# Top **URL:** https://discuss.elastic.co/top.md?page=92&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 93 --- ## [Failed shards + lost of kibana data](https://discuss.elastic.co/t/failed-shards-lost-of-kibana-data/40362)
**Author:** [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\ **Replies:** 12\ **Last updated:** [February 4, 2016, 8:42pm UTC](https://discuss.elastic.co/t/failed-shards-lost-of-kibana-data/40362 "2016-02-04T20:42:34Z")
Hi all, I faced very annoying problem. Elasticsearch crashed, all shards became in UNASSIGNED state. Errors in log 2016-01-27 13:23:27,101DEBUGaction.search.type elk-ID1 All shards failed for phase: query Remote… --- ## [X-pack\\..\\elasticsearch-env.bat"' is not recognized as an internal or external command](https://discuss.elastic.co/t/x-pack-elasticsearch-env-bat-is-not-recognized-as-an-internal-or-external-command/110641)
**Author:** [@mrba](https://discuss.elastic.co/u/mrba)\ **Replies:** 9\ **Last updated:** [December 7, 2017, 3:13pm UTC](https://discuss.elastic.co/t/x-pack-elasticsearch-env-bat-is-not-recognized-as-an-internal-or-external-command/110641 "2017-12-07T15:13:41Z")
Hello everyone, I am trying to install the x\_pack on elasticsearch i've followed every instructions in this guide I set up the elasticsearch.yml file as it says , I restart elasticsearch and in one line I get this: \[… --- ## [LS can't connect to ES with Shield](https://discuss.elastic.co/t/ls-cant-connect-to-es-with-shield/34756)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 12\ **Last updated:** [July 4, 2016, 8:34am UTC](https://discuss.elastic.co/t/ls-cant-connect-to-es-with-shield/34756 "2016-07-04T08:34:37Z")
Hey all, I've recently installed a new ES cluster with version 2.0, and Logstash at 1.5.5. This was done on 3 Centos 7.1 hosts. I'm running shield on this setup. Kibana is running behind nginx on the 1st node. I th… --- ## [Raw logs to data compression ratio](https://discuss.elastic.co/t/raw-logs-to-data-compression-ratio/305440)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 16\ **Last updated:** [May 26, 2022, 9:23am UTC](https://discuss.elastic.co/t/raw-logs-to-data-compression-ratio/305440 "2022-05-26T09:23:20Z")
Hi All, I've been investigating some compression ratios of my live logs. Two main catergories. Auditd logs and other logs like /var/log/messages etc. Both being ingested via filebeat 7.11 and running 7.11 cluster. S… --- ## [Failed to retrieve password hash for reserved user kibana\_system](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana-system/363271)
**Author:** [@Mireiabm](https://discuss.elastic.co/u/Mireiabm)\ **Replies:** 10\ **Last updated:** [July 22, 2024, 1:55am UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana-system/363271 "2024-07-22T01:55:49Z")
hi, From one day to the next, my Elasticsearch stopped working without me doing anything, and this error appears: \[2024-07-11T09:22:37,457\]\[ERROR\]\[o.e.x.s.a.e.ReservedRealm\] \[prod-1\] failed to retrieve password hash for… --- ## [Reporting the most common log errors with Logstash 2.3.4](https://discuss.elastic.co/t/reporting-the-most-common-log-errors-with-logstash-2-3-4/60750)
**Author:** [@KIVagant](https://discuss.elastic.co/u/KIVagant)\ **Replies:** 10\ **Last updated:** [September 19, 2016, 2:45pm UTC](https://discuss.elastic.co/t/reporting-the-most-common-log-errors-with-logstash-2-3-4/60750 "2016-09-19T14:45:17Z")
Hello. This question is a same as this oldest question but in context of Logstash 2. I trying to get top N of errors from all logs entries with data table visualisation. But, I don't have the "message.raw" field that i… --- ## [How to create a pie chart of same value with two different filters](https://discuss.elastic.co/t/how-to-create-a-pie-chart-of-same-value-with-two-different-filters/296127)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 17\ **Last updated:** [February 11, 2022, 1:20am UTC](https://discuss.elastic.co/t/how-to-create-a-pie-chart-of-same-value-with-two-different-filters/296127 "2022-02-11T01:20:38Z")
