# Top **URL:** https://discuss.elastic.co/top.md?page=80&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 81 --- ## [Question regarding size of bulk action](https://discuss.elastic.co/t/question-regarding-size-of-bulk-action/301800)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 21\ **Last updated:** [April 7, 2022, 8:25pm UTC](https://discuss.elastic.co/t/question-regarding-size-of-bulk-action/301800 "2022-04-07T20:25:45Z")
I have 3 nodes designated to be the ingestion nodes. So all writers will round robin to those 3 nodes. My question is should the bulkWrite size be sizing to the ingestion node or primary shard on nodes? Let's say I ha… --- ## [Error in jvmgcmonitorservice (gc overhead)](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 9\ **Last updated:** [July 15, 2021, 8:13am UTC](https://discuss.elastic.co/t/error-in-jvmgcmonitorservice-gc-overhead/278241 "2021-07-15T08:13:39Z")
I am having the following problem. $ cat /var/log/elasticsearch/elasticsearch.log | grep WARN \[2021-07-09T00:04:51,795\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[ITS-ELST-01\] \[gc\]\[young\]\[214003\]\[2290\] duration \[1.7s\], collec… --- ## [How to allow read only user to report from Kibana](https://discuss.elastic.co/t/how-to-allow-read-only-user-to-report-from-kibana/189807)
**Author:** [@alonsnir](https://discuss.elastic.co/u/alonsnir)\ **Replies:** 9\ **Last updated:** [August 5, 2019, 1:04pm UTC](https://discuss.elastic.co/t/how-to-allow-read-only-user-to-report-from-kibana/189807 "2019-08-05T13:04:03Z")
Hi, I need some of my dashboard read only users to be able to export data. X-Pack documentation says " To access Kibana and generate reports, you need the kibana\_user and reporting\_user roles". The problem is that us… --- ## [Can't match this phrase!](https://discuss.elastic.co/t/cant-match-this-phrase/113970)
**Author:** [@The\_Juke\_Box\_Hero](https://discuss.elastic.co/u/The_Juke_Box_Hero)\ **Replies:** 10\ **Last updated:** [January 11, 2018, 10:35pm UTC](https://discuss.elastic.co/t/cant-match-this-phrase/113970 "2018-01-11T22:35:10Z")
Hi Elastic team, I've been trying to fix an issue with our match for a few days now where my search for this phrase "Finished IT Project" won't match anything, here is what I have tried so far: 1- Removed IT as stop wo… --- ## [Node sync fails and cluster goes to "red"](https://discuss.elastic.co/t/node-sync-fails-and-cluster-goes-to-red/274409)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 21\ **Last updated:** [May 31, 2021, 4:58pm UTC](https://discuss.elastic.co/t/node-sync-fails-and-cluster-goes-to-red/274409 "2021-05-31T16:58:37Z")
Hello, I hope you and your loved ones are safe and healthy. I have a 3 node cluster with 2 data nodes and 1 voting only node. I accidentally deleted the separate disk that holds data for one of the data node. I separa… --- ## [Config file is not processed by logstash](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903)
**Author:** [@Antonis\_Michael](https://discuss.elastic.co/u/Antonis_Michael)\ **Replies:** 15\ **Last updated:** [February 20, 2021, 1:13am UTC](https://discuss.elastic.co/t/config-file-is-not-processed-by-logstash/264903 "2021-02-20T01:13:15Z")
Hello, I am having my pipeline set to look for .conf files under /etc/logstash/conf.d/, there i have multiple config files and I make sure to tag each one for filtering indices. Everything works fine for all the other c… --- ## [Timelion - no data returned from Quandl](https://discuss.elastic.co/t/timelion-no-data-returned-from-quandl/68336)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 18\ **Last updated:** [December 9, 2016, 11:27pm UTC](https://discuss.elastic.co/t/timelion-no-data-returned-from-quandl/68336 "2016-12-09T23:27:35Z")
