# Top

**URL:** https://discuss.elastic.co/top.md?page=668&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 669

---

## [Ceph as elasticserach backend](https://discuss.elastic.co/t/ceph-as-elasticserach-backend/68993)

<div class="topic-metadata">

**Author:** [@KamalSaurabh](https://discuss.elastic.co/u/KamalSaurabh)\
**Replies:** 4\
**Last updated:** [December 15, 2016, 10:19am UTC](https://discuss.elastic.co/t/ceph-as-elasticserach-backend/68993 "2016-12-15T10:19:48Z")

</div>

Is it possible to use any distributed filesystem like ceph, as elasticsearch storage backend

---

## [Cross cluster replication in different regions in aws elasticsearch](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067)

<div class="topic-metadata">

**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\
**Replies:** 8\
**Last updated:** [December 1, 2020, 9:18am UTC](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067 "2020-12-01T09:18:42Z")

</div>

Hi .. i am migrating to aws managed elasticsearch from self hosted es.. as part of migration facing an issue with backup(snapshot) and restore. we have 2 distinct clusters preferably us-east and us-west , snapshot repos…

---

## [Heartbeat list of host help](https://discuss.elastic.co/t/heartbeat-list-of-host-help/217415)

<div class="topic-metadata">

**Author:** [@delatucci](https://discuss.elastic.co/u/delatucci)\
**Replies:** 8\
**Last updated:** [February 10, 2020, 5:41pm UTC](https://discuss.elastic.co/t/heartbeat-list-of-host-help/217415 "2020-02-10T17:41:16Z")

</div>

Hi all, I am trying to configure an icmp.yml file to ping a list of hosts on my network. I got it to ping the host that part is working, how do I add name: to the list of host. type: icmp enabled: true schedule: '@…

---

## [Arabic Tokenizer](https://discuss.elastic.co/t/arabic-tokenizer/12370)

<div class="topic-metadata">

**Author:** [@tarang\_dawer](https://discuss.elastic.co/u/tarang_dawer)\
**Replies:** 3\
**Last updated:** [June 17, 2013, 7:31am UTC](https://discuss.elastic.co/t/arabic-tokenizer/12370 "2013-06-17T07:31:36Z")

</div>

Hi I want to use arabic tokenizer for some arabic content, but the documentation for it is a bit scarce on the ES site, so , please , could someone , explain , what tokenizer(standard or is there some arabic tokenize…

---

## [APM java agent on JBoss 6](https://discuss.elastic.co/t/apm-java-agent-on-jboss-6/144066)

<div class="topic-metadata">

**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Replies:** 5\
**Last updated:** [August 14, 2018, 12:00pm UTC](https://discuss.elastic.co/t/apm-java-agent-on-jboss-6/144066 "2018-08-14T12:00:46Z")

</div>

Hello all, i have problems to use the apm-java-agent within a jboss6 application server. I know this server isn't listed in the officaly supported webservers, but i hope someone can help. The problem lies probably not …

---

## [Searching Integer with wild cards](https://discuss.elastic.co/t/searching-integer-with-wild-cards/114262)

<div class="topic-metadata">

**Author:** [@Prashant.kasodariya](https://discuss.elastic.co/u/Prashant.kasodariya)\
**Replies:** 5\
**Last updated:** [January 5, 2018, 1:16pm UTC](https://discuss.elastic.co/t/searching-integer-with-wild-cards/114262 "2018-01-05T13:16:26Z")

</div>

Can anyone please help me identifying how to use wild cards for integer searches? I tried using the inline script but no luck. This is what I have tried (I have also tried with different regex pattern which works for jav…

---

## [Logstash - Aggregate Filter](https://discuss.elastic.co/t/logstash-aggregate-filter/108026)

<div class="topic-metadata">

**Author:** [@kazul33](https://discuss.elastic.co/u/kazul33)\
**Replies:** 2\
**Last updated:** [November 17, 2017, 7:33pm UTC](https://discuss.elastic.co/t/logstash-aggregate-filter/108026 "2017-11-17T19:33:01Z")

</div>

I'm working with auditd and I'm trying to take multiple events, with the same auditID, and convert it (insert a new document) into one document. The end goal would be to have the original documents be submitted, but the…

