# Top **URL:** https://discuss.elastic.co/top.md?page=718&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 719 --- ## [ElasticSearch hangs when trying to upload large file](https://discuss.elastic.co/t/elasticsearch-hangs-when-trying-to-upload-large-file/14821)
**Author:** [@Melody\_Whitaker](https://discuss.elastic.co/u/Melody_Whitaker)\ **Replies:** 5\ **Last updated:** [December 16, 2013, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-hangs-when-trying-to-upload-large-file/14821 "2013-12-16T07:45:50Z")
I have an environment set up running ElasticSearch 0.90.2 with two master nodes (each on their own server) and 8 data nodes (two nodes on 4 servers): - master 1 - 4 vcpus, 32 GB RAM - master 2 - 8 vcpus, 16 G… --- ## [How to parse JSON with nested field name "source"](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083)
**Author:** [@a\_acev](https://discuss.elastic.co/u/a_acev)\ **Replies:** 2\ **Last updated:** [May 17, 2016, 7:39pm UTC](https://discuss.elastic.co/t/how-to-parse-json-with-nested-field-name-source/50083 "2016-05-17T19:39:25Z")
Hi, I am new to ELK. I am trying to parse JSON strings that contain field name "source". Here is an example: {"feed": {"name": "AlienVault", "accuracy": 100.0, "url": "https://reputation.alienvault.com/reputation.data"},… --- ## [CSV Export - Kibana.log error - TypeError: Cannot read property 'convert' of undefined](https://discuss.elastic.co/t/csv-export-kibana-log-error-typeerror-cannot-read-property-convert-of-undefined/289480)
**Author:** [@hocho](https://discuss.elastic.co/u/hocho)\ **Replies:** 4\ **Last updated:** [December 14, 2021, 5:27pm UTC](https://discuss.elastic.co/t/csv-export-kibana-log-error-typeerror-cannot-read-property-convert-of-undefined/289480 "2021-12-14T17:27:19Z")
Hello, I recently updated Kibana 7.10.2 to 7.15.0 and with the update/upgrade of Kibana I started noticing the below error in kibana.log when an CSV export running and missing data in the exported CSV file. This error … --- ## [Upgrade to 2.0, unable to initialize plugins](https://discuss.elastic.co/t/upgrade-to-2-0-unable-to-initialize-plugins/34544)
**Author:** [@james\_mtl](https://discuss.elastic.co/u/james_mtl)\ **Replies:** 4\ **Last updated:** [December 28, 2015, 6:20pm UTC](https://discuss.elastic.co/t/upgrade-to-2-0-unable-to-initialize-plugins/34544 "2015-12-28T18:20:37Z")
On startup ES looks for /usr/share/elasticsearch/plugins/head/plugin-descriptor.properties but can't find it. Is there a way to bypass or reinitialize? Caused by: java.nio.file.NoSuchFileException: /usr/share/elasticse… --- ## [Domain name in hostname is treated as separate field](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444)
**Author:** [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\ **Replies:** 4\ **Last updated:** [August 16, 2015, 9:00pm UTC](https://discuss.elastic.co/t/domain-name-in-hostname-is-treated-as-separate-field/27444 "2015-08-16T21:00:14Z")
Hi, I'm in position of migrating from former ELK stack to the latest one So I have 2 environments: Redis -\> Logstash(v1.4.2) -\> ES(v1.4.2) -\> Kibana(v3.1.0) Redis -\> Logstash(v1.5.2) -\> ES(v1.7.1) -\> Kibana(v4.0.2) S… --- ## [Authentication using apikey failed - Illegal base64 character 3a After Upgrading to 7.7.0](https://discuss.elastic.co/t/authentication-using-apikey-failed-illegal-base64-character-3a-after-upgrading-to-7-7-0/235190)
**Author:** [@btnrsec](https://discuss.elastic.co/u/btnrsec)\ **Replies:** 3\ **Last updated:** [June 12, 2020, 6:00pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed-illegal-base64-character-3a-after-upgrading-to-7-7-0/235190 "2020-06-12T18:00:04Z")
I have implemented Filebeat and Auditbeat with ElasticSearch output functionally in 7.6.0 to 7.6.2 without issue. I upgraded a host and ELK Server to version 7.7.0 and am not able to authenticate with the API key in the … --- ## [Cluster state RED when restoring the snapshot](https://discuss.elastic.co/t/cluster-state-red-when-restoring-the-snapshot/85756)
