# Top

**URL:** https://discuss.elastic.co/top.md?page=91&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 92

---

## [How to manage elasticsearch logs: disk almost full](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061)

<div class="topic-metadata">

**Author:** [@Mauro\_Tridici](https://discuss.elastic.co/u/Mauro_Tridici)\
**Replies:** 13\
**Last updated:** [November 2, 2020, 8:25pm UTC](https://discuss.elastic.co/t/how-to-manage-elasticsearch-logs-disk-almost-full/254061 "2020-11-02T20:25:11Z")

</div>

Dear Users, I'm a newbie and this is the first time I use ELK stack. I was able to deploy ELK stack and capture needed information. I created my first dashboard and visualizations. They are working as expected: we are …

---

## [\[JAVA\] Unexpected JSON event 'VALUE\_TRUE' instead of '\[KEY\_NAME, VALUE\_STRING\]'](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740)

<div class="topic-metadata">

**Author:** [@wxh](https://discuss.elastic.co/u/wxh)\
**Replies:** 10\
**Last updated:** [January 31, 2022, 5:43pm UTC](https://discuss.elastic.co/t/java-unexpected-json-event-value-true-instead-of-key-name-value-string/295740 "2022-01-31T17:43:53Z")

</div>

I am writing some code to manage Elasticsearch templates. When running the code snippet below I am getting co.elastic.clients.json.UnexpectedJsonEventException: Unexpected JSON event 'VALUE\_FALSE' instead of '\[KEY\_NAME,…

---

## [Configuration problem](https://discuss.elastic.co/t/configuration-problem/274358)

<div class="topic-metadata">

**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\
**Replies:** 20\
**Last updated:** [June 4, 2021, 12:12am UTC](https://discuss.elastic.co/t/configuration-problem/274358 "2021-06-04T00:12:43Z")

</div>

I have cloud elastic activated. I want to set up my environment in following way: \[beats - on prem\] ----\> \[logstash-on prem\] ------\> \[elastic cloud\] So, basically install beats on servers, send logs to logstash on prem…

---

## [Running \_forcemerge on an index that is being write on](https://discuss.elastic.co/t/running-forcemerge-on-an-index-that-is-being-write-on/326492)

<div class="topic-metadata">

**Author:** [@Tudor\_Plugaru](https://discuss.elastic.co/u/Tudor_Plugaru)\
**Replies:** 18\
**Last updated:** [February 27, 2023, 8:22am UTC](https://discuss.elastic.co/t/running-forcemerge-on-an-index-that-is-being-write-on/326492 "2023-02-27T08:22:27Z")

</div>

Hi, we are having an index with heavy updates on the documents. This leads us to having a lot of uncleaned deleted documents, for example, we can have around 400M searchable documents and around 150M of uncleaned docume…

---

## [Streamed Logs not loaded into Kibana](https://discuss.elastic.co/t/streamed-logs-not-loaded-into-kibana/194052)

<div class="topic-metadata">

**Author:** [@ben.sharp](https://discuss.elastic.co/u/ben.sharp)\
**Replies:** 15\
**Last updated:** [August 12, 2019, 5:29pm UTC](https://discuss.elastic.co/t/streamed-logs-not-loaded-into-kibana/194052 "2019-08-12T17:29:56Z")

</div>

Hi there, I am attempting to stream logs from AWS Lambda into Elasticsearch/Kibana. I am doing so via a POST to the Elasticsearch endpoint, + the index and document type (e.g. POST https://example-es-domain.com/alblogs…

---

## [Issues with packetbeat geo Location](https://discuss.elastic.co/t/issues-with-packetbeat-geo-location/44792)

<div class="topic-metadata">

**Author:** [@padmajav9](https://discuss.elastic.co/u/padmajav9)\
**Replies:** 10\
**Last updated:** [March 21, 2016, 9:30pm UTC](https://discuss.elastic.co/t/issues-with-packetbeat-geo-location/44792 "2016-03-21T21:30:46Z")

</div>

Hello, I have configured the host to push network traffic using packet beat. On kibana, I was able to see packet beat dashboard too. But in my dashboard, i was not able to see the geolocation. When I check what packet …

