# Top

**URL:** https://discuss.elastic.co/top.md?page=854&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 855

---

## [Too Many Files Open - Failed to accept a connection](https://discuss.elastic.co/t/too-many-files-open-failed-to-accept-a-connection/38020)

<div class="topic-metadata">

**Author:** [@binurajps](https://discuss.elastic.co/u/binurajps)\
**Replies:** 1\
**Last updated:** [December 28, 2015, 8:27am UTC](https://discuss.elastic.co/t/too-many-files-open-failed-to-accept-a-connection/38020 "2015-12-28T08:27:31Z")

</div>

Hello Team, I am getting following exception while starting elastic search. In my elastic search configuration elasticsearch.yml is as follows. bootstrap.mlockall: true \[2015-12-28 15:09:31,323\]\[WARN \]\[netty.chan…

---

## [Elastic search match query over array object](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786)

<div class="topic-metadata">

**Author:** [@aninda\_halder](https://discuss.elastic.co/u/aninda_halder)\
**Replies:** 2\
**Last updated:** [October 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/elastic-search-match-query-over-array-object/250786 "2020-10-14T10:23:53Z")

</div>

Suppose i've 3 doc doc\_1 = { "citedIn": \[ "Bar Councils Act, 1926 - Section 15", "Contract Act, 1872 - Section 23" \] } doc\_2 = { "citedIn":\[ "15 C. B 400", "Contract Act, 18…

---

## [UNable to install logstash on windows 10](https://discuss.elastic.co/t/unable-to-install-logstash-on-windows-10/107306)

<div class="topic-metadata">

**Author:** [@Korrapati\_Lokesh\_Kum](https://discuss.elastic.co/u/Korrapati_Lokesh_Kum)\
**Replies:** 2\
**Last updated:** [November 21, 2017, 4:22pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-on-windows-10/107306 "2017-11-21T16:22:34Z")

</div>

I have tried creating a config file and I get an error cant find java1.5 or higher. java 8 is installed in my laptop \[image\]

---

## [Smart date analyzer](https://discuss.elastic.co/t/smart-date-analyzer/48272)

<div class="topic-metadata">

**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\
**Replies:** 2\
**Last updated:** [April 25, 2016, 1:26pm UTC](https://discuss.elastic.co/t/smart-date-analyzer/48272 "2016-04-25T13:26:28Z")

</div>

Is there an exiting analyzer for smart date analysis. For example, if the document contains the date like " 06.25.2008" or "06/25/2008", I can fetch the doc even searching for "June 25 2008". Or vice versa, the doc cont…

---

## [Suggested method to extract data in bulk](https://discuss.elastic.co/t/suggested-method-to-extract-data-in-bulk/352099)

<div class="topic-metadata">

**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\
**Replies:** 3\
**Last updated:** [January 31, 2024, 2:23pm UTC](https://discuss.elastic.co/t/suggested-method-to-extract-data-in-bulk/352099 "2024-01-31T14:23:57Z")

</div>

Hi all, I am trying to execute a full extract of the Elasticsearch data on intervals or in a monthly based (depending on what creates less load), push it to a file and then load it to another system (Hive) for analytics…

---

## [Dynamic index name not working with Filebeat](https://discuss.elastic.co/t/dynamic-index-name-not-working-with-filebeat/251284)

<div class="topic-metadata">

**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\
**Replies:** 3\
**Last updated:** [October 14, 2020, 4:45pm UTC](https://discuss.elastic.co/t/dynamic-index-name-not-working-with-filebeat/251284 "2020-10-14T16:45:03Z")

</div>

Hi guys! I am not being able to get Filebeat to write documents to indices based on a field. This is my configuration: filebeat.inputs: - type: log # Change to true to enable this input configuration. enabled: tr…

---

## [Visualize Prometheus Metrics From Metricbeats](https://discuss.elastic.co/t/visualize-prometheus-metrics-from-metricbeats/246893)