**Author:** [@ultimate.duwal](https://discuss.elastic.co/u/ultimate.duwal)\ **Replies:** 3\ **Last updated:** [May 25, 2017, 4:48pm UTC](https://discuss.elastic.co/t/cluster-state-red-when-restoring-the-snapshot/85756 "2017-05-25T16:48:26Z")
Hello, I am using snapshot api to create and restore my index to s3. Everything is fine while creating snapshot to s3. But the problem arises when I restore the snapshot with two methods. Firstly I tried to resto… --- ## [Query to the alias with multiple indices](https://discuss.elastic.co/t/query-to-the-alias-with-multiple-indices/81010)
**Author:** [@opuzakov](https://discuss.elastic.co/u/opuzakov)\ **Replies:** 3\ **Last updated:** [April 4, 2017, 8:02am UTC](https://discuss.elastic.co/t/query-to-the-alias-with-multiple-indices/81010 "2017-04-04T08:02:33Z")
I use one alias for multiple indices and when i do searching i receive the exception "No mapping found for \[FieldName\] in order to sort on" , but this exception appear for type, which i do not use for searching. Why elas… --- ## [How to remove master nodes from the elasticsearch cluster](https://discuss.elastic.co/t/how-to-remove-master-nodes-from-the-elasticsearch-cluster/346732)
**Author:** [@efrainMZ](https://discuss.elastic.co/u/efrainMZ)\ **Replies:** 7\ **Last updated:** [November 11, 2023, 6:20pm UTC](https://discuss.elastic.co/t/how-to-remove-master-nodes-from-the-elasticsearch-cluster/346732 "2023-11-11T18:20:36Z")
How could I delete two master nodes that are in my cluster, I currently have 3 master nodes, the cluster version is 7.17. thank you --- ## [Merge separate json objects output to an array](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393)
**Author:** [@SKing](https://discuss.elastic.co/u/SKing)\ **Replies:** 7\ **Last updated:** [April 20, 2018, 9:20am UTC](https://discuss.elastic.co/t/merge-separate-json-objects-output-to-an-array/128393 "2018-04-20T09:20:51Z")
I am querying an elastic search instance. I end up with a series of json objects. {"business\_id": "1", "Accepts Credit Cards": true, "Price Range": 1, "type": "food"} {"business\_id": "2", "Accepts Credit Cards": tr… --- ## [Loading data into Elasticsearch - the best way to do it](https://discuss.elastic.co/t/loading-data-into-elasticsearch-the-best-way-to-do-it/143401)
**Author:** [@Roman\_G](https://discuss.elastic.co/u/Roman_G)\ **Replies:** 0\ **Last updated:** [August 7, 2018, 9:19pm UTC](https://discuss.elastic.co/t/loading-data-into-elasticsearch-the-best-way-to-do-it/143401 "2018-08-07T21:19:39Z")
I have relatively big sets of documents that we load into elasticsearch via java rest client. Every day we do a batch load of data (basically our full data set) at midnight and then through the day we load delta files wh… --- ## [Point in time backups with snapshot and restore](https://discuss.elastic.co/t/point-in-time-backups-with-snapshot-and-restore/21138)
**Author:** [@Vinayak\_Bhosale](https://discuss.elastic.co/u/Vinayak_Bhosale)\ **Replies:** 0\ **Last updated:** [December 8, 2014, 10:37am UTC](https://discuss.elastic.co/t/point-in-time-backups-with-snapshot-and-restore/21138 "2014-12-08T10:37:03Z")
Hi All, I was hoping to that multiple incremental snapshots created using this mechanism would allow me to go back in time to revert few documents that got indexed. However what I observed was, if I have 3 increment… --- ## [Function\_score](https://discuss.elastic.co/t/function-score/14538)
