# Top **URL:** https://discuss.elastic.co/top.md?page=760&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 761 --- ## [Replacement of QueryBuilder(ES 5.6) in ES 8.5](https://discuss.elastic.co/t/replacement-of-querybuilder-es-5-6-in-es-8-5/323856)
**Author:** [@Harsh0145](https://discuss.elastic.co/u/Harsh0145)\ **Replies:** 3\ **Last updated:** [January 25, 2023, 9:49am UTC](https://discuss.elastic.co/t/replacement-of-querybuilder-es-5-6-in-es-8-5/323856 "2023-01-25T09:49:44Z")
Hi, We have been using the ES 5.6 cluster, but are now migrating to a new ES 8.5 cluster. The Data migration, and indexing queries are all sorted. However, earlier we used to use QueryBuilder in ES 5.6 java app and ther… --- ## [Second issue trying to change the elastic-agent grpc.port during fleet server 7.15 setup](https://discuss.elastic.co/t/second-issue-trying-to-change-the-elastic-agent-grpc-port-during-fleet-server-7-15-setup/286903)
**Author:** [@rrivers](https://discuss.elastic.co/u/rrivers)\ **Replies:** 2\ **Last updated:** [October 20, 2021, 11:32am UTC](https://discuss.elastic.co/t/second-issue-trying-to-change-the-elastic-agent-grpc-port-during-fleet-server-7-15-setup/286903 "2021-10-20T11:32:31Z")
I'm running into a second issue trying to install fleet server 7.15 on an Ubuntu 20.04 machine because of a port conflict since 127.0.0.1:6789 is already in use by another application. The fix to the first post allowed t… --- ## [Split path and take certain value by its position \[2\] and insert it into field](https://discuss.elastic.co/t/split-path-and-take-certain-value-by-its-position-2-and-insert-it-into-field/186639)
**Author:** [@nitzanm](https://discuss.elastic.co/u/nitzanm)\ **Replies:** 2\ **Last updated:** [June 22, 2019, 5:59pm UTC](https://discuss.elastic.co/t/split-path-and-take-certain-value-by-its-position-2-and-insert-it-into-field/186639 "2019-06-22T17:59:35Z")
hi... I need to extract from a path certain value by position... example: let's say I split this following path into array using '\\' as split char E:\\OUM82\\APP\\Logs\\UploadManager\_20062019.log I get: \[0\]=E: \[1\]=OU… --- ## [Nodes are bootlooping when attempting to start cluster](https://discuss.elastic.co/t/nodes-are-bootlooping-when-attempting-to-start-cluster/138272)
**Author:** [@BryanPerkins](https://discuss.elastic.co/u/BryanPerkins)\ **Replies:** 2\ **Last updated:** [July 3, 2018, 4:16pm UTC](https://discuss.elastic.co/t/nodes-are-bootlooping-when-attempting-to-start-cluster/138272 "2018-07-03T16:16:22Z")
This issue cropped up over the weekend. I'm running a 4 instance setup of ECE and when I try to spin up a cluster on 3 of these instances, I get the following error: Unexpected error during step: \[forced-cluster-reboot\]… --- ## [Kibana Vega - Showing tooltip on parallel coordinates](https://discuss.elastic.co/t/kibana-vega-showing-tooltip-on-parallel-coordinates/151020)
**Author:** [@deuskars](https://discuss.elastic.co/u/deuskars)\ **Replies:** 6\ **Last updated:** [November 5, 2018, 2:01am UTC](https://discuss.elastic.co/t/kibana-vega-showing-tooltip-on-parallel-coordinates/151020 "2018-11-05T02:01:14Z")
Hi, Quick summary of what I want the visualization to be like ... I have multiple IHS proxys which route requests to a bunch of servers. I want to draw a parallel coordinates graph that would show the number of request… --- ## [How to fix Validation Failed: 1: mapping type is missing](https://discuss.elastic.co/t/how-to-fix-validation-failed-1-mapping-type-is-missing/183367)
