# Top **URL:** https://discuss.elastic.co/top.md?page=979&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 980 --- ## [Delete by query: keeping only the most recent N documents](https://discuss.elastic.co/t/delete-by-query-keeping-only-the-most-recent-n-documents/261764)
**Author:** [@jminuscula](https://discuss.elastic.co/u/jminuscula)\ **Replies:** 3\ **Last updated:** [January 22, 2021, 9:02am UTC](https://discuss.elastic.co/t/delete-by-query-keeping-only-the-most-recent-n-documents/261764 "2021-01-22T09:02:28Z")
Hi there, I want to control the number of documents in our index, so I'm planning on running a delete by query periodically. Our documents look something like this: { "client": "a51b8afa8710ccbad1", … --- ## [External actions after file transfer](https://discuss.elastic.co/t/external-actions-after-file-transfer/74937)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 3\ **Last updated:** [February 16, 2017, 5:09pm UTC](https://discuss.elastic.co/t/external-actions-after-file-transfer/74937 "2017-02-16T17:09:04Z")
Hi, I have a requirement to perform an action after successful harvesting by FileBeats (e.g. move the file to archive dir) and was wondering what the best practices/options are for this ? There is nothing I can see i… --- ## [Problem with detection \[rules\]](https://discuss.elastic.co/t/problem-with-detection-rules/274443)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 2\ **Last updated:** [June 3, 2021, 4:51pm UTC](https://discuss.elastic.co/t/problem-with-detection-rules/274443 "2021-06-03T16:51:55Z")
I have successfully transferred logs from winlog to logstash on prem to elastic/kibana cloud. I have created index pattern and discovered data. In order to test if everything works fine I went have created a new user on … --- ## [Kibana refresh field list not working](https://discuss.elastic.co/t/kibana-refresh-field-list-not-working/186513)
**Author:** [@Ahana\_Ambshri](https://discuss.elastic.co/u/Ahana_Ambshri)\ **Replies:** 2\ **Last updated:** [June 20, 2019, 3:26pm UTC](https://discuss.elastic.co/t/kibana-refresh-field-list-not-working/186513 "2019-06-20T15:26:52Z")
Hey, I am sending heartbeat and metricbeat logs from host A to Security Onion's logstash. I can see little triangles next to multiple fields. I have refreshed the indexes multiple times (management -\> index pattern -\> :… --- ## [Multiple foreach processors on array of JSON](https://discuss.elastic.co/t/multiple-foreach-processors-on-array-of-json/99728)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 2\ **Last updated:** [September 11, 2017, 11:31am UTC](https://discuss.elastic.co/t/multiple-foreach-processors-on-array-of-json/99728 "2017-09-11T11:31:28Z")
In the docs for the foreach processor, it says “The foreach processor does restore the original value, so that value is available to processors after the foreach processor.” Can someone clarify what this means? I have t… --- ## [Can we use DNS entries instead of IP address to access elasticsearch?](https://discuss.elastic.co/t/can-we-use-dns-entries-instead-of-ip-address-to-access-elasticsearch/72508)
**Author:** [@Annie178](https://discuss.elastic.co/u/Annie178)\ **Replies:** 2\ **Last updated:** [January 23, 2017, 11:27pm UTC](https://discuss.elastic.co/t/can-we-use-dns-entries-instead-of-ip-address-to-access-elasticsearch/72508 "2017-01-23T23:27:28Z")
Hi all, I have a query that I have been unable to test as of yet. I am setting up an elasticsearch service on my laptop and shipping logs from other servers. As my laptop uses dynamic IP addresses, I was thinking … --- ## [Beats output to Logstash over HTTP?](https://discuss.elastic.co/t/beats-output-to-logstash-over-http/42185)
