# Top

**URL:** https://discuss.elastic.co/top.md?page=882&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 883

---

## [Can ES do a complex aggregation with WHERE and GROUP BY + ORDER BY like in MySQL](https://discuss.elastic.co/t/can-es-do-a-complex-aggregation-with-where-and-group-by-order-by-like-in-mysql/265559)

<div class="topic-metadata">

**Author:** [@Long\_Quanzheng](https://discuss.elastic.co/u/Long_Quanzheng)\
**Replies:** 7\
**Last updated:** [March 2, 2021, 12:45pm UTC](https://discuss.elastic.co/t/can-es-do-a-complex-aggregation-with-where-and-group-by-order-by-like-in-mysql/265559 "2021-03-02T12:45:13Z")

</div>

Hi, I have a query like this in MySQL that I am thinking to migrate to ElasticSearch for scalability: SELELCT userID,sum(countA) as sumA,sum(countB) as sumB FROM data\_table WHERE groupID=? AND date BETWEEN ? AND ?…

---

## [Give user access to just one individual dashboard](https://discuss.elastic.co/t/give-user-access-to-just-one-individual-dashboard/165664)

<div class="topic-metadata">

**Author:** [@riteshun](https://discuss.elastic.co/u/riteshun)\
**Replies:** 1\
**Last updated:** [January 24, 2019, 9:09pm UTC](https://discuss.elastic.co/t/give-user-access-to-just-one-individual-dashboard/165664 "2019-01-24T21:09:19Z")

</div>

Hi, We have a lot of dashboards with some info that we would not want everyone to see. How can we restrict users to view only one or some dashboards and even see other dashboards. I mean the other dashboards should not …

---

## [Logstash error while receiving filebeat messages](https://discuss.elastic.co/t/logstash-error-while-receiving-filebeat-messages/139380)

<div class="topic-metadata">

**Author:** [@brunoof1](https://discuss.elastic.co/u/brunoof1)\
**Replies:** 1\
**Last updated:** [July 10, 2018, 5:20pm UTC](https://discuss.elastic.co/t/logstash-error-while-receiving-filebeat-messages/139380 "2018-07-10T17:20:47Z")

</div>

I have been stashing files from filebeat, Here the file structure: Jul 10 11:50:32 prod-es-ingest1e logstash\[1061\]: "statusResponse" =\> "PROCESSED", Jul 10 11:50:32 prod-es-ingest1e logstash\[1061\]: "of…

---

## [Repository artifacts.elastic.co seems to be down/really slow](https://discuss.elastic.co/t/repository-artifacts-elastic-co-seems-to-be-down-really-slow/139538)

<div class="topic-metadata">

**Author:** [@Patralos](https://discuss.elastic.co/u/Patralos)\
**Replies:** 2\
**Last updated:** [July 11, 2018, 11:03am UTC](https://discuss.elastic.co/t/repository-artifacts-elastic-co-seems-to-be-down-really-slow/139538 "2018-07-11T11:03:55Z")

</div>

Hi, does someone other experience problems downloading from artifactes.elastic.co as well? My downloads start with 100Kbit an fail later, somethimes with 502 gateway timeout, server error.

---

## [How do you create a simple "traffic light" indicator on a Canvas dashboard?](https://discuss.elastic.co/t/how-do-you-create-a-simple-traffic-light-indicator-on-a-canvas-dashboard/205564)

<div class="topic-metadata">

**Author:** [@irwazr](https://discuss.elastic.co/u/irwazr)\
**Replies:** 2\
**Last updated:** [October 29, 2019, 5:06pm UTC](https://discuss.elastic.co/t/how-do-you-create-a-simple-traffic-light-indicator-on-a-canvas-dashboard/205564 "2019-10-29T17:06:55Z")

</div>

Hi all, I'm trying to create a standard traffic-light-style widget in Canvas, but I can't seem to find an element in the collection (we're on 7.2x) that fits this idea. What I want to be able to do is upload an SVG wid…

---

## [Error installing Elasticsearch 7 - Failed dependencies](https://discuss.elastic.co/t/error-installing-elasticsearch-7-failed-dependencies/177551)

<div class="topic-metadata">

**Author:** [@AndyB](https://discuss.elastic.co/u/AndyB)\
**Replies:** 2\
**Last updated:** [April 19, 2019, 7:12pm UTC](https://discuss.elastic.co/t/error-installing-elasticsearch-7-failed-dependencies/177551 "2019-04-19T19:12:43Z")

