# Top **URL:** https://discuss.elastic.co/top.md?page=959&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 960 --- ## [Snapshot thread are in sleep](https://discuss.elastic.co/t/snapshot-thread-are-in-sleep/184362)
**Author:** [@saikettewary](https://discuss.elastic.co/u/saikettewary)\ **Replies:** 7\ **Last updated:** [June 10, 2019, 4:34pm UTC](https://discuss.elastic.co/t/snapshot-thread-are-in-sleep/184362 "2019-06-10T16:34:10Z")
I am seeing a lot of snapshot threads are in sleep from hot threads .. what does this mean. the FS repository has all default settings. Also i am seeing a lot of snapshot threads are in active and in queue from thread po… --- ## [How to create a nested array from multiple input fields](https://discuss.elastic.co/t/how-to-create-a-nested-array-from-multiple-input-fields/62178)
**Author:** [@ehausig](https://discuss.elastic.co/u/ehausig)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 1:50pm UTC](https://discuss.elastic.co/t/how-to-create-a-nested-array-from-multiple-input-fields/62178 "2016-10-05T13:50:56Z")
Hello, I'm having difficulty figuring out how to fill a nested data type with values from multiple fields from a CSV. For example: I have a CSV data source that has the following columns: company\_id company\_name co… --- ## [Issues with Marvel and Shield](https://discuss.elastic.co/t/issues-with-marvel-and-shield/59571)
**Author:** [@nate.fleming](https://discuss.elastic.co/u/nate.fleming)\ **Replies:** 7\ **Last updated:** [September 2, 2016, 5:14pm UTC](https://discuss.elastic.co/t/issues-with-marvel-and-shield/59571 "2016-09-02T17:14:07Z")
I recently restarted some nodes in our cluster after a configuration change and unfortunately they aren't coming back up cleanly. There appears to be an issue with marvel. There is a reference to \_marveluser however I ne… --- ## [Count for every slice in pie chart](https://discuss.elastic.co/t/count-for-every-slice-in-pie-chart/47235)
**Author:** [@vikalp](https://discuss.elastic.co/u/vikalp)\ **Replies:** 1\ **Last updated:** [April 13, 2016, 4:16pm UTC](https://discuss.elastic.co/t/count-for-every-slice-in-pie-chart/47235 "2016-04-13T16:16:41Z")
Can i show total count inside pie chart for every slice , as of now its shows on roll over only. --- ## [Use\_disk\_threshold defaulting to False](https://discuss.elastic.co/t/use-disk-threshold-defaulting-to-false/179972)
**Author:** [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\ **Replies:** 1\ **Last updated:** [May 7, 2019, 1:25pm UTC](https://discuss.elastic.co/t/use-disk-threshold-defaulting-to-false/179972 "2019-05-07T13:25:46Z")
Hi, If I create a deployment then update the elasticsearch instances wth the API (not the UI) I can see that the use\_disk\_threshold is being changed from true to false, even though I am not specifying this anywhere in m… --- ## [Calculate MTBF/MTTF Mean time between/to failure for a visualization](https://discuss.elastic.co/t/calculate-mtbf-mttf-mean-time-between-to-failure-for-a-visualization/134995)
**Author:** [@topel](https://discuss.elastic.co/u/topel)\ **Replies:** 4\ **Last updated:** [June 14, 2018, 8:10am UTC](https://discuss.elastic.co/t/calculate-mtbf-mttf-mean-time-between-to-failure-for-a-visualization/134995 "2018-06-14T08:10:44Z")
Hi there, I am struggling to find the way or rather a way to visualize the MTBF of my Jenkins Pipelines/Jobs. What I have is the following: A job index, where one document holds the information about what builds belo… --- ## [Auth to ECK using Azure AAD SAML failing](https://discuss.elastic.co/t/auth-to-eck-using-azure-aad-saml-failing/245275)
