# Top **URL:** https://discuss.elastic.co/top.md?page=909&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 910 --- ## [How can we connect local kibana to elastic cloud elasticsearch](https://discuss.elastic.co/t/how-can-we-connect-local-kibana-to-elastic-cloud-elasticsearch/338379)
**Author:** [@Nishant\_Chauhan](https://discuss.elastic.co/u/Nishant_Chauhan)\ **Replies:** 1\ **Last updated:** [July 14, 2023, 11:29pm UTC](https://discuss.elastic.co/t/how-can-we-connect-local-kibana-to-elastic-cloud-elasticsearch/338379 "2023-07-14T23:29:07Z")
how can we connect local kibana to elastic cloud elasticsearch, like how we can get token. I tried this. GET /\_security/enroll/kibana { "error": { "root\_cause": \[ { "type": "security\_exception", … --- ## [How does Logstash know the host.hostname field?](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666)
**Author:** [@Poubelle\_Dirty](https://discuss.elastic.co/u/Poubelle_Dirty)\ **Replies:** 4\ **Last updated:** [September 10, 2023, 3:17pm UTC](https://discuss.elastic.co/t/how-does-logstash-know-the-host-hostname-field/342666 "2023-09-10T15:17:26Z")
Hello, I don't find the information and I think it's about ECS. I have a really simple config on logtash that uses syslog input, grok parsing and inject into elastic cluster. input { syslog { host =\> "0.0.0.0" … --- ## [Logstash TCP and Syslog Plugin Error](https://discuss.elastic.co/t/logstash-tcp-and-syslog-plugin-error/330722)
**Author:** [@hanna](https://discuss.elastic.co/u/hanna)\ **Replies:** 4\ **Last updated:** [May 9, 2023, 1:26pm UTC](https://discuss.elastic.co/t/logstash-tcp-and-syslog-plugin-error/330722 "2023-05-09T13:26:55Z")
Hello, I'm experiencing a Logstash error with the syslog input plugin. The input plugin for my pipeline keeps crashing with the message Force-closing a channel whose registration task was not accepted by an event loop … --- ## [Watcher Mail action with custom mustache mail body template](https://discuss.elastic.co/t/watcher-mail-action-with-custom-mustache-mail-body-template/29096)
**Author:** [@om\_panda](https://discuss.elastic.co/u/om_panda)\ **Replies:** 4\ **Last updated:** [February 15, 2017, 3:52pm UTC](https://discuss.elastic.co/t/watcher-mail-action-with-custom-mustache-mail-body-template/29096 "2017-02-15T15:52:17Z")
I have a mail action configured in which the mail body template is fetched from a mustache template. i have placed the template file under config/scripts. but getting ElasticsearchIllegalArgumentException\[Unable to find… --- ## [Logstash elasticsearch output configuration:partial update with doc](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 4\ **Last updated:** [January 26, 2017, 1:24pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update-with-doc/72863 "2017-01-26T13:24:31Z")
hi , plz how can i use the partial update with "doc" in logstash for elasticsearch output? thanks --- ## [Can't retrieve a document with its \_id?](https://discuss.elastic.co/t/cant-retrieve-a-document-with-its--id/37763)
**Author:** [@fchantrel](https://discuss.elastic.co/u/fchantrel)\ **Replies:** 4\ **Last updated:** [December 22, 2015, 3:30pm UTC](https://discuss.elastic.co/t/cant-retrieve-a-document-with-its--id/37763 "2015-12-22T15:30:28Z")
Hi, can someone explain me how it is possible, when i make this request : GET /myindex/mytype/\_search { "query": { "match": { "\_id": "55448282" } } } I've got an answer like this : "hits": { "… --- ## [Installation head plugin on elastic 2.X](https://discuss.elastic.co/t/installation-head-plugin-on-elastic-2-x/36605)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 4\ **Last updated:** [December 8, 2015, 7:41am UTC](https://discuss.elastic.co/t/installation-head-plugin-on-elastic-2-x/36605 "2015-12-08T07:41:18Z")