**Author:** [@plonka2000](https://discuss.elastic.co/u/plonka2000)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 1:40pm UTC](https://discuss.elastic.co/t/beats-output-to-logstash-over-http/42185 "2016-02-19T13:40:03Z")
Hi, I've been looking around to find a way to ship events from various libbeat applications to Logstash, but I need to do it over HTTP using basic authentication. I have seen that libbeat is able to ship to Elasticse… --- ## [Jsonp support in elasticsearch](https://discuss.elastic.co/t/jsonp-support-in-elasticsearch/35655)
**Author:** [@andy.m](https://discuss.elastic.co/u/andy.m)\ **Replies:** 2\ **Last updated:** [November 26, 2015, 12:22pm UTC](https://discuss.elastic.co/t/jsonp-support-in-elasticsearch/35655 "2015-11-26T12:22:39Z")
Hello, Reading the elastic search documentation here: https://www.elastic.co/guide/en/elasticsearch/reference/1.4/common-options.html#\_jsonp I see that adding http.jsonp.enable: true To the config.yaml file should e… --- ## [Can ELK configure Remote Syslog Forwarding to Third party syslog server?](https://discuss.elastic.co/t/can-elk-configure-remote-syslog-forwarding-to-third-party-syslog-server/316953)
**Author:** [@wcpoon](https://discuss.elastic.co/u/wcpoon)\ **Replies:** 5\ **Last updated:** [October 20, 2022, 3:30am UTC](https://discuss.elastic.co/t/can-elk-configure-remote-syslog-forwarding-to-third-party-syslog-server/316953 "2022-10-20T03:30:26Z")
Hi All, Can ELK Stack able to configure remote syslog forwarding to another syslog server? Kindly please advise. Thanks. --- ## [Caught exception while handling client http traffic, closing connection 1.7.4](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-1-7-4/75427)
**Author:** [@whybangbang](https://discuss.elastic.co/u/whybangbang)\ **Replies:** 1\ **Last updated:** [February 17, 2017, 3:19am UTC](https://discuss.elastic.co/t/caught-exception-while-handling-client-http-traffic-closing-connection-1-7-4/75427 "2017-02-17T03:19:14Z")
sometime this log will happen , and all request will be slowed, i have google this issue, but no great solutions, please help me, thank you! --- ## [Error in 5.0.0-alpha5](https://discuss.elastic.co/t/error-in-5-0-0-alpha5/60729)
**Author:** [@Bradly](https://discuss.elastic.co/u/Bradly)\ **Replies:** 1\ **Last updated:** [September 16, 2016, 3:27pm UTC](https://discuss.elastic.co/t/error-in-5-0-0-alpha5/60729 "2016-09-16T15:27:29Z")
I have a elasticsearch cluster here at my office that I have been using to do various things trying to learn more about it. I decided I wanted to upgrade to the new version. At any rate now elasticsearch wont start. I… --- ## [Elasticsearch 2.0 NoClassDefFoundError for JsonXContentGenerator](https://discuss.elastic.co/t/elasticsearch-2-0-noclassdeffounderror-for-jsonxcontentgenerator/34251)
**Author:** [@mkstsph](https://discuss.elastic.co/u/mkstsph)\ **Replies:** 1\ **Last updated:** [March 9, 2016, 10:51pm UTC](https://discuss.elastic.co/t/elasticsearch-2-0-noclassdeffounderror-for-jsonxcontentgenerator/34251 "2016-03-09T22:51:21Z")
Hello, I am trying to update my elasticsearch java client api version from 1.4.2 to 2.0.0. But when I use: XContentBuilder builder = XContentFactory.jsonBuilder() It used to work in 1.4.2 but I get this exception in … --- ## [Help parsing nested JSON with dynamic top key](https://discuss.elastic.co/t/help-parsing-nested-json-with-dynamic-top-key/41069)
**Author:** [@thesilence](https://discuss.elastic.co/u/thesilence)\ **Replies:** 1\ **Last updated:** [February 6, 2016, 2:50pm UTC](https://discuss.elastic.co/t/help-parsing-nested-json-with-dynamic-top-key/41069 "2016-02-06T14:50:19Z")
Hi everyone, I am looking for help to tackle a fairly difficult problem for an unexperienced logstash user. I have an application that pushes JSON messages to redis. The message format is the following: I need t… --- ## [Determine the user that acknowledged an Alert](https://discuss.elastic.co/t/determine-the-user-that-acknowledged-an-alert/349426)