Hello, I am running Kibana 5.0.0 and cannot seem to get any data returned from Quandl. I added my API key to the ../src.core\_plugins/timelion/timelion.json file. Restarted Kibana. Then used .quandlI('FRBC/USINFL'… --- ## [Rejected execution (queue capacity 50) in bulk process](https://discuss.elastic.co/t/rejected-execution-queue-capacity-50-in-bulk-process/16149)
**Author:** [@Jose\_Gargallo](https://discuss.elastic.co/u/Jose_Gargallo)\ **Replies:** 10\ **Last updated:** [March 5, 2014, 11:58am UTC](https://discuss.elastic.co/t/rejected-execution-queue-capacity-50-in-bulk-process/16149 "2014-03-05T11:58:01Z")
Hello, I'm facing a problem bulk indexing 5k documents in 24 different indices (i18n). I'm using elasticsearch 1.0.1 with all default settings. I've read that a thread per index is used, that would mean I'm using … --- ## [How to retrieve all document form a content source of Workplace search](https://discuss.elastic.co/t/how-to-retrieve-all-document-form-a-content-source-of-workplace-search/286834)
**Author:** [@Mymail\_Cpn](https://discuss.elastic.co/u/Mymail_Cpn)\ **Replies:** 11\ **Last updated:** [October 19, 2021, 2:59pm UTC](https://discuss.elastic.co/t/how-to-retrieve-all-document-form-a-content-source-of-workplace-search/286834 "2021-10-19T14:59:18Z")
Hello I am new to Elasticsearch. Yesterday I created content source and inserted few documents in workplace search. Now I am trying to retrieve all the documents from that content source. What is the api that I need … --- ## [Logstash Date Type](https://discuss.elastic.co/t/logstash-date-type/78637)
**Author:** [@Shubham\_Joshi](https://discuss.elastic.co/u/Shubham_Joshi)\ **Replies:** 19\ **Last updated:** [March 15, 2017, 11:06am UTC](https://discuss.elastic.co/t/logstash-date-type/78637 "2017-03-15T11:06:57Z")
I am using logstash to parse my logs on S3(gz). My log has data like: 172.31.0.14 - - \[15/May/2016:06:49:02 +0000\] "GET /ottsale/youthstars.html?color=112&manufacturer=116&ram=384&utm\_campaign=mi\_2704&utm\_medium=post&utm… --- ## [Http: TLS handshake error from x.x.x.x:xxxx EOF](https://discuss.elastic.co/t/http-tls-handshake-error-from-x-x-x-x-xxxx-eof/229414)
**Author:** [@Robert\_Bridgeman](https://discuss.elastic.co/u/Robert_Bridgeman)\ **Replies:** 9\ **Last updated:** [April 27, 2020, 4:59pm UTC](https://discuss.elastic.co/t/http-tls-handshake-error-from-x-x-x-x-xxxx-eof/229414 "2020-04-27T16:59:54Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 7.6.… --- ## [Unable to start elasticsearch in Rhel 6](https://discuss.elastic.co/t/unable-to-start-elasticsearch-in-rhel-6/71738)
**Author:** [@bini](https://discuss.elastic.co/u/bini)\ **Replies:** 15\ **Last updated:** [January 19, 2017, 2:31pm UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-in-rhel-6/71738 "2017-01-19T14:31:13Z")
I am unable to start elasticsearch 5.1.1 on Rhel 6. I am getting the following error : 2017-01-16 12:20:10,344 main ERROR RollingFileManager (/var/log/elasticsearch/clarity.log) java.io.FileNotFoundException: /var/log/… --- ## [Filebeat mysql module slowlog - error.message: Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-mysql-module-slowlog-error-message-provided-grok-expressions-do-not-match-field-value/135945)