I would like to create a pie chart based on two different filters and put the two values in a pie chart to have two sections value to be percentage of the sum of the two values. Is this doable? --- ## [Unable to export Kibana dashboard](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard/298080)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 23\ **Last updated:** [March 17, 2022, 2:06pm UTC](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard/298080 "2022-03-17T14:06:08Z")
Hi All. I am using ELK7.6.2 stack. When I try to export a dashboard I get a 404 error. Please see below $ curl -k -u user:password -X GET "http://\`hostname\`:5601/api/kibana/dashboards/export?dashboard=93454870-94dc-11e… --- ## [Load balance output between multiple hosts](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694)
**Author:** [@xShadow](https://discuss.elastic.co/u/xShadow)\ **Replies:** 9\ **Last updated:** [July 18, 2018, 8:26am UTC](https://discuss.elastic.co/t/load-balance-output-between-multiple-hosts/139694 "2018-07-18T08:26:44Z")
Hi, I have a logstash instance with multiple hosts output. According to the documentation, logstash should load balance across the hosts specified. However, I am receiving the logs on both of the elasticsearch instance. … --- ## [Parsing message using Grok filter](https://discuss.elastic.co/t/parsing-message-using-grok-filter/187424)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 12\ **Last updated:** [June 28, 2019, 2:21pm UTC](https://discuss.elastic.co/t/parsing-message-using-grok-filter/187424 "2019-06-28T14:21:26Z")
Hi, I am trying to drop a couple of words in a message. /test/data/user/log1/xyz How can I drop the first two words "test" and "data" only when the message starts with "/test" and store username=user and file=log1/xyz… --- ## [Visual Basic Examples for ElasticSearch.net and NEST](https://discuss.elastic.co/t/visual-basic-examples-for-elasticsearch-net-and-nest/226304)
**Author:** [@kvickery](https://discuss.elastic.co/u/kvickery)\ **Replies:** 16\ **Last updated:** [April 17, 2020, 11:56pm UTC](https://discuss.elastic.co/t/visual-basic-examples-for-elasticsearch-net-and-nest/226304 "2020-04-17T23:56:41Z")
Hi. I am trying to update a Visual Basic project to use the new Elasticsearch.Net and NEST api versions. Unfortunately whenever I try to find examples all I can find is c#. Can anyone show me some examples of the foll… --- ## [X-Pack Watcher: multiple emails in to/cc fields via template](https://discuss.elastic.co/t/x-pack-watcher-multiple-emails-in-to-cc-fields-via-template/76058)
**Author:** [@sova](https://discuss.elastic.co/u/sova)\ **Replies:** 9\ **Last updated:** [October 16, 2017, 9:11am UTC](https://discuss.elastic.co/t/x-pack-watcher-multiple-emails-in-to-cc-fields-via-template/76058 "2017-10-16T09:11:09Z")
Hello all, Brief intro: I'm creating watcher alerts with send email actions. Email fields TO and CC are calculatable, so known only after watch execution and can be transformed before the action. As noted in the documen… --- ## [EsHadoopInvalidRequest: \[POST\]](https://discuss.elastic.co/t/eshadoopinvalidrequest-post/31635)
**Author:** [@Sar82](https://discuss.elastic.co/u/Sar82)\ **Replies:** 9\ **Last updated:** [December 18, 2015, 12:37pm UTC](https://discuss.elastic.co/t/eshadoopinvalidrequest-post/31635 "2015-12-18T12:37:49Z")
Hello I am trying to read data from ElasticSearch. My Code is as follows, SparkConf sparkConf = new SparkConf() .setAppName("Spark ES Integration").setMaster("local"); // .set("spark.ui.port", "7077"); sparkConf.… --- ## [Credentials for elastic-operator](https://discuss.elastic.co/t/credentials-for-elastic-operator/212628)
**Author:** [@xyphr](https://discuss.elastic.co/u/xyphr)\ **Replies:** 9\ **Last updated:** [December 23, 2019, 1:57pm UTC](https://discuss.elastic.co/t/credentials-for-elastic-operator/212628 "2019-12-23T13:57:52Z")
Hi, For our use case we are using a security plugin "readonlyrest". It seems the elastic operator is not compatible with this plugin OOTB. The requests being made by the operator is being blocked by this plugin, and I s… --- ## [NEST Brings down the whole Webserver](https://discuss.elastic.co/t/nest-brings-down-the-whole-webserver/217693)
