# Top **URL:** https://discuss.elastic.co/top.md?page=921&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 922 --- ## [Filebeat initializing error for s3](https://discuss.elastic.co/t/filebeat-initializing-error-for-s3/269137)
**Author:** [@paano](https://discuss.elastic.co/u/paano)\ **Replies:** 4\ **Last updated:** [April 3, 2021, 2:48pm UTC](https://discuss.elastic.co/t/filebeat-initializing-error-for-s3/269137 "2021-04-03T14:48:41Z")
I am trying to follow as explained in the elastic blog And getting error: 2021-04-03T01:04:23.845Z ERROR instance/beat.go:971 Exiting: Failed to start crawler: starting input failed: Error while initializing input: Err… --- ## [Elasticsearch performance is not increasing by adding new nodes](https://discuss.elastic.co/t/elasticsearch-performance-is-not-increasing-by-adding-new-nodes/50072)
**Author:** [@hosseinjdk](https://discuss.elastic.co/u/hosseinjdk)\ **Replies:** 4\ **Last updated:** [May 17, 2016, 5:35am UTC](https://discuss.elastic.co/t/elasticsearch-performance-is-not-increasing-by-adding-new-nodes/50072 "2016-05-17T05:35:58Z")
we have installed Elasticsearch Cluster on VMware Virtual machine nodes, on the other side we have a java application that run queries on elasticsearch using Transport Client. one of the indexes contains 500,000,000 Docu… --- ## [Can ES handle my traffic load?](https://discuss.elastic.co/t/can-es-handle-my-traffic-load/27250)
**Author:** [@N\_M\_10](https://discuss.elastic.co/u/N_M_10)\ **Replies:** 4\ **Last updated:** [August 14, 2015, 10:07pm UTC](https://discuss.elastic.co/t/can-es-handle-my-traffic-load/27250 "2015-08-14T22:07:37Z")
We are using ES for searching only, our server is AWS, there we have say 3 node/machine , each having its own ES cluster with 1 node only (which is master+data) but they are independent cluster, and we have our own load … --- ## [Comparing multiple timestamp fields](https://discuss.elastic.co/t/comparing-multiple-timestamp-fields/20551)
**Author:** [@vijay\_karmani](https://discuss.elastic.co/u/vijay_karmani)\ **Replies:** 6\ **Last updated:** [January 14, 2016, 2:38pm UTC](https://discuss.elastic.co/t/comparing-multiple-timestamp-fields/20551 "2016-01-14T14:38:39Z")
I've document structure like { username : abc login\_timestamp : 2014-04-11 11:05:00 AM logout\_timestamp : 2014-04-11 11:30:00 AM }, { username : def login\_timestamp : 2014-04-11 11:15:00 AM logout\_timesta… --- ## [How do you build query suggester like Google/Amazon? Suggest by token instead of suggesting a result](https://discuss.elastic.co/t/how-do-you-build-query-suggester-like-google-amazon-suggest-by-token-instead-of-suggesting-a-result/213268)
**Author:** [@Brac\_Macke](https://discuss.elastic.co/u/Brac_Macke)\ **Replies:** 0\ **Last updated:** [December 28, 2019, 9:40pm UTC](https://discuss.elastic.co/t/how-do-you-build-query-suggester-like-google-amazon-suggest-by-token-instead-of-suggesting-a-result/213268 "2019-12-28T21:40:16Z")
This feature is available on Elastic App Search, but I want to implement this kind of suggestion using Elasticsearch. I've been messing around this for 3 days straight with no luck. My closest approach to this is to u… --- ## [How to connect MS Sql server in windows?](https://discuss.elastic.co/t/how-to-connect-ms-sql-server-in-windows/107357)
**Author:** [@divik](https://discuss.elastic.co/u/divik)\ **Replies:** 5\ **Last updated:** [November 14, 2017, 7:30am UTC](https://discuss.elastic.co/t/how-to-connect-ms-sql-server-in-windows/107357 "2017-11-14T07:30:05Z")
First i have one doubt im using elasticsearch 5.6.3 and jdbc is elasticsearch-jdbc-2.3.3.1.. is it fine or is it wrong?? Im using windows 7. and i installed elasticsearch 5.6.3 its shows {strong text "name" : "5uyIjly… --- ## [Multi DC cluster or separate cluster per DC?](https://discuss.elastic.co/t/multi-dc-cluster-or-separate-cluster-per-dc/17373)
