# Top **URL:** https://discuss.elastic.co/top.md?page=706&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 707 --- ## [Should I run multiple indexes?](https://discuss.elastic.co/t/should-i-run-multiple-indexes/41654)
**Author:** [@DanielJay](https://discuss.elastic.co/u/DanielJay)\ **Replies:** 6\ **Last updated:** [February 15, 2016, 7:51pm UTC](https://discuss.elastic.co/t/should-i-run-multiple-indexes/41654 "2016-02-15T19:51:30Z")
I have been testing out ELK for monitoring our Windows Event Viewer logs, IIS logs and network switch logs. I have been having some serious performance issues. Not to mention when running queries I frequently get somethi… --- ## [Unable to delete documents from index when using logstash output plugin](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303)
**Author:** [@truesecure](https://discuss.elastic.co/u/truesecure)\ **Replies:** 2\ **Last updated:** [June 30, 2017, 2:33am UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-index-when-using-logstash-output-plugin/91303 "2017-06-30T02:33:40Z")
My logstash plugin isn't deleting the docs in the index. It appears to be ignoring the document\_id it is being passed, and instead just uses the variable name (as opposed to the value). I have the following configurati… --- ## [Parentheses in http querystring help needed](https://discuss.elastic.co/t/parentheses-in-http-querystring-help-needed/12969)
**Author:** [@Diederik\_Meijer\_Ten\_](https://discuss.elastic.co/u/Diederik_Meijer_Ten_)\ **Replies:** 4\ **Last updated:** [July 30, 2013, 8:39pm UTC](https://discuss.elastic.co/t/parentheses-in-http-querystring-help-needed/12969 "2013-07-30T20:39:34Z")
Dear list, We are running EC on top of a Mongo DB and it works great. An iPhone client queries EC through http calls. I would like to be able to have the search term include parentheses and a colon, I have trie… --- ## [NEST Bulk API Validation Error: type is missing](https://discuss.elastic.co/t/nest-bulk-api-validation-error-type-is-missing/243752)
**Author:** [@lmattingly](https://discuss.elastic.co/u/lmattingly)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 12:13am UTC](https://discuss.elastic.co/t/nest-bulk-api-validation-error-type-is-missing/243752 "2020-08-05T00:13:03Z")
Hi, I'm experiencing "Invalid NEST response built from a unsuccessful (400) low level call on POST: /indexname/\_bulk" Bad Request with '{Type: action\_request\_validation\_exception Reason: "Validation Failed: 1: type is… --- ## [Dashboard export with command line](https://discuss.elastic.co/t/dashboard-export-with-command-line/184016)
**Author:** [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)\ **Replies:** 3\ **Last updated:** [June 4, 2019, 2:57pm UTC](https://discuss.elastic.co/t/dashboard-export-with-command-line/184016 "2019-06-04T14:57:55Z")
Hi, I would like to export \*\*all\*\* the dashboards of Kibana in a json file through a command line. I am using Kibana 7. --- ## [Logstash TCP connection leak](https://discuss.elastic.co/t/logstash-tcp-connection-leak/92119)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 3\ **Last updated:** [July 14, 2017, 5:55pm UTC](https://discuss.elastic.co/t/logstash-tcp-connection-leak/92119 "2017-07-14T17:55:01Z")
Logstash: 5.3.0 Logstash is keeping TCP connections open even for servers that are shutdown. It also seems to be preventing the OS from closing the connections via TCP keep alive- I just have the default settings: … --- ## [Killing pod](https://discuss.elastic.co/t/killing-pod/186745)
**Author:** [@t0ffel](https://discuss.elastic.co/u/t0ffel)\ **Replies:** 5\ **Last updated:** [June 25, 2019, 3:15pm UTC](https://discuss.elastic.co/t/killing-pod/186745 "2019-06-25T15:15:04Z")
I'm trying a simple 3-node cluster. All 3 are masters/data/ingest. If I delete all 3 pods manually the pods will spin-up again, they will have the same names, however they'll fail to join the cluster. According to the l… --- ## [Replication Strategies](https://discuss.elastic.co/t/replication-strategies/3081)