**Author:** [@damjank](https://discuss.elastic.co/u/damjank)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 11:00am UTC](https://discuss.elastic.co/t/auth-to-eck-using-azure-aad-saml-failing/245275 "2020-08-18T11:00:46Z")
Hey guys, I am facing a weird issue. Following this guide as a roadmap: https://discuss.elastic.co/t/sso-azure-ad-setup/230639/2 and mostly https://www.elastic.co/blog/saml-based-single-sign-on-with-elasticsearch-and-az… --- ## [Max\_bucket exception from elasticsearch](https://discuss.elastic.co/t/max-bucket-exception-from-elasticsearch/237732)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [June 19, 2020, 8:20am UTC](https://discuss.elastic.co/t/max-bucket-exception-from-elasticsearch/237732 "2020-06-19T08:20:00Z")
Hi, I have made a control visualization (option list) with 4 options-fields (let's say A, B, C & D). The "size" field of each option is 10000 and search.max\_buckets setting is 10000 too. In ElasticSearch, for field A … --- ## [Kibana with elastic form docker compose setup problem](https://discuss.elastic.co/t/kibana-with-elastic-form-docker-compose-setup-problem/347951)
**Author:** [@habajol675](https://discuss.elastic.co/u/habajol675)\ **Replies:** 5\ **Last updated:** [November 24, 2023, 7:51pm UTC](https://discuss.elastic.co/t/kibana-with-elastic-form-docker-compose-setup-problem/347951 "2023-11-24T19:51:30Z")
Hello everyone, I have been trying to deploy elasticsearch and kibana for several days now. I'm using docker compos and having a lot of problems. I have provided an example of the file below, but there is this error with… --- ## [Getting ConnectTimeoutException When joining in cluster Even if nodes are reachable](https://discuss.elastic.co/t/getting-connecttimeoutexception-when-joining-in-cluster-even-if-nodes-are-reachable/281998)
**Author:** [@ziw028](https://discuss.elastic.co/u/ziw028)\ **Replies:** 5\ **Last updated:** [September 3, 2021, 4:56am UTC](https://discuss.elastic.co/t/getting-connecttimeoutexception-when-joining-in-cluster-even-if-nodes-are-reachable/281998 "2021-09-03T04:56:01Z")
I have elasticsearch deployed on 2 node deployment setup (node1, node2) on remote machine & using the Java API to connect to it. Originally both nodes were in different clusters, and each of them is master node. Then we … --- ## [Query help must\_not except when](https://discuss.elastic.co/t/query-help-must-not-except-when/172935)
**Author:** [@grant\_donovan](https://discuss.elastic.co/u/grant_donovan)\ **Replies:** 5\ **Last updated:** [March 19, 2019, 2:03pm UTC](https://discuss.elastic.co/t/query-help-must-not-except-when/172935 "2019-03-19T14:03:18Z")
I wonder if someone would be able to help me with this query The query works and returns results, but I want to change the must not bit, instead of "must\_not": \[ { "match": { "notificationType": "88" }} I want to say … --- ## [Empty buckets return different type of result value '0' and 'null' for the same field](https://discuss.elastic.co/t/empty-buckets-return-different-type-of-result-value-0-and-null-for-the-same-field/137927)
**Author:** [@guanghaofan](https://discuss.elastic.co/u/guanghaofan)\ **Replies:** 2\ **Last updated:** [July 1, 2018, 4:06am UTC](https://discuss.elastic.co/t/empty-buckets-return-different-type-of-result-value-0-and-null-for-the-same-field/137927 "2018-07-01T04:06:12Z")
Kibana: 6.2.5 Metric Type: Sum, the response return value '0' for the empty buckets. Metric Type: Min/Max/Average, the response return value 'null' for the empty buckets. Below the request and response: Request: { … --- ## [Adding a copy field and set it lowercase](https://discuss.elastic.co/t/adding-a-copy-field-and-set-it-lowercase/126762)