<div class="topic-metadata">

**Author:** [@Karl\_Falconer](https://discuss.elastic.co/u/Karl_Falconer)\
**Replies:** 3\
**Last updated:** [August 31, 2020, 1:16pm UTC](https://discuss.elastic.co/t/visualize-prometheus-metrics-from-metricbeats/246893 "2020-08-31T13:16:29Z")

</div>

Hi, We are evaluating migrating from Grafana to Kibana, we have metricbeats sending prometheus data to be Elastic to be indexed. I am having trouble creating a visualization on a pre-aggregated count field. Below is a d…

---

## [Where I find my Kibana dashboard source code](https://discuss.elastic.co/t/where-i-find-my-kibana-dashboard-source-code/140149)

<div class="topic-metadata">

**Author:** [@asallemi](https://discuss.elastic.co/u/asallemi)\
**Replies:** 3\
**Last updated:** [July 16, 2018, 2:02pm UTC](https://discuss.elastic.co/t/where-i-find-my-kibana-dashboard-source-code/140149 "2018-07-16T14:02:51Z")

</div>

Hi, I created a new Dashboard and I'd like to consult the source code. Where can I find it ? Best regards, Akrem.

---

## [Metric aggregations on custom fields that use flattened field type](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724)

<div class="topic-metadata">

**Author:** [@amkoehler](https://discuss.elastic.co/u/amkoehler)\
**Replies:** 5\
**Last updated:** [March 30, 2022, 2:52pm UTC](https://discuss.elastic.co/t/metric-aggregations-on-custom-fields-that-use-flattened-field-type/300724 "2022-03-30T14:52:32Z")

</div>

Hello, I am looking for a way to index our documents in such a way that gives me the ability to run metric aggregations on custom number fields. Here's an example data structure we are indexing: { name: 'My Element',…

---

## [Not able to start elastic Service](https://discuss.elastic.co/t/not-able-to-start-elastic-service/263347)

<div class="topic-metadata">

**Author:** [@pnrao.83](https://discuss.elastic.co/u/pnrao.83)\
**Replies:** 5\
**Last updated:** [February 8, 2021, 2:40pm UTC](https://discuss.elastic.co/t/not-able-to-start-elastic-service/263347 "2021-02-08T14:40:35Z")

</div>

Hi Team, i am trying to configure and use elastic search and Kibana. But i was stuck at starting the elastic service in my Oracle Linux Machine. Please find the below logs and yaml file and help: cat /var/log/elasticse…

---

## [Input PDF in logstash](https://discuss.elastic.co/t/input-pdf-in-logstash/217722)

<div class="topic-metadata">

**Author:** [@Vivek\_Srivastava](https://discuss.elastic.co/u/Vivek_Srivastava)\
**Replies:** 5\
**Last updated:** [February 12, 2020, 12:56pm UTC](https://discuss.elastic.co/t/input-pdf-in-logstash/217722 "2020-02-12T12:56:19Z")

</div>

Unable to input PDF in logstash. \[2020-02-03T23:38:35,068\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>#\<LogStash::Error: Don't know how to handle Java::JavaLang::IllegalStateException for P…

---

## [How to use URL decode on JSON Input?](https://discuss.elastic.co/t/how-to-use-url-decode-on-json-input/106626)

<div class="topic-metadata">

**Author:** [@keyolk](https://discuss.elastic.co/u/keyolk)\
**Replies:** 5\
**Last updated:** [November 9, 2017, 8:38pm UTC](https://discuss.elastic.co/t/how-to-use-url-decode-on-json-input/106626 "2017-11-09T20:38:33Z")

</div>

Hello, I don't know well at kibana yet. : ( I have filed which has UTF-8 urlencoded string. Is there a simple way to decode it on JSON Input from Kibana ? I have found painless script reference but didnt find proper …

---

## [Logstash mutate not working](https://discuss.elastic.co/t/logstash-mutate-not-working/47250)

<div class="topic-metadata">

**Author:** [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\
**Replies:** 5\
**Last updated:** [April 15, 2016, 9:11am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250 "2016-04-15T09:11:24Z")

