# Top **URL:** https://discuss.elastic.co/top.md?page=982&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 983 --- ## [Grok pattern for stashing Ansible logs](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 6\ **Last updated:** [March 11, 2022, 4:06pm UTC](https://discuss.elastic.co/t/grok-pattern-for-stashing-ansible-logs/299227 "2022-03-11T16:06:57Z")
Hello, I am new to Elasticsearch. I am on Elasticsearch 7.17.1. Below are the logs that I am trying to parse. 2022-03-08 14:52:50,672 p=1654827 u=ansible n=ansible | TASK \[lvm : Formatting xfs filesystem\] \*\* 2022-03-… --- ## [Restart on daily basis](https://discuss.elastic.co/t/restart-on-daily-basis/233116)
**Author:** [@mu44ly](https://discuss.elastic.co/u/mu44ly)\ **Replies:** 6\ **Last updated:** [May 19, 2020, 5:51am UTC](https://discuss.elastic.co/t/restart-on-daily-basis/233116 "2020-05-19T05:51:10Z")
Hello everyone, Recently we got issues with circuit.breaker exception on multiple clusters, right after upgrade from 6.8 to 7.4. It was found that problem can be fixed by jvm option tuning. However, due to other issues … --- ## [NGINX Ingress controller + Filebeat with NGINX module](https://discuss.elastic.co/t/nginx-ingress-controller-filebeat-with-nginx-module/291824)
**Author:** [@anton-johansson](https://discuss.elastic.co/u/anton-johansson)\ **Replies:** 1\ **Last updated:** [December 15, 2021, 5:26am UTC](https://discuss.elastic.co/t/nginx-ingress-controller-filebeat-with-nginx-module/291824 "2021-12-15T05:26:33Z")
Hey! We're using the NGINX Ingress Controller (GitHub - kubernetes/ingress-nginx: NGINX Ingress Controller for Kubernetes), hosted in our Kubernetes cluster. We're using Filebeat deployed as a DaemonSet that parses logs … --- ## [Could not index event to Elasticsearch status 400](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 1\ **Last updated:** [October 2, 2018, 4:30pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-status-400/150648 "2018-10-02T16:30:44Z")
Hi All, I am getting the following error while index a document: \[2018-10-02T08:00:11,897\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :… --- ## [Could not initialize class org.elasticsearch.test.ESTestCase](https://discuss.elastic.co/t/could-not-initialize-class-org-elasticsearch-test-estestcase/78770)
**Author:** [@elastic\_boston](https://discuss.elastic.co/u/elastic_boston)\ **Replies:** 1\ **Last updated:** [March 16, 2017, 9:03pm UTC](https://discuss.elastic.co/t/could-not-initialize-class-org-elasticsearch-test-estestcase/78770 "2017-03-16T21:03:26Z")
I am trying to write a junit test which would create a org.elasticsearch.node.Node object. So I have created a class which extends ESIntegTestCase. However, when I run it, I get java.lang.NoClassDefFoundError: Could n… --- ## [APM transactions with Spring Integration](https://discuss.elastic.co/t/apm-transactions-with-spring-integration/321421)
**Author:** [@Yaneek](https://discuss.elastic.co/u/Yaneek)\ **Replies:** 4\ **Last updated:** [January 17, 2023, 4:56pm UTC](https://discuss.elastic.co/t/apm-transactions-with-spring-integration/321421 "2023-01-17T16:56:32Z")
Hi, I'd like to ask if it's possible to monitor Spring Integration transactions in APM. Adding javaagent to our Spring Boot app works flawlessly and the transactions related to REST API invocation show up very nicely i… --- ## [Using wildcard and must\_not to search](https://discuss.elastic.co/t/using-wildcard-and-must-not-to-search/323236)
