# Top **URL:** https://discuss.elastic.co/top.md?page=911&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 912 --- ## [Rest High Level client - Gracefully flushing bulk processor as JVM exits](https://discuss.elastic.co/t/rest-high-level-client-gracefully-flushing-bulk-processor-as-jvm-exits/217368)
**Author:** [@marchuss](https://discuss.elastic.co/u/marchuss)\ **Replies:** 6\ **Last updated:** [February 5, 2020, 8:57am UTC](https://discuss.elastic.co/t/rest-high-level-client-gracefully-flushing-bulk-processor-as-jvm-exits/217368 "2020-02-05T08:57:42Z")
Are there any recommendations on how to cleanly flush all items that are in the Rest High Level bulkprocessor (configured with one concurrent request) as the JVM exits? We have a spring boot application and have tried … --- ## [Unable to start Metric beat on Kubenetes](https://discuss.elastic.co/t/unable-to-start-metric-beat-on-kubenetes/190076)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 6\ **Last updated:** [July 12, 2019, 2:50pm UTC](https://discuss.elastic.co/t/unable-to-start-metric-beat-on-kubenetes/190076 "2019-07-12T14:50:43Z")
I am trying to start the metric beat with https://github.com/elastic/beats/blob/master/deploy/kubernetes/metricbeat-kubernetes.yaml file but it failing with below error. any help will be appriciated. Version Elk - 7.2 … --- ## [Finding User Name & more](https://discuss.elastic.co/t/finding-user-name-more/139942)
**Author:** [@Marcos\_Felix](https://discuss.elastic.co/u/Marcos_Felix)\ **Replies:** 6\ **Last updated:** [July 17, 2018, 8:19am UTC](https://discuss.elastic.co/t/finding-user-name-more/139942 "2018-07-17T08:19:16Z")
Hello, 1st Question: I am forwarding logs from my collector environment to Kibana using winlogbeat I am interested in finding who done what. When I check a log I look for the user that done that, and I can't find - m… --- ## [Cluster hangs for 1h. no logs, no throughput](https://discuss.elastic.co/t/cluster-hangs-for-1h-no-logs-no-throughput/90570)
**Author:** [@ghs](https://discuss.elastic.co/u/ghs)\ **Replies:** 6\ **Last updated:** [June 26, 2017, 1:34am UTC](https://discuss.elastic.co/t/cluster-hangs-for-1h-no-logs-no-throughput/90570 "2017-06-26T01:34:47Z")
I use 12 ES nodes. (3 master with data, 9 data only) Java app is putting documents to ES using TransportClient's bulk API. Suddenly, ES throughput didn't work for 1hour. At that time, 1. One of the data nodes is hang… --- ## [Nothing showing in Kibana](https://discuss.elastic.co/t/nothing-showing-in-kibana/90117)
**Author:** [@wmcgilvery](https://discuss.elastic.co/u/wmcgilvery)\ **Replies:** 6\ **Last updated:** [June 22, 2017, 3:40pm UTC](https://discuss.elastic.co/t/nothing-showing-in-kibana/90117 "2017-06-22T15:40:21Z")
Hello: My server ran out of space - duh. so I used the curator to remove anything older than 45 days and now I have plenty of free space and still indices newer than 45 days. The problem is when I log into kibana - n… --- ## [Cannot save to ElasticSearch via NLog](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790)
**Author:** [@persepherone](https://discuss.elastic.co/u/persepherone)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 10:47am UTC](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790 "2020-05-15T10:47:59Z")
I have a password protected ElasticSearch instance. When i try to use NLog.Targets.ElasticSearch in my .net core 3.1 application to directly save logs to Elastic search. I am getting error. my Log .config file is as fol… --- ## [Best practice for Log-Analyzing](https://discuss.elastic.co/t/best-practice-for-log-analyzing/155504)
