Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [elasticsearch]

ElasticSearch is a JSON-based search and analytics engine, often associated with Logstash, which collects data, and Kibana, which visualizes the results. There are separate tags for these.

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

How to set ip of service within a container? static ip in default network

With an ip-address of a containerized Elasticsearch from the output of docker inspect I succesfully called the Elasticsearch function in a Jupyter notebook running inside another container. Both are ...
Johan's user avatar
  • 409
0 votes
0 answers
19 views

elasticsearch cannot read certificate file - linux file permissions

I generated a certificate file with certbot. It is placed in /etc/letsencrypt/.... I created a group called elk where I added the elasticsearch user, and I recursively set it as the owning group for /...
Vivere's user avatar
  • 203
0 votes
1 answer
161 views

ElasticSearch install Raspberry pi

I have installed the latest version on elasticsearch on my raspberry pi by following (I am not sure if elasticsearch is even running correctly ) https://www.elastic.co/guide/en/elasticsearch/reference/...
arpit joshi's user avatar
0 votes
0 answers
92 views

Unable to uninstall Elasticsearch from CentOS 8 Stream server

I'm running CentOS 8 Stream and it has elasticsearch 7.10 installed. When I try to remove this I get the following error # dnf remove elasticsearch-7.10.0-1.x86_64 Modular dependency problems: ...
Aditya K's user avatar
  • 2,090
0 votes
0 answers
223 views

Elasticsearch install failing on AWS EC2

I am trying to elasticsearch on aws ec2 instance (ubuntu) I ran the below command and it fails to restart . root@ip-XXX-XX-XX-XXX:/usr/lib/systemd/system# sudo service elasticsearch start Job for ...
arpit joshi's user avatar
0 votes
0 answers
97 views

run put queries on Elasticsearch host from ansible host

When I run any GET queries, it runs fine. for instance - name: run curl query on ES host uri: url: "http://localhost:9200" method: GET return_content: yes url_username: ...
Sollosa's user avatar
  • 1,941
0 votes
1 answer
52 views

Capture network interface device name with Packetbeat

With Packetbeat on Linux, the packetbeat.interfaces.device: any configuration captures all messages sent or received by the server where Packetbeat is installed. I want to distinguish the messages ...
Tabish Mir's user avatar
0 votes
1 answer
5k views

keytool error: java.io.IOException: Invalid keystore format

I have a 3-node ELK stack (Elasticsearch v7.17). After a reboot, the Kibana web interface reports an error "Kibana server is not ready yet". The SSL certs were expired, so I re-created them (...
dr_'s user avatar
  • 29.9k
0 votes
2 answers
66 views

bash: filter except the latest n records

I'm creating a small script that will delete indexes on an Elasticsearch cluster to prevent it for fill up all the storage with logstash data. I have a list of records, and I would like to keep the ...
Tasslehoff Burrfoot's user avatar
0 votes
0 answers
850 views

Unable to send logs from rsyslog to logstash and elasticsearch

I am using ubuntu and I installed the ELK stack version 8.5 on the same machine. I did the necessary configurations for each of the services(logstash, elasticsearch, kibana) and I equally configured ...
Ngouaba Rosalie's user avatar
1 vote
0 answers
358 views

Is it safe to change read ahead setting on a live server

After going through Elasticsearch's documentation I realised that the recommended read ahead value is 128KiB while I am currently using 256KiB on a live server. It is only indexing data and not ...
Nick Garlis's user avatar
0 votes
1 answer
51 views

I want remove repeated records and remove those lines in awk

I want check repeated records in column 2 and remove those lines in awk create a delete a create b create c delete c create d delete f create f create g create h Expected Output create b create d ...
Nabob's user avatar
  • 15
0 votes
1 answer
146 views

elasticsearch: On premise restore snapshot from aws s3

This could sound pretty straightforward. However, I've spent days looking in the web for a method where I can migrate snapshot from aws s3 to on premise elasticsearch cluster. All the docs I've found ...
Eng7's user avatar
  • 1,681
0 votes
1 answer
523 views

HTTPD Redirect Rule as Proxy is giving me file not found error. How do I proxy to an external url?

I have a reverse proxy to AWS Elasticsearch. I am having issues with using RedirectRule: no matter what I try, my URL is being interpreted as a file. SSLProxyEngine On ProxyRequests On ...
gerbdla's user avatar
  • 11
0 votes
1 answer
706 views

Auditbeat exclude /usr/sbin/cron

I'll tried to exclude event from cron jobs running that can be found with the KQL request : auditd.summary.how :"/usr/sbin/cron" My host does not running SE Linux, so the rules i found (put ...
Inazo's user avatar
  • 101
0 votes
1 answer
4k views

No valid OpenPGP data found - Elasticsearch wget

I am trying to install elasticsearch on Ubuntu 20.04, but I am getting the following error: home@VirtualBox$ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - gpg: no ...
John Barton's user avatar
0 votes
0 answers
559 views

