# Top

**URL:** https://discuss.elastic.co/top.md?page=974&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 975

---

## [How to reflect UI changes without restarting kibana](https://discuss.elastic.co/t/how-to-reflect-ui-changes-without-restarting-kibana/119340)

<div class="topic-metadata">

**Author:** [@seema](https://discuss.elastic.co/u/seema)\
**Replies:** 8\
**Last updated:** [February 21, 2018, 7:33am UTC](https://discuss.elastic.co/t/how-to-reflect-ui-changes-without-restarting-kibana/119340 "2018-02-21T07:33:44Z")

</div>

Hi, I need to make some change in kibana css but every time to reflect that changes, I need to delete optimize/bundle folder and restart kibana. Please let me know if there is any other workaround. Thanks, Seema

---

## [How do I get the real total when PAGING](https://discuss.elastic.co/t/how-do-i-get-the-real-total-when-paging/289156)

<div class="topic-metadata">

**Author:** [@KhalidDu](https://discuss.elastic.co/u/KhalidDu)\
**Replies:** 4\
**Last updated:** [November 15, 2021, 7:16am UTC](https://discuss.elastic.co/t/how-do-i-get-the-real-total-when-paging/289156 "2021-11-15T07:16:04Z")

</div>

When.NET uses NEST for paging query, when I get the total number of data from Hits, I find the maximum value is 10000, but my real data amount should be 50000+, I have set max\_result\_window value to 200000000, but it doe…

---

## [Geo\_point automatically](https://discuss.elastic.co/t/geo-point-automatically/273183)

<div class="topic-metadata">

**Author:** [@Emi\_lie](https://discuss.elastic.co/u/Emi_lie)\
**Replies:** 4\
**Last updated:** [May 18, 2021, 8:40am UTC](https://discuss.elastic.co/t/geo-point-automatically/273183 "2021-05-18T08:40:00Z")

</div>

Hello, I struggle to add the geo\_point to my index, automatically. All the solutions I found, official and unofficial, indicate that it is necessary to pass by the devTools to make a PUT of the index. But I use elastic…

---

## [Unable to see transactions with APM when used with apollo-server-express](https://discuss.elastic.co/t/unable-to-see-transactions-with-apm-when-used-with-apollo-server-express/263821)

<div class="topic-metadata">

**Author:** [@Sim\_Singh](https://discuss.elastic.co/u/Sim_Singh)\
**Replies:** 4\
**Last updated:** [February 10, 2021, 9:31am UTC](https://discuss.elastic.co/t/unable-to-see-transactions-with-apm-when-used-with-apollo-server-express/263821 "2021-02-10T09:31:34Z")

</div>

APM Agent language and version: "elastic-apm-node": "^3.10.0", Using with: "apollo-server-express": "^2.18.2", "express": "^4.17.1", This is a first time setup for this particular type of app. As suggested by Apollo…

---

## [Upgrade elk 7 ，start elasticsearch failed](https://discuss.elastic.co/t/upgrade-elk-7-start-elasticsearch-failed/177394)

<div class="topic-metadata">

**Author:** [@shaonbean](https://discuss.elastic.co/u/shaonbean)\
**Replies:** 4\
**Last updated:** [April 18, 2019, 11:58pm UTC](https://discuss.elastic.co/t/upgrade-elk-7-start-elasticsearch-failed/177394 "2019-04-18T23:58:03Z")

</div>

\[2019-04-18T10:22:34,929\]\[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[es-1\] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and \[cluster.initial\_master\_nodes\] is empty on t…

---

## [Max number of shards per elasticsearch data node](https://discuss.elastic.co/t/max-number-of-shards-per-elasticsearch-data-node/84607)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 4\
**Last updated:** [May 7, 2017, 4:54am UTC](https://discuss.elastic.co/t/max-number-of-shards-per-elasticsearch-data-node/84607 "2017-05-07T04:54:18Z")

</div>

Is there any limitation on the number of shards a data node can have?