</div>

Below are my 2 config file but when i add mutet it stops working ----------config 1 input { tcp { 'port' =\> '9563' } } filter { json { source =\> 'message' } mutate { …

---

## [Problem with Dis Max Query](https://discuss.elastic.co/t/problem-with-dis-max-query/41572)

<div class="topic-metadata">

**Author:** [@FisherKing](https://discuss.elastic.co/u/FisherKing)\
**Replies:** 5\
**Last updated:** [February 14, 2016, 5:10pm UTC](https://discuss.elastic.co/t/problem-with-dis-max-query/41572 "2016-02-14T17:10:12Z")

</div>

I have this documents: { "firstfield" : "House" } { "firstfield" : "Red House" "secondfield" : "Blue House" } I want to query every field of a document. Only the field with the maximum score should set …

---

## [Not able to create index pattern in kibana 6.8.1](https://discuss.elastic.co/t/not-able-to-create-index-pattern-in-kibana-6-8-1/188087)

<div class="topic-metadata">

**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Replies:** 6\
**Last updated:** [July 18, 2019, 10:19am UTC](https://discuss.elastic.co/t/not-able-to-create-index-pattern-in-kibana-6-8-1/188087 "2019-07-18T10:19:07Z")

</div>

HI, i have installed ELK STACK and i am trying to create an index pattern in kibana but its not creating ? can someone one please tell me what wrong i have done ? and help me solve it . that loading is running for h…

---

## [Alerting on documents with 2 conditions](https://discuss.elastic.co/t/alerting-on-documents-with-2-conditions/162249)

<div class="topic-metadata">

**Author:** [@Chris\_Meyer](https://discuss.elastic.co/u/Chris_Meyer)\
**Replies:** 6\
**Last updated:** [December 28, 2018, 3:16pm UTC](https://discuss.elastic.co/t/alerting-on-documents-with-2-conditions/162249 "2018-12-28T15:16:00Z")

</div>

Hello, I'm trying to build an alert that matches 2 fields - an event\_id and a keyword. I need to trigger an action (which is working) if there are 4 counts in 5 minutes of: event\_id = 4776 AND keyword = "Audit Failur…

---

## [Snapshot Duration / Curator / Index Selection](https://discuss.elastic.co/t/snapshot-duration-curator-index-selection/21040)

<div class="topic-metadata">

**Author:** [@mhughes](https://discuss.elastic.co/u/mhughes)\
**Replies:** 6\
**Last updated:** [December 3, 2014, 5:22pm UTC](https://discuss.elastic.co/t/snapshot-duration-curator-index-selection/21040 "2014-12-03T17:22:27Z")

</div>

As noted here -- https://groups.google.com/forum/#!searchin/elasticsearch/snapshot$20duration/elasticsearch/bCKenCVFf2o/TFK-Es0wxSwJ -- the time it takes to perform a snapshot increases the more snapshots you take.…

---

## [Problem to cretae token for kibana interface](https://discuss.elastic.co/t/problem-to-cretae-token-for-kibana-interface/304829)

<div class="topic-metadata">

**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\
**Replies:** 7\
**Last updated:** [May 26, 2022, 12:54pm UTC](https://discuss.elastic.co/t/problem-to-cretae-token-for-kibana-interface/304829 "2022-05-26T12:54:24Z")

</div>

elastic@elastic:/usr/share/Elasticsearch/bin$ sudo ./Elasticsearch-create-enrollment-token -s kibana \`Preformatted text\`:1415) ~\[?:?\] at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450) …

---

## [Getting xpack missing authentication token error after uninstalling xpack](https://discuss.elastic.co/t/getting-xpack-missing-authentication-token-error-after-uninstalling-xpack/207582)

<div class="topic-metadata">

**Author:** [@lschmid](https://discuss.elastic.co/u/lschmid)\
**Replies:** 7\
**Last updated:** [November 25, 2019, 5:49pm UTC](https://discuss.elastic.co/t/getting-xpack-missing-authentication-token-error-after-uninstalling-xpack/207582 "2019-11-25T17:49:42Z")