**Author:** [@lastshadow](https://discuss.elastic.co/u/lastshadow)\ **Replies:** 5\ **Last updated:** [December 21, 2023, 4:21pm UTC](https://discuss.elastic.co/t/determine-the-user-that-acknowledged-an-alert/349426 "2023-12-21T16:21:32Z")
I have several SOC analysts in my SIEM and need to figure out the following: How do I determine who acknowledged an alert? How can the analysts filter their acknowledged alerts so they only see what they have acknowled… --- ## [Kibana alerting - how to access log messages](https://discuss.elastic.co/t/kibana-alerting-how-to-access-log-messages/249709)
**Author:** [@carl0s](https://discuss.elastic.co/u/carl0s)\ **Replies:** 4\ **Last updated:** [September 29, 2020, 12:09pm UTC](https://discuss.elastic.co/t/kibana-alerting-how-to-access-log-messages/249709 "2020-09-29T12:09:35Z")
I've set up a Log Threshold alert to match on errors in the message and I'd like to send the matching logs in the webhook action I've created. It doesn't seem like there's a way to get these yet? --- ## [Elasticsearch Data Directory size anomaly](https://discuss.elastic.co/t/elasticsearch-data-directory-size-anomaly/141742)
**Author:** [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Replies:** 4\ **Last updated:** [July 26, 2018, 11:30am UTC](https://discuss.elastic.co/t/elasticsearch-data-directory-size-anomaly/141742 "2018-07-26T11:30:37Z")
Hi All , It is a theoretical question. I am indexed almost 2 GB of data in elasticsearch with default Shards & Replicas . Logs indexed from Feb 1 to July 15 year . Index name is with respect to date . ie in log… --- ## [How to import 'File outputed' Metricbeat data into ES via Logstash](https://discuss.elastic.co/t/how-to-import-file-outputed-metricbeat-data-into-es-via-logstash/94986)
**Author:** [@Patrick\_Stevens](https://discuss.elastic.co/u/Patrick_Stevens)\ **Replies:** 4\ **Last updated:** [August 28, 2017, 5:53pm UTC](https://discuss.elastic.co/t/how-to-import-file-outputed-metricbeat-data-into-es-via-logstash/94986 "2017-08-28T17:53:21Z")
Hi, I am attempting to use Logstash to import Metricbeat ‘file output’ files into Elasticsearch. I am using file output on Metricbeat because the servers I’m monitoring are on a different domain than my ES, Logstash, and… --- ## [Rsyslog is not forwarding logs to elasticsearch](https://discuss.elastic.co/t/rsyslog-is-not-forwarding-logs-to-elasticsearch/322266)
**Author:** [@Aksel](https://discuss.elastic.co/u/Aksel)\ **Replies:** 6\ **Last updated:** [January 1, 2023, 6:37pm UTC](https://discuss.elastic.co/t/rsyslog-is-not-forwarding-logs-to-elasticsearch/322266 "2023-01-01T18:37:25Z")
I'm trying to configure rsyslog to send logs to logstash and then forward them to elasticsearch. I have create a config file /etc/rsyslog.d/60-output.conf with the following content: \*.\* @localhost:10514;json-template … --- ## [setFrom() method of SearchRequestBuilder class only accepts a int value](https://discuss.elastic.co/t/setfrom-method-of-searchrequestbuilder-class-only-accepts-a-int-value/7959)
**Author:** [@kanishk](https://discuss.elastic.co/u/kanishk)\ **Replies:** 6\ **Last updated:** [June 5, 2012, 7:52am UTC](https://discuss.elastic.co/t/setfrom-method-of-searchrequestbuilder-class-only-accepts-a-int-value/7959 "2012-06-05T07:52:05Z")
setFrom() method of SearchRequestBuilder class only accept a int value, so if i have to fetch record which is greater than a int value (2147483647) for example - SearchRequestBuilder.setFrom(21474836478) The… --- ## [.Net client socket error after many inserts](https://discuss.elastic.co/t/net-client-socket-error-after-many-inserts/304088)