---

## [Customize logo in Kibana 7.6](https://discuss.elastic.co/t/customize-logo-in-kibana-7-6/234771)

<div class="topic-metadata">

**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\
**Replies:** 15\
**Last updated:** [June 12, 2020, 8:25am UTC](https://discuss.elastic.co/t/customize-logo-in-kibana-7-6/234771 "2020-06-12T08:25:44Z")

</div>

Hello to everyone! I am trying to customize kibana 7.6. I have successfully changed the logo in Header ( the logo in the tab), the logo in loading screen, and I have replaced the favicons folder. I have used this topic…

---

## [Running ES as a OSGi bundle](https://discuss.elastic.co/t/running-es-as-a-osgi-bundle/4372)

<div class="topic-metadata">

**Author:** [@shruthi](https://discuss.elastic.co/u/shruthi)\
**Replies:** 11\
**Last updated:** [July 24, 2013, 12:07pm UTC](https://discuss.elastic.co/t/running-es-as-a-osgi-bundle/4372 "2013-07-24T12:07:21Z")

</div>

Hello, I am building an application on the OSGi platform and intending to use ES for indexing and searching. My requirement is to make ES available as a bundle and make it run on OSGi runtime along with my other bund…

---

## [Log messages with same index timestamps are not in the order as in the actual log file](https://discuss.elastic.co/t/log-messages-with-same-index-timestamps-are-not-in-the-order-as-in-the-actual-log-file/242000)

<div class="topic-metadata">

**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\
**Replies:** 9\
**Last updated:** [July 22, 2020, 9:12am UTC](https://discuss.elastic.co/t/log-messages-with-same-index-timestamps-are-not-in-the-order-as-in-the-actual-log-file/242000 "2020-07-22T09:12:27Z")

</div>

I have a filebeat \> logstash \> elastic set up I am using to process multi-line logs. I can see the logs in kibana, but they are not in the right order as the actual log. Here's my filebeat.yml file: filebeat.inputs: - …

---

## [Cannot read property 'length' of undefined ... bundles/vendors.bundle.js?v=16602:17](https://discuss.elastic.co/t/cannot-read-property-length-of-undefined-bundles-vendors-bundle-js-v-16602-17/129823)

<div class="topic-metadata">

**Author:** [@asp](https://discuss.elastic.co/u/asp)\
**Replies:** 13\
**Last updated:** [May 3, 2018, 7:19am UTC](https://discuss.elastic.co/t/cannot-read-property-length-of-undefined-bundles-vendors-bundle-js-v-16602-17/129823 "2018-05-03T07:19:07Z")

</div>

Hi, since a few days we are on elastic stack 6.2.3 on production. It didn't occour in our testing phase, but now we are facing the folloing issue in kibana. Uncaught TypeError: Cannot read property 'length' of undefi…

---

## [Simulate NOT IN select](https://discuss.elastic.co/t/simulate-not-in-select/87245)

<div class="topic-metadata">

**Author:** [@Martin\_Duris](https://discuss.elastic.co/u/Martin_Duris)\
**Replies:** 12\
**Last updated:** [June 4, 2017, 8:13am UTC](https://discuss.elastic.co/t/simulate-not-in-select/87245 "2017-06-04T08:13:47Z")

</div>

Hi, i need help how to create one search query in Elasticsearch. Image we have index (login of clients) with 2 columns -\> timestamp (when action happens) and user id. What i would like to find what users have login aft…

---

## [How to start and end transaction in python aws lambda function , also how to add labels between transaction](https://discuss.elastic.co/t/how-to-start-and-end-transaction-in-python-aws-lambda-function-also-how-to-add-labels-between-transaction/324320)

<div class="topic-metadata">

**Author:** [@Pratiksha\_Nagoshe](https://discuss.elastic.co/u/Pratiksha_Nagoshe)\
**Replies:** 16\
**Last updated:** [February 21, 2023, 4:21am UTC](https://discuss.elastic.co/t/how-to-start-and-end-transaction-in-python-aws-lambda-function-also-how-to-add-labels-between-transaction/324320 "2023-02-21T04:21:16Z")

</div>

If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea…

---

## [Restore operation can only be performed on snapshots with state "SUCCESS", or "PARTIAL" if partial=True](https://discuss.elastic.co/t/restore-operation-can-only-be-performed-on-snapshots-with-state-success-or-partial-if-partial-true/97455)

