# Top **URL:** https://discuss.elastic.co/top.md?page=975&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 976 --- ## [Time offset with Visual Builder](https://discuss.elastic.co/t/time-offset-with-visual-builder/117446)
**Author:** [@krsna](https://discuss.elastic.co/u/krsna)\ **Replies:** 2\ **Last updated:** [January 29, 2018, 12:55pm UTC](https://discuss.elastic.co/t/time-offset-with-visual-builder/117446 "2018-01-29T12:55:31Z")
Hello, Does any one know if it is possible in Visual Builder to create a graph with time offset? I want to create a network traffic graph where I want to see the traffic for current week overlapped with the traffic of la… --- ## [Any alternative for \_ttl mapping](https://discuss.elastic.co/t/any-alternative-for--ttl-mapping/53367)
**Author:** [@sandipelastic](https://discuss.elastic.co/u/sandipelastic)\ **Replies:** 2\ **Last updated:** [July 20, 2016, 6:10pm UTC](https://discuss.elastic.co/t/any-alternative-for--ttl-mapping/53367 "2016-07-20T18:10:48Z")
I am using Elasticsearch 2.3.3 and I found out that \_ttl (time to live) mapping was deprecated. I am wondering if there is any alternative mapping for automatic deletion of documents. Any comments and suggestions would b… --- ## [Elasticsearch on aws ec2 index very slow](https://discuss.elastic.co/t/elasticsearch-on-aws-ec2-index-very-slow/38120)
**Author:** [@AdaYang](https://discuss.elastic.co/u/AdaYang)\ **Replies:** 2\ **Last updated:** [December 29, 2015, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-ec2-index-very-slow/38120 "2015-12-29T21:07:45Z")
Set up elasticsearch 2.1 3 nodes 5 shards cluster in ec2 aws using m4.large (8G) instance. I am bulk indexing using java transport client . The same index run in my local mac takes about 6 minutes to index 500K documents… --- ## [Removing fields from Index](https://discuss.elastic.co/t/removing-fields-from-index/301623)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 4\ **Last updated:** [April 8, 2022, 5:56am UTC](https://discuss.elastic.co/t/removing-fields-from-index/301623 "2022-04-08T05:56:17Z")
Hi sorry for bothering you everytime. I upload some logs into elastic via filebeat, but there is some other information added to my original logs like the host name os kernel ..., and the main message become unformatted… --- ## [Help with parsing Kafka key](https://discuss.elastic.co/t/help-with-parsing-kafka-key/173542)
**Author:** [@Ed\_K](https://discuss.elastic.co/u/Ed_K)\ **Replies:** 4\ **Last updated:** [March 26, 2019, 6:19pm UTC](https://discuss.elastic.co/t/help-with-parsing-kafka-key/173542 "2019-03-26T18:19:04Z")
Hello, I currently use \[@metadata\]\[kafka\]\[key\] to set the document ID of all my messages from the kafka input. I want to implement a way to also route the message to the appropriate index. There are 2 options I am thinki… --- ## [New node cannot join existing cluster: IOException\[Connection Refused\]](https://discuss.elastic.co/t/new-node-cannot-join-existing-cluster-ioexception-connection-refused/142058)
**Author:** [@Mr\_BAU](https://discuss.elastic.co/u/Mr_BAU)\ **Replies:** 4\ **Last updated:** [July 30, 2018, 10:32am UTC](https://discuss.elastic.co/t/new-node-cannot-join-existing-cluster-ioexception-connection-refused/142058 "2018-07-30T10:32:11Z")
Hi All, this has me puzzled for quite a while now. I've been trying to add a 3rd node to our 2-node setup to avoid split brain situation but for the life of me I cannot get the 3rd node inside the cluster. On a networ… --- ## [Logstash 2.2 OutOfMemoryError](https://discuss.elastic.co/t/logstash-2-2-outofmemoryerror/43710)
