# Top

**URL:** https://discuss.elastic.co/top.md?page=889&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 890

---

## [Trying to recover snapshot](https://discuss.elastic.co/t/trying-to-recover-snapshot/323428)

<div class="topic-metadata">

**Author:** [@Monica\_majua](https://discuss.elastic.co/u/Monica_majua)\
**Replies:** 4\
**Last updated:** [January 18, 2023, 4:35pm UTC](https://discuss.elastic.co/t/trying-to-recover-snapshot/323428 "2023-01-18T16:35:54Z")

</div>

Hello everyone, I'm new to this topic, it's my first time using elastic so I'm a bit lost and confused. I have migrated from ES (elasticsearch 7.17.6) to Opendistro (elasticsearch 7.10.2) but I took a snapshot first. Now…

---

## [All fields are mapped as text](https://discuss.elastic.co/t/all-fields-are-mapped-as-text/230373)

<div class="topic-metadata">

**Author:** [@martin.s](https://discuss.elastic.co/u/martin.s)\
**Replies:** 4\
**Last updated:** [April 30, 2020, 5:29am UTC](https://discuss.elastic.co/t/all-fields-are-mapped-as-text/230373 "2020-04-30T05:29:52Z")

</div>

Hello, I wasn't sure if this is more an Elasticsearch or Logstash issue, hope this is the right place. As you can probably guess I am rather new to Elasticsearch. This is Elasticsearch 6.8 on CentOS 7.7. I have a CSV …

---

## [How do I filter data returned from \_cat endpoints](https://discuss.elastic.co/t/how-do-i-filter-data-returned-from-cat-endpoints/219853)

<div class="topic-metadata">

**Author:** [@geoffmore](https://discuss.elastic.co/u/geoffmore)\
**Replies:** 0\
**Last updated:** [February 18, 2020, 7:25pm UTC](https://discuss.elastic.co/t/how-do-i-filter-data-returned-from-cat-endpoints/219853 "2020-02-18T19:25:36Z")

</div>

An issue at work came up where it was necessary to balance shards to alleviate disk pressure. For the size of our cluster, /\_cat/indices \[1\] returns close to a thousand lines. Looking at this resulted in me finding that …

---

## [DLQ Error: invalid checksum of record](https://discuss.elastic.co/t/dlq-error-invalid-checksum-of-record/149427)

<div class="topic-metadata">

**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\
**Replies:** 0\
**Last updated:** [September 21, 2018, 10:00am UTC](https://discuss.elastic.co/t/dlq-error-invalid-checksum-of-record/149427 "2018-09-21T10:00:03Z")

</div>

I am trying to drop all messages from dlq. input { dead\_letter\_queue { path =\> "/var/lib/logstash/dead\_letter\_queue" commit\_offsets =\> true pipeline\_id =\> "default-pipeline" } } filter…

---

## [Filebeat to parse mixed data (strings and json)](https://discuss.elastic.co/t/filebeat-to-parse-mixed-data-strings-and-json/267629)

<div class="topic-metadata">

**Author:** [@Olivier\_Gerault](https://discuss.elastic.co/u/Olivier_Gerault)\
**Replies:** 3\
**Last updated:** [April 2, 2021, 10:34am UTC](https://discuss.elastic.co/t/filebeat-to-parse-mixed-data-strings-and-json/267629 "2021-04-02T10:34:54Z")

</div>

Hello, First of all, I'm a new to filebeat, so I may say stupids things. Forgive me in advance. I have to parse a log file that looks like : 2021-03-18 09:33:37,131 -- TYPE -- {"json1": "data", "json2": "data", "json3…

---

## [Logstash - Is it Possible To Handle Dissect Failures Without Filling Up Syslog](https://discuss.elastic.co/t/logstash-is-it-possible-to-handle-dissect-failures-without-filling-up-syslog/246044)

<div class="topic-metadata">

**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Replies:** 3\
**Last updated:** [August 25, 2020, 1:23am UTC](https://discuss.elastic.co/t/logstash-is-it-possible-to-handle-dissect-failures-without-filling-up-syslog/246044 "2020-08-25T01:23:23Z")

</div>

Hello ELK Community, I have a pipeline that processes a certain type of log file, depending on where the log file was generated the fields may be different, this causes my dissect to fail. With the following code block…