**Author:** [@r03](https://discuss.elastic.co/u/r03)\ **Replies:** 3\ **Last updated:** [May 10, 2022, 3:47pm UTC](https://discuss.elastic.co/t/net-client-socket-error-after-many-inserts/304088 "2022-05-10T15:47:35Z")
I'm trying to create documents in Elastic with the .Net client. (7.17.1 on server 8.1.3) This works, but on the first sync I have many documents and after a lot of successul inserts the elastic client stops working. I … --- ## [That is an error from the auditbeat client. Any solutions to fix this problem?](https://discuss.elastic.co/t/that-is-an-error-from-the-auditbeat-client-any-solutions-to-fix-this-problem/204571)
**Author:** [@pbona](https://discuss.elastic.co/u/pbona)\ **Replies:** 3\ **Last updated:** [November 1, 2019, 2:16am UTC](https://discuss.elastic.co/t/that-is-an-error-from-the-auditbeat-client-any-solutions-to-fix-this-problem/204571 "2019-11-01T02:16:34Z")
root@dcim:~# auditbeat setup Exiting: Couldn't connect to any of the configured Elasticsearch hosts. Errors: \[Error connection to Elasticsearch https://172.16.5.199:9200: 401 Unauthorized: {"error":{"root\_cause":\[{"type… --- ## [Skewed shards on index even with enough disk space in all physical nodes](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:48pm UTC](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974 "2019-10-24T15:48:43Z")
Hi everyone, I have an index (shown below) which is not evenly distributed accross my 10 data nodes cluster. Each node in the cluster has at least 1.1 TB free, only the one called arm-lc-004 has ~700GB free only bu… --- ## [Filter Data Table Column Using Dropdown Filter](https://discuss.elastic.co/t/filter-data-table-column-using-dropdown-filter/194928)
**Author:** [@r\_singh10](https://discuss.elastic.co/u/r_singh10)\ **Replies:** 3\ **Last updated:** [August 27, 2019, 10:54pm UTC](https://discuss.elastic.co/t/filter-data-table-column-using-dropdown-filter/194928 "2019-08-27T22:54:58Z")
Imagine a table with 4 columns. Is there a way I can use the Dropdown Filter element within Canvas to only show the selected columns within the table? For example, look at this table found on Apple.com. Notice how you… --- ## [Kafka Output Recurring I/O Timeout](https://discuss.elastic.co/t/kafka-output-recurring-i-o-timeout/176764)
**Author:** [@Or\_Arnon](https://discuss.elastic.co/u/Or_Arnon)\ **Replies:** 3\ **Last updated:** [April 16, 2019, 12:26pm UTC](https://discuss.elastic.co/t/kafka-output-recurring-i-o-timeout/176764 "2019-04-16T12:26:50Z")
Hi, We're seeing Filebeat getting: kafka/log.go:53 producer/broker/1036 state change to \[closing\] because write tcp 10.200.1.158:49334-\>10.200.3.121:9092: i/o timeout This causes Filebeat to re-connect to Kafka broke… --- ## [Reindex fails with array mapped to geo\_point](https://discuss.elastic.co/t/reindex-fails-with-array-mapped-to-geo-point/172853)
**Author:** [@getorca](https://discuss.elastic.co/u/getorca)\ **Replies:** 3\ **Last updated:** [March 20, 2019, 5:47am UTC](https://discuss.elastic.co/t/reindex-fails-with-array-mapped-to-geo-point/172853 "2019-03-20T05:47:21Z")
I'm attempting to reindex after changing the mapping of one field from type text to type geo\_point. The existing data in the source index looks like (but the lat\_long mapping type = text): "location" : { … --- ## [Arcgis Maps to Kibana](https://discuss.elastic.co/t/arcgis-maps-to-kibana/139185)