</div>

On my dedicated server I currently have Elasticsearch 6 installed. I would like to upgrade to Elasticsearch 7. I'm using the "Download and install the RPM Manually" method. Here's the link that explains the steps: https…

---

## [Exclude files to be processed](https://discuss.elastic.co/t/exclude-files-to-be-processed/36093)

<div class="topic-metadata">

**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\
**Replies:** 2\
**Last updated:** [December 1, 2015, 9:45pm UTC](https://discuss.elastic.co/t/exclude-files-to-be-processed/36093 "2015-12-01T21:45:22Z")

</div>

I currently use Logstash to read files in my directory. I use the input from file plugin and use path/to/logs/\*.log then use exclude statements to exclude the logs I don't want transported into my ES cluster. Is ther…

---

## [Why .monitoring-\* indices has large size of data](https://discuss.elastic.co/t/why-monitoring-indices-has-large-size-of-data/278027)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 3\
**Last updated:** [July 25, 2021, 3:26pm UTC](https://discuss.elastic.co/t/why-monitoring-indices-has-large-size-of-data/278027 "2021-07-25T15:26:53Z")

</div>

I have 11 elasticsearch nodes 3 master node 6 data node and 2 coordinate node.We are running latest version of elasticsearch 7.13.2 we have installed metricbeat and configured in all elasticsearch node we are monitorin…

---

## [Winlogbeat high cpu usage](https://discuss.elastic.co/t/winlogbeat-high-cpu-usage/267625)

<div class="topic-metadata">

**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\
**Replies:** 3\
**Last updated:** [March 29, 2021, 9:49am UTC](https://discuss.elastic.co/t/winlogbeat-high-cpu-usage/267625 "2021-03-29T09:49:54Z")

</div>

Hi, I have installed winlogbeat on my windows server. However it is causing high cpu usage. I am also attaching an image of the same. Any help would be appreciated. Thanks

---

## [Install problem](https://discuss.elastic.co/t/install-problem/99370)

<div class="topic-metadata">

**Author:** [@dawyi](https://discuss.elastic.co/u/dawyi)\
**Replies:** 3\
**Last updated:** [September 5, 2017, 8:19am UTC](https://discuss.elastic.co/t/install-problem/99370 "2017-09-05T08:19:39Z")

</div>

hello i am trying to install kibana on my windows 10-64 bit. when i try to open /bin/kibana i get this error : "unable to find usable node.js executable." i tried v 5.5.2 and 5.5.1, .zip and .tar and i had same problem…

---

## [Elastic Search Hadoop Connector - Spark Facing Issues while Saving to ES](https://discuss.elastic.co/t/elastic-search-hadoop-connector-spark-facing-issues-while-saving-to-es/50852)

<div class="topic-metadata">

**Author:** [@krishmah](https://discuss.elastic.co/u/krishmah)\
**Replies:** 3\
**Last updated:** [June 1, 2016, 11:24am UTC](https://discuss.elastic.co/t/elastic-search-hadoop-connector-spark-facing-issues-while-saving-to-es/50852 "2016-06-01T11:24:00Z")

</div>

I am using 5.0.0 alpha 2 version of Elastic Search along with the corresponding ES Hadoop connector. Version of Spark that I am using is 1.6.1. I am running on EMR. Here are the configuration of Nodes on ES: 1 Mast…

---

## [100% CPU on 1 Node with JMeter Tests](https://discuss.elastic.co/t/100-cpu-on-1-node-with-jmeter-tests/18195)

<div class="topic-metadata">

**Author:** [@sairam\_2](https://discuss.elastic.co/u/sairam_2)\
**Replies:** 3\
**Last updated:** [January 11, 2015, 8:54am UTC](https://discuss.elastic.co/t/100-cpu-on-1-node-with-jmeter-tests/18195 "2015-01-11T08:54:04Z")

</div>

One out of 4 nodes always spikes to 100% CPU when we do some load tests using JMeter (50 Threads, 50 Loops) with any query (Match\_All, Filtered Query etc.,). That particular node has 3 Shards with 2 Primary Shards. T…

---

## [Enterprise Search running on a docker container can't connect to Elasticsearch running as a service on windows](https://discuss.elastic.co/t/enterprise-search-running-on-a-docker-container-cant-connect-to-elasticsearch-running-as-a-service-on-windows/334761)