</div>

Hello, I understand that with xpack installed you need to pass credentials along with a request. In this case, I have uninstalled xpack on all nodes in the cluster and restarted the cluster. On cluster restart, the sta…

---

## [Getting latest record of each day](https://discuss.elastic.co/t/getting-latest-record-of-each-day/129449)

<div class="topic-metadata">

**Author:** [@veerabhadraiah](https://discuss.elastic.co/u/veerabhadraiah)\
**Replies:** 1\
**Last updated:** [May 9, 2018, 1:02pm UTC](https://discuss.elastic.co/t/getting-latest-record-of-each-day/129449 "2018-05-09T13:02:37Z")

</div>

Hi , In mysql i had query like select id, eventIdx, sitename,machine, nid, nocstatus, reportDate,priority from (select id, eventIdx, sitename,machine, nid, nocstatus, reportDate,priority from event.tempGraphSummary whe…

---

## [Slowing Down File Ingest](https://discuss.elastic.co/t/slowing-down-file-ingest/122978)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 7\
**Last updated:** [March 9, 2018, 12:50am UTC](https://discuss.elastic.co/t/slowing-down-file-ingest/122978 "2018-03-09T00:50:31Z")

</div>

Is there a way to slow down the rate at which the file input ingests data from a file before delivering it to the filter. The problem I have is the file input using multiline codec is feeding data to my XML filter faste…

---

## [Specifying default custom analyzer](https://discuss.elastic.co/t/specifying-default-custom-analyzer/97587)

<div class="topic-metadata">

**Author:** [@gchen](https://discuss.elastic.co/u/gchen)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 2:58pm UTC](https://discuss.elastic.co/t/specifying-default-custom-analyzer/97587 "2017-08-22T14:58:11Z")

</div>

Hi, I’m working on upgrading out cluster to newer ES version. one of the template mapping that used to work on the old version doesn’t work on the newer version. I checked the document, there no mention that this beha…

---

## [Disabling Hostname Verification on Elasticsearch 7.16 Outbound Connections](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816)

<div class="topic-metadata">

**Author:** [@icey7z](https://discuss.elastic.co/u/icey7z)\
**Replies:** 4\
**Last updated:** [April 12, 2023, 8:01pm UTC](https://discuss.elastic.co/t/disabling-hostname-verification-on-elasticsearch-7-16-outbound-connections/329816 "2023-04-12T20:01:16Z")

</div>

I'm trying to do a remote reindexing from a 5.3 cluster to a 7.16 cluster, and need a way to disable hostname verification when communicating between them. The 5.3 cluster's certificate doesn't match the hostname, and I…

---

## [\[Solved\] Filebeat 7.0.1 has no data on \[Filebeat System\] Syslog dashboard ECS](https://discuss.elastic.co/t/solved-filebeat-7-0-1-has-no-data-on-filebeat-system-syslog-dashboard-ecs/182575)

<div class="topic-metadata">

**Author:** [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Replies:** 2\
**Last updated:** [May 30, 2019, 5:04pm UTC](https://discuss.elastic.co/t/solved-filebeat-7-0-1-has-no-data-on-filebeat-system-syslog-dashboard-ecs/182575 "2019-05-30T17:04:41Z")

</div>

Hello team, I have an ELK stack running on 7.0.1 and i have trouble displaying data on the \[Filebeat System\] Syslog dashboard ECS but i can see logs on the discover panel. I have configured a linuxclient to send system…

---

## [Not able to plot geo data on Kibana](https://discuss.elastic.co/t/not-able-to-plot-geo-data-on-kibana/248726)

<div class="topic-metadata">

**Author:** [@vpurushottam](https://discuss.elastic.co/u/vpurushottam)\
**Replies:** 3\
**Last updated:** [September 16, 2020, 6:41pm UTC](https://discuss.elastic.co/t/not-able-to-plot-geo-data-on-kibana/248726 "2020-09-16T18:41:34Z")

</div>

Hi Guys, So I have an issue with displaying the geolocation data on Kibana map visualization. Sorry if my description becomes too long but I will try to provide as much information as possible. Past: I am using logsta…