**Author:** [@Franz\_Allan\_Valencia](https://discuss.elastic.co/u/Franz_Allan_Valencia)\ **Replies:** 5\ **Last updated:** [July 12, 2010, 3:05am UTC](https://discuss.elastic.co/t/replication-strategies/3081 "2010-07-12T03:05:16Z")
Curious, if you guys are using ElasticSearch for replication, how do you replicate your data? I'm assuming your main data source is slow, so I was wondering how you go around it to have a faster replication. Do y… --- ## [Send the updated lines of file to logstash without re-running the filebeat](https://discuss.elastic.co/t/send-the-updated-lines-of-file-to-logstash-without-re-running-the-filebeat/110347)
**Author:** [@npasha](https://discuss.elastic.co/u/npasha)\ **Replies:** 8\ **Last updated:** [December 6, 2017, 2:45pm UTC](https://discuss.elastic.co/t/send-the-updated-lines-of-file-to-logstash-without-re-running-the-filebeat/110347 "2017-12-06T14:45:29Z")
I configured the filebeat.yml with the prospector and sends the output to logstash parse and then send to elastic search. All worked fine. My question is if i append or modify the file, is it possible to send only the … --- ## [Escape dot in mustache to access elastic query \_source field in alerts](https://discuss.elastic.co/t/escape-dot-in-mustache-to-access-elastic-query-source-field-in-alerts/321912)
**Author:** [@Nabeel\_Ahmed\_NAK](https://discuss.elastic.co/u/Nabeel_Ahmed_NAK)\ **Replies:** 7\ **Last updated:** [December 29, 2022, 9:03am UTC](https://discuss.elastic.co/t/escape-dot-in-mustache-to-access-elastic-query-source-field-in-alerts/321912 "2022-12-29T09:03:35Z")
Hi All I have enabled elastic defend and enabled rules to detect security events. Now I want to generate alerts from the Kibana rule and connector to slack. I have encountered that Elasticsearch mapping of kibana rule… --- ## [Discover stream in dashboard](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772)
**Author:** [@Gforce](https://discuss.elastic.co/u/Gforce)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:55pm UTC](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772 "2022-01-07T17:55:31Z")
How can I get a "Discover-like" stream into a Dashboard? The Log Stream widget does not behave the same. The stream visible in the Discover section adds new items to the top and it does not completely blank-out during r… --- ## [ECK Cost](https://discuss.elastic.co/t/eck-cost/234657)
**Author:** [@Virajsl](https://discuss.elastic.co/u/Virajsl)\ **Replies:** 3\ **Last updated:** [May 28, 2020, 7:55am UTC](https://discuss.elastic.co/t/eck-cost/234657 "2020-05-28T07:55:30Z")
As per the documentation ECK is opensource. But it is listed under enterprise subscription in https://www.elastic.co/subscriptions. Is there any cost involving ECK ? --- ## [Javascript Query builder](https://discuss.elastic.co/t/javascript-query-builder/141642)
**Author:** [@saravana\_kumar1](https://discuss.elastic.co/u/saravana_kumar1)\ **Replies:** 3\ **Last updated:** [July 28, 2018, 11:44am UTC](https://discuss.elastic.co/t/javascript-query-builder/141642 "2018-07-28T11:44:26Z")
Hi All, Is there any Official Query builder or REST Client for javascript for elasticsearch. In java - https://www.elastic.co/guide/en/elasticsearch/client/java-api/current/index.html It is very useful. I am expecting… --- ## [INFLIGHT\_EVENTS\_REPORT being logged every 5 seconds](https://discuss.elastic.co/t/inflight-events-report-being-logged-every-5-seconds/33759)
**Author:** [@weevil](https://discuss.elastic.co/u/weevil)\ **Replies:** 3\ **Last updated:** [November 9, 2015, 11:42pm UTC](https://discuss.elastic.co/t/inflight-events-report-being-logged-every-5-seconds/33759 "2015-11-09T23:42:38Z")
I am seeing the following in my log every 5 seconds: {:timestamp=\>"2015-11-04T09:18:47.164000-0600", :message=\>\["INFLIGHT\_EVENTS\_REPORT", "2015-11-04T09:18:47-06:00", {"input\_to\_filter"=\>0, "filter\_to\_output"=\>0, "outp… --- ## [Non Alphanumeric character searching](https://discuss.elastic.co/t/non-alphanumeric-character-searching/15054)
