# Top **URL:** https://discuss.elastic.co/top.md?page=794&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 795 --- ## [Elastic Cloud Snapshot to AWS S3](https://discuss.elastic.co/t/elastic-cloud-snapshot-to-aws-s3/178000)
**Author:** [@Robin\_Guo](https://discuss.elastic.co/u/Robin_Guo)\ **Replies:** 6\ **Last updated:** [April 26, 2019, 4:29pm UTC](https://discuss.elastic.co/t/elastic-cloud-snapshot-to-aws-s3/178000 "2019-04-26T16:29:57Z")
Hi Elastic Members, I Have a question of Elastic Cloud index snapshot, As I know if we want to send index snapshots to AWS s3 in terms of on-premise ELK solution, We need to install repository-s3 plugin on each of ES … --- ## [Dashboard and visualization showing No results found, but Discover page shows data](https://discuss.elastic.co/t/dashboard-and-visualization-showing-no-results-found-but-discover-page-shows-data/319344)
**Author:** [@D3epDiv3r](https://discuss.elastic.co/u/D3epDiv3r)\ **Replies:** 2\ **Last updated:** [November 20, 2022, 3:04am UTC](https://discuss.elastic.co/t/dashboard-and-visualization-showing-no-results-found-but-discover-page-shows-data/319344 "2022-11-20T03:04:12Z")
Hello team, I am using Elastic Stack 5.2.2, I have been able to parse logs from Suricata to Logstash and Elasticsearch which displays in the Kibana Discover page as seen below: But whenever I go to the Dashboard tab… --- ## [How to make Filebeat 6.4.1 read custom application logs?](https://discuss.elastic.co/t/how-to-make-filebeat-6-4-1-read-custom-application-logs/149805)
**Author:** [@Revit](https://discuss.elastic.co/u/Revit)\ **Replies:** 2\ **Last updated:** [September 26, 2018, 6:22am UTC](https://discuss.elastic.co/t/how-to-make-filebeat-6-4-1-read-custom-application-logs/149805 "2018-09-26T06:22:02Z")
Hello, I am new into this ELK stuff. I have question: how to make filebeat read custom log (for example vmware log) and send it to logstash? I already read the guide and I am quite clueless. Do I need make new custom mo… --- ## [How to display dashboard title on a custom header](https://discuss.elastic.co/t/how-to-display-dashboard-title-on-a-custom-header/111705)
**Author:** [@Karan\_Sharma](https://discuss.elastic.co/u/Karan_Sharma)\ **Replies:** 2\ **Last updated:** [December 20, 2017, 6:53am UTC](https://discuss.elastic.co/t/how-to-display-dashboard-title-on-a-custom-header/111705 "2017-12-20T06:53:42Z")
I need to make a header on kibana for branding purpose. I use a plugin to make a custom header, using the hacks uiExports. I am able to display the HTML and less code. Now i wan't to retrieve the name of the current das… --- ## [Shrink (merge?) performance optimization](https://discuss.elastic.co/t/shrink-merge-performance-optimization/101157)
**Author:** [@gerilya](https://discuss.elastic.co/u/gerilya)\ **Replies:** 2\ **Last updated:** [September 21, 2017, 8:51am UTC](https://discuss.elastic.co/t/shrink-merge-performance-optimization/101157 "2017-09-21T08:51:40Z")
Hello, We have Elasticsearch cluster with 30 data nodes (i3.2xlarge AWS instances). They are storing approx 37TB of data spread between 335 indicies (1 index per day per app service). The largest indecies reach almost… --- ## [Alerts based on a field](https://discuss.elastic.co/t/alerts-based-on-a-field/246548)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 3\ **Last updated:** [August 27, 2020, 3:46pm UTC](https://discuss.elastic.co/t/alerts-based-on-a-field/246548 "2020-08-27T15:46:59Z")
Hi All, Is it possible to create either an alert or a watcher, that is based off the count of a specific field. I currently have application logs that ingest into elasticsearch. I then have a timelion graph that graphs… --- ## [Elastisearch Backups Are Failing On s3](https://discuss.elastic.co/t/elastisearch-backups-are-failing-on-s3/48059)