**Author:** [@Aymen\_Ben\_Moussa](https://discuss.elastic.co/u/Aymen_Ben_Moussa)\ **Replies:** 0\ **Last updated:** [May 29, 2019, 3:05pm UTC](https://discuss.elastic.co/t/how-to-fix-validation-failed-1-mapping-type-is-missing/183367 "2019-05-29T15:05:01Z")
this is my index default mapping \> { \> "yoyo4y" : { \> "mappings" : { \> "doc" : { \> "properties" : { \> "@timestamp" : { \> "type" : "date" \> }, \> "@version" : { \> "type" : "text",… --- ## [My\_index/\_stats/indexing (high number of "index\_failed" operations)](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152)
**Author:** [@Logan\_H](https://discuss.elastic.co/u/Logan_H)\ **Replies:** 4\ **Last updated:** [April 17, 2021, 4:16pm UTC](https://discuss.elastic.co/t/my-index-stats-indexing-high-number-of-index-failed-operations/270152 "2021-04-17T16:16:44Z")
I'm supporting a cluster with an index that is seeing a high number in "indexed\_failed" operations as shown by the indexing stats. I'm trying to understand what type of scenarios would cause this counter to increment up.… --- ## [X-pack License info](https://discuss.elastic.co/t/x-pack-license-info/143630)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 4\ **Last updated:** [August 14, 2018, 5:21pm UTC](https://discuss.elastic.co/t/x-pack-license-info/143630 "2018-08-14T17:21:08Z")
Hello All, I am running Elasticsearch cluster with 3 nodes. All are working as master node as well as data node. Now i want to monitor my cluster. But i want to know the cost of X-pack license and how we use them means … --- ## [Elasticsearch doesn't find the cluster](https://discuss.elastic.co/t/elasticsearch-doesnt-find-the-cluster/133926)
**Author:** [@DanV](https://discuss.elastic.co/u/DanV)\ **Replies:** 4\ **Last updated:** [May 30, 2018, 9:17pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-find-the-cluster/133926 "2018-05-30T21:17:25Z")
Hello, i'm trying to connect a elasticsearch search node (node2) in a server to a already existing elasticsearch node (node1) in another server with the goal of data replication from node1 to node2. The problem appear… --- ## [Flushing buffer at interval](https://discuss.elastic.co/t/flushing-buffer-at-interval/56527)
**Author:** [@Stormdizzle](https://discuss.elastic.co/u/Stormdizzle)\ **Replies:** 4\ **Last updated:** [September 13, 2016, 1:41pm UTC](https://discuss.elastic.co/t/flushing-buffer-at-interval/56527 "2016-09-13T13:41:02Z")
I am curious if someone can assist me. It appears there's an issue with either the latest Logstash or perhaps Elasticsearch can't handle the traffic, which I don't find to be true. I am seeing the logs being fed into E… --- ## [Elasticsearch 5.2 upgrade to 5.5 failed](https://discuss.elastic.co/t/elasticsearch-5-2-upgrade-to-5-5-failed/92579)
**Author:** [@huzhengkai](https://discuss.elastic.co/u/huzhengkai)\ **Replies:** 2\ **Last updated:** [July 12, 2017, 2:20am UTC](https://discuss.elastic.co/t/elasticsearch-5-2-upgrade-to-5-5-failed/92579 "2017-07-12T02:20:25Z")
I do step by step as https://www.elastic.co/guide/en/elasticsearch/reference/5.2/restart-upgrade.html. I got this when I run Elasticsearch: \[2017-07-11T11:39:37,552\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] unexpected error w… --- ## [Bulk indexing, how to prevent flooding?](https://discuss.elastic.co/t/bulk-indexing-how-to-prevent-flooding/4271)
**Author:** [@jprante](https://discuss.elastic.co/u/jprante)\ **Replies:** 7\ **Last updated:** [April 23, 2011, 8:36pm UTC](https://discuss.elastic.co/t/bulk-indexing-how-to-prevent-flooding/4271 "2011-04-23T20:36:15Z")
Hi, how can I prevent bad clients from flooding an Elasticsearch cluster especiall when using bulk indexing? Imagine remote indexing by a TransportClient with bad habits, i.e. it ignores the messages in ActionLis… --- ## [ODBC failed connection to remote ES server](https://discuss.elastic.co/t/odbc-failed-connection-to-remote-es-server/301493)