**Author:** [@Sebastian\_Laskawiec](https://discuss.elastic.co/u/Sebastian_Laskawiec)\ **Replies:** 5\ **Last updated:** [May 15, 2014, 7:23am UTC](https://discuss.elastic.co/t/multi-dc-cluster-or-separate-cluster-per-dc/17373 "2014-05-15T07:23:29Z")
Hi! I'd like to ask for advice about deployment in multi DC scenario. Currently we operate on 2 Data Centers in active/standby mode. like to opeIn case of ES we'd like to have different approach - we'drate in a… --- ## [Aggregate filter plugin events not adding to elasticsearch index](https://discuss.elastic.co/t/aggregate-filter-plugin-events-not-adding-to-elasticsearch-index/189610)
**Author:** [@rohith1570](https://discuss.elastic.co/u/rohith1570)\ **Replies:** 8\ **Last updated:** [July 10, 2019, 6:38pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-events-not-adding-to-elasticsearch-index/189610 "2019-07-10T18:38:26Z")
Hi, In stdout i'm able to see the Aggregate events got printed, but not able to see in elasticsearch index. logstash conf: filter { if \[user.id\] != "" and \[user.id\] != 'null' and \[user.id\] != 'error' { aggrega… --- ## [How to send grok field into ruby](https://discuss.elastic.co/t/how-to-send-grok-field-into-ruby/133381)
**Author:** [@veerendranath\_lukkan](https://discuss.elastic.co/u/veerendranath_lukkan)\ **Replies:** 8\ **Last updated:** [May 28, 2018, 11:54am UTC](https://discuss.elastic.co/t/how-to-send-grok-field-into-ruby/133381 "2018-05-28T11:54:50Z")
filter{ grok{ match =\>{"message" =\> "%{GREEDYDATA:selectedMessage}"} } Ruby{ path ="test.rb" script\_params =\> { "percentage" =\> selectedMessage } } } how can send any example! --- ## [How can I send alerts to telegram?](https://discuss.elastic.co/t/how-can-i-send-alerts-to-telegram/303652)
**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\ **Replies:** 1\ **Last updated:** [May 4, 2022, 3:51pm UTC](https://discuss.elastic.co/t/how-can-i-send-alerts-to-telegram/303652 "2022-05-04T15:51:38Z")
Hello community, how can I send alerts to telegram? --- ## [Dashboard User cant see any data](https://discuss.elastic.co/t/dashboard-user-cant-see-any-data/122461)
**Author:** [@AQ\_Amra](https://discuss.elastic.co/u/AQ_Amra)\ **Replies:** 1\ **Last updated:** [March 5, 2018, 6:42pm UTC](https://discuss.elastic.co/t/dashboard-user-cant-see-any-data/122461 "2018-03-05T18:42:52Z")
I have a Dashboard and now I want to create a user that is allowed to view this dashboard. I want the user to be able to change the date range on the search as well as filter the data using the search filter bar. I fol… --- ## [Filebeat Inputs: Docker vs Log with options](https://discuss.elastic.co/t/filebeat-inputs-docker-vs-log-with-options/155122)
**Author:** [@justinw](https://discuss.elastic.co/u/justinw)\ **Replies:** 2\ **Last updated:** [November 4, 2018, 1:43am UTC](https://discuss.elastic.co/t/filebeat-inputs-docker-vs-log-with-options/155122 "2018-11-04T01:43:03Z")
Out of curiosity, what's the difference between the two: - type: log paths: - /var/lib/docker/containers/\*/\*-json.log json.keys\_under\_root: true json.add\_error\_key: true json.message\_key: log ## assume downs… --- ## [Logstash | elasticsearch - Encountered a retryable error](https://discuss.elastic.co/t/logstash-elasticsearch-encountered-a-retryable-error/114418)