<div class="topic-metadata">

**Author:** [@xon](https://discuss.elastic.co/u/xon)\
**Replies:** 15\
**Last updated:** [August 18, 2017, 3:42pm UTC](https://discuss.elastic.co/t/restore-operation-can-only-be-performed-on-snapshots-with-state-success-or-partial-if-partial-true/97455 "2017-08-18T15:42:19Z")

</div>

I am getting the above error with curator. \> Restore operation can only be performed on snapshots with state "SUCCESS", or "PARTIAL" if partial=True. My action file is the below actions: 1: action: restore …

---

## [Can I delete some indices manually from elasticsearch to free up some space?](https://discuss.elastic.co/t/can-i-delete-some-indices-manually-from-elasticsearch-to-free-up-some-space/273480)

<div class="topic-metadata">

**Author:** [@prat](https://discuss.elastic.co/u/prat)\
**Replies:** 9\
**Last updated:** [May 25, 2021, 12:19am UTC](https://discuss.elastic.co/t/can-i-delete-some-indices-manually-from-elasticsearch-to-free-up-some-space/273480 "2021-05-25T00:19:16Z")

</div>

Hi All, I have indices from 1st Feb in elasticsearch. Everyday there on average 4 indices. It has consumed 79 GB space out of 100GB. Can I delete few of them to release space without impacting to anything? Thanks,

---

## [Logstash receive from multiple source & data analysis](https://discuss.elastic.co/t/logstash-receive-from-multiple-source-data-analysis/36406)

<div class="topic-metadata">

**Author:** [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\
**Replies:** 17\
**Last updated:** [December 7, 2015, 2:20pm UTC](https://discuss.elastic.co/t/logstash-receive-from-multiple-source-data-analysis/36406 "2015-12-07T14:20:56Z")

</div>

Hi, I'm new to logstash, i've set up the "sexilog" appliance ( it's a elk appliance mostly developped for vmware logs) I'm trying to catch a extreme networks wifi controller logs. Actually, all the log are received tr…

---

## [X-pack plugin installation issue in elastic search](https://discuss.elastic.co/t/x-pack-plugin-installation-issue-in-elastic-search/91689)

<div class="topic-metadata">

**Author:** [@gs21](https://discuss.elastic.co/u/gs21)\
**Replies:** 10\
**Last updated:** [July 14, 2017, 12:51am UTC](https://discuss.elastic.co/t/x-pack-plugin-installation-issue-in-elastic-search/91689 "2017-07-14T00:51:05Z")

</div>

Hello , Can you please help me in debugging the following issue C:\\ES\_NEW\\elasticsearch-5.4.3\>bin\\elasticsearch-plugin install x-pack -\> Downloading x-pack from elastic Exception in thread "main" javax.net.ssl.SSLHan…

---

## [Reducing heap usage dedicated to indices.segments.terms\_memory\_in\_bytes...?](https://discuss.elastic.co/t/reducing-heap-usage-dedicated-to-indices-segments-terms-memory-in-bytes/68899)

<div class="topic-metadata">

**Author:** [@diranged](https://discuss.elastic.co/u/diranged)\
**Replies:** 9\
**Last updated:** [December 21, 2016, 3:37pm UTC](https://discuss.elastic.co/t/reducing-heap-usage-dedicated-to-indices-segments-terms-memory-in-bytes/68899 "2016-12-21T15:37:59Z")

</div>

We have a heterogeneous cluster setup where a large set of powerful hot data nodes ingest daily data live, and store about 5 days worth of data (~15tb or so). Then after 5 days we migrate the data to a smaller set of les…

---

## [Pivot facets](https://discuss.elastic.co/t/pivot-facets/4470)

<div class="topic-metadata">

**Author:** [@Greg](https://discuss.elastic.co/u/Greg)\
**Replies:** 11\
**Last updated:** [January 18, 2012, 7:12pm UTC](https://discuss.elastic.co/t/pivot-facets/4470 "2012-01-18T19:12:44Z")

</div>

Hi all Does ES currently support, or plan to support pivot faceting like Solr? I am trying to create a hierarchical facet structure, for example: State + California (23) - Los Angeles (9) - San Franc…

---

## [Elastic agent fails to install on Centos 7](https://discuss.elastic.co/t/elastic-agent-fails-to-install-on-centos-7/329260)