<div class="topic-metadata">

**Author:** [@Mtuni\_Globbal](https://discuss.elastic.co/u/Mtuni_Globbal)\
**Replies:** 6\
**Last updated:** [June 1, 2023, 7:31am UTC](https://discuss.elastic.co/t/enterprise-search-running-on-a-docker-container-cant-connect-to-elasticsearch-running-as-a-service-on-windows/334761 "2023-06-01T07:31:23Z")

</div>

Hi, I'm trying to connect Enterprise Search which I run as a docker container to connect to Elasticsearch and Kibana which are running as Windows service. However, every time I run Enterprise Search it exits, saying that…

---

## [Packetbeat 5.4.0 can't sniff tun device - raw ip datalink](https://discuss.elastic.co/t/packetbeat-5-4-0-cant-sniff-tun-device-raw-ip-datalink/87710)

<div class="topic-metadata">

**Author:** [@Giacomo\_Milani](https://discuss.elastic.co/u/Giacomo_Milani)\
**Replies:** 5\
**Last updated:** [May 31, 2017, 11:28am UTC](https://discuss.elastic.co/t/packetbeat-5-4-0-cant-sniff-tun-device-raw-ip-datalink/87710 "2017-05-31T11:28:30Z")

</div>

VPN softwares like OpenVPN create on linux "tun devices", a network device that represents the network tunnel and presents directly IP frames (without datalink) to the operative system. Tun devices are preferred than TAP…

---

## [Delete snapshot fails due to no space on disk](https://discuss.elastic.co/t/delete-snapshot-fails-due-to-no-space-on-disk/115747)

<div class="topic-metadata">

**Author:** [@Arvind\_Rao](https://discuss.elastic.co/u/Arvind_Rao)\
**Replies:** 1\
**Last updated:** [January 17, 2018, 9:03am UTC](https://discuss.elastic.co/t/delete-snapshot-fails-due-to-no-space-on-disk/115747 "2018-01-17T09:03:52Z")

</div>

We run ES 5.2.2 on a 8 node CentOS cluster. We are using filesystem repository to store snapshots. The disk volume storing the snapshot repository ran out of space and is now at 100% used. We tried running the delete sn…

---

## [Filebeat Doesn't open port 5066](https://discuss.elastic.co/t/filebeat-doesnt-open-port-5066/273042)

<div class="topic-metadata">

**Author:** [@Matteo\_Rainieri](https://discuss.elastic.co/u/Matteo_Rainieri)\
**Replies:** 1\
**Last updated:** [May 14, 2021, 4:32pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-open-port-5066/273042 "2021-05-14T16:32:19Z")

</div>

Hello there. I'm facing a problem i cannot resolve. I' using filebeat for shipping elasticsearch, kibana and logstash logs and i also use metricbeat for monitor them. In filebeat.yml i have "http.enabled: true" to ope…

---

## [Manual inject columns in table view](https://discuss.elastic.co/t/manual-inject-columns-in-table-view/272991)

<div class="topic-metadata">

**Author:** [@debrt](https://discuss.elastic.co/u/debrt)\
**Replies:** 8\
**Last updated:** [May 19, 2021, 2:45pm UTC](https://discuss.elastic.co/t/manual-inject-columns-in-table-view/272991 "2021-05-19T14:45:10Z")

</div>

Dear community I'm using a data table to show the top count of event\_id's found in my Winlogbeat index and I am searching for a way to have a column in the table with the description of the event\_id as specified on the s…

---

## [Attempted to resurrect connection to dead ES instance in secure ELK](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-in-secure-elk/282989)

<div class="topic-metadata">

**Author:** [@kiran80511](https://discuss.elastic.co/u/kiran80511)\
**Replies:** 2\
**Last updated:** [September 2, 2021, 4:56am UTC](https://discuss.elastic.co/t/attempted-to-resurrect-connection-to-dead-es-instance-in-secure-elk/282989 "2021-09-02T04:56:48Z")

</div>

Hi, I am using version 7.14 for elasticsearch, logstash and kibana . In logstash log I got this error: Sep 01 10:43:09 elastic.sys logstash\[2975\]: \[2021-09-01T10:43:09,352\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\]…

---

## [Elasticsearch RPM installation conflicts old Elasticsearch](https://discuss.elastic.co/t/elasticsearch-rpm-installation-conflicts-old-elasticsearch/252419)

<div class="topic-metadata">

**Author:** [@H0bbit](https://discuss.elastic.co/u/H0bbit)\
**Replies:** 2\
**Last updated:** [October 24, 2020, 4:15pm UTC](https://discuss.elastic.co/t/elasticsearch-rpm-installation-conflicts-old-elasticsearch/252419 "2020-10-24T16:15:13Z")