---

## [Packetbeat refuses to start - yaml error](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608)

<div class="topic-metadata">

**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Replies:** 2\
**Last updated:** [March 8, 2016, 4:37am UTC](https://discuss.elastic.co/t/packetbeat-refuses-to-start-yaml-error/43608 "2016-03-08T04:37:07Z")

</div>

Hey guys, I've had a decent set of beats configs distributed by puppet and running well for oh about a month at this point. When suddenly packetbeat as of yesterday stopped functioning. There were know known changes. …

---

## [Auto-delete zipkin indices](https://discuss.elastic.co/t/auto-delete-zipkin-indices/247545)

<div class="topic-metadata">

**Author:** [@ajoshi83](https://discuss.elastic.co/u/ajoshi83)\
**Replies:** 6\
**Last updated:** [September 10, 2020, 9:00am UTC](https://discuss.elastic.co/t/auto-delete-zipkin-indices/247545 "2020-09-10T09:00:37Z")

</div>

Hi. I am using Elastic Search 7.3.1 as a storage engine for OpenZipkin. Zipkin creates a span index daily in the format "zipkin-span-YYYY-MM-dd". How I can automate the deletion of the Zipkin indices when its old than …

---

## [Timelion if weekend](https://discuss.elastic.co/t/timelion-if-weekend/114221)

<div class="topic-metadata">

**Author:** [@kumpelblase](https://discuss.elastic.co/u/kumpelblase)\
**Replies:** 6\
**Last updated:** [January 10, 2018, 10:28am UTC](https://discuss.elastic.co/t/timelion-if-weekend/114221 "2018-01-10T10:28:00Z")

</div>

I have an ammount of tickets over two years. My goal is to calculate the average, which I do with the .movingaverage(). The problem is that I don't want the weekends included in the average. I managed to hide the dates w…

---

## [Bootstrap error regarding failure to lock memory](https://discuss.elastic.co/t/bootstrap-error-regarding-failure-to-lock-memory/223572)

<div class="topic-metadata">

**Author:** [@\_finack](https://discuss.elastic.co/u/_finack)\
**Replies:** 1\
**Last updated:** [March 13, 2020, 9:28pm UTC](https://discuss.elastic.co/t/bootstrap-error-regarding-failure-to-lock-memory/223572 "2020-03-13T21:28:53Z")

</div>

I have enabled the bootstrap.memory\_lock: true setting in elasticsearch.yml; however, Elasticsearch refuses to start due to failure during bootstrap check because it cannot lock the memory. The log advised the following: …

---

## [Disallow change own password](https://discuss.elastic.co/t/disallow-change-own-password/78347)

<div class="topic-metadata">

**Author:** [@slinky](https://discuss.elastic.co/u/slinky)\
**Replies:** 3\
**Last updated:** [April 4, 2017, 11:36am UTC](https://discuss.elastic.co/t/disallow-change-own-password/78347 "2017-04-04T11:36:29Z")

</div>

I am going to share a (read-only) user with the world so people can check out my X-Pack demo. Therefore I need to disallow/disable the 'change password' option under the users own account options. Is this possible?

---

## [Migrating Filter/Plugin/Pattern to Logstash 1.5](https://discuss.elastic.co/t/migrating-filter-plugin-pattern-to-logstash-1-5/2216)

<div class="topic-metadata">

**Author:** [@xiro](https://discuss.elastic.co/u/xiro)\
**Replies:** 3\
**Last updated:** [June 16, 2015, 12:43am UTC](https://discuss.elastic.co/t/migrating-filter-plugin-pattern-to-logstash-1-5/2216 "2015-06-16T00:43:29Z")

</div>

Hi, I've just set up a new ELK-stack for monitoring of Cisco ASA Log-files. We have already one running with kibana 3 and logstash 1.4. Unfortunately, my filter is not working with the new version, since it contains "g…

---

## [Kibana Dashboard vs AWStats when showing Browser Version](https://discuss.elastic.co/t/kibana-dashboard-vs-awstats-when-showing-browser-version/31952)