**Author:** [@He\_Pamela](https://discuss.elastic.co/u/He_Pamela)\ **Replies:** 3\ **Last updated:** [July 13, 2018, 3:10pm UTC](https://discuss.elastic.co/t/arcgis-maps-to-kibana/139185 "2018-07-13T15:10:32Z")
Hi, Is It possible to integrate an Arcgis map to use in Kibana. And if it 's possible, How can I do it? Thanks. --- ## [Filtering for two chars strings on keyword field does not work?](https://discuss.elastic.co/t/filtering-for-two-chars-strings-on-keyword-field-does-not-work/116409)
**Author:** [@ste2c](https://discuss.elastic.co/u/ste2c)\ **Replies:** 3\ **Last updated:** [January 22, 2018, 12:44pm UTC](https://discuss.elastic.co/t/filtering-for-two-chars-strings-on-keyword-field-does-not-work/116409 "2018-01-22T12:44:07Z")
Hi all, I cannot understand how to filter for two chars strings a simple keyword field. I created the field like this: "tags": { "store": True, "type": "keyword" }, ..the "tags" field is then populated with a lis… --- ## [How to monitor or find logs regarding elasticsearch-hadoop plugin for hive](https://discuss.elastic.co/t/how-to-monitor-or-find-logs-regarding-elasticsearch-hadoop-plugin-for-hive/109885)
**Author:** [@Harbeer\_Kadian](https://discuss.elastic.co/u/Harbeer_Kadian)\ **Replies:** 3\ **Last updated:** [December 14, 2017, 7:37pm UTC](https://discuss.elastic.co/t/how-to-monitor-or-find-logs-regarding-elasticsearch-hadoop-plugin-for-hive/109885 "2017-12-14T19:37:46Z")
I am using elasticsearch-hadoop plugin inside hive to insert record from hive to elasticsearch. I need to get hold of insertion logs and if possible some way to monitor how the insertion is going. I checked elasticsearch… --- ## [Rabbitmq input metadata](https://discuss.elastic.co/t/rabbitmq-input-metadata/101348)
**Author:** [@Charlotte\_EGM](https://discuss.elastic.co/u/Charlotte_EGM)\ **Replies:** 3\ **Last updated:** [September 22, 2017, 11:19am UTC](https://discuss.elastic.co/t/rabbitmq-input-metadata/101348 "2017-09-22T11:19:26Z")
Hi, I would like to see the metadata of my rabbitmq input. I have set metadata\_enabled to true and then i added this : add\_field =\> { "topic" =\> "%{\[@metadata\]\[rabbitmq\_properties\]\[routing-key\]}"} Unfortunately I en… --- ## [Dev Tools Console Error](https://discuss.elastic.co/t/dev-tools-console-error/89351)
**Author:** [@jhn134910](https://discuss.elastic.co/u/jhn134910)\ **Replies:** 3\ **Last updated:** [June 28, 2017, 6:57pm UTC](https://discuss.elastic.co/t/dev-tools-console-error/89351 "2017-06-28T18:57:52Z")
Hello there, I'm using Kibana 5.4.0 where Kibana is operating behind a web-server and is using x-pack security. I've created some visualizations and dashboards. When I click on DevTools-\>Console and execute say: GET /\_c… --- ## [Error ,upgrading Kibana 4.5.4 to 4.6.0 =\>Visualize: orderAgg is undefined](https://discuss.elastic.co/t/error-upgrading-kibana-4-5-4-to-4-6-0-visualize-orderagg-is-undefined/59665)
**Author:** [@Diyal](https://discuss.elastic.co/u/Diyal)\ **Replies:** 2\ **Last updated:** [September 5, 2016, 8:02am UTC](https://discuss.elastic.co/t/error-upgrading-kibana-4-5-4-to-4-6-0-visualize-orderagg-is-undefined/59665 "2016-09-05T08:02:46Z")
Hi, i have already upgrade ES 2.3.4 to 2.4.0, so it's done. But now with the new Kibana 4.6.0 all visualizations and dashboards are longer visible. What the " orderAgg " ?? This is the message: Error: orderAgg is … --- ## [Copy single field from one index to another existing index](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794)
**Author:** [@thekozak](https://discuss.elastic.co/u/thekozak)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 10:39am UTC](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794 "2020-05-15T10:39:48Z")
Is it possible to take a field from one index and copy it to another existing index without loosing fields it already contains? For example I have an index abc having fields field\_a, field\_b, field\_c and index def havin… --- ## [How to use/have just one address field in Netflow module regardless of IP version?](https://discuss.elastic.co/t/how-to-use-have-just-one-address-field-in-netflow-module-regardless-of-ip-version/205519)