**Author:** [@han1](https://discuss.elastic.co/u/han1)\ **Replies:** 38\ **Last updated:** [February 6, 2020, 7:55pm UTC](https://discuss.elastic.co/t/nest-brings-down-the-whole-webserver/217693 "2020-02-06T19:55:45Z")
Does anyone realize that the NEST Library brings down a whole web server? Does anyone even care about such a Humongous bug! Gone Warkolm - Close this thread to save EMBARRASSMENT(as you unusually do) instead of acknowl… --- ## [LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\]](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 15\ **Last updated:** [February 16, 2021, 3:27am UTC](https://discuss.elastic.co/t/logstash-configurationerror-message-expected-one-of-a-za-z0-9/264315 "2021-02-16T03:27:30Z")
Hi Guys, Good Day!! I am facing the issue while staring the logstash. LogStash::ConfigurationError", :message=\>"Expected one of \[A-Za-z0-9\_-\] \[ \\t\\r\\n\], "#", "{", \[A-Za-z0-9\_\], "}" at line 49, column 31 (byte 1290) af… --- ## [Logstash goes wrong after add filter](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 26\ **Last updated:** [July 21, 2021, 10:20am UTC](https://discuss.elastic.co/t/logstash-goes-wrong-after-add-filter/278730 "2021-07-21T10:20:07Z")
Hello everyone, I install Logstash in Ubuntu 18 with two conf.d file input and output. Everything run normally. But when I add 10-syslog-filter.conf something went wrong. 02-beat-input.conf input { beats { host… --- ## [Getting APM metrics using the/an API](https://discuss.elastic.co/t/getting-apm-metrics-using-the-an-api/292614)
**Author:** [@Maxi\_Donadio](https://discuss.elastic.co/u/Maxi_Donadio)\ **Replies:** 10\ **Last updated:** [December 22, 2021, 8:15pm UTC](https://discuss.elastic.co/t/getting-apm-metrics-using-the-an-api/292614 "2021-12-22T20:15:19Z")
Hi! I'm have the elastic APM set up on some machines. It's working quite well and all the stats are showing perfectly fine, but I don't want to use just the GUI. I'd like to get metrics (CPU Usage, Disk Usage, etc) for … --- ## [Version check on update?](https://discuss.elastic.co/t/version-check-on-update/11953)
**Author:** [@Chris2048](https://discuss.elastic.co/u/Chris2048)\ **Replies:** 13\ **Last updated:** [May 20, 2013, 10:22pm UTC](https://discuss.elastic.co/t/version-check-on-update/11953 "2013-05-20T22:22:48Z")
Sorry to repost an issue, but I thought I this might be seen by more people here: I'm trying to use version checking with document updates using the Java API, but I'm not sure how; there is no 'setVersion' option… --- ## [How to read custom log files using filebeat](https://discuss.elastic.co/t/how-to-read-custom-log-files-using-filebeat/276386)
**Author:** [@robertashok](https://discuss.elastic.co/u/robertashok)\ **Replies:** 12\ **Last updated:** [July 26, 2021, 3:00pm UTC](https://discuss.elastic.co/t/how-to-read-custom-log-files-using-filebeat/276386 "2021-07-26T15:00:18Z")
I have following TCS.log in seperate folder 2021/06/13 17:58:42 : INFO | Stock = TCS.NS, Date = 2002-08-12 2021/06/13 17:58:42 : INFO | Volume=212976 2021/06/13 17:58:42 : INFO | Low=38.724998474121094 2021… --- ## [X-pack watch: error while sending mail with PDF attachment](https://discuss.elastic.co/t/x-pack-watch-error-while-sending-mail-with-pdf-attachment/90640)
**Author:** [@kiranilla](https://discuss.elastic.co/u/kiranilla)\ **Replies:** 9\ **Last updated:** [July 5, 2017, 9:27am UTC](https://discuss.elastic.co/t/x-pack-watch-error-while-sending-mail-with-pdf-attachment/90640 "2017-07-05T09:27:09Z")
I have configured the watch for an index and saved successfully . Below is the code snippet for actions{...} section only. "actions": { "send\_email": { "email": { "profile": "standard", "a… --- ## [Out of Memory Error](https://discuss.elastic.co/t/out-of-memory-error/32561)