<div class="topic-metadata">

**Author:** [@bhutchinson](https://discuss.elastic.co/u/bhutchinson)\
**Replies:** 2\
**Last updated:** [October 11, 2015, 3:01pm UTC](https://discuss.elastic.co/t/kibana-dashboard-vs-awstats-when-showing-browser-version/31952 "2015-10-11T15:01:54Z")

</div>

I built a simple ELK Stack solution 1) Uses Apache Log files as inputs 2) Parses the Apache Log Files with Logstash and the Agent Filter 3) Logstash Outputs events into Elasticsearch 4) Kibana displays dashboard 5) Kiban…

---

## [How to delete the indices older than 90 days](https://discuss.elastic.co/t/how-to-delete-the-indices-older-than-90-days/310974)

<div class="topic-metadata">

**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\
**Replies:** 1\
**Last updated:** [July 29, 2022, 11:43am UTC](https://discuss.elastic.co/t/how-to-delete-the-indices-older-than-90-days/310974 "2022-07-29T11:43:10Z")

</div>

Hi, We are using Elasticsearch mostly for Observability. We have almost 1000 + VM' where we have deployed fleet agent to capture metrics. We would like to delete data if \> 90 days. Please be noted we are using standar…

---

## [Custom pattern - Telephone number and others](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712)

<div class="topic-metadata">

**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Replies:** 7\
**Last updated:** [February 21, 2017, 4:55pm UTC](https://discuss.elastic.co/t/custom-pattern-telephone-number-and-others/75712 "2017-02-21T16:55:38Z")

</div>

Hello, I trying to capture specific fields in log like a phone\_number. In grok debbuger, i try this (regular expression found) : {'/^(+33|0)\[67\]\[0-9\]{8}$/':PHONE\_NUMBER} Entry : 0614151612 Result : Not found. …

---

## [Auditbeat memory leak](https://discuss.elastic.co/t/auditbeat-memory-leak/259137)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 5\
**Last updated:** [December 23, 2020, 1:28pm UTC](https://discuss.elastic.co/t/auditbeat-memory-leak/259137 "2020-12-23T13:28:55Z")

</div>

Hi All, I was wondering if anyone else has noticed a memory leak with the last few version of Auditbeat? Currently running 7.10.0 (and had the issue in 7.8 and 7.9 as well) and I am seeing Auditbeat constantly being OO…

---

## [2 instances of ElasticSearch deployed with docker can't see each other](https://discuss.elastic.co/t/2-instances-of-elasticsearch-deployed-with-docker-cant-see-each-other/31351)

<div class="topic-metadata">

**Author:** [@cruizpollino](https://discuss.elastic.co/u/cruizpollino)\
**Replies:** 5\
**Last updated:** [September 30, 2015, 8:25am UTC](https://discuss.elastic.co/t/2-instances-of-elasticsearch-deployed-with-docker-cant-see-each-other/31351 "2015-09-30T08:25:16Z")

</div>

Good evening, I've started two instances of elasticsearch on two hosts as docker containers the issue now is the elasticsearch instances are not able to see each other does anyone know what configuration changes or…

---

## [Elasticsearch dense\_vector is taking up too much storage space！Help](https://discuss.elastic.co/t/elasticsearch-dense-vector-is-taking-up-too-much-storage-space-help/366046)

<div class="topic-metadata">

**Author:** [@Andy\_Cong](https://discuss.elastic.co/u/Andy_Cong)\
**Replies:** 8\
**Last updated:** [September 24, 2024, 7:39am UTC](https://discuss.elastic.co/t/elasticsearch-dense-vector-is-taking-up-too-much-storage-space-help/366046 "2024-09-24T07:39:06Z")

</div>

I'm having an issue with Elasticsearch where my dense\_vector data is taking up significantly more storage space than expected. ES Version 8.2.3 Data Model: vector field: Type is dense\_vector with a dimension of 1024…

---

## [Can I delete deprecation log indices by a query?](https://discuss.elastic.co/t/can-i-delete-deprecation-log-indices-by-a-query/307253)

<div class="topic-metadata">

**Author:** [@fujita](https://discuss.elastic.co/u/fujita)\
**Replies:** 2\
**Last updated:** [November 25, 2022, 6:29pm UTC](https://discuss.elastic.co/t/can-i-delete-deprecation-log-indices-by-a-query/307253 "2022-11-25T18:29:48Z")