Hi , I was using previous version of elastic (1.7) , there we could install the head plugin from local directory using : bin/plugin --install head --url file:///Full/Path/To/elasticsearch-head-master.zip But when I … --- ## [Failed to start filebeat.service: Unit filebeat.service not found](https://discuss.elastic.co/t/failed-to-start-filebeat-service-unit-filebeat-service-not-found/198877)
**Author:** [@Tje](https://discuss.elastic.co/u/Tje)\ **Replies:** 1\ **Last updated:** [September 11, 2019, 4:17am UTC](https://discuss.elastic.co/t/failed-to-start-filebeat-service-unit-filebeat-service-not-found/198877 "2019-09-11T04:17:57Z")
I'm trying to enable filebeat in logstash.below is my filebeat.yml output.elasticsearch: # Array of hosts to connect to. hosts: \["localhost:9200"\] username: "elastic" password: "elastic" setup.kibana: host: … --- ## [Grok filter ignore first line always](https://discuss.elastic.co/t/grok-filter-ignore-first-line-always/117359)
**Author:** [@parthkdas](https://discuss.elastic.co/u/parthkdas)\ **Replies:** 1\ **Last updated:** [January 29, 2018, 8:35am UTC](https://discuss.elastic.co/t/grok-filter-ignore-first-line-always/117359 "2018-01-29T08:35:04Z")
I am trying to read large csv and txt file from different sources. The sources may give us csv or txt file for same data. I want to ignore the first the line of each files when they are first time parsed , as they repr… --- ## [Add field with logstash in csv file](https://discuss.elastic.co/t/add-field-with-logstash-in-csv-file/84919)
**Author:** [@zegdene](https://discuss.elastic.co/u/zegdene)\ **Replies:** 1\ **Last updated:** [May 8, 2017, 12:08pm UTC](https://discuss.elastic.co/t/add-field-with-logstash-in-csv-file/84919 "2017-05-08T12:08:08Z")
Hi, I create a file config.conf to insert data.csv in elasticsearch i need to remove filed and add in empty filed this is my config.conf: input { file { path =\> "/home/salma/Documents/data.csv" start\_posi… --- ## [How can I use ES Java API in Storm bolt?](https://discuss.elastic.co/t/how-can-i-use-es-java-api-in-storm-bolt/24838)
**Author:** [@Maisy](https://discuss.elastic.co/u/Maisy)\ **Replies:** 1\ **Last updated:** [July 3, 2015, 6:50am UTC](https://discuss.elastic.co/t/how-can-i-use-es-java-api-in-storm-bolt/24838 "2015-07-03T06:50:59Z")
I have some questions about Elasticsearch and Apache Strom. First, I insert some data to ElasticSearch in Strom bolt typle by tuple. After that, I want to read the count of that Data I inserted by ElasticSearch query( … --- ## [Kibana is not opening in my browser](https://discuss.elastic.co/t/kibana-is-not-opening-in-my-browser/160531)
**Author:** [@Paviganesh](https://discuss.elastic.co/u/Paviganesh)\ **Replies:** 3\ **Last updated:** [December 12, 2018, 5:13pm UTC](https://discuss.elastic.co/t/kibana-is-not-opening-in-my-browser/160531 "2018-12-12T17:13:28Z")
Hi team, Can you please help me fix this issue. I had created an EC2 instance in AWS. Installed ELK in Ubuntu 16.04. Configured kibana.yml with localhost and private. Both things not working while I open the browser wit… --- ## [Hardware monitoring with ELK](https://discuss.elastic.co/t/hardware-monitoring-with-elk/122953)