**Author:** [@sukanta](https://discuss.elastic.co/u/sukanta)\ **Replies:** 3\ **Last updated:** [April 22, 2016, 1:38pm UTC](https://discuss.elastic.co/t/elastisearch-backups-are-failing-on-s3/48059 "2016-04-22T13:38:51Z")
Hi, We are taking elasticsearch backup using S3 repository plugin , Here is the repository setting and and create snap shot command Register Repo : curl -XPUT 'http://localhost:9200/\_snapshot/repo\_name' -d '{ "ty… --- ## [Mustache double quotes problem in search templates](https://discuss.elastic.co/t/mustache-double-quotes-problem-in-search-templates/318736)
**Author:** [@D1sturbance](https://discuss.elastic.co/u/D1sturbance)\ **Replies:** 7\ **Last updated:** [November 16, 2022, 7:52am UTC](https://discuss.elastic.co/t/mustache-double-quotes-problem-in-search-templates/318736 "2022-11-16T07:52:23Z")
What is the best way to use mustache False values feature in Elasticsearch template? At the moment I am trying to select function based on boolean value. Rendering seems to be working according to the logic, but it pri… --- ## [Don't send log to Elastic search](https://discuss.elastic.co/t/dont-send-log-to-elastic-search/65787)
**Author:** [@jyp](https://discuss.elastic.co/u/jyp)\ **Replies:** 8\ **Last updated:** [November 16, 2016, 9:12am UTC](https://discuss.elastic.co/t/dont-send-log-to-elastic-search/65787 "2016-11-16T09:12:53Z")
Now, we use logging system on ELK (filebeat \> kafka \> logstash\> elasticsearch/kibana) But we restart server on elasticsearch(=ES) recently. I don't know why I can search only log file after when elasticsearch restart, … --- ## [Duplicate documents using Filebeat](https://discuss.elastic.co/t/duplicate-documents-using-filebeat/53905)
**Author:** [@vitgou](https://discuss.elastic.co/u/vitgou)\ **Replies:** 2\ **Last updated:** [June 27, 2016, 9:21am UTC](https://discuss.elastic.co/t/duplicate-documents-using-filebeat/53905 "2016-06-27T09:21:20Z")
Hi, I'm using Filebeat to send data to Logstash + Elasticsearch server. I noticed that if the Logstash+Elasticsearch server is not fast enough I start to see duplicate entries in elasticsearch. Is this a bug? What opti… --- ## [Logstash 2.1.1 : Routing output to multiple clusters](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [January 5, 2016, 9:32am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165 "2016-01-05T09:32:41Z")
Hi, I have a need to route different message types to different elasticsearch clusters. I realise I could do this by having different "elasticsearch" output blocks separated by "if" conditionals. However, that is wastefu… --- ## [Nested Jason with Filebeat](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930)
**Author:** [@Michael\_U](https://discuss.elastic.co/u/Michael_U)\ **Replies:** 1\ **Last updated:** [January 25, 2018, 4:59pm UTC](https://discuss.elastic.co/t/nested-jason-with-filebeat/116930 "2018-01-25T16:59:53Z")
Dear all, recently I used logz.io to do my logging. My log-entries are nested .net objects, that I serialize to Json using NLog. With logz.io it just works fine - I can model any log-message and it will show up as a n… --- ## [How to get unique combination of multiple fields in elastic search in 1 bucket](https://discuss.elastic.co/t/how-to-get-unique-combination-of-multiple-fields-in-elastic-search-in-1-bucket/214719)
**Author:** [@Pinky\_Agarwal](https://discuss.elastic.co/u/Pinky_Agarwal)\ **Replies:** 1\ **Last updated:** [January 13, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-get-unique-combination-of-multiple-fields-in-elastic-search-in-1-bucket/214719 "2020-01-13T13:58:28Z")
I have an index with fields like that "\_source": { "ProductID": "7ab9772e-1e92-48c9-bfbb-a6d200b42fbe", "productName": "ABC", "theme\_id":"dsadsad", "theme\_name":"sdsd" } I want to get the unique key value pair lik… --- ## [Filebeat and Logstash in AIX](https://discuss.elastic.co/t/filebeat-and-logstash-in-aix/41077)