**Author:** [@deep\_saxena](https://discuss.elastic.co/u/deep_saxena)\ **Replies:** 3\ **Last updated:** [January 2, 2014, 2:50pm UTC](https://discuss.elastic.co/t/non-alphanumeric-character-searching/15054 "2014-01-02T14:50:44Z")
\#%##%#%#$%#%#$%#$ my data contain this string. I am firing this query, but not able to search the data. any clues why it is not searching? if I put abc in between #%##%#%#abc$%#%#$%#$ and fire the same query which… --- ## [Filebeat cannot connect to kibana: error loading index pattern: parsing kibana response](https://discuss.elastic.co/t/filebeat-cannot-connect-to-kibana-error-loading-index-pattern-parsing-kibana-response/279328)
**Author:** [@outranker](https://discuss.elastic.co/u/outranker)\ **Replies:** 4\ **Last updated:** [July 28, 2021, 8:12am UTC](https://discuss.elastic.co/t/filebeat-cannot-connect-to-kibana-error-loading-index-pattern-parsing-kibana-response/279328 "2021-07-28T08:12:10Z")
I have set up Kibana and Elasticsearch and they work fine so far. I have also set up Filebeat on another aws ec2 instance to send logs to Elasticsearch and monitor from Kibana But for some reason Filebeat cannot connec… --- ## [Renaming label in canvas expression editor](https://discuss.elastic.co/t/renaming-label-in-canvas-expression-editor/199909)
**Author:** [@rndee](https://discuss.elastic.co/u/rndee)\ **Replies:** 4\ **Last updated:** [September 18, 2019, 11:02am UTC](https://discuss.elastic.co/t/renaming-label-in-canvas-expression-editor/199909 "2019-09-18T11:02:29Z")
Is there a way to rename label of graphics (pie chart, donut chart,...) with expression editor or in general canvas? For instance there are codes like 0001, 0010, 0100 in the index documents which we would like to trans… --- ## [Span type for Full trace](https://discuss.elastic.co/t/span-type-for-full-trace/225003)
**Author:** [@Harm](https://discuss.elastic.co/u/Harm)\ **Replies:** 7\ **Last updated:** [March 27, 2020, 9:01pm UTC](https://discuss.elastic.co/t/span-type-for-full-trace/225003 "2020-03-27T21:01:03Z")
Kibana version: 7.6.0 Elasticsearch version: 7.6.0 APM Server version: 7.6.0 APM Agent language and version: Java 1.12-1 Browser version: Chrome 80.0.3987.149 Original install method (e.g. download page, yum, deb, f… --- ## [Why is the Sense page not rendering properly?](https://discuss.elastic.co/t/why-is-the-sense-page-not-rendering-properly/461)
**Author:** [@henry\_hamster](https://discuss.elastic.co/u/henry_hamster)\ **Replies:** 5\ **Last updated:** [March 30, 2016, 6:22pm UTC](https://discuss.elastic.co/t/why-is-the-sense-page-not-rendering-properly/461 "2016-03-30T18:22:51Z")
Hullo, I am a total newbie to ES but excited to find out more. I got it running on a Raspberry Pi so I have my little ES node with me on long train journeys. Another node runs on my main server. I am trying to follow t… --- ## [Kibana and Azure Application Gateway](https://discuss.elastic.co/t/kibana-and-azure-application-gateway/322731)
**Author:** [@bruun963](https://discuss.elastic.co/u/bruun963)\ **Replies:** 0\ **Last updated:** [January 9, 2023, 12:05pm UTC](https://discuss.elastic.co/t/kibana-and-azure-application-gateway/322731 "2023-01-09T12:05:10Z")
Hi, First time testing a ECK deployment on Azure Kubernetes Service with the Application Gateway as an ingress controller. But somehow the health probes are unable to connect to the Kibana pod. There's no response. If … --- ## [ElasticsearchException: Concurrent modification of alias \[datastream\] during rollover](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547)
**Author:** [@altuhovsu](https://discuss.elastic.co/u/altuhovsu)\ **Replies:** 0\ **Last updated:** [December 14, 2020, 8:15am UTC](https://discuss.elastic.co/t/elasticsearchexception-concurrent-modification-of-alias-datastream-during-rollover/258547 "2020-12-14T08:15:20Z")
Hello. We have a datastream with ILM policy (50gb or 30 days). It works, but when rollover occurs we see some errors in a logs and some indices created! This problem occurs only with datastreams and not with simple ind… --- ## [How to connect to ElasticSearch via Spring Boot App Startup?](https://discuss.elastic.co/t/how-to-connect-to-elasticsearch-via-spring-boot-app-startup/94255)