**Author:** [@paul1](https://discuss.elastic.co/u/paul1)\ **Replies:** 5\ **Last updated:** [January 14, 2014, 6:50am UTC](https://discuss.elastic.co/t/function-score/14538 "2014-01-14T06:50:31Z")
What should be defined inside the function , any example queries. could not find one on elastic search page.this throws a exception No query registered for \[function\_score\]\] { "query":{ "function\_score":… --- ## [Joda time vs Java Time in 6.8](https://discuss.elastic.co/t/joda-time-vs-java-time-in-6-8/203594)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 6:04am UTC](https://discuss.elastic.co/t/joda-time-vs-java-time-in-6-8/203594 "2019-10-17T06:04:52Z")
got a working 6.8 cluster ingesting data into indicies with templates that defines some date fields like this: "os\_installed": { "type": "date", "format": "MM/DD/YYYY||MM\\/DD\\/YYYY||MM\\\\/DD\\\\/YYYY||strict\_year… --- ## [Logs not in sequence as in console output](https://discuss.elastic.co/t/logs-not-in-sequence-as-in-console-output/188437)
**Author:** [@mrashid](https://discuss.elastic.co/u/mrashid)\ **Replies:** 6\ **Last updated:** [July 2, 2019, 1:08pm UTC](https://discuss.elastic.co/t/logs-not-in-sequence-as-in-console-output/188437 "2019-07-02T13:08:49Z")
I am sending logs from Jenkins to ELK. Because of the jade timestamp and not having enough precision to nano or milli seconds , I have introduced a sequence number against every line of log that enters logstash . Even … --- ## [How setting about logstash with proxy connect to es cloud?](https://discuss.elastic.co/t/how-setting-about-logstash-with-proxy-connect-to-es-cloud/112346)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 6\ **Last updated:** [December 25, 2017, 6:15am UTC](https://discuss.elastic.co/t/how-setting-about-logstash-with-proxy-connect-to-es-cloud/112346 "2017-12-25T06:15:57Z")
how setting about logstash with proxy connect to es cloud? packetbeat can seding logs to es cloud ? but logstash can't seding system\_log in to es cloud. also use proxy can to es cloud. logstash logs. \[2017-12-19T12… --- ## [Kibana with Logstash 5.0 elasticsearch 5.0 error](https://discuss.elastic.co/t/kibana-with-logstash-5-0-elasticsearch-5-0-error/65261)
**Author:** [@azteam](https://discuss.elastic.co/u/azteam)\ **Replies:** 6\ **Last updated:** [November 10, 2016, 8:39am UTC](https://discuss.elastic.co/t/kibana-with-logstash-5-0-elasticsearch-5-0-error/65261 "2016-11-10T08:39:49Z")
I setup ELK on Ubuntu 15. So I have some problems. Logs logstash returns: \[2016-11-08T02:00:02,607\]\[WARN \]\[logstash.outputs.elasticsearch\] UNEXPECTED POOL ERROR {:e=\>#} \[2016-11-08T02:00:02,607\]\[ERROR\]\[logstash.outputs.… --- ## [Elasticsearch 1.7: specify multiple index template patterns?](https://discuss.elastic.co/t/elasticsearch-1-7-specify-multiple-index-template-patterns/42196)
**Author:** [@unknownunknown](https://discuss.elastic.co/u/unknownunknown)\ **Replies:** 6\ **Last updated:** [February 19, 2016, 3:59pm UTC](https://discuss.elastic.co/t/elasticsearch-1-7-specify-multiple-index-template-patterns/42196 "2016-02-19T15:59:45Z")
I want to use the same template to specify mappings for indices with different patterns. Must I create a separate template file for each one? Attempts to specify more than one pattern have met with failure: Approach 1 T… --- ## [Can kibana connect with data sources other than elastic search?](https://discuss.elastic.co/t/can-kibana-connect-with-data-sources-other-than-elastic-search/22363)