**Author:** [@Doug\_Swanson](https://discuss.elastic.co/u/Doug_Swanson)\ **Replies:** 10\ **Last updated:** [December 14, 2015, 8:13pm UTC](https://discuss.elastic.co/t/out-of-memory-error/32561 "2015-12-14T20:13:10Z")
We got an OOM error earlier this week and it looks like some resource other then memory may be the problem. These boxes have 64GB, 30GB allocated to java heap. At the time of the error they were all using around 30%-35… --- ## [How fast can we achieve in theory using "match\_phrase" query on 30M document index](https://discuss.elastic.co/t/how-fast-can-we-achieve-in-theory-using-match-phrase-query-on-30m-document-index/118756)
**Author:** [@LukeYang](https://discuss.elastic.co/u/LukeYang)\ **Replies:** 9\ **Last updated:** [February 20, 2018, 12:28pm UTC](https://discuss.elastic.co/t/how-fast-can-we-achieve-in-theory-using-match-phrase-query-on-30m-document-index/118756 "2018-02-20T12:28:26Z")
We are doing a project to use ElasticSearch as searching engine for the large amount of text content. The goal is to offer Full text search capacity to retrieve first 10 document based on phrases user provides within 30M… --- ## [Problem with accents](https://discuss.elastic.co/t/problem-with-accents/185565)
**Author:** [@soufiane1](https://discuss.elastic.co/u/soufiane1)\ **Replies:** 11\ **Last updated:** [June 18, 2019, 1:31pm UTC](https://discuss.elastic.co/t/problem-with-accents/185565 "2019-06-18T13:31:21Z")
Hello everyone, I am trying to load data from a csv file to elasticsearch, but I can't get the accents "é", I get \\xE0 for "à", there is some solution to solve this ? Here is my config, and the accents exist in the co… --- ## [Logstash Extract Elasticsearch Nested Fields](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 28\ **Last updated:** [June 16, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451 "2021-06-16T14:13:37Z")
Hello Team I am using Elasticsearch version 7.8.0 and Logstash version 7.8.0 I am having ES Index having following mappings : "mappings" : { "properties" : { "appEvents" : { "properties" : … --- ## [Create new field from query](https://discuss.elastic.co/t/create-new-field-from-query/263892)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 17\ **Last updated:** [February 16, 2021, 11:57am UTC](https://discuss.elastic.co/t/create-new-field-from-query/263892 "2021-02-16T11:57:03Z")
I got a query which creates a new field sophos.utm.to.domain. That query extracts the full mail domain. The mail address which is stored in sophos.utm.to. My Question: How do I create a new field out of this query? --- ## [Unrecognized @timestamp value type=class org.jruby.RubyFloat](https://discuss.elastic.co/t/unrecognized-timestamp-value-type-class-org-jruby-rubyfloat/243560)
**Author:** [@111266](https://discuss.elastic.co/u/111266)\ **Replies:** 10\ **Last updated:** [August 3, 2020, 4:08pm UTC](https://discuss.elastic.co/t/unrecognized-timestamp-value-type-class-org-jruby-rubyfloat/243560 "2020-08-03T16:08:22Z")
Use: "logstash.version"=\>"7.8.0" kafka\_2.13-2.5.0 Config: input { kafka { bootstrap\_servers =\> "ip:port" auto\_offset\_reset =\> "earliest" enable\_auto\_commit =\> true topics =\> \["logs… --- ## [Index name date math with wildcard?](https://discuss.elastic.co/t/index-name-date-math-with-wildcard/63541)
**Author:** [@josephswick](https://discuss.elastic.co/u/josephswick)\ **Replies:** 10\ **Last updated:** [October 25, 2016, 1:46pm UTC](https://discuss.elastic.co/t/index-name-date-math-with-wildcard/63541 "2016-10-25T13:46:04Z")
When using the index date math, is there a way to be able to add a wildcard into the index name reference? As some background information, I'm setting up a watch to look for errors in the logs for multiple different dy… --- ## [Can't start auditbeat](https://discuss.elastic.co/t/cant-start-auditbeat/255097)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 24\ **Last updated:** [November 22, 2020, 10:18am UTC](https://discuss.elastic.co/t/cant-start-auditbeat/255097 "2020-11-22T10:18:32Z")