<div class="topic-metadata">

**Author:** [@sblack](https://discuss.elastic.co/u/sblack)\
**Replies:** 10\
**Last updated:** [April 4, 2023, 4:21am UTC](https://discuss.elastic.co/t/elastic-agent-fails-to-install-on-centos-7/329260 "2023-04-04T04:21:19Z")

</div>

Hi, I am getting the following error message when attempting to install Fleet agent: Installed as a system package, installation will not be altered. Error: failed to execute enroll command: fork/exec /usr/bin/elastic-…

---

## [How to create individual dashboards for different-2 clients](https://discuss.elastic.co/t/how-to-create-individual-dashboards-for-different-2-clients/191517)

<div class="topic-metadata">

**Author:** [@Pankaj\_Navneet](https://discuss.elastic.co/u/Pankaj_Navneet)\
**Replies:** 22\
**Last updated:** [August 21, 2019, 4:10am UTC](https://discuss.elastic.co/t/how-to-create-individual-dashboards-for-different-2-clients/191517 "2019-08-21T04:10:37Z")

</div>

Hi Team, Can someone from ELK team help me? I have many clients whose VM's are running on a data center. I have used Icingabeat module, as all my monitoring is configured on Icinga tool. My goal is to create individual…

---

## [Elasticsearch Alert Email not working - Watcher](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386)

<div class="topic-metadata">

**Author:** [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\
**Replies:** 11\
**Last updated:** [May 25, 2020, 5:12pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386 "2020-05-25T17:12:31Z")

</div>

Dear all, I configured SMTP following the guide https://www.elastic.co/guide/en/elasticsearch/reference/7.6/actions-email.html#configuring-email My configuration is as follows: xpack.notification.email.account: gmail…

---

## [Logstash Elasticsearch Input - Query in @timestamp order](https://discuss.elastic.co/t/logstash-elasticsearch-input-query-in-timestamp-order/210607)

<div class="topic-metadata">

**Author:** [@Paul\_Ainslie](https://discuss.elastic.co/u/Paul_Ainslie)\
**Replies:** 11\
**Last updated:** [December 7, 2019, 9:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-query-in-timestamp-order/210607 "2019-12-07T21:33:15Z")

</div>

I'm querying an index with Nginx access records, running it thru the Aggregate filter plugin and writing it to a file. However, the elasticsearch input plugin is not reading the records in @timestamp order - they are wr…

---

## [Is it possible to get http.max\_content\_length in AWS Elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-get-http-max-content-length-in-aws-elasticsearch/337223)

<div class="topic-metadata">

**Author:** [@a-moondance-94](https://discuss.elastic.co/u/a-moondance-94)\
**Replies:** 10\
**Last updated:** [June 30, 2023, 3:40am UTC](https://discuss.elastic.co/t/is-it-possible-to-get-http-max-content-length-in-aws-elasticsearch/337223 "2023-06-30T03:40:45Z")

</div>

I need to get the max\_content\_length to limit the size of the bulk request I am sending to AWS Elasticsearch. In my local installation of Elasticsearch I am able to do this using GET \_cluster/settings?include\_defaults A…

---

## [Issue with sending email with pdf report attachments](https://discuss.elastic.co/t/issue-with-sending-email-with-pdf-report-attachments/53701)

<div class="topic-metadata">

**Author:** [@vinayakravi](https://discuss.elastic.co/u/vinayakravi)\
**Replies:** 10\
**Last updated:** [July 25, 2016, 6:20am UTC](https://discuss.elastic.co/t/issue-with-sending-email-with-pdf-report-attachments/53701 "2016-07-25T06:20:35Z")

</div>

I'm experiencing an issue with x-pack 5.0.0 alpha 3. I've set up an email action in XPack Watcher to send an email with a PDF attachment of a report as follows: "attachments": { "my\_report.pdf": { …

---

## [Can't uninstall Elastic Endpoint on macOS](https://discuss.elastic.co/t/cant-uninstall-elastic-endpoint-on-macos/273986)

<div class="topic-metadata">

**Author:** [@Josh\_A](https://discuss.elastic.co/u/Josh_A)\
**Replies:** 9\
**Last updated:** [May 28, 2021, 11:16am UTC](https://discuss.elastic.co/t/cant-uninstall-elastic-endpoint-on-macos/273986 "2021-05-28T11:16:57Z")