---

## [Coupling Filebeat prospector with Logstash pipeline](https://discuss.elastic.co/t/coupling-filebeat-prospector-with-logstash-pipeline/108349)

<div class="topic-metadata">

**Author:** [@dba](https://discuss.elastic.co/u/dba)\
**Replies:** 3\
**Last updated:** [November 21, 2017, 12:38pm UTC](https://discuss.elastic.co/t/coupling-filebeat-prospector-with-logstash-pipeline/108349 "2017-11-21T12:38:26Z")

</div>

Hi We are moving to ELK 6.0 and are very pleased that we can now define filebeat prospectors and logstash pipelines in their own files. This makes it easier for our teams to create and deploy their own configurations (a…

---

## [How to open sence with Kibana in url](https://discuss.elastic.co/t/how-to-open-sence-with-kibana-in-url/94050)

<div class="topic-metadata">

**Author:** [@eboy](https://discuss.elastic.co/u/eboy)\
**Replies:** 2\
**Last updated:** [July 24, 2017, 2:05am UTC](https://discuss.elastic.co/t/how-to-open-sence-with-kibana-in-url/94050 "2017-07-24T02:05:52Z")

</div>

I heard on version 5.x,Sense has been renamed to "Console" and is part of X-Pack for kibana directly. when i open "http://localhost:5601/app/sense" in Browser. Hints. The The wrong：“{"statusCode":404,"error":"Not Found"…

---

## [Winlogbeat 8.5 and Windows 11 22H2](https://discuss.elastic.co/t/winlogbeat-8-5-and-windows-11-22h2/318676)

<div class="topic-metadata">

**Author:** [@logs4drew](https://discuss.elastic.co/u/logs4drew)\
**Replies:** 7\
**Last updated:** [December 6, 2022, 8:58pm UTC](https://discuss.elastic.co/t/winlogbeat-8-5-and-windows-11-22h2/318676 "2022-12-06T20:58:41Z")

</div>

Greetings! It appears that variables (e.g. %1, %2) in windows events shipped via winlogbeat do not have these variables replaced with their real values. Example: Credential Manager credentials were read. Subject: Sec…

---

## [Create fields by splitting a log](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891)

<div class="topic-metadata">

**Author:** [@prasadlele](https://discuss.elastic.co/u/prasadlele)\
**Replies:** 7\
**Last updated:** [March 5, 2020, 2:11pm UTC](https://discuss.elastic.co/t/create-fields-by-splitting-a-log/221891 "2020-03-05T14:11:29Z")

</div>

Hi , I have configure logstash to read my log file which gives me below input. Now I want to split the message and create a field for each comma separated values against each. Tried to use mutate in my logstash.conf f…

---

## [Logstash defaults modules?](https://discuss.elastic.co/t/logstash-defaults-modules/112476)

<div class="topic-metadata">

**Author:** [@Kristoffer\_Fagerlund](https://discuss.elastic.co/u/Kristoffer_Fagerlund)\
**Replies:** 7\
**Last updated:** [December 20, 2017, 1:42pm UTC](https://discuss.elastic.co/t/logstash-defaults-modules/112476 "2017-12-20T13:42:14Z")

</div>

I just installed ELK and I got it to work for a few minutes then I booted the vm and now Im trying to get back. logstash doesnt listen to the port I specified in the conf file. I also noticed int the log file :/etc/log…

---

## [When does ILM trigger?](https://discuss.elastic.co/t/when-does-ilm-trigger/208540)

<div class="topic-metadata">

**Author:** [@lask001](https://discuss.elastic.co/u/lask001)\
**Replies:** 2\
**Last updated:** [November 19, 2019, 4:03pm UTC](https://discuss.elastic.co/t/when-does-ilm-trigger/208540 "2019-11-19T16:03:40Z")

</div>

I have ILM setup on my elasticsearch cluster and for the most part it seems to be working but I have a few questions on how things are working behind the scenes. Currently I have my settings identical to the examples in …

---

## [Monitoring ES - Free Tools](https://discuss.elastic.co/t/monitoring-es-free-tools/127936)

<div class="topic-metadata">

**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\
**Replies:** 8\
**Last updated:** [April 23, 2018, 10:03pm UTC](https://discuss.elastic.co/t/monitoring-es-free-tools/127936 "2018-04-23T22:03:17Z")