</div>

Hi there, I'm pretty new to Elasticsearch. I have been trying to install it on my Centos 7 server. I have been following a tutorial for installing elasticsearch-oss. Because I was playing with it, I have uninstalled it …

---

## [Problem with logstash-input-file plugin](https://discuss.elastic.co/t/problem-with-logstash-input-file-plugin/141579)

<div class="topic-metadata">

**Author:** [@Pierre2](https://discuss.elastic.co/u/Pierre2)\
**Replies:** 2\
**Last updated:** [July 26, 2018, 6:59am UTC](https://discuss.elastic.co/t/problem-with-logstash-input-file-plugin/141579 "2018-07-26T06:59:56Z")

</div>

Hello ! Since the update of input-file plugin to version 4.1.5 when I start logstash I obtain this error : \[2018-07-25T15:04:51,634\]\[INFO \]\[filewatch.observingtail \] START, creating Disc overer, Watch with file and …

---

## [Timestamp format fails when there's a space in my timestamp field](https://discuss.elastic.co/t/timestamp-format-fails-when-theres-a-space-in-my-timestamp-field/137211)

<div class="topic-metadata">

**Author:** [@Oren\_Cohen](https://discuss.elastic.co/u/Oren_Cohen)\
**Replies:** 2\
**Last updated:** [June 25, 2018, 3:05pm UTC](https://discuss.elastic.co/t/timestamp-format-fails-when-theres-a-space-in-my-timestamp-field/137211 "2018-06-25T15:05:19Z")

</div>

Hey, I've been poking around with the Kibana dev tools and created an index called orglogs and a type called log Here it is: \> POST orglogs/log { "properties": { "\_timestamp": { "type": "object" …

---

## [Is there a way to support different time zone when my email title is “error occurs at {{ctx.trigger.scheduled\_time}}”?](https://discuss.elastic.co/t/is-there-a-way-to-support-different-time-zone-when-my-email-title-is-error-occurs-at-ctx-trigger-scheduled-time/32455)

<div class="topic-metadata">

**Author:** [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\
**Replies:** 2\
**Last updated:** [October 19, 2015, 9:11am UTC](https://discuss.elastic.co/t/is-there-a-way-to-support-different-time-zone-when-my-email-title-is-error-occurs-at-ctx-trigger-scheduled-time/32455 "2015-10-19T09:11:37Z")

</div>

I get: error occurs at 2015-10-19T04:30:00.000Z But our time zone is GMT+8, So it should be 2015-10-19T12:30:00.000Z. Is there a way do it in Email Action?

---

## [Logstash 7.13.1 Windows pipeline.separate\_logs Problem](https://discuss.elastic.co/t/logstash-7-13-1-windows-pipeline-separate-logs-problem/275503)

<div class="topic-metadata">

**Author:** [@KSib](https://discuss.elastic.co/u/KSib)\
**Replies:** 4\
**Last updated:** [June 10, 2021, 3:58am UTC](https://discuss.elastic.co/t/logstash-7-13-1-windows-pipeline-separate-logs-problem/275503 "2021-06-10T03:58:21Z")

</div>

I'm not sure what's going on here. I'm using Logstash 7.13.1 on Windows Server 2019. When I run logstash with the following C:\\Elastic\\logstash\\bin\\logstash.bat -f "C:\\Elastic\\logstash\\redacted-config\\pipeline\\\_temp\\cus…

---

## [Filebeat: Match literal \* or \*\* in messages](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757)

<div class="topic-metadata">

**Author:** [@Krog](https://discuss.elastic.co/u/Krog)\
**Replies:** 4\
**Last updated:** [May 31, 2018, 4:22pm UTC](https://discuss.elastic.co/t/filebeat-match-literal-or-in-messages/133757 "2018-05-31T16:22:27Z")

</div>

I have log files that contain the following: \<15:00:51.504 DBG ... \<15:00:52.173 \*WRN\* SM ... \<15:00:52.173 \*\*ERR\*\* TSS ... \<15:00:52.173 TRC EWF ... I would like to drop any messages that do not contain WRN or ERR fro…

---

## ["Mastering Elasticsearch 2nd Edition" - Is it a fit for Elasticsearch 2?](https://discuss.elastic.co/t/mastering-elasticsearch-2nd-edition-is-it-a-fit-for-elasticsearch-2/53857)