**Author:** [@Sonal\_Kothari](https://discuss.elastic.co/u/Sonal_Kothari)\ **Replies:** 1\ **Last updated:** [February 24, 2015, 9:31pm UTC](https://discuss.elastic.co/t/can-kibana-connect-with-data-sources-other-than-elastic-search/22363 "2015-02-24T21:31:46Z")
Can kibana connect with data sources other than elastic search and build visualizations on top of those data sources ? -- You received this message because you are subscribed to the Google Groups "elasticsearch" g… --- ## [How to increase line\_merge\_size\_limit when importing from Visualizer](https://discuss.elastic.co/t/how-to-increase-line-merge-size-limit-when-importing-from-visualizer/245912)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 3\ **Last updated:** [August 23, 2020, 1:57am UTC](https://discuss.elastic.co/t/how-to-increase-line-merge-size-limit-when-importing-from-visualizer/245912 "2020-08-23T01:57:32Z")
Hi, I am trying to import IIS log file manually via \[Data Visualizer\] however I am keep getting bellow message. Now one solution is to increase "line\_merge\_size\_limit" Ref: https://www.elastic.co/guide/en/elasticsear… --- ## [Scoring for a full text search with ngram filter](https://discuss.elastic.co/t/scoring-for-a-full-text-search-with-ngram-filter/68454)
**Author:** [@JeromeAvoustin](https://discuss.elastic.co/u/JeromeAvoustin)\ **Replies:** 3\ **Last updated:** [December 9, 2016, 10:44am UTC](https://discuss.elastic.co/t/scoring-for-a-full-text-search-with-ngram-filter/68454 "2016-12-09T10:44:36Z")
Hi there ! I'm actually working on a full text search (and quite new to it). I'd like to give to the user the results which best fit the query string, and do it as the user types characters. I've created a multi match … --- ## [2 nodes with different Cluster UUID issue causing issue in Monitoring](https://discuss.elastic.co/t/2-nodes-with-different-cluster-uuid-issue-causing-issue-in-monitoring/155474)
**Author:** [@askids](https://discuss.elastic.co/u/askids)\ **Replies:** 4\ **Last updated:** [November 6, 2018, 1:56pm UTC](https://discuss.elastic.co/t/2-nodes-with-different-cluster-uuid-issue-causing-issue-in-monitoring/155474 "2018-11-06T13:56:37Z")
hi, We had a 1 node cluster. So we wanted to temporarily expand it to 2 node cluster. I know that minimum 3 nodes are needed for full sized cluster. But keeping that aside, I have a different issue. We are running 5.5.1… --- ## [Field turns into text in elasticsearch after being mapped as INT in grok and being mutated into integer](https://discuss.elastic.co/t/field-turns-into-text-in-elasticsearch-after-being-mapped-as-int-in-grok-and-being-mutated-into-integer/112381)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 4\ **Last updated:** [December 21, 2017, 8:12am UTC](https://discuss.elastic.co/t/field-turns-into-text-in-elasticsearch-after-being-mapped-as-int-in-grok-and-being-mutated-into-integer/112381 "2017-12-21T08:12:38Z")
Hi everyone! I have logstash filter (grok) and I matched certain phrases as INT. When I open the mapping in kibana, I see that elasticsearch classified the INT as text. Why is that? How do I change it? I want to make n… --- ## [Escaping special characters is not working](https://discuss.elastic.co/t/escaping-special-characters-is-not-working/16111)
**Author:** [@Geoff\_Longman](https://discuss.elastic.co/u/Geoff_Longman)\ **Replies:** 4\ **Last updated:** [March 3, 2014, 8:27pm UTC](https://discuss.elastic.co/t/escaping-special-characters-is-not-working/16111 "2014-03-03T20:27:32Z")
ES version 1.0.0 Using logstash 1.3.3 Logs include a human readable uuid field mapping: - agent\_id: { type: string} example value stored in the index 2f2f4cd7-ac07-4689-8079-2b71cde6a3bb I've see… --- ## [Can't Connect to Kibana via web browser](https://discuss.elastic.co/t/cant-connect-to-kibana-via-web-browser/134262)
**Author:** [@tdasch](https://discuss.elastic.co/u/tdasch)\ **Replies:** 2\ **Last updated:** [June 2, 2018, 5:42pm UTC](https://discuss.elastic.co/t/cant-connect-to-kibana-via-web-browser/134262 "2018-06-02T17:42:49Z")
Following this guide to learn how to setup x-pack and node TLS. I have my 2 nodes up and running and cluster health is green. The problem is I cant open Kibana in my web browser. I am attempting to connect to https://kib… --- ## [Logstash container: Cannot find jar driver library file for JDBC Input Plugin](https://discuss.elastic.co/t/logstash-container-cannot-find-jar-driver-library-file-for-jdbc-input-plugin/129054)