</div>

Thank you for always providing useful information. Several days ago we upgraded Elasticsearch to version 7.17.2 at our data center. After upgrading we found that cluster health is yellow. Before upgrading it was not s…

---

## [Why does a restart performs recovery which takes long time (6-12hrs)?](https://discuss.elastic.co/t/why-does-a-restart-performs-recovery-which-takes-long-time-6-12hrs/162132)

<div class="topic-metadata">

**Author:** [@eightnoteight](https://discuss.elastic.co/u/eightnoteight)\
**Replies:** 2\
**Last updated:** [December 26, 2018, 2:50pm UTC](https://discuss.elastic.co/t/why-does-a-restart-performs-recovery-which-takes-long-time-6-12hrs/162132 "2018-12-26T14:50:56Z")

</div>

Hi, So our cluster consists of 4k indices and about 20k shards spanned over 7 nodes. upon restarting an elasticsearch node most of the indices(99.98) get to available state within 5 mins. but everytime there are a few i…

---

## [As the final mapping would have more than 1 type ERROR](https://discuss.elastic.co/t/as-the-final-mapping-would-have-more-than-1-type-error/115457)

<div class="topic-metadata">

**Author:** [@ramzey1981](https://discuss.elastic.co/u/ramzey1981)\
**Replies:** 3\
**Last updated:** [January 15, 2018, 5:29pm UTC](https://discuss.elastic.co/t/as-the-final-mapping-would-have-more-than-1-type-error/115457 "2018-01-15T17:29:53Z")

</div>

I had data going to ES from filebeats with no issues and then yesterday, I get tons of these errors for most of our rest-api services. i looked at the filebeat debug output and see metadata type as doc. I looked at log…

---

## [Elastic Agent output to Kafka](https://discuss.elastic.co/t/elastic-agent-output-to-kafka/289068)

<div class="topic-metadata">

**Author:** [@marti1](https://discuss.elastic.co/u/marti1)\
**Replies:** 2\
**Last updated:** [November 16, 2021, 7:32am UTC](https://discuss.elastic.co/t/elastic-agent-output-to-kafka/289068 "2021-11-16T07:32:25Z")

</div>

Hi, I would like to know if it's possible to connect Elastic Agents to Logstash through Kafka. Elastic Agent -\> Kafka \<- Logstash -\> Elasticsearch I have already read the documentation and I don't understant what mean…

---

## [Old .monitoring indices aren't being deleted](https://discuss.elastic.co/t/old-monitoring-indices-arent-being-deleted/145436)

<div class="topic-metadata">

**Author:** [@oblakeerickson](https://discuss.elastic.co/u/oblakeerickson)\
**Replies:** 4\
**Last updated:** [August 21, 2018, 6:24pm UTC](https://discuss.elastic.co/t/old-monitoring-indices-arent-being-deleted/145436 "2018-08-21T18:24:23Z")

</div>

I'm having a similar issue as this topic where old monitoring indices aren't being deleted: But we are using exporters of type local as far as I know because the monitoring indices are on the same nodes as our other i…

---

## [Kibana stop working](https://discuss.elastic.co/t/kibana-stop-working/291086)

<div class="topic-metadata">

**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Replies:** 7\
**Last updated:** [December 7, 2021, 7:03pm UTC](https://discuss.elastic.co/t/kibana-stop-working/291086 "2021-12-07T19:03:09Z")

</div>

working kibana stop working here is message that comes up when I try to access kibana:5601 {"type":"log","@timestamp":"2021-12-06T19:18:16-06:00","tags":\["error","plugins","taskManager"\],"pid":3497,"message":"Failed to…

---

## [Kibana cloudtrail visualization](https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864)

<div class="topic-metadata">

**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\
**Replies:** 7\
**Last updated:** [December 15, 2017, 11:08pm UTC](https://discuss.elastic.co/t/kibana-cloudtrail-visualization/111864 "2017-12-15T23:08:09Z")

</div>

Hi Team, I am forwarding aws cloudtrail logs to ES-5.5 and it is forwarded by logstash-5 (using cloudtrail plugin). While preparing visualizations, i realized that for some events "responseElements" field is not organiz…