**Author:** [@Gabriel\_Pellegrini\_M](https://discuss.elastic.co/u/Gabriel_Pellegrini_M)\ **Replies:** 2\ **Last updated:** [April 4, 2018, 5:38pm UTC](https://discuss.elastic.co/t/adding-a-copy-field-and-set-it-lowercase/126762 "2018-04-04T17:38:29Z")
Hello guys, I'm having a trouble with a mutate filter, where i need to set a field copy to lowercase. But when i try to load on elastic , the field copy won't be lowercase. My Logstash Version is 5.2 i'm using the c… --- ## [Upsert from Spark - 504 after 1.5 hours](https://discuss.elastic.co/t/upsert-from-spark-504-after-1-5-hours/97171)
**Author:** [@dragick](https://discuss.elastic.co/u/dragick)\ **Replies:** 2\ **Last updated:** [August 17, 2017, 2:10am UTC](https://discuss.elastic.co/t/upsert-from-spark-504-after-1-5-hours/97171 "2017-08-17T02:10:14Z")
e have an index of 250M documents and are trying to update 55M of them from Spark to ElasticSearch. The initial write of 250M on it’s own runs without issue. Unfortunately the 55M updates are getting a few timeouts afte… --- ## [Pentaho-ElasticSearch](https://discuss.elastic.co/t/pentaho-elasticsearch/11042)
**Author:** [@Yuliya](https://discuss.elastic.co/u/Yuliya)\ **Replies:** 2\ **Last updated:** [March 6, 2013, 10:11pm UTC](https://discuss.elastic.co/t/pentaho-elasticsearch/11042 "2013-03-06T22:11:54Z")
Hello all! Please help :) We are using ES to index ~1.5mil records from the database. To populate the index we are using Pentaho ES component which is set to “Overwrite if exists” (runs ~15 min). Also, indivi… --- ## [Metricbeat-7.16.2 HTTP error 401 in : 401 Unauthorized](https://discuss.elastic.co/t/metricbeat-7-16-2-http-error-401-in-401-unauthorized/294816)
**Author:** [@mwoods269](https://discuss.elastic.co/u/mwoods269)\ **Replies:** 1\ **Last updated:** [January 19, 2022, 5:07pm UTC](https://discuss.elastic.co/t/metricbeat-7-16-2-http-error-401-in-401-unauthorized/294816 "2022-01-19T17:07:43Z")
Hello, Environment: singlenode sandbox running 7.16.2 Security enabled (TLS inter node comms) No Https Issue: Installed metricbeat and enabled Elasticsearch however node still reporting as self monitored Gett… --- ## [Timezone in ES Python Client](https://discuss.elastic.co/t/timezone-in-es-python-client/114099)
**Author:** [@shin1](https://discuss.elastic.co/u/shin1)\ **Replies:** 1\ **Last updated:** [January 12, 2018, 5:43pm UTC](https://discuss.elastic.co/t/timezone-in-es-python-client/114099 "2018-01-12T17:43:53Z")
Hi All, I'm new to ES Python Client (https://elasticsearch-py.readthedocs.io/en/master/) and have an odd issue on query result from Elasticsearch.search(). Queried data has a datetime field holding UTC timestamp but El… --- ## [Why should I not run Logstash as root?](https://discuss.elastic.co/t/why-should-i-not-run-logstash-as-root/49615)
**Author:** [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Replies:** 1\ **Last updated:** [May 10, 2016, 7:36am UTC](https://discuss.elastic.co/t/why-should-i-not-run-logstash-as-root/49615 "2016-05-10T07:36:38Z")
Hi, I have read that it is not recommended to run Logstash as root, but I need it to capture syslogs from a privileged port. I could set up a rsyslog server that can redirect any messages to a higher port, non-privi… --- ## [Node id same in two nodes](https://discuss.elastic.co/t/node-id-same-in-two-nodes/170947)