**Author:** [@Rodrigo\_Floriano](https://discuss.elastic.co/u/Rodrigo_Floriano)\ **Replies:** 10\ **Last updated:** [June 26, 2018, 3:53pm UTC](https://discuss.elastic.co/t/filebeat-mysql-module-slowlog-error-message-provided-grok-expressions-do-not-match-field-value/135945 "2018-06-26T15:53:25Z")
Hi, all! I want use Filebeat MySQL Module for collecting slowlogs into Elasticsearch to view in Kibana Dashboard. I would like to resolve this issue only without using Logstash, only filebeat module. Anyone can help m… --- ## [Shield and LDAP configuration](https://discuss.elastic.co/t/shield-and-ldap-configuration/34114)
**Author:** [@gustav](https://discuss.elastic.co/u/gustav)\ **Replies:** 13\ **Last updated:** [November 19, 2015, 5:27am UTC](https://discuss.elastic.co/t/shield-and-ldap-configuration/34114 "2015-11-19T05:27:31Z")
Hello. I'm trying to configure Shield to authenticate ES users via LDAP. Our company has a domain, for example: company.com. And we have groups like "IT", "Finance", "Tech". But I need authenticate users only from IT. We… --- ## [Logstash - grokfilter is successful using grokdebug, but fails in live](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/110823)
**Author:** [@ajwillo](https://discuss.elastic.co/u/ajwillo)\ **Replies:** 14\ **Last updated:** [December 8, 2017, 4:07pm UTC](https://discuss.elastic.co/t/logstash-grokfilter-is-successful-using-grokdebug-but-fails-in-live/110823 "2017-12-08T16:07:23Z")
I have a grok filter that I have built and tested on http://grokdebug.herokuapp.com. the test sample is: \<190\>3259426: \*Dec 7 17:43:09.599 UTC: %SEC-6-IPACCESSLOGP: list ACL\_3P denied tcp 10.10.10.2(8000) -\> 10.20.20.2… --- ## [Error connecting MongoDB and Elasticseach through Logstash](https://discuss.elastic.co/t/error-connecting-mongodb-and-elasticseach-through-logstash/234762)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 16\ **Last updated:** [May 29, 2020, 1:14pm UTC](https://discuss.elastic.co/t/error-connecting-mongodb-and-elasticseach-through-logstash/234762 "2020-05-29T13:14:24Z")
I can't do the ingestion between the MongoBD database and Elasticseach using Logstash, below is my .conf file input { uri =\> 'mongodb://localhost:27017/exemplo' placeholder\_db\_dir =\> '/opt/logstash-m… --- ## [Using the Java Keystore with Shield](https://discuss.elastic.co/t/using-the-java-keystore-with-shield/43428)
**Author:** [@megaforce1020](https://discuss.elastic.co/u/megaforce1020)\ **Replies:** 14\ **Last updated:** [March 11, 2016, 1:41pm UTC](https://discuss.elastic.co/t/using-the-java-keystore-with-shield/43428 "2016-03-11T13:41:24Z")
Hi so I'm trying to connect Kibana to Elasticsearch both of which have the Shield Plugin installed and both are running at the moment of this testing on the same machine. I have followed the guides from elastic: https:/… --- ## [Avoiding the Split Brain](https://discuss.elastic.co/t/avoiding-the-split-brain/128746)
**Author:** [@aslamy1](https://discuss.elastic.co/u/aslamy1)\ **Replies:** 12\ **Last updated:** [April 20, 2018, 1:15pm UTC](https://discuss.elastic.co/t/avoiding-the-split-brain/128746 "2018-04-20T13:15:14Z")
Hi ! I have a cluster with two nodes. Can I avoid split brain if I always send create/update/delete requests to one of this nodes ? (I know there are other solutions) --- ## [My cluster always yellow](https://discuss.elastic.co/t/my-cluster-always-yellow/118551)
**Author:** [@sekaiga](https://discuss.elastic.co/u/sekaiga)\ **Replies:** 11\ **Last updated:** [February 8, 2018, 8:42am UTC](https://discuss.elastic.co/t/my-cluster-always-yellow/118551 "2018-02-08T08:42:06Z")
hi, version: 5.1.1 my cluster always yellow, a lot of unassinged shards. logs show lot of "master left" \[2018-02-06T05:16:04,873\]\[WARN \]\[o.e.i.c.IndicesClusterStateService\] \[node-15\] \[\[xxx\_log\_201802\]\[150\]\] marking an… --- ## [No services were found](https://discuss.elastic.co/t/no-services-were-found/158722)