**Author:** [@Jorge\_Correa](https://discuss.elastic.co/u/Jorge_Correa)\ **Replies:** 0\ **Last updated:** [October 28, 2019, 4:59pm UTC](https://discuss.elastic.co/t/how-to-use-have-just-one-address-field-in-netflow-module-regardless-of-ip-version/205519 "2019-10-28T16:59:44Z")
Hi! I was using the Logstash netflow module for a while. With ELK 7.4 I started to get some errors with UDP input and realized that Logstash Netflow Module was being deprecated. So, I installed Filebeat Netflow Module. H… --- ## [Logstash Error: "Your settings are invalid"](https://discuss.elastic.co/t/logstash-error-your-settings-are-invalid/291544)
**Author:** [@neerajg](https://discuss.elastic.co/u/neerajg)\ **Replies:** 2\ **Last updated:** [December 13, 2021, 7:52am UTC](https://discuss.elastic.co/t/logstash-error-your-settings-are-invalid/291544 "2021-12-13T07:52:03Z")
Hi guys, I just upgraded elk stack from 7.15.0 to 7.16.0. Everything is working fine except Logstash. It ends up failing to start. I checked the system logs and found the following error. Error: logstash\[20212\]: Ope… --- ## [How to set HTTP filter body to whole event](https://discuss.elastic.co/t/how-to-set-http-filter-body-to-whole-event/243041)
**Author:** [@bradley.king](https://discuss.elastic.co/u/bradley.king)\ **Replies:** 2\ **Last updated:** [July 29, 2020, 9:16pm UTC](https://discuss.elastic.co/t/how-to-set-http-filter-body-to-whole-event/243041 "2020-07-29T21:16:07Z")
Hi guys, just a quick question. I can't seem to find the answer on the docs :confused: How do I reference the whole event in logstash? I want to use the HTTP filter to send the whole event to one of our APIs for some q… --- ## [Setup snapshots with minio, unable to retrieve secrets](https://discuss.elastic.co/t/setup-snapshots-with-minio-unable-to-retrieve-secrets/202351)
**Author:** [@Kent\_Brake](https://discuss.elastic.co/u/Kent_Brake)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 8:43pm UTC](https://discuss.elastic.co/t/setup-snapshots-with-minio-unable-to-retrieve-secrets/202351 "2019-10-24T20:43:51Z")
Hi, I'm trying to setup snapshot with a local minion instance, but I can't seem to imports secrets as documented here. I setup the secrets with: kubectl create secret generic minio-credentials --from-file=s3.client.de… --- ## [Maps Unable to Load Tooltip Content](https://discuss.elastic.co/t/maps-unable-to-load-tooltip-content/234983)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 7\ **Last updated:** [June 1, 2020, 7:55pm UTC](https://discuss.elastic.co/t/maps-unable-to-load-tooltip-content/234983 "2020-06-01T19:55:37Z")
I've got a map using geo\_point data to place coordinate markers on the map. When I add fields to the Tooltip, it displays Unable to load tooltip content: Unable to find document, \_id:xxx when I hover over one of the coo… --- ## [Try to recover \[test-20181128\]\[2\] from primary shard with sync id but number of docs differ: 59432 (10.1.1.189, primary) vs 60034(10.1.1.190)](https://discuss.elastic.co/t/try-to-recover-test-20181128-2-from-primary-shard-with-sync-id-but-number-of-docs-differ-59432-10-1-1-189-primary-vs-60034-10-1-1-190/158983)