**Author:** [@AJ\_NOURI](https://discuss.elastic.co/u/AJ_NOURI)\ **Replies:** 2\ **Last updated:** [April 23, 2018, 12:48pm UTC](https://discuss.elastic.co/t/logstash-container-cannot-find-jar-driver-library-file-for-jdbc-input-plugin/129054 "2018-04-23T12:48:00Z")
I am using logstash container and I would like to use jdbc input plugin to read a remote mysql database. I can see the plugin installed, root@a547c877b6a4:/# /usr/share/logstash/bin/logstash-plugin list ... logstash-i… --- ## [Does the JSON filter create \`null\` value if parsing empty string?](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801)
**Author:** [@arisbanach](https://discuss.elastic.co/u/arisbanach)\ **Replies:** 2\ **Last updated:** [January 2, 2018, 4:19pm UTC](https://discuss.elastic.co/t/does-the-json-filter-create-null-value-if-parsing-empty-string/113801 "2018-01-02T16:19:27Z")
I have been trying to diagnose a couple issues with my Logstash pipeline, but this would explain it if true. If the JSON filter tries to parse a field that is an empty string, it seems like it could be changing the field… --- ## [Logstash keeps saying "file grew" but doesn't import data from new files](https://discuss.elastic.co/t/logstash-keeps-saying-file-grew-but-doesnt-import-data-from-new-files/46347)
**Author:** [@vaibhav316](https://discuss.elastic.co/u/vaibhav316)\ **Replies:** 2\ **Last updated:** [April 8, 2016, 9:50am UTC](https://discuss.elastic.co/t/logstash-keeps-saying-file-grew-but-doesnt-import-data-from-new-files/46347 "2016-04-08T09:50:18Z")
Hi, Im having a peculiar problem where logstash is not importing the data. Im running logstash in the following mode sudo /opt/logstash/bin/logstash agent --debug -f conf.d/. It discovers the files fine: each: fi… --- ## [GeoJSON Maps color from hex code](https://discuss.elastic.co/t/geojson-maps-color-from-hex-code/305272)
**Author:** [@Quentin\_D](https://discuss.elastic.co/u/Quentin_D)\ **Replies:** 5\ **Last updated:** [May 20, 2022, 8:40pm UTC](https://discuss.elastic.co/t/geojson-maps-color-from-hex-code/305272 "2022-05-20T20:40:32Z")
Hi everyone, I'm a kinda new user of the Elastic Stack and I have a hard time getting what I want from the "maps" visualization. What I'm trying to do is to create a GeoJSON file with colors and display these colors on… --- ## [Разделение логов по индексам в Filebeat](https://discuss.elastic.co/t/filebeat/239125)
**Author:** [@Ivan\_Bykov](https://discuss.elastic.co/u/Ivan_Bykov)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 3:49pm UTC](https://discuss.elastic.co/t/filebeat/239125 "2020-06-29T15:49:53Z")
Есть два типа логов /var/log/1.log и 2.log Подскажите пожалуйста, как настроить правильно filebeat чтобы каждому и этих логов соответствовал свой индекс для logstash + elastic? В конфиге у меня сейчас вот так: filebe… --- ## [Packet loss while decoding REDIS protocol data](https://discuss.elastic.co/t/packet-loss-while-decoding-redis-protocol-data/116970)
**Author:** [@zjxian](https://discuss.elastic.co/u/zjxian)\ **Replies:** 8\ **Last updated:** [February 1, 2018, 3:33pm UTC](https://discuss.elastic.co/t/packet-loss-while-decoding-redis-protocol-data/116970 "2018-02-01T15:33:56Z")
We're planning on monitor REDIS protocol communication with packetbeat. What we want from packetbeat is to decode and record REDIS commands between server and clients. The test environment is somewhat like this: Redi… --- ## [Troubles with complex span query term boosting](https://discuss.elastic.co/t/troubles-with-complex-span-query-term-boosting/116106)