---

## [Reindex with field value converted to uppercase](https://discuss.elastic.co/t/reindex-with-field-value-converted-to-uppercase/108937)

<div class="topic-metadata">

**Author:** [@abhisheksimion](https://discuss.elastic.co/u/abhisheksimion)\
**Replies:** 1\
**Last updated:** [November 24, 2017, 12:53am UTC](https://discuss.elastic.co/t/reindex-with-field-value-converted-to-uppercase/108937 "2017-11-24T00:53:18Z")

</div>

I am trying to migrate from ES 1.4 to ES 5.5. In one of the index I need to change the name of field and also convert it's value to uppercase. I am able to reindex with change in name of field and remove the unwanted fie…

---

## [Endpoint Security on Elastic Stack Community Slack](https://discuss.elastic.co/t/endpoint-security-on-elastic-stack-community-slack/212696)

<div class="topic-metadata">

**Author:** [@tonymeehan](https://discuss.elastic.co/u/tonymeehan)\
**Replies:** 0\
**Last updated:** [December 20, 2019, 6:36pm UTC](https://discuss.elastic.co/t/endpoint-security-on-elastic-stack-community-slack/212696 "2019-12-20T18:36:08Z")

</div>

In case you missed the announcement, we've got a community Slack setup for discussing endpoint security. See https://twitter.com/elastic/status/1207631666362998784 for more details and join us in #endpoint-security! -To…

---

## [Why does Logstash close idle TCP connections with RST instead of FIN?](https://discuss.elastic.co/t/why-does-logstash-close-idle-tcp-connections-with-rst-instead-of-fin/379000)

<div class="topic-metadata">

**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\
**Replies:** 0\
**Last updated:** [June 9, 2025, 12:03pm UTC](https://discuss.elastic.co/t/why-does-logstash-close-idle-tcp-connections-with-rst-instead-of-fin/379000 "2025-06-09T12:03:44Z")

</div>

Hi Elastic team, I’m trying to better understand how client\_inactivity\_timeout works in Logstash, specifically in relation to how it closes idle TCP connections. Context: We have Winlogbeat agents sending logs over TCP…

---

## [Error creating new beat](https://discuss.elastic.co/t/error-creating-new-beat/227567)

<div class="topic-metadata">

**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\
**Replies:** 1\
**Last updated:** [April 11, 2020, 10:26pm UTC](https://discuss.elastic.co/t/error-creating-new-beat/227567 "2020-04-11T22:26:02Z")

</div>

I've created beats in the past using the old method by invoking Python. This is the first time I've tried generating one using mage GenerateCustomBeat. I have the beats repo checked out in the right place and pulled lat…

---

## [Multiple Syslog Inputs on one port](https://discuss.elastic.co/t/multiple-syslog-inputs-on-one-port/127956)

<div class="topic-metadata">

**Author:** [@Joachim\_Hermans](https://discuss.elastic.co/u/Joachim_Hermans)\
**Replies:** 4\
**Last updated:** [April 16, 2018, 9:40pm UTC](https://discuss.elastic.co/t/multiple-syslog-inputs-on-one-port/127956 "2018-04-16T21:40:36Z")

</div>

Hello, I'm a student doing studies around Centralized Logging. I've setup an ELK system, Kibana, Logstash, Elasticsearch, Filebeat, Nginx, Metricbeat and packetbeat. I've been messing around with many different logs. …

---

## [BadRequestError: BadRequestError(400, 'media\_type\_header\_exception', 'Invalid media-type value on headers \[Accept, Content-Type\]')](https://discuss.elastic.co/t/badrequesterror-badrequesterror-400-media-type-header-exception-invalid-media-type-value-on-headers-accept-content-type/378116)

<div class="topic-metadata">

**Author:** [@drake\_boob](https://discuss.elastic.co/u/drake_boob)\
**Replies:** 1\
**Last updated:** [July 25, 2025, 10:05am UTC](https://discuss.elastic.co/t/badrequesterror-badrequesterror-400-media-type-header-exception-invalid-media-type-value-on-headers-accept-content-type/378116 "2025-07-25T10:05:51Z")