**Author:** [@Simone1](https://discuss.elastic.co/u/Simone1)\ **Replies:** 5\ **Last updated:** [April 15, 2022, 12:03pm UTC](https://discuss.elastic.co/t/odbc-failed-connection-to-remote-es-server/301493 "2022-04-15T12:03:34Z")
Hi, I'm trying to connect to my remote server, where i have ES and all my data, with the ODBC driver to pull data to excel in my PC. When i try to configure the remote connection in the ODBC data sources, i receive thi… --- ## [ElasticSearch - 6.1 - Windows - Not starting](https://discuss.elastic.co/t/elasticsearch-6-1-windows-not-starting/133546)
**Author:** [@Fhocs](https://discuss.elastic.co/u/Fhocs)\ **Replies:** 5\ **Last updated:** [May 29, 2018, 8:09am UTC](https://discuss.elastic.co/t/elasticsearch-6-1-windows-not-starting/133546 "2018-05-29T08:09:03Z")
Hello, I'm using Elastic 6.1.1 on windows , I installed it via the msi setup, the cluster was running fine, we got a unexpected restart of the cluster and now all node display this. Here the exception log : Elastic.Pr… --- ## [Shard index gone bad, anyone know how to fix this: java.io.EOFException: read past EOF: NIOFSIndexInput](https://discuss.elastic.co/t/shard-index-gone-bad-anyone-know-how-to-fix-this-java-io-eofexception-read-past-eof-niofsindexinput/10227)
**Author:** [@Dimitry](https://discuss.elastic.co/u/Dimitry)\ **Replies:** 2\ **Last updated:** [January 29, 2013, 11:46am UTC](https://discuss.elastic.co/t/shard-index-gone-bad-anyone-know-how-to-fix-this-java-io-eofexception-read-past-eof-niofsindexinput/10227 "2013-01-29T11:46:58Z")
We running version 0.19.9 with 6 servers running using 6 shards. A few days ago, shard number 2 seems to have gone goofy (looks like a corruption in the index) causing the following exception to appear constantl… --- ## [Master not Discovered yet](https://discuss.elastic.co/t/master-not-discovered-yet/295699)
**Author:** [@auasad](https://discuss.elastic.co/u/auasad)\ **Replies:** 3\ **Last updated:** [January 28, 2022, 11:01pm UTC](https://discuss.elastic.co/t/master-not-discovered-yet/295699 "2022-01-28T23:01:40Z")
Hello community, I am facing an issue, I have a cluster consisting 3 nodes in NZ(Master-Data), one node in PK(Data Node) everything is up and running over the public IPs. Now the issue comes when I try to join my new IR… --- ## [Term query is very slow if size != 0](https://discuss.elastic.co/t/term-query-is-very-slow-if-size-0/134654)
**Author:** [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\ **Replies:** 8\ **Last updated:** [June 9, 2018, 7:14pm UTC](https://discuss.elastic.co/t/term-query-is-very-slow-if-size-0/134654 "2018-06-09T19:14:14Z")
I have a ES 6.2.4 cluster with 3 x m4.2xlarge (EBS optimized, gp2) nodes on AWS. The cluster contains a single index with 5 shards, 1 replica, 600 000 000 small documents (1k each, 40 string and numeric fields, default m… --- ## [No module named 'elasticsearch'](https://discuss.elastic.co/t/no-module-named-elasticsearch/110185)
**Author:** [@lengthy\_preamble](https://discuss.elastic.co/u/lengthy_preamble)\ **Replies:** 0\ **Last updated:** [December 4, 2017, 5:11pm UTC](https://discuss.elastic.co/t/no-module-named-elasticsearch/110185 "2017-12-04T17:11:08Z")
Hello all, I'm working with a cohort's python script, which calls on the elasticsearch module. However, when I run it in Jupyter, I get the following error: ImportError Traceback (most r… --- ## [Timelion shows 0 count](https://discuss.elastic.co/t/timelion-shows-0-count/93698)