</div>

Hello, I search a free tools to moniroting my es cluster. X-pack is not free .... :cry: Here my short list to important metrics : Heap Shards allocation Disk Usage Refresh and FLush Latency Request average GC I/O D…

---

## [Unable to install s3-repository plugin](https://discuss.elastic.co/t/unable-to-install-s3-repository-plugin/336443)

<div class="topic-metadata">

**Author:** [@ANUBHAV\_GUPTA](https://discuss.elastic.co/u/ANUBHAV_GUPTA)\
**Replies:** 6\
**Last updated:** [June 20, 2023, 1:29pm UTC](https://discuss.elastic.co/t/unable-to-install-s3-repository-plugin/336443 "2023-06-20T13:29:26Z")

</div>

Hi, I am trying to install s3-repository plugin but getting the following error:- -\> Installing repository-s3 \[repository-s3\] is no longer a plugin but instead a module packaged with this distribution of Elasticsearch -\>…

---

## [Simulate tail -f](https://discuss.elastic.co/t/simulate-tail-f/219735)

<div class="topic-metadata">

**Author:** [@robertofabrizi](https://discuss.elastic.co/u/robertofabrizi)\
**Replies:** 6\
**Last updated:** [February 20, 2020, 12:19pm UTC](https://discuss.elastic.co/t/simulate-tail-f/219735 "2020-02-20T12:19:15Z")

</div>

Dear friends, I'm new to ElasticSearch, only been enjoying it as the backend of the Kibana instance running in production. I have a new requirement, I have to parse application logs in real time, until now via buffered…

---

## [Kibana SAML setup having auth issue](https://discuss.elastic.co/t/kibana-saml-setup-having-auth-issue/205755)

<div class="topic-metadata">

**Author:** [@pshahkibana](https://discuss.elastic.co/u/pshahkibana)\
**Replies:** 6\
**Last updated:** [October 30, 2019, 5:13pm UTC](https://discuss.elastic.co/t/kibana-saml-setup-having-auth-issue/205755 "2019-10-30T17:13:41Z")

</div>

Hello, I have NGINX proxy server which forwards requests to kibana. I wanted to have SSO authentication using SAML for Kibana. My setup is as below: (1)NGIX config: server { listen 443; server\_name gpcs-sre-nonpro…

---

## [FSCrawler is not indexing consistently](https://discuss.elastic.co/t/fscrawler-is-not-indexing-consistently/174267)

<div class="topic-metadata">

**Author:** [@sreed](https://discuss.elastic.co/u/sreed)\
**Replies:** 6\
**Last updated:** [April 1, 2019, 5:50am UTC](https://discuss.elastic.co/t/fscrawler-is-not-indexing-consistently/174267 "2019-04-01T05:50:36Z")

</div>

I have configured fscrawler to monitor a folder with 13 items (folders, files of types txt, pdf, doc, xls & ppt) But not all files (and their content) are being indexed. Only 8 are being indexed. Is there an error in th…

---

## [Bluk indexing performance over a high latency newtork](https://discuss.elastic.co/t/bluk-indexing-performance-over-a-high-latency-newtork/54844)

<div class="topic-metadata">

**Author:** [@eugene\_miretsky](https://discuss.elastic.co/u/eugene_miretsky)\
**Replies:** 6\
**Last updated:** [July 14, 2016, 12:19pm UTC](https://discuss.elastic.co/t/bluk-indexing-performance-over-a-high-latency-newtork/54844 "2016-07-14T12:19:38Z")

</div>

We have a 3 node ES cluster set up in AWS. Running the default Rally benchmark from another instance in the same AWS VPC (using --benchmark-only) results in ~45,000 docs/s indexing rate. Running the same benchmark from …

---

## [How to configure mapping of nested properties using .NET client?](https://discuss.elastic.co/t/how-to-configure-mapping-of-nested-properties-using-net-client/360317)

<div class="topic-metadata">

**Author:** [@JornWildt](https://discuss.elastic.co/u/JornWildt)\
**Replies:** 4\
**Last updated:** [May 28, 2024, 1:40pm UTC](https://discuss.elastic.co/t/how-to-configure-mapping-of-nested-properties-using-net-client/360317 "2024-05-28T13:40:14Z")