---

## [How to do such select in Kibana (or ES)?](https://discuss.elastic.co/t/how-to-do-such-select-in-kibana-or-es/161870)

<div class="topic-metadata">

**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\
**Replies:** 3\
**Last updated:** [December 24, 2018, 12:27am UTC](https://discuss.elastic.co/t/how-to-do-such-select-in-kibana-or-es/161870 "2018-12-24T00:27:33Z")

</div>

I'd like to select all companies that are new in 2018 (were not selling in 2017). In SQL I would to following: SELECT \* FROM table WHERE order\_date BETWEEN '2018-01-01' AND '2018-12-31' AND company NOT IN (SELECT compa…

---

## [Parsing Json File with Logstash and Filebeat](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925)

<div class="topic-metadata">

**Author:** [@Mufashid](https://discuss.elastic.co/u/Mufashid)\
**Replies:** 3\
**Last updated:** [September 11, 2017, 12:04pm UTC](https://discuss.elastic.co/t/parsing-json-file-with-logstash-and-filebeat/99925 "2017-09-11T12:04:56Z")

</div>

Hi I am new to ES. I was trying to parse json file with logstash but I am getting error like below. Please help me to solve this issue Error \<LogStash::Json::ParserError: Unexpected end-of-input: expected close marke…

---

## [Delete errors](https://discuss.elastic.co/t/delete-errors/60106)

<div class="topic-metadata">

**Author:** [@Jeff\_Bolle](https://discuss.elastic.co/u/Jeff_Bolle)\
**Replies:** 3\
**Last updated:** [September 9, 2016, 2:16pm UTC](https://discuss.elastic.co/t/delete-errors/60106 "2016-09-09T14:16:04Z")

</div>

I am sure I'm being dense, but the following code using the Java API works...sometimes. However there are cases where it is unable to delete the document. I am then able to use the REST interface to delete the document j…

---

## [Sending Logs to Slack](https://discuss.elastic.co/t/sending-logs-to-slack/41000)

<div class="topic-metadata">

**Author:** [@cotcadaver](https://discuss.elastic.co/u/cotcadaver)\
**Replies:** 3\
**Last updated:** [February 4, 2016, 8:38pm UTC](https://discuss.elastic.co/t/sending-logs-to-slack/41000 "2016-02-04T20:38:27Z")

</div>

Hey guys, I am having trouble understanding why my instance of logstash isn't sending the files to slack. I was hoping a pair of fresh eyes may be able to find my mistakes. I am simply using an Ubuntu server and am wanti…

---

## [An HTTP line is larger than 4096 bytes](https://discuss.elastic.co/t/an-http-line-is-larger-than-4096-bytes/188876)

<div class="topic-metadata">

**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\
**Replies:** 0\
**Last updated:** [July 4, 2019, 9:46am UTC](https://discuss.elastic.co/t/an-http-line-is-larger-than-4096-bytes/188876 "2019-07-04T09:46:19Z")

</div>

hi team, get error while trying to record my data to index with \_bulk api. I make records in my custom endpoint which takes all \_ids of my events. Use elasticsearch 6.7.0 . is there any workaround resolution of this? …

---

## [Filter out Large Messages and Add Tag](https://discuss.elastic.co/t/filter-out-large-messages-and-add-tag/63853)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 2\
**Last updated:** [October 26, 2016, 7:03am UTC](https://discuss.elastic.co/t/filter-out-large-messages-and-add-tag/63853 "2016-10-26T07:03:29Z")

</div>

Hi, We have problems caused by very large log messages. Can someone help me with how to formulate the following filter logic: Drop the message field when it is over "n" bytes Add a tag showing that the message field h…

---

## [Configure Kibana with SSL for shield](https://discuss.elastic.co/t/configure-kibana-with-ssl-for-shield/53613)

<div class="topic-metadata">

**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Replies:** 2\
**Last updated:** [June 22, 2016, 4:45pm UTC](https://discuss.elastic.co/t/configure-kibana-with-ssl-for-shield/53613 "2016-06-22T16:45:50Z")