**Author:** [@mrehanb](https://discuss.elastic.co/u/mrehanb)\ **Replies:** 1\ **Last updated:** [February 6, 2016, 4:03am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-in-aix/41077 "2016-02-06T04:03:29Z")
Few questions:- 1) Please advise how to start logstash service in AIX 2) Does Filebeat works in AIX? 3) Secondly i like to ship the logs from AIX to windows machine. Do i need SSL/TLS certificate to have handshake? T… --- ## [MetricBeat tomcat module with HTTPS](https://discuss.elastic.co/t/metricbeat-tomcat-module-with-https/220313)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 6\ **Last updated:** [March 3, 2020, 1:26pm UTC](https://discuss.elastic.co/t/metricbeat-tomcat-module-with-https/220313 "2020-03-03T13:26:33Z")
Hi guys, I have just tried to get the BETA version of the tomcat module to work with our tomcat(8.0.x) which only allows HTTPS connections. My configuration of the module(MetricBeat 7.6.0) is this: - module: tomcat … --- ## [How can Kibana be accessed using IAM in AWS?](https://discuss.elastic.co/t/how-can-kibana-be-accessed-using-iam-in-aws/172111)
**Author:** [@Habbiot](https://discuss.elastic.co/u/Habbiot)\ **Replies:** 6\ **Last updated:** [March 14, 2019, 12:50pm UTC](https://discuss.elastic.co/t/how-can-kibana-be-accessed-using-iam-in-aws/172111 "2019-03-14T12:50:31Z")
I am using ELK stack on EC2 INstances. How can Kibana be accessed using IAM in AWS ? --- ## [Index.codec in template is not accepting anymore in ES6.5?](https://discuss.elastic.co/t/index-codec-in-template-is-not-accepting-anymore-in-es6-5/167807)
**Author:** [@Suryadip\_Nag](https://discuss.elastic.co/u/Suryadip_Nag)\ **Replies:** 6\ **Last updated:** [February 11, 2019, 10:37am UTC](https://discuss.elastic.co/t/index-codec-in-template-is-not-accepting-anymore-in-es6-5/167807 "2019-02-11T10:37:56Z")
We have migrated to Elasticsearch from 5.5 to 6.5. We have field in template index.codec but it is not accepting anymore when I try to create the template in ES6.5. But same template is getting created in ES5.5. curl -X… --- ## [Winlogbeat will no longer start](https://discuss.elastic.co/t/winlogbeat-will-no-longer-start/150819)
**Author:** [@popa](https://discuss.elastic.co/u/popa)\ **Replies:** 3\ **Last updated:** [October 3, 2018, 8:24am UTC](https://discuss.elastic.co/t/winlogbeat-will-no-longer-start/150819 "2018-10-03T08:24:17Z")
I made a configuration change to winlogbeat.yml then issued a Restart-Service winlogbeat. I've done this several times in the past when updating my configuration file without any issues. However, this time the winlogbea… --- ## [How to change number of rows in dataTable in Discover? Kibana](https://discuss.elastic.co/t/how-to-change-number-of-rows-in-datatable-in-discover-kibana/147547)
**Author:** [@NikolaenkoDmitriy](https://discuss.elastic.co/u/NikolaenkoDmitriy)\ **Replies:** 3\ **Last updated:** [September 6, 2018, 11:01am UTC](https://discuss.elastic.co/t/how-to-change-number-of-rows-in-datatable-in-discover-kibana/147547 "2018-09-06T11:01:36Z")
Hi, Can I somehow reduce or increase the number of lines here?: By default, no more than seven rows are displayed for each message. Did not find the settings by which I could change this number=( --- ## [Hive read operation fails when stored as external table pointing to Elastic search location](https://discuss.elastic.co/t/hive-read-operation-fails-when-stored-as-external-table-pointing-to-elastic-search-location/130135)