</div>

I am trying to map a graph using the .NET Client API from NuGet "Elastic.Clients.Elasticsearch" 8.13.8. See code below. The graph nodes are each represented as a document in ES. On each document there is supposed to be …

---

## [APM stop working after upgrade from 7.17.6 --\> 8.4.2](https://discuss.elastic.co/t/apm-stop-working-after-upgrade-from-7-17-6-8-4-2/315119)

<div class="topic-metadata">

**Author:** [@gabriel\_tessier](https://discuss.elastic.co/u/gabriel_tessier)\
**Replies:** 1\
**Last updated:** [September 26, 2022, 9:16am UTC](https://discuss.elastic.co/t/apm-stop-working-after-upgrade-from-7-17-6-8-4-2/315119 "2022-09-26T09:16:25Z")

</div>

If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea…

---

## [Timeout executing grok and timeout\_millis not work](https://discuss.elastic.co/t/timeout-executing-grok-and-timeout-millis-not-work/206449)

<div class="topic-metadata">

**Author:** [@Luis\_Enrique\_Gastelu](https://discuss.elastic.co/u/Luis_Enrique_Gastelu)\
**Replies:** 4\
**Last updated:** [November 5, 2019, 12:56am UTC](https://discuss.elastic.co/t/timeout-executing-grok-and-timeout-millis-not-work/206449 "2019-11-05T00:56:04Z")

</div>

Hi i try to execute a grok but return text Timeout executing grok '\\\[(?\<STUCK\>STUCK)\\\] %{DATA:STUCKMESSAGE}(\\n)\\\[\\n(%{DATA:Method} %{DATA:url} %{DATA:Protocol}\\n)(?\<headers-list\>(.|\\n)\*)\\\]\\", (\\n|\\r|.)\*' against field …

---

## [Rest Client - Any other authentication mechanism?](https://discuss.elastic.co/t/rest-client-any-other-authentication-mechanism/83790)

<div class="topic-metadata">

**Author:** [@aditya\_tripathi](https://discuss.elastic.co/u/aditya_tripathi)\
**Replies:** 4\
**Last updated:** [April 29, 2017, 6:38am UTC](https://discuss.elastic.co/t/rest-client-any-other-authentication-mechanism/83790 "2017-04-29T06:38:24Z")

</div>

Hi, From the documentation, I see that a user in ES can be authenticated via Kerberos/PKI mechanisms (and others like LDAP/ActiveDirectory). Documentation also mentions that REST Client can only authenticate users with B…

---

## [Not reinstalling ElasticsSearch when running "npm run elasticsearch"](https://discuss.elastic.co/t/not-reinstalling-elasticssearch-when-running-npm-run-elasticsearch/51003)

<div class="topic-metadata">

**Author:** [@jgbarah](https://discuss.elastic.co/u/jgbarah)\
**Replies:** 4\
**Last updated:** [May 26, 2016, 9:38am UTC](https://discuss.elastic.co/t/not-reinstalling-elasticssearch-when-running-npm-run-elasticsearch/51003 "2016-05-26T09:38:37Z")

</div>

I'm trying to run Kibana from sources (master HEAD). I followed instructions in the git repo CONTRIBUTING.md file. But I have a problem with the ElasticSearch configuration: when I run npm run elasticsearch I get an …

---

## [Looking for a list of "Out of the Box" Use Cases for Elastic SIEM](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101)

<div class="topic-metadata">

**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\
**Replies:** 1\
**Last updated:** [September 13, 2021, 4:34pm UTC](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101 "2021-09-13T16:34:18Z")

</div>

I am working on a secure project that is utilizing ELK SIEM and we are looking for Use Cases that we can direct the client towards for answering what the Elastic SIEM can do for them. Is there a link or area that I can …

---

## [Updating synonyms via ElasticSearch REST api?](https://discuss.elastic.co/t/updating-synonyms-via-elasticsearch-rest-api/34276)

<div class="topic-metadata">

**Author:** [@dunglan](https://discuss.elastic.co/u/dunglan)\
**Replies:** 1\
**Last updated:** [November 11, 2015, 6:20am UTC](https://discuss.elastic.co/t/updating-synonyms-via-elasticsearch-rest-api/34276 "2015-11-11T06:20:53Z")