<div class="topic-metadata">

**Author:** [@ulir](https://discuss.elastic.co/u/ulir)\
**Replies:** 4\
**Last updated:** [August 2, 2016, 11:02am UTC](https://discuss.elastic.co/t/mastering-elasticsearch-2nd-edition-is-it-a-fit-for-elasticsearch-2/53857 "2016-08-02T11:02:20Z")

</div>

Hi, I'm thinking about buying - Mastering Elasticsearch - Second Edition (https://www.amazon.de//dp/1783553790) I found a snippet of the bool on Google Books during a research on merge policies and it felt like it rea…

---

## [Replace value from one field in another field using an Elasticsearch Ingest Pipeline](https://discuss.elastic.co/t/replace-value-from-one-field-in-another-field-using-an-elasticsearch-ingest-pipeline/302963)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 3\
**Last updated:** [April 27, 2022, 1:27pm UTC](https://discuss.elastic.co/t/replace-value-from-one-field-in-another-field-using-an-elasticsearch-ingest-pipeline/302963 "2022-04-27T13:27:03Z")

</div>

I need to remove a substring contained in one field from another field. However, I don't seem to be able to use the gsub or grok processors to accomplish this. E.g., I have the following fields: { "foo": "foo", …

---

## [ECS - Squid proxy log normalization](https://discuss.elastic.co/t/ecs-squid-proxy-log-normalization/190777)

<div class="topic-metadata">

**Author:** [@herrBez](https://discuss.elastic.co/u/herrBez)\
**Replies:** 3\
**Last updated:** [July 17, 2019, 8:48am UTC](https://discuss.elastic.co/t/ecs-squid-proxy-log-normalization/190777 "2019-07-17T08:48:35Z")

</div>

Hi there, I really like to use elastic common schema for my data coming from a squid proxy, but I cannot really understand which ECS Field Reference should I use. Observer seems good to describe the data about the prox…

---

## [How to list out dashboard uid's](https://discuss.elastic.co/t/how-to-list-out-dashboard-uids/118791)

<div class="topic-metadata">

**Author:** [@dangal](https://discuss.elastic.co/u/dangal)\
**Replies:** 3\
**Last updated:** [February 9, 2018, 5:08am UTC](https://discuss.elastic.co/t/how-to-list-out-dashboard-uids/118791 "2018-02-09T05:08:23Z")

</div>

we have used kibana api to export dashboard right curl -XGET http://localhost:5601/api/kibana/dashboards/export?dashboard=d25f3e20-041d-11e8-af22-05a1f7ea412f \> dashboard\_export.json d25f3e20-041d-11e8-af22-05a1f7ea41…

---

## [Separate response time from message field](https://discuss.elastic.co/t/separate-response-time-from-message-field/101017)

<div class="topic-metadata">

**Author:** [@Vivek\_Samaga](https://discuss.elastic.co/u/Vivek_Samaga)\
**Replies:** 3\
**Last updated:** [September 21, 2017, 3:39am UTC](https://discuss.elastic.co/t/separate-response-time-from-message-field/101017 "2017-09-21T03:39:17Z")

</div>

\[image\] Hi I need to separate the response time in the Screenshot which is "0" and create a new field for it how to do this?

---

## [Multiple logstash-forwarder on same server](https://discuss.elastic.co/t/multiple-logstash-forwarder-on-same-server/53477)

<div class="topic-metadata">

**Author:** [@YLombardi](https://discuss.elastic.co/u/YLombardi)\
**Replies:** 3\
**Last updated:** [June 21, 2016, 2:06pm UTC](https://discuss.elastic.co/t/multiple-logstash-forwarder-on-same-server/53477 "2016-06-21T14:06:34Z")

</div>

Hi. On my server, I have log file in json format and in plain text format. I want to separate them on two logstash input (one for with a json codec and one with plain codec). My logstash use two lumberjack input that l…

---

## [Bin/plugin Failing to find org.elasticsearch.plugins.PluginManager](https://discuss.elastic.co/t/bin-plugin-failing-to-find-org-elasticsearch-plugins-pluginmanager/9910)

<div class="topic-metadata">

**Author:** [@amiribarksdale](https://discuss.elastic.co/u/amiribarksdale)\
**Replies:** 3\
**Last updated:** [December 3, 2012, 6:58pm UTC](https://discuss.elastic.co/t/bin-plugin-failing-to-find-org-elasticsearch-plugins-pluginmanager/9910 "2012-12-03T18:58:54Z")

</div>

After trying and failing to run elasticsearch/bin/plugin, which would fail with this: Exception in thread "main" java.lang.NoClassDefFoundError: org/elasticsearch /plugins/PluginManager Caused by: java.lang.ClassN…