**Author:** [@josselinchevalay](https://discuss.elastic.co/u/josselinchevalay)\ **Replies:** 6\ **Last updated:** [March 12, 2019, 10:25am UTC](https://discuss.elastic.co/t/node-id-same-in-two-nodes/170947 "2019-03-12T10:25:11Z")
Hi guys, currently i have a weird issue. I have two virtual machine distinct each vm a create a unique node typed master. this two vm are created node with the same node id. someone can explain me how to solve that ? R… --- ## [Can I query data of more then one elasticsearch using one kibana](https://discuss.elastic.co/t/can-i-query-data-of-more-then-one-elasticsearch-using-one-kibana/133882)
**Author:** [@komal\_mittal](https://discuss.elastic.co/u/komal_mittal)\ **Replies:** 6\ **Last updated:** [May 31, 2018, 1:07pm UTC](https://discuss.elastic.co/t/can-i-query-data-of-more-then-one-elasticsearch-using-one-kibana/133882 "2018-05-31T13:07:48Z")
In a cluster more then one nodes(Elasticsearch) are received data from more then one logstash. Can I search this data on a single kibana?? Can someone explain?? --- ## [Installing dashboards from Auditbeat to Docker containers](https://discuss.elastic.co/t/installing-dashboards-from-auditbeat-to-docker-containers/119270)
**Author:** [@nlh](https://discuss.elastic.co/u/nlh)\ **Replies:** 6\ **Last updated:** [February 26, 2018, 9:24am UTC](https://discuss.elastic.co/t/installing-dashboards-from-auditbeat-to-docker-containers/119270 "2018-02-26T09:24:10Z")
Apologies, pretty much a newbie to Docker and ELK. I have a Redhat system that I am trying to monitor on an Ubuntu system using ELK. I have the Ubuntu system running Elasticsearch, Logstash and Kibana 5.6.4 in separate c… --- ## [Parent/Child use case](https://discuss.elastic.co/t/parent-child-use-case/5401)
**Author:** [@Paul\_Smith](https://discuss.elastic.co/u/Paul_Smith)\ **Replies:** 6\ **Last updated:** [November 16, 2011, 6:45am UTC](https://discuss.elastic.co/t/parent-child-use-case/5401 "2011-11-16T06:45:47Z")
Just wanted to check whether this scenario fit properly the parent/child mapping feature. We currently index just meta-data of documents (dozens of fields), however we want to index file contents too as that's somet… --- ## [DEBIAN - Problème lancement Elasticsearch](https://discuss.elastic.co/t/debian-probleme-lancement-elasticsearch/209483)
**Author:** [@Theo\_Meteyer](https://discuss.elastic.co/u/Theo_Meteyer)\ **Replies:** 3\ **Last updated:** [November 29, 2019, 4:03am UTC](https://discuss.elastic.co/t/debian-probleme-lancement-elasticsearch/209483 "2019-11-29T04:03:13Z")
Bonjour, Je viens vous demander de l'aide car depuis plusieurs jours de rencontre un soucis avec Elasticsearch.. Je ne suis pas très familier avec Debian, et donc la question pourrait sembler stupide. Pour mes études,… --- ## ["Group other values in separate bucket" Option does not work in bar graphs](https://discuss.elastic.co/t/group-other-values-in-separate-bucket-option-does-not-work-in-bar-graphs/135170)
**Author:** [@rjain](https://discuss.elastic.co/u/rjain)\ **Replies:** 3\ **Last updated:** [June 27, 2018, 5:28pm UTC](https://discuss.elastic.co/t/group-other-values-in-separate-bucket-option-does-not-work-in-bar-graphs/135170 "2018-06-27T17:28:52Z")
I have created a bar graph that splits each bar (series) to show the 5 top frequently used items. However, when since I want all the other items to be shown in an "others" bucket, I clicked on the "Group other values in … --- ## [Using Multi Value in Zabbix Output](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707)
**Author:** [@singu](https://discuss.elastic.co/u/singu)\ **Replies:** 3\ **Last updated:** [December 21, 2016, 9:26pm UTC](https://discuss.elastic.co/t/using-multi-value-in-zabbix-output/69707 "2016-12-21T21:26:16Z")
Hi, I am new to logstash and looking for option to send application logs to Zabbix. I was able to setup the logstash configuration with zabbix\_key, but it is only getting single messages from the log and showing in Zabbi… --- ## [Custom Eventlog Parsing](https://discuss.elastic.co/t/custom-eventlog-parsing/58009)