</div>

Hi - the macOS agent is a huge CPU and RAM hog on macOS 11.2.3. I'm trying to uninstall following these instructions: When I browse to the folder where the endpoint is installed (/Library/Elastic/Endpoint/), I get the…

---

## [Metricbeat apache module - error.message:HTTP error 404 in status: 404 Not Found](https://discuss.elastic.co/t/metricbeat-apache-module-error-message-http-error-404-in-status-404-not-found/169911)

<div class="topic-metadata">

**Author:** [@bradfordaemorton](https://discuss.elastic.co/u/bradfordaemorton)\
**Replies:** 9\
**Last updated:** [March 15, 2019, 3:40pm UTC](https://discuss.elastic.co/t/metricbeat-apache-module-error-message-http-error-404-in-status-404-not-found/169911 "2019-03-15T15:40:18Z")

</div>

Hi All, I have enabled the merticbeat module for apache. When reviewing the logs in Kibana I notice that I get an error -HTTP error 404 in status: 404 Not Found. I guess there is something wrong in my configure? Wha…

---

## [Improve indexing throughput](https://discuss.elastic.co/t/improve-indexing-throughput/6877)

<div class="topic-metadata">

**Author:** [@Lior\_Cohen\_barnea](https://discuss.elastic.co/u/Lior_Cohen_barnea)\
**Replies:** 14\
**Last updated:** [March 6, 2012, 5:02pm UTC](https://discuss.elastic.co/t/improve-indexing-throughput/6877 "2012-03-06T17:02:43Z")

</div>

Hi all, I am doing a POC on ES and Solr cloud. I want to improve indexing throughput which is quite less than Solr's. What approach should i take: Increase number of shards and/or nodes? Config my client with al…

---

## [Kibana search performance over time-based indices](https://discuss.elastic.co/t/kibana-search-performance-over-time-based-indices/168617)

<div class="topic-metadata">

**Author:** [@avencar](https://discuss.elastic.co/u/avencar)\
**Replies:** 9\
**Last updated:** [February 22, 2019, 5:18pm UTC](https://discuss.elastic.co/t/kibana-search-performance-over-time-based-indices/168617 "2019-02-22T17:18:16Z")

</div>

I have a concern regarding the change in Kibana 6.x to no longer support "time-interval based index patterns". Instead, we now use wildcards. Below is an example of my concern. Let's say we have a large number of daily …

---

## [ECK - Fleet Server agent startup failure](https://discuss.elastic.co/t/eck-fleet-server-agent-startup-failure/280573)

<div class="topic-metadata">

**Author:** [@sc75651](https://discuss.elastic.co/u/sc75651)\
**Replies:** 11\
**Last updated:** [September 23, 2021, 6:53pm UTC](https://discuss.elastic.co/t/eck-fleet-server-agent-startup-failure/280573 "2021-09-23T18:53:16Z")

</div>

Followed these steps - but I am getting below error during startup Note\* - I am using custom TLS certificates generated using cert-manager - k logs -f fleet-server-agent-6f976f656c-l5vtd cp: cannot stat '/mnt/elastic-i…

---

## [Elasticsearch stopped accepting specific documents](https://discuss.elastic.co/t/elasticsearch-stopped-accepting-specific-documents/43417)

<div class="topic-metadata">

**Author:** [@Benyamin\_Dvoskin](https://discuss.elastic.co/u/Benyamin_Dvoskin)\
**Replies:** 9\
**Last updated:** [March 8, 2016, 4:12pm UTC](https://discuss.elastic.co/t/elasticsearch-stopped-accepting-specific-documents/43417 "2016-03-08T16:12:10Z")

</div>

Hi, I'm trying to figure out something that happened to me just today, where Elasticsearch suddenly refuses to accept certain documents from logstash. latest versions of both (2.2.0 and 2.2.2) this is the error i get…

---

## [Surprising behaviour when escaping reserved char in query string \[1.3.4\]](https://discuss.elastic.co/t/surprising-behaviour-when-escaping-reserved-char-in-query-string-1-3-4/32088)

<div class="topic-metadata">

**Author:** [@mrec](https://discuss.elastic.co/u/mrec)\
**Replies:** 9\
**Last updated:** [October 14, 2015, 6:45pm UTC](https://discuss.elastic.co/t/surprising-behaviour-when-escaping-reserved-char-in-query-string-1-3-4/32088 "2015-10-14T18:45:59Z")