**Author:** [@rrs](https://discuss.elastic.co/u/rrs)\ **Replies:** 2\ **Last updated:** [January 7, 2018, 4:42pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-encountered-a-retryable-error/114418 "2018-01-07T16:42:56Z")
We have setup ELK 5.6.3 in cluster method and everything in each layer is running fine, but logstash keep reporting below error even the port 5044 in listening state. Can anyone help me out here. \[ERROR\] 2018-01-07 11:1… --- ## [Strange, very slow performance despite of lots of CPU/RAM resources](https://discuss.elastic.co/t/strange-very-slow-performance-despite-of-lots-of-cpu-ram-resources/98378)
**Author:** [@woytekm](https://discuss.elastic.co/u/woytekm)\ **Replies:** 2\ **Last updated:** [August 28, 2017, 10:22pm UTC](https://discuss.elastic.co/t/strange-very-slow-performance-despite-of-lots-of-cpu-ram-resources/98378 "2017-08-28T22:22:02Z")
Hello, i have migrated ELK cluster to new hardware, and also upgraded ELK to 5.5.2. Cluster consists of: master node 2CPU 5G RAM 12 data nodes with 6 CPU/12G RAM 3 ingest nodes with 6 CPU/6G RAM 3 logstash nodes with … --- ## [Is dense\_vector field available in AWS Elasticsearch Service?](https://discuss.elastic.co/t/is-dense-vector-field-available-in-aws-elasticsearch-service/243845)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 3\ **Last updated:** [August 5, 2020, 10:34am UTC](https://discuss.elastic.co/t/is-dense-vector-field-available-in-aws-elasticsearch-service/243845 "2020-08-05T10:34:14Z")
I would like to use dense\_vector field (https://www.elastic.co/guide/en/elasticsearch/reference/current/dense-vector.html) while it seems to be contained in X-Pack. Is it available in AWS Elasticsearch Service too? P.S… --- ## [TASK doesn't support cancellation](https://discuss.elastic.co/t/task-doesnt-support-cancellation/234852)
**Author:** [@realyn\_elastic](https://discuss.elastic.co/u/realyn_elastic)\ **Replies:** 3\ **Last updated:** [June 9, 2020, 5:29pm UTC](https://discuss.elastic.co/t/task-doesnt-support-cancellation/234852 "2020-06-09T17:29:38Z")
Can help to enlighten why I cannot cancel this task { "completed" : false, "task" : { "node" : "Vzjnc-d2SuOZ07\_6LCyl2A", "id" : 4779394, "type" : "transport", "action" : "cluster:admin/xpack/monitoring/bulk", "de… --- ## [Mapping http\_poller JSON to an index](https://discuss.elastic.co/t/mapping-http-poller-json-to-an-index/86756)
**Author:** [@digs\_77](https://discuss.elastic.co/u/digs_77)\ **Replies:** 3\ **Last updated:** [May 23, 2017, 6:52am UTC](https://discuss.elastic.co/t/mapping-http-poller-json-to-an-index/86756 "2017-05-23T06:52:23Z")
This is a representation of a JSON array (widgets) I'm getting with the http\_poller plugin... { "ABC\_123": {"id": 7, "cost": 1.02, "sales\_volume": 6}, "3BT\_8RT": {"id": 84, "cost": .025, "sales\_volume":… --- ## [Field Data Cache Evictions](https://discuss.elastic.co/t/field-data-cache-evictions/44980)
**Author:** [@anshulagrawal](https://discuss.elastic.co/u/anshulagrawal)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 7:04am UTC](https://discuss.elastic.co/t/field-data-cache-evictions/44980 "2016-03-22T07:04:45Z")
Hi, We have our field data configured at 40% of available heap size (which is currently configured to 122 GB) which comes to 48.8 GB. But we are seeing evictions at a number of 835 and field data reaches 47.7 B easily. … --- ## [Specific node can not requsts from logstash](https://discuss.elastic.co/t/specific-node-can-not-requsts-from-logstash/51362)
**Author:** [@mir](https://discuss.elastic.co/u/mir)\ **Replies:** 7\ **Last updated:** [June 2, 2016, 6:21am UTC](https://discuss.elastic.co/t/specific-node-can-not-requsts-from-logstash/51362 "2016-06-02T06:21:12Z")
elasticsearch config is like this: \[NODE-1\] cluster.name: cluster-name node.name: node-1 node.master: true node.data: true network.host: NODEIP discovery.zen.ping.unicast.hosts: \[NODE1IP, NODE2IP, NODE3IP, NODE4IP\] \[… --- ## [Elasticsearch is still initializing the kibana index : No shard available for org.elasticsearch.action.get.MultiGetShardRequest](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index-no-shard-available-for-org-elasticsearch-action-get-multigetshardrequest/47838)