**Author:** [@Illmatic](https://discuss.elastic.co/u/Illmatic)\ **Replies:** 2\ **Last updated:** [November 21, 2018, 8:35am UTC](https://discuss.elastic.co/t/best-practice-for-log-analyzing/155504 "2018-11-21T08:35:19Z")
I need to Analyze the Logs(Exceptions) from a Rest-Application. I have a Log-File with the logged Exceptions and was wondering, what would be best practice to Analyze this Logs and wich Components from the ELK-Stack I sh… --- ## [Logstash- /var/log/logstash - has no files](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780)
**Author:** [@gurumu](https://discuss.elastic.co/u/gurumu)\ **Replies:** 7\ **Last updated:** [May 3, 2022, 8:46pm UTC](https://discuss.elastic.co/t/logstash-var-log-logstash-has-no-files/303780 "2022-05-03T20:46:35Z")
Hello- I have installed Elasticsearch, Kibana and Logstash version 8.1.0 on my ubuntu VM. I am trying to ingest auth.log into ES by passing it through logstash. attached is the configuration file screenshots. I am not se… --- ## [Change mapping of a list of indices (rollover)](https://discuss.elastic.co/t/change-mapping-of-a-list-of-indices-rollover/271614)
**Author:** [@samia](https://discuss.elastic.co/u/samia)\ **Replies:** 7\ **Last updated:** [May 3, 2021, 4:36pm UTC](https://discuss.elastic.co/t/change-mapping-of-a-list-of-indices-rollover/271614 "2021-05-03T16:36:13Z")
Hi, I'm using Elastic 7.11 I have a series of indices (not DataStreams) which rollover through an ILM policy. There's a legacy index template which refer to them. I would like to change the mapping of the future ind… --- ## [Trying to correlate data in kibana for reports](https://discuss.elastic.co/t/trying-to-correlate-data-in-kibana-for-reports/145750)
**Author:** [@sagar19](https://discuss.elastic.co/u/sagar19)\ **Replies:** 1\ **Last updated:** [August 24, 2018, 10:39am UTC](https://discuss.elastic.co/t/trying-to-correlate-data-in-kibana-for-reports/145750 "2018-08-24T10:39:58Z")
I am trying to correlate data so that i can generate a report. The start of the log has a message 'TRANSACTION\_STARTED' and there is GatewayTxCode associated with it. The last log has message 'TRANSACTION\_SUCCESS' (or fa… --- ## [Filebeat multiline timeout](https://discuss.elastic.co/t/filebeat-multiline-timeout/110946)
**Author:** [@Shreya\_Chatterjee](https://discuss.elastic.co/u/Shreya_Chatterjee)\ **Replies:** 1\ **Last updated:** [December 11, 2017, 1:01pm UTC](https://discuss.elastic.co/t/filebeat-multiline-timeout/110946 "2017-12-11T13:01:39Z")
excerpt from log file: 2017-11-06 11:54:43,333; \[LOG\_LEVEL=ALWAYS, CMPNT\_NM=com.fmr.ifeb.alayer.cache.ehcache.ApplicationCacheImpl, MESSAGE=Initialized cache named 'oscarJdbcDaxCache'\] 2017-11-06 11:54:43,344; \[LOG\_LEVE… --- ## [REST API to access/update Advanced Settings](https://discuss.elastic.co/t/rest-api-to-access-update-advanced-settings/220350)
**Author:** [@gab.bernasconi](https://discuss.elastic.co/u/gab.bernasconi)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 2:01pm UTC](https://discuss.elastic.co/t/rest-api-to-access-update-advanced-settings/220350 "2020-03-04T14:01:53Z")
I am currently using Kibana version 7.4.2 Saved Objects REST API (see here) to programmatically customize some Kibana Advanced Settings. In particular, I am customizing the dateFormat:tz setting to choose the timezone K… --- ## [Here is one solution of how to parse domain name from url](https://discuss.elastic.co/t/here-is-one-solution-of-how-to-parse-domain-name-from-url/189271)
**Author:** [@Havana](https://discuss.elastic.co/u/Havana)\ **Replies:** 3\ **Last updated:** [July 8, 2019, 2:41am UTC](https://discuss.elastic.co/t/here-is-one-solution-of-how-to-parse-domain-name-from-url/189271 "2019-07-08T02:41:34Z")
For example, if the url is "https://pixabay.com/images/search/planet/", what I need is the domain "pixabay.com". We can try scripted filed to solve this problem with the help of this documentation. Attention: Never for… --- ## [Join two indices using alias](https://discuss.elastic.co/t/join-two-indices-using-alias/162490)