</div>

Trivial document, default (i.e. dynamic) mapping/analyzer. PUT example/doc/1 {"s":"\>hello"} Tokenization discards the \>, but it's a reserved character, so you'd expect a naive unescaped querystring containing it to ha…

---

## [Падает эластик после обновления до 6.4](https://discuss.elastic.co/t/6-4/150222)

<div class="topic-metadata">

**Author:** [@AntonUstinov](https://discuss.elastic.co/u/AntonUstinov)\
**Replies:** 17\
**Last updated:** [October 1, 2018, 4:22pm UTC](https://discuss.elastic.co/t/6-4/150222 "2018-10-01T16:22:22Z")

</div>

Добрый день! Раньше я использовал elasticsearch 5.1 на одной виртуальной машине (4Gb RAM, 4 CPU). Heap 1Gb (при 2-х почему-то эластик вылетал), объем данных 20Gb. Все работало долго и стабильно. Затем решил обновиться д…

---

## [Elasticsearch cluster instability](https://discuss.elastic.co/t/elasticsearch-cluster-instability/2015)

<div class="topic-metadata">

**Author:** [@bstascavage](https://discuss.elastic.co/u/bstascavage)\
**Replies:** 12\
**Last updated:** [July 2, 2015, 1:47am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-instability/2015 "2015-07-02T01:47:37Z")

</div>

Sorry for the lack of information here, but we have been experiencing massive cluster instability for the last week or so. We had upgraded to 1.5.2 last week and were stable for a full week before we started to have iss…

---

## [Fleet unhealthy in GUI + could not setup certificate reloader can not convert 'object' into 'string'](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997)

<div class="topic-metadata">

**Author:** [@ksmithdafm](https://discuss.elastic.co/u/ksmithdafm)\
**Replies:** 35\
**Last updated:** [April 2, 2024, 11:02am UTC](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997 "2024-04-02T11:02:07Z")

</div>

Fleet Server unhealthy in GUI and from CLI. Hello All, I have been wrestling with adding the fleet server for sometime now. I am running self managed ELK with 3 nodes as follows. master/data - Also runs kibana data01 …

---

## [How is Docker/Docker-Compose getting in the way?](https://discuss.elastic.co/t/how-is-docker-docker-compose-getting-in-the-way/230048)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 14\
**Last updated:** [April 28, 2020, 9:03pm UTC](https://discuss.elastic.co/t/how-is-docker-docker-compose-getting-in-the-way/230048 "2020-04-28T21:03:26Z")

</div>

I use docker-compose to keep most of my configuration in git for various applications. For the past few days I've been trying to get a test Elasticsearch cluster up and running. After way too much troubleshooting, I've n…

---

## [Indicator Match Detection Rule Not Matched and Mapped to Intel Feeds](https://discuss.elastic.co/t/indicator-match-detection-rule-not-matched-and-mapped-to-intel-feeds/262446)

<div class="topic-metadata">

**Author:** [@ikbal](https://discuss.elastic.co/u/ikbal)\
**Replies:** 16\
**Last updated:** [March 4, 2021, 3:06am UTC](https://discuss.elastic.co/t/indicator-match-detection-rule-not-matched-and-mapped-to-intel-feeds/262446 "2021-03-04T03:06:22Z")

</div>

Hi guys, We are using ES 7.10.1 altogether with Logstash and Kibana. We have ingested TI feeds from MISP and index named as filebeat and we wanted to map and match it to Zscaler logs. We have tested tens of times just…

---

## [Empezando con elk formato catalina.out](https://discuss.elastic.co/t/empezando-con-elk-formato-catalina-out/51078)

<div class="topic-metadata">

**Author:** [@CValor](https://discuss.elastic.co/u/CValor)\
**Replies:** 11\
**Last updated:** [February 14, 2017, 3:23pm UTC](https://discuss.elastic.co/t/empezando-con-elk-formato-catalina-out/51078 "2017-02-14T15:23:33Z")

</div>

Hola a todos, estoy teniendo problemas para entender del todo como funciona elk. El catalina loguea de la siguiente manera May 19, 2016 7:14:42 PM com.sun.xml.ws.transport.http.HttpAdapter fixQuotesAroundSoapAction INF…