**Author:** [@iamlearner123](https://discuss.elastic.co/u/iamlearner123)\ **Replies:** 3\ **Last updated:** [March 8, 2018, 6:33am UTC](https://discuss.elastic.co/t/hardware-monitoring-with-elk/122953 "2018-03-08T06:33:53Z")
Hi there, I know that there is collectd that can be used for gathering hardware performance metrics but i was wondering, if there is something else that can be used instead of collectd. Thanks --- ## [Elasticsearch erroring on RaspberryPi 4](https://discuss.elastic.co/t/elasticsearch-erroring-on-raspberrypi-4/205342)
**Author:** [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\ **Replies:** 1\ **Last updated:** [October 26, 2019, 9:24am UTC](https://discuss.elastic.co/t/elasticsearch-erroring-on-raspberrypi-4/205342 "2019-10-26T09:24:02Z")
Hi All, It has been some time since I have posted but I have a problem I can't resolve. I have recently purchased a Raspberry Pi 4 and have installed BroIDS to monitor my gateway traffic. Bro is working well but I want… --- ## [Winlogbeat Connection Refused](https://discuss.elastic.co/t/winlogbeat-connection-refused/207399)
**Author:** [@michael.whittaker](https://discuss.elastic.co/u/michael.whittaker)\ **Replies:** 2\ **Last updated:** [November 13, 2019, 4:09pm UTC](https://discuss.elastic.co/t/winlogbeat-connection-refused/207399 "2019-11-13T16:09:20Z")
Running 7.4, trying to push WIN10 events to Ubuntu Elasticsearch. Seeing the following when debugging on the Win10 box: "2019-11-11T12:08:14.383-0500 ERROR pipeline/output.go:100 Failed to connect to backoff(elast… --- ## [Having an issue with Nest and BulkDescriptor](https://discuss.elastic.co/t/having-an-issue-with-nest-and-bulkdescriptor/138046)
**Author:** [@Doug\_Nelson1](https://discuss.elastic.co/u/Doug_Nelson1)\ **Replies:** 2\ **Last updated:** [July 2, 2018, 2:11pm UTC](https://discuss.elastic.co/t/having-an-issue-with-nest-and-bulkdescriptor/138046 "2018-07-02T14:11:17Z")
I am having an issue with following code and it should work. I am trying to use the bulk api to perform partial updates on documents. The issue I am having is the execution hangs on the bulkRequest.Update method. Noth… --- ## [Invalid redirect in elastic.co/blog causes links to lead to 404](https://discuss.elastic.co/t/invalid-redirect-in-elastic-co-blog-causes-links-to-lead-to-404/34469)
**Author:** [@igor\_k](https://discuss.elastic.co/u/igor_k)\ **Replies:** 2\ **Last updated:** [November 17, 2015, 8:16pm UTC](https://discuss.elastic.co/t/invalid-redirect-in-elastic-co-blog-causes-links-to-lead-to-404/34469 "2015-11-17T20:16:39Z")
Hi Elastic, This is a page I've encountered while browsing your blog posts. To reproduce: Go to https://www.elastic.co/blog/found-elasticsearch-plugin-types Click any internal link to other elastic/found blog a… --- ## [ConflictError(409, ' running curator](https://discuss.elastic.co/t/conflicterror-409-running-curator/225239)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 5\ **Last updated:** [March 26, 2020, 7:53pm UTC](https://discuss.elastic.co/t/conflicterror-409-running-curator/225239 "2020-03-26T19:53:40Z")
Yesterday I received help here that allowed me to get curator to run. I tested my action.yml in dry-run mode yesterday - and all looked fine. I am brand new to ELK and Curator - so please bear with me This morning - I… --- ## [Filebeat-failover](https://discuss.elastic.co/t/filebeat-failover/134685)
**Author:** [@surendrakotte](https://discuss.elastic.co/u/surendrakotte)\ **Replies:** 5\ **Last updated:** [June 6, 2018, 4:45pm UTC](https://discuss.elastic.co/t/filebeat-failover/134685 "2018-06-06T16:45:48Z")
Hello, Do we have a way to configure failover for filebeat process? Thanks in advance! Surendra --- ## [Packetbeat flows - start\_time vs last\_time](https://discuss.elastic.co/t/packetbeat-flows-start-time-vs-last-time/64904)