**Author:** [@halogeek](https://discuss.elastic.co/u/halogeek)\ **Replies:** 0\ **Last updated:** [July 23, 2017, 7:39pm UTC](https://discuss.elastic.co/t/how-to-connect-to-elasticsearch-via-spring-boot-app-startup/94255 "2017-07-23T19:39:31Z")
Am using Spring Boot along with ElasticSearch's Java Client to connect to a local ElasticSearch 5.5.0 instance by using the following code inside: public void (String... args) Here's the current code: @SpringBootAp… --- ## [Date Range Not Working with Now](https://discuss.elastic.co/t/date-range-not-working-with-now/268825)
**Author:** [@rohan\_5894](https://discuss.elastic.co/u/rohan_5894)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 11:50am UTC](https://discuss.elastic.co/t/date-range-not-working-with-now/268825 "2021-03-31T11:50:38Z")
I am trying to show only those documents where published\_at date is less than now-7d/d. #It seems ES is not working correctly here. I tried with an example of showing documents which are having published\_at filed greater… --- ## [How to install logstash ruby filer plugin](https://discuss.elastic.co/t/how-to-install-logstash-ruby-filer-plugin/125600)
**Author:** [@csudaya](https://discuss.elastic.co/u/csudaya)\ **Replies:** 3\ **Last updated:** [March 26, 2018, 1:20pm UTC](https://discuss.elastic.co/t/how-to-install-logstash-ruby-filer-plugin/125600 "2018-03-26T13:20:39Z")
I am trying to execute a workflow in pnda using logstash. The config file has ruby inline code and I understand we need to have plugin. can you please tell me on how to install thesame --- ## [Logs created on default folder](https://discuss.elastic.co/t/logs-created-on-default-folder/44610)
**Author:** [@evasu](https://discuss.elastic.co/u/evasu)\ **Replies:** 7\ **Last updated:** [March 7, 2017, 12:50pm UTC](https://discuss.elastic.co/t/logs-created-on-default-folder/44610 "2017-03-07T12:50:07Z")
Hi, I am new to ELK, when I ran my logstash conf, all my logs created on default folder "/var/log/logstash". Is there any why to keeps this log files on customize folder as "/home/folder ". Here is conf ig file input … --- ## [Knapsack plugin install -- and all other plugins](https://discuss.elastic.co/t/knapsack-plugin-install-and-all-other-plugins/32801)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 6\ **Last updated:** [October 24, 2015, 12:17am UTC](https://discuss.elastic.co/t/knapsack-plugin-install-and-all-other-plugins/32801 "2015-10-24T00:17:14Z")
When I am installing knapsack can I just install the plugin into 1 node, the load balancer node. Or do I have to install it to all nodes in order to use the feature. Thanks, M --- ## [Logstash GREEDYMULTILINE](https://discuss.elastic.co/t/logstash-greedymultiline/85394)
**Author:** [@bogomop](https://discuss.elastic.co/u/bogomop)\ **Replies:** 2\ **Last updated:** [May 11, 2017, 1:24pm UTC](https://discuss.elastic.co/t/logstash-greedymultiline/85394 "2017-05-11T13:24:01Z")
getting this error when trying to start logstash \[2017-05-11T12:35:56,772\]\[ERROR\]\[logstash.filters.grok \] Unknown setting 'pattern\_definitions' for grok \[2017-05-11T12:35:56,795\]\[ERROR\]\[logstash.agent \] Ca… --- ## [Return missing ids from given list](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 5\ **Last updated:** [November 24, 2020, 2:29pm UTC](https://discuss.elastic.co/t/return-missing-ids-from-given-list/256365 "2020-11-24T14:29:40Z")
Hi, Is there a way, we can return only those ids which is not found in a given list. For eaxample list to search \[1,2,3,4,5,6,7,8,9,10\] and query will return etc \[2,3,8,10\] list of missing ids in ES index. Thanks in … --- ## [Searching for data over multiple indexes](https://discuss.elastic.co/t/searching-for-data-over-multiple-indexes/237182)