**Author:** [@bvk](https://discuss.elastic.co/u/bvk)\ **Replies:** 3\ **Last updated:** [May 2, 2018, 6:07am UTC](https://discuss.elastic.co/t/hive-read-operation-fails-when-stored-as-external-table-pointing-to-elastic-search-location/130135 "2018-05-02T06:07:45Z")
Hi, I have 5.10.2 CDH Kerberos enabled 6 node Hadoop cluster and I have installed Elasticsearch 6.1.4 on Edge-node (Single node ES). I am trying to to load data from hive to Elasticsearch and read it in hive. for ex: … --- ## [Mapping for objects with an arbitrary amount of properties](https://discuss.elastic.co/t/mapping-for-objects-with-an-arbitrary-amount-of-properties/14626)
**Author:** [@hereandnow](https://discuss.elastic.co/u/hereandnow)\ **Replies:** 3\ **Last updated:** [November 29, 2013, 9:29am UTC](https://discuss.elastic.co/t/mapping-for-objects-with-an-arbitrary-amount-of-properties/14626 "2013-11-29T09:29:01Z")
i have a given document: { "foo": {} } where \`foo\` can have an arbitrary amount of properties. lets assume i will import millions of documents into my index, in which each of \`foo\`'s properties do… --- ## [Email alert in elasticsearch](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 7:36pm UTC](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105 "2020-02-10T19:36:20Z")
Hi Team, I am working on the Email Alert functionality, where i came different scenario like Let's Suppose I have configured the metricbeat & filebeat in 10 servers which will send the data to the Elastics cluster. Amo… --- ## [Term Query is not working](https://discuss.elastic.co/t/term-query-is-not-working/158470)
**Author:** [@Giorgi\_Kharchenko](https://discuss.elastic.co/u/Giorgi_Kharchenko)\ **Replies:** 7\ **Last updated:** [November 28, 2018, 7:55am UTC](https://discuss.elastic.co/t/term-query-is-not-working/158470 "2018-11-28T07:55:19Z")
Hi, I tried to run this query. but this query is not working. I changed term with match\_phrase so it is working. Can you tell me what the problem is? GET index/\_search { "query": { "bool": { … --- ## [Need help with Logstash/Filebeat working with Kibana](https://discuss.elastic.co/t/need-help-with-logstash-filebeat-working-with-kibana/153501)
**Author:** [@CMonty](https://discuss.elastic.co/u/CMonty)\ **Replies:** 7\ **Last updated:** [October 31, 2018, 9:51am UTC](https://discuss.elastic.co/t/need-help-with-logstash-filebeat-working-with-kibana/153501 "2018-10-31T09:51:38Z")
I am trying to ingest data into kibana using a logstash via a filebeat but the data isn't being transferred by my filebeat for some reason... Would you guys be able to help? The link below is the code to my logstash-sam… --- ## [Kibana Reflecting error to connect with elasticsearch](https://discuss.elastic.co/t/kibana-reflecting-error-to-connect-with-elasticsearch/76728)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 7\ **Last updated:** [March 14, 2017, 6:50am UTC](https://discuss.elastic.co/t/kibana-reflecting-error-to-connect-with-elasticsearch/76728 "2017-03-14T06:50:59Z")
Hi , I'm using new version of elasticsearch(5.2.1) and kibana (5.2.1) and i'm try to start elasticsearch as cluster mode. Elasticsearch is up and running when i start kibana im getting error status : red and please find … --- ## [Setting es\_heap\_size requires re-install in Windows?](https://discuss.elastic.co/t/setting-es-heap-size-requires-re-install-in-windows/19651)
**Author:** [@kti\_sk](https://discuss.elastic.co/u/kti_sk)\ **Replies:** 0\ **Last updated:** [September 5, 2014, 10:36pm UTC](https://discuss.elastic.co/t/setting-es-heap-size-requires-re-install-in-windows/19651 "2014-09-05T22:36:41Z")
This is what I observed. I set es\_heap\_size from 2000m to 3000m (on 6gb machine) and restart ES service and marvel still shows the machine as having 2gb. I restarted the machine itself and still the same. I finally … --- ## [Analyze with custom analyzer throws JsonGenerationException](https://discuss.elastic.co/t/analyze-with-custom-analyzer-throws-jsongenerationexception/170644)