**Author:** [@Jim\_Jepson](https://discuss.elastic.co/u/Jim_Jepson)\ **Replies:** 4\ **Last updated:** [March 8, 2016, 9:25pm UTC](https://discuss.elastic.co/t/logstash-2-2-outofmemoryerror/43710 "2016-03-08T21:25:17Z")
We are trying to use Winlogbeats to archive off our Windows logs. To start this, we setup a Linux server running the latest ELK. On one of our three Windows 2012 R2 DC's we setup winlogbeats to ship the logs to the Ubu… --- ## [Which doesn't exists on any documents in the "jv-\*" index pattern](https://discuss.elastic.co/t/which-doesnt-exists-on-any-documents-in-the-jv-index-pattern/136707)
**Author:** [@atom](https://discuss.elastic.co/u/atom)\ **Replies:** 3\ **Last updated:** [June 21, 2018, 6:46am UTC](https://discuss.elastic.co/t/which-doesnt-exists-on-any-documents-in-the-jv-index-pattern/136707 "2018-06-21T06:46:20Z")
Hi, i am getting the following error message if i am trying to use a new field i have created today: Filtering occus on the "geolocation.keyword" field, which doesn't exists on any documents in the "jv-\*" index patter… --- ## [The button "Create" in the Index Patterns being disabled](https://discuss.elastic.co/t/the-button-create-in-the-index-patterns-being-disabled/92173)
**Author:** [@Vincent\_Xian](https://discuss.elastic.co/u/Vincent_Xian)\ **Replies:** 3\ **Last updated:** [July 7, 2017, 10:21pm UTC](https://discuss.elastic.co/t/the-button-create-in-the-index-patterns-being-disabled/92173 "2017-07-07T22:21:55Z")
I think that it is related to the warning message "No default index pattern. You must select or create one to continue." But the problem is that i do not know how to get around this. Therefore, any help will be appreci… --- ## [Elasticsearch with multihost docker networking - Cluster connectivity issues](https://discuss.elastic.co/t/elasticsearch-with-multihost-docker-networking-cluster-connectivity-issues/49671)
**Author:** [@ajay\_bh111](https://discuss.elastic.co/u/ajay_bh111)\ **Replies:** 3\ **Last updated:** [May 15, 2016, 6:41am UTC](https://discuss.elastic.co/t/elasticsearch-with-multihost-docker-networking-cluster-connectivity-issues/49671 "2016-05-15T06:41:32Z")
When using external networking using calico, cluster nodes though can talk to each other on ports 9200 & 9300 but additional port needed for cluster discovery being dynamic hence are not opened by default. Therefore disc… --- ## [URI query not matching all fields](https://discuss.elastic.co/t/uri-query-not-matching-all-fields/174523)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 5\ **Last updated:** [April 2, 2019, 6:29pm UTC](https://discuss.elastic.co/t/uri-query-not-matching-all-fields/174523 "2019-04-02T18:29:09Z")
This query is returning documents that don't match all the listed fields (they don't even have these fields). type.keyword:"rsyslog" AND severity.keyword:("alert" OR "err" OR "crit") AND @timestamp:\[now-10m TO now\] Enc… --- ## [Unable to send email via Exchange notification](https://discuss.elastic.co/t/unable-to-send-email-via-exchange-notification/148968)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 5\ **Last updated:** [September 24, 2018, 9:20am UTC](https://discuss.elastic.co/t/unable-to-send-email-via-exchange-notification/148968 "2018-09-24T09:20:29Z")
that is my watcher configuration: "trigger" : { "schedule" : { "interval" : "24h" } }, "input" : { "search" : { "request" : { "indices" : \[ "index\_v2" \], "body" : { "size" : 0, "query" : { "match" : { "sev": "w… --- ## [Application Dependency Monitoring](https://discuss.elastic.co/t/application-dependency-monitoring/87914)