**Author:** [@rhyse](https://discuss.elastic.co/u/rhyse)\ **Replies:** 3\ **Last updated:** [August 16, 2016, 8:58am UTC](https://discuss.elastic.co/t/custom-eventlog-parsing/58009 "2016-08-16T08:58:29Z")
Hi I am trying to parse a custom windows Event log in to elasticsearch. This eventlog is generated from a powershell script Event Data: \`event\_data.param1 RunDate : 15/08/2016 08:29:58 Caller … --- ## [Add Sub fields](https://discuss.elastic.co/t/add-sub-fields/243414)
**Author:** [@nurhambali](https://discuss.elastic.co/u/nurhambali)\ **Replies:** 4\ **Last updated:** [August 1, 2020, 4:38am UTC](https://discuss.elastic.co/t/add-sub-fields/243414 "2020-08-01T04:38:30Z")
hi, how to add sub fields on logstash ex: server, time, message i'm add sub field modsec.server modsec.time modsec.message ? any ide ? --- ## [Unknown key for a START\_OBJECT in \[queryBuilder\]](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-querybuilder/115724)
**Author:** [@ramchjob](https://discuss.elastic.co/u/ramchjob)\ **Replies:** 4\ **Last updated:** [January 17, 2018, 10:13am UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-object-in-querybuilder/115724 "2018-01-17T10:13:03Z")
Hello Gurus, I am relatively new to the group. I am posting the below query via JAVA API and seeing error as follows. Not sure what i am missing. Request Body : {"query":{"match\_all":{"boost":1.0}}} Error response: {… --- ## [Tribe Node](https://discuss.elastic.co/t/tribe-node/61311)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 4\ **Last updated:** [September 23, 2016, 4:31pm UTC](https://discuss.elastic.co/t/tribe-node/61311 "2016-09-23T16:31:03Z")
I just have a few questions about the mechanics of a tribe node. I have set up two clusters, and a tribe node configured to connect to the two of them. First, how can I verify that it is successfully connected. I can r… --- ## [Use logstash to connect VMware vCenter API?](https://discuss.elastic.co/t/use-logstash-to-connect-vmware-vcenter-api/348517)
**Author:** [@pyk346](https://discuss.elastic.co/u/pyk346)\ **Replies:** 7\ **Last updated:** [December 6, 2023, 2:33pm UTC](https://discuss.elastic.co/t/use-logstash-to-connect-vmware-vcenter-api/348517 "2023-12-06T14:33:35Z")
I'm trying to utilize the elastic logstash to obtain VMware vcenter datacenter metrics via API but failed to connect them. The vCenter version is 8.0.1. I had successfully configured "syslog" as input and recieved logs… --- ## [Syslog input config for logstash](https://discuss.elastic.co/t/syslog-input-config-for-logstash/245714)
**Author:** [@Cihan\_Tunali](https://discuss.elastic.co/u/Cihan_Tunali)\ **Replies:** 7\ **Last updated:** [August 27, 2020, 6:19pm UTC](https://discuss.elastic.co/t/syslog-input-config-for-logstash/245714 "2020-08-27T18:19:38Z")
Hello all, Im using ES 7.9.0. My goal is to get syslogs from my firewall to logstash. I tried every config that i found on net. But could not solve it. I configured rsyslog to forward incoming syslogs to my logstash whi… --- ## [Logatash with nested Json parser](https://discuss.elastic.co/t/logatash-with-nested-json-parser/41198)
