For me tuning the threadpool search queue_size solved the issue. I tried a number of other things and this is the one that solved it. I added this to my elasticsearch.yml threadpool.search.queue_size: 10000 and then restarted elasticsearch. Reasoning… (from the docs) A node holds several thread pools in order to improve how threads memory consumption … Read more
Clearing the cache alleviates the symptoms for now. http://www.elastic.co/guide/en/elasticsearch/reference/current/indices-clearcache.html Clear a single index curl -XPOST ‘http://localhost:9200/twitter/_cache/clear’ Clear multiple indicies curl -XPOST ‘http://localhost:9200/kimchy,elasticsearch/_cache/clear’ curl -XPOST ‘http://localhost:9200/_cache/clear’ Or as suggested by a user in IRC. This one seems to work the best. curl -XPOST ‘http://localhost:9200/_cache/clear’ -d ‘{ “fielddata”: “true” }’ Update: these errors went away as soon … Read more
This is an old post. But I think still someone is still searching for a good answer. You can easily export your searches from Kibana Discover. Click Save first and enter the “Title” field, then click Share Click CSV Reports Then click Generate CSV After a few moments, you’ll get the download option bottom right … Read more
There is some misunderstanding about what localhost or 127.0.0.1 means when running a command inside a container. Because every container has its own networking, localhost is not your real host system but either the container itself. So when you are running kibana and pointing the ELASTICSEARCