:** 4\ **Last updated:** [February 20, 2018, 2:28am UTC](https://discuss.elastic.co/t/date-showing-as-utc-and-indexed-like-it-and-not-in-local-time/120382 "2018-02-20T02:28:27Z")
Hello, I have some auth0 logs streamed via Logstash where I use date filter to capture the date from the message itself. In the message the date is in the form of: 2018-02-19T00:35:32.145Z My date filter looks like th… --- ## [In-memory buffer?](https://discuss.elastic.co/t/in-memory-buffer/110611)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 4\ **Last updated:** [December 12, 2017, 1:40am UTC](https://discuss.elastic.co/t/in-memory-buffer/110611 "2017-12-12T01:40:14Z")
Hello . I am trying to understand the definitive guide precisely. Exactly , which setting is this in-memory indexing buffer referring to ? https://www.elastic.co/guide/en/elasticsearch/guide/current/translog.html In … --- ## [Load testing on elasticsearch cluster](https://discuss.elastic.co/t/load-testing-on-elasticsearch-cluster/14651)
**Author:** [@Bharvi\_Dixit\_2](https://discuss.elastic.co/u/Bharvi_Dixit_2)\ **Replies:** 4\ **Last updated:** [December 2, 2013, 4:49pm UTC](https://discuss.elastic.co/t/load-testing-on-elasticsearch-cluster/14651 "2013-12-02T16:49:20Z")
Hi, Could anyone tell me how can i do a load testing on my elasticsearch cluster.? I want to test how many concurrent user requests it can handle. Regards Bharvi Dixit -- You received this message becaus… --- ## [Filebeat reports :Error publishing events (retrying): read tcp IPA-\>9IPB5044: i/o timeout, why?](https://discuss.elastic.co/t/filebeat-reports-error-publishing-events-retrying-read-tcp-ipa-9ipb5044-i-o-timeout-why/89398)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 6\ **Last updated:** [June 15, 2017, 7:48pm UTC](https://discuss.elastic.co/t/filebeat-reports-error-publishing-events-retrying-read-tcp-ipa-9ipb5044-i-o-timeout-why/89398 "2017-06-15T19:48:05Z")
HEllo, I have updated my machine to filebeat 5 and now when trying to ship my logs I see that the shipping sometimes fails and I don't understand the reason. The error is the following when enabling debug 2017-06-… --- ## [How does search latency and index latency calculate on marvel's dashborad](https://discuss.elastic.co/t/how-does-search-latency-and-index-latency-calculate-on-marvels-dashborad/63178)
**Author:** [@makeyang](https://discuss.elastic.co/u/makeyang)\ **Replies:** 1\ **Last updated:** [October 24, 2016, 10:56pm UTC](https://discuss.elastic.co/t/how-does-search-latency-and-index-latency-calculate-on-marvels-dashborad/63178 "2016-10-24T22:56:47Z")
currently the latency is calcaluted by marvel is not fit with the valued we calculated from client side. so we'd like to konw how it calculated by marvel --- ## [Php client benchmarks, which library is faster?](https://discuss.elastic.co/t/php-client-benchmarks-which-library-is-faster/23049)
**Author:** [@Zelfapp](https://discuss.elastic.co/u/Zelfapp)\ **Replies:** 3\ **Last updated:** [July 15, 2015, 1:49pm UTC](https://discuss.elastic.co/t/php-client-benchmarks-which-library-is-faster/23049 "2015-07-15T13:49:52Z")
The only php client benchmark I can find for elasticsearch seems big time outdated: http://jolicode.com/blog/elasticsearch-php-clients-test-drive We are currently developing using the elasticsearch-php official libr… --- ## [Java client unable to connect - ClusterBlockException](https://discuss.elastic.co/t/java-client-unable-to-connect-clusterblockexception/8244)
**Author:** [@pnayak](https://discuss.elastic.co/u/pnayak)\ **Replies:** 3\ **Last updated:** [June 28, 2012, 6:10pm UTC](https://discuss.elastic.co/t/java-client-unable-to-connect-clusterblockexception/8244 "2012-06-28T18:10:29Z")
I'd appreciate any help/insight into this problem... Thanks in advance for your time and help! My ElasticSearch setup uses a single shard with no replica. I am running on a Rackspace cloud server. The works fi… --- ## [Why use Elastic Search-UI instead of ReactiveSearch? What are the differences? Is there a comparison table somewhere?](https://discuss.elastic.co/t/why-use-elastic-search-ui-instead-of-reactivesearch-what-are-the-differences-is-there-a-comparison-table-somewhere/296514)
**Author:** [@tombburnell](https://discuss.elastic.co/u/tombburnell)\ **Replies:** 5\ **Last updated:** [February 14, 2022, 9:42am UTC](https://discuss.elastic.co/t/why-use-elastic-search-ui-instead-of-reactivesearch-what-are-the-differences-is-there-a-comparison-table-somewhere/296514 "2022-02-14T09:42:40Z")
Why use Elasticsearch-UI instead of ReactiveSearch? What are the differences? Is there a comparison table somewhere? --- ## [Periodically query ES to store pre-computed totals - how?](https://discuss.elastic.co/t/periodically-query-es-to-store-pre-computed-totals-how/79203)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 5\ **Last updated:** [March 29, 2017, 4:47am UTC](https://discuss.elastic.co/t/periodically-query-es-to-store-pre-computed-totals-how/79203 "2017-03-29T04:47:37Z")
I have some 20 billion log lines per year going into an ES cluster, and am working on producing 5-minutely snapshots of several metrics to reduce compute cost at query time. Every 5 minutes I will calculate and store, fo… --- ## [Bulk Size error on filebeat](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 4\ **Last updated:** [May 29, 2017, 1:47pm UTC](https://discuss.elastic.co/t/bulk-size-error-on-filebeat/87373 "2017-05-29T13:47:33Z")
Hi there I'm seeing this on filebeat log file that I found just by accident while debuggin an issue. 2017-05-28T18:35:26Z INFO Error publishing events (retrying): 413 Request Entity Too Large In the configuration fil… --- ## [7.9 -\> 7.10 ECK experience](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510)
**Author:** [@3266miles](https://discuss.elastic.co/u/3266miles)\ **Replies:** 5\ **Last updated:** [December 7, 2020, 11:38pm UTC](https://discuss.elastic.co/t/7-9-7-10-eck-experience/257510 "2020-12-07T23:38:31Z")
So I've recently migrated our observability cluster from Elastic 7.9 to Elastic 7.10, and noticed some interesting gotchas that are worthy of discussion. I don't think these are bugs per say but there is definitely some … --- ## [Issues with elastic 8.x yum repository](https://discuss.elastic.co/t/issues-with-elastic-8-x-yum-repository/356184)
**Author:** [@kunalyadav](https://discuss.elastic.co/u/kunalyadav)\ **Replies:** 6\ **Last updated:** [March 27, 2024, 2:39pm UTC](https://discuss.elastic.co/t/issues-with-elastic-8-x-yum-repository/356184 "2024-03-27T14:39:56Z")
Hi, we've been experiencing issues with the elastic 8.x yum repository since this morning (UTC). The yum update command is failing with the following error $ sudo yum -y update-minimal --security --skip-broken Loaded p… --- ## [How to overwrite/rewrite message field after kv and remove field filters?](https://discuss.elastic.co/t/how-to-overwrite-rewrite-message-field-after-kv-and-remove-field-filters/47647)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 3\ **Last updated:** [April 19, 2016, 8:31am UTC](https://discuss.elastic.co/t/how-to-overwrite-rewrite-message-field-after-kv-and-remove-field-filters/47647 "2016-04-19T08:31:27Z")
Hi Experts, I need to overwrite my message field once I am done with kv filter . My flow would be like input{} filter { grok { match=\>\["message",'CEF:%{CEFNUM:cef}\[^\\|\\n\]\*\\|%{CEFBAR:dvcvendor}\\|%{CEFBAR:dvcprodu… --- ## [How many months of log data do we retain in Elasticsearch?](https://discuss.elastic.co/t/how-many-months-of-log-data-do-we-retain-in-elasticsearch/194104)
**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\ **Replies:** 6\ **Last updated:** [August 12, 2019, 8:01am UTC](https://discuss.elastic.co/t/how-many-months-of-log-data-do-we-retain-in-elasticsearch/194104 "2019-08-12T08:01:44Z")
How many months of log data does organization should store in Elasticsearch? Do we store the log data anywhere aside from Elasticsearch (e.g. flat files?) How do we archive old log data that is required for regulatory c… --- ## [Logstash shutdown stalled](https://discuss.elastic.co/t/logstash-shutdown-stalled/121086)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 0\ **Last updated:** [February 22, 2018, 4:19pm UTC](https://discuss.elastic.co/t/logstash-shutdown-stalled/121086 "2018-02-22T16:19:14Z")
Hi I've attempted to restart logstash and now find the following error: \[2018-02-22T15:54:41,710\]\[INFO \]\[logstash.pipeline \] Pipeline terminated {"pipeline.id"=\>".monitoring-logstash"} \[2018-02-22T15:54:46,200\]\[… --- ## [\[ANNOUNCEMENT\] logstash-input-rets released](https://discuss.elastic.co/t/announcement-logstash-input-rets-released/59852)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [September 6, 2016, 8:32am UTC](https://discuss.elastic.co/t/announcement-logstash-input-rets-released/59852 "2016-09-06T08:32:23Z")
A new Logstash input plugin called logstash-input-rets is now available to pull data out of MLS RETS servers (Real Estate Transaction Standard). We're still working on a few kinks but the input is fully functional. T… --- ## [Lumberjack output "Broken Pipe"](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 8\ **Last updated:** [April 3, 2019, 2:12pm UTC](https://discuss.elastic.co/t/lumberjack-output-broken-pipe/174936 "2019-04-03T14:12:52Z")
Hi, i've tried the lumberjack output to utilize the graylog beats input, but it doesn't get a connection. IDK if this is a problem on the logstash or graylog side. Does someone have tried to connect lumberjack to the b… --- ## [Kibana server is not ready yet - Fresh install on CentOS 8](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-fresh-install-on-centos-8/211023)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 2\ **Last updated:** [December 8, 2019, 7:43pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-fresh-install-on-centos-8/211023 "2019-12-08T19:43:18Z")
Hi Folks, I also recieve this error: Kibana server is not ready yet Tutorial I'm following: Java 11 NGINX as Reverse Proxy login is working fine Elasticsearch is running Logstash is running Active Internet connec… --- ## [Filebeat and bufferring](https://discuss.elastic.co/t/filebeat-and-bufferring/53225)
**Author:** [@sahas](https://discuss.elastic.co/u/sahas)\ **Replies:** 2\ **Last updated:** [June 20, 2016, 1:03pm UTC](https://discuss.elastic.co/t/filebeat-and-bufferring/53225 "2016-06-20T13:03:08Z")
Sorry, if its a naive question. Filebeat is configured to ship data to ES directly. Just incase ES is office and filebeat harvester found a log to ship, would it buffer, retry and ship? here is what I tried, my docker … --- ## [Execute Kibana savedsearch using curl command](https://discuss.elastic.co/t/execute-kibana-savedsearch-using-curl-command/172779)
**Author:** [@elborni96](https://discuss.elastic.co/u/elborni96)\ **Replies:** 4\ **Last updated:** [March 18, 2019, 3:36pm UTC](https://discuss.elastic.co/t/execute-kibana-savedsearch-using-curl-command/172779 "2019-03-18T15:36:43Z")
Hi all, i have create a new savedsearch on Kibana. Now I need to use the curl command from my terminal to recall the results of this savedsearch. The name of the savedsearch is : S-Cert-Feed How can i do this task? … --- ## [Problem with logstash output to elastic via ssl](https://discuss.elastic.co/t/problem-with-logstash-output-to-elastic-via-ssl/109248)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 4\ **Last updated:** [December 1, 2017, 3:27pm UTC](https://discuss.elastic.co/t/problem-with-logstash-output-to-elastic-via-ssl/109248 "2017-12-01T15:27:37Z")
Hello. I have the next output config: output { file { path =\> "/var/log/logstash/output" } elasticsearch { hosts =\> \["https://127.0.0.1:9200"\] … --- ## [My kibana failed to start](https://discuss.elastic.co/t/my-kibana-failed-to-start/123548)
**Author:** [@Phoebe](https://discuss.elastic.co/u/Phoebe)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 11:25am UTC](https://discuss.elastic.co/t/my-kibana-failed-to-start/123548 "2018-03-22T11:25:57Z")
elasticsearch is going well and my head plugins also working well,But i can't enter the web of kibana ,start it give me the error msg: \[root@localhost bin\]# events.js:160 throw er; // Unhandled 'error' event ^ Error… --- ## [Wild card search required instead of searching to a specific field name in elasticsearch](https://discuss.elastic.co/t/wild-card-search-required-instead-of-searching-to-a-specific-field-name-in-elasticsearch/53413)
**Author:** [@ajoealex](https://discuss.elastic.co/u/ajoealex)\ **Replies:** 6\ **Last updated:** [June 22, 2016, 1:43pm UTC](https://discuss.elastic.co/t/wild-card-search-required-instead-of-searching-to-a-specific-field-name-in-elasticsearch/53413 "2016-06-22T13:43:52Z")
I am working on elasticsearch 2.3.3. While querying the search, I am getting results only when field name is specified. ie GET /mydocs/\_search?q=file.content:cat but I need to search without giving the field name. … --- ## [Error en cluster, deja de ver los nodos de datos](https://discuss.elastic.co/t/error-en-cluster-deja-de-ver-los-nodos-de-datos/38063)
**Author:** [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)\ **Replies:** 4\ **Last updated:** [May 26, 2016, 6:17pm UTC](https://discuss.elastic.co/t/error-en-cluster-deja-de-ver-los-nodos-de-datos/38063 "2016-05-26T18:17:50Z")
Hola, tengo un cluster que esta compuesto por un nodo cliente, otros 2 de datos y un nodo master. Los nodos tienen 3gb cada uno (se que seria bueno darles mas, pero no tengo disponible en este momento). Actualmente hay u… --- ## [Visualize Time Range on Dashboard](https://discuss.elastic.co/t/visualize-time-range-on-dashboard/144748)
**Author:** [@cmcdonald](https://discuss.elastic.co/u/cmcdonald)\ **Replies:** 3\ **Last updated:** [September 11, 2018, 5:42pm UTC](https://discuss.elastic.co/t/visualize-time-range-on-dashboard/144748 "2018-09-11T17:42:47Z")
I'd like to be able to show, on a dashboard, the date range that is currently selected. The use case is that I have a metric up on a dashboard and people keep assuming it's an all-time count, not a "Last 7 Days" metric.… --- ## [How to convert json string to number](https://discuss.elastic.co/t/how-to-convert-json-string-to-number/126993)
**Author:** [@Rahulkumar](https://discuss.elastic.co/u/Rahulkumar)\ **Replies:** 3\ **Last updated:** [April 6, 2018, 6:34am UTC](https://discuss.elastic.co/t/how-to-convert-json-string-to-number/126993 "2018-04-06T06:34:54Z")
Hi All, I am sending custom json string with the help of http rest call. When index is created, the document is having string type for all kind of fields. there are few numeric values as well and I want to convert those… --- ## [Filebeat process with \`logging.json = true\` does not emit pure JSON to stdout](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522)
**Author:** [@cdaringe](https://discuss.elastic.co/u/cdaringe)\ **Replies:** 6\ **Last updated:** [January 22, 2018, 9:35pm UTC](https://discuss.elastic.co/t/filebeat-process-with-logging-json-true-does-not-emit-pure-json-to-stdout/112522 "2018-01-22T21:35:08Z")
Hi all: I am using filebeat in docker. I use it to send all my containers' logs from /some/docker/dir/\*-json.log to logstash. To make this work simply, I configure all of my services to write single-line, JSON log mes… --- ## [How to Log Elasticsearch's Own Logs?](https://discuss.elastic.co/t/how-to-log-elasticsearchs-own-logs/115928)
**Author:** [@morphers82](https://discuss.elastic.co/u/morphers82)\ **Replies:** 7\ **Last updated:** [January 31, 2018, 2:19am UTC](https://discuss.elastic.co/t/how-to-log-elasticsearchs-own-logs/115928 "2018-01-31T02:19:00Z")
Is there a best way to log the logs produced by Elasticsearch itself. I want to monitor All of the logs of all of the elasticsearch nodes in my cluster. Is there a guide for this that uses logstash/beats/ or something … --- ## [How to plot a line graph in kibana using 2 indexes](https://discuss.elastic.co/t/how-to-plot-a-line-graph-in-kibana-using-2-indexes/51985)
**Author:** [@abhi.kedari](https://discuss.elastic.co/u/abhi.kedari)\ **Replies:** 7\ **Last updated:** [June 6, 2016, 10:42pm UTC](https://discuss.elastic.co/t/how-to-plot-a-line-graph-in-kibana-using-2-indexes/51985 "2016-06-06T22:42:41Z")
Hi, I want to get data from multiple indexes and they might not have same pattern. I tried but it seems that I can get data from single index only at a time because it looks like discover works with only one index. I … --- ## [Input S3 does NOT work properly with prefix option](https://discuss.elastic.co/t/input-s3-does-not-work-properly-with-prefix-option/196426)