---

## [Override file for elasticsearch.yml](https://discuss.elastic.co/t/override-file-for-elasticsearch-yml/24170)

<div class="topic-metadata">

**Author:** [@rrva](https://discuss.elastic.co/u/rrva)\
**Replies:** 4\
**Last updated:** [June 23, 2015, 11:47am UTC](https://discuss.elastic.co/t/override-file-for-elasticsearch-yml/24170 "2015-06-23T11:47:37Z")

</div>

Is it possible to make elasticsearch first read elasticsearch.yml and then apply a elasticsearch-local.yml which overrides any setting found in elasticsearch.yml ? That way I can have any local changes not be overridden …

---

## [Restore MediaWiki ElasticSearch functionality](https://discuss.elastic.co/t/restore-mediawiki-elasticsearch-functionality/301786)

<div class="topic-metadata">

**Author:** [@lenhartp](https://discuss.elastic.co/u/lenhartp)\
**Replies:** 5\
**Last updated:** [April 13, 2022, 5:29pm UTC](https://discuss.elastic.co/t/restore-mediawiki-elasticsearch-functionality/301786 "2022-04-13T17:29:32Z")

</div>

A couple months ago, had a mediawiki server with 3 wikis running on it dumped in my lap to support. The search box was using CirrusSearch and Elasticsearch / Elastica to generate results, but that was recently broken whe…

---

## [One index field update based on some condition on field of another index](https://discuss.elastic.co/t/one-index-field-update-based-on-some-condition-on-field-of-another-index/234702)

<div class="topic-metadata">

**Author:** [@sarvendras](https://discuss.elastic.co/u/sarvendras)\
**Replies:** 5\
**Last updated:** [June 1, 2020, 8:24pm UTC](https://discuss.elastic.co/t/one-index-field-update-based-on-some-condition-on-field-of-another-index/234702 "2020-06-01T20:24:38Z")

</div>

Hi Elastic Team, I have two index with below fields. Index1: index1 has 2 below fields. RRN Flag 1 nofraud 2 nofraud 3 nofraud 4 fraud Index2: this has only 1 field RRN 1 2 …

---

## [Cluster \[271f47\] Reindex across clusters?](https://discuss.elastic.co/t/cluster-271f47-reindex-across-clusters/58474)

<div class="topic-metadata">

**Author:** [@Steve\_Suh](https://discuss.elastic.co/u/Steve_Suh)\
**Replies:** 5\
**Last updated:** [August 20, 2016, 4:12am UTC](https://discuss.elastic.co/t/cluster-271f47-reindex-across-clusters/58474 "2016-08-20T04:12:31Z")

</div>

Is it possible to reindex across clusters? In this case, I'm trying to migrate from ElasticCloud on Heroku to a different cluster on ElasticCloud on AWS.

---

## [How to index nested mysql object into elasticsearch using logstash?](https://discuss.elastic.co/t/how-to-index-nested-mysql-object-into-elasticsearch-using-logstash/47600)

<div class="topic-metadata">

**Author:** [@Yangrui\_Guo](https://discuss.elastic.co/u/Yangrui_Guo)\
**Replies:** 1\
**Last updated:** [April 18, 2016, 9:11pm UTC](https://discuss.elastic.co/t/how-to-index-nested-mysql-object-into-elasticsearch-using-logstash/47600 "2016-04-18T21:11:26Z")

</div>

I'm trying to index mysql database with elasticsearch. Consider the example mapping: {"blog": {"properties": {"id": "string"} {"author": "string"} {"time\_created": } {"author\_info": {"author\_n…

---

## [No such file or directory, open 'C:\\path\\to\\your\\client.crt'](https://discuss.elastic.co/t/no-such-file-or-directory-open-c-path-to-your-client-crt/110391)

<div class="topic-metadata">

**Author:** [@pragadeesh\_dharsha](https://discuss.elastic.co/u/pragadeesh_dharsha)\
**Replies:** 3\
**Last updated:** [December 7, 2017, 5:44pm UTC](https://discuss.elastic.co/t/no-such-file-or-directory-open-c-path-to-your-client-crt/110391 "2017-12-07T17:44:15Z")

</div>

can anyone tell me how to resolve this error?\[Capture\]

---

## [What do these ES logs mean](https://discuss.elastic.co/t/what-do-these-es-logs-mean/38537)

<div class="topic-metadata">

**Author:** [@mad\_min](https://discuss.elastic.co/u/mad_min)\
**Replies:** 3\
**Last updated:** [February 18, 2016, 2:33am UTC](https://discuss.elastic.co/t/what-do-these-es-logs-mean/38537 "2016-02-18T02:33:48Z")