</div>

I am writing a code to create elasticsearch indexes with the constraint that everything must be done through the elasticsearch REST APIs. I am able to create the index, update the mapping and settings with the Java cl…

---

## [Elastic stack with Fleet Server - certificate issue](https://discuss.elastic.co/t/elastic-stack-with-fleet-server-certificate-issue/322842)

<div class="topic-metadata">

**Author:** [@MBender](https://discuss.elastic.co/u/MBender)\
**Replies:** 3\
**Last updated:** [May 14, 2024, 2:13pm UTC](https://discuss.elastic.co/t/elastic-stack-with-fleet-server-certificate-issue/322842 "2024-05-14T14:13:33Z")

</div>

I'm trying to set up an all-in-one docker compose configuration for the Elastic Stack consisting of Elastic Search, Kibana, APM (I know it's being deprecated as a stand-alone service; for the time being this is for backw…

---

## [3 Node Elasticsearch cluster is failing repeatedly with error: this node is unhealthy: health check failed due to broken node lock](https://discuss.elastic.co/t/3-node-elasticsearch-cluster-is-failing-repeatedly-with-error-this-node-is-unhealthy-health-check-failed-due-to-broken-node-lock/333234)

<div class="topic-metadata">

**Author:** [@akansha.agarwal1](https://discuss.elastic.co/u/akansha.agarwal1)\
**Replies:** 3\
**Last updated:** [May 12, 2023, 1:17pm UTC](https://discuss.elastic.co/t/3-node-elasticsearch-cluster-is-failing-repeatedly-with-error-this-node-is-unhealthy-health-check-failed-due-to-broken-node-lock/333234 "2023-05-12T13:17:16Z")

</div>

Hi All, I am stuck in a very weird situation. My 3-node ES cluster is failing after 8-10 days abruptly with error: \[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[elasticsearch-0.es-service\] this node is unhealthy: he…

---

## [Logstash 5 ruby filter](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851)

<div class="topic-metadata">

**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Replies:** 3\
**Last updated:** [March 1, 2017, 6:55am UTC](https://discuss.elastic.co/t/logstash-5-ruby-filter/76851 "2017-03-01T06:55:20Z")

</div>

Hi All, I have the following code in my logstash config and the ruby part causes logstash to continuously restart, if I remove the ruby part it works just fine. There are no errors in the log what so ever, shall I repor…

---

## [Reindexing string to date format error](https://discuss.elastic.co/t/reindexing-string-to-date-format-error/51526)

<div class="topic-metadata">

**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\
**Replies:** 3\
**Last updated:** [June 1, 2016, 11:30am UTC](https://discuss.elastic.co/t/reindexing-string-to-date-format-error/51526 "2016-06-01T11:30:29Z")

</div>

Hello, I'm trying to reindex my data because of mapping changes and in this process I´m trying to convert a string to date format. The string of the date looks like this : "01.06.2016 01:05:34". My template for this…

---

## [Geo search within country or continent](https://discuss.elastic.co/t/geo-search-within-country-or-continent/13481)

<div class="topic-metadata">

**Author:** [@mfriedma](https://discuss.elastic.co/u/mfriedma)\
**Replies:** 3\
**Last updated:** [September 10, 2013, 2:30pm UTC](https://discuss.elastic.co/t/geo-search-within-country-or-continent/13481 "2013-09-10T14:30:37Z")

</div>

I'm new to elasticsearch. Thank you for this great product. Our client would like to search within a region (continent), or within a country, or even near a city. I have been reading about geo shapes etc. I'm t…

---

## [Declaring java client in elastic search?](https://discuss.elastic.co/t/declaring-java-client-in-elastic-search/88772)

<div class="topic-metadata">

**Author:** [@kaushah](https://discuss.elastic.co/u/kaushah)\
**Replies:** 2\
**Last updated:** [June 9, 2017, 6:01am UTC](https://discuss.elastic.co/t/declaring-java-client-in-elastic-search/88772 "2017-06-09T06:01:33Z")

</div>

How do I declare a java client? From the current documentation, it is done using // on startup TransportClient client = new PreBuiltTransportClient(Settings.EMPTY) .addTransportAddress(new InetSocketTransp…