**Author:** [@geeky\_human](https://discuss.elastic.co/u/geeky_human)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 11:12am UTC](https://discuss.elastic.co/t/using-wildcard-and-must-not-to-search/323236 "2023-01-16T11:12:27Z")
Hi, I’m new to ELK. For searching, I’m using dev tools in kibana. I want to find all the results that do not match a wildcard term. "must\_not": \[ {"wildcard": { "agent.keyword": {"value":"python\*"} }}\] I… --- ## [APM Agent for .NET: How can I prevent traces being created for browsers' preflight (OPTIONS) requests?](https://discuss.elastic.co/t/apm-agent-for-net-how-can-i-prevent-traces-being-created-for-browsers-preflight-options-requests/259013)
**Author:** [@michielvoo](https://discuss.elastic.co/u/michielvoo)\ **Replies:** 4\ **Last updated:** [December 21, 2020, 12:51pm UTC](https://discuss.elastic.co/t/apm-agent-for-net-how-can-i-prevent-traces-being-created-for-browsers-preflight-options-requests/259013 "2020-12-21T12:51:59Z")
I have integrated the APM Agent for .NET in an ASP.NET Core application. I have added the HttpDiagnosticsSubscriber in the call to UseElasticApm, so all my controller actions are automatically instrumented. For normal r… --- ## [Enterprise-search failes to load](https://discuss.elastic.co/t/enterprise-search-failes-to-load/219341)
**Author:** [@manosmustang](https://discuss.elastic.co/u/manosmustang)\ **Replies:** 4\ **Last updated:** [February 17, 2020, 2:39pm UTC](https://discuss.elastic.co/t/enterprise-search-failes-to-load/219341 "2020-02-17T14:39:23Z")
Hello, I am trying to start an enterprise-search at an existing elasticsearch cluster while starting the enterprise-search i get the below error \> \[root@elasticlogs bin\]# ./enterprise-search \> Found java executable in… --- ## [Filebeat strict to elasticsearch send only default fields](https://discuss.elastic.co/t/filebeat-strict-to-elasticsearch-send-only-default-fields/120426)
**Author:** [@Bardelli\_B](https://discuss.elastic.co/u/Bardelli_B)\ **Replies:** 4\ **Last updated:** [February 20, 2018, 4:06pm UTC](https://discuss.elastic.co/t/filebeat-strict-to-elasticsearch-send-only-default-fields/120426 "2018-02-20T16:06:13Z")
HI all, My setup has only a filebeat sending the logs to elasticsearch, I'm trying to use multiple templates with different indexes. When filebeat starts, the indexes are created, but only with default fields (beat.nam… --- ## [Grok query domain from DNS server log](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 4\ **Last updated:** [July 12, 2017, 3:35pm UTC](https://discuss.elastic.co/t/grok-query-domain-from-dns-server-log/92770 "2017-07-12T15:35:09Z")
Hi, I'm using Elastic Stack V5.5 and using logstahs for parse log from DNS server log. Something like that (6)mobile(4)pipe(4)aria(9)microsoft(3)com(0) (7)outlook(6)office(3)com(0) (5)nexus(10)officeapps(4)live(3)com… --- ## [Problem with sincedb](https://discuss.elastic.co/t/problem-with-sincedb/83420)
**Author:** [@ktomu](https://discuss.elastic.co/u/ktomu)\ **Replies:** 4\ **Last updated:** [May 2, 2017, 7:11pm UTC](https://discuss.elastic.co/t/problem-with-sincedb/83420 "2017-05-02T19:11:47Z")
Hello, I'm using the file input with Logstash - just plane text files (pipeline processing) output to elasticsearch and without any filters. Sometimes I have an issue, when some files have processed but there are no ne… --- ## [Self-signed certificate in certificate chain](https://discuss.elastic.co/t/self-signed-certificate-in-certificate-chain/368976)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 2\ **Last updated:** [October 21, 2024, 3:14am UTC](https://discuss.elastic.co/t/self-signed-certificate-in-certificate-chain/368976 "2024-10-21T03:14:06Z")