**Author:** [@vikramshinde](https://discuss.elastic.co/u/vikramshinde)\ **Replies:** 5\ **Last updated:** [June 12, 2017, 1:57pm UTC](https://discuss.elastic.co/t/application-dependency-monitoring/87914 "2017-06-12T13:57:45Z")
Hello friends, I am monitoring application which has different components. I would like to monitor dependencies between different components or different servers (if each component is deployed on different server). So … --- ## [Scripted\_metric in Kibana visualization](https://discuss.elastic.co/t/scripted-metric-in-kibana-visualization/76008)
**Author:** [@elk\_user1](https://discuss.elastic.co/u/elk_user1)\ **Replies:** 5\ **Last updated:** [February 27, 2017, 4:10pm UTC](https://discuss.elastic.co/t/scripted-metric-in-kibana-visualization/76008 "2017-02-27T16:10:24Z")
Hi All, I wanted to know if there is any support for using scripted\_metric aggregations in Kibana ? I wrote an elasticsearch query which uses scripted\_metric, but I want to use it in visualizations. I am using Kibana… --- ## [Kibana 5 Metribeat Dashboard/Servers Overview Won't Show More than 5 Servers](https://discuss.elastic.co/t/kibana-5-metribeat-dashboard-servers-overview-wont-show-more-than-5-servers/64331)
**Author:** [@elJoeyJojo](https://discuss.elastic.co/u/elJoeyJojo)\ **Replies:** 5\ **Last updated:** [November 2, 2016, 4:31pm UTC](https://discuss.elastic.co/t/kibana-5-metribeat-dashboard-servers-overview-wont-show-more-than-5-servers/64331 "2016-11-02T16:31:43Z")
Hello ELK Users: I recently installed and setup my new EK Server and everything works fine but I did notice that the "Servers Overview" filter on Kibana doesn't list more than 5 servers. So I thought I'd go in and edit … --- ## [Multiple regexp query?](https://discuss.elastic.co/t/multiple-regexp-query/80117)
**Author:** [@Anubha\_Agrawal](https://discuss.elastic.co/u/Anubha_Agrawal)\ **Replies:** 1\ **Last updated:** [March 31, 2017, 7:04am UTC](https://discuss.elastic.co/t/multiple-regexp-query/80117 "2017-03-31T07:04:05Z")
I want to query two fields at the same time using regexp. For example- With the sample Shakespeare dataset present in Elasticsearch, I want to query fields play\_name and speaker. I want to get entries where play\_name is … --- ## [Optimize logstash tcp input plugin](https://discuss.elastic.co/t/optimize-logstash-tcp-input-plugin/337847)
**Author:** [@true64gurus](https://discuss.elastic.co/u/true64gurus)\ **Replies:** 7\ **Last updated:** [July 18, 2023, 1:33pm UTC](https://discuss.elastic.co/t/optimize-logstash-tcp-input-plugin/337847 "2023-07-18T13:33:26Z")
Hello, I have 10 Kubernetes clusters forward their logs to logstash VM (k8s fluentd ---\> logstash port 7000) . Logstash gets to a point where logs are being missed and source pods doing retries to get logs through . (… --- ## [How to determine separation between labels in axis?](https://discuss.elastic.co/t/how-to-determine-separation-between-labels-in-axis/269861)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 8\ **Last updated:** [April 29, 2021, 3:38pm UTC](https://discuss.elastic.co/t/how-to-determine-separation-between-labels-in-axis/269861 "2021-04-29T15:38:50Z")
Hello, If we consider above chart as an example, by default labels are separated with difference of 20. Is there any way that we can control the difference/separation between labels? --- ## [Parsing specific values from logs in logstash configuration](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 8\ **Last updated:** [February 16, 2017, 7:28am UTC](https://discuss.elastic.co/t/parsing-specific-values-from-logs-in-logstash-configuration/75288 "2017-02-16T07:28:14Z")
Hi, I am currently using default logstash configuration to parse the apache server access log file and index it to elasticsearch. However, I don't want to parse all fields in log but say specific ones like IP, Referrer… --- ## [Created simple filebeat module for ProxySQL](https://discuss.elastic.co/t/created-simple-filebeat-module-for-proxysql/283380)