</div>

In data bricks , I have been elastic 9.0 for year now , but recently i got this error \[BadRequestError: BadRequestError(400, 'media\_type\_header\_exception', 'Invalid media-type value on headers \[Accept, Content-Type\]') \] …

---

## [Upload data via python bulk helper caused error](https://discuss.elastic.co/t/upload-data-via-python-bulk-helper-caused-error/48205)

<div class="topic-metadata">

**Author:** [@ignaqui](https://discuss.elastic.co/u/ignaqui)\
**Replies:** 2\
**Last updated:** [December 19, 2016, 4:34pm UTC](https://discuss.elastic.co/t/upload-data-via-python-bulk-helper-caused-error/48205 "2016-12-19T16:34:09Z")

</div>

Cluster ID: f0a801 Hello, We are trying to push data to dynamically created indices. Using python helper (http://elasticsearch-py.readthedocs.org/en/master/helpers.html), we tried to upload data in two following form…

---

## [Snapshot error: Unable to find client with name \[default\]](https://discuss.elastic.co/t/snapshot-error-unable-to-find-client-with-name-default/265344)

<div class="topic-metadata">

**Author:** [@mchudinov](https://discuss.elastic.co/u/mchudinov)\
**Replies:** 2\
**Last updated:** [February 25, 2021, 7:17am UTC](https://discuss.elastic.co/t/snapshot-error-unable-to-find-client-with-name-default/265344 "2021-02-25T07:17:21Z")

</div>

Have problems to register an Azure repository in ECK. There is an Azure storage account with elasticsearch-snapshots container. Account name and the key are stored as a secret named secrets-store-storageaccount in K8S …

---

## [Indexing long documents in chunks](https://discuss.elastic.co/t/indexing-long-documents-in-chunks/50787)

<div class="topic-metadata">

**Author:** [@Patrick\_Lam](https://discuss.elastic.co/u/Patrick_Lam)\
**Replies:** 2\
**Last updated:** [May 24, 2016, 4:23pm UTC](https://discuss.elastic.co/t/indexing-long-documents-in-chunks/50787 "2016-05-24T16:23:44Z")

</div>

Suppose we have a set of long documents which can be broken down into an arbitrary number of chunks (for example, paragraphs). We want to index the documents in a way such that we can satisfy the following requirements: …

---

## [Elastic APM for angular JS](https://discuss.elastic.co/t/elastic-apm-for-angular-js/132416)

<div class="topic-metadata">

**Author:** [@Balamurali](https://discuss.elastic.co/u/Balamurali)\
**Replies:** 5\
**Last updated:** [May 18, 2018, 12:26pm UTC](https://discuss.elastic.co/t/elastic-apm-for-angular-js/132416 "2018-05-18T12:26:02Z")

</div>

HI Team, We are currently using Angular-JS 1.6, So Is there any possibilities for using Elastic APM for Angular-JS app ? If so , please guide me with links. Thanks in advance!

---

## [When does ElasticSearch reallocate shards between nodes?](https://discuss.elastic.co/t/when-does-elasticsearch-reallocate-shards-between-nodes/19383)

<div class="topic-metadata">

**Author:** [@ElasticSearch\_Users\_](https://discuss.elastic.co/u/ElasticSearch_Users_)\
**Replies:** 5\
**Last updated:** [August 21, 2014, 9:51am UTC](https://discuss.elastic.co/t/when-does-elasticsearch-reallocate-shards-between-nodes/19383 "2014-08-21T09:51:36Z")

</div>

Hi, What can be the possible causes when ElasticSearch will automatically reallocate a shard from node in the cluster to another node? One can be obviously when you add a new node. What are the automatic trigg…

---

## [Elasticsearch - Low Level Rest Client Initialisation throwing exception](https://discuss.elastic.co/t/elasticsearch-low-level-rest-client-initialisation-throwing-exception/168046)

<div class="topic-metadata">

**Author:** [@Nikesh](https://discuss.elastic.co/u/Nikesh)\
**Replies:** 3\
**Last updated:** [February 13, 2019, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-low-level-rest-client-initialisation-throwing-exception/168046 "2019-02-13T11:55:37Z")

</div>

Hi, I am working on implementing Low Level Rest Client. I am facing issues with Initialising RestClient. The dependency in pom.xml is : \<dependency\> \<groupId\>org.elasticsearch.client\</groupId\> \<artifac…