---

## [Debian installation error](https://discuss.elastic.co/t/debian-installation-error/72432)

<div class="topic-metadata">

**Author:** [@Jimmy\_Sand](https://discuss.elastic.co/u/Jimmy_Sand)\
**Replies:** 2\
**Last updated:** [January 25, 2017, 4:25am UTC](https://discuss.elastic.co/t/debian-installation-error/72432 "2017-01-25T04:25:16Z")

</div>

Hi! I'm trying to install Logstash from online repository. Source added and key added too. Successfully downloaded and unpacked. When setup tries to set up logstash there many errors. I already spend 2 days for diggi…

---

## [Sorting and range filtering semantic versions](https://discuss.elastic.co/t/sorting-and-range-filtering-semantic-versions/21827)

<div class="topic-metadata">

**Author:** [@Eric\_Smith](https://discuss.elastic.co/u/Eric_Smith)\
**Replies:** 2\
**Last updated:** [March 17, 2015, 7:21pm UTC](https://discuss.elastic.co/t/sorting-and-range-filtering-semantic-versions/21827 "2015-03-17T19:21:54Z")

</div>

I am trying to figure out some sort of indexing scheme where I can do range filters on semantic versions . Values look like these: "1.0.2.5", "1.10.2.5", "2.3.434.1" I know that I can add a separate field with t…

---

## [Highlighting Using Nest](https://discuss.elastic.co/t/highlighting-using-nest/208180)

<div class="topic-metadata">

**Author:** [@han1](https://discuss.elastic.co/u/han1)\
**Replies:** 7\
**Last updated:** [November 27, 2019, 5:15am UTC](https://discuss.elastic.co/t/highlighting-using-nest/208180 "2019-11-27T05:15:37Z")

</div>

We are trying to use the Highlighting feature , but we just want to update each document that has the relevant highlights. For example: var hits = searchResponse.Hits.Where(h =\> h.Highlight.Count \> 0).Select(p =\> { p.S…

---

## [Duplicate value in a fileds](https://discuss.elastic.co/t/duplicate-value-in-a-fileds/198936)

<div class="topic-metadata">

**Author:** [@Reb](https://discuss.elastic.co/u/Reb)\
**Replies:** 7\
**Last updated:** [September 16, 2019, 10:30am UTC](https://discuss.elastic.co/t/duplicate-value-in-a-fileds/198936 "2019-09-16T10:30:09Z")

</div>

due to a bad log treatment, the value of some fields is duplicated like : fields\_duration : 373, 373. How can i use query (update\_by\_query) to keep just the first value ? Thank you

---

## [Upgradation from 1.3.7 to 2.x](https://discuss.elastic.co/t/upgradation-from-1-3-7-to-2-x/40538)

<div class="topic-metadata">

**Author:** [@justnj](https://discuss.elastic.co/u/justnj)\
**Replies:** 7\
**Last updated:** [February 3, 2016, 10:09pm UTC](https://discuss.elastic.co/t/upgradation-from-1-3-7-to-2-x/40538 "2016-02-03T22:09:16Z")

</div>

Hi we are planning to upgrade ES from 1.3.7 to 2.X we have used migration plug and found lot conflict mappings with respect to various types. Each type has it own purpose to store records and retrival f…

---

## [Air Gap System: Internal error occurred: failed calling webhook "validation.elasticsearch.elastic.co": Post https://elastic-webhook-service.elastic-system.svc:443/validate-elasticsearches?timeout=30s: Service Unavailable](https://discuss.elastic.co/t/air-gap-system-internal-error-occurred-failed-calling-webhook-validation-elasticsearch-elastic-co-post-https-elastic-webhook-service-elastic-system-svc-443-validate-elasticsearches-timeout-30s-service-unavailable/186396)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 5\
**Last updated:** [July 24, 2019, 7:57am UTC](https://discuss.elastic.co/t/air-gap-system-internal-error-occurred-failed-calling-webhook-validation-elasticsearch-elastic-co-post-https-elastic-webhook-service-elastic-system-svc-443-validate-elasticsearches-timeout-30s-service-unavailable/186396 "2019-07-24T07:57:20Z")

</div>

Hi, I am following the quick start guide: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html When I want to deploy the single node elasticsearch I get following error: Internal error occurred: fa…