---

## [Monitoring JBoss Fuse using APM](https://discuss.elastic.co/t/monitoring-jboss-fuse-using-apm/185758)

<div class="topic-metadata">

**Author:** [@vivek14](https://discuss.elastic.co/u/vivek14)\
**Replies:** 12\
**Last updated:** [June 27, 2019, 2:29am UTC](https://discuss.elastic.co/t/monitoring-jboss-fuse-using-apm/185758 "2019-06-27T02:29:21Z")

</div>

If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: Kibana version: 6.5.…

---

## [Logstash Index problem after logrotate](https://discuss.elastic.co/t/logstash-index-problem-after-logrotate/108463)

<div class="topic-metadata">

**Author:** [@Vafa\_Ronaghi](https://discuss.elastic.co/u/Vafa_Ronaghi)\
**Replies:** 12\
**Last updated:** [November 26, 2017, 7:58pm UTC](https://discuss.elastic.co/t/logstash-index-problem-after-logrotate/108463 "2017-11-26T19:58:26Z")

</div>

Logstash is having problem to read log files after log rotation and send it to Elasticsearch. This issue occures when a log file with only one line of log is getting rotated and the new log file also has only one line. …

---

## [How to create \_watcher index](https://discuss.elastic.co/t/how-to-create--watcher-index/72523)

<div class="topic-metadata">

**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\
**Replies:** 12\
**Last updated:** [January 30, 2017, 10:56pm UTC](https://discuss.elastic.co/t/how-to-create--watcher-index/72523 "2017-01-30T22:56:59Z")

</div>

Hi Team, Please suggest how can i create/start watcher index? i am getting below error: i deleted watcher index to resolve an issue and its not working since then, i updated elasticsearch.yml for: watcher.index.rest.…

---

## [How to reindex , with multiple \_id in index](https://discuss.elastic.co/t/how-to-reindex-with-multiple-id-in-index/114879)

<div class="topic-metadata">

**Author:** [@Abhishekh](https://discuss.elastic.co/u/Abhishekh)\
**Replies:** 14\
**Last updated:** [January 10, 2018, 5:01pm UTC](https://discuss.elastic.co/t/how-to-reindex-with-multiple-id-in-index/114879 "2018-01-10T17:01:44Z")

</div>

Hi, I have Index with more than one document and wanted to reindex but while reindexing wanted to change the \_id field of each document in destination index. Followed this but it is for one index. How to do that?

---

## [Nothing view in elasticsearch and kibana when import csv file](https://discuss.elastic.co/t/nothing-view-in-elasticsearch-and-kibana-when-import-csv-file/83822)

<div class="topic-metadata">

**Author:** [@zegdene](https://discuss.elastic.co/u/zegdene)\
**Replies:** 24\
**Last updated:** [May 3, 2017, 3:25pm UTC](https://discuss.elastic.co/t/nothing-view-in-elasticsearch-and-kibana-when-import-csv-file/83822 "2017-05-03T15:25:49Z")

</div>

Hi, I create a file.config for import csv file to elasticsearch but the connection between ES and Logstash is warning . I have this Warn: \> Sending Logstash's logs to C:/Project/elk/logstash/logs which is now configur…

---

## [Calculating rolling average using aggregations](https://discuss.elastic.co/t/calculating-rolling-average-using-aggregations/16281)

<div class="topic-metadata">

**Author:** [@Simon\_Cast](https://discuss.elastic.co/u/Simon_Cast)\
**Replies:** 9\
**Last updated:** [November 15, 2016, 9:51pm UTC](https://discuss.elastic.co/t/calculating-rolling-average-using-aggregations/16281 "2016-11-15T21:51:58Z")

</div>

Hi, I'm looking at using the new aggregations module of Elasticsearch to produce some metrics for my application. I want to calculate the rolling average for every hour in the last 28 days and then plot these …

---

## [Curator installation results in error](https://discuss.elastic.co/t/curator-installation-results-in-error/86980)

<div class="topic-metadata">

**Author:** [@aarishramesh](https://discuss.elastic.co/u/aarishramesh)\
**Replies:** 9\
**Last updated:** [May 30, 2017, 1:56pm UTC](https://discuss.elastic.co/t/curator-installation-results-in-error/86980 "2017-05-30T13:56:03Z")

</div>

I am trying to install elasticsearch curator by various means like pip install elasticsearch-curator But when i execute the above command I get a series of errors like below ^ In file included from ext/\_yaml.h:2:…