</div>

Hi List, I am seeing the following logs pop up quite regularly (many times a minute, to many times in 10 minutes). What do they mean: \[2016-01-06 13:51:31,733\]\[INFO \]\[monitor.jvm \] \[srv-4\] \[gc\]\[old\]\[130378…

---

## [Libbeat kafka output](https://discuss.elastic.co/t/libbeat-kafka-output/35488)

<div class="topic-metadata">

**Author:** [@mattweber](https://discuss.elastic.co/u/mattweber)\
**Replies:** 3\
**Last updated:** [November 26, 2015, 9:36am UTC](https://discuss.elastic.co/t/libbeat-kafka-output/35488 "2015-11-26T09:36:32Z")

</div>

Any plans for a kafka output? Looking to send beat events directly to Kafka which can then be consumed by (multiple) Logstash instances using the Kafka input.

---

## [How to install kibana-authentication-proxy?](https://discuss.elastic.co/t/how-to-install-kibana-authentication-proxy/17048)

<div class="topic-metadata">

**Author:** [@andrea06590](https://discuss.elastic.co/u/andrea06590)\
**Replies:** 3\
**Last updated:** [July 30, 2014, 6:56am UTC](https://discuss.elastic.co/t/how-to-install-kibana-authentication-proxy/17048 "2014-07-30T06:56:34Z")

</div>

Hello, I'm now looking for security in my elasticsearch cluster, and I would like to ask the user to login, and then to give him the right index. For example, the user adminSec would have access to the SECURITY-\* ind…

---

## [Opinion needed about Document design for recursive sub-objects/documents](https://discuss.elastic.co/t/opinion-needed-about-document-design-for-recursive-sub-objects-documents/13798)

<div class="topic-metadata">

**Author:** [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\
**Replies:** 3\
**Last updated:** [September 30, 2013, 11:48am UTC](https://discuss.elastic.co/t/opinion-needed-about-document-design-for-recursive-sub-objects-documents/13798 "2013-09-30T11:48:11Z")

</div>

Hello, I am approaching document design to ease the process on Elasticsearch. I am using ES to extract stats from ES. The frontend is the well known Kibana. The main difference between the typical setup is: …

---

## [Search analyzer not being applied](https://discuss.elastic.co/t/search-analyzer-not-being-applied/5288)

<div class="topic-metadata">

**Author:** [@Mattias\_Nordberg](https://discuss.elastic.co/u/Mattias_Nordberg)\
**Replies:** 3\
**Last updated:** [August 31, 2011, 3:07pm UTC](https://discuss.elastic.co/t/search-analyzer-not-being-applied/5288 "2011-08-31T15:07:26Z")

</div>

Hi, I've got an index which has been configured to use the snowball analyzer (English) as both index\_analyzer and search\_analyzer. The problem is that it doesn't appear to be applied to any search queries, but work…

---

## [Unable to verify that the server is ElasticSearch due to unsuccesful product check call](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000)

<div class="topic-metadata">

**Author:** [@charlot\_Attard](https://discuss.elastic.co/u/charlot_Attard)\
**Replies:** 2\
**Last updated:** [June 23, 2022, 1:20pm UTC](https://discuss.elastic.co/t/unable-to-verify-that-the-server-is-elasticsearch-due-to-unsuccesful-product-check-call/308000 "2022-06-23T13:20:31Z")

</div>

Hello, We have an application connecting with NEST to ES Version 7.17. Intermitently we are facing this issue Unable to verify that the server is ElasticSearch due to unsuccesful product check call. Some functionality …

---

## [Parsing log with comma separated key value pairs](https://discuss.elastic.co/t/parsing-log-with-comma-separated-key-value-pairs/176942)

<div class="topic-metadata">

**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\
**Replies:** 2\
**Last updated:** [April 15, 2019, 6:52pm UTC](https://discuss.elastic.co/t/parsing-log-with-comma-separated-key-value-pairs/176942 "2019-04-15T18:52:43Z")