</div>

According to https://www.elastic.co/guide/en/shield/current/kibana.html, I need to set server.ssl.key: /path/to/your/server.key server.ssl.cert: /path/to/your/server.crt Where could I find the path for the key and …

---

## [S3 Snapshot issues](https://discuss.elastic.co/t/s3-snapshot-issues/232096)

<div class="topic-metadata">

**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Replies:** 6\
**Last updated:** [May 11, 2020, 7:34pm UTC](https://discuss.elastic.co/t/s3-snapshot-issues/232096 "2020-05-11T19:34:06Z")

</div>

I am trying to set up S3 snapshots and i keep getting this error, anyone has any ideas ? "error" : { "root\_cause" : \[ { "type" : "repository\_verification\_exception", "reason" : "\[s3\] path is…

---

## [Filebeat 7.4.1 PODs of k8s daemonset constantly crash](https://discuss.elastic.co/t/filebeat-7-4-1-pods-of-k8s-daemonset-constantly-crash/205649)

<div class="topic-metadata">

**Author:** [@makoch](https://discuss.elastic.co/u/makoch)\
**Replies:** 6\
**Last updated:** [December 3, 2019, 1:08pm UTC](https://discuss.elastic.co/t/filebeat-7-4-1-pods-of-k8s-daemonset-constantly-crash/205649 "2019-12-03T13:08:15Z")

</div>

I'm trying to use filebeat in my k8s cluster to forward logs to a dedicated self-hosted elasticsearch instance. Following the documentation here ( https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubern…

---

## [Synonyms in a query](https://discuss.elastic.co/t/synonyms-in-a-query/16838)

<div class="topic-metadata">

**Author:** [@Alex\_K](https://discuss.elastic.co/u/Alex_K)\
**Replies:** 6\
**Last updated:** [April 8, 2014, 11:02am UTC](https://discuss.elastic.co/t/synonyms-in-a-query/16838 "2014-04-08T11:02:21Z")

</div>

Hello there, i have a query, example is this: { "query": { "bool": { "should": \[ { "multi\_match": { "query": "foo", …

---

## [Elasticsearch License Expired](https://discuss.elastic.co/t/elasticsearch-license-expired/338546)

<div class="topic-metadata">

**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\
**Replies:** 1\
**Last updated:** [July 17, 2023, 12:11pm UTC](https://discuss.elastic.co/t/elasticsearch-license-expired/338546 "2023-07-17T12:11:17Z")

</div>

Hi What happens when the Elasticsearch license expired? Currently, the cluster has assigned a commercial license and it will expire soon, so what will happen once the assigned date expired?

---

## [Field type conflict](https://discuss.elastic.co/t/field-type-conflict/56686)

<div class="topic-metadata">

**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\
**Replies:** 1\
**Last updated:** [August 3, 2016, 7:13pm UTC](https://discuss.elastic.co/t/field-type-conflict/56686 "2016-08-03T19:13:19Z")

</div>

In my filter I am converting field values for response and response\_time from string to integer and float respectively. In my mapping template I have the following snippet: "mappings": { "\_default\_": { …

---

## [Using document properties in alert index rule](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972)

<div class="topic-metadata">

**Author:** [@tflorac](https://discuss.elastic.co/u/tflorac)\
**Replies:** 3\
**Last updated:** [January 30, 2022, 11:50pm UTC](https://discuss.elastic.co/t/using-document-properties-in-alert-index-rule/292972 "2022-01-30T23:50:40Z")

</div>

Hi, I'm using Elasticsearch and Kibana 7.16.2, and I'm trying to create custom alerts rules. I've created a rule which is using an index action and everything is nearly OK, but my question is: how can I include propert…

---

## [Filebeat/logstash installation and configuration](https://discuss.elastic.co/t/filebeat-logstash-installation-and-configuration/88797)

<div class="topic-metadata">

**Author:** [@richagautam](https://discuss.elastic.co/u/richagautam)\
**Replies:** 3\
**Last updated:** [June 26, 2017, 5:52am UTC](https://discuss.elastic.co/t/filebeat-logstash-installation-and-configuration/88797 "2017-06-26T05:52:19Z")