I have installed auditbeat (latest version). This is my config file (I hid the output.logstash/kibana part as it's irrelevant and has sensitive data. Also, it doesn't even have audit rules - it didn't work before so I r… --- ## [Grok pattern working fine in grok debugger but the same pattern is not working when running with logstash](https://discuss.elastic.co/t/grok-pattern-working-fine-in-grok-debugger-but-the-same-pattern-is-not-working-when-running-with-logstash/111150)
**Author:** [@govinda.rao](https://discuss.elastic.co/u/govinda.rao)\ **Replies:** 13\ **Last updated:** [January 4, 2018, 2:30pm UTC](https://discuss.elastic.co/t/grok-pattern-working-fine-in-grok-debugger-but-the-same-pattern-is-not-working-when-running-with-logstash/111150 "2018-01-04T14:30:43Z")
Hi, I am using below pattern to parse below Log, the pattern is working fine grok debugger but failing when running in logstash. Please help Grok Pattern: %{DATA:hour}:%{DATA:minute}:%{DATA:second},%{DATA:milisecond} %{… --- ## [Winlogbeat suddenly stop when started - Windows 2003 64-bit](https://discuss.elastic.co/t/winlogbeat-suddenly-stop-when-started-windows-2003-64-bit/116369)
**Author:** [@poper](https://discuss.elastic.co/u/poper)\ **Replies:** 14\ **Last updated:** [February 8, 2018, 2:00am UTC](https://discuss.elastic.co/t/winlogbeat-suddenly-stop-when-started-windows-2003-64-bit/116369 "2018-02-08T02:00:07Z")
Hi There, I got the winlogbeat suddenly stop when I run the service. See in my system log said. ID: 7034 The winlogbeat service terminated unexpectedly. It has done this 3 time(s). I run winlogbeat in version 6.1.1 … --- ## [Kubernetes metadata](https://discuss.elastic.co/t/kubernetes-metadata/90865)
**Author:** [@djschny](https://discuss.elastic.co/u/djschny)\ **Replies:** 16\ **Last updated:** [June 28, 2017, 9:39am UTC](https://discuss.elastic.co/t/kubernetes-metadata/90865 "2017-06-28T09:39:03Z")
I'm trying to test the new kubernetes metadata features that were added to beats and therefore would like to pull the docker image for the alpha, but it appears it is not being published. Could it be published please? … --- ## [Unable to connect the AGENT with the Server](https://discuss.elastic.co/t/unable-to-connect-the-agent-with-the-server/146536)
**Author:** [@kranthi\_851](https://discuss.elastic.co/u/kranthi_851)\ **Replies:** 10\ **Last updated:** [August 31, 2018, 6:05am UTC](https://discuss.elastic.co/t/unable-to-connect-the-agent-with-the-server/146536 "2018-08-31T06:05:43Z")
Hi All, This is my server output after starting the api-server: apm-server: host: "192.168.0.95:8200" rum: # To enable real user monitoring (RUM) support set this to true. enabled: true #==================== El… --- ## [Troubleshoot "low" Logstash -\> ES indexing rate](https://discuss.elastic.co/t/troubleshoot-low-logstash-es-indexing-rate/77558)
**Author:** [@gleroy](https://discuss.elastic.co/u/gleroy)\ **Replies:** 16\ **Last updated:** [March 16, 2017, 8:33pm UTC](https://discuss.elastic.co/t/troubleshoot-low-logstash-es-indexing-rate/77558 "2017-03-16T20:33:38Z")
Hello, I have indexing issues with elasticsearch 5.1, recently. In logstash 5.2, I have a lot of errors like that: \[2017-03-06T15:39:12,413\]\[INFO \]\[logstash.outputs.elasticsearch\] retrying failed action with respon… --- ## [Elasticsearch 7.13](https://discuss.elastic.co/t/elasticsearch-7-13/275410)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 25\ **Last updated:** [July 13, 2021, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-7-13/275410 "2021-07-13T09:03:06Z")
\`rypoint\[1835\]: Exception in thread "main" java.lang.RuntimeException: starting java failed with \[1\] rypoint\[1835\]: output: rypoint\[1835\]: \[0.029s\]\[error\]\[logging\] Error opening log file '/var/log/elasticsearch/gc.log': … --- ## [Logstash output to Elasticsearch name index based on field?](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-name-index-based-on-field/264584)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 11\ **Last updated:** [February 23, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-name-index-based-on-field/264584 "2021-02-23T16:18:24Z")