</div>

Hi all, I have a log file some like this. 2019-01-30T06:01:02.551-07:00;82828;10400035;INFO;Measure vehicle detected;System Vehicle detected;"CAL\_CHKS=,CAL\_CPPX=0,CAL\_CPPY=0,CAM\_CUSR=CAM\_CUSR,CAM\_NUMB=1,CAM\_NUS2…

---

## [Filtering data deppending on the user](https://discuss.elastic.co/t/filtering-data-deppending-on-the-user/78816)

<div class="topic-metadata">

**Author:** [@ecabanas](https://discuss.elastic.co/u/ecabanas)\
**Replies:** 2\
**Last updated:** [March 16, 2017, 5:38pm UTC](https://discuss.elastic.co/t/filtering-data-deppending-on-the-user/78816 "2017-03-16T17:38:54Z")

</div>

Hi, I'm really new using this incredible tool. I installed kibana in my test server and some questions came up. 1º Is it possible to give access to some data deppending on the user? for example, user A can only see d…

---

## [GeoLite2 and ASN in v.5.6](https://discuss.elastic.co/t/geolite2-and-asn-in-v-5-6/106713)

<div class="topic-metadata">

**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\
**Replies:** 1\
**Last updated:** [November 9, 2017, 10:52am UTC](https://discuss.elastic.co/t/geolite2-and-asn-in-v-5-6/106713 "2017-11-09T10:52:22Z")

</div>

I'm trying to get our Geo location filter to work again after patching from v.2.4 to v.5.6. First I found that I needed manually to convert our geopoint data to floats where previous they were float like their sources (…

---

## [Elasticsearch Nested Match Last Value](https://discuss.elastic.co/t/elasticsearch-nested-match-last-value/92219)

<div class="topic-metadata">

**Author:** [@muthuvel](https://discuss.elastic.co/u/muthuvel)\
**Replies:** 1\
**Last updated:** [July 7, 2017, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-nested-match-last-value/92219 "2017-07-07T13:09:54Z")

</div>

We have article & edited authors as array. Need to check How many article last edited by particular author. Data: { "Article" : \[ { "id" : 12 "title" : "An article title", "categorie…

---

## [Indices all gone but i don't think i did it](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370)

<div class="topic-metadata">

**Author:** [@switchedfabric](https://discuss.elastic.co/u/switchedfabric)\
**Replies:** 1\
**Last updated:** [January 12, 2017, 5:35pm UTC](https://discuss.elastic.co/t/indices-all-gone-but-i-dont-think-i-did-it/71370 "2017-01-12T17:35:02Z")

</div>

Hi all, I've been running ES 5 for some time (say a month) now and all has been well, but last night all my indices were deleted. I see this in the log (the second line): ---- 8\< ---- \[2017-01-11T21:23:04,357\]\[WARN …

---

## [How to index Sharepoint files?](https://discuss.elastic.co/t/how-to-index-sharepoint-files/222959)

<div class="topic-metadata">

**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\
**Replies:** 6\
**Last updated:** [March 11, 2020, 7:15pm UTC](https://discuss.elastic.co/t/how-to-index-sharepoint-files/222959 "2020-03-11T19:15:00Z")

</div>

Hello, I am building an app that can search files across server, S3, Share point and Dropbox. I was able to search across files in servers, thanks to FsCrawler!! Exploring on how to index files from Share point right …

---

## [Overall Average of count returns float value need Integer](https://discuss.elastic.co/t/overall-average-of-count-returns-float-value-need-integer/220271)

<div class="topic-metadata">

**Author:** [@vikasp](https://discuss.elastic.co/u/vikasp)\
**Replies:** 6\
**Last updated:** [March 9, 2020, 11:31pm UTC](https://discuss.elastic.co/t/overall-average-of-count-returns-float-value-need-integer/220271 "2020-03-09T23:31:31Z")

</div>

Hi, I created a Kibana visualization (data table) that will give the overall average of the count of the messages split by rows (for the values in status.keyword). I am getting an average value fine and good for the se…

---

## [Identifying the stale indices in Elasticsearch](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537)

<div class="topic-metadata">

**Author:** [@vineethsuhas](https://discuss.elastic.co/u/vineethsuhas)\
**Replies:** 4\
**Last updated:** [March 29, 2021, 8:36pm UTC](https://discuss.elastic.co/t/identifying-the-stale-indices-in-elasticsearch/268537 "2021-03-29T20:36:01Z")