Im having trouble running secure kibana on linux, i keep getting the below error : \[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. self-signed certificate in certificate c… --- ## [Metricbeat: \[logstash.node\] node/node.go:79 could not fetch node pipelines: HTTP error 405 in : 405 Method Not Allowed](https://discuss.elastic.co/t/metricbeat-logstash-node-node-node-go-79-could-not-fetch-node-pipelines-http-error-405-in-405-method-not-allowed/253786)
**Author:** [@Yuy\_Heero](https://discuss.elastic.co/u/Yuy_Heero)\ **Replies:** 2\ **Last updated:** [October 30, 2020, 12:52pm UTC](https://discuss.elastic.co/t/metricbeat-logstash-node-node-node-go-79-could-not-fetch-node-pipelines-http-error-405-in-405-method-not-allowed/253786 "2020-10-30T12:52:10Z")
I created one-node elasticsearch(7.9.3) and one-node logstash(7.9.3). Logstash can transfer logs via https without problem. I want to use metricbeat to monitor logstash. After I installed metricbeat in logstash node. M… --- ## [Error Hadoop/ElasticSearch Too Many Requests](https://discuss.elastic.co/t/error-hadoop-elasticsearch-too-many-requests/45658)
**Author:** [@Guillermo\_Ortiz](https://discuss.elastic.co/u/Guillermo_Ortiz)\ **Replies:** 2\ **Last updated:** [April 5, 2016, 2:52pm UTC](https://discuss.elastic.co/t/error-hadoop-elasticsearch-too-many-requests/45658 "2016-04-05T14:52:27Z")
I'm executing Spark againts ElasticSearch using the ElasticSearch API. I have 6 executors with one core each one. There are not queued tasks. I only have two ElasticNodes with 8 cores and 32 Gb but it seems that they… --- ## [Get max(\_score) in function score query](https://discuss.elastic.co/t/get-max--score-in-function-score-query/16470)
**Author:** [@Ian\_Neubert](https://discuss.elastic.co/u/Ian_Neubert)\ **Replies:** 2\ **Last updated:** [March 31, 2014, 2:07pm UTC](https://discuss.elastic.co/t/get-max--score-in-function-score-query/16470 "2014-03-31T14:07:28Z")
Is it possible to get the maximum \_score from all search results inside the function of a function score query? For example: https://gist.github.com/ianneub/6a165d3206ad83dfdbdf This is a simplistic example, but … --- ## [Text analysis](https://discuss.elastic.co/t/text-analysis/171696)
**Author:** [@Priyasmini\_Sahoo](https://discuss.elastic.co/u/Priyasmini_Sahoo)\ **Replies:** 5\ **Last updated:** [March 11, 2019, 9:38am UTC](https://discuss.elastic.co/t/text-analysis/171696 "2019-03-11T09:38:00Z")
I have an index in Elasticsearch. It has fields with string values. Can I tokenize them? or Can I do text analysis in that index? --- ## [Logstash sends last event only on shutdown](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348)
**Author:** [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)\ **Replies:** 5\ **Last updated:** [February 10, 2016, 5:08am UTC](https://discuss.elastic.co/t/logstash-sends-last-event-only-on-shutdown/41348 "2016-02-10T05:08:01Z")
Hello I use logstash to parse log files and send result documents to elasticsearch. It seems to me that last log/event is not sent until new one appears. The only way I managed to make logstash send last event is turnin… --- ## [Multiple Instances of Logstash JDBC input](https://discuss.elastic.co/t/multiple-instances-of-logstash-jdbc-input/204147)