**Author:** [@vimalmpatel](https://discuss.elastic.co/u/vimalmpatel)\ **Replies:** 7\ **Last updated:** [February 18, 2016, 5:29pm UTC](https://discuss.elastic.co/t/logatash-with-nested-json-parser/41198 "2016-02-18T17:29:59Z")
i have kafka input something like this {"interactionId":"7891013","applicantInfoList":\[{"cif":123456,"role":"Primary","applicantType":"PROSPECT"}\],"correlationId":"d828bcf9-0fb7-467b-b2c5-a67c2305a9db","application… --- ## [Filebeat Not able to catch up with rotating container logs](https://discuss.elastic.co/t/filebeat-not-able-to-catch-up-with-rotating-container-logs/296935)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 2\ **Last updated:** [February 11, 2022, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-not-able-to-catch-up-with-rotating-container-logs/296935 "2022-02-11T18:17:22Z")
We have a situation where container logs are rotated ~5 times with-in a minute and only last 5 files are kept before getting deleted. We have Filebeat running as daemon set in the K8 cluster and it is able to send th… --- ## [Watcher Compare 2 fields from the same index](https://discuss.elastic.co/t/watcher-compare-2-fields-from-the-same-index/179797)
**Author:** [@gurpal](https://discuss.elastic.co/u/gurpal)\ **Replies:** 2\ **Last updated:** [May 20, 2019, 12:55pm UTC](https://discuss.elastic.co/t/watcher-compare-2-fields-from-the-same-index/179797 "2019-05-20T12:55:09Z")
Hello, I am trying to create a simple watcher that compares 2 fields in the same index every 5 minutes. My index contains the following fields "Temperature" : "22.6", "Temp Hi" : "30.1", "Temp Lo" : "25.5", "@tim… --- ## [Ulimit issue in elasticsearch](https://discuss.elastic.co/t/ulimit-issue-in-elasticsearch/95576)
**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\ **Replies:** 2\ **Last updated:** [August 3, 2017, 1:23am UTC](https://discuss.elastic.co/t/ulimit-issue-in-elasticsearch/95576 "2017-08-03T01:23:47Z")
moderators : I am pretty sure I created this post but i cant see it in my list of questions so please delete the other one if its visible to you. I downloaded and untarred the elasticsearch-5.5.1 into a directory, creat… --- ## [Count and Stats api showing different doc's count in Elasticsearch?](https://discuss.elastic.co/t/count-and-stats-api-showing-different-docs-count-in-elasticsearch/91414)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 2\ **Last updated:** [July 5, 2017, 2:00pm UTC](https://discuss.elastic.co/t/count-and-stats-api-showing-different-docs-count-in-elasticsearch/91414 "2017-07-05T14:00:07Z")
HI, 1)I have an index "data" which has 479427 documents in it. To get the count i had used GET /data/\_search i got response like this "hits": { "total": 479427, "max\_score": 1, 2)I checked using count api… --- ## [Kibana - Disable gzip compression](https://discuss.elastic.co/t/kibana-disable-gzip-compression/85611)
**Author:** [@locguero](https://discuss.elastic.co/u/locguero)\ **Replies:** 2\ **Last updated:** [May 22, 2017, 7:46pm UTC](https://discuss.elastic.co/t/kibana-disable-gzip-compression/85611 "2017-05-22T19:46:39Z")
We are trying to use IIS ARR to do reverse proxy of kibana to add some level of security. We are trying to disable content compression (content-encoding: gzip) to allow us to implement a work around. I see that in hapi… --- ## [How to debug "Grok regexp threw exception"](https://discuss.elastic.co/t/how-to-debug-grok-regexp-threw-exception/47399)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 8:26pm UTC](https://discuss.elastic.co/t/how-to-debug-grok-regexp-threw-exception/47399 "2016-12-12T20:26:03Z")
Hi, i have many grok rules and recently i notice this in the logs: {:timestamp=\>"2016-04-14T16:19:46.989000+0200", :message=\>"Grok regexp threw exception", :exception=\>"", :level=\>:warn} i have no exception text, so … --- ## [Watch-history fieldname error](https://discuss.elastic.co/t/watch-history-fieldname-error/73364)