**Author:** [@mmarie](https://discuss.elastic.co/u/mmarie)\ **Replies:** 2\ **Last updated:** [March 13, 2019, 7:52am UTC](https://discuss.elastic.co/t/analyze-with-custom-analyzer-throws-jsongenerationexception/170644 "2019-03-13T07:52:17Z")
Hi I have the same problem than the unanswered one there Refering to the doc Java High Level REST Client, I built a custom analyzer AnalyzeRequest request = new AnalyzeRequest(); request.text("\Some text to analyze\ **Author:** [@panda2004](https://discuss.elastic.co/u/panda2004)\ **Replies:** 2\ **Last updated:** [June 11, 2018, 6:31am UTC](https://discuss.elastic.co/t/cache-impacts-performance/133610 "2018-06-11T06:31:22Z") Hello, We launched our product 10 months ago. Now it's time for us to expand, serve more customers and as a result move to a bigger cluster. Therefore, nowadays we are making some kind of sizing procedure. Our sizing p… --- ## [Export kibana all data from CLI (Like Export button in kibana)](https://discuss.elastic.co/t/export-kibana-all-data-from-cli-like-export-button-in-kibana/99772)
**Author:** [@rpuserh](https://discuss.elastic.co/u/rpuserh)\ **Replies:** 2\ **Last updated:** [September 11, 2017, 5:07pm UTC](https://discuss.elastic.co/t/export-kibana-all-data-from-cli-like-export-button-in-kibana/99772 "2017-09-11T17:07:13Z")
Hi, I need to setup cron and export all kibana data with curl and then use UI to Import . I tried to get XHR requests from browser It give me 3 request /es\_admin/.kibana/visualization/\_search?size=1000&scroll=1m&sort… --- ## [Multiline conf file to parse log file to elasticsearch](https://discuss.elastic.co/t/multiline-conf-file-to-parse-log-file-to-elasticsearch/1153)
**Author:** [@bradfordli](https://discuss.elastic.co/u/bradfordli)\ **Replies:** 4\ **Last updated:** [June 19, 2015, 1:39pm UTC](https://discuss.elastic.co/t/multiline-conf-file-to-parse-log-file-to-elasticsearch/1153 "2015-06-19T13:39:26Z")
I have this log file: http://dpaste.com/3FE2VNY I only want to extract certain pieces of information such as date time, and number of events posted. My attempt of putting this into elasticsearch results in hanging of … --- ## [Authentication of \[elastic\] was terminated by realm\[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/207077)
**Author:** [@geethusureshkrishna](https://discuss.elastic.co/u/geethusureshkrishna)\ **Replies:** 5\ **Last updated:** [November 25, 2019, 8:46am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/207077 "2019-11-25T08:46:42Z")
I have an Elasticsearch cluster with version 7.3.2. The cluster was stopped because of the error " Authentication of \[elastic\] was terminated by realm\[reserved\] - failed to authenticate user \[elastic\]. Failed to retrieve… --- ## [Elapsed and aggregate filter with multiple workers](https://discuss.elastic.co/t/elapsed-and-aggregate-filter-with-multiple-workers/150647)
**Author:** [@shwesinhan](https://discuss.elastic.co/u/shwesinhan)\ **Replies:** 5\ **Last updated:** [October 4, 2018, 8:43am UTC](https://discuss.elastic.co/t/elapsed-and-aggregate-filter-with-multiple-workers/150647 "2018-10-04T08:43:20Z")
Elapsed and aggregate filters will not work properly when multiple logstash workers are used. In that case, how do we solve the same problem? Thank you. same question with this https://stackoverflow.com/questions/373533… --- ## [Cannot execute scripts using \[aggs\] context](https://discuss.elastic.co/t/cannot-execute-scripts-using-aggs-context/146604)