**Author:** [@bnered](https://discuss.elastic.co/u/bnered)\ **Replies:** 0\ **Last updated:** [October 18, 2019, 1:00am UTC](https://discuss.elastic.co/t/multiple-instances-of-logstash-jdbc-input/204147 "2019-10-18T01:00:16Z")
My Requirement is to fetch updated/new records from the table. I used the sql\_last\_value to fetch the latest the records. I want to run logstash in multiple instances to avoid os/hardware crashes and get continuous updat… --- ## [Disk quota isolation for elasticsearch](https://discuss.elastic.co/t/disk-quota-isolation-for-elasticsearch/203344)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 0\ **Last updated:** [October 13, 2019, 12:55pm UTC](https://discuss.elastic.co/t/disk-quota-isolation-for-elasticsearch/203344 "2019-10-13T12:55:23Z")
Hi, Can elasticsearch multi-tenancy provide disk quota isolation for individual tenants/users? A single source writing a huge amount of data may cause entire cluster failure and data loss to all the other sources. Is t… --- ## [Script - round an average](https://discuss.elastic.co/t/script-round-an-average/184320)
**Author:** [@simple\_commentateur](https://discuss.elastic.co/u/simple_commentateur)\ **Replies:** 3\ **Last updated:** [June 20, 2019, 11:36pm UTC](https://discuss.elastic.co/t/script-round-an-average/184320 "2019-06-20T23:36:38Z")
Hello, In Kibana, i want to display the average of a field in Metric Vizualization Average value : 24573.222 But the display don't change, it still show 2453.222 I even try this but it still don't work : { "scri… --- ## [Elasticsearch nested array Aggregation](https://discuss.elastic.co/t/elasticsearch-nested-array-aggregation/120294)
**Author:** [@lavangiriece](https://discuss.elastic.co/u/lavangiriece)\ **Replies:** 0\ **Last updated:** [February 17, 2018, 7:17am UTC](https://discuss.elastic.co/t/elasticsearch-nested-array-aggregation/120294 "2018-02-17T07:17:44Z")
Hello, I'm trying to aggregate a nested array, the count is including the duplicate value also.. Here is my Mapping {"mappings" : { "mention" : { "properties" : { "Topics" : { "t… --- ## [Bool query with boost for should clause](https://discuss.elastic.co/t/bool-query-with-boost-for-should-clause/323555)
**Author:** [@seeminglee](https://discuss.elastic.co/u/seeminglee)\ **Replies:** 1\ **Last updated:** [January 20, 2023, 1:33am UTC](https://discuss.elastic.co/t/bool-query-with-boost-for-should-clause/323555 "2023-01-20T01:33:55Z")
How can you add boost to specific part of a should query. For example: { "query": { "bool": { "should": \[ {"term":{"fruit.keyword":"apple"}}, {"term":{"fruit.keyword":"banana"}}, {"te… --- ## [Trouble installing logstash kv filter plugin](https://discuss.elastic.co/t/trouble-installing-logstash-kv-filter-plugin/1864)
**Author:** [@Donald\_Nguyen](https://discuss.elastic.co/u/Donald_Nguyen)\ **Replies:** 1\ **Last updated:** [June 3, 2015, 10:52pm UTC](https://discuss.elastic.co/t/trouble-installing-logstash-kv-filter-plugin/1864 "2015-06-03T22:52:37Z")
Hi Logstash Community! I am learning to use the ELK stack and currently trying to install the kv filter plugin for logstash but nothing seems to work for me. I first tried to install filter plugins manual following the… --- ## [How to settings threadpool on elastic cloud?](https://discuss.elastic.co/t/how-to-settings-threadpool-on-elastic-cloud/245544)
**Author:** [@chautm](https://discuss.elastic.co/u/chautm)\ **Replies:** 5\ **Last updated:** [August 20, 2020, 5:11am UTC](https://discuss.elastic.co/t/how-to-settings-threadpool-on-elastic-cloud/245544 "2020-08-20T05:11:55Z")
My project using elastic cloud but reject error: EsThreadPoolExecutor\[name = instance-0000000003/write, queue capacity = 200 On breaking change description "Thread pool settings are now node-level settings. As such, it… --- ## [Link to an image file in Kibana](https://discuss.elastic.co/t/link-to-an-image-file-in-kibana/220034)