**Author:** [@Ryan\_Grannell](https://discuss.elastic.co/u/Ryan_Grannell)\ **Replies:** 8\ **Last updated:** [February 3, 2017, 10:39am UTC](https://discuss.elastic.co/t/watch-history-fieldname-error/73364 "2017-02-03T10:39:16Z")
Version: v2.4.3 Hi, I'm currently running into a problem where the watch-history record for a particular watcher isn't index due complains about the fieldname ctx.payload.hits.total: \[2017-01-31 11:33:51,687\]\[ERROR… --- ## [Fleet server status offline](https://discuss.elastic.co/t/fleet-server-status-offline/345444)
**Author:** [@candyli](https://discuss.elastic.co/u/candyli)\ **Replies:** 5\ **Last updated:** [October 25, 2023, 7:58am UTC](https://discuss.elastic.co/t/fleet-server-status-offline/345444 "2023-10-25T07:58:29Z")
I install fleet server on my centos7 Successfully. But status always display offline. I also check integration status: commandline status shows as follow: ''' \[root@fleet02 elastic-agent-8.10.4-linux-x86\_64\]# cd … --- ## [Recover from Out of Memory Error](https://discuss.elastic.co/t/recover-from-out-of-memory-error/59111)
**Author:** [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Replies:** 5\ **Last updated:** [August 30, 2016, 9:58am UTC](https://discuss.elastic.co/t/recover-from-out-of-memory-error/59111 "2016-08-30T09:58:08Z")
Hi, I have ES 1.7, and I got an "Out of Memory Error, Java Heap Space" I know the cause is that I don't have enough RAM for the amount of data I'm inserting ES. Unfortunately, new hardware is coming only in a few weeks… --- ## [Getting different @timestamp field in kibana as a JSON document and in Table](https://discuss.elastic.co/t/getting-different-timestamp-field-in-kibana-as-a-json-document-and-in-table/177399)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [April 18, 2019, 5:32am UTC](https://discuss.elastic.co/t/getting-different-timestamp-field-in-kibana-as-a-json-document-and-in-table/177399 "2019-04-18T05:32:45Z")
Hello, My filebeat (data Server ) is in IST Zone and my Elastic timezone is also IST. When i am parsing the logs . according to my use case I provided dynamic mapping to my index and my dynamic mapping is PUT /reques… --- ## [Unable to complete saved object migrations for the \[.kibana\] index. RequestAbortedError: The content length (823769731) is bigger than the maximum allowed string](https://discuss.elastic.co/t/unable-to-complete-saved-object-migrations-for-the-kibana-index-requestabortederror-the-content-length-823769731-is-bigger-than-the-maximum-allowed-string/274408)
**Author:** [@LombardoAndrea195](https://discuss.elastic.co/u/LombardoAndrea195)\ **Replies:** 3\ **Last updated:** [June 2, 2021, 6:47am UTC](https://discuss.elastic.co/t/unable-to-complete-saved-object-migrations-for-the-kibana-index-requestabortederror-the-content-length-823769731-is-bigger-than-the-maximum-allowed-string/274408 "2021-06-02T06:47:34Z")
kibana | {"type":"log","@timestamp":"2021-05-29T18:16:24+00:00","tags":\["info","savedobjects-service"\],"pid":6,"message":"\[.kibana\_task\_manager\] Migration completed after 9330ms"} kibana | {"type":"lo… --- ## [Filebeat not respecting ingest pipeline in output settings when using syslog inputs](https://discuss.elastic.co/t/filebeat-not-respecting-ingest-pipeline-in-output-settings-when-using-syslog-inputs/248060)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 7:21am UTC](https://discuss.elastic.co/t/filebeat-not-respecting-ingest-pipeline-in-output-settings-when-using-syslog-inputs/248060 "2020-09-11T07:21:43Z")