**Author:** [@sge1](https://discuss.elastic.co/u/sge1)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 12:47pm UTC](https://discuss.elastic.co/t/packetbeat-flows-start-time-vs-last-time/64904 "2016-11-10T12:47:38Z")
Hi everyone, I am currently in the process of deploying Packetbeat to capture flow data of udp as well as tcp flows. Thereby, Packetbeat instances are running on the receiving side as well as the sending side of the ge… --- ## [Fields, type mapping](https://discuss.elastic.co/t/fields-type-mapping/46979)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 5\ **Last updated:** [April 12, 2016, 8:57am UTC](https://discuss.elastic.co/t/fields-type-mapping/46979 "2016-04-12T08:57:32Z")
Hi, We are having one system where error and info logs are created in different files as below /var/log/sales/salesbackedERROR.log, /var/log/sales/salesbackendINFO.log, /var/log/sales/crmERROR.log, /var/log/sales/c… --- ## [How to safely update Kibana offline?](https://discuss.elastic.co/t/how-to-safely-update-kibana-offline/25778)
**Author:** [@Carlos\_Vega\_Moreno](https://discuss.elastic.co/u/Carlos_Vega_Moreno)\ **Replies:** 5\ **Last updated:** [July 18, 2015, 2:49am UTC](https://discuss.elastic.co/t/how-to-safely-update-kibana-offline/25778 "2015-07-18T02:49:39Z")
Hi, I've a server without Internet access (due to security rules) and I would like to know how to safely update kibana. For the kibana process, is it enough with just overwriting the kibana folder? Do I have to keep so… --- ## [Python dataframe Kibana](https://discuss.elastic.co/t/python-dataframe-kibana/104769)
**Author:** [@sonic](https://discuss.elastic.co/u/sonic)\ **Replies:** 1\ **Last updated:** [October 23, 2017, 4:44pm UTC](https://discuss.elastic.co/t/python-dataframe-kibana/104769 "2017-10-23T16:44:15Z")
Hello! I'm planning to do next thing: Using Pandas in python, I want to make a query and get info from csv file, then import it in kibana. The question is: Are there any ways to import .py file, or dataframe into kiban… --- ## [PHP Client Suggestion BadRequest400Exception](https://discuss.elastic.co/t/php-client-suggestion-badrequest400exception/69691)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 1\ **Last updated:** [December 22, 2016, 5:35pm UTC](https://discuss.elastic.co/t/php-client-suggestion-badrequest400exception/69691 "2016-12-22T17:35:40Z")
I'm using the PHP client. I can search no problem. My problem is getting suggestions. Here is my code: $json = ' POST /my\_search\_engine/\_suggest { "my\_engine":{ "text":"'.$keyword.'", "completion":{ "… --- ## [Insert complex nested json documents from Postgres to Elasticsearch via Logstash](https://discuss.elastic.co/t/insert-complex-nested-json-documents-from-postgres-to-elasticsearch-via-logstash/185813)
**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Replies:** 4\ **Last updated:** [June 14, 2019, 1:59pm UTC](https://discuss.elastic.co/t/insert-complex-nested-json-documents-from-postgres-to-elasticsearch-via-logstash/185813 "2019-06-14T13:59:07Z")
Hi, I have seen in other topics and I have also verified in first person that Logstash does not recognize json object from the jdbc input and an error related to the PGobject comes out, like this: Exception when execut… --- ## [Logstash crashing with "exception"=\>"undefined method \`tr' for 0:Fixnum",](https://discuss.elastic.co/t/logstash-crashing-with-exception-undefined-method-tr-for-0-fixnum/129742)