**Author:** [@viswadeep](https://discuss.elastic.co/u/viswadeep)\ **Replies:** 3\ **Last updated:** [July 19, 2017, 8:32am UTC](https://discuss.elastic.co/t/timelion-shows-0-count/93698 "2017-07-19T08:32:54Z")
Hi, I am trying to create a timelion in Kibana 4.5. .es(logstash\*) shows zero count. What will be the issue? Do I need to change any settings? --- ## [Packetbeat windows - all\_headers not working?](https://discuss.elastic.co/t/packetbeat-windows-all-headers-not-working/68841)
**Author:** [@andrew\_crow](https://discuss.elastic.co/u/andrew_crow)\ **Replies:** 8\ **Last updated:** [December 16, 2016, 8:31am UTC](https://discuss.elastic.co/t/packetbeat-windows-all-headers-not-working/68841 "2016-12-16T08:31:17Z")
Sorry guys - I'm a newbie to ELK. So I've got packetbeat working (sort of) fine on Win 10. Local copy of Elasticsearch receiving direct docuemts from the beat. Kibana displaying everything - sort of. Having edited the… --- ## [Many small machines vs fewer large machines](https://discuss.elastic.co/t/many-small-machines-vs-fewer-large-machines/62632)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [October 11, 2016, 1:28pm UTC](https://discuss.elastic.co/t/many-small-machines-vs-fewer-large-machines/62632 "2016-10-11T13:28:42Z")
Hi there, I am building a new heavy throughput logging cluster, receiving about 150-200gb of logs a day acros ~60 indices (though mostly weighted towards 2 or 3 of them). We currently have a setup with 5 data nodes wit… --- ## [Debugging missing plugins after updating from 7.6.2 to 7.9.2](https://discuss.elastic.co/t/debugging-missing-plugins-after-updating-from-7-6-2-to-7-9-2/252355)
**Author:** [@tlacuache](https://discuss.elastic.co/u/tlacuache)\ **Replies:** 6\ **Last updated:** [October 22, 2020, 7:56am UTC](https://discuss.elastic.co/t/debugging-missing-plugins-after-updating-from-7-6-2-to-7-9-2/252355 "2020-10-22T07:56:15Z")
I'm working on updating a project from using Elastic OSS components at version 7.6.2 to version 7.9.2. For the most part everything has gone smoothly. However, I've gotten stuck on a few plugins that, although they insta… --- ## [Analyse difference of count parameters](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406)
**Author:** [@Manjula\_Piyumal](https://discuss.elastic.co/u/Manjula_Piyumal)\ **Replies:** 6\ **Last updated:** [January 10, 2020, 7:45am UTC](https://discuss.elastic.co/t/analyse-difference-of-count-parameters/214406 "2020-01-10T07:45:25Z")
Hi All, I'm currently reporting user login and logout logs to Elasticsearch. Now I want to get the current logged i user count. Document structure is simply as below { "userId": "user1", "eventType": "LOGIN" ... } … --- ## [Install ES Docker Compose](https://discuss.elastic.co/t/install-es-docker-compose/159268)
**Author:** [@diagriyanto](https://discuss.elastic.co/u/diagriyanto)\ **Replies:** 6\ **Last updated:** [December 6, 2018, 6:45am UTC](https://discuss.elastic.co/t/install-es-docker-compose/159268 "2018-12-06T06:45:53Z")
hello, i'm new here and i want to ask something. i've install ES using docker compose with tutorial on the docs. but the container won't run status exited and i found message like this . \[root@s1 ~\]# docker ps -a CON… --- ## [Description of metrics exposed by /stats endpoint](https://discuss.elastic.co/t/description-of-metrics-exposed-by-stats-endpoint/126205)