</div>

Hi, I have to install and configure filebeat and logstash in CentOS7 OS for an assingment. Filebeat will be on one server and logstash will be on another server i.e both will be on different server. I am planning t…

---

## [Type of field changes - Mapping conflict](https://discuss.elastic.co/t/type-of-field-changes-mapping-conflict/79545)

<div class="topic-metadata">

**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\
**Replies:** 3\
**Last updated:** [March 23, 2017, 8:02am UTC](https://discuss.elastic.co/t/type-of-field-changes-mapping-conflict/79545 "2017-03-23T08:02:26Z")

</div>

Hi, I am feeding log data through Logstash through Elasticsearch. Without making any change to the data itself or Logstash Config, I am getting a mapping conflict on a new index I have created yesterday (because of the …

---

## [Upgrade assistant critical errors sollutions](https://discuss.elastic.co/t/upgrade-assistant-critical-errors-sollutions/182228)

<div class="topic-metadata">

**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Replies:** 0\
**Last updated:** [May 22, 2019, 12:45pm UTC](https://discuss.elastic.co/t/upgrade-assistant-critical-errors-sollutions/182228 "2019-05-22T12:45:43Z")

</div>

Hi, I've successfully updated from 6.3.1 to 6.8 so that in the future I can upgrade to the 7.x release. I'm quite happy with the upgrade assistant since this tool shows me what I need to check. Only I quite confused w…

---

## [Translate elasticsearch language analyzer to NEST](https://discuss.elastic.co/t/translate-elasticsearch-language-analyzer-to-nest/86113)

<div class="topic-metadata">

**Author:** [@aslamy](https://discuss.elastic.co/u/aslamy)\
**Replies:** 0\
**Last updated:** [May 17, 2017, 1:40pm UTC](https://discuss.elastic.co/t/translate-elasticsearch-language-analyzer-to-nest/86113 "2017-05-17T13:40:21Z")

</div>

Hi ! Can somebody translate elasticsearch language analyzer to NEST ? { "settings": { "analysis": { "filter": { "swedish\_stop": { "type": "stop", "stopwords": "swedish" …

---

## [Why doesn't elect master node?](https://discuss.elastic.co/t/why-doesnt-elect-master-node/229190)

<div class="topic-metadata">

**Author:** [@hgdo](https://discuss.elastic.co/u/hgdo)\
**Replies:** 8\
**Last updated:** [April 23, 2020, 4:55am UTC](https://discuss.elastic.co/t/why-doesnt-elect-master-node/229190 "2020-04-23T04:55:07Z")

</div>

Hi. I created a Elasticsearch cluster with 2 servers. Elasticsearch Cluster version is 7.6.2. Each server has three master nodes. I am currently doing a failover test. First, if you kill server 1 that has a master n…

---

## [クエリの子の中からの親のデータの参照について](https://discuss.elastic.co/t/topic/152773)

<div class="topic-metadata">

**Author:** [@e5da94b0de01a92c429f](https://discuss.elastic.co/u/e5da94b0de01a92c429f)\
**Replies:** 8\
**Last updated:** [October 22, 2018, 7:29am UTC](https://discuss.elastic.co/t/topic/152773 "2018-10-22T07:29:11Z")

</div>

お世話になります。質問させてください。 has\_childの中で親のデータを参照した計算をしたいと考えています。 has\_childの中からhas\_parentをすると重たくなる印象があります。 多くのフィールドを参照したいのですが、stored fieldはやりすぎない方がいい印象があります。 script fieldなど動的なフィールドをhas\_child内部から参照させるのもできないのかなと感じています。 painles…

---

## [Getting empty value in script field in Kibana 5.2.1](https://discuss.elastic.co/t/getting-empty-value-in-script-field-in-kibana-5-2-1/104306)

<div class="topic-metadata">

**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\
**Replies:** 2\
**Last updated:** [October 20, 2017, 8:30pm UTC](https://discuss.elastic.co/t/getting-empty-value-in-script-field-in-kibana-5-2-1/104306 "2017-10-20T20:30:16Z")