**Author:** [@Loki](https://discuss.elastic.co/u/Loki)\ **Replies:** 3\ **Last updated:** [December 31, 2018, 10:05am UTC](https://discuss.elastic.co/t/join-two-indices-using-alias/162490 "2018-12-31T10:05:07Z")
Hi, I am still newbie in elasticsearch and I have also read that we cannot join two indices. But is it possible to use alias in this case? I mean, can we join indices using alias? Or is there any alternative or workar… --- ## [When Adding replicas I recieve \`failed to list shard for shard\_store on node \` warning repeatedly](https://discuss.elastic.co/t/when-adding-replicas-i-recieve-failed-to-list-shard-for-shard-store-on-node-warning-repeatedly/155094)
**Author:** [@Shaun\_Stone](https://discuss.elastic.co/u/Shaun_Stone)\ **Replies:** 3\ **Last updated:** [November 7, 2018, 9:16am UTC](https://discuss.elastic.co/t/when-adding-replicas-i-recieve-failed-to-list-shard-for-shard-store-on-node-warning-repeatedly/155094 "2018-11-07T09:16:24Z")
we are using elasticsearch 6.3. i received this same WARN message when i restored from a snapshot and a separate time when I added extra replicas. exception: { "exception\_class": "org.elasticsearch.action.FailedNod… --- ## [License update fails on unknown version](https://discuss.elastic.co/t/license-update-fails-on-unknown-version/106605)
**Author:** [@Dharma\_Indurthy](https://discuss.elastic.co/u/Dharma_Indurthy)\ **Replies:** 3\ **Last updated:** [November 7, 2017, 5:09pm UTC](https://discuss.elastic.co/t/license-update-fails-on-unknown-version/106605 "2017-11-07T17:09:58Z")
Can't seem to find this issue anywhere. We're trying to update our license and it fails with this error: curl -XPUT "http://:9200/\_license" -d @elasticsearch-license.json {"error":{"root\_cause":\[{"type":"exception","r… --- ## [How to copy from Kibana Logs easily?](https://discuss.elastic.co/t/how-to-copy-from-kibana-logs-easily/294140)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 4\ **Last updated:** [January 14, 2022, 5:32am UTC](https://discuss.elastic.co/t/how-to-copy-from-kibana-logs-easily/294140 "2022-01-14T05:32:01Z")
I use Kibana to view the Logs, and I want to copy some lines from it. However, when copying, I get something like the following in my clipboard: 16:55:10.943 MyTag \[Debug\] my message 16:55:10.956 AnotherTag \[Info\] anoth… --- ## ['suggest\_mode' =\> 'always' does not return suggestion's full word query](https://discuss.elastic.co/t/suggest-mode-always-does-not-return-suggestions-full-word-query/302268)
**Author:** [@jacreich](https://discuss.elastic.co/u/jacreich)\ **Replies:** 8\ **Last updated:** [April 15, 2022, 4:49pm UTC](https://discuss.elastic.co/t/suggest-mode-always-does-not-return-suggestions-full-word-query/302268 "2022-04-15T16:49:29Z")
Hello, I am running an suggestions query using Elasticsearch v5.5. When looking for a whole word in the document (e.g. 'kneecap'), suggestions are not returned when the whole word is typed, but it does appear when typing… --- ## [How do ECE Cloud UI Hot-Warm and Index Management Hot-Warm join up](https://discuss.elastic.co/t/how-do-ece-cloud-ui-hot-warm-and-index-management-hot-warm-join-up/227956)