**Author:** [@kennymarx0](https://discuss.elastic.co/u/kennymarx0)\ **Replies:** 5\ **Last updated:** [September 2, 2018, 11:25am UTC](https://discuss.elastic.co/t/cannot-execute-scripts-using-aggs-context/146604 "2018-09-02T11:25:30Z")
i wanna use aggs and script in es 6.3 like below GET /trxdetail-sdall/\_search?pretty { "aggs": { "distinct\_OPPNAME": { "terms": { "script":"doc\['OPPACC'\]+' '+doc\['OPPNAME'\]" } } }, "query": { "terms": { "OPP… --- ## [Scripts during indexing](https://discuss.elastic.co/t/scripts-during-indexing/13470)
**Author:** [@Adrian\_2](https://discuss.elastic.co/u/Adrian_2)\ **Replies:** 5\ **Last updated:** [September 6, 2013, 11:36am UTC](https://discuss.elastic.co/t/scripts-during-indexing/13470 "2013-09-06T11:36:00Z")
Hi all, I wonder if it is possible to use scripts within an index statement? Thanks, Adrian -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe f… --- ## [Elasticsearch JNA unavailable / elastic no start](https://discuss.elastic.co/t/elasticsearch-jna-unavailable-elastic-no-start/343072)
**Author:** [@deepx](https://discuss.elastic.co/u/deepx)\ **Replies:** 3\ **Last updated:** [September 14, 2023, 8:02pm UTC](https://discuss.elastic.co/t/elasticsearch-jna-unavailable-elastic-no-start/343072 "2023-09-14T20:02:33Z")
Hello, I installed elasticsearch on ubuntu , but when i start elastic I always get an error. The log is showing me the following: JNA not available java.lang.UnsatisfiedLinkError: /tmp/elasticsearch-1125708853983863618… --- ## [Merging hybrid search results (BM25 + HNSW) in elastic 8.7](https://discuss.elastic.co/t/merging-hybrid-search-results-bm25-hnsw-in-elastic-8-7/330225)
**Author:** [@Francisco\_Rocha](https://discuss.elastic.co/u/Francisco_Rocha)\ **Replies:** 3\ **Last updated:** [April 20, 2023, 5:57pm UTC](https://discuss.elastic.co/t/merging-hybrid-search-results-bm25-hnsw-in-elastic-8-7/330225 "2023-04-20T17:57:50Z")
Hi there! I'm new to Elastic and have been trying to do a information retrieval system for 500k documents of text using python and docker (for elastic 8.7). I'm not really sure how to go about doing an hybrid search (BM… --- ## [Grok performance problem when parsing dots, dashs, underscore](https://discuss.elastic.co/t/grok-performance-problem-when-parsing-dots-dashs-underscore/102985)
**Author:** [@simon.t](https://discuss.elastic.co/u/simon.t)\ **Replies:** 3\ **Last updated:** [October 6, 2017, 11:19am UTC](https://discuss.elastic.co/t/grok-performance-problem-when-parsing-dots-dashs-underscore/102985 "2017-10-06T11:19:31Z")
Hi all, I'm issuing a performance problem with grok filter. I use filebeat 5.4.6 to send log file event to logstash 5.4.6. I made a very simple grok filter in logstash to extract path and filename of the log file from… --- ## [Would the search performance be very slow if a data stream consists of too many or too large cold backing indices?](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 6\ **Last updated:** [January 18, 2022, 8:16am UTC](https://discuss.elastic.co/t/would-the-search-performance-be-very-slow-if-a-data-stream-consists-of-too-many-or-too-large-cold-backing-indices/294376 "2022-01-18T08:16:45Z")
Hi, I'm moving from es 6.x to 7.x, find the new feature data stream and would like to have a try. But I'm a bit worried of the search performace for the docs explains When you submit a read request to a data stream, the… --- ## [Filebeat - Force filebeat to read custom log from different pod paths](https://discuss.elastic.co/t/filebeat-force-filebeat-to-read-custom-log-from-different-pod-paths/259320)