---

## [Consuming data with logstash kafka plugin](https://discuss.elastic.co/t/consuming-data-with-logstash-kafka-plugin/62991)

<div class="topic-metadata">

**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\
**Replies:** 6\
**Last updated:** [February 20, 2017, 12:18pm UTC](https://discuss.elastic.co/t/consuming-data-with-logstash-kafka-plugin/62991 "2017-02-20T12:18:10Z")

</div>

Hi I have a logstash configuration file which is not consume data that I produce with kafka. Basically, here is my configuration input { kafka { topics =\> "mytopic" bootstrap\_servers =\> "zookeeper\_i…

---

## [Coordinate Map: Cannot read property 'filter' of undefined](https://discuss.elastic.co/t/coordinate-map-cannot-read-property-filter-of-undefined/93688)

<div class="topic-metadata">

**Author:** [@Channing\_Liu](https://discuss.elastic.co/u/Channing_Liu)\
**Replies:** 6\
**Last updated:** [July 19, 2017, 8:56am UTC](https://discuss.elastic.co/t/coordinate-map-cannot-read-property-filter-of-undefined/93688 "2017-07-19T08:56:44Z")

</div>

Hi everyone Forgive me my english is so poor This morning , suddenly my GEO map display incomplete , I did not change any config yesterday , just show warring Coordinate Map: Cannot read property 'filter' of undefined …

---

## [\[nested\] failed to find nested object under path \[orders\]](https://discuss.elastic.co/t/nested-failed-to-find-nested-object-under-path-orders/237603)

<div class="topic-metadata">

**Author:** [@ravivarmakola](https://discuss.elastic.co/u/ravivarmakola)\
**Replies:** 1\
**Last updated:** [July 10, 2020, 2:58pm UTC](https://discuss.elastic.co/t/nested-failed-to-find-nested-object-under-path-orders/237603 "2020-07-10T14:58:40Z")

</div>

I am getting "\[nested\] failed to find nested object under path" when searching on single index and field has "type": "nested" in mappings: PS: I am getting response, but exception is seen on elasticsearch console. If …

---

## [Log4j plugin java.lang.NullPointerException](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763)

<div class="topic-metadata">

**Author:** [@daytimemoon](https://discuss.elastic.co/u/daytimemoon)\
**Replies:** 3\
**Last updated:** [March 17, 2017, 1:48pm UTC](https://discuss.elastic.co/t/log4j-plugin-java-lang-nullpointerexception/51763 "2017-03-17T13:48:22Z")

</div>

I'm using ELK 2.3.3,logstash 2.3.2 . When I'm trying to use log4j as input,logstash reports java.lang.NullPointerException. here is my logstash config: input { log4j { type =\> "log4j-type" port =\> 4560 } }…

---

## [Send k8s logs with Filebeat to separate indices](https://discuss.elastic.co/t/send-k8s-logs-with-filebeat-to-separate-indices/250632)

<div class="topic-metadata">

**Author:** [@karol\_k](https://discuss.elastic.co/u/karol_k)\
**Replies:** 1\
**Last updated:** [October 2, 2020, 7:02am UTC](https://discuss.elastic.co/t/send-k8s-logs-with-filebeat-to-separate-indices/250632 "2020-10-02T07:02:02Z")

</div>

Hi :slight\_smile: Currently I'm using self-hosted elastic stack but evaluating elastic cloud. I collect all the logs from multiple k8s clusters in a standard way with filebeat kubernetes module. There are application an…

---

## [Nodes can't join the cluster](https://discuss.elastic.co/t/nodes-cant-join-the-cluster/305701)

<div class="topic-metadata">

**Author:** [@Ali\_Panahian](https://discuss.elastic.co/u/Ali_Panahian)\
**Replies:** 7\
**Last updated:** [June 1, 2022, 6:24am UTC](https://discuss.elastic.co/t/nodes-cant-join-the-cluster/305701 "2022-06-01T06:24:02Z")

</div>

Hi i'm trying to cluster 3 node Elasticsearch in multi host using docker all of my nodes run successfully and frist one create and join the cluster as master but other nodes got cluster\_uis: na this is my docker-compo…