**Author:** [@david.preston](https://discuss.elastic.co/u/david.preston)\ **Replies:** 8\ **Last updated:** [April 15, 2020, 5:13pm UTC](https://discuss.elastic.co/t/how-do-ece-cloud-ui-hot-warm-and-index-management-hot-warm-join-up/227956 "2020-04-15T17:13:39Z")
I've been working through the Elastic documentation, starting here: https://www.elastic.co/guide/en/cloud-enterprise/current/ece-configuring-ece-tag-allocators.html The guide walks through the setting up of Hot-Warm all… --- ## [Logstash File Output Vulnerability CVE-2015-4152](https://discuss.elastic.co/t/logstash-file-output-vulnerability-cve-2015-4152/2257)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [June 9, 2015, 9:42pm UTC](https://discuss.elastic.co/t/logstash-file-output-vulnerability-cve-2015-4152/2257 "2015-06-09T21:42:06Z")
Summary: Logstash versions 1.4.2 and prior are vulnerable to a directory traversal attack that allows an attacker to over-write files on the server running Logstash. This vulnerability is not present in the initial insta… --- ## [Logstash 6.8 Input File not using exit\_after\_read](https://discuss.elastic.co/t/logstash-6-8-input-file-not-using-exit-after-read/226420)
**Author:** [@seibelj](https://discuss.elastic.co/u/seibelj)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 4:51pm UTC](https://discuss.elastic.co/t/logstash-6-8-input-file-not-using-exit-after-read/226420 "2020-04-03T16:51:44Z")
Working with a client that has ELK 6.8.1 Their system produces a JSON file every minute (obviously a lot of files). I've been successful getting them into ES but having an issue with the number open. I'd like it to close… --- ## [Heartbeat activemq monitor without error in activemq.log](https://discuss.elastic.co/t/heartbeat-activemq-monitor-without-error-in-activemq-log/249351)
**Author:** [@rino](https://discuss.elastic.co/u/rino)\ **Replies:** 4\ **Last updated:** [October 16, 2020, 1:03pm UTC](https://discuss.elastic.co/t/heartbeat-activemq-monitor-without-error-in-activemq-log/249351 "2020-10-16T13:03:08Z")
Hi, We're monitoring the uptime of our activemq servers (specificly the openwire port our queue is using). The problem is, with the below tcp monitor, it leaves behind some ugly logging in the activemq log. i wonder if … --- ## [Query a specific IP address in Elastic](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318)
**Author:** [@ianrobo](https://discuss.elastic.co/u/ianrobo)\ **Replies:** 2\ **Last updated:** [March 22, 2022, 12:34pm UTC](https://discuss.elastic.co/t/query-a-specific-ip-address-in-elastic/300318 "2022-03-22T12:34:26Z")
Hi there, I am relatively new to elastic and expanding our ES daily. We are ingesting logs from various network devices but come across a problem in Cisco. They do not send the hostname in their syslog and therefore al… --- ## [Logstash in docker fails after plugin installed](https://discuss.elastic.co/t/logstash-in-docker-fails-after-plugin-installed/298446)
**Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 2\ **Last updated:** [February 28, 2022, 11:48pm UTC](https://discuss.elastic.co/t/logstash-in-docker-fails-after-plugin-installed/298446 "2022-02-28T23:48:19Z")
When using the official image for logstash (8.0.0) if a plugin is installed, after that Logstash will not load. If I use the image without the plugin installed then it works. For example: docker run --rm --name my-logst… --- ## [KibanaにアップロードするときのCSV書式について](https://discuss.elastic.co/t/kibana-csv/269218)
**Author:** [@Ango\_Hefner](https://discuss.elastic.co/u/Ango_Hefner)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 2:54am UTC](https://discuss.elastic.co/t/kibana-csv/269218 "2021-04-07T02:54:32Z")
お世話になります。大変初心者の質問で申し訳ありません。 現在、以下のデータを利用し従業員の業務の可視化のサンプルを作成しております。 画像の「Task」「Action」列を使用し、二重のドーナッツチャートを作りたいと考えています。 しかし「Task」の項目が1カラムに複数ある場合、例えば二行目ですと、アップロードした時に「”経理”,”法務”」という名称で一まとめとなってしまいます。 こちらを「経理」と「法務」それぞれでカウ… --- ## [How to interpret memory stats in filebeat log](https://discuss.elastic.co/t/how-to-interpret-memory-stats-in-filebeat-log/191110)