</div>

Hi, I want to delete the indices which are stale (Not being accessed since last month). Is there a way to identify the indices which are not in use since one month? I could not find any stats on the indices which corre…

---

## [\[SOLVED\] I can't use winlogbeat with Kibana](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908)

<div class="topic-metadata">

**Author:** [@Christian\_SG](https://discuss.elastic.co/u/Christian_SG)\
**Replies:** 4\
**Last updated:** [February 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/solved-i-cant-use-winlogbeat-with-kibana/263908 "2021-02-11T14:12:41Z")

</div>

Hi everyone, I'm running elasticsearch and Kibana in a Debian10 machine, everything was working perfectly. Then I tried intalling winlogbeat in a Windows10 machine and here comes my problem, I've been searching for many …

---

## [Painless query very slowly](https://discuss.elastic.co/t/painless-query-very-slowly/127295)

<div class="topic-metadata">

**Author:** [@fapwlh](https://discuss.elastic.co/u/fapwlh)\
**Replies:** 4\
**Last updated:** [April 9, 2018, 10:17am UTC](https://discuss.elastic.co/t/painless-query-very-slowly/127295 "2018-04-09T10:17:07Z")

</div>

I'm a beginner, when I use painless script to search ,very slowly ,but use date\_histogram very quickly. \`POST /productinfo/\_search { "aggs": { "groupbyyear":{ "terms": { "script": { "lang": "painless", "source":"…

---

## [Trying to configure Marvel on monitored node gets "Illegal User Settings"](https://discuss.elastic.co/t/trying-to-configure-marvel-on-monitored-node-gets-illegal-user-settings/70703)

<div class="topic-metadata">

**Author:** [@DonL](https://discuss.elastic.co/u/DonL)\
**Replies:** 4\
**Last updated:** [January 5, 2017, 6:04pm UTC](https://discuss.elastic.co/t/trying-to-configure-marvel-on-monitored-node-gets-illegal-user-settings/70703 "2017-01-05T18:04:55Z")

</div>

I am attempting to follow the documentation to get marvel monitoring set up for my 2.4 cluster. The doc (https://www.elastic.co/guide/en/shield/current/marvel.html) says to input this in the YAML config: marvel.agent…

---

## [Elasticsearch 5.1.1 与 repository hdfs 集成启动出错](https://discuss.elastic.co/t/elasticsearch-5-1-1-repository-hdfs/69656)

<div class="topic-metadata">

**Author:** [@111145](https://discuss.elastic.co/u/111145)\
**Replies:** 1\
**Last updated:** [January 13, 2017, 9:01am UTC](https://discuss.elastic.co/t/elasticsearch-5-1-1-repository-hdfs/69656 "2017-01-13T09:01:59Z")

</div>

已经下载好了 repository hdfs ，但配置 elasticsearch.yml 出错，不能识别 hdfs 属性。 \[2016-12-21T04:49:58,120\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] \[node-1\] uncaught exception in thread \[main\] org.elasticsearch.bootstrap.Star…

---

## [Logstash Keystore While Running As A Service](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262)

<div class="topic-metadata">

**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Replies:** 5\
**Last updated:** [June 30, 2021, 4:15pm UTC](https://discuss.elastic.co/t/logstash-keystore-while-running-as-a-service/277262 "2021-06-30T16:15:16Z")

</div>

Hello Team, I have created Logstash Keystore with command sudo -E /usr/share/logstash/bin/logstash-keystore --path.settings /etc/logstash create but while running /usr/share/logstash/bin/logstash-keystore list it is thro…

---

## [Filebeat Holds open rotated log files](https://discuss.elastic.co/t/filebeat-holds-open-rotated-log-files/138259)

<div class="topic-metadata">

**Author:** [@aforster](https://discuss.elastic.co/u/aforster)\
**Replies:** 5\
**Last updated:** [July 16, 2018, 5:37pm UTC](https://discuss.elastic.co/t/filebeat-holds-open-rotated-log-files/138259 "2018-07-16T17:37:48Z")

</div>

On our kubernetes clusters we have an issue caused by filebeat holding open rotated log files for too long. Filebeat needs a more native understanding of log file rotation. Docker is configured to rotate logs at 20meg a…

---

## [WhiteSpaceTokenizer buffer\_size](https://discuss.elastic.co/t/whitespacetokenizer-buffer-size/32387)

<div class="topic-metadata">

**Author:** [@ananth](https://discuss.elastic.co/u/ananth)\
**Replies:** 5\
**Last updated:** [April 19, 2016, 11:34am UTC](https://discuss.elastic.co/t/whitespacetokenizer-buffer-size/32387 "2016-04-19T11:34:16Z")

</div>

My analysis conf as follows, index : analysis : analyzer : default\_index : type : custom tokenizer : whitespace filter : \[ word\_delimiter, snowball, lowercase\] …

---

## [Unbalanced loading on 2-identical-node cluster](https://discuss.elastic.co/t/unbalanced-loading-on-2-identical-node-cluster/8074)

<div class="topic-metadata">

**Author:** [@ywtsang](https://discuss.elastic.co/u/ywtsang)\
**Replies:** 5\
**Last updated:** [June 20, 2012, 1:07am UTC](https://discuss.elastic.co/t/unbalanced-loading-on-2-identical-node-cluster/8074 "2012-06-20T01:07:25Z")

</div>

I have setup a 2-node cluster, but 1 node is showing high CPU usage/high GC number while the other is showing normal. Let me describe the basic details of the setup: - 2 separate and "identical" machines, 32G ram…

---

## [How to migration frozen index to hot or warm?](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817)

<div class="topic-metadata">

**Author:** [@InJong\_Park](https://discuss.elastic.co/u/InJong_Park)\
**Replies:** 2\
**Last updated:** [November 17, 2022, 5:38am UTC](https://discuss.elastic.co/t/how-to-migration-frozen-index-to-hot-or-warm/318817 "2022-11-17T05:38:14Z")

</div>

Hello I'm InJong from korea. I have a frozen indices with datastream. (in Elastic Cloud) I want to move frozen tier index to another tier. (hot, warm, cold) I checked document -\> "Migrate index allocation filters to …

---

## [Load balanced access to fleet servers](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210)

<div class="topic-metadata">

**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\
**Replies:** 2\
**Last updated:** [March 22, 2022, 7:10am UTC](https://discuss.elastic.co/t/load-balanced-access-to-fleet-servers/300210 "2022-03-22T07:10:41Z")

</div>

Hi, I have setup 2 fleet servers successfully and want all additional elastic agents to connect to them via loadbalanced IP (haproxy with "round robin" option). Whenever I configure the loadbalanced URL instead of the …

---

## [Sprintf +FORMAT Field Reference](https://discuss.elastic.co/t/sprintf-format-field-reference/184226)

<div class="topic-metadata">

**Author:** [@josh\_jacques](https://discuss.elastic.co/u/josh_jacques)\
**Replies:** 2\
**Last updated:** [June 4, 2019, 8:46pm UTC](https://discuss.elastic.co/t/sprintf-format-field-reference/184226 "2019-06-04T20:46:23Z")

</div>

Under the sprintf section of Accessing Event Data and Fields in the Configuration in the logstash reference. There is mention of being able to use a +FORMAT to format the @timestamp..in their example they mention using …

---

## [\[SOLVED\] How to manage HUGE log messages sent to ELK stack over-the-wire?](https://discuss.elastic.co/t/solved-how-to-manage-huge-log-messages-sent-to-elk-stack-over-the-wire/78054)

<div class="topic-metadata">

**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\
**Replies:** 2\
**Last updated:** [March 11, 2017, 6:07pm UTC](https://discuss.elastic.co/t/solved-how-to-manage-huge-log-messages-sent-to-elk-stack-over-the-wire/78054 "2017-03-11T18:07:37Z")

</div>

I've been using ELK for centralized logging service, and rsyslog as my shipper. Rsyslog wraps the log events in a JSON format. However, some of our application logs are HUGE, e.g., stack traces, and when Logstash recei…