Curl argument list too long error in elastic search mapping and setting

mapping=(</index_automation/{product}/mapping/Mapping/"$tempmappingfile") settings=(</index_automation/{product}/mapping/Mapping/"$tempsettingsfile") dataraw="{{...
CodeCracker's user avatar
0 votes
1 answer
5k views

Kibana service won't start

I am using Manjaro and installed elasticsearch and kibana with yay -S elasticsearch kibana Starting the elasticsearch service works well sudo systemctl start elasticsearch I've configured kibana ...
betaros's user avatar
  • 103
0 votes
0 answers
111 views

hearthbeat can't run

I have ELK server, and sending Heartbeats to server. I added an monitor in monitors.d directory, added setup.dashboards.enabled: true line in heartbeat.yml file, but after restarting heartbeat service,...
khachikyan97's user avatar
0 votes
1 answer
2k views

What is fields.yml file

Here I have installed packetbeat. So in the time learning the configuration for packetbeat I saw a file fields.yml in the directory /etc/packetbeat. I tried to get any information about that file but ...
khachikyan97's user avatar
0 votes
1 answer
1k views

Gmake on FreeBSD: exec: “clang”: executable file not found in $PATH [closed]

I'm trying to install Filebeat (elasticsearch log shipping) on PfSense 2.4.5. I follow the instruction from: https://blog.securitybits.io/2019/12/beats-7.5.0-on-pfsense-2.4.4/ At the make step, I got ...
mtpumpkin's user avatar
0 votes
1 answer
553 views

Elasticsearch curator not deleting old indices

I am using Elasticsearch + Kibana + File-/Metric-/Winlogbeat to summarize my logfiles. To not fill up my HDD with tons of logs I wanted to just keep them 14 days - so I installed Curator to do this ...
TheAdmin8000's user avatar
2 votes
1 answer
10k views

what is GREEDYDATA in elasticsearch

reading the conf files of logstash i found in filter conf grok { match => { "message" => "Put\s*command\s*:\s+%{GREEDYDATA:command}" } } How does this filter work , i tried to ...
I'm V's user avatar
  • 43
0 votes
1 answer
100 views

Unable to remove the unwanted messages(especially Auditbeat) in my centos server

I need your help in solving the below mentioned Issue. I have Installed Auditbeat-7.3.1 as a part of ELK setup in my centos server. Everything was working well, But i was facing problem while ...
PhaniKumar Raviprola's user avatar
1 vote
1 answer
404 views

rsyslog error in logstash

I have installed ELK and tried to configure rsyslog server with logstash but i am getting lot of \ while executing curl -XGET 'http://172.22.63.61:9200/logstash-*/_search?q=*&pretty' Rsyslog ...
MOBIN TM's user avatar
3 votes
2 answers
15k views

Change filesystem without losing data

I've got 16 nodes of elasticsearch (RHEL 7) - 18TB each, every node has a ext4 filesystem. For better efficency I need to change to XFS filesystem. Is there any tool / way which help me change ...
truegunner's user avatar
5 votes
1 answer
2k views

Yum install: unexpected nothing to do while upgrading elasticsearch

I'm experimenting something estrange with yum in centos7, lets see If someone understands what's happening: Usually, I upgrade packages using sudo yum install <package_name>-<version_info>...
grg121's user avatar
  • 151
0 votes
1 answer
337 views

unable to connect with localhost (11.213.234.24) on port 9200 from vagrant

I am running vagrant from a virtual box with centos. Trying to connect my localhost on port 9200 from vagrant by using (curl -X GET 'http://11.213.234.24:9200'). Getting below error curl: (7) couldn'...
user356582's user avatar
0 votes
1 answer
816 views

Elasticsearch fails to start with 'permissions read' error even though read permissions exist

I have a symlink at /etc/elasticsearch/analysis that points to a mounted drive at /elasticdata/fileshare/analysis on Ubuntu 16.04 LTS Azure VM. When I try and start elasticsearch I am getting the ...
Joe's user avatar
  • 103
0 votes
0 answers
37 views

Elasticsearch process run under weird username

I have Elasticsearch 1.7.3 running successfully on CentOS7. However, I observed: %ps -aux | grep elastic **209** 10504 85.0 29.2 36122740 19283600 ? SLl 04:02 0:05 /usr/bin/java -Xms30g -...
AlexPham's user avatar
0 votes
1 answer
1k views

Advantage of elasticsearch over grep when trying to search keyword in logs files [closed]

I know elasticsearch is good for full text search but when it comes to analyze logs, say nginx logs what is the advantage of using it over grep (with tail, awk, etc.) ? Quite of often I dig through ...
Qiulang 邱朗's user avatar
0 votes
1 answer
35 views

How to operate on a directory with different owner from a script?

Few days ago i have installed elasticsearch, For diagnosing some problems on my elasticsearch setup, i have checked the logs files located in /var/log/elasticsearch and tailed them but apparently the ...
JammingThebBits's user avatar
3 votes
1 answer
3k views

Why does a systemd unit file at `/usr/lib/systemd/system/` still works for Ubuntu?