**Author:** [@s\_yash](https://discuss.elastic.co/u/s_yash)\ **Replies:** 4\ **Last updated:** [May 7, 2018, 4:23pm UTC](https://discuss.elastic.co/t/logstash-crashing-with-exception-undefined-method-tr-for-0-fixnum/129742 "2018-05-07T16:23:41Z")
Logstash crashing while converting value to float. See below for config file and exception. Has anyone seen this error and is there a workaround. version: logstash 5.6.9 conf file: filter { if \[type\] == "metric" {… --- ## [Mastering ElasticSearch - Free eBook today Oct 25, 2016](https://discuss.elastic.co/t/mastering-elasticsearch-free-ebook-today-oct-25-2016/63841)
**Author:** [@Packt](https://discuss.elastic.co/u/Packt)\ **Replies:** 4\ **Last updated:** [October 25, 2016, 5:43pm UTC](https://discuss.elastic.co/t/mastering-elasticsearch-free-ebook-today-oct-25-2016/63841 "2016-10-25T17:43:30Z")
Hi folks, I'd like to let you'll know that the eBook version of "Mastering ElasticSearch" by Rafał Kuć and Marek Rogoziński is available for free today. The eBook can be claimed here: https://www.packtpub.com/packt/off… --- ## [How to decide on number of Master and data nodes between two data centers](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 8\ **Last updated:** [February 4, 2022, 2:32pm UTC](https://discuss.elastic.co/t/how-to-decide-on-number-of-master-and-data-nodes-between-two-data-centers/295097 "2022-02-04T14:32:51Z")
Hi All, We have a total of 8 servers (4 in each data center), running ELK 7.6.2 stack. How can we decide on the number of Master (or Master-eligible) nodes and data nodes? Please help --- ## [Kibana SIEM Function: Failed to Parse Date field? (Epoch Time)](https://discuss.elastic.co/t/kibana-siem-function-failed-to-parse-date-field-epoch-time/242710)
**Author:** [@cleared\_blue\_sky](https://discuss.elastic.co/u/cleared_blue_sky)\ **Replies:** 8\ **Last updated:** [July 28, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kibana-siem-function-failed-to-parse-date-field-epoch-time/242710 "2020-07-28T19:36:40Z")
Hi All, Really need some help here. I am trying to use the Kibana SIEM Function; in particular the network function. I have mapped all my fields to ECS standard but for some reason it is returning 'Data Fetch Failure' … --- ## [Failed to submit message: 'HTTP 401: invalid token' to APM Server](https://discuss.elastic.co/t/failed-to-submit-message-http-401-invalid-token-to-apm-server/157156)
**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\ **Replies:** 3\ **Last updated:** [November 21, 2018, 8:37am UTC](https://discuss.elastic.co/t/failed-to-submit-message-http-401-invalid-token-to-apm-server/157156 "2018-11-21T08:37:57Z")
Hi I have ELk stack and APM server (6.5.0) are running in Docker. I can view the Kibana dashboard for any events. Created a sample flask application to send APM values of it to APM server. When i call the Flask applicat… --- ## [How to import kibana dashboard from commandline](https://discuss.elastic.co/t/how-to-import-kibana-dashboard-from-commandline/141104)
**Author:** [@rohit02bits](https://discuss.elastic.co/u/rohit02bits)\ **Replies:** 2\ **Last updated:** [July 30, 2018, 6:09am UTC](https://discuss.elastic.co/t/how-to-import-kibana-dashboard-from-commandline/141104 "2018-07-30T06:09:55Z")
As of now I have to manually import the kibana dashboard. i am looking at an option to automate the process via script --- ## [Watcher: Generating URLs to link back to Watch History](https://discuss.elastic.co/t/watcher-generating-urls-to-link-back-to-watch-history/92228)