**Author:** [@J.K](https://discuss.elastic.co/u/J.K)\ **Replies:** 2\ **Last updated:** [February 23, 2020, 1:29pm UTC](https://discuss.elastic.co/t/link-to-an-image-file-in-kibana/220034 "2020-02-23T13:29:08Z")
In Kibana Index Patterns there is a field that contains a link to an image. The image is saved on my local machine, so to open the image in the chrome explorer I have to put the url: "file://thePath/fileName.png". In … --- ## [How does sincedb\_clean\_after in file{} work?](https://discuss.elastic.co/t/how-does-sincedb-clean-after-in-file-work/161471)
**Author:** [@espenk](https://discuss.elastic.co/u/espenk)\ **Replies:** 2\ **Last updated:** [December 21, 2018, 3:41pm UTC](https://discuss.elastic.co/t/how-does-sincedb-clean-after-in-file-work/161471 "2018-12-21T15:41:22Z")
Hi. I have been reading https://www.elastic.co/guide/en/logstash/master/plugins-inputs-file.html for a while, and stumbled upon the following statement: "Sincedb records can now be expired meaning that read positions of … --- ## [Apache logs not able to map geo IPs](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [August 26, 2017, 4:55am UTC](https://discuss.elastic.co/t/apache-logs-not-able-to-map-geo-ips/98429 "2017-08-26T04:55:40Z")
Hi Guys, I am trying to plot the geo for my apache logs but somehow I am getting below error on kibana, can someone please help me on this error? No Compatible Fields: The “apache-\*” index pattern does not contain any … --- ## [Elastic cloudで再起動後に過去分のインデックスが全消失](https://discuss.elastic.co/t/elastic-cloud/77588)
**Author:** [@shnagai](https://discuss.elastic.co/u/shnagai)\ **Replies:** 2\ **Last updated:** [March 7, 2017, 10:49pm UTC](https://discuss.elastic.co/t/elastic-cloud/77588 "2017-03-07T22:49:38Z")
elastic cloudのコミュニティに投げたのですが、明確な回答まだ来てないので日本語コミュニティにも投げさせていただきます。 【知りたいこと】 どうすれば過去分のデータをリストアできますか?(.Kibanaのインデックスだけはなんとしても復元したい) クラスタ再起動で、インデックスが消失した理由を知りたいです。 https://discuss.elastic.co/t/data-disappeared-when-resta… --- ## [Does logstash work with java 1.7](https://discuss.elastic.co/t/does-logstash-work-with-java-1-7/76366)
**Author:** [@daaakeee](https://discuss.elastic.co/u/daaakeee)\ **Replies:** 2\ **Last updated:** [February 24, 2017, 8:59am UTC](https://discuss.elastic.co/t/does-logstash-work-with-java-1-7/76366 "2017-02-24T08:59:52Z")
I am using java 1.7.0, which version of logstash is compatible with this version of java? --- ## [Safely publish an event using libbeat](https://discuss.elastic.co/t/safely-publish-an-event-using-libbeat/52395)
**Author:** [@lukejolly](https://discuss.elastic.co/u/lukejolly)\ **Replies:** 2\ **Last updated:** [June 10, 2016, 10:52am UTC](https://discuss.elastic.co/t/safely-publish-an-event-using-libbeat/52395 "2016-06-10T10:52:51Z")
So I'm at a loss on how to go about publishing an event and being sure it was a success. If I use publisher.Client.PublishEvent(m, publisher.Sync) and the output (in my test case logstash) isn't up, it blocks forever i… --- ## [Can some one explain how the transform runs it in this scenario](https://discuss.elastic.co/t/can-some-one-explain-how-the-transform-runs-it-in-this-scenario/238888)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 4\ **Last updated:** [July 6, 2020, 5:26pm UTC](https://discuss.elastic.co/t/can-some-one-explain-how-the-transform-runs-it-in-this-scenario/238888 "2020-07-06T17:26:11Z")