**Author:** [@David\_Fachini](https://discuss.elastic.co/u/David_Fachini)\ **Replies:** 6\ **Last updated:** [December 22, 2020, 10:41pm UTC](https://discuss.elastic.co/t/filebeat-force-filebeat-to-read-custom-log-from-different-pod-paths/259320 "2020-12-22T22:41:08Z")
Hello, using Elastic + Filebeat + kibana in kubernetes. I have a lot of products running in cluster (apache kafka, apache druid, postgresql). Checking filebeat behavior it harvest logs from /var/lib/docker/containers/ … --- ## [How to calculate search time spent by Elasticsearch on its inverted index alone?](https://discuss.elastic.co/t/how-to-calculate-search-time-spent-by-elasticsearch-on-its-inverted-index-alone/232962)
**Author:** [@kmdabdulla](https://discuss.elastic.co/u/kmdabdulla)\ **Replies:** 6\ **Last updated:** [June 1, 2020, 8:33pm UTC](https://discuss.elastic.co/t/how-to-calculate-search-time-spent-by-elasticsearch-on-its-inverted-index-alone/232962 "2020-06-01T20:33:41Z")
Took field gives overall search time but is there any way to find the time elasticsearch spends only on its index alone? --- ## [Output -\> file -\> codec -\> json writing in a single line instead of writing as new line for every set](https://discuss.elastic.co/t/output-file-codec-json-writing-in-a-single-line-instead-of-writing-as-new-line-for-every-set/65440)
**Author:** [@gmmurugan](https://discuss.elastic.co/u/gmmurugan)\ **Replies:** 2\ **Last updated:** [November 9, 2016, 4:09pm UTC](https://discuss.elastic.co/t/output-file-codec-json-writing-in-a-single-line-instead-of-writing-as-new-line-for-every-set/65440 "2016-11-09T16:09:49Z")
output -\> file -\> codec -\> json writing in a single line instead of writing as new line for every set. its hard for nxlog to parse thru thee output because there is no new line . its always a single line and never ending… --- ## [\_update\_by\_query throws null\_pointer\_exception](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 2\ **Last updated:** [September 19, 2020, 12:52am UTC](https://discuss.elastic.co/t/update-by-query-throws-null-pointer-exception/248574 "2020-09-19T00:52:44Z")
I've created an index, and I'm trying to add one field. using this script: POST test\_kris\_assignment/\_update\_by\_query { "script": { "source": "ctx.\_source.field1.field2\_1 =10", "lang": "painless" }, "query": { "m… --- ## [Performance management in CCR](https://discuss.elastic.co/t/performance-management-in-ccr/277637)
**Author:** [@jamesgorrie](https://discuss.elastic.co/u/jamesgorrie)\ **Replies:** 4\ **Last updated:** [July 5, 2021, 2:18am UTC](https://discuss.elastic.co/t/performance-management-in-ccr/277637 "2021-07-05T02:18:31Z")
We currently have CCR setup between two deployments within Elastic Cloud. The main reason for having this configuration is that we write heavily to the leader, and don't mind a search performance hit there, but would li… --- ## [Why does elasticsearch return inconsistent result on version 7.8.1 and return correct result on 5.6.7 for the same match\_phrase\_prefix query? How can i get consistent result on elasticsearch 7.8.1?](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722)
**Author:** [@animesh\_dhokare](https://discuss.elastic.co/u/animesh_dhokare)\ **Replies:** 7\ **Last updated:** [December 17, 2021, 1:02pm UTC](https://discuss.elastic.co/t/why-does-elasticsearch-return-inconsistent-result-on-version-7-8-1-and-return-correct-result-on-5-6-7-for-the-same-match-phrase-prefix-query-how-can-i-get-consistent-result-on-elasticsearch-7-8-1/290722 "2021-12-17T13:02:11Z")
Hi there, I have observed inconsistency in the result for the below match\_phrase\_prefix query on elasticsearch 7.8.1. QUERY: { "sort": \[{ "created": { "order": "desc" } … --- ## [Large number of nodes within a cluster in a local network](https://discuss.elastic.co/t/large-number-of-nodes-within-a-cluster-in-a-local-network/69710)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 7\ **Last updated:** [January 12, 2017, 10:43am UTC](https://discuss.elastic.co/t/large-number-of-nodes-within-a-cluster-in-a-local-network/69710 "2017-01-12T10:43:23Z")