**Author:** [@alphalol](https://discuss.elastic.co/u/alphalol)\ **Replies:** 5\ **Last updated:** [June 15, 2020, 8:44pm UTC](https://discuss.elastic.co/t/searching-for-data-over-multiple-indexes/237182 "2020-06-15T20:44:22Z")
Lets say I have two indices: foo and bar. foo has an id and type field. bar has an id and total field. This is obviously a contrived minimal example, so while you may think the data could be refactored into one docu… --- ## [Doubling Down on Open - Why not two separate repos?](https://discuss.elastic.co/t/doubling-down-on-open-why-not-two-separate-repos/122266)
**Author:** [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\ **Replies:** 3\ **Last updated:** [March 10, 2018, 9:49am UTC](https://discuss.elastic.co/t/doubling-down-on-open-why-not-two-separate-repos/122266 "2018-03-10T09:49:34Z")
When i read the "Doubling Down on Open" information correctly it looks like that the x-pack source code will reside in the same github repo as elasticsearch code itself and that there is a big confusion about licenses fo… --- ## [Memory, storage and CPU requirements depending on node roles](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 3\ **Last updated:** [October 10, 2021, 2:58pm UTC](https://discuss.elastic.co/t/memory-storage-and-cpu-requirements-depending-on-node-roles/286294 "2021-10-10T14:58:38Z")
Hi, Has anyone any intuition about what are the memory, storage and CPU requirements depending on node roles ? Is the following intuition right ? Coordinating nodes : high CPU, low memory Master-only nodes : high CPU… --- ## [Avarage without outliers](https://discuss.elastic.co/t/avarage-without-outliers/42247)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 4:19pm UTC](https://discuss.elastic.co/t/avarage-without-outliers/42247 "2016-02-19T16:19:26Z")
Is it possible to find the avarage without outliers using elasticsearch query? Im still using elasticsearch 1.7... Also an option to find the avarage of all the values below the 95th percentile Thanks! --- ## [Elasticsearch is taking more memory than allocated heap when using bootstrap.mlockall: true](https://discuss.elastic.co/t/elasticsearch-is-taking-more-memory-than-allocated-heap-when-using-bootstrap-mlockall-true/16260)
**Author:** [@bagui](https://discuss.elastic.co/u/bagui)\ **Replies:** 3\ **Last updated:** [March 11, 2014, 11:02am UTC](https://discuss.elastic.co/t/elasticsearch-is-taking-more-memory-than-allocated-heap-when-using-bootstrap-mlockall-true/16260 "2014-03-11T11:02:23Z")
Hi, I’ve allocated max and min heap same with \*ES\_HEAP\_SIZE=1200m\* in elasticsearch and using \*bootstrap.mlockall: true \*as suggested by elasticsearch so that process memory won’t get swapped. But when elast… --- ## [How to process multiple files in logstash](https://discuss.elastic.co/t/how-to-process-multiple-files-in-logstash/97148)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [August 17, 2017, 7:41am UTC](https://discuss.elastic.co/t/how-to-process-multiple-files-in-logstash/97148 "2017-08-17T07:41:29Z")
I have some million json files that i separated in multiple sub folders. Basically these are Cloudtrail data for a year. My Logstash version is 5.5 and this is a 8 core , 32 GB system. The problem is that when i run my … --- ## [Kibana optimize/bundules before start](https://discuss.elastic.co/t/kibana-optimize-bundules-before-start/74458)
**Author:** [@whoami](https://discuss.elastic.co/u/whoami)\ **Replies:** 4\ **Last updated:** [February 17, 2017, 5:51am UTC](https://discuss.elastic.co/t/kibana-optimize-bundules-before-start/74458 "2017-02-17T05:51:34Z")
can I run some command to generate the optimize/bundles files before I run ./kibana --- ## [Grok loglevel catches 'er'](https://discuss.elastic.co/t/grok-loglevel-catches-er/47974)
**Author:** [@Ezer\_Karash](https://discuss.elastic.co/u/Ezer_Karash)\ **Replies:** 4\ **Last updated:** [April 21, 2016, 7:05am UTC](https://discuss.elastic.co/t/grok-loglevel-catches-er/47974 "2016-04-21T07:05:30Z")
the grok lovel pattern catches 'er' (for example if the word 'number' is in the message)' is there a way to fix that --- ## [Mutual TLS FileBeat to LogStash fails with "remote error: tls: internal error"](https://discuss.elastic.co/t/mutual-tls-filebeat-to-logstash-fails-with-remote-error-tls-internal-error/85271)