**Author:** [@kbhaskar](https://discuss.elastic.co/u/kbhaskar)\ **Replies:** 1\ **Last updated:** [April 20, 2016, 8:35pm UTC](https://discuss.elastic.co/t/elasticsearch-is-still-initializing-the-kibana-index-no-shard-available-for-org-elasticsearch-action-get-multigetshardrequest/47838 "2016-04-20T20:35:56Z")
Elastic Search is installed and has been working. However, Kibana now throws an exception. The cluster health itself is in healthy state. However, I keep getting the "Elasticsearch is still initializing the kibana index… --- ## [Kibana-7.6.1 startup error：“Elastic APM initialization error: ……”](https://discuss.elastic.co/t/kibana-7-6-1-startup-error-elastic-apm-initialization-error/229809)
**Author:** [@LuckyNemo](https://discuss.elastic.co/u/LuckyNemo)\ **Replies:** 4\ **Last updated:** [May 6, 2020, 5:54pm UTC](https://discuss.elastic.co/t/kibana-7-6-1-startup-error-elastic-apm-initialization-error/229809 "2020-05-06T17:54:52Z")
Environment： 3 nodes（all deploy es nodes and kibana nodes） version：elasticsearch7.6.1 and kibana-7.6.1（both r RPM installed） ES nodes worked fine，but when I start kibana nodes,throw exception as follows： Elastic … --- ## [Поиск по значению поля на русском языке](https://discuss.elastic.co/t/topic/89702)
**Author:** [@delorian](https://discuss.elastic.co/u/delorian)\ **Replies:** 4\ **Last updated:** [June 19, 2017, 11:16am UTC](https://discuss.elastic.co/t/topic/89702 "2017-06-19T11:16:24Z")
Добрый день, коллеги! Только начинаю познавать elastic. В общем, установлены elasticsearch+logstash+kibana. Мониторю лог файлового сервера под win. Использую winlogbeat. У меня есть поле event\_data.RelativeTargetName, в … --- ## [Start/Stop pattern for multiline](https://discuss.elastic.co/t/start-stop-pattern-for-multiline/45861)
**Author:** [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Replies:** 4\ **Last updated:** [March 31, 2016, 9:55pm UTC](https://discuss.elastic.co/t/start-stop-pattern-for-multiline/45861 "2016-03-31T21:55:40Z")
I can't figure out how to use the filebeat multiline functionality to aggregate output with a start & stop pattern: 2016-03-29T09:45:01 process-A starting 2016-03-29T09:45:02 process-A foo 2016-03-29T09:45:03 process… --- ## [Kibana visualization for time difference](https://discuss.elastic.co/t/kibana-visualization-for-time-difference/115993)
**Author:** [@Bikash\_Behuria](https://discuss.elastic.co/u/Bikash_Behuria)\ **Replies:** 2\ **Last updated:** [January 18, 2018, 8:59pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-time-difference/115993 "2018-01-18T20:59:46Z")
Hi , I have Request Response Integration logs with correlation ID in both request and response logs. 5c023e43-b695-407b-ac17-1f85d10ec9e4 RP401 OPT OrderId 11087766 (Request) 5c023e43-b695-407b-ac17-1f85d10ec9e4… --- ## [Filebeat need restart to send logs and his logs they are duplicate](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs-and-his-logs-they-are-duplicate/106718)
**Author:** [@davidhs](https://discuss.elastic.co/u/davidhs)\ **Replies:** 2\ **Last updated:** [November 9, 2017, 9:00am UTC](https://discuss.elastic.co/t/filebeat-need-restart-to-send-logs-and-his-logs-they-are-duplicate/106718 "2017-11-09T09:00:09Z")
Hello community elastic, i have a problem with filebeat, I have seen many threads in the community, but I have two problems, I have to restart filebeat to be able to send logs, but it receives duplicates, that is, it sen… --- ## [Post Filter access aggregation values](https://discuss.elastic.co/t/post-filter-access-aggregation-values/51164)