---

## [Bulk handling of logstash conf files](https://discuss.elastic.co/t/bulk-handling-of-logstash-conf-files/52803)

<div class="topic-metadata">

**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Replies:** 4\
**Last updated:** [June 27, 2016, 8:36pm UTC](https://discuss.elastic.co/t/bulk-handling-of-logstash-conf-files/52803 "2016-06-27T20:36:16Z")

</div>

I have like 10 clients using logstash to send data to a central ES server, however, everytime when I have some modification to the conf files, I needed to modify each clients logstash conf files. That could be so time co…

---

## [Configuration Prometheus data in ElasticSearch via Metricbeats](https://discuss.elastic.co/t/configuration-prometheus-data-in-elasticsearch-via-metricbeats/310222)

<div class="topic-metadata">

**Author:** [@tgkumarmca](https://discuss.elastic.co/u/tgkumarmca)\
**Replies:** 7\
**Last updated:** [August 2, 2022, 2:33pm UTC](https://discuss.elastic.co/t/configuration-prometheus-data-in-elasticsearch-via-metricbeats/310222 "2022-08-02T14:33:02Z")

</div>

Sub: We are looking for a solution to push the Prometheus data to Elasticsearch for long term storage. We have deployed Elasticsearch, Metric Beat, prometheus and Grafana on a kubernetes cluster. We need to push prometh…

---

## [How to split an array index in Kibana?](https://discuss.elastic.co/t/how-to-split-an-array-index-in-kibana/284377)

<div class="topic-metadata">

**Author:** [@carlos\_gomez\_gomez](https://discuss.elastic.co/u/carlos_gomez_gomez)\
**Replies:** 7\
**Last updated:** [September 22, 2021, 7:33am UTC](https://discuss.elastic.co/t/how-to-split-an-array-index-in-kibana/284377 "2021-09-22T07:33:19Z")

</div>

Hi everyone. I have an index in my Kiabana that is an array. These index is an array becouse the length of this coud be diference each time. I need to split the array for use in the control visualization. If I create…

---

## [Top Hits Aggregation Maximum Size?](https://discuss.elastic.co/t/top-hits-aggregation-maximum-size/131350)

<div class="topic-metadata">

**Author:** [@kevybear](https://discuss.elastic.co/u/kevybear)\
**Replies:** 1\
**Last updated:** [May 10, 2018, 8:07pm UTC](https://discuss.elastic.co/t/top-hits-aggregation-maximum-size/131350 "2018-05-10T20:07:48Z")

</div>

Is there a maximum size to the number of documents returned by top hits sub aggregation? \[SearchRequest{searchType=QUERY\_THEN\_FETCH, indices=\[container, container\], indicesOptions=IndicesOptions\[id=38, ignore\_unavailab…

---

## [Can some let know how to write below query in elasticsearch](https://discuss.elastic.co/t/can-some-let-know-how-to-write-below-query-in-elasticsearch/25789)

<div class="topic-metadata">

**Author:** [@vaniaravinda](https://discuss.elastic.co/u/vaniaravinda)\
**Replies:** 7\
**Last updated:** [July 28, 2015, 9:11am UTC](https://discuss.elastic.co/t/can-some-let-know-how-to-write-below-query-in-elasticsearch/25789 "2015-07-28T09:11:37Z")

</div>

( ( TITLE:"same old song and \\\\(dance)"^100 OR ( TITLE:same~0.8 AND TITLE:old~0.8 AND TITLE:song~0.8 AND TITLE:and~0.8 AND TITLE:??dance?~0.8 )^50 OR ( TITLE:same~0.5 AND TITLE:old~0.5 AND TITLE:song~0…

---

## [Filebeat and Logstash no send Logs](https://discuss.elastic.co/t/filebeat-and-logstash-no-send-logs/287292)

<div class="topic-metadata">

**Author:** [@roxasval](https://discuss.elastic.co/u/roxasval)\
**Replies:** 6\
**Last updated:** [October 25, 2021, 7:28am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-no-send-logs/287292 "2021-10-25T07:28:22Z")

</div>

Hello to all I'm a newbie on Elasticsearch and I'm having some problems: I have a cluster of 2 Elasticsearch (but I do most things with one) and a separate kibana. I would like to retrieve logs from network devices an…