**Author:** [@AndyBCDL](https://discuss.elastic.co/u/AndyBCDL)\ **Replies:** 2\ **Last updated:** [July 10, 2017, 9:35am UTC](https://discuss.elastic.co/t/watcher-generating-urls-to-link-back-to-watch-history/92228 "2017-07-10T09:35:15Z")
Hi folks, we've just upgraded to Elastic 5 over Dev, UAT and Live. I'm just looking at Watcher for the first time. I've configured a simple query to look for HTTP 503 errors in our HAproxy access logs and report to our … --- ## [Set fielddata=true on \[event.dataset\]](https://discuss.elastic.co/t/set-fielddata-true-on-event-dataset/239769)
**Author:** [@kollp](https://discuss.elastic.co/u/kollp)\ **Replies:** 1\ **Last updated:** [July 4, 2020, 3:00pm UTC](https://discuss.elastic.co/t/set-fielddata-true-on-event-dataset/239769 "2020-07-04T15:00:32Z")
Hello, We are using the ELK Stack 7.3.1. Since a few days when I try to enter "Stack Monitoring" within Kibana I get the following error message: \[illegal\_argument\_exception\] Fielddata is disabled on text fields by de… --- ## [Single Shard 0 replicas 3 nodes](https://discuss.elastic.co/t/single-shard-0-replicas-3-nodes/145184)
**Author:** [@sanjaykrishna12](https://discuss.elastic.co/u/sanjaykrishna12)\ **Replies:** 1\ **Last updated:** [August 22, 2018, 12:32pm UTC](https://discuss.elastic.co/t/single-shard-0-replicas-3-nodes/145184 "2018-08-22T12:32:37Z")
Hi, I am trying to understand the shards and replicas in elasticsearch. I have 3 nodes in my elastic cluster. My indices are created with 1 shard and 0 replicas. I assume in this scenario each of my node would have 1 co… --- ## [Back references in mutate gsub?](https://discuss.elastic.co/t/back-references-in-mutate-gsub/49707)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 1\ **Last updated:** [May 11, 2016, 4:59pm UTC](https://discuss.elastic.co/t/back-references-in-mutate-gsub/49707 "2016-05-11T16:59:04Z")
I'm in the middle of implementing a PostgreSQL log parser that will normalize the queries so I can do stats on them. As part of this, I need to be able to search for components of fields and replace them with back refere… --- ## [BulkProcessor pest practices](https://discuss.elastic.co/t/bulkprocessor-pest-practices/23389)
**Author:** [@am87](https://discuss.elastic.co/u/am87)\ **Replies:** 1\ **Last updated:** [April 24, 2015, 9:40am UTC](https://discuss.elastic.co/t/bulkprocessor-pest-practices/23389 "2015-04-24T09:40:09Z")
Hey guys, I'm using the BulkProcessor to index documents in elasticsearch. Its definitely made my indexing throughput greater than it was before. Anyway, I was wondering if there were some best practices around … --- ## [🎉 Elastic Stack 7.14 released](https://discuss.elastic.co/t/elastic-stack-7-14-released/280447)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 2:35pm UTC](https://discuss.elastic.co/t/elastic-stack-7-14-released/280447 "2021-08-04T14:35:14Z")
New in Elastic 7.14 Limit your risk with Limitless XDR! Elastic 7.14 brings together capabilities of SIEM and endpoint security on one platform, plus with the GA of Elastic Agent, centrally manage all of your integration… --- ## [Filebeat netflow huawei](https://discuss.elastic.co/t/filebeat-netflow-huawei/275515)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 0\ **Last updated:** [June 10, 2021, 4:42am UTC](https://discuss.elastic.co/t/filebeat-netflow-huawei/275515 "2021-06-10T04:42:20Z")
Hey all, I've been testing netflow from Huawei AR2200 Keep getting the following No template for ID 5000 2021-06-10T14:30:14.874+1000 DEBUG \[input\] input/input.go:139 Run input 2021-06-10T14:30:23.305+1000 DEBUG \[netf… --- ## [Discrepancy b/w /\_cat/nodes and Kibana dashboard showing node's performance](https://discuss.elastic.co/t/discrepancy-b-w-cat-nodes-and-kibana-dashboard-showing-nodes-performance/236039)