Hello. Im trying to name a index based on a field but it doesnt seem to work: output { elasticsearch { hosts =\> \["localhost"\] user =\> \["elastic"\] password =\> \["pass"\] index =\> "winlogbeat-server-winapplication-%{… --- ## [Multiline config for filebeat](https://discuss.elastic.co/t/multiline-config-for-filebeat/43458)
**Author:** [@kasi](https://discuss.elastic.co/u/kasi)\ **Replies:** 10\ **Last updated:** [March 10, 2016, 11:43am UTC](https://discuss.elastic.co/t/multiline-config-for-filebeat/43458 "2016-03-10T11:43:40Z")
what will be the multiline config for the following stack trace, I have tried everything nothing seems to work. Any help much appreciated Stack Trace: TID: \[0\] \[BAM\] \[2015-11-27 23:51:19,549\] ERROR {org.wso2.carbon.… --- ## [Reading Old Log files](https://discuss.elastic.co/t/reading-old-log-files/39620)
**Author:** [@novice](https://discuss.elastic.co/u/novice)\ **Replies:** 11\ **Last updated:** [January 20, 2016, 9:37am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620 "2016-01-20T09:37:30Z")
Hi, I have ELK Server setup and the logstash keeps reading the old files along with the new ones. How can I prevent that? --- ## [Disk space is increasing](https://discuss.elastic.co/t/disk-space-is-increasing/195056)
**Author:** [@Rajeev\_Prakash](https://discuss.elastic.co/u/Rajeev_Prakash)\ **Replies:** 10\ **Last updated:** [August 22, 2019, 2:16pm UTC](https://discuss.elastic.co/t/disk-space-is-increasing/195056 "2019-08-22T14:16:17Z")
Our Elasticsearch servers are configured with multiple nodes in a single cluster. But for only one elastisearch node diskspace is increasing more when compared with other nodes in cluster. We were clearing the old indi… --- ## [Dynamic color changing text box based on Pipeline Build Status](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443)
**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\ **Replies:** 22\ **Last updated:** [November 22, 2020, 12:20pm UTC](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443 "2020-11-22T12:20:20Z")
Hello , I am trying to create a textbox whose background color will change based on the status of the latest build. I need this visualization on Dashboard rather than on canvas. Thanks, Sachin --- ## [Need Help with Hardware configuration for EK-Stack for 2.5 TB of data per day](https://discuss.elastic.co/t/need-help-with-hardware-configuration-for-ek-stack-for-2-5-tb-of-data-per-day/112607)
**Author:** [@es\_noobb](https://discuss.elastic.co/u/es_noobb)\ **Replies:** 18\ **Last updated:** [December 26, 2017, 12:10pm UTC](https://discuss.elastic.co/t/need-help-with-hardware-configuration-for-ek-stack-for-2-5-tb-of-data-per-day/112607 "2017-12-26T12:10:03Z")
Hi everyone, this is my first post here. I am planning to deploy a cluster which will get around 2.5 TB of data per day. These logs will be parsed locally on a few logstash instances and will be sent to AWS which will ho… --- ## [Use conditional if in a Set processor](https://discuss.elastic.co/t/use-conditional-if-in-a-set-processor/184971)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 10\ **Last updated:** [June 12, 2019, 1:31pm UTC](https://discuss.elastic.co/t/use-conditional-if-in-a-set-processor/184971 "2019-06-12T13:31:22Z")
Hi there! Title is kinda explicative. How do I use a set processor in an ingest pipeline only if another field exists? I mean, I want to copy the value of field\_A into another field\_B only if field\_A does exist. Guess… --- ## [Metricbeat Apache Info](https://discuss.elastic.co/t/metricbeat-apache-info/117125)
**Author:** [@elJoeyJojo](https://discuss.elastic.co/u/elJoeyJojo)\ **Replies:** 10\ **Last updated:** [February 8, 2018, 6:06pm UTC](https://discuss.elastic.co/t/metricbeat-apache-info/117125 "2018-02-08T18:06:01Z")
I've setup the metricbeat config on 3 servers (1 of them is the kibana/elasticsearch host) and i am able to see the logs/dashboards for system overall, cpu, memory etc.. I enabled the apache and mysql module on all 3 ser… --- ## [Replace Log4j from 2.11.0 to 2.15.0](https://discuss.elastic.co/t/replace-log4j-from-2-11-0-to-2-15-0/291901)