---

## [Loading index patterns to use in Kibana](https://discuss.elastic.co/t/loading-index-patterns-to-use-in-kibana/92356)

<div class="topic-metadata">

**Author:** [@BentCoder](https://discuss.elastic.co/u/BentCoder)\
**Replies:** 6\
**Last updated:** [July 12, 2017, 12:41pm UTC](https://discuss.elastic.co/t/loading-index-patterns-to-use-in-kibana/92356 "2017-07-12T12:41:49Z")

</div>

Hi, Is there any point/need/advantage for loading index patterns for filebeat etc. if we use custom index names in elasticsearch output like shown below? For example, If I won't use any of "packetbeat-", "topbeat-", "f…

---

## [How to intelligently choose features for x-pack machine learning?](https://discuss.elastic.co/t/how-to-intelligently-choose-features-for-x-pack-machine-learning/89275)

<div class="topic-metadata">

**Author:** [@bcz](https://discuss.elastic.co/u/bcz)\
**Replies:** 6\
**Last updated:** [June 16, 2017, 1:14pm UTC](https://discuss.elastic.co/t/how-to-intelligently-choose-features-for-x-pack-machine-learning/89275 "2017-06-16T13:14:49Z")

</div>

Recently I have been working with the machine learning capabilities of X-Pack and have found that there is a certain point where it seems that having an understanding of how the ML algorithms are working, even on a basic…

---

## [Reindexing from HTML](https://discuss.elastic.co/t/reindexing-from-html/59673)

<div class="topic-metadata">

**Author:** [@mbagatini](https://discuss.elastic.co/u/mbagatini)\
**Replies:** 6\
**Last updated:** [September 5, 2016, 2:33pm UTC](https://discuss.elastic.co/t/reindexing-from-html/59673 "2016-09-05T14:33:25Z")

</div>

Hey folks, I'm trying to make a simple reindex request from a HTML button, but keep getting a ElasticsearchParseException. Can someone give me a hand on this? This is the HTML I'm using: \<html\> \<head\> \<script type…

---

## [Questions Regarding Deleting Source Data After Transform](https://discuss.elastic.co/t/questions-regarding-deleting-source-data-after-transform/279353)

<div class="topic-metadata">

**Author:** [@Ashfur](https://discuss.elastic.co/u/Ashfur)\
**Replies:** 5\
**Last updated:** [August 6, 2021, 2:23pm UTC](https://discuss.elastic.co/t/questions-regarding-deleting-source-data-after-transform/279353 "2021-08-06T14:23:42Z")

</div>

From what I read from the other posts, if we are running a continuous transform, we should not delete any data from the source index as that will trigger the transform to re-compute and the deleted records will no longer…

---

## [How can I obtain a list of indices in ILM lifecycle error state](https://discuss.elastic.co/t/how-can-i-obtain-a-list-of-indices-in-ilm-lifecycle-error-state/204027)

<div class="topic-metadata">

**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\
**Replies:** 2\
**Last updated:** [October 17, 2019, 2:06pm UTC](https://discuss.elastic.co/t/how-can-i-obtain-a-list-of-indices-in-ilm-lifecycle-error-state/204027 "2019-10-17T14:06:31Z")

</div>

Is there any way to get a list of indices that currently have lifecycle errors? I'm trying to setup a watcher job that will send a notification based on whether there are any such indices. Thanks.

---

## [Kafka ouput with SASL\_SSL authentication](https://discuss.elastic.co/t/kafka-ouput-with-sasl-ssl-authentication/149422)

<div class="topic-metadata">

**Author:** [@Ronanh](https://discuss.elastic.co/u/Ronanh)\
**Replies:** 2\
**Last updated:** [September 21, 2018, 12:01pm UTC](https://discuss.elastic.co/t/kafka-ouput-with-sasl-ssl-authentication/149422 "2018-09-21T12:01:08Z")

</div>

Hello, I need to send logs with filebeat to a Kafka broker where I am not administrator. This broker has SSL and authentication enabled and I failed to configure filebeat to connect to it properly. Our Kafka administr…

---

## [Can't create index pattern if you have more than 100 indices](https://discuss.elastic.co/t/cant-create-index-pattern-if-you-have-more-than-100-indices/197919)

<div class="topic-metadata">

**Author:** [@alecrooney](https://discuss.elastic.co/u/alecrooney)\
**Replies:** 1\
**Last updated:** [September 4, 2019, 8:02pm UTC](https://discuss.elastic.co/t/cant-create-index-pattern-if-you-have-more-than-100-indices/197919 "2019-09-04T20:02:41Z")