**Author:** [@jiankunking](https://discuss.elastic.co/u/jiankunking)\ **Replies:** 1\ **Last updated:** [December 1, 2018, 7:49am UTC](https://discuss.elastic.co/t/try-to-recover-test-20181128-2-from-primary-shard-with-sync-id-but-number-of-docs-differ-59432-10-1-1-189-primary-vs-60034-10-1-1-190/158983 "2018-12-01T07:49:05Z")
We use three ES data nodes with setting -Xmx30g -Xms30g. The three ES servers have 128G physical memory and 32 CPU cores. the ES version is 5.4.1. The following exception was found in the log today: Caused by: java.la… --- ## [SocketError: send: name or service not known - logstash 2.3.4 version](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-logstash-2-3-4-version/72767)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 1\ **Last updated:** [January 25, 2017, 2:41pm UTC](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-logstash-2-3-4-version/72767 "2017-01-25T14:41:01Z")
Logstash agent configuration: input { heartbeat { type =\> "heartbeat" interval =\> 60 add\_field =\> { "app.name" =\> "esper" } } file { path =\> "/… --- ## [Java.lang.NoSuchFieldError: ALLOW\_UNQUOTED\_FIELD\_NAMES when trying to query elasticsearch using spark](https://discuss.elastic.co/t/java-lang-nosuchfielderror-allow-unquoted-field-names-when-trying-to-query-elasticsearch-using-spark/18482)
**Author:** [@Brian\_Thomas\_2](https://discuss.elastic.co/u/Brian_Thomas_2)\ **Replies:** 7\ **Last updated:** [September 16, 2014, 5:09pm UTC](https://discuss.elastic.co/t/java-lang-nosuchfielderror-allow-unquoted-field-names-when-trying-to-query-elasticsearch-using-spark/18482 "2014-09-16T17:09:57Z")
I am trying to test querying elasticsearch using Apache Spark using elasticsearch-hadoop. I am just trying to do a query to the elasticsearch server and return the count of results. Below is my test class using t… --- ## [API key owner](https://discuss.elastic.co/t/api-key-owner/348167)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 8\ **Last updated:** [December 3, 2023, 11:59pm UTC](https://discuss.elastic.co/t/api-key-owner/348167 "2023-12-03T23:59:14Z")
Hi all, Using Elastic Cloud V8.10.2 I need to create several API keys to be used on logstash. When API key is created on Kibana -\> Security -\> API Keys, it ends with the owner being my user. When API key is created o… --- ## [503 Error :Saved Object Service not available in kibana](https://discuss.elastic.co/t/503-error-saved-object-service-not-available-in-kibana/205785)
**Author:** [@das\_santosh](https://discuss.elastic.co/u/das_santosh)\ **Replies:** 5\ **Last updated:** [November 15, 2019, 5:31am UTC](https://discuss.elastic.co/t/503-error-saved-object-service-not-available-in-kibana/205785 "2019-11-15T05:31:53Z")
Hi Elasticteam, I have tried to delete my saved object but i am getting the attached error also while modifying the saved object pattern i am getting the error. Please find the attached screenshots , could you please a… --- ## [LOGSTASH Config file error, doesn't like host assigning but it requires one](https://discuss.elastic.co/t/logstash-config-file-error-doesnt-like-host-assigning-but-it-requires-one/53142)
**Author:** [@brandonmcgrath1](https://discuss.elastic.co/u/brandonmcgrath1)\ **Replies:** 5\ **Last updated:** [June 17, 2016, 1:20pm UTC](https://discuss.elastic.co/t/logstash-config-file-error-doesnt-like-host-assigning-but-it-requires-one/53142 "2016-06-17T13:20:55Z")
I'm trying to configure logstash and this is the error im getting: {:timestamp=\>"2016-06-17T11:36:27.128000+0100", :message=\>"Could not start TCP server: Address in use", :host=\>"elk.etechdc.local", :port=\>3515, :level… --- ## [Logstash 2.0.0 vs elasticsearch](https://discuss.elastic.co/t/logstash-2-0-0-vs-elasticsearch/33899)