**Author:** [@njain213](https://discuss.elastic.co/u/njain213)\ **Replies:** 9\ **Last updated:** [January 6, 2022, 9:01am UTC](https://discuss.elastic.co/t/replace-log4j-from-2-11-0-to-2-15-0/291901 "2022-01-06T09:01:31Z")
Hello Team, I am using logstash 7.5.1 and having log4j jar as 2.11.1. Now as per doc https://discuss.elastic.co/ it is mentioned to remove JNDI class if we don't want to upgrade logstash. Is it possible if I can upgrade… --- ## [Is it possible getting parent doc's score in nested query?](https://discuss.elastic.co/t/is-it-possible-getting-parent-docs-score-in-nested-query/69727)
**Author:** [@Youxu](https://discuss.elastic.co/u/Youxu)\ **Replies:** 11\ **Last updated:** [December 27, 2016, 1:02pm UTC](https://discuss.elastic.co/t/is-it-possible-getting-parent-docs-score-in-nested-query/69727 "2016-12-27T13:02:15Z")
For example, I have an index with following mapping: { "mappings": { "docs": { "properties": { "QueryClicks": { "type": "nested", "properties": { "Cou… --- ## [Filebeat locks file when logstash is not runnig](https://discuss.elastic.co/t/filebeat-locks-file-when-logstash-is-not-runnig/66719)
**Author:** [@eluppol](https://discuss.elastic.co/u/eluppol)\ **Replies:** 11\ **Last updated:** [November 25, 2016, 10:24am UTC](https://discuss.elastic.co/t/filebeat-locks-file-when-logstash-is-not-runnig/66719 "2016-11-25T10:24:27Z")
I'm using filebeat to ship logs created by log4cxx to ELK stack. When filebeat is running but logstash is not available, log4cxx cannot rotate log file, so it becomes large (log generation speed is about 4 MB per minute,… --- ## [Récupérer le nom des champs de mon index](https://discuss.elastic.co/t/recuperer-le-nom-des-champs-de-mon-index/183331)
**Author:** [@Simon\_Ledoit](https://discuss.elastic.co/u/Simon_Ledoit)\ **Replies:** 15\ **Last updated:** [June 4, 2019, 10:25am UTC](https://discuss.elastic.co/t/recuperer-le-nom-des-champs-de-mon-index/183331 "2019-06-04T10:25:25Z")
Bonjour à tous, Je débute avec la suite ELK et mon projet et de créer un plugin contenant 3 visualisation (un peu comme un dashboard). Mon problème et le suivant je requête Elasticsearch qui me renvoie le bon index mai… --- ## [Sending ganglia metric to logstash and the displaying them on kibana](https://discuss.elastic.co/t/sending-ganglia-metric-to-logstash-and-the-displaying-them-on-kibana/40567)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 12\ **Last updated:** [February 2, 2016, 7:34pm UTC](https://discuss.elastic.co/t/sending-ganglia-metric-to-logstash-and-the-displaying-them-on-kibana/40567 "2016-02-02T19:34:18Z")
Hi All, I was able to send some metrics of ganglia to logstash. Here is my input configuration input { lumberjack { port =\> 5043 type =\> "logs" ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_ke… --- ## [Elasticsearch Errors - Failed action \[500\]](https://discuss.elastic.co/t/elasticsearch-errors-failed-action-500/79289)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 13\ **Last updated:** [March 24, 2017, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-errors-failed-action-500/79289 "2017-03-24T14:15:36Z")
I am setting up a new index on my cluster just for my firewall logs. I average about 5 million per hour across all my sites. Upon getting the index defined and configuring Logstash to target that index, I am now getting … --- ## [EC2 discovery issue](https://discuss.elastic.co/t/ec2-discovery-issue/4772)
**Author:** [@Ridvan\_Gyundogan](https://discuss.elastic.co/u/Ridvan_Gyundogan)\ **Replies:** 29\ **Last updated:** [July 13, 2016, 11:28am UTC](https://discuss.elastic.co/t/ec2-discovery-issue/4772 "2016-07-13T11:28:47Z")
Hi, I am trying to run 2 ec2 instances according to the following article http://www.elasticsearch.org/guide/reference/modules/discovery/ec2.html. This is my config/elasticsearch.yml: cluster: name: perftests … [Previous page](https://discuss.elastic.co/top.md?page=91&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=93&per_page=50&period=all)