**Author:** [@b0rr3g0](https://discuss.elastic.co/u/b0rr3g0)\ **Replies:** 12\ **Last updated:** [December 4, 2018, 2:46pm UTC](https://discuss.elastic.co/t/no-services-were-found/158722 "2018-12-04T14:46:26Z")
Hi there, Im trying to set up a full APM e2e scenario with the following stack: ELK 6.5.1 APM 6.5.1 APM Agent for Java: 1.1.0 Microservices: Spring Boot 2.1 My set up for each of the microservices is: java -javaag… --- ## [How does indexing performance vary over increase in number of nodes?](https://discuss.elastic.co/t/how-does-indexing-performance-vary-over-increase-in-number-of-nodes/56246)
**Author:** [@sw.jung](https://discuss.elastic.co/u/sw.jung)\ **Replies:** 9\ **Last updated:** [July 25, 2016, 12:28pm UTC](https://discuss.elastic.co/t/how-does-indexing-performance-vary-over-increase-in-number-of-nodes/56246 "2016-07-25T12:28:50Z")
How does indexing performance vary over increase in number of nodes? I plan to add more nodes for performance issue. I have read from a guide that it is effective for searching, but I wasn't sure with indexing. Does it… --- ## [Kibana monitoring gaps when data node is replaced](https://discuss.elastic.co/t/kibana-monitoring-gaps-when-data-node-is-replaced/211432)
**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\ **Replies:** 16\ **Last updated:** [January 2, 2020, 6:04pm UTC](https://discuss.elastic.co/t/kibana-monitoring-gaps-when-data-node-is-replaced/211432 "2020-01-02T18:04:09Z")
Hi, I am using ES 7.2.0 on AWS spot instances. Cluster is comprised of 5 Master nodes, 8 Data nodes and 2 Coordinators. I noticed that whenever a data node is replaced (due to spot replacement), there are monitoring g… --- ## [Grok timestamp](https://discuss.elastic.co/t/grok-timestamp/72995)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 14\ **Last updated:** [January 27, 2017, 11:07am UTC](https://discuss.elastic.co/t/grok-timestamp/72995 "2017-01-27T11:07:04Z")
20170118154716225 plz what is its format in grok ? --- ## [How to drop multiple message names using filebeat](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551)
**Author:** [@balamelangi](https://discuss.elastic.co/u/balamelangi)\ **Replies:** 9\ **Last updated:** [January 24, 2019, 12:06pm UTC](https://discuss.elastic.co/t/how-to-drop-multiple-message-names-using-filebeat/165551 "2019-01-24T12:06:18Z")
Hi, Please some one help me how to drop lines using filebeat. My code is, processors: - drop\_event: when: contains: message: \["AbstractLoggingWriter", "WARN"\] and processors: - drop… --- ## [geoDistanceSort(String, GeoPoint\[\]) is ambiguous for the type SortBuilders](https://discuss.elastic.co/t/geodistancesort-string-geopoint-is-ambiguous-for-the-type-sortbuilders/116594)
**Author:** [@javag](https://discuss.elastic.co/u/javag)\ **Replies:** 23\ **Last updated:** [January 24, 2018, 11:25am UTC](https://discuss.elastic.co/t/geodistancesort-string-geopoint-is-ambiguous-for-the-type-sortbuilders/116594 "2018-01-24T11:25:26Z")
In Elastic Search 6.1.0, facing this error,"The method geoDistanceSort(String, GeoPoint\[\]) is ambiguous for the type SortBuilders" SortBuilders.geoDistanceSort("location") .point(lati… --- ## [How to install and setup x-pack on two node with one cluster?](https://discuss.elastic.co/t/how-to-install-and-setup-x-pack-on-two-node-with-one-cluster/125116)