**Author:** [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Replies:** 5\ **Last updated:** [May 9, 2016, 9:46am UTC](https://discuss.elastic.co/t/logstash-2-0-0-vs-elasticsearch/33899 "2016-05-09T09:46:32Z")
Hi, Currently I have logstash 1.5.0 running successfully, with the next elasticsearch output config: elasticsearch { host =\> "host" protocol =\> "http" user =\> … --- ## [Extract certain fields from JSON](https://discuss.elastic.co/t/extract-certain-fields-from-json/335487)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 4\ **Last updated:** [June 8, 2023, 3:33pm UTC](https://discuss.elastic.co/t/extract-certain-fields-from-json/335487 "2023-06-08T15:33:48Z")
Hi, I am forwarding filebeat logs to an ES, and I would like to only extract certain fields in the JSON message and write them to ES. For example, if I have the JSON message below: { "field1": "info", "field2":… --- ## [In App Search API how to check if the field exists or not in a document during search](https://discuss.elastic.co/t/in-app-search-api-how-to-check-if-the-field-exists-or-not-in-a-document-during-search/208535)
**Author:** [@jayrraval](https://discuss.elastic.co/u/jayrraval)\ **Replies:** 4\ **Last updated:** [November 21, 2019, 9:06am UTC](https://discuss.elastic.co/t/in-app-search-api-how-to-check-if-the-field-exists-or-not-in-a-document-during-search/208535 "2019-11-21T09:06:46Z")
In App Search API, how i can in query for documents that does not contain a particular field. In Elasticsearch we have "exists" keyword in while in App Search API there does not seems to be "exists" keyword to check if a… --- ## [Fielddata is disabled on text fields](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields/195793)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 4\ **Last updated:** [August 21, 2019, 6:38am UTC](https://discuss.elastic.co/t/fielddata-is-disabled-on-text-fields/195793 "2019-08-21T06:38:07Z")
So an error I'm receiving for "logstash-2019.08.19" is "Fielddata is disabled on text fields by default. Set fielddata=true on \[time\] in order to load fielddata in memory by uninverting the inverted index. Note that this… --- ## [Logstash does not output to elastic , and now does not work at all](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 4\ **Last updated:** [July 6, 2016, 1:09pm UTC](https://discuss.elastic.co/t/logstash-does-not-output-to-elastic-and-now-does-not-work-at-all/50912 "2016-07-06T13:09:22Z")
hi , i've benn dealing with a problem for 2 days now i'm using logstash 2.3 on rhel VM my logstash configurations worked just fine until yesterday: i built another very simple configuration : input { file { … --- ## [Kibana 4.4.1 - unable to npm start or build](https://discuss.elastic.co/t/kibana-4-4-1-unable-to-npm-start-or-build/43035)
**Author:** [@jliang](https://discuss.elastic.co/u/jliang)\ **Replies:** 4\ **Last updated:** [March 2, 2016, 1:15am UTC](https://discuss.elastic.co/t/kibana-4-4-1-unable-to-npm-start-or-build/43035 "2016-03-02T01:15:42Z")
I just download the Kibana 4.4.1 and tring to make some changes which I juse to do for kibana 4.3 or previous versions. But nothing was apply when I use bin/kibana. And npm start is no longer working. And also how can I … --- ## [Do we have any Plugin to update Mappings on the fly?](https://discuss.elastic.co/t/do-we-have-any-plugin-to-update-mappings-on-the-fly/36983)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 4\ **Last updated:** [December 12, 2015, 1:51pm UTC](https://discuss.elastic.co/t/do-we-have-any-plugin-to-update-mappings-on-the-fly/36983 "2015-12-12T13:51:09Z")
Hi Experts, I know that we can update /create or modify my existing Mappings using SENSE or I can directly achieve this with Mapping API. My question is do we have any GUI or plugin from where I can update/Delete/Creat… [Previous page](https://discuss.elastic.co/top.md?page=978&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=980&per_page=50&period=all)