---

## [ELK 7.3 monitoring show "No items found" for certain time range](https://discuss.elastic.co/t/elk-7-3-monitoring-show-no-items-found-for-certain-time-range/195133)

<div class="topic-metadata">

**Author:** [@YOULYU\_ZHANG](https://discuss.elastic.co/u/YOULYU_ZHANG)\
**Replies:** 8\
**Last updated:** [August 16, 2019, 1:34pm UTC](https://discuss.elastic.co/t/elk-7-3-monitoring-show-no-items-found-for-certain-time-range/195133 "2019-08-16T13:34:03Z")

</div>

We've build a new ES 7.3 cluster, and then notice the "Nodes" page does not correctly show data for certain time range. Question: I want to confirm this is a known bug or this is due to our setup mistake. All version …

---

## [Metricbeat in Kubernetes - 404 error for Kubernetes module events](https://discuss.elastic.co/t/metricbeat-in-kubernetes-404-error-for-kubernetes-module-events/181653)

<div class="topic-metadata">

**Author:** [@chandra2037](https://discuss.elastic.co/u/chandra2037)\
**Replies:** 3\
**Last updated:** [June 3, 2019, 4:17pm UTC](https://discuss.elastic.co/t/metricbeat-in-kubernetes-404-error-for-kubernetes-module-events/181653 "2019-06-03T16:17:59Z")

</div>

Hello, I am running Metricbeat 7.0.1 on Kubernetes cluster (Server V1.14), followed the official instructions, and enabled System, Docker, Kubernetes modules. System and Docker modules working where I can see the data i…

---

## [Importing data for use with Google Charts](https://discuss.elastic.co/t/importing-data-for-use-with-google-charts/11440)

<div class="topic-metadata">

**Author:** [@OffensivelyBad\_2](https://discuss.elastic.co/u/OffensivelyBad_2)\
**Replies:** 3\
**Last updated:** [April 5, 2013, 3:11pm UTC](https://discuss.elastic.co/t/importing-data-for-use-with-google-charts/11440 "2013-04-05T15:11:26Z")

</div>

I'm attempting to render a Google Chart based on an Elasticsearch query. Here is my non-working code: The issue I'm running into is that the data returne…

---

## [Configuring multiple nodes](https://discuss.elastic.co/t/configuring-multiple-nodes/300922)

<div class="topic-metadata">

**Author:** [@albert2022](https://discuss.elastic.co/u/albert2022)\
**Replies:** 7\
**Last updated:** [April 11, 2022, 9:33am UTC](https://discuss.elastic.co/t/configuring-multiple-nodes/300922 "2022-04-11T09:33:45Z")

</div>

We try to run an Elasticsearch cluster with multiple nodes on the same VM for testing purpose and for this we are using the following docker compose file: version: "2.2" services: es01: image: docker.elastic.co/e…

---

## [How to use Analyze index disk usage API?](https://discuss.elastic.co/t/how-to-use-analyze-index-disk-usage-api/285119)

<div class="topic-metadata">

**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\
**Replies:** 7\
**Last updated:** [September 30, 2021, 5:22pm UTC](https://discuss.elastic.co/t/how-to-use-analyze-index-disk-usage-api/285119 "2021-09-30T17:22:32Z")

</div>

Hi, We'd like to know how to use \_disk\_usage api. We are trying to figure out how much disk is used by individual fields in an index. The example mentioned in the doc is a POST request but it has no example data…

---

## [Red status because of 1 index has an unassigned shard](https://discuss.elastic.co/t/red-status-because-of-1-index-has-an-unassigned-shard/31551)

<div class="topic-metadata">

**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\
**Replies:** 7\
**Last updated:** [October 2, 2015, 6:02pm UTC](https://discuss.elastic.co/t/red-status-because-of-1-index-has-an-unassigned-shard/31551 "2015-10-02T18:02:40Z")

</div>

I left elastic running and came back to find that my status is red. I have 9 indices and only 1 of them is giving me a red status the rest are fine: logstash-2015.10.01-systemstats":{ "status":"red", "number\_of\_shard…

---

## [Running elasticsearch-sql-cli Script on Remote Machines](https://discuss.elastic.co/t/running-elasticsearch-sql-cli-script-on-remote-machines/205143)