**Author:** [@slmingol](https://discuss.elastic.co/u/slmingol)\ **Replies:** 0\ **Last updated:** [June 6, 2020, 1:15pm UTC](https://discuss.elastic.co/t/discrepancy-b-w-cat-nodes-and-kibana-dashboard-showing-nodes-performance/236039 "2020-06-06T13:15:42Z")
I'm investigating a performance problem we've been noticing with one of our datanodes. Specifically es-data-01a.lab1. The /\_cat/nodes API shows indexing.index\_count hovering around 20, but the dashboard in Kibana shows a… --- ## [Причина ошибки Illegal list shortcut value](https://discuss.elastic.co/t/illegal-list-shortcut-value/121702)
**Author:** [@bio](https://discuss.elastic.co/u/bio)\ **Replies:** 5\ **Last updated:** [February 28, 2018, 3:01pm UTC](https://discuss.elastic.co/t/illegal-list-shortcut-value/121702 "2018-02-28T15:01:12Z")
Помогите понять причину ошибки Illegal list shortcut value Ошибка Индекс Документ Поиск и обновление --- ## [Shard allocation failed with MMap warnings](https://discuss.elastic.co/t/shard-allocation-failed-with-mmap-warnings/61983)
**Author:** [@Shammi\_Kumar](https://discuss.elastic.co/u/Shammi_Kumar)\ **Replies:** 5\ **Last updated:** [October 4, 2016, 7:24am UTC](https://discuss.elastic.co/t/shard-allocation-failed-with-mmap-warnings/61983 "2016-10-04T07:24:10Z")
I am using ES version 2.3.2 on 3 node cluster \[ 12 core / 16 GB RAM per node\] I am writing per day index size with 100 GB (12 shards per index) daily. After one day (reached 26 shards), I am getting following errors in … --- ## [IIS logs showing as a string](https://discuss.elastic.co/t/iis-logs-showing-as-a-string/288470)
**Author:** [@Venu1](https://discuss.elastic.co/u/Venu1)\ **Replies:** 3\ **Last updated:** [November 9, 2021, 3:21am UTC](https://discuss.elastic.co/t/iis-logs-showing-as-a-string/288470 "2021-11-09T03:21:24Z")
Hello all, I'm a newbie to ELK, I'm able to send the IIS logs and other application logs to the Elastic Kibana from the servers directly without logstash, IIS logs are showing up one string in the Elastic Kibana, I woul… --- ## [Get the top document from each group with sorting and paging](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003)
**Author:** [@Sergii](https://discuss.elastic.co/u/Sergii)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 8:34am UTC](https://discuss.elastic.co/t/get-the-top-document-from-each-group-with-sorting-and-paging/251003 "2020-10-08T08:34:36Z")
Hi! I have a collection of entities and I need to group them by RelationId and select entity with biggest Revision in each group. Result should be ordered by "title" and support paging. Is it possible to do this with El… --- ## [GUID is not a configured index pattern ID Showing the default index pattern](https://discuss.elastic.co/t/guid-is-not-a-configured-index-pattern-id-showing-the-default-index-pattern/217405)
**Author:** [@daz1761](https://discuss.elastic.co/u/daz1761)\ **Replies:** 3\ **Last updated:** [February 3, 2020, 8:28am UTC](https://discuss.elastic.co/t/guid-is-not-a-configured-index-pattern-id-showing-the-default-index-pattern/217405 "2020-02-03T08:28:58Z")
I am new to ELK, and I have just spun up the containers including Filebeat via Docker Compose to read some dummy logs from a file (see https://github.com/moryachok/elasticstack-lab). When I go to the Discovery tab in Ki… --- ## [WordCloud in Elasticsearch](https://discuss.elastic.co/t/wordcloud-in-elasticsearch/23374)