**Author:** [@filebeater](https://discuss.elastic.co/u/filebeater)\ **Replies:** 2\ **Last updated:** [July 29, 2019, 7:48pm UTC](https://discuss.elastic.co/t/how-to-interpret-memory-stats-in-filebeat-log/191110 "2019-07-29T19:48:08Z")
Hello, I am wondering what is the following 3 memstats means? beat.memstats.gc\_next=32389200 beat.memstats.memory\_alloc=32504416 beat.memstats.memory\_total=51506747192 For example, i would like to know what is maxim… --- ## [Wildcard query](https://discuss.elastic.co/t/wildcard-query/116230)
**Author:** [@Frances\_Buontempo](https://discuss.elastic.co/u/Frances_Buontempo)\ **Replies:** 2\ **Last updated:** [January 19, 2018, 2:17pm UTC](https://discuss.elastic.co/t/wildcard-query/116230 "2018-01-19T14:17:47Z")
I'm trying a wildcard query to match ip addresses. I have two src\_ip documents of starting "5." This query: "query" : { "wildcard" : { "src\_ip" : "5\*"} } returns one hit. What am I doing wrong? --- ## [Node failure and recovery](https://discuss.elastic.co/t/node-failure-and-recovery/106065)
**Author:** [@wrinehart](https://discuss.elastic.co/u/wrinehart)\ **Replies:** 2\ **Last updated:** [November 2, 2017, 12:06am UTC](https://discuss.elastic.co/t/node-failure-and-recovery/106065 "2017-11-02T00:06:02Z")
Howdy, I have a cluster in Elasticsearch version 1.4.4 that is currently under-provisioned. Currently, when a node falls off the cluster the other nodes start reassigning shards from the failed nodes to the other nodes… --- ## [Unable to search from Kibana - Failed to execute search.SearchRequest](https://discuss.elastic.co/t/unable-to-search-from-kibana-failed-to-execute-search-searchrequest/60215)
**Author:** [@michal\_NCR](https://discuss.elastic.co/u/michal_NCR)\ **Replies:** 2\ **Last updated:** [September 12, 2016, 4:10pm UTC](https://discuss.elastic.co/t/unable-to-search-from-kibana-failed-to-execute-search-searchrequest/60215 "2016-09-12T16:10:28Z")
Hello, I have issues performing searches in Kibana, I am getting "Courier Fetch: 45 of 60 shards failed".. My environment: ES 1.6, Kibana is 4.1.1 4 data nodes - 4 cores and 12GB RAM each, 6GB assigned to heap tot… --- ## [APM Servers respond with 503 "request timed out"](https://discuss.elastic.co/t/apm-servers-respond-with-503-request-timed-out/332671)
**Author:** [@zvazquez](https://discuss.elastic.co/u/zvazquez)\ **Replies:** 6\ **Last updated:** [June 28, 2024, 10:18am UTC](https://discuss.elastic.co/t/apm-servers-respond-with-503-request-timed-out/332671 "2024-06-28T10:18:04Z")
Hi, We see a lot of the following error logs in our APM servers: { "log.level": "error", "@timestamp": "2023-05-05T17:02:56.871Z", "log.logger": "request", "log.origin": { "file.name": "middleware/log\_middleware.… --- ## [TransportClient Error while upgrading from Elasticsearch 1.7.3 to 2.0.0](https://discuss.elastic.co/t/transportclient-error-while-upgrading-from-elasticsearch-1-7-3-to-2-0-0/43843)
**Author:** [@anupamamann](https://discuss.elastic.co/u/anupamamann)\ **Replies:** 6\ **Last updated:** [March 10, 2016, 4:21pm UTC](https://discuss.elastic.co/t/transportclient-error-while-upgrading-from-elasticsearch-1-7-3-to-2-0-0/43843 "2016-03-10T16:21:57Z")
Hi, I'm trying to upgrade Elasticsearch cluster from 1.7.3 to 2.0.0. I was able to upgrade the nodes in the cluster with a rolling restart. The head plugin runs successfully, index was read properly by the cluster and I… --- ## [Problems with from/size pagination on Node.js API](https://discuss.elastic.co/t/problems-with-from-size-pagination-on-node-js-api/219619)
**Author:** [@lleal](https://discuss.elastic.co/u/lleal)\ **Replies:** 3\ **Last updated:** [February 18, 2020, 4:37pm UTC](https://discuss.elastic.co/t/problems-with-from-size-pagination-on-node-js-api/219619 "2020-02-18T16:37:10Z")
Hi folks, I am currently running in some weird behavior while running paginated searches using the Node.js API. From my tests it seems that the "from" parameter is not being correctly parsed. No matter the value I conf… --- ## [Kibana Discover page doesn't show the data after updating the index pattern](https://discuss.elastic.co/t/kibana-discover-page-doesnt-show-the-data-after-updating-the-index-pattern/216717)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 3\ **Last updated:** [January 29, 2020, 10:52am UTC](https://discuss.elastic.co/t/kibana-discover-page-doesnt-show-the-data-after-updating-the-index-pattern/216717 "2020-01-29T10:52:46Z")
Issue: Updating the index pattern to include the new fields from other indices doesn't now show their data on Kibana discover page. Steps to replicate: index error-codes-test vs Index error-codes-final have slightly… --- ## [How to get Hostname in email subject for Diskspace alert](https://discuss.elastic.co/t/how-to-get-hostname-in-email-subject-for-diskspace-alert/137510)
**Author:** [@rpendela](https://discuss.elastic.co/u/rpendela)\ **Replies:** 3\ **Last updated:** [June 29, 2018, 8:43am UTC](https://discuss.elastic.co/t/how-to-get-hostname-in-email-subject-for-diskspace-alert/137510 "2018-06-29T08:43:18Z")
My issue also similar to this topic but I am not using any advance query, I can see my threshold query is executing but I want to see the host name in email subject Here is my Threshold alert \[33%20AM\] I want to see e… --- ## [Help with indexing millions of rows through postgres -\> logstash -\> elasticsearch](https://discuss.elastic.co/t/help-with-indexing-millions-of-rows-through-postgres-logstash-elasticsearch/64079)
**Author:** [@dvcrn](https://discuss.elastic.co/u/dvcrn)\ **Replies:** 3\ **Last updated:** [November 2, 2016, 9:11am UTC](https://discuss.elastic.co/t/help-with-indexing-millions-of-rows-through-postgres-logstash-elasticsearch/64079 "2016-11-02T09:11:04Z")
Hi! I want to gather some advise on a problem I'm facing right now. I want/have to index millions of rows from a postgres instance in elasticsearch. Do give some scale, let's assume this data are products. A produc… --- ## ["reset" ILM failed step](https://discuss.elastic.co/t/reset-ilm-failed-step/327754)
**Author:** [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Replies:** 7\ **Last updated:** [April 18, 2023, 3:40pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754 "2023-04-18T15:40:44Z")
Hello, I've some restricted indices stuck on ILM actions because of permissions. security\_exception: action \[indices:admin/delete\] is unauthorized for user \[xxx\] with roles \[superuser\] on restricted indices \[.ds-.fleet… --- ## [API response time visualization](https://discuss.elastic.co/t/api-response-time-visualization/219981)
**Author:** [@Madhu19](https://discuss.elastic.co/u/Madhu19)\ **Replies:** 1\ **Last updated:** [February 19, 2020, 3:09pm UTC](https://discuss.elastic.co/t/api-response-time-visualization/219981 "2020-02-19T15:09:55Z")
Hi, Is it possible to visualize response time V/s API calls graph in Kibana --- ## [Auditbeat System module: Add parent process entity\_id field to process and socket events](https://discuss.elastic.co/t/auditbeat-system-module-add-parent-process-entity-id-field-to-process-and-socket-events/174610)
**Author:** [@Aaron\_Jewitt](https://discuss.elastic.co/u/Aaron_Jewitt)\ **Replies:** 7\ **Last updated:** [April 8, 2019, 3:33pm UTC](https://discuss.elastic.co/t/auditbeat-system-module-add-parent-process-entity-id-field-to-process-and-socket-events/174610 "2019-04-08T15:33:44Z")
Recommend adding the parent processes event\_id field to all System module process events as well as socket events. Having the parent processes event\_id in a process and socket event would be extremely useful when conduc… --- ## [Creating multi metric job can only use distinct count on IP](https://discuss.elastic.co/t/creating-multi-metric-job-can-only-use-distinct-count-on-ip/118218)