---

## [Retrieve latest documents in Saved Searches](https://discuss.elastic.co/t/retrieve-latest-documents-in-saved-searches/57165)

<div class="topic-metadata">

**Author:** [@logilouis](https://discuss.elastic.co/u/logilouis)\
**Replies:** 5\
**Last updated:** [August 5, 2016, 3:25pm UTC](https://discuss.elastic.co/t/retrieve-latest-documents-in-saved-searches/57165 "2016-08-05T15:25:02Z")

</div>

Hi, I am storing JMS queue stats into ElasticSearch every minute. Each document contains "QueueName", "PendingMessageCount","EnqueuedMessageCount" and couple more stats fields. At the end of the day I wanted to be able…

---

## [Is my elasticsearch index data duplicated to all nodes?](https://discuss.elastic.co/t/is-my-elasticsearch-index-data-duplicated-to-all-nodes/157975)

<div class="topic-metadata">

**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Replies:** 4\
**Last updated:** [November 23, 2018, 9:43am UTC](https://discuss.elastic.co/t/is-my-elasticsearch-index-data-duplicated-to-all-nodes/157975 "2018-11-23T09:43:40Z")

</div>

Hi, I am using ELK GA 6.3.0. I have set up a 5 node cluster of all master eligible nodes. I have the below data from rest request; health status index uuid pri rep docs.count docs.deleted store.size…

---

## [List of all ctx.\* / context.\* I can use in a Kibana webhook payload?](https://discuss.elastic.co/t/list-of-all-ctx-context-i-can-use-in-a-kibana-webhook-payload/277335)

<div class="topic-metadata">

**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\
**Replies:** 2\
**Last updated:** [June 29, 2021, 8:07pm UTC](https://discuss.elastic.co/t/list-of-all-ctx-context-i-can-use-in-a-kibana-webhook-payload/277335 "2021-06-29T20:07:27Z")

</div>

Dear all =) Does anyone know if there exist a list of all the info I can include in a Kibana rule/webhook payload? Right now I have "watch\_id":"{{ctx.watch\_id}}", "id":"{{ctx.id}}", "payload":"{{ctx.payload}}", "e…

---

## [Logstash 5 Monitoring Web UI](https://discuss.elastic.co/t/logstash-5-monitoring-web-ui/88963)

<div class="topic-metadata">

**Author:** [@sloniki](https://discuss.elastic.co/u/sloniki)\
**Replies:** 2\
**Last updated:** [June 11, 2017, 10:46pm UTC](https://discuss.elastic.co/t/logstash-5-monitoring-web-ui/88963 "2017-06-11T22:46:26Z")

</div>

I'm exercising in JavaScript development and created a simple Web tool for Logstash 5.x monitoring. I use it to track processed messages, java heap etc. For current Logstash version I did not see a config option to enabl…

---

## [Netflow support for Brocade Vyatta routers](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547)

<div class="topic-metadata">

**Author:** [@Amir\_Gohar](https://discuss.elastic.co/u/Amir_Gohar)\
**Replies:** 2\
**Last updated:** [April 26, 2017, 3:14pm UTC](https://discuss.elastic.co/t/netflow-support-for-brocade-vyatta-routers/83547 "2017-04-26T15:14:02Z")

</div>

can logstash plugin for netflow support vyatta routers as well ? i am able see my CISCO devices data on elk stack but not able to see the vyatta routers related data, i am aware of the supported exporters list that netf…

---

## [Auto import dangling indices to "no"](https://discuss.elastic.co/t/auto-import-dangling-indices-to-no/76577)

<div class="topic-metadata">

**Author:** [@vamshikrishna\_imp](https://discuss.elastic.co/u/vamshikrishna_imp)\
**Replies:** 2\
**Last updated:** [February 28, 2017, 5:07am UTC](https://discuss.elastic.co/t/auto-import-dangling-indices-to-no/76577 "2017-02-28T05:07:42Z")

</div>

I would like to make Auto import dangling indices to "no", can anyone please help me out here, how to do it and which file i need to change. Can you tell me the file location.