**Author:** [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Replies:** 6\ **Last updated:** [April 4, 2018, 12:51pm UTC](https://discuss.elastic.co/t/description-of-metrics-exposed-by-stats-endpoint/126205 "2018-04-04T12:51:48Z")
now that filebeat has a metrics endpoint (https://github.com/elastic/beats/pull/3717) we're trying to set up some rudimentary monitoring of our filebeat agents running on all nodes. Here's an example result that I pulle… --- ## [Filebeat compile on OpenBSD 6.0](https://discuss.elastic.co/t/filebeat-compile-on-openbsd-6-0/65145)
**Author:** [@Gordo](https://discuss.elastic.co/u/Gordo)\ **Replies:** 6\ **Last updated:** [November 8, 2016, 1:06pm UTC](https://discuss.elastic.co/t/filebeat-compile-on-openbsd-6-0/65145 "2016-11-08T13:06:33Z")
I would like to run Filebeat 5.0 on an OpenBSD 6.0 server. The current version of Go on OpenBSD is 1.6 and it would appear that there is a dependency on the Go 1.7 (specifically, a failing context import error, related… --- ## [Best way to save users search queries in ElasticSearch?](https://discuss.elastic.co/t/best-way-to-save-users-search-queries-in-elasticsearch/47518)
**Author:** [@fridary](https://discuss.elastic.co/u/fridary)\ **Replies:** 6\ **Last updated:** [April 22, 2016, 3:41pm UTC](https://discuss.elastic.co/t/best-way-to-save-users-search-queries-in-elasticsearch/47518 "2016-04-22T15:41:59Z")
I am developing application that uses ElasticSearch and SQL database. So, what is the best way to save users search queries and show statistics like what are the most popular requests? The simply way is to save in SQL da… --- ## [Request API to obtain active alerts](https://discuss.elastic.co/t/request-api-to-obtain-active-alerts/326461)
**Author:** [@fabien9402](https://discuss.elastic.co/u/fabien9402)\ **Replies:** 4\ **Last updated:** [March 21, 2023, 1:27pm UTC](https://discuss.elastic.co/t/request-api-to-obtain-active-alerts/326461 "2023-03-21T13:27:45Z")
Hello everyone, On the Kibana interface I have a rule called "No logs from docker", this is a "Log threshold" rule which should tell me when I have not received a log containing the "event.dataset" with value "docker.co… --- ## [Uptime: "no uptime monitors found" for heartbeat](https://discuss.elastic.co/t/uptime-no-uptime-monitors-found-for-heartbeat/193767)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 3:23pm UTC](https://discuss.elastic.co/t/uptime-no-uptime-monitors-found-for-heartbeat/193767 "2019-09-16T15:23:26Z")
Hi, I am getting the output above when looking at the uptime: As you can see, heartbeat data ist being delivered to Elasticsearch. How can I fix this? EDIT: some more Info: everything is on 7.3.0 heartbeat is on t… --- ## [Rollover doesn't actually roll in the Python Elasticseach API](https://discuss.elastic.co/t/rollover-doesnt-actually-roll-in-the-python-elasticseach-api/163941)
**Author:** [@mehdi-gital](https://discuss.elastic.co/u/mehdi-gital)\ **Replies:** 4\ **Last updated:** [January 15, 2019, 3:19pm UTC](https://discuss.elastic.co/t/rollover-doesnt-actually-roll-in-the-python-elasticseach-api/163941 "2019-01-15T15:19:41Z")
It's my first time trying to create a rollover and I've read a bunch of posts with similar topics but nothing quite answers mine. from elasticsearch import Elasticsearch, helpers es = Elasticsearch(\[{'host': 'localhost… --- ## [How to adjust Tooltip width? More than half of text is hidden](https://discuss.elastic.co/t/how-to-adjust-tooltip-width-more-than-half-of-text-is-hidden/45241)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 4\ **Last updated:** [March 23, 2016, 3:53pm UTC](https://discuss.elastic.co/t/how-to-adjust-tooltip-width-more-than-half-of-text-is-hidden/45241 "2016-03-23T15:53:18Z")
I know my text in the tooltip is kind of long, but I want to see at least 40-50 characters. It would be good if the width is adjustable. --- ## [Problem accessing trust store](https://discuss.elastic.co/t/problem-accessing-trust-store/93056)