**Author:** [@kumarts](https://discuss.elastic.co/u/kumarts)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 2:44am UTC](https://discuss.elastic.co/t/post-filter-access-aggregation-values/51164 "2016-05-31T02:44:51Z")
Hi there I need help to understand how to run post filter scripts to show only results with cardinality \> 2. { "aggs" : { "products\_items" : { "term": { "field": "product" } }, "aggs" : { "distinct\_pricing"… --- ## [PointInTime api and SearchAfter in Nest](https://discuss.elastic.co/t/pointintime-api-and-searchafter-in-nest/283908)
**Author:** [@rizhaider](https://discuss.elastic.co/u/rizhaider)\ **Replies:** 6\ **Last updated:** [September 15, 2021, 8:28pm UTC](https://discuss.elastic.co/t/pointintime-api-and-searchafter-in-nest/283908 "2021-09-15T20:28:27Z")
I am working on a task in which I have to search a large number of documents in Elasticsearch using Nest client. I implemented ScrollAPI that works fine but need to use SearchAPI with SearchAfter and PointInTime as recom… --- ## [Input http\_endpoint is not accepted by 7.9.0 or master](https://discuss.elastic.co/t/input-http-endpoint-is-not-accepted-by-7-9-0-or-master/245557)
**Author:** [@KlavsKlavsen](https://discuss.elastic.co/u/KlavsKlavsen)\ **Replies:** 6\ **Last updated:** [August 26, 2020, 3:58pm UTC](https://discuss.elastic.co/t/input-http-endpoint-is-not-accepted-by-7-9-0-or-master/245557 "2020-08-26T15:58:22Z")
I just tried building docker images (make release) from github on both master and the new 7.9.0 tag. When I then run filebeat with this config: filebeat.inputs: - type: http\_endpoint enabled: true l… --- ## [Show all Data in saved Search on a Kibana Dashboard](https://discuss.elastic.co/t/show-all-data-in-saved-search-on-a-kibana-dashboard/232402)
**Author:** [@KoettingSimon](https://discuss.elastic.co/u/KoettingSimon)\ **Replies:** 6\ **Last updated:** [June 5, 2020, 4:53pm UTC](https://discuss.elastic.co/t/show-all-data-in-saved-search-on-a-kibana-dashboard/232402 "2020-06-05T16:53:53Z")
Hi All, Im using Kibana 7.6.1. I need to greate a monthly report of some Audit-Data. I would like to greate a Dashboard with some visualisations and a saved search showing all "raw" Audit-Data. Then i would use watche… --- ## [No highlighting with intervals/fuzzy queries](https://discuss.elastic.co/t/no-highlighting-with-intervals-fuzzy-queries/229259)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 6\ **Last updated:** [May 19, 2020, 3:30am UTC](https://discuss.elastic.co/t/no-highlighting-with-intervals-fuzzy-queries/229259 "2020-05-19T03:30:31Z")
In a recent feature request, the intervals query was extended to support fuzzy rules. I'm now trying to figure out why highlighting doesn't work with intervals/fuzzy whereas it does work with intervals/match and span\_ne… --- ## [Problem displaying dashboards after copying the iframe address in the html tag of a WordPress site](https://discuss.elastic.co/t/problem-displaying-dashboards-after-copying-the-iframe-address-in-the-html-tag-of-a-wordpress-site/144068)
**Author:** [@delavari](https://discuss.elastic.co/u/delavari)\ **Replies:** 6\ **Last updated:** [August 15, 2018, 9:03pm UTC](https://discuss.elastic.co/t/problem-displaying-dashboards-after-copying-the-iframe-address-in-the-html-tag-of-a-wordpress-site/144068 "2018-08-15T21:03:07Z")
Hello. I will copy the iframe in the HTML tags on a WordPress page, but unfortunately the blank frame is displayed. --- ## [Overwriting @timestamp in module](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463)