**Author:** [@vglazkov](https://discuss.elastic.co/u/vglazkov)\ **Replies:** 1\ **Last updated:** [January 26, 2018, 2:22pm UTC](https://discuss.elastic.co/t/troubles-with-complex-span-query-term-boosting/116106 "2018-01-26T14:22:32Z")
Hi, I have a troubles with boosting of complex term span queries to the elasticsearch. Here's the toy example: Mapping: PUT my\_index { "mappings": { "my\_type": { "properties": { "text": { … --- ## [Having trouble converting Groovy to Painless](https://discuss.elastic.co/t/having-trouble-converting-groovy-to-painless/176118)
**Author:** [@jw-ovgd](https://discuss.elastic.co/u/jw-ovgd)\ **Replies:** 3\ **Last updated:** [April 11, 2019, 7:23pm UTC](https://discuss.elastic.co/t/having-trouble-converting-groovy-to-painless/176118 "2019-04-11T19:23:06Z")
Hi I've been having a very hard time converting an old Groovy script to Painless in a filter query script. Almost every index in my ES6.5 has a field of this structure: ..., groups: \[ \[a\], \[a, b\], \[a, b, c\] \], .… --- ## [Error while setting up Kibana Dev Environment](https://discuss.elastic.co/t/error-while-setting-up-kibana-dev-environment/187228)
**Author:** [@saravananselvamohan](https://discuss.elastic.co/u/saravananselvamohan)\ **Replies:** 2\ **Last updated:** [June 26, 2019, 6:53am UTC](https://discuss.elastic.co/t/error-while-setting-up-kibana-dev-environment/187228 "2019-06-26T06:53:02Z")
After running the yarn start command, I am getting this error. server log \[10:52:28.945\] \[info\]\[task\_manager\] Installing .kibana\_task\_manager index template version: 8000099. server log \[10:52:28.951\] \[warning\]\[task\_man… --- ## [Logs are not updating in elastic search just after installing Xpack](https://discuss.elastic.co/t/logs-are-not-updating-in-elastic-search-just-after-installing-xpack/118012)
**Author:** [@sweta\_khandelwal](https://discuss.elastic.co/u/sweta_khandelwal)\ **Replies:** 7\ **Last updated:** [March 8, 2018, 1:55pm UTC](https://discuss.elastic.co/t/logs-are-not-updating-in-elastic-search-just-after-installing-xpack/118012 "2018-03-08T13:55:38Z")
Right after installing xpack filebeat stopped shipping of logs in to elastic search. Do I need to do some sort of authentication setting? can someone please reply and help?? --- ## [Query seems to ignore size / from parameters](https://discuss.elastic.co/t/query-seems-to-ignore-size-from-parameters/61422)
**Author:** [@pieterdt](https://discuss.elastic.co/u/pieterdt)\ **Replies:** 5\ **Last updated:** [September 28, 2016, 1:01am UTC](https://discuss.elastic.co/t/query-seems-to-ignore-size-from-parameters/61422 "2016-09-28T01:01:38Z")
Hi, I'm fairly new to ES and loving it. Recently I had to build a query, which seems to work. However, when the query is provided with size/from parameters for paging purposes, these parameters seems to be ignored comp… --- ## [Changing Parents](https://discuss.elastic.co/t/changing-parents/8106)
**Author:** [@Florian\_Gilcher](https://discuss.elastic.co/u/Florian_Gilcher)\ **Replies:** 5\ **Last updated:** [July 18, 2014, 5:40pm UTC](https://discuss.elastic.co/t/changing-parents/8106 "2014-07-18T17:40:52Z")
Hi, I have been playing around with parent/child documents lately and the following question came up: is it possible to change the parent of a document? Say, I have the following two documents: /person/1 -d … --- ## [New clean ES data node cannot find master during cluster discovery](https://discuss.elastic.co/t/new-clean-es-data-node-cannot-find-master-during-cluster-discovery/41030)