---

## [Elastic and mongoDB connectors](https://discuss.elastic.co/t/elastic-and-mongodb-connectors/26644)

<div class="topic-metadata">

**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\
**Replies:** 2\
**Last updated:** [August 26, 2015, 8:51pm UTC](https://discuss.elastic.co/t/elastic-and-mongodb-connectors/26644 "2015-08-26T20:51:57Z")

</div>

hi, Is there another way apart from elasticsearch-river-mongodb to import the mongoDB data into elastic search ?

---

## [Fast vector highlighter (fvh) making searches slower](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634)

<div class="topic-metadata">

**Author:** [@Pyppe](https://discuss.elastic.co/u/Pyppe)\
**Replies:** 6\
**Last updated:** [December 1, 2021, 10:45am UTC](https://discuss.elastic.co/t/fast-vector-highlighter-fvh-making-searches-slower/290634 "2021-12-01T10:45:04Z")

</div>

Hi! We recently improved our hit highlighting by utilizing fvh (Lucene Fast Vector Highlighter). The highlighting is done as follows: { "query": {...}, "highlight": { "fields": { "searchableName": { …

---

## [Elasticsearch- Aggregation pagination](https://discuss.elastic.co/t/elasticsearch-aggregation-pagination/18929)

<div class="topic-metadata">

**Author:** [@Manoj\_Singh](https://discuss.elastic.co/u/Manoj_Singh)\
**Replies:** 2\
**Last updated:** [July 29, 2014, 7:58am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-pagination/18929 "2014-07-29T07:58:55Z")

</div>

I am working on elastic search. I have to show report data but I need to group by them. Since I have large amount of data so I can not paginate client side. Can anyone explain how we can do pagination while using a…

---

## [High CPU Usage on some filebeat instances](https://discuss.elastic.co/t/high-cpu-usage-on-some-filebeat-instances/298426)

<div class="topic-metadata">

**Author:** [@Lebvanih](https://discuss.elastic.co/u/Lebvanih)\
**Replies:** 3\
**Last updated:** [March 23, 2022, 12:25pm UTC](https://discuss.elastic.co/t/high-cpu-usage-on-some-filebeat-instances/298426 "2022-03-23T12:25:15Z")

</div>

Hello, Some information about the system as this can help: Installation inside K8S using elastic helm charts. Filebeat version 7.16.3 Amount of pods per nodes: ~160 Amount of logs harvested per nodes: ~100 CPU usage r…

---

## [Upgrade elasticsearch from 6.5 to 6.8.1](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-5-to-6-8-1/191182)

<div class="topic-metadata">

**Author:** [@Hitesh\_Malhotra](https://discuss.elastic.co/u/Hitesh_Malhotra)\
**Replies:** 3\
**Last updated:** [July 19, 2019, 7:16am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-6-5-to-6-8-1/191182 "2019-07-19T07:16:46Z")

</div>

Hi , I am trying to upgrade elastic from 6.5 to 6.8.1 by using sudo yum install elasticsearch command but no luck Loaded plugins: fastestmirror, product-id, search-disabled-repos, subscription-manager This syst…

---

## [SAML configuration - Azure Active Directory](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314)

<div class="topic-metadata">

**Author:** [@keenan.sequeira](https://discuss.elastic.co/u/keenan.sequeira)\
**Replies:** 3\
**Last updated:** [May 23, 2019, 3:18pm UTC](https://discuss.elastic.co/t/saml-configuration-azure-active-directory/182314 "2019-05-23T15:18:18Z")

</div>

Hey, I've followed the SAML config documentation and setup elasticsearch & kibana. However, I am encountering errors when attempting to use the SAML login (basic still works). Version info: v7.0.1 (elasticsearch and kib…

---

## [Performance Monitoring query](https://discuss.elastic.co/t/performance-monitoring-query/103858)

<div class="topic-metadata">

**Author:** [@moriol](https://discuss.elastic.co/u/moriol)\
**Replies:** 3\
**Last updated:** [October 13, 2017, 11:03am UTC](https://discuss.elastic.co/t/performance-monitoring-query/103858 "2017-10-13T11:03:31Z")

</div>

I am running a 3 node cluster and basically I want to see how many writes per second I have to my index in ES. I know X-pack is good for this to give me monitoring functionality, but before I install it on my 3 node clus…

[Previous page](https://discuss.elastic.co/top.md?page=888&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=890&per_page=50&period=all)