Hi, In a local high speed network, are there any downsides or anything to be aware of when attempting to have a single elasticsearch cluster with 500 or 1000 or more nodes given that the servers where the nodes will be… --- ## [Errors installing logstash-mixin-ecs\_compatibility\_support plugin](https://discuss.elastic.co/t/errors-installing-logstash-mixin-ecs-compatibility-support-plugin/299374)
**Author:** [@mikespharss](https://discuss.elastic.co/u/mikespharss)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 7:28pm UTC](https://discuss.elastic.co/t/errors-installing-logstash-mixin-ecs-compatibility-support-plugin/299374 "2022-03-17T19:28:50Z")
I started having a weird problem where using logstash-plugin to install logstash-output-opensearch was leaving my plugin environment in a broken state. Logstash version: logstash 7.16.1 using bundled JDK version I sta… --- ## [Curator script to reindex daily indices to monthly onces](https://discuss.elastic.co/t/curator-script-to-reindex-daily-indices-to-monthly-onces/161223)
**Author:** [@VietCong](https://discuss.elastic.co/u/VietCong)\ **Replies:** 4\ **Last updated:** [December 26, 2018, 4:01pm UTC](https://discuss.elastic.co/t/curator-script-to-reindex-daily-indices-to-monthly-onces/161223 "2018-12-26T16:01:15Z")
I am trying to write a curator script that would look into my clusters and pick out those daily indices that are smaller than 5GB then reindex them to big monthly indices then delete the daily indices. My problem/que… --- ## [Msearch: Failed to derive xcontent](https://discuss.elastic.co/t/msearch-failed-to-derive-xcontent/80854)
**Author:** [@jattenberg](https://discuss.elastic.co/u/jattenberg)\ **Replies:** 4\ **Last updated:** [April 3, 2017, 4:18pm UTC](https://discuss.elastic.co/t/msearch-failed-to-derive-xcontent/80854 "2017-04-03T16:18:24Z")
I'm trying to get back a number of results (lines from chat data) simultaneously, however I'm stymied with what is wrong with my query. I get the error "Failed to derive xcontent \[parse exception\]", Query is /myindex/\_ms… --- ## [Selectively ignore dashboard global filters](https://discuss.elastic.co/t/selectively-ignore-dashboard-global-filters/269292)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 3\ **Last updated:** [April 6, 2021, 4:40pm UTC](https://discuss.elastic.co/t/selectively-ignore-dashboard-global-filters/269292 "2021-04-06T16:40:27Z")
I have a dashboard with two filters, and I need to set a visualization that uses the second one. There is an option to Ignore Global Filter in TSVB, but it ignores both of them. Can a visualization apply the second filte… --- ## [Data from Splunk not reaching Ealsticsearch server through Apache Loadbalancer](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160)
**Author:** [@sumith\_naduvath](https://discuss.elastic.co/u/sumith_naduvath)\ **Replies:** 5\ **Last updated:** [January 7, 2019, 12:04pm UTC](https://discuss.elastic.co/t/data-from-splunk-not-reaching-ealsticsearch-server-through-apache-loadbalancer/163160 "2019-01-07T12:04:47Z")
Hi All, I am trying to setup an Elasticsearch and Kibana on my server and the input data for Elasticsearch is a splunk log forwarder. The splunk is being managed by a third party company and they have configured the log… [Previous page](https://discuss.elastic.co/top.md?page=793&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=795&per_page=50&period=all)