**Author:** [@altuhovsu](https://discuss.elastic.co/u/altuhovsu)\ **Replies:** 0\ **Last updated:** [September 5, 2021, 5:16pm UTC](https://discuss.elastic.co/t/created-simple-filebeat-module-for-proxysql/283380 "2021-09-05T17:16:02Z")
If anyone needed, I have created (cloned from mysql module) a simple Filebeat module for parsing ProxySQL logs and ship them to ElasticSearch. https://github.com/altuhovsu/filebeat-proxysql-module --- ## [Empty buckets for filtered nested aggregation in 5.0 version](https://discuss.elastic.co/t/empty-buckets-for-filtered-nested-aggregation-in-5-0-version/66351)
**Author:** [@ithilmar](https://discuss.elastic.co/u/ithilmar)\ **Replies:** 0\ **Last updated:** [November 17, 2016, 9:02am UTC](https://discuss.elastic.co/t/empty-buckets-for-filtered-nested-aggregation-in-5-0-version/66351 "2016-11-17T09:02:24Z")
Hello! I have some problem with filtered nested terms bucket aggregation. Mappings data for 'region' field: { 'type': 'nested', 'properties': { 'country': {'type': 'keyword'}, … --- ## [Bin elasticsearch-env file - possible bug?](https://discuss.elastic.co/t/bin-elasticsearch-env-file-possible-bug/109266)
**Author:** [@morphers82](https://discuss.elastic.co/u/morphers82)\ **Replies:** 1\ **Last updated:** [November 27, 2017, 6:36pm UTC](https://discuss.elastic.co/t/bin-elasticsearch-env-file-possible-bug/109266 "2017-11-27T18:36:26Z")
I've only been able to run 2-6.0 ES nodes on a single server by manually editing the /usr/share/elasticsearch/bin/elasticsearch-env file before running the seperately configured elasticsearch.service files (ie running sy… --- ## [Mlockall fails](https://discuss.elastic.co/t/mlockall-fails/11453)
**Author:** [@Ophir\_Michaeli](https://discuss.elastic.co/u/Ophir_Michaeli)\ **Replies:** 7\ **Last updated:** [April 8, 2013, 7:01pm UTC](https://discuss.elastic.co/t/mlockall-fails/11453 "2013-04-08T19:01:22Z")
Hi, I set "bootstrap.mlockall = true" at elasticsearch.yml and added "common.jna: DEBUG " at config.yml. At logs\\ pinterest\_cluster.log I get the following message: " unable to link C library. native me… --- ## [Allocation Failed](https://discuss.elastic.co/t/allocation-failed/328097)
**Author:** [@fnitz](https://discuss.elastic.co/u/fnitz)\ **Replies:** 6\ **Last updated:** [March 20, 2023, 5:58pm UTC](https://discuss.elastic.co/t/allocation-failed/328097 "2023-03-20T17:58:03Z")
Hi, I've got many error messages like that: { "index" : "logstash-prod\_operations\_clear-001098", "shard" : 0, "primary" : false, "current\_state" : "unassigned", "unassigned\_info" : { "reason" : "ALLOCATIO… --- ## [Kibana 6.4.0 Error 500](https://discuss.elastic.co/t/kibana-6-4-0-error-500/207827)
**Author:** [@Eric\_Yong](https://discuss.elastic.co/u/Eric_Yong)\ **Replies:** 6\ **Last updated:** [December 3, 2019, 5:12am UTC](https://discuss.elastic.co/t/kibana-6-4-0-error-500/207827 "2019-12-03T05:12:22Z")
I have 2 clusters of ES + Kibana running, but only 1 of the cluster has problems. Each cluster consists of 2Master, 2Data, 2 Client, and 1 Kibana. All running on EC2 (without docker or k8s) After restarting the kibana,… --- ## [How to start kibana from docker](https://discuss.elastic.co/t/how-to-start-kibana-from-docker/139285)