**Author:** [@macnibblet](https://discuss.elastic.co/u/macnibblet)\ **Replies:** 7\ **Last updated:** [February 5, 2018, 2:14pm UTC](https://discuss.elastic.co/t/creating-multi-metric-job-can-only-use-distinct-count-on-ip/118218 "2018-02-05T14:14:15Z")
Heya, Maybe I have misunderstood something when trying to setup my anomaly detection but I want to track an unusual amount of messages being sent from a sender IP and then split that by service. But for some reason in K… --- ## [ES2.0.2 - Heap near 100% and eventually Elasticsearch locks up](https://discuss.elastic.co/t/es2-0-2-heap-near-100-and-eventually-elasticsearch-locks-up/108462)
**Author:** [@Brian\_Albright](https://discuss.elastic.co/u/Brian_Albright)\ **Replies:** 7\ **Last updated:** [December 7, 2017, 3:49pm UTC](https://discuss.elastic.co/t/es2-0-2-heap-near-100-and-eventually-elasticsearch-locks-up/108462 "2017-12-07T15:49:01Z")
Hello! First post so apologies if i'm leaving something important out. We are running into some problems weekly-ish where the heap utilization floats near 100% after a while, and eventually crashes Elaticsearch, requir… --- ## [Pattern Matching](https://discuss.elastic.co/t/pattern-matching/77195)
**Author:** [@cisaksen](https://discuss.elastic.co/u/cisaksen)\ **Replies:** 7\ **Last updated:** [March 8, 2017, 1:30pm UTC](https://discuss.elastic.co/t/pattern-matching/77195 "2017-03-08T13:30:12Z")
Using grok I want to parse a log file as you normally would but i also want to pull a specific piece of of the log record in a custom field. I have 2 patterns one is a nginx\_combined with a x-forwarded field at the end… --- ## [Kafka input plugin: How many Logstash consumer threads to be used for many logstash consumers](https://discuss.elastic.co/t/kafka-input-plugin-how-many-logstash-consumer-threads-to-be-used-for-many-logstash-consumers/88437)
**Author:** [@sgarap](https://discuss.elastic.co/u/sgarap)\ **Replies:** 0\ **Last updated:** [June 6, 2017, 2:57pm UTC](https://discuss.elastic.co/t/kafka-input-plugin-how-many-logstash-consumer-threads-to-be-used-for-many-logstash-consumers/88437 "2017-06-06T14:57:13Z")
Hi, Continuing the discussion from Multiple logstash reading from a single kafka topic: I have 6 Kafka Instances running. I created a topic with 18 Partitions and 3 as a replication factor. On the other hand I have 6 l… --- ## [Creating Index/Visualization/Dashboards via REST API V 7.1](https://discuss.elastic.co/t/creating-index-visualization-dashboards-via-rest-api-v-7-1/187354)
**Author:** [@pgervais](https://discuss.elastic.co/u/pgervais)\ **Replies:** 4\ **Last updated:** [June 26, 2019, 10:08pm UTC](https://discuss.elastic.co/t/creating-index-visualization-dashboards-via-rest-api-v-7-1/187354 "2019-06-26T22:08:30Z")
I have created a web based front end to my data set. My front end program extracts the data and inserts it into ELK via logstash. I then want to create a visualization followed by dashboards via saved\_objects REST API. … --- ## [Watcher Service not working](https://discuss.elastic.co/t/watcher-service-not-working/140348)
**Author:** [@vkrishna91](https://discuss.elastic.co/u/vkrishna91)\ **Replies:** 4\ **Last updated:** [July 24, 2018, 1:02pm UTC](https://discuss.elastic.co/t/watcher-service-not-working/140348 "2018-07-24T13:02:53Z")
I have a three node elasticsearch cluster, One node is not connecting to the cluster. The elasticsearch service running on it but i saw this error. \[2018-07-17T00:00:07,000\]\[ERROR\]\[o.e.x.w.e.ExecutionService\] \[elk-data-… --- ## [How to build Beats for ArchLinux ARM](https://discuss.elastic.co/t/how-to-build-beats-for-archlinux-arm/238588)