**Author:** [@mcardlesam](https://discuss.elastic.co/u/mcardlesam)\ **Replies:** 5\ **Last updated:** [May 20, 2020, 11:46pm UTC](https://discuss.elastic.co/t/overwriting-timestamp-in-module/233463 "2020-05-20T23:46:17Z")
I have written a module for filebeat to parse a log from a application I have written The pipeline mostly works, except in kibana i get the error "Text '19/May/2020 15:25:17' could not be parsed at index 12" for each re… --- ## [Count API with multiple fields in Java](https://discuss.elastic.co/t/count-api-with-multiple-fields-in-java/22695)
**Author:** [@satheesh\_kumar](https://discuss.elastic.co/u/satheesh_kumar)\ **Replies:** 5\ **Last updated:** [March 16, 2015, 10:59pm UTC](https://discuss.elastic.co/t/count-api-with-multiple-fields-in-java/22695 "2015-03-16T22:59:38Z")
Hi, I'm trying to use Count API to see whether a search query returns data count 1 or not. http://www.elastic.co/guide/en/elasticsearch/client/java-api/current/count.html The above example uses single (fieldn… --- ## [Adding NGram to language analyzer](https://discuss.elastic.co/t/adding-ngram-to-language-analyzer/12980)
**Author:** [@Shamun](https://discuss.elastic.co/u/Shamun)\ **Replies:** 5\ **Last updated:** [May 30, 2014, 2:30pm UTC](https://discuss.elastic.co/t/adding-ngram-to-language-analyzer/12980 "2014-05-30T14:30:16Z")
Hi, I use the built-in Arabic analyzer to index my Arabic text. I want to add auto complete feature to my search, so I thought about adding NGram filter. Is it possible to extend existing analyzer? If no, what is th… --- ## [Multiline log in elastic agent](https://discuss.elastic.co/t/multiline-log-in-elastic-agent/257698)
**Author:** [@FenixSec](https://discuss.elastic.co/u/FenixSec)\ **Replies:** 1\ **Last updated:** [December 7, 2020, 9:44am UTC](https://discuss.elastic.co/t/multiline-log-in-elastic-agent/257698 "2020-12-07T09:44:45Z")
Hi, i have a filebeat that picks up a file in the log directory and parses it with the multiline options in the filebeath.yml file: Multiline options multiline.type: pattern multiline.pattern: '\[0-9\]{4}-\[0-9\]{2}-\[0-9\]{… --- ## [Performance of keyword vs fielddata](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742)
**Author:** [@yungnvn](https://discuss.elastic.co/u/yungnvn)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 1:11am UTC](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742 "2019-10-23T01:11:42Z")
Hi, I had a couple of questions regarding keywords vs fielddata. I understand if fielddata type for "text" fields are enabled, it is much more performance intensive since it has to store it in the JVM memory itself. … --- ## [Winlogbeat timestamp format](https://discuss.elastic.co/t/winlogbeat-timestamp-format/173116)
**Author:** [@Dv\_Thiyanesh](https://discuss.elastic.co/u/Dv_Thiyanesh)\ **Replies:** 8\ **Last updated:** [March 27, 2019, 3:14pm UTC](https://discuss.elastic.co/t/winlogbeat-timestamp-format/173116 "2019-03-27T15:14:37Z")
when i get log from machine using Winlogbeat it shows @timestamp as like this: in kibana it shows like this in table format it shows as |@timestamp || |---|---| ||March 18th 2019, 12:30:04.874| and same date and ti… --- ## [Single logstash forwarder sending log to multiple servers](https://discuss.elastic.co/t/single-logstash-forwarder-sending-log-to-multiple-servers/54708)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 10:06am UTC](https://discuss.elastic.co/t/single-logstash-forwarder-sending-log-to-multiple-servers/54708 "2016-07-05T10:06:54Z")