---

## [When i try to download the pdf using reporting option getting error: HeadlessError: Phantom immediately exited with: 1](https://discuss.elastic.co/t/when-i-try-to-download-the-pdf-using-reporting-option-getting-error-headlesserror-phantom-immediately-exited-with-1/85619)

<div class="topic-metadata">

**Author:** [@Shashidhar\_Wl](https://discuss.elastic.co/u/Shashidhar_Wl)\
**Replies:** 18\
**Last updated:** [June 29, 2017, 6:22pm UTC](https://discuss.elastic.co/t/when-i-try-to-download-the-pdf-using-reporting-option-getting-error-headlesserror-phantom-immediately-exited-with-1/85619 "2017-06-29T18:22:45Z")

</div>

Hello Kibana Team, I was able to install and configure ELK and x-pack-5.4.0 and able to retrieve the data of Apache logs and able to create dashboards and everything seems to be working fine except reporting option. ge…

---

## [Logstash Email Config](https://discuss.elastic.co/t/logstash-email-config/157703)

<div class="topic-metadata">

**Author:** [@Nikhil\_Singh1](https://discuss.elastic.co/u/Nikhil_Singh1)\
**Replies:** 32\
**Last updated:** [December 3, 2018, 12:39pm UTC](https://discuss.elastic.co/t/logstash-email-config/157703 "2018-12-03T12:39:32Z")

</div>

This is my config file for logstash email plugin if "ERROR" in \[message\] { email { to =\> 'email' codec =\> "plain" from =\> 'email2' subject =\> 'Central logstash alert' via =\> 'smtp' body =\> 'Here is the event li…

---

## [Kibana: Как построить график количества событий в секунду](https://discuss.elastic.co/t/kibana/200038)

<div class="topic-metadata">

**Author:** [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\
**Replies:** 11\
**Last updated:** [September 26, 2019, 1:33pm UTC](https://discuss.elastic.co/t/kibana/200038 "2019-09-26T13:33:17Z")

</div>

Добрый день. Как, в Кибане, построить график, отображающий количество событий/документов в секунду. Я понимаю, что это задачу можно решить, изменив параметры диаграммы: Но, параметры графика сильно зависят от исполь…

---

## [APM ApiKey Failing with Unauthorized (Wrong permissions documented?)](https://discuss.elastic.co/t/apm-apikey-failing-with-unauthorized-wrong-permissions-documented/277663)

<div class="topic-metadata">

**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Replies:** 10\
**Last updated:** [July 9, 2021, 12:31pm UTC](https://discuss.elastic.co/t/apm-apikey-failing-with-unauthorized-wrong-permissions-documented/277663 "2021-07-09T12:31:57Z")

</div>

Kibana version: 7.13.2 Elasticsearch version: 7.13.2 APM Server version: 7.13.2 APM Agent language and version: N/A Browser version: N/A Original install method (e.g. download page, yum, deb, from source, etc.)…

---

## [Painfully slow queries](https://discuss.elastic.co/t/painfully-slow-queries/37346)

<div class="topic-metadata">

**Author:** [@111106](https://discuss.elastic.co/u/111106)\
**Replies:** 10\
**Last updated:** [December 17, 2015, 11:44am UTC](https://discuss.elastic.co/t/painfully-slow-queries/37346 "2015-12-17T11:44:28Z")

</div>

I'm experiencing problems with query time. The longer the word count gets in the query, the longer it takes, up to a whopping 30s when unwarmed. My config: i5, 8GB RAM ES 2.1.0 1 node, 1 shard, 0 replicas, 1 index (don…

---

## [Packetbeat: Not listening to mysql](https://discuss.elastic.co/t/packetbeat-not-listening-to-mysql/44101)

<div class="topic-metadata">

**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Replies:** 10\
**Last updated:** [April 15, 2016, 1:21pm UTC](https://discuss.elastic.co/t/packetbeat-not-listening-to-mysql/44101 "2016-04-15T13:21:48Z")

</div>

I'm using packetbeat for monitoring MySQL, I've configured it using following configuration but it is not listening to the ports. interfaces: device: 0 protocols: dns: ports: \[53\] include\_additionals: tr…

[Previous page](https://discuss.elastic.co/top.md?page=90&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=92&per_page=50&period=all)