**Author:** [@bamboo2222](https://discuss.elastic.co/u/bamboo2222)\ **Replies:** 6\ **Last updated:** [July 11, 2018, 1:06am UTC](https://discuss.elastic.co/t/how-to-start-kibana-from-docker/139285 "2018-07-11T01:06:03Z")
Hi, I want to develop kibana from docker and the kibana source code(adding some plugins and change some source code) and try to write a dockerfile to start it. I have a server running elasticsearch. However, when I run … --- ## [How well does the syslog output module handle queuing if the destination host goes down temporarily? Or what is the best way to send logs to a 3rd party?](https://discuss.elastic.co/t/how-well-does-the-syslog-output-module-handle-queuing-if-the-destination-host-goes-down-temporarily-or-what-is-the-best-way-to-send-logs-to-a-3rd-party/93443)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 6\ **Last updated:** [August 8, 2017, 8:26pm UTC](https://discuss.elastic.co/t/how-well-does-the-syslog-output-module-handle-queuing-if-the-destination-host-goes-down-temporarily-or-what-is-the-best-way-to-send-logs-to-a-3rd-party/93443 "2017-08-08T20:26:41Z")
We've recently been asked to ship a portion of our logs to a client at their datacenter. We are currently using the syslog output module to send logs from logstash to another internal device at the end of our pipeline. … --- ## [org.elasticsearch.xpack.XPackClient does not exist in the downloaded jar file](https://discuss.elastic.co/t/org-elasticsearch-xpack-xpackclient-does-not-exist-in-the-downloaded-jar-file/82536)
**Author:** [@Sharat\_Jagannath](https://discuss.elastic.co/u/Sharat_Jagannath)\ **Replies:** 6\ **Last updated:** [April 18, 2017, 4:03pm UTC](https://discuss.elastic.co/t/org-elasticsearch-xpack-xpackclient-does-not-exist-in-the-downloaded-jar-file/82536 "2017-04-18T16:03:05Z")
hi I downloaded the xpack transport jar file v 5.3 from https://www.elastic.co/guide/en/x-pack/current/java-clients.html After that i tested with example- import java.net.InetAddress; import org.elasticsea… --- ## [Designing elasticsearch cluster for a SOC](https://discuss.elastic.co/t/designing-elasticsearch-cluster-for-a-soc/323647)
**Author:** [@TomSLV](https://discuss.elastic.co/u/TomSLV)\ **Replies:** 4\ **Last updated:** [January 22, 2023, 1:09pm UTC](https://discuss.elastic.co/t/designing-elasticsearch-cluster-for-a-soc/323647 "2023-01-22T13:09:13Z")
Hi everyone, I'm Tom, i'm a soc analyst since 4 years and i'm actually working for a company who want to put a SIEM. I've read many blog post on how to designing/sizing an elasticsearch cluster but i want to have your f… --- ## [Ingest array of JSON objects](https://discuss.elastic.co/t/ingest-array-of-json-objects/222216)
**Author:** [@abregman](https://discuss.elastic.co/u/abregman)\ **Replies:** 4\ **Last updated:** [March 5, 2020, 12:35pm UTC](https://discuss.elastic.co/t/ingest-array-of-json-objects/222216 "2020-03-05T12:35:20Z")
Is it possible to import into elasticsearch an array of JSON objects? Something like this: \[{'a': 1}, {'b': 2}, ...\] Right now I get this error when trying to do so: "Malformed action/metadata line \[1\], expected START\_… --- ## [What is \[use\_field\_mapping\] format?](https://discuss.elastic.co/t/what-is-use-field-mapping-format/186416)
**Author:** [@simple\_commentateur](https://discuss.elastic.co/u/simple_commentateur)\ **Replies:** 4\ **Last updated:** [July 5, 2019, 8:35am UTC](https://discuss.elastic.co/t/what-is-use-field-mapping-format/186416 "2019-07-05T08:35:48Z")
Hi, I have a problem with my shards failing so I check es logs. I find this warning : \[instance-0000000005\] \[use\_field\_mapping\] is a special format that was only used to ease the transition to 7.x. It has become the d… --- ## [Filtering by Event source](https://discuss.elastic.co/t/filtering-by-event-source/125073)
**Author:** [@elasticprof](https://discuss.elastic.co/u/elasticprof)\ **Replies:** 4\ **Last updated:** [March 22, 2018, 6:01pm UTC](https://discuss.elastic.co/t/filtering-by-event-source/125073 "2018-03-22T18:01:51Z")
Hi How can i filter by EventSource, the events are sent from one of our custom applications and i wanted to log only those messages but not all messages for "Application" for example i want to send the messages only fr… --- ## [We are trying to move Elasticsearch Data from Docker Container to Kubernetes Pod , the default Data path for ES pod is /usr/share/elasticsearch/data/nodes/0/](https://discuss.elastic.co/t/we-are-trying-to-move-elasticsearch-data-from-docker-container-to-kubernetes-pod-the-default-data-path-for-es-pod-is-usr-share-elasticsearch-data-nodes-0/295553)
**Author:** [@AnushaK](https://discuss.elastic.co/u/AnushaK)\ **Replies:** 3\ **Last updated:** [January 27, 2022, 9:36am UTC](https://discuss.elastic.co/t/we-are-trying-to-move-elasticsearch-data-from-docker-container-to-kubernetes-pod-the-default-data-path-for-es-pod-is-usr-share-elasticsearch-data-nodes-0/295553 "2022-01-27T09:36:30Z")
Hi , I am trying to copy the indices from the source Elasticsearch to the target Elasticsearch under /usr/share/Elasticsearch/data/nodes/0/indices/. Source and target path is same /usr/share/Elasticsearch/data/nodes/0/i… --- ## [EQL syntax error?](https://discuss.elastic.co/t/eql-syntax-error/277301)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 3\ **Last updated:** [June 30, 2021, 4:30pm UTC](https://discuss.elastic.co/t/eql-syntax-error/277301 "2021-06-30T16:30:01Z")
I'm trying to inspect the results of an EQL query (based on the built-in hosts modification rule). However when I run the EQL query : file where event.type in ("change", "creation") and file.path : ("/private/… --- ## [Autonomous System Number (ASN) not displaying](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195)
**Author:** [@Justin\_Doles](https://discuss.elastic.co/u/Justin_Doles)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 7:58pm UTC](https://discuss.elastic.co/t/autonomous-system-number-asn-not-displaying/206195 "2019-11-01T19:58:09Z")
I have an index that I've created that follows the ECS standard. Within the index I have the source.as.\* and destination.as.\* fields that are populated using the GeoLite2ASN database. The fields are being populated in … --- ## [Ingest pipeline to extract data](https://discuss.elastic.co/t/ingest-pipeline-to-extract-data/183516)
**Author:** [@nicks1993](https://discuss.elastic.co/u/nicks1993)\ **Replies:** 3\ **Last updated:** [May 31, 2019, 4:46pm UTC](https://discuss.elastic.co/t/ingest-pipeline-to-extract-data/183516 "2019-05-31T16:46:13Z")
if I want to extract the numeric duration value from words::words::words::words (duration=432, words) would this grok pipeline work PUT \_ingest/pipeline/parse { "description" : "parses the duration field", "process… --- ## [Metricbeat yaml drop\_event.when.regexp.mount\_point filter not working as expected not working as expected](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275)
**Author:** [@naveengauba](https://discuss.elastic.co/u/naveengauba)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 11:57pm UTC](https://discuss.elastic.co/t/metricbeat-yaml-drop-event-when-regexp-mount-point-filter-not-working-as-expected-not-working-as-expected/125275 "2018-03-22T23:57:42Z")
Hi there I am using metricbeat to monitor storage for a specific mount\_point on Linux machine. In order to get to data for that mount\_point I am using the drop\_event.when.regexp.mount\_point filter in the metricbeat.yaml… --- ## [Filebeat error shipping logs =\> read: connection reset by peer (no TLS/SSL)](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438)