**Author:** [@jasony](https://discuss.elastic.co/u/jasony)\ **Replies:** 2\ **Last updated:** [August 26, 2019, 2:00am UTC](https://discuss.elastic.co/t/input-s3-does-not-work-properly-with-prefix-option/196426 "2019-08-26T02:00:56Z")
Hello, I am trying to set up a logstash pipeline with input source AWS S3. I set up as below and tested, and saw all log files were successfully retrieved by logstash. but only problem was from using "prefix" option. i… --- ## [Errors in while starting Logstash](https://discuss.elastic.co/t/errors-in-while-starting-logstash/117797)
**Author:** [@script007](https://discuss.elastic.co/u/script007)\ **Replies:** 4\ **Last updated:** [January 31, 2018, 12:04pm UTC](https://discuss.elastic.co/t/errors-in-while-starting-logstash/117797 "2018-01-31T12:04:36Z")
I feel something is not right in my conf file. Ant help. I am not able to start this conf file. Conf File: input { file { path =\> "/data/es/snmp/stage/snmp.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/nu… --- ## [Install Sense in FreeBSD](https://discuss.elastic.co/t/install-sense-in-freebsd/45888)
**Author:** [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Replies:** 4\ **Last updated:** [August 15, 2016, 4:43am UTC](https://discuss.elastic.co/t/install-sense-in-freebsd/45888 "2016-08-15T04:43:19Z")
I have Kibana installed with pkg install kibana43 and it is working nicely. Sense looks like a useful tool, so I looked at the install instructions but am having trouble. I can't find a kibana binary! The service rc file… --- ## [How can I check if the log file path contains a certain string in the logstash configuration using regex?](https://discuss.elastic.co/t/how-can-i-check-if-the-log-file-path-contains-a-certain-string-in-the-logstash-configuration-using-regex/224042)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 3\ **Last updated:** [March 31, 2020, 10:10am UTC](https://discuss.elastic.co/t/how-can-i-check-if-the-log-file-path-contains-a-certain-string-in-the-logstash-configuration-using-regex/224042 "2020-03-31T10:10:37Z")
I use filebeat to send logs to logstash, based on their file names - these logs are sent to specific indexes in elasticsearch. Filebeat works fine, logstash receives log files, but I can't get the regular expression in m… --- ## [Kibana - Need the ability to visualize data by Sankey Diagram and funnel Diagram](https://discuss.elastic.co/t/kibana-need-the-ability-to-visualize-data-by-sankey-diagram-and-funnel-diagram/179921)
**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\ **Replies:** 2\ **Last updated:** [May 7, 2019, 4:14pm UTC](https://discuss.elastic.co/t/kibana-need-the-ability-to-visualize-data-by-sankey-diagram-and-funnel-diagram/179921 "2019-05-07T16:14:25Z")
Hi Team, Is Kibana able to to visualize data by Sankey Diagram and Funnel Diagram? If not, any plan to support these 2 diagram in Kibana? Thanks, Cherie --- ## [Rsyslog collection using Logstash](https://discuss.elastic.co/t/rsyslog-collection-using-logstash/43728)
**Author:** [@gabe](https://discuss.elastic.co/u/gabe)\ **Replies:** 8\ **Last updated:** [March 9, 2016, 6:52am UTC](https://discuss.elastic.co/t/rsyslog-collection-using-logstash/43728 "2016-03-09T06:52:02Z")
Hi All, I was hoping for some help setting up syslog collection using the syslog input plugin for Logstash on Ubuntu 14.04 LTS. We have configured Topbeat, Logstash, Elasticsearch and Kibana and that seems to be wo… --- ## [Logstash Lumberjack Input Stops Processing](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031)
**Author:** [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Replies:** 8\ **Last updated:** [June 5, 2015, 8:53pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031 "2015-06-05T20:53:21Z")
Logstash 1.5.0 released version, logstash lumberjack input / rabbitMQ output goes idle after a few hours, in the log: 2015-05-20\_02:19:15.40710 {:timestamp=\>"2015-05-19T21:19:15.406000-0500", :message=\>"Lumberjack inpu… --- ## [Delete vs deletebyquery](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 7\ **Last updated:** [June 27, 2022, 11:54am UTC](https://discuss.elastic.co/t/delete-vs-deletebyquery/308183 "2022-06-27T11:54:59Z")
Hi, I want to delete over 10 million documents. Which approach is better and faster? Loop and delete each document with DELETE //\_doc/\<\_id\> OR perform deletebyquery? Thanks... --- ## [Yet another \_dateparsefailure](https://discuss.elastic.co/t/yet-another--dateparsefailure/41214)