I understand that systemd stores unit files at different locations for different versions of Linux. On RHEL, it's at /usr/lib/systemd/system/, whereas on Debian-based machines it's at /lib/systemd/...
dayuloli's user avatar
  • 515
2 votes
2 answers
17k views

Elasticsearch cannot open log file: Permission denied

The error I installed Elasticsearch on CentOS using rpm and am encountering this error when I try to start it via systemctl start elasticsearch: Feb 20 21:08:34 server.cberdata.org systemd[1]: ...
Phantom Watson's user avatar
0 votes
1 answer
404 views

How can I set the Java heap size for elasticsearch on Nixos?

It seems these should go in the ${configDir}/jvm.options"} (/var/lib/elasticsearch/config/jvm.options ?) looking at the package at https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/...
Chris Stryczynski's user avatar
0 votes
1 answer
2k views

One port is listening with an * and the other is listening with 127.0.0.1 and only the first is accepting remote connections

Please see the attached picture below, and then I will explain: So, I have Solr running which uses port 8983. And as you can see in the screen shot, it's listed as "TCP *:8983 (LISTEN)". And, it's ...
Tony Friz's user avatar
  • 123
0 votes
1 answer
1k views

Can I lock down access to a TCP port in Linux

I'm trying to secure a single-node Elasticsearch machine. Basically, I want to put Elasticsearch behind a reverse proxy (nginx) and make sure that the only way any user or process can communicate with ...
Dominic P's user avatar
  • 105
1 vote
1 answer
4k views

How is JVM memory usage calculated?

I am tuning my Elasticsearch cluster, and see that the memory usage doesn't line up. Running "free" on my instance: free total used free shared buff/cache ...
Avba's user avatar
  • 141
0 votes
1 answer
856 views

problem re-loading index from filebeat in elasticsearch

I am using the ELK stack (more ELG stack as I am using Grafana as the front end instead of kibana for personal reasons). I am using Filebeat to send the logs file to Logstash which are then stored in ...
detectiveahg's user avatar
8 votes
1 answer
14k views

How to give RAM to the filesystem cache

I am tuning my linux machine running Elasticsearch. It says that I should give at least half the memory of the machine running elasticsearch to the filesystem cache. But I don't know how much of it is ...
Rohanil's user avatar
  • 355
-1 votes
2 answers
32k views

How do i completely uninstall ELK (Elasticsearch, Logstash, Kibana)?

I search on internet that we have to unistall each of the ELK part one by one like unistall stand-alone kibana, elastic search, and logstash. Is there any command which no need to unistall all of them ...
gagantous's user avatar
  • 225
3 votes
2 answers
557 views

Timeouts between an API and an elasticsearch server every 2 hours

We are experiencing a weird issue on our servers. (Debian 8.9) We have an API which is a PHP application. It requests an elasticsearch which instance is on a separate server. Every 2 hours, we are ...
COil's user avatar
  • 301
1 vote
1 answer
3k views

How to start elasticsearch on a CentOS?

I have downloaded the latest elasticsearch version 5.5.1 on my Centos 7 server from https://www.elastic.co/downloads/elasticsearch. I have unzipped the file and store it in elasticsearch directory. ...
Rose's user avatar
  • 143
2 votes
1 answer
5k views

"unable to load jna" error on Elasticsearch on Centos

What is the solution to this? New install of elasticsearch 5.4.1 on Centos 6.8 [2017-06-15T13:54:19,140][WARN ][o.e.b.Natives ] unable to load JNA n ative support library, native methods ...
Jonesome Reinstate Monica's user avatar
3 votes
2 answers
396 views

Can not run Elasticsearch on Linux Mint 18

I installed Elasticsearch on Linux Mint without any trouble. Everything according this tutorial Easy install for elasticsearch on Ubuntu 14.04. All installation steps went well. However, when I want ...
catch23's user avatar
  • 221
0 votes
1 answer
520 views

Kibana- Want to split vertical bars based on my log fields

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "...
Murat's user avatar
  • 335
0 votes
1 answer
255 views

Send Apache Catalina Logs to Logstash

Dependencies : OS Version : CentOS 5.0 Server Environment : Production Logstash Version : 5.0 Elasticsearch Version : 5.0 I have several app servers running on CentOS 5.0. All these are on-...
Jakir patel's user avatar
0 votes
2 answers
946 views

How can I create a menu item for terminal-applications starting in background mode

I want to start e.g. my ElasticSearch instance which is installed manually via one-click in the cinnamon menu. What I can do is /opt/elasticsearch-1.6.2/bin/elasticsearch & and the application is ...
colidyre's user avatar
  • 193
1 vote
1 answer
246 views

logstash - take 2 - filter to send messages from IntelMQ/python/redis to ELK

Following up on the heels of this question, https://stackoverflow.com/questions/40768603/logstash-trying-to-make-sense-of-strings-passed-by-intelmq-in-elasticsearch I am trying to create a refine/...
Rui F Ribeiro's user avatar
2 votes
1 answer
261 views

Tile/Greographic Map in Kibana not working

I am trying to create a geographical map of my data in Kibana 5.01, and it does not work. The fact is that I do not even have the geoip.field that is required in the menu. I am sending data from ...
Rui F Ribeiro's user avatar