**Author:** [@zokratez](https://discuss.elastic.co/u/zokratez)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 5:28pm UTC](https://discuss.elastic.co/t/filebeat-error-shipping-logs-read-connection-reset-by-peer-no-tls-ssl/79438 "2017-03-21T17:28:55Z")
I searched in the other topics but cannot find the solution to my problem.... Scenary: FileBeat 5.2.2.1 Filebeat-input-plugin 3.1.14 ELK 5.2 I have 4 server successfully sending logs to the logstash servers... I cre… --- ## [ILM has rolled over indices way over the limits](https://discuss.elastic.co/t/ilm-has-rolled-over-indices-way-over-the-limits/210620)
**Author:** [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\ **Replies:** 5\ **Last updated:** [December 16, 2019, 5:56pm UTC](https://discuss.elastic.co/t/ilm-has-rolled-over-indices-way-over-the-limits/210620 "2019-12-16T17:56:34Z")
I setup a policy (ILM) for an index to roll over to a new index when: maximum index size = 50GB or maximum age = 1d Right now, I have 3 indexes which were created by the policy above, but their size is way above 50GB. g… --- ## [404 GET \_fields\_for\_wildcards error in kibana](https://discuss.elastic.co/t/404-get-fields-for-wildcards-error-in-kibana/134513)
**Author:** [@kesha](https://discuss.elastic.co/u/kesha)\ **Replies:** 5\ **Last updated:** [June 6, 2018, 4:17pm UTC](https://discuss.elastic.co/t/404-get-fields-for-wildcards-error-in-kibana/134513 "2018-06-06T16:17:01Z")
Kibana version: 6.2.3 Elasticsearch version:6.2.3 Bowser version: Firefox 60.0.1 (64-bit) OS: CentOS 6 Apache Reverse Proxy Conf: \ ProxyPass http://localhost:5601/elasticsearch ProxyPassReverse… --- ## [Integrating mongodb with elasticSearch](https://discuss.elastic.co/t/integrating-mongodb-with-elasticsearch/7531)
**Author:** [@coys](https://discuss.elastic.co/u/coys)\ **Replies:** 5\ **Last updated:** [May 31, 2017, 6:54am UTC](https://discuss.elastic.co/t/integrating-mongodb-with-elasticsearch/7531 "2017-05-31T06:54:19Z")
Hi, I'm trying to integrate mongodb with elasticsearch and for some reason I cant seem to get this working. I think there's something messed up with the version number combination I'm using - mongodb- linux 64 2.0.4 ,… --- ## [PHP Client without composer](https://discuss.elastic.co/t/php-client-without-composer/68469)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 2\ **Last updated:** [December 9, 2016, 3:36pm UTC](https://discuss.elastic.co/t/php-client-without-composer/68469 "2016-12-09T15:36:08Z")
I see in the docs that composer and ext-curl are required for the PHP client. I wouldn't want to install things on my shared servers. I don't want to spin up an EC2 instance just to accommodate my search. Isn't there… --- ## [Multiple ssl certificates in logstash-forwarder](https://discuss.elastic.co/t/multiple-ssl-certificates-in-logstash-forwarder/27337)
**Author:** [@iamrudra](https://discuss.elastic.co/u/iamrudra)\ **Replies:** 1\ **Last updated:** [August 13, 2015, 9:34pm UTC](https://discuss.elastic.co/t/multiple-ssl-certificates-in-logstash-forwarder/27337 "2015-08-13T21:34:06Z")
The basic/example config shipped with logstash-forwarder states the following for listing multiple downstream servers: ... #A list of downstream servers listening for our messages. #logstash-forwarder will pick one a… --- ## [Get all the records without the need of specifying the size](https://discuss.elastic.co/t/get-all-the-records-without-the-need-of-specifying-the-size/19543)
**Author:** [@Drole](https://discuss.elastic.co/u/Drole)\ **Replies:** 1\ **Last updated:** [September 1, 2014, 2:47am UTC](https://discuss.elastic.co/t/get-all-the-records-without-the-need-of-specifying-the-size/19543 "2014-09-01T02:47:06Z")
Hi, I need to query all the URL in my index using terms since I only want to get the unique URLs, but the number of returned record is determined by the size, which for the example below is 10. What should i do t… --- ## [Synonyms containing commas](https://discuss.elastic.co/t/synonyms-containing-commas/160504)