**Author:** [@Karthik\_Saravanan](https://discuss.elastic.co/u/Karthik_Saravanan)\ **Replies:** 13\ **Last updated:** [March 23, 2018, 9:23pm UTC](https://discuss.elastic.co/t/how-to-install-and-setup-x-pack-on-two-node-with-one-cluster/125116 "2018-03-23T21:23:48Z")
I have configured one cluster with two nodes, one is master node and another one is a data node. Now, have to install and configure xpack on these nodes, Master Node: cluster.name: ELK\_master node.name: node-master n… --- ## [IFrame Communicator Plugin - now available](https://discuss.elastic.co/t/iframe-communicator-plugin-now-available/44550)
**Author:** [@bondib1](https://discuss.elastic.co/u/bondib1)\ **Replies:** 11\ **Last updated:** [March 2, 2017, 1:43am UTC](https://discuss.elastic.co/t/iframe-communicator-plugin-now-available/44550 "2017-03-02T01:43:30Z")
Hi everyone. We created an IFrame communicator plugin which enables you controlling an embedded (in an iframe) Kibana dashboard. (instead of reloading the whole page when you require a change) The plugin demonstrates how… --- ## [Addressing Filebeat's memory leak and performance issues with high log volume](https://discuss.elastic.co/t/addressing-filebeats-memory-leak-and-performance-issues-with-high-log-volume/354929)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 12\ **Last updated:** [April 23, 2024, 1:08pm UTC](https://discuss.elastic.co/t/addressing-filebeats-memory-leak-and-performance-issues-with-high-log-volume/354929 "2024-04-23T13:08:59Z")
Hello, Recently, we've encountered significant challenges with Filebeat's memory usage and performance, specifically after integrating additional netflow shippers. This led to Filebeat running out of memory just minutes… --- ## [Fleet Agent: Logstash output: Invalid version of beats protocol](https://discuss.elastic.co/t/fleet-agent-logstash-output-invalid-version-of-beats-protocol/314624)
**Author:** [@Gustavo\_Llermaly](https://discuss.elastic.co/u/Gustavo_Llermaly)\ **Replies:** 11\ **Last updated:** [September 19, 2022, 2:32pm UTC](https://discuss.elastic.co/t/fleet-agent-logstash-output-invalid-version-of-beats-protocol/314624 "2022-09-19T14:32:19Z")
This is my Logstash config input { elastic\_agent { port =\> 5044 ssl =\> false } } filter { mutate { add\_field =\> { "foo" =\> "bar gustavito" } } } output { elasticsear… --- ## [org.elasticsearch.ElasticsearchException$1: Fielddata is disabled on text fields by default](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-1-fielddata-is-disabled-on-text-fields-by-default/179313)
**Author:** [@manue](https://discuss.elastic.co/u/manue)\ **Replies:** 11\ **Last updated:** [May 2, 2019, 3:21pm UTC](https://discuss.elastic.co/t/org-elasticsearch-elasticsearchexception-1-fielddata-is-disabled-on-text-fields-by-default/179313 "2019-05-02T15:21:14Z")
Could you help me to solver this error?: \[2019-05-02T10:35:37,497\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[K-elM\_U\] \[magento2\_product\_1\_v52\]\[3\], node\[K-elM\_UTTXCBvlkUTFuglg\], \[P\], s\[STARTED\], a\[id=hUhVYORgQ2GI24nBt3FqDw… --- ## [Metricbeat 7.9.2 service doesn't start on windows 2019, but fine on linux](https://discuss.elastic.co/t/metricbeat-7-9-2-service-doesnt-start-on-windows-2019-but-fine-on-linux/253054)
**Author:** [@jmacnett](https://discuss.elastic.co/u/jmacnett)\ **Replies:** 18\ **Last updated:** [November 18, 2020, 5:14pm UTC](https://discuss.elastic.co/t/metricbeat-7-9-2-service-doesnt-start-on-windows-2019-but-fine-on-linux/253054 "2020-11-18T17:14:18Z")
Attempting a new setup of Metricbeat on a fresh windows 2019 server, and getting error 1067 ("The process terminated unsuccessfully) from services.msc. Powershell startup is essentially the same result. Setup: The fi… --- ## [Issue in configuring mail server](https://discuss.elastic.co/t/issue-in-configuring-mail-server/28557)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 10\ **Last updated:** [September 4, 2015, 4:47pm UTC](https://discuss.elastic.co/t/issue-in-configuring-mail-server/28557 "2015-09-04T16:47:18Z")