**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\ **Replies:** 2\ **Last updated:** [August 4, 2017, 9:59am UTC](https://discuss.elastic.co/t/problem-accessing-trust-store/93056 "2017-08-04T09:59:14Z")
Hi All, I was trying out the Logstash by following the steps at the below link. https://www.elastic.co/guide/en/beats/libbeat/5.5/logstash-installation.html I'm using the same configuration mentioned there as shown … --- ## [Can Logstash lose data?](https://discuss.elastic.co/t/can-logstash-lose-data/205535)
**Author:** [@amitavmohanty01](https://discuss.elastic.co/u/amitavmohanty01)\ **Replies:** 3\ **Last updated:** [October 29, 2019, 6:22am UTC](https://discuss.elastic.co/t/can-logstash-lose-data/205535 "2019-10-29T06:22:38Z")
If I understand correctly, Logstash has two thread pools: input (IN), processing and output combines (OUT). When Logstash is getting input from Kafka, at what point does it send an ACK to Kafka? If the ACK is sent when t… --- ## [Reindex 5.4.0 to 7.1.1](https://discuss.elastic.co/t/reindex-5-4-0-to-7-1-1/186512)
**Author:** [@Nick\_Carn](https://discuss.elastic.co/u/Nick_Carn)\ **Replies:** 3\ **Last updated:** [June 20, 2019, 11:34am UTC](https://discuss.elastic.co/t/reindex-5-4-0-to-7-1-1/186512 "2019-06-20T11:34:39Z")
Hi there, I'm reindexing from remote. I have two slightly different document types (not es types). One i can reindex without problems, the other i get the error below. I can create a document manually from the \_source… --- ## [ES231 fail due to below Kuromoji error](https://discuss.elastic.co/t/es231-fail-due-to-below-kuromoji-error/47896)
**Author:** [@gopin4hat7ash](https://discuss.elastic.co/u/gopin4hat7ash)\ **Replies:** 3\ **Last updated:** [April 21, 2016, 5:59am UTC](https://discuss.elastic.co/t/es231-fail-due-to-below-kuromoji-error/47896 "2016-04-21T05:59:16Z")
I got below error while running the elastic search java.lang.IllegalArgumentException: Custom Analyzer \[kuromojiAnalyzer\] failed to find tokenizer under name \[kuromoji\_tokenizer\] USed the below jar version of kuromoji … --- ## [Error while starting up logstash block device detection unsupported or native support failed to load](https://discuss.elastic.co/t/error-while-starting-up-logstash-block-device-detection-unsupported-or-native-support-failed-to-load/32090)
**Author:** [@Shailen](https://discuss.elastic.co/u/Shailen)\ **Replies:** 3\ **Last updated:** [October 19, 2015, 2:23pm UTC](https://discuss.elastic.co/t/error-while-starting-up-logstash-block-device-detection-unsupported-or-native-support-failed-to-load/32090 "2015-10-19T14:23:16Z")
I have been running logstash 1.5.4, elasticsearch 1.7.2 and kibana 4.1.2 for a couple of weeks without any issues. The environment is as follows: $ uname -a Linux picdsr000001076 2.6.32-504.16.2.el6.x86\_64 #1 SMP Tue M… --- ## [Increase URL\_MAX\_OTHERS to avoid URL overflow error](https://discuss.elastic.co/t/increase-url-max-others-to-avoid-url-overflow-error/73054)
**Author:** [@ArunANayagam](https://discuss.elastic.co/u/ArunANayagam)\ **Replies:** 1\ **Last updated:** [January 28, 2017, 5:03pm UTC](https://discuss.elastic.co/t/increase-url-max-others-to-avoid-url-overflow-error/73054 "2017-01-28T17:03:13Z")
Hi, I am using Kibana 4.6.1. I am intentionally trying to execute a large boolean query. I am getting a URL overflow error, defined here, ./src/ui/public/error\_url\_overflow/url\_overflow\_service.js I don't know how … --- ## [Elastic-agent msi?](https://discuss.elastic.co/t/elastic-agent-msi/274970)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 2\ **Last updated:** [June 8, 2021, 6:39pm UTC](https://discuss.elastic.co/t/elastic-agent-msi/274970 "2021-06-08T18:39:46Z")