</div>

I have over 100 indices in my ES cluster and I am trying to create an index pattern, but only the first 100 indices alphabetically show up. Also the wizard does not let you continue i.e. hit next unless the pattern matc…

---

## [Filebeat stop to harvest for nginx log \[Solved\]](https://discuss.elastic.co/t/filebeat-stop-to-harvest-for-nginx-log-solved/169489)

<div class="topic-metadata">

**Author:** [@Lucio\_Palmieri](https://discuss.elastic.co/u/Lucio_Palmieri)\
**Replies:** 1\
**Last updated:** [February 22, 2019, 9:22pm UTC](https://discuss.elastic.co/t/filebeat-stop-to-harvest-for-nginx-log-solved/169489 "2019-02-22T21:22:44Z")

</div>

Hi everyone, I'm trying to use ELK to analyze Nginx access.log, but when I run Filebeat, I get a few hours of logging until Filebeat enters in an infinite loop where it says: "Harvester for file is still running ..." F…

---

## [Elasticsearch Software Bill of Materials (SBOM)](https://discuss.elastic.co/t/elasticsearch-software-bill-of-materials-sbom/296763)

<div class="topic-metadata">

**Author:** [@jtp1023](https://discuss.elastic.co/u/jtp1023)\
**Replies:** 1\
**Last updated:** [February 9, 2022, 10:39pm UTC](https://discuss.elastic.co/t/elasticsearch-software-bill-of-materials-sbom/296763 "2022-02-09T22:39:57Z")

</div>

Is there a published SBOM anywhere for Elasticsearch or any other document that shares all the components/libraries used within the application? This would be helpful when investigating security vulnerabilities and deter…

---

## [Elastic search showing error](https://discuss.elastic.co/t/elastic-search-showing-error/208270)

<div class="topic-metadata">

**Author:** [@Aditya\_kumar\_kar](https://discuss.elastic.co/u/Aditya_kumar_kar)\
**Replies:** 3\
**Last updated:** [November 20, 2019, 8:52am UTC](https://discuss.elastic.co/t/elastic-search-showing-error/208270 "2019-11-20T08:52:40Z")

</div>

.NoShardAvailableActionException error showing elastic search. {"type": "server", "timestamp": "2019-11-18T04:35:16,649Z", "level": "WARN", "component": "r.suppressed", "cluster.name": "docker-cluster", "node.name": "el…

---

## [Kibana field \_count](https://discuss.elastic.co/t/kibana-field--count/42552)

<div class="topic-metadata">

**Author:** [@binurajps](https://discuss.elastic.co/u/binurajps)\
**Replies:** 3\
**Last updated:** [February 25, 2016, 6:03pm UTC](https://discuss.elastic.co/t/kibana-field--count/42552 "2016-02-25T18:03:05Z")

</div>

Hello Team, Please find the below scenario. I have field like Booking\_Source, this field have value like as below Booking\_Source : AXS Booking\_Source : INF Booking\_Source : APL How to get the count of Bookin…

---

## [Searching sentence/words with different order/position](https://discuss.elastic.co/t/searching-sentence-words-with-different-order-position/223324)

<div class="topic-metadata">

**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\
**Replies:** 4\
**Last updated:** [March 12, 2020, 1:32pm UTC](https://discuss.elastic.co/t/searching-sentence-words-with-different-order-position/223324 "2020-03-12T13:32:12Z")

</div>

Hi! Is there a way to search a sentence or words and the result will be same number of words but they are in different order, I know my question is confusing so I will just give an example: if I search for a phrase flo…

---

## [Xml 소스 파싱에 관한 문제](https://discuss.elastic.co/t/xml/127237)

<div class="topic-metadata">

**Author:** [@seungtae](https://discuss.elastic.co/u/seungtae)\
**Replies:** 4\
**Last updated:** [April 9, 2018, 7:44am UTC](https://discuss.elastic.co/t/xml/127237 "2018-04-09T07:44:15Z")

</div>

안녕하세요. XML 파싱하는 주제에 관해 몇 가지 자문을 구하고자 질문을 올립니다. 현재 테스트는 Postman으로 XML 소스를 로그스태쉬로 보내고, 로그스태쉬에서 http로 받습니다. 여러 filter들을 통하여 파싱을 하고 output으로 Elasticsearch에 저장하고 또한 콘솔로 찍어서 테스트를 진행하고 있습니다. 질문을 드리고자 하는 부분은 XML 소스 구조가 이상할…

[Previous page](https://discuss.elastic.co/top.md?page=881&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=883&per_page=50&period=all)