I have configured actions as below: "actions" : { "email\_administrator" : { "email" : { "to" : "my\_mail\_id", "subject" : "Counts of error code is {{ctx.payload.hits.total}}", "body" : "There are… --- ## [Webpage Input Plugin](https://discuss.elastic.co/t/webpage-input-plugin/124399)
**Author:** [@Salma](https://discuss.elastic.co/u/Salma)\ **Replies:** 19\ **Last updated:** [March 17, 2018, 8:19pm UTC](https://discuss.elastic.co/t/webpage-input-plugin/124399 "2018-03-17T20:19:26Z")
Hi, I'm wondering if there is a way to input webpage data into Elasticsearch using Logstash pipeline. I have a webpage that is publicly accessible like website/logs/access.log what input plugin should I use? Thanks, … --- ## [Logstash Bind Issue? (solved](https://discuss.elastic.co/t/logstash-bind-issue-solved/53222)
**Author:** [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Replies:** 13\ **Last updated:** [June 28, 2016, 3:03am UTC](https://discuss.elastic.co/t/logstash-bind-issue-solved/53222 "2016-06-28T03:03:25Z")
Hi, I was wondering if someone has had this issue before? So everything is working on my Ubuntu server 14.04 and the logs are coming in no issue there. But when i need to check something with tail -f /var/log/logstas… --- ## [Querying documents for the past 10 minutes is not working](https://discuss.elastic.co/t/querying-documents-for-the-past-10-minutes-is-not-working/103288)
**Author:** [@cocoonryan](https://discuss.elastic.co/u/cocoonryan)\ **Replies:** 9\ **Last updated:** [October 10, 2017, 11:05am UTC](https://discuss.elastic.co/t/querying-documents-for-the-past-10-minutes-is-not-working/103288 "2017-10-10T11:05:04Z")
i have a query like this to query documents within the past 10 minutes, but it returns documents outside the 10 minutes range. { "\_source": \["timestamp"\], "query": { "range":{ "timestamp":{ "gt": "now-10m" } } } … --- ## [Grok parse failures .. Grok syntax](https://discuss.elastic.co/t/grok-parse-failures-grok-syntax/152083)
**Author:** [@ranganath\_nangineni](https://discuss.elastic.co/u/ranganath_nangineni)\ **Replies:** 21\ **Last updated:** [October 12, 2018, 8:21am UTC](https://discuss.elastic.co/t/grok-parse-failures-grok-syntax/152083 "2018-10-12T08:21:44Z")
Hi, I have matching records for the below grok pattern \[%{TIMESTAMP\_ISO8601:timestamp}\] %{HTTPDUSER:EVENTUSER} %{WORD:EVENT} \[%{NUMBER:ID}:%{GREEDYDATA:STATE}\] %{GREEDYDATA:project} %{HTTPDUSER:USER}/ %{HTTPDUSER:abort… --- ## [Exact matches with match query on analyzed field not showing on top result](https://discuss.elastic.co/t/exact-matches-with-match-query-on-analyzed-field-not-showing-on-top-result/87399)
**Author:** [@shashankgutha](https://discuss.elastic.co/u/shashankgutha)\ **Replies:** 11\ **Last updated:** [May 29, 2017, 1:09pm UTC](https://discuss.elastic.co/t/exact-matches-with-match-query-on-analyzed-field-not-showing-on-top-result/87399 "2017-05-29T13:09:47Z")
I have a data set like below "hits": \[ { "\_index": "demotest", "\_type": "demotest", "\_id": "2", "\_score": 1, "\_source": { "name": "Duv… --- ## [Heap usage vs number of shards](https://discuss.elastic.co/t/heap-usage-vs-number-of-shards/104646)