**Author:** [@maglo](https://discuss.elastic.co/u/maglo)\ **Replies:** 2\ **Last updated:** [May 16, 2017, 7:00am UTC](https://discuss.elastic.co/t/mutual-tls-filebeat-to-logstash-fails-with-remote-error-tls-internal-error/85271 "2017-05-16T07:00:59Z")
I am trying to setup mutual authentication between FileBeat and LogStash as per https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html I have generated certificates and keys using two diff… --- ## [1.7 Billion Document Migration - Circuit Breaking Exception](https://discuss.elastic.co/t/1-7-billion-document-migration-circuit-breaking-exception/124594)
**Author:** [@kurtiskurtis](https://discuss.elastic.co/u/kurtiskurtis)\ **Replies:** 6\ **Last updated:** [March 19, 2018, 8:57pm UTC](https://discuss.elastic.co/t/1-7-billion-document-migration-circuit-breaking-exception/124594 "2018-03-19T20:57:01Z")
Setup: ----All machines hosted on AWS EC2---- 3 Dedicated Masters (15 Gb Ram) 3 D/I Nodes (64 Gb Ram 30 Dedicated to Heap) 1 Network Load Balancer Scenario: We are moving our Elastic Search cluster from a hosted se… --- ## [How to upgrade the elastic cluster deployed by docker?](https://discuss.elastic.co/t/how-to-upgrade-the-elastic-cluster-deployed-by-docker/256986)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [December 2, 2020, 6:41am UTC](https://discuss.elastic.co/t/how-to-upgrade-the-elastic-cluster-deployed-by-docker/256986 "2020-12-02T06:41:19Z")
I started the elasticsearch cluster with docker-compose, and I wanted to upgrade from 7.9.1 to 7.10.0. There is already some data(Advanced Settings,Spaces,Saved Objects) on kibana. How to upgrade the cluster without losi… --- ## [Filter results by the length of the nested objects returned, similar to min\_child](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582)
**Author:** [@Dustin\_Silk](https://discuss.elastic.co/u/Dustin_Silk)\ **Replies:** 1\ **Last updated:** [August 4, 2020, 9:48am UTC](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582 "2020-08-04T09:48:55Z")
I'm trying to filter my results based on the number of nested objects found for a document. I've tried using scores but I cant get scores to work with filters, and I've tried a script but can't get that working either. … --- ## [Failed to read the 'sessionStorage'](https://discuss.elastic.co/t/failed-to-read-the-sessionstorage/158718)
**Author:** [@tilchl](https://discuss.elastic.co/u/tilchl)\ **Replies:** 1\ **Last updated:** [November 29, 2018, 6:03pm UTC](https://discuss.elastic.co/t/failed-to-read-the-sessionstorage/158718 "2018-11-29T18:03:21Z")
I have a problem with embeding iframes of Kibana in my Website. Chrome greets me with this error: Uncaught DOMException: Failed to read the 'sessionStorage' property from 'Window': Access is denied for this document. … --- ## [How do I make Dashboards 'stick'?](https://discuss.elastic.co/t/how-do-i-make-dashboards-stick/35228)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 7\ **Last updated:** [January 8, 2016, 8:55pm UTC](https://discuss.elastic.co/t/how-do-i-make-dashboards-stick/35228 "2016-01-08T20:55:11Z")
I find that every time I go to my dashboards section, I have to do 2 things. 1) I have to load my saved dashboards. 2) I have to set the theme back to 'dark' ( I just simply prefer the dark theme). How do I make thes… --- ## [Order Bar chart according to bar size](https://discuss.elastic.co/t/order-bar-chart-according-to-bar-size/53542)
**Author:** [@Oferkes](https://discuss.elastic.co/u/Oferkes)\ **Replies:** 8\ **Last updated:** [June 21, 2016, 7:16pm UTC](https://discuss.elastic.co/t/order-bar-chart-according-to-bar-size/53542 "2016-06-21T19:16:41Z")
Hi, is there a way to have the bar chart automatically arrange the bars in order, from smallest to largest? in the picture, i'd like to have all the reds on the left, then the blue and on the right the green. thanks… --- ## [Failed Logins](https://discuss.elastic.co/t/failed-logins/190118)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 3\ **Last updated:** [July 17, 2019, 10:47pm UTC](https://discuss.elastic.co/t/failed-logins/190118 "2019-07-17T22:47:50Z")