---

## [Как добавить "is\_write\_index": true в index template?](https://discuss.elastic.co/t/is-write-index-true-index-template/218598)

<div class="topic-metadata">

**Author:** [@11191](https://discuss.elastic.co/u/11191)\
**Replies:** 7\
**Last updated:** [February 12, 2020, 7:32pm UTC](https://discuss.elastic.co/t/is-write-index-true-index-template/218598 "2020-02-12T19:32:41Z")

</div>

Если добавляю эту опцию к template который указываю в template\_name в output { elasticsearch { template\_name =\> "haproxy" } }, то она просто пропадает. И в GET /\_template/haproxy вижу: "aliases" : { "haproxy" : { } } …

---

## [How to use scripted metric aggregation in kibana](https://discuss.elastic.co/t/how-to-use-scripted-metric-aggregation-in-kibana/31605)

<div class="topic-metadata">

**Author:** [@vaibhavy](https://discuss.elastic.co/u/vaibhavy)\
**Replies:** 2\
**Last updated:** [July 11, 2016, 9:57am UTC](https://discuss.elastic.co/t/how-to-use-scripted-metric-aggregation-in-kibana/31605 "2016-07-11T09:57:01Z")

</div>

I was working on an example given in the following link: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-scripted-metric-aggregation.html I have gotten the script working, no…

---

## [Where is add\_kubernetes\_metadata documented?](https://discuss.elastic.co/t/where-is-add-kubernetes-metadata-documented/135110)

<div class="topic-metadata">

**Author:** [@TimWard](https://discuss.elastic.co/u/TimWard)\
**Replies:** 4\
**Last updated:** [June 8, 2018, 10:50am UTC](https://discuss.elastic.co/t/where-is-add-kubernetes-metadata-documented/135110 "2018-06-08T10:50:21Z")

</div>

At https://www.elastic.co/guide/en/beats/filebeat/current/add-kubernetes-metadata.html there is an example of "default indexers and matchers disabled and enables ones that the user is interested in" but no links that I…

---

## [Elastic eating 25% CPU](https://discuss.elastic.co/t/elastic-eating-25-cpu/107747)

<div class="topic-metadata">

**Author:** [@pir1981](https://discuss.elastic.co/u/pir1981)\
**Replies:** 6\
**Last updated:** [November 29, 2017, 8:41am UTC](https://discuss.elastic.co/t/elastic-eating-25-cpu/107747 "2017-11-29T08:41:10Z")

</div>

Hi, I am very new to logging and successfully installed a month back an ELK stack for monitoring with grafana, prometheus and cadvisor (all running in docker). But for about two weeks now I am seeing a constant elastic…

---

## [A survey on modules, data sources and ingestion experience](https://discuss.elastic.co/t/a-survey-on-modules-data-sources-and-ingestion-experience/100934)

<div class="topic-metadata">

**Author:** [@asawari](https://discuss.elastic.co/u/asawari)\
**Replies:** 0\
**Last updated:** [September 18, 2017, 8:57pm UTC](https://discuss.elastic.co/t/a-survey-on-modules-data-sources-and-ingestion-experience/100934 "2017-09-18T20:57:41Z")

</div>

Modules (in Beats & Logstash) are built on the premise that simple things should be simple. They let you go from raw data to dashboards for common data sources in literally minutes. Run 1 command and instantly start expl…

---

## [Kibana 7.9 Index Patterns Do Not Pick Up Source Fields](https://discuss.elastic.co/t/kibana-7-9-index-patterns-do-not-pick-up-source-fields/268220)

<div class="topic-metadata">

**Author:** [@SKRYMr](https://discuss.elastic.co/u/SKRYMr)\
**Replies:** 8\
**Last updated:** [March 25, 2021, 11:01am UTC](https://discuss.elastic.co/t/kibana-7-9-index-patterns-do-not-pick-up-source-fields/268220 "2021-03-25T11:01:16Z")

</div>

Hello, I was trying to set up some visualizations for our data so I created an index pattern to match all our production indices. What happens is that the indices are matched correctly but only "root" fields are picked …

[Previous page](https://discuss.elastic.co/top.md?page=667&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=669&per_page=50&period=all)