Hi, I am using transform index, and i am grouping the records by day wise to find out max. but the frequency of the transform can be set maximum as 1hour. if the transform runs at next hour will it consider the record… --- ## [Multiple trees in one vizualization](https://discuss.elastic.co/t/multiple-trees-in-one-vizualization/211650)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 4\ **Last updated:** [December 14, 2019, 6:57pm UTC](https://discuss.elastic.co/t/multiple-trees-in-one-vizualization/211650 "2019-12-14T18:57:05Z")
Hello I made quite simple tree visualization in Vega. I would like to made multiple trees in one vizualization grouped by "group" value - for example if I add another value {"id": 3595, "name": "Vytvořit povinné pohyby… --- ## [How to use bigdesk for new version (6.2) of elasticsearch](https://discuss.elastic.co/t/how-to-use-bigdesk-for-new-version-6-2-of-elasticsearch/152769)
**Author:** [@atticboy](https://discuss.elastic.co/u/atticboy)\ **Replies:** 4\ **Last updated:** [October 18, 2018, 7:30am UTC](https://discuss.elastic.co/t/how-to-use-bigdesk-for-new-version-6-2-of-elasticsearch/152769 "2018-10-18T07:30:55Z")
I tried all the methods described in the homepage of bigdesk to connect to es 6.2, but all failed, it says does not support new versions, so is there any way to connect to new version of es with bigdesk, thanks a lot! --- ## [Shards are not equal size in one index](https://discuss.elastic.co/t/shards-are-not-equal-size-in-one-index/44604)
**Author:** [@sipazzo](https://discuss.elastic.co/u/sipazzo)\ **Replies:** 4\ **Last updated:** [March 17, 2016, 4:05am UTC](https://discuss.elastic.co/t/shards-are-not-equal-size-in-one-index/44604 "2016-03-17T04:05:50Z")
We are using Elasticsearch 2.2 0-1in a POC with a fairly large dataset, 3 indexes across 3 nodes, one replica, utilizing the default 5 shards per index and pretty much default settings. One of our indexes is about 175GB… --- ## [\[8.5.3\] Unable to download CSV from dashboard / visualizations](https://discuss.elastic.co/t/8-5-3-unable-to-download-csv-from-dashboard-visualizations/321835)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 8\ **Last updated:** [January 9, 2023, 9:14am UTC](https://discuss.elastic.co/t/8-5-3-unable-to-download-csv-from-dashboard-visualizations/321835 "2023-01-09T09:14:49Z")
None of my Kibana dashboard or viz have a "Download to CVS" option showing up in 8.5.3. What am I missing? Below is my setup: I've installed the 8.5.3 stack of elasticsearch and kibana from this official doc. My kibana… --- ## [Trouble getting XML into usable format](https://discuss.elastic.co/t/trouble-getting-xml-into-usable-format/153009)
**Author:** [@motts](https://discuss.elastic.co/u/motts)\ **Replies:** 8\ **Last updated:** [November 13, 2018, 5:17pm UTC](https://discuss.elastic.co/t/trouble-getting-xml-into-usable-format/153009 "2018-11-13T17:17:57Z")
Hello, I am not sure if this would be better for Logstash or Beats, but I am using filebeat to send an XML file of windows events. Some of the data looks neat and can be pretty easy to implement a KV with a value split o… --- ## [What is using all my heap space?](https://discuss.elastic.co/t/what-is-using-all-my-heap-space/21344)