**Author:** [@zkun](https://discuss.elastic.co/u/zkun)\ **Replies:** 4\ **Last updated:** [February 25, 2016, 5:04am UTC](https://discuss.elastic.co/t/new-clean-es-data-node-cannot-find-master-during-cluster-discovery/41030 "2016-02-25T05:04:22Z")
Hi guys, appreciate your attention on this thread. This morning I terminated elastic service on one data node of my cluster, which contains altogether 2 data nodes and 2 master-only nodes plus one kibana node. After I un… --- ## [Elasticsearch node fails after multiple G1GC triggers](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 0\ **Last updated:** [November 12, 2022, 9:16pm UTC](https://discuss.elastic.co/t/elasticsearch-node-fails-after-multiple-g1gc-triggers/318779 "2022-11-12T21:16:09Z")
We have a 6 node cluster on ES 7.17.7, which is very stable except for our single coordinating node (which also is master eligible, so not a "true" coordinating node). After 4-6 hours of uptime, we always get the below … --- ## [Send to different indices with filebeat modules and ILM enabled](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507)
**Author:** [@nber](https://discuss.elastic.co/u/nber)\ **Replies:** 0\ **Last updated:** [January 28, 2021, 1:43pm UTC](https://discuss.elastic.co/t/send-to-different-indices-with-filebeat-modules-and-ilm-enabled/262507 "2021-01-28T13:43:36Z")
Hey there, I'd like to collect logs on a device with different modules and send them to different indices. The question itself is answered in: Though, as far as I understand, this only works when ILM is disabled. Yet… --- ## [Fluentd is not able to forward data to elasticsearch](https://discuss.elastic.co/t/fluentd-is-not-able-to-forward-data-to-elasticsearch/196899)
**Author:** [@skdasari](https://discuss.elastic.co/u/skdasari)\ **Replies:** 0\ **Last updated:** [August 27, 2019, 8:21am UTC](https://discuss.elastic.co/t/fluentd-is-not-able-to-forward-data-to-elasticsearch/196899 "2019-08-27T08:21:42Z")
I am trying to forward my local server log from windows to an elasticsearch server in a linux machine and check these logs in the kibana. This is test environment currently. fuentd on either ends is not showing any issue… --- ## [Error TrustManagerFactory - Failed to load plugin class \[org.elasticsearch.xpack.XPackPlugin\]](https://discuss.elastic.co/t/error-trustmanagerfactory-failed-to-load-plugin-class-org-elasticsearch-xpack-xpackplugin/81896)
**Author:** [@adriellcardoso](https://discuss.elastic.co/u/adriellcardoso)\ **Replies:** 2\ **Last updated:** [April 11, 2017, 1:25pm UTC](https://discuss.elastic.co/t/error-trustmanagerfactory-failed-to-load-plugin-class-org-elasticsearch-xpack-xpackplugin/81896 "2017-04-11T13:25:17Z")
Hello, I created cloud cluster and run class TransportClient, but when mounting the TransportClient object, the following error occurs: Exception in thread "main" ElasticsearchException\[Failed to load plugin class \[o… --- ## [Filter dissect: mapping on double quotes](https://discuss.elastic.co/t/filter-dissect-mapping-on-double-quotes/67617)
**Author:** [@alex22](https://discuss.elastic.co/u/alex22)\ **Replies:** 2\ **Last updated:** [December 29, 2016, 12:56pm UTC](https://discuss.elastic.co/t/filter-dissect-mapping-on-double-quotes/67617 "2016-12-29T12:56:08Z")
Hi \*, im currently trying to get along with the dissect filter. So i have the following example log which i try to parse with dissect: "a b" 33 c And my dissect mapping looks like this mapping =\> { "message" =\> "… --- ## [SIEM Zeek log data getting Error decoding JSON](https://discuss.elastic.co/t/siem-zeek-log-data-getting-error-decoding-json/191103)