**Author:** [@mags107](https://discuss.elastic.co/u/mags107)\ **Replies:** 3\ **Last updated:** [December 13, 2018, 2:18am UTC](https://discuss.elastic.co/t/synonyms-containing-commas/160504 "2018-12-13T02:18:21Z")
When updating a synonym list via the API, not using a synonym text file. We have a synonym list that has values that contain commas causes a json parsing error if the normal escape sequence is used e.g. , Given that the… --- ## [How to send apache logs using filebeat?](https://discuss.elastic.co/t/how-to-send-apache-logs-using-filebeat/133800)
**Author:** [@Saketh\_Chandra\_Kolis](https://discuss.elastic.co/u/Saketh_Chandra_Kolis)\ **Replies:** 3\ **Last updated:** [May 30, 2018, 10:14pm UTC](https://discuss.elastic.co/t/how-to-send-apache-logs-using-filebeat/133800 "2018-05-30T22:14:01Z")
hi, I am new to filebeat. I didn't understand the filebeat documentation.In filebeat.yml when the you specify the path to directory which has your log files,how are the going get parsed,is there any use of config file w… --- ## [ES 6.2.1 Unassigned shards due to DANGLING\_INDEX\_IMPORTED](https://discuss.elastic.co/t/es-6-2-1-unassigned-shards-due-to-dangling-index-imported/121896)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 3\ **Last updated:** [March 22, 2018, 7:26pm UTC](https://discuss.elastic.co/t/es-6-2-1-unassigned-shards-due-to-dangling-index-imported/121896 "2018-03-22T19:26:53Z")
Hi Team, I am getting unassigned shards after I added a new data node to the cluster. This is the sequence of actions that I did prior that lead to unassigned shards: Cluster is green Then on host A, where there is a … --- ## [Unable to create mapping using cURL commands](https://discuss.elastic.co/t/unable-to-create-mapping-using-curl-commands/22440)
**Author:** [@Anandkumar\_Gunasekar](https://discuss.elastic.co/u/Anandkumar_Gunasekar)\ **Replies:** 3\ **Last updated:** [February 27, 2015, 9:46pm UTC](https://discuss.elastic.co/t/unable-to-create-mapping-using-curl-commands/22440 "2015-02-27T21:46:59Z")
Hi All, I am unable to create mappings to an index using cURL command. \*cURL command to create index:\* C:\\Program Files\\cURL\\bin\>curl -XPUT "http://localhost:9200/a" {"acknowledged":true} \*cURL command to cr… --- ## [Best way of faceting on boolean field](https://discuss.elastic.co/t/best-way-of-faceting-on-boolean-field/10511)
**Author:** [@roytmana](https://discuss.elastic.co/u/roytmana)\ **Replies:** 3\ **Last updated:** [January 26, 2013, 4:23pm UTC](https://discuss.elastic.co/t/best-way-of-faceting-on-boolean-field/10511 "2013-01-26T16:23:12Z")
Helllo, When faceting on boolean field by default ES uses T and F for values. I would prefer Yes, No, N/A (when it is blank) but I do not want to pollute my source json substituting boolean for Yes, No, N/A string… --- ## [ES for a social network application](https://discuss.elastic.co/t/es-for-a-social-network-application/7416)
**Author:** [@alheim](https://discuss.elastic.co/u/alheim)\ **Replies:** 3\ **Last updated:** [July 25, 2012, 6:17am UTC](https://discuss.elastic.co/t/es-for-a-social-network-application/7416 "2012-07-25T06:17:42Z")
Hi, We build a social network application and we use ES to enable our users to browse content with facets and text search. Everything works fine. Now we would like to enable the users to filter what they ha… [Previous page](https://discuss.elastic.co/top.md?page=974&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=976&per_page=50&period=all)