Hi Folks, How are folks deploying elastic-agent? I'd like to use intune to deploy elastic-agent however there is currently no .msi file, therefore: can we have a .msi file pretty please? How are folks doing this atm? … --- ## [Beats with json support](https://discuss.elastic.co/t/beats-with-json-support/42149)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 8\ **Last updated:** [February 19, 2016, 7:29am UTC](https://discuss.elastic.co/t/beats-with-json-support/42149 "2016-02-19T07:29:11Z")
Hi, there's some plugin for this? I have all logs in JSON... --- ## [INDEX作成時に自動でAliasを設定したい](https://discuss.elastic.co/t/index-alias/207991)
**Author:** [@sat1100](https://discuss.elastic.co/u/sat1100)\ **Replies:** 2\ **Last updated:** [November 25, 2019, 12:38am UTC](https://discuss.elastic.co/t/index-alias/207991 "2019-11-25T00:38:48Z")
Logstashのtest.confのoutput出力で「index =\> "test-%{+yyyy.MM.dd}"」と記載し、 Elasticsearchへindexが作成されますが、コマンドラインで設定する以外にelasticseach.ymlに Aliasを記載して設定する事は実現可能でしょうか。 もし、可能であれば記載方法等ご教示お願いします。 --- ## [How to specify mapping to disable index for all fields of an object type](https://discuss.elastic.co/t/how-to-specify-mapping-to-disable-index-for-all-fields-of-an-object-type/33956)
**Author:** [@philips](https://discuss.elastic.co/u/philips)\ **Replies:** 2\ **Last updated:** [November 9, 2015, 7:12am UTC](https://discuss.elastic.co/t/how-to-specify-mapping-to-disable-index-for-all-fields-of-an-object-type/33956 "2015-11-09T07:12:37Z")
I have an field with type object in my document. This field has a lot of fields inside (and possibly additional other fields may be added later since we crawl data from external sources). For example: { "field1": 1, … --- ## [ClusterBlockException:blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered /initialized\]](https://discuss.elastic.co/t/clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/169535)
**Author:** [@vincentduan](https://discuss.elastic.co/u/vincentduan)\ **Replies:** 1\ **Last updated:** [February 22, 2019, 2:13pm UTC](https://discuss.elastic.co/t/clusterblockexception-blocked-by-service-unavailable-1-state-not-recovered-initialized/169535 "2019-02-22T14:13:06Z")
I have 12nodes (include 3 master nodes and 9 data nodes). I use Elasticsearch 6.2.3 , ubuntu desktop 512G Memory, about 1000shards in cluster. Yesterday, the cluster status got red , because one of my data nodes crashe… --- ## [Logsstash filling up /var/log/syslog?](https://discuss.elastic.co/t/logsstash-filling-up-var-log-syslog/108234)
**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\ **Replies:** 4\ **Last updated:** [November 30, 2017, 9:19pm UTC](https://discuss.elastic.co/t/logsstash-filling-up-var-log-syslog/108234 "2017-11-30T21:19:53Z")
syslog in /var/log filling up with logstash? Every event coming through logstash is filling up syslog - ogstash\[54646\]: "type" =\> "wineventlog", Nov 18 06:25:05 elkstack logstash\[54646\]: "opcod… --- ## [Filebeat does not process any files after restart](https://discuss.elastic.co/t/filebeat-does-not-process-any-files-after-restart/281536)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 6\ **Last updated:** [August 18, 2021, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-does-not-process-any-files-after-restart/281536 "2021-08-18T14:55:12Z")