**Author:** [@yammy](https://discuss.elastic.co/u/yammy)\ **Replies:** 7\ **Last updated:** [May 22, 2017, 5:02am UTC](https://discuss.elastic.co/t/yet-another--dateparsefailure/41214 "2017-05-22T05:02:34Z")
I'm having trouble with a dateparse failure and hoping someone can spot the issue. Sample log entry: PSAPPSRV.45377 (947) 2016-01-31T01:00:18.707 GetCertificate Detected time zone is EST I can grok the data successfu… --- ## [Elasticsearch not working with CORS](https://discuss.elastic.co/t/elasticsearch-not-working-with-cors/79152)
**Author:** [@ExiaSR](https://discuss.elastic.co/u/ExiaSR)\ **Replies:** 1\ **Last updated:** [March 24, 2017, 2:23pm UTC](https://discuss.elastic.co/t/elasticsearch-not-working-with-cors/79152 "2017-03-24T14:23:07Z")
Elasticsearch 5.2.2 I am using a http client library (axios) with web app to send request to the elasticsearch, however, after the preflight OPTIONS request, nothing happen after it. Thank you. NOTE: I am able to use… --- ## [Filebeat 5.0 - stuck in "ERR Problem putting initial state: prospector outlet closed"](https://discuss.elastic.co/t/filebeat-5-0-stuck-in-err-problem-putting-initial-state-prospector-outlet-closed/64027)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 7\ **Last updated:** [October 27, 2016, 7:24am UTC](https://discuss.elastic.co/t/filebeat-5-0-stuck-in-err-problem-putting-initial-state-prospector-outlet-closed/64027 "2016-10-27T07:24:23Z")
Hi, First of all congratz on 5.0 release! I've encountered a problem after upgrading from 5-0-rc1 to 5.0 with the same config that I used for 5.0-rc1. Filebeat does nothing now and only sends "ERR Problem putting … --- ## [How does Watcher Alert throttling exactly work?](https://discuss.elastic.co/t/how-does-watcher-alert-throttling-exactly-work/218123)
**Author:** [@zuerisee](https://discuss.elastic.co/u/zuerisee)\ **Replies:** 3\ **Last updated:** [February 12, 2020, 3:49pm UTC](https://discuss.elastic.co/t/how-does-watcher-alert-throttling-exactly-work/218123 "2020-02-12T15:49:15Z")
Hello everyone, I'm wondering how Watcher Alert throttling exactly works. Does the search result have any influence on the throttling? I'm using Watcher with APM and would like to get only one notification per error per… --- ## [Internal geo distance calculation in Elastic Search](https://discuss.elastic.co/t/internal-geo-distance-calculation-in-elastic-search/15889)
**Author:** [@golchhamohit](https://discuss.elastic.co/u/golchhamohit)\ **Replies:** 3\ **Last updated:** [February 19, 2014, 4:12pm UTC](https://discuss.elastic.co/t/internal-geo-distance-calculation-in-elastic-search/15889 "2014-02-19T16:12:11Z")
Hi all, I am new to this group and new to Elastic Search as well. I had been using geo location facilities of Elastic Search and I wondered how internally does the Elastic Search calculates distances … --- ## [Best practice for shard rebalancing when adding nodes](https://discuss.elastic.co/t/best-practice-for-shard-rebalancing-when-adding-nodes/202429)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 2\ **Last updated:** [October 7, 2019, 5:40am UTC](https://discuss.elastic.co/t/best-practice-for-shard-rebalancing-when-adding-nodes/202429 "2019-10-07T05:40:52Z")
I added two new data nodes into a 4-node cluster. But I noticed that after I added the two new nodes, the new index (5 shards) is only allocated to the two new nodes. As meanwhile, it is balancing the old indices as well… --- ## [Nested Json Parsing](https://discuss.elastic.co/t/nested-json-parsing/161997)
**Author:** [@Veena\_Kulkarni](https://discuss.elastic.co/u/Veena_Kulkarni)\ **Replies:** 2\ **Last updated:** [December 25, 2018, 7:22am UTC](https://discuss.elastic.co/t/nested-json-parsing/161997 "2018-12-25T07:22:23Z")
Need help in parsing nested json . Below is sample json : {"debug\_level":"ERROR","debug\_timestamp":"2018-12-21 05:15:57,559","debug\_thread":"ScalaTest","debug\_file":"Audit1.scala", "debug\_line":"27","debug\_message":{"Jo… [Previous page](https://discuss.elastic.co/top.md?page=620&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=622&per_page=50&period=all)