Hi, I'm having issues using ingest pipelines with Filebeat. Filebeat is supposed to collect any syslog messages and send them to the ingest pipeline "syslog\_distributor". However, the incoming documents are not passed t… --- ## [Reverse\_mapping for cef input codec not working](https://discuss.elastic.co/t/reverse-mapping-for-cef-input-codec-not-working/169184)
**Author:** [@FreddyFernando](https://discuss.elastic.co/u/FreddyFernando)\ **Replies:** 3\ **Last updated:** [March 6, 2019, 12:41pm UTC](https://discuss.elastic.co/t/reverse-mapping-for-cef-input-codec-not-working/169184 "2019-03-06T12:41:19Z")
Cef reverse\_mapping does not work. I am expecting logstash to give me short form of cef, instead it gives me the long form. Version: Logstash 6.5.0 (cef codec version 5.0.6) Operating System: Ubuntu 16.04 Config File … --- ## [Canvas Metric Element: Unique count](https://discuss.elastic.co/t/canvas-metric-element-unique-count/166896)
**Author:** [@Darshan\_Parab](https://discuss.elastic.co/u/Darshan_Parab)\ **Replies:** 3\ **Last updated:** [March 4, 2019, 11:24am UTC](https://discuss.elastic.co/t/canvas-metric-element-unique-count/166896 "2019-03-04T11:24:14Z")
Hi All, I'm trying to create my first event canvas workpad. I have an index that contains at least 100K unique hostnames. But when I create a metric element to display count of unique hostnames, it show maximum count a… --- ## [Setup Filebeat to run as a service](https://discuss.elastic.co/t/setup-filebeat-to-run-as-a-service/292726)
**Author:** [@vharabor](https://discuss.elastic.co/u/vharabor)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 8:25pm UTC](https://discuss.elastic.co/t/setup-filebeat-to-run-as-a-service/292726 "2021-12-22T20:25:40Z")
I've setup Filebeat on AWS Amazon Linux 2 AMI using the setup instruction here : (Filebeat quick start: installation and configuration | Filebeat Reference \[7.16\] | Elastic) So basically : curl -L -O https://artifacts.… --- ## [Setting Xms and Xmx](https://discuss.elastic.co/t/setting-xms-and-xmx/273875)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [May 25, 2021, 8:52am UTC](https://discuss.elastic.co/t/setting-xms-and-xmx/273875 "2021-05-25T08:52:52Z")
I assume this is a long-debated topic but I was kind of puzzled by this recommendation: Modifying advanced settings is generally not recommended and could negatively impact performance and stability. Using the Elastics… --- ## [Delete By Query Plugin Error](https://discuss.elastic.co/t/delete-by-query-plugin-error/35399)
**Author:** [@ton](https://discuss.elastic.co/u/ton)\ **Replies:** 2\ **Last updated:** [June 6, 2016, 7:41pm UTC](https://discuss.elastic.co/t/delete-by-query-plugin-error/35399 "2016-06-06T19:41:19Z")
Hi, i am tring to use the new Delete By Query Plugin in ES 2.0 DeleteByQueryResponse deleteByQueryResponse = new DeleteByQueryRequestBuilder(client, DeleteByQueryAction.INSTANCE) .setIndices("indic… --- ## [How to remove basic license?](https://discuss.elastic.co/t/how-to-remove-basic-license/50131)
**Author:** [@deeshugupta](https://discuss.elastic.co/u/deeshugupta)\ **Replies:** 2\ **Last updated:** [May 25, 2016, 7:41am UTC](https://discuss.elastic.co/t/how-to-remove-basic-license/50131 "2016-05-25T07:41:45Z")
I installed the basic license with marvel. Later I installed watcher and tried to put a watcher in ES but got the following error \[401\] {"error":{"root\_cause":\[{"type":"security\_exception","reason":"current license is … [Previous page](https://discuss.elastic.co/top.md?page=958&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=960&per_page=50&period=all)