<div class="topic-metadata">

**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Replies:** 6\
**Last updated:** [October 31, 2019, 12:39pm UTC](https://discuss.elastic.co/t/running-elasticsearch-sql-cli-script-on-remote-machines/205143 "2019-10-31T12:39:03Z")

</div>

Hello again Elasticsearch wizards, I have what is probably a stupid Java question. I’ve spun up a Docker container of Elasticsearch v7.4.0, and I’m loving the “elasticsearch-sql-cli” script you can use to submit SQL-li…

---

## [Ruby filter inline code keeps logstash to restart](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526)

<div class="topic-metadata">

**Author:** [@paano](https://discuss.elastic.co/u/paano)\
**Replies:** 6\
**Last updated:** [October 29, 2019, 6:41pm UTC](https://discuss.elastic.co/t/ruby-filter-inline-code-keeps-logstash-to-restart/204526 "2019-10-29T18:41:13Z")

</div>

I have a local docker ELK stack OSS image running and it works. Version: 6.5.4 When deployed into the enterprise ELK stack which is 6.5.4, it crashes the logstash instance. Error: \[2019-10-21T10:58:20,568\]\[ERROR\]\[log…

---

## [Error in shipping logs from Logstash to Elasticsearch](https://discuss.elastic.co/t/error-in-shipping-logs-from-logstash-to-elasticsearch/41346)

<div class="topic-metadata">

**Author:** [@sukhada369](https://discuss.elastic.co/u/sukhada369)\
**Replies:** 6\
**Last updated:** [April 29, 2016, 3:07pm UTC](https://discuss.elastic.co/t/error-in-shipping-logs-from-logstash-to-elasticsearch/41346 "2016-04-29T15:07:15Z")

</div>

Error while forwarding filebeat indexed logs from Logstash to Elasticsearch. Following is the content ¨Beats input: the pipeline is blocked, temporary refusing new connection.¨

---

## [Using Script field in Search Query](https://discuss.elastic.co/t/using-script-field-in-search-query/7520)

<div class="topic-metadata">

**Author:** [@Rahul\_Sharma](https://discuss.elastic.co/u/Rahul_Sharma)\
**Replies:** 6\
**Last updated:** [May 3, 2012, 2:13pm UTC](https://discuss.elastic.co/t/using-script-field-in-search-query/7520 "2012-05-03T14:13:43Z")

</div>

Hi, Stuck with a simple issue, it would be really great if any of you can help me out. Trying to use a scriptField in a search query. But as I execute the query, it runs forever does not come out of execution. Am…

---

## [Logstash raising json\_e\_o\_f\_exception when input events are coming from elastisearch](https://discuss.elastic.co/t/logstash-raising-json-e-o-f-exception-when-input-events-are-coming-from-elastisearch/127635)

<div class="topic-metadata">

**Author:** [@Zhihai\_Xian](https://discuss.elastic.co/u/Zhihai_Xian)\
**Replies:** 2\
**Last updated:** [April 11, 2018, 11:25pm UTC](https://discuss.elastic.co/t/logstash-raising-json-e-o-f-exception-when-input-events-are-coming-from-elastisearch/127635 "2018-04-11T23:25:31Z")

</div>

Here is my configuration file input { elasticsearch { hosts =\> \["XXXXXXXXXXXXXX.ap-southeast-1.es.amazonaws.com:443"\] index =\> "transcripts" query =\> '{ "query": { "match\_all": {} }' scroll =\> "5m" size =\> 100 ss…

---

## [ECE In AWS on Centos AMI](https://discuss.elastic.co/t/ece-in-aws-on-centos-ami/118140)

<div class="topic-metadata">

**Author:** [@allenb](https://discuss.elastic.co/u/allenb)\
**Replies:** 2\
**Last updated:** [February 6, 2018, 7:47pm UTC](https://discuss.elastic.co/t/ece-in-aws-on-centos-ami/118140 "2018-02-06T19:47:56Z")

</div>

I have followed the ECE installation instructions using the centos ami in AWS and have successfully created a cloud on 3 EC2 instances. After creating my first cluster and enabling Kibana the logon screen shows 'Login is…

[Previous page](https://discuss.elastic.co/top.md?page=973&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=975&per_page=50&period=all)