**Author:** [@Jeff\_Rick](https://discuss.elastic.co/u/Jeff_Rick)\ **Replies:** 8\ **Last updated:** [December 22, 2014, 6:22pm UTC](https://discuss.elastic.co/t/what-is-using-all-my-heap-space/21344 "2014-12-22T18:22:31Z")
Hi, So we have a small development cluster that we are doing some sizing tests with. The make-up of the cluster as is follows: 4 Data Nodes - 60GB of memory and 108 cores (aka c3.8xlarge) - 32GB per node for h… --- ## [Multiple matches from one line](https://discuss.elastic.co/t/multiple-matches-from-one-line/166851)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 6\ **Last updated:** [February 4, 2019, 12:50pm UTC](https://discuss.elastic.co/t/multiple-matches-from-one-line/166851 "2019-02-04T12:50:41Z")
Hi! I am struggling with syslog from one of our vendors (F5). When something goes down a syslog message is sent with the thing that has failed together with the last states of the monitor. Two sample log lines could lo… --- ## [Search and Filter on Analyzed Fields](https://discuss.elastic.co/t/search-and-filter-on-analyzed-fields/115090)
**Author:** [@vinaygarg30](https://discuss.elastic.co/u/vinaygarg30)\ **Replies:** 6\ **Last updated:** [January 15, 2018, 11:09am UTC](https://discuss.elastic.co/t/search-and-filter-on-analyzed-fields/115090 "2018-01-15T11:09:57Z")
We need to search as well as apply filters on the text fields (which are analysed and they are required to be so in our application). But, while applying filters on analysed text returns results which do not match the fi… --- ## [Recherche sur champ winlogbeat](https://discuss.elastic.co/t/recherche-sur-champ-winlogbeat/80840)
**Author:** [@lepat78](https://discuss.elastic.co/u/lepat78)\ **Replies:** 6\ **Last updated:** [April 7, 2017, 2:24pm UTC](https://discuss.elastic.co/t/recherche-sur-champ-winlogbeat/80840 "2017-04-07T14:24:58Z")
Bonjour. Je travaille sur ELK 5 avec des flux provenant d'un serveur Windows avec l'utilisation Winlogsbeat 5.1. Après de nombreuses recherches infructueuses, je voudrais faire une recherche qui matche sur le champ "even… --- ## [RE : Ulimit property](https://discuss.elastic.co/t/re-ulimit-property/899)
**Author:** [@Phani\_Nadiminti](https://discuss.elastic.co/u/Phani_Nadiminti)\ **Replies:** 6\ **Last updated:** [May 20, 2015, 7:45am UTC](https://discuss.elastic.co/t/re-ulimit-property/899 "2015-05-20T07:45:49Z")
Hi All, Can we set Ulimit -l unlimited in RHEL servers as my servers running on production.es suggesting to give unlimited ulimit but my question is is it safe to enable Ulimit -l unlimited for root user on production … --- ## [Aggregations query timeout and cancellation](https://discuss.elastic.co/t/aggregations-query-timeout-and-cancellation/163791)
**Author:** [@Ivan\_Bokii](https://discuss.elastic.co/u/Ivan_Bokii)\ **Replies:** 1\ **Last updated:** [January 10, 2019, 6:23pm UTC](https://discuss.elastic.co/t/aggregations-query-timeout-and-cancellation/163791 "2019-01-10T18:23:52Z")
Hi guys, Setting a timeout property on a search query seems to not have any effect. I know that queries timeouts are not very precise due to the problem of time out checks during execution, but the query below successfu… --- ## [Performance of Term Query vs Terms Query with 1 value](https://discuss.elastic.co/t/performance-of-term-query-vs-terms-query-with-1-value/150818)
**Author:** [@Mohit\_Kathuria](https://discuss.elastic.co/u/Mohit_Kathuria)\ **Replies:** 1\ **Last updated:** [October 11, 2018, 11:23am UTC](https://discuss.elastic.co/t/performance-of-term-query-vs-terms-query-with-1-value/150818 "2018-10-11T11:23:43Z")
We have an Elasticsearch cluster setup of 5 data nodes, 3 master with version 5.2.2. The cluster has 10 indices, namely txn\_0, txn\_1 ... txn\_9 where Ith index has all transactions of a user with modulus of 10 as I. For e… --- ## [HDFS as storage for ElasticSearch](https://discuss.elastic.co/t/hdfs-as-storage-for-elasticsearch/53334)