</div>

Hi, I am using Kibana 5.2.1 scripted field. I wrote one painless script as follows but I am not getting the return value on the created script field. Always I am getting empty value in my script field. I am not sure whe…

---

## [Beat compilation for musl libc / Alpine Linux / Docker containers](https://discuss.elastic.co/t/beat-compilation-for-musl-libc-alpine-linux-docker-containers/90838)

<div class="topic-metadata">

**Author:** [@inbx](https://discuss.elastic.co/u/inbx)\
**Replies:** 2\
**Last updated:** [June 27, 2017, 8:50am UTC](https://discuss.elastic.co/t/beat-compilation-for-musl-libc-alpine-linux-docker-containers/90838 "2017-06-27T08:50:12Z")

</div>

It would be great if all beats would be compiled statically to work on musl libc distributions as well. I found (for 5.4.2) that filebeat works nicely on musl libc based distros, metricbeat requires a compatibility layer…

---

## [Elasticsearch Crash on Start up](https://discuss.elastic.co/t/elasticsearch-crash-on-start-up/79614)

<div class="topic-metadata">

**Author:** [@jaliph](https://discuss.elastic.co/u/jaliph)\
**Replies:** 2\
**Last updated:** [March 23, 2017, 7:55am UTC](https://discuss.elastic.co/t/elasticsearch-crash-on-start-up/79614 "2017-03-23T07:55:10Z")

</div>

Hi, This is Production system with around 2.5 TB of Data. Elasticsearch version is 5.0.2. The Server has rebooted somehow and we are still doing an RCA on that. Elasticsearch is not coming up. Please suggest the …

---

## [Cluster State Yellow: 2 shards initializing with multiple failed attempts: IllegalArgumentException \[ReleasableBytesStreamOutput cannot hold more than 2GB of data](https://discuss.elastic.co/t/cluster-state-yellow-2-shards-initializing-with-multiple-failed-attempts-illegalargumentexception-releasablebytesstreamoutput-cannot-hold-more-than-2gb-of-data/334008)

<div class="topic-metadata">

**Author:** [@Sarit\_Ghosh](https://discuss.elastic.co/u/Sarit_Ghosh)\
**Replies:** 5\
**Last updated:** [May 24, 2023, 9:43am UTC](https://discuss.elastic.co/t/cluster-state-yellow-2-shards-initializing-with-multiple-failed-attempts-illegalargumentexception-releasablebytesstreamoutput-cannot-hold-more-than-2gb-of-data/334008 "2023-05-24T09:43:51Z")

</div>

For about a week, we are seeing the following error and cluster state yellow. On checking the \_cluster/state we get this - Elastic Search Version - 7.17 (Please let me know if more data is needed) {"state":"INITIALIZIN…

---

## [Different Doc count after reindexing](https://discuss.elastic.co/t/different-doc-count-after-reindexing/322826)

<div class="topic-metadata">

**Author:** [@cr\_168328](https://discuss.elastic.co/u/cr_168328)\
**Replies:** 5\
**Last updated:** [January 11, 2023, 8:10am UTC](https://discuss.elastic.co/t/different-doc-count-after-reindexing/322826 "2023-01-11T08:10:11Z")

</div>

I have an index user1. To add some fields, I created a new index and did reindexing using the query: POST /\_reindex?scroll=30m { "source": { "index": "user1" }, "dest": { "index": "user2" } } After rei…

---

## [Logstash is restarting automatucally with high CPU usage](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617)

<div class="topic-metadata">

**Author:** [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\
**Replies:** 5\
**Last updated:** [September 8, 2020, 10:39am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617 "2020-09-08T10:39:50Z")

</div>

Hi, i am trying to run logstash using the below command. sudo systemctl start logstash.service From below logs we can see that logstash service is started than it is stopped and restarted again. \[2020-08-27T11:56:24…

[Previous page](https://discuss.elastic.co/top.md?page=853&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=855&per_page=50&period=all)