**Author:** [@bloke](https://discuss.elastic.co/u/bloke)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 2:53am UTC](https://discuss.elastic.co/t/how-to-build-beats-for-archlinux-arm/238588 "2020-06-25T02:53:13Z")
Hi, If you know how to use ALARM (ArchLinux ARM) this will help you build beats for the distro. For technical reasons the package seems excluded on the distro. I have also done some reading on the discuss site and mostl… --- ## [Auditbeat File Integrity (Windows OS) Doesn't Capture WHO Changed Files?](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518)
**Author:** [@efaile](https://discuss.elastic.co/u/efaile)\ **Replies:** 3\ **Last updated:** [February 26, 2021, 4:30am UTC](https://discuss.elastic.co/t/auditbeat-file-integrity-windows-os-doesnt-capture-who-changed-files/265518 "2021-02-26T04:30:50Z")
We need a File Integrity Monitoring solution for Windows OS's - on the server we use as file servers . To further explain "file servers" - not to monitor remotely across shares which is not supported - but directly on th… --- ## [Elasticsearch 5.3 scripted\_metric reduce script running twice?](https://discuss.elastic.co/t/elasticsearch-5-3-scripted-metric-reduce-script-running-twice/87784)
**Author:** [@Ervin\_Puskar](https://discuss.elastic.co/u/Ervin_Puskar)\ **Replies:** 5\ **Last updated:** [June 5, 2017, 9:51am UTC](https://discuss.elastic.co/t/elasticsearch-5-3-scripted-metric-reduce-script-running-twice/87784 "2017-06-05T09:51:27Z")
I have a creeping suspicion that there is something very wrong with me putting a scripted metric inside a filter aggregation inside a terms aggregation. Here is an example of the type of query that's giving me weird be… --- ## [Siren-join query cause high io](https://discuss.elastic.co/t/siren-join-query-cause-high-io/56396)
**Author:** [@win1027](https://discuss.elastic.co/u/win1027)\ **Replies:** 5\ **Last updated:** [July 26, 2016, 1:51pm UTC](https://discuss.elastic.co/t/siren-join-query-cause-high-io/56396 "2016-07-26T13:51:47Z")
i use siren-join plugin replace es parent-child. but now many siren-join query cause machine high io. GET test\_1/1/\_coordinate\_search { "from" : 0, "size" : 50, "timeout" : 30000, "query" : { "filterjoin" … --- ## [Can I get the datepicker parameters to use in a KQL query in Kibana](https://discuss.elastic.co/t/can-i-get-the-datepicker-parameters-to-use-in-a-kql-query-in-kibana/276756)
**Author:** [@tumbledwyer](https://discuss.elastic.co/u/tumbledwyer)\ **Replies:** 2\ **Last updated:** [June 24, 2021, 1:01pm UTC](https://discuss.elastic.co/t/can-i-get-the-datepicker-parameters-to-use-in-a-kql-query-in-kibana/276756 "2021-06-24T13:01:26Z")
My data has multiple date fields so I would like to get the start and end dates from the datepicker to use in a KQL query to further filter my data in a Kibana visualisation. So let's say I have a document like this: {… --- ## [Packetbeat causing 100% CPU usage](https://discuss.elastic.co/t/packetbeat-causing-100-cpu-usage/151628)
**Author:** [@radu.capverde](https://discuss.elastic.co/u/radu.capverde)\ **Replies:** 3\ **Last updated:** [November 14, 2018, 3:53pm UTC](https://discuss.elastic.co/t/packetbeat-causing-100-cpu-usage/151628 "2018-11-14T15:53:16Z")
Hello, We have multiple VMs that are running packetbeat and on some of them (8 VMs) the CPU usage is constantly at 100% due to packetbeat. We have had one instance where one VM became completely unresponsive due to this… [Previous page](https://discuss.elastic.co/top.md?page=910&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=912&per_page=50&period=all)