Hi Magnus, I have a logstash forwarder which sends multiple log files to multiple servers. There are two log files- application1.log and application2.log application1.log needs to sent to logstash1 in server1. appli… --- ## [Logstash and client nodes](https://discuss.elastic.co/t/logstash-and-client-nodes/51251)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 8\ **Last updated:** [May 30, 2016, 12:53pm UTC](https://discuss.elastic.co/t/logstash-and-client-nodes/51251 "2016-05-30T12:53:01Z")
I have my ES cluster set up to accept among other things data shipped by logstash. right now I have all my logstash nodes sending directly to my ES data nodes. My question is should I have my logstash nodes send to ES… --- ## [Elasticsearch: Exception while starting ES, failed to delete one of translog file](https://discuss.elastic.co/t/elasticsearch-exception-while-starting-es-failed-to-delete-one-of-translog-file/45751)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 3\ **Last updated:** [March 30, 2016, 8:52am UTC](https://discuss.elastic.co/t/elasticsearch-exception-while-starting-es-failed-to-delete-one-of-translog-file/45751 "2016-03-30T08:52:47Z")
Hi, When I am starting ES from command prompt on windows, it is starting but with some exceptions. Here I am posting what exceptions ES is asking for, \[2016-03-30 08:59:05,828\]\[WARN \]\[index.translog \] \[Mel… --- ## [Badly formatted index, after interpolation still contains placeholder: \[%{\[@metadat a\]\[target\_index\]}\]](https://discuss.elastic.co/t/badly-formatted-index-after-interpolation-still-contains-placeholder-metadat-a-target-index/338905)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 2\ **Last updated:** [July 21, 2023, 11:00am UTC](https://discuss.elastic.co/t/badly-formatted-index-after-interpolation-still-contains-placeholder-metadat-a-target-index/338905 "2023-07-21T11:00:59Z")
Hey guys, trying to aggregate audit events from a linux with logstash-8.8.1-1.x86\_64 and got the error: Badly formatted index, after interpolation still contains placeholder: \[%{\[@metadat a\]\[target\_index\]}\] The stdo… --- ## [Convert kibana query language in json format automatically?](https://discuss.elastic.co/t/convert-kibana-query-language-in-json-format-automatically/315762)
**Author:** [@Nikolas1306](https://discuss.elastic.co/u/Nikolas1306)\ **Replies:** 2\ **Last updated:** [October 5, 2022, 11:08am UTC](https://discuss.elastic.co/t/convert-kibana-query-language-in-json-format-automatically/315762 "2022-10-05T11:08:50Z")
hello i ve this query on discover message :"AREAS ENGINEERING" and message:"20220925104256" how convert in this format GET /myindex/\_search { "query": { "match\_phrase\_prefix": { "message": ????? why p… --- ## [How to delete multiple documents from your index](https://discuss.elastic.co/t/how-to-delete-multiple-documents-from-your-index/148444)
**Author:** [@martb](https://discuss.elastic.co/u/martb)\ **Replies:** 2\ **Last updated:** [September 14, 2018, 9:48am UTC](https://discuss.elastic.co/t/how-to-delete-multiple-documents-from-your-index/148444 "2018-09-14T09:48:49Z")
Hi, Using the example below how do I delete all documents within an index that match the actype field i.e all REF-3? { "\_index": "index-names-2018.08.27", "\_type": "doc", "\_id": "XOod0mUBf6rT7tCrMDeP", "\_version": … --- ## [Curl command to Delete an Elastic search Index not working](https://discuss.elastic.co/t/curl-command-to-delete-an-elastic-search-index-not-working/69395)
**Author:** [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)\ **Replies:** 2\ **Last updated:** [December 19, 2016, 7:17am UTC](https://discuss.elastic.co/t/curl-command-to-delete-an-elastic-search-index-not-working/69395 "2016-12-19T07:17:10Z")
I have been working on Elastic search for a while and i have scenario to delete some indices in the elasticsearch. As instructed in the ELK user guide, am trying to delete the indices using the CURL command in powershe… --- ## [Watcher Troubleshooting](https://discuss.elastic.co/t/watcher-troubleshooting/247587)