**Author:** [@Alessio](https://discuss.elastic.co/u/Alessio)\ **Replies:** 1\ **Last updated:** [June 20, 2016, 4:17pm UTC](https://discuss.elastic.co/t/hdfs-as-storage-for-elasticsearch/53334 "2016-06-20T16:17:22Z")
Hi, Is it possible to use HDFS as storage for Elastisearch index? I checked that HDFS can be used for backup or snapshot but I would configure ElasticSearch nodes to use directly HDFS for storing index and indexed da… --- ## [Logstash not dropping messages as configured](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554)
**Author:** [@LollerAgent](https://discuss.elastic.co/u/LollerAgent)\ **Replies:** 5\ **Last updated:** [March 4, 2019, 2:58pm UTC](https://discuss.elastic.co/t/logstash-not-dropping-messages-as-configured/170554 "2019-03-04T14:58:31Z")
Can someone please help me understand why the following "drop" filter is not working? As you can see, the original \[message\] field is in \[json\]\[log\]\[message\] but is renamed to \[log\]\[message\] in the second filter. I hav… --- ## [Elasticsearch 6.1.3 -- failed to discover master after node restart](https://discuss.elastic.co/t/elasticsearch-6-1-3-failed-to-discover-master-after-node-restart/124827)
**Author:** [@LogBabel](https://discuss.elastic.co/u/LogBabel)\ **Replies:** 5\ **Last updated:** [March 30, 2018, 4:53am UTC](https://discuss.elastic.co/t/elasticsearch-6-1-3-failed-to-discover-master-after-node-restart/124827 "2018-03-30T04:53:16Z")
Hello all, Our cluster had a node (node3) lose connectivity and now it will not rejoin the cluster. I've used TCPDUMP to study the exchange of traffic and it appears the master node is responding with the heartbeat mes… --- ## [Yet another buffer question](https://discuss.elastic.co/t/yet-another-buffer-question/78259)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 5\ **Last updated:** [March 12, 2017, 6:57am UTC](https://discuss.elastic.co/t/yet-another-buffer-question/78259 "2017-03-12T06:57:58Z")
Hello All, I'm indexing local log-files with Logstash + ES and encountered a "buffer" issue: the last messages get sent to ES only after sending Ctrl-C to the LS-process, e.g.: all logfiles are parsed: ES index - 96,52… --- ## [Access data from different index using ingest pipeline](https://discuss.elastic.co/t/access-data-from-different-index-using-ingest-pipeline/197312)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [August 29, 2019, 12:49pm UTC](https://discuss.elastic.co/t/access-data-from-different-index-using-ingest-pipeline/197312 "2019-08-29T12:49:15Z")
hi all, when a pipeline catches an index operation is there a way to query another index to get a specific field's value? I mean, if the current document will be indexed into index1 but I want to create also another fi… --- ## [Use CephFS as Elasticsearch data storage](https://discuss.elastic.co/t/use-cephfs-as-elasticsearch-data-storage/171324)
**Author:** [@TWalter](https://discuss.elastic.co/u/TWalter)\ **Replies:** 3\ **Last updated:** [March 7, 2019, 2:56pm UTC](https://discuss.elastic.co/t/use-cephfs-as-elasticsearch-data-storage/171324 "2019-03-07T14:56:25Z")
Hello guys, i want to deploy an Elasticsearch cluster (3 Nodes, ES-Version: 6.x) on Kubernetes and want to know, which storage types are efficient to use for data. Do you think CephFS would be a proper solution or is i… [Previous page](https://discuss.elastic.co/top.md?page=981&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=983&per_page=50&period=all)