**Author:** [@dpangallo](https://discuss.elastic.co/u/dpangallo)\ **Replies:** 3\ **Last updated:** [July 18, 2019, 7:13pm UTC](https://discuss.elastic.co/t/siem-zeek-log-data-getting-error-decoding-json/191103 "2019-07-18T19:13:31Z")
I'm trying to ingest Zeek network log data (formerly Bro) into SIEM (Beta 7.2). Finally got it configured to ingest the data but I'm getting tons of errors decoding JSON. Here's a sample: ERROR#011readjson/json.go:52#01… --- ## [Escape pipe \\ Vertical Operator (|) in Ingress Pipeline for grok processor](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 5\ **Last updated:** [June 9, 2020, 3:20pm UTC](https://discuss.elastic.co/t/escape-pipe-vertical-operator-in-ingress-pipeline-for-grok-processor/236358 "2020-06-09T15:20:01Z")
I want to process logs separated by pipe '|' operator in an ingress pipeline using grok. How can I ignore this character in the pattern? Log data: PUT /combined/\_doc/1?pipeline=pipeline\_combined\_logs { "service": "… --- ## [How to calculate two aggregations on same field within the same body?](https://discuss.elastic.co/t/how-to-calculate-two-aggregations-on-same-field-within-the-same-body/193889)
**Author:** [@Kaushik123](https://discuss.elastic.co/u/Kaushik123)\ **Replies:** 5\ **Last updated:** [August 7, 2019, 3:43am UTC](https://discuss.elastic.co/t/how-to-calculate-two-aggregations-on-same-field-within-the-same-body/193889 "2019-08-07T03:43:25Z")
I am trying to find the sum aggregate data(total count) of a field for my query. I also want to find the sum aggregate data of that same field, but on a different day/time. How can I write that has this type of functiona… --- ## [Logstash pipe plugin exec not working](https://discuss.elastic.co/t/logstash-pipe-plugin-exec-not-working/72097)
**Author:** [@Sharat\_Jagannath](https://discuss.elastic.co/u/Sharat_Jagannath)\ **Replies:** 5\ **Last updated:** [January 23, 2017, 9:23pm UTC](https://discuss.elastic.co/t/logstash-pipe-plugin-exec-not-working/72097 "2017-01-23T21:23:51Z")
I have a logstash conf file that gets data from kafka as input and then based on if the input contains a field it is supposed to pipe the input data to a script(unix of python) For example- input{ kafka { zk\_connect =\> … --- ## [Problem with using kibana to link elsearch](https://discuss.elastic.co/t/problem-with-using-kibana-to-link-elsearch/194598)
**Author:** [@elsearch](https://discuss.elastic.co/u/elsearch)\ **Replies:** 2\ **Last updated:** [August 10, 2019, 5:59am UTC](https://discuss.elastic.co/t/problem-with-using-kibana-to-link-elsearch/194598 "2019-08-10T05:59:37Z")
the problem is \[error\]\[status\]\[plugin:xpack\_main@7.2.1\] Status changed from yellow to red - \[data\] Elasticsearch cluster did not respond with license information. when i use kibana to link with elsearch next the Elast… --- ## [Curator - Deleting old Snapshots is taking a long time](https://discuss.elastic.co/t/curator-deleting-old-snapshots-is-taking-a-long-time/144054)
**Author:** [@pri](https://discuss.elastic.co/u/pri)\ **Replies:** 2\ **Last updated:** [August 13, 2018, 1:00pm UTC](https://discuss.elastic.co/t/curator-deleting-old-snapshots-is-taking-a-long-time/144054 "2018-08-13T13:00:14Z")
Hi, I have been creating hourly snapshots of our prod ES to AWS s3. And have been running curator to do this task. However now I am setting up a curator action to delete snapshots older than n number of days and it is e… --- ## [System memory usuage in MBytes](https://discuss.elastic.co/t/system-memory-usuage-in-mbytes/58913)
**Author:** [@prem\_sompura](https://discuss.elastic.co/u/prem_sompura)\ **Replies:** 2\ **Last updated:** [August 26, 2016, 7:57am UTC](https://discuss.elastic.co/t/system-memory-usuage-in-mbytes/58913 "2016-08-26T07:57:49Z")
By default metricbeat generate system.memory.used in bytes. However I changed the system.memory.used.bytes to system.memory.used.mb in template and then reloaded the template but all in vain. It wasn't that easy. I wa… [Previous page](https://discuss.elastic.co/top.md?page=717&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=719&per_page=50&period=all)