**Author:** [@Jeff\_Fogarty](https://discuss.elastic.co/u/Jeff_Fogarty)\ **Replies:** 3\ **Last updated:** [April 24, 2015, 1:26pm UTC](https://discuss.elastic.co/t/wordcloud-in-elasticsearch/23374 "2015-04-24T13:26:28Z")
I looking to create a wordcloud in Jupyter (IPython Notebook) using either python or javascript. I have a collection of Presidential speeches from the millercenter.org loading into ES. I'm able to execute a term… --- ## [\[Solved\] Use grok'd timestamp across multiple messages](https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220)
**Author:** [@AtTheControls](https://discuss.elastic.co/u/AtTheControls)\ **Replies:** 4\ **Last updated:** [October 28, 2016, 3:49pm UTC](https://discuss.elastic.co/t/solved-use-grokd-timestamp-across-multiple-messages/64220 "2016-10-28T15:49:22Z")
Hello, I am currently building a pipeline to parse iostat data and send it to elasticsearch. I am using grok to find the lines I am interested. Some lines contain the timestamp, the other lines the device information f… --- ## [Filebeat is overwriting the pipeline specified in Elastic on start](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825)
**Author:** [@JamblaInc](https://discuss.elastic.co/u/JamblaInc)\ **Replies:** 7\ **Last updated:** [March 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/filebeat-is-overwriting-the-pipeline-specified-in-elastic-on-start/266825 "2021-03-15T14:54:19Z")
I am using Filebeat to collect CloudWatch logs and I have modified the ingest node pipeline to extract and index some more information from the logs. However, when Filebeat has restarted the extra processors that I added… --- ## [IS "Fetch" phase really needed during seach](https://discuss.elastic.co/t/is-fetch-phase-really-needed-during-seach/233461)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 7\ **Last updated:** [May 20, 2020, 9:41am UTC](https://discuss.elastic.co/t/is-fetch-phase-really-needed-during-seach/233461 "2020-05-20T09:41:23Z")
This question always comes up during discussions and there is "no" strong answer to say Is "Fetch" phase really needed during search - As we understand , the coordinating node executes the search in two phases - "Query"… --- ## [File input in read mode not deleting the file after parsing](https://discuss.elastic.co/t/file-input-in-read-mode-not-deleting-the-file-after-parsing/152053)
**Author:** [@rakeshpatri](https://discuss.elastic.co/u/rakeshpatri)\ **Replies:** 1\ **Last updated:** [October 12, 2018, 6:33am UTC](https://discuss.elastic.co/t/file-input-in-read-mode-not-deleting-the-file-after-parsing/152053 "2018-10-12T06:33:03Z")
Version: logstash-input-file (4.1.6) Operating System: logstash 6.4.1 image (container) Config File: input { file { id =\> "client-files" mode =\> "read" path =\> \[ "/usr/share/logstash/plugins/message/\*.gz"\] add\_fie… --- ## [How do I connect to the application when I have dedicated master nodes?](https://discuss.elastic.co/t/how-do-i-connect-to-the-application-when-i-have-dedicated-master-nodes/108932)
**Author:** [@RafaelPosthaus](https://discuss.elastic.co/u/RafaelPosthaus)\ **Replies:** 7\ **Last updated:** [November 24, 2017, 4:41pm UTC](https://discuss.elastic.co/t/how-do-i-connect-to-the-application-when-i-have-dedicated-master-nodes/108932 "2017-11-24T16:41:41Z")
I have a cluster with 4 date nodes, and 3 dedicated master nodes, I have a question, regarding the connection driver, should I pass the ips of the 3 dedicated master nodes? thank you so much. [Previous page](https://discuss.elastic.co/top.md?page=908&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=910&per_page=50&period=all)