How are failed logins tracked? I have lots of winlog.event\_id: 4771 indicating a login failure, but if I look at SIEM, it shows thousands of successful logins and 0 failed logins. --- ## [Nested - Performance - Any other better way?](https://discuss.elastic.co/t/nested-performance-any-other-better-way/160876)
**Author:** [@boeledi01](https://discuss.elastic.co/u/boeledi01)\ **Replies:** 0\ **Last updated:** [December 14, 2018, 10:23am UTC](https://discuss.elastic.co/t/nested-performance-any-other-better-way/160876 "2018-12-14T10:23:00Z")
Hi All, I would like to have your opinion and maybe hints on how to improve the way we are indexing the data, from a query performance perspective. As a foreword, we already tried to flatten as much as possible but we … --- ## [Filter with not equal to null](https://discuss.elastic.co/t/filter-with-not-equal-to-null/124680)
**Author:** [@aneesh](https://discuss.elastic.co/u/aneesh)\ **Replies:** 1\ **Last updated:** [March 20, 2018, 7:55am UTC](https://discuss.elastic.co/t/filter-with-not-equal-to-null/124680 "2018-03-20T07:55:13Z")
Hi How can i filter data with a condition not equal to null { "from": 0, "size": 10000, "query": { "bool": { "must\_not": \[ { "match" : { "SubjectId" : null}} \] } } } giving { "… --- ## [Best practices for bulk indexing/retry handling?](https://discuss.elastic.co/t/best-practices-for-bulk-indexing-retry-handling/42144)
**Author:** [@tkaiser](https://discuss.elastic.co/u/tkaiser)\ **Replies:** 1\ **Last updated:** [February 18, 2016, 11:54pm UTC](https://discuss.elastic.co/t/best-practices-for-bulk-indexing-retry-handling/42144 "2016-02-18T23:54:17Z")
We're using BulkProcessor for indexing and stumbled upon a problem when doing rolling restarts of our Elasticsearch cluster consisting of three nodes. It appears that once the master node is going down, we get Clu… --- ## [Kibana Alerts configuration - Using ctx.results\[0\].hits.total](https://discuss.elastic.co/t/kibana-alerts-configuration-using-ctx-results-0-hits-total/199085)
**Author:** [@bharati](https://discuss.elastic.co/u/bharati)\ **Replies:** 2\ **Last updated:** [October 5, 2019, 8:42am UTC](https://discuss.elastic.co/t/kibana-alerts-configuration-using-ctx-results-0-hits-total/199085 "2019-10-05T08:42:35Z")
Hi, Im trying to use the ctx.results\[0\].hits.total variable as a part of the message of the triggered alert. I have added the alert message content as below Hi, An event has occured. Duration: from: {{ctx.periodSt… --- ## [Kibana.yml elasticsearch.username: kibana\_system or elastic](https://discuss.elastic.co/t/kibana-yml-elasticsearch-username-kibana-system-or-elastic/271517)
**Author:** [@m\_x](https://discuss.elastic.co/u/m_x)\ **Replies:** 4\ **Last updated:** [April 29, 2021, 2:53pm UTC](https://discuss.elastic.co/t/kibana-yml-elasticsearch-username-kibana-system-or-elastic/271517 "2021-04-29T14:53:21Z")
Hi, Doc here says to use the 'elastic' user in kibana.yml whereas the default configuration and this doc say to use 'kibana\_system' user. Which one should I use ? --- ## [Merging information from two log files](https://discuss.elastic.co/t/merging-information-from-two-log-files/28914)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 4\ **Last updated:** [May 29, 2017, 11:34am UTC](https://discuss.elastic.co/t/merging-information-from-two-log-files/28914 "2017-05-29T11:34:35Z")
Hi , I need to merge the information from two log file ex: From the first log file I am getting some log information and second log file I am getting ID , I want to append that ID with each logs coming from first file.… [Previous page](https://discuss.elastic.co/top.md?page=705&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=707&per_page=50&period=all)