**Author:** [@vvwood](https://discuss.elastic.co/u/vvwood)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 8:37pm UTC](https://discuss.elastic.co/t/watcher-troubleshooting/247587 "2020-09-24T20:37:38Z")
Greetings all, For this post, I am seeking advice on how to go about troubleshooting watcher configurations. I have 2 different use cases that I am seeking to use watcher for and so far I have run in to a few challenges… --- ## [APM Server returns 404](https://discuss.elastic.co/t/apm-server-returns-404/232826)
**Author:** [@leslie](https://discuss.elastic.co/u/leslie)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 2:57pm UTC](https://discuss.elastic.co/t/apm-server-returns-404/232826 "2020-05-15T14:57:25Z")
I set up es、kibana、apm-server and my django app months ago, and it works well. I can view apm analysis on kibana http://\/app/apm, and it help me to solve some performence issue. But today, on kibana, I found th… --- ## [Question about Throughput Sizing](https://discuss.elastic.co/t/question-about-throughput-sizing/198137)
**Author:** [@zidane28](https://discuss.elastic.co/u/zidane28)\ **Replies:** 4\ **Last updated:** [September 5, 2019, 6:15am UTC](https://discuss.elastic.co/t/question-about-throughput-sizing/198137 "2019-09-05T06:15:07Z")
I found out that one of the method for cluster planning is though Throughput Sizing , in which it uses number of search per second, search response time, physical cores etc etc. to calculate how many nodes needed. Below… --- ## [Exporting logs to elasticsearch on kubernetes/aws: functionbeat - Cannot retrieve license](https://discuss.elastic.co/t/exporting-logs-to-elasticsearch-on-kubernetes-aws-functionbeat-cannot-retrieve-license/166039)
**Author:** [@GAHila](https://discuss.elastic.co/u/GAHila)\ **Replies:** 4\ **Last updated:** [February 15, 2019, 8:48pm UTC](https://discuss.elastic.co/t/exporting-logs-to-elasticsearch-on-kubernetes-aws-functionbeat-cannot-retrieve-license/166039 "2019-02-15T20:48:39Z")
I have kubernetes running on AWS (EKS) (v.6.3.2 from containers in GCP) and dedicated nodes that run Elasticsearch. So we want to export Cloudwatch logs there given we have kibana and everything else goes there. Instal… --- ## [Why does heap usage keep approaching 100%?](https://discuss.elastic.co/t/why-does-heap-usage-keep-approaching-100/1097)
**Author:** [@Brian\_G](https://discuss.elastic.co/u/Brian_G)\ **Replies:** 4\ **Last updated:** [May 21, 2015, 3:15pm UTC](https://discuss.elastic.co/t/why-does-heap-usage-keep-approaching-100/1097 "2015-05-21T15:15:53Z")
I'm new to ES and I have an ES 1.5.2 cluster with: 4 nodes. Each node currently is an amazon ec2 (c4.2xlarge) instance. 16 GB RAM 8 cores. 8 GB RAM assigned to HEAP 7.9 billion documents 2656 shards 6.57 TB of data al… --- ## [APM and Ghost blog](https://discuss.elastic.co/t/apm-and-ghost-blog/113720)
**Author:** [@mitchdavis](https://discuss.elastic.co/u/mitchdavis)\ **Replies:** 7\ **Last updated:** [January 4, 2018, 2:33pm UTC](https://discuss.elastic.co/t/apm-and-ghost-blog/113720 "2018-01-04T14:33:01Z")
Hi there, I'm looking to integrate APM into my ghost installation, but am unaware of where to start. I have tried adding it to my index.js, Gruntfile.js and a few other files but Ghost fails to start after that. Has a… [Previous page](https://discuss.elastic.co/top.md?page=920&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=922&per_page=50&period=all)