Hi, We restarted filebeat in our server today and after restarting no new logs are pushed to logstash anymore. Here is the config that we use for the input: filebeat.inputs: - type: log enabled: true paths: - /v… --- ## [Snapshot policy which is only triggered by ILM and not on its own schedule](https://discuss.elastic.co/t/snapshot-policy-which-is-only-triggered-by-ilm-and-not-on-its-own-schedule/277758)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 6\ **Last updated:** [July 25, 2021, 11:43pm UTC](https://discuss.elastic.co/t/snapshot-policy-which-is-only-triggered-by-ilm-and-not-on-its-own-schedule/277758 "2021-07-25T23:43:53Z")
Hi, Is it possible to have a snapshot policy which does not have a schedule? I wanted the ILM to create a snapshot by invoking the snapshot policy just before the index is deleted at the end of cold phase. I want to us… --- ## [Logstash Insert or Update if exists](https://discuss.elastic.co/t/logstash-insert-or-update-if-exists/206083)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 11:15am UTC](https://discuss.elastic.co/t/logstash-insert-or-update-if-exists/206083 "2019-11-01T11:15:38Z")
hello guys , so lately i've trying to insert some data from txt file into elasticsearch index , but i'm having a problem in updating my index , when i run the logstach conf file it's not updating the data or inserting th… --- ## [Problem of ElasticSearch on ZFS](https://discuss.elastic.co/t/problem-of-elasticsearch-on-zfs/15061)
**Author:** [@xianghui](https://discuss.elastic.co/u/xianghui)\ **Replies:** 3\ **Last updated:** [January 1, 2014, 12:10pm UTC](https://discuss.elastic.co/t/problem-of-elasticsearch-on-zfs/15061 "2014-01-01T12:10:05Z")
Dear All Could I check whether anyone deploy ElasticSearch on ZFS? We are facing some problems with our ES instance on ZFS. When indexing (and idle mode) there seems to be high volume of reads on the drives u… --- ## [Manually import data from indices folder](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388)
**Author:** [@Tojo\_Rakotoarimanana](https://discuss.elastic.co/u/Tojo_Rakotoarimanana)\ **Replies:** 5\ **Last updated:** [November 4, 2021, 8:59am UTC](https://discuss.elastic.co/t/manually-import-data-from-indices-folder/288388 "2021-11-04T08:59:35Z")
Hello all, For unknown reason, our index was deleted automatically. we have a backup but just the folder in path.data, no snapshot. is there any tricky method to import index from this backup? thanks --- ## [Deleted ES indices coming back](https://discuss.elastic.co/t/deleted-es-indices-coming-back/228213)
**Author:** [@ntsh999](https://discuss.elastic.co/u/ntsh999)\ **Replies:** 5\ **Last updated:** [April 17, 2020, 1:44pm UTC](https://discuss.elastic.co/t/deleted-es-indices-coming-back/228213 "2020-04-17T13:44:11Z")
I am running Elastic stack v7.2 in Azure Kubernetes for logging and monitoring of containerized applications. I have 3 master + 2 data node configuration. I am using ES curator which is scheduled to run once daily to de… --- ## [Should we continue or stop indexing during rolling upgrades of Elastic-Search?](https://discuss.elastic.co/t/should-we-continue-or-stop-indexing-during-rolling-upgrades-of-elastic-search/240779)
**Author:** [@het](https://discuss.elastic.co/u/het)\ **Replies:** 7\ **Last updated:** [July 21, 2020, 8:56am UTC](https://discuss.elastic.co/t/should-we-continue-or-stop-indexing-during-rolling-upgrades-of-elastic-search/240779 "2020-07-21T08:56:56Z")
Hi team, Should we continue or stop indexing during rolling upgrades of Elastic-Search? I read in the upgrade documentation that it is optional steps to stop indexing and do flush sync. My query is if we do not stop in… [Previous page](https://discuss.elastic.co/top.md?page=759&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=761&per_page=50&period=all)