**Author:** [@vahissan](https://discuss.elastic.co/u/vahissan)\ **Replies:** 12\ **Last updated:** [October 22, 2017, 8:16am UTC](https://discuss.elastic.co/t/heap-usage-vs-number-of-shards/104646 "2017-10-22T08:16:07Z")
We have a 3 node cluster with 128GB RAM in each node. Heap allocated for each node is 31GB. Our expected monthly record count is 8 billion per month. So we have created daily indices to hold data up to 2 years. Now, afte… --- ## [Logstash/grok patterns with ECS](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871)
**Author:** [@prophoto](https://discuss.elastic.co/u/prophoto)\ **Replies:** 11\ **Last updated:** [November 10, 2020, 6:33pm UTC](https://discuss.elastic.co/t/logstash-grok-patterns-with-ecs/197871 "2020-11-10T18:33:10Z")
For a couple weeks I've been attempting to migrate my logs to ECS. I have a running ELK 6.x cluster and it works fine, but my new cluster I want to see if I can get ECS running. I am starting from scratch so old logs don… --- ## [XML import](https://discuss.elastic.co/t/xml-import/154273)
**Author:** [@mrncgirc](https://discuss.elastic.co/u/mrncgirc)\ **Replies:** 9\ **Last updated:** [October 29, 2018, 6:04pm UTC](https://discuss.elastic.co/t/xml-import/154273 "2018-10-29T18:04:18Z")
XML Import with Logstash Hi there I have read about all XML filter import examples I can find. However, I just cannot figure out how to get this specific xml format imported through logstash. Use case The government of… --- ## [Kibana (7.11.1) isn't showing logs](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399)
**Author:** [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\ **Replies:** 13\ **Last updated:** [March 31, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399 "2021-03-31T15:11:44Z")
Hi, I have an index, that is containing log data, but the data can't be seen under Observability -\> Logs. I have also created an index pattern and choose a time field. I adjusted the settings of Observability -\> Logs t… --- ## [All Packetbeat dashboards version 7.15.0 don't work: Invalid JSON in search source](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824)
**Author:** [@hermanator](https://discuss.elastic.co/u/hermanator)\ **Replies:** 14\ **Last updated:** [October 18, 2021, 11:15pm UTC](https://discuss.elastic.co/t/all-packetbeat-dashboards-version-7-15-0-dont-work-invalid-json-in-search-source/285824 "2021-10-18T23:15:02Z")
Hello, I can't get the dashboards for packetbeat to work. The list with packetbeat dashboards are visible in Kibana, but after clicking any of them I get the error: Invalid JSON in search source. I've setup packetbeat… --- ## [Logstash jdbc input plugin schedule doesn't work](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-schedule-doesnt-work/189404)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 9\ **Last updated:** [July 11, 2019, 7:04am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-schedule-doesnt-work/189404 "2019-07-11T07:04:02Z")
Hi everyone, I am trying to run my input plugin at a specific time for example 11:30 AM, but the schedule doesn't work. It passes the time, but doesn't output any logs in the command line. Any idea what is the issue? An… --- ## [Offline indexing with multiple shards](https://discuss.elastic.co/t/offline-indexing-with-multiple-shards/41271)
**Author:** [@Johannes\_Zillmann](https://discuss.elastic.co/u/Johannes_Zillmann)\ **Replies:** 15\ **Last updated:** [February 18, 2016, 11:11am UTC](https://discuss.elastic.co/t/offline-indexing-with-multiple-shards/41271 "2016-02-18T11:11:50Z")
I have a question. Is the following possible ? create multiple indices with multiple ES single node instances for each index create a snapshot put all snapshots in one folder and restore them in a ES cluster as a sin… --- ## [SSLHandshakeException while using webhook action in watcher](https://discuss.elastic.co/t/sslhandshakeexception-while-using-webhook-action-in-watcher/94906)
**Author:** [@biswars](https://discuss.elastic.co/u/biswars)\ **Replies:** 13\ **Last updated:** [August 29, 2017, 6:26am UTC](https://discuss.elastic.co/t/sslhandshakeexception-while-using-webhook-action-in-watcher/94906 "2017-08-29T06:26:18Z")
Version: 5.4.2 I do have the CA cert used in the target host in the webhook action url and it is tested using curl --cacert option and works well. Followed the followings However, I still get "SSLHandshakeException\[… --- ## [Char\_filter for German](https://discuss.elastic.co/t/char-filter-for-german/20806)
**Author:** [@Kresimir\_Slugan](https://discuss.elastic.co/u/Kresimir_Slugan)\ **Replies:** 18\ **Last updated:** [March 12, 2015, 3:25pm UTC](https://discuss.elastic.co/t/char-filter-for-german/20806 "2015-03-12T15:25:13Z")
Hi, To handle German language in search I have to be able to provide same results if user searches for e.g über, uber or ueber I would do this at the index time where I would have über in the data. But if I u… --- ## [Netflow Codec : UDP receive errors](https://discuss.elastic.co/t/netflow-codec-udp-receive-errors/127111)
**Author:** [@Julzor](https://discuss.elastic.co/u/Julzor)\ **Replies:** 11\ **Last updated:** [April 13, 2018, 8:43am UTC](https://discuss.elastic.co/t/netflow-codec-udp-receive-errors/127111 "2018-04-13T08:43:50Z")
Hi, I have installed LogStash with the Netflow module to catch my flows and output them in ES and it works great, i can see my stats in Kibana without problems. I have between 5k and 12k flows/sec depending of the time… --- ## [What levers are present to control memory usage in Elastic Search?](https://discuss.elastic.co/t/what-levers-are-present-to-control-memory-usage-in-elastic-search/109494)
**Author:** [@antonpious](https://discuss.elastic.co/u/antonpious)\ **Replies:** 11\ **Last updated:** [December 6, 2017, 1:06am UTC](https://discuss.elastic.co/t/what-levers-are-present-to-control-memory-usage-in-elastic-search/109494 "2017-12-06T01:06:15Z")
Since elastic search is a search engine, the amount of memory given to it would be less than the total data that is stored in search engine. Is this assumption valid? If we have 100 GB of Data can elastic be configured… --- ## [Any experience with ES and Data Compressing Filesystems?](https://discuss.elastic.co/t/any-experience-with-es-and-data-compressing-filesystems/18695)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 11\ **Last updated:** [August 4, 2014, 12:56pm UTC](https://discuss.elastic.co/t/any-experience-with-es-and-data-compressing-filesystems/18695 "2014-08-04T12:56:44Z")
Hey Guys, to save a lot of hard disk space, we are going to use an compression file system, which allows us transparent compression for the es-indices. (It seems like es-indices are very good compressable, got up … --- ## [Filebeat unable to connect logstash server](https://discuss.elastic.co/t/filebeat-unable-to-connect-logstash-server/285137)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 23\ **Last updated:** [September 26, 2021, 12:43pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-logstash-server/285137 "2021-09-26T12:43:42Z")
Hi Team, I have installed filebeat on a server which is having IP as 192.168.x.x and filebeat is trying to send events to two logstash servers which are having IPs as 10.20.x.x. Currently i see filebeat service is fai… [Previous page](https://discuss.elastic.co/top.md?page=79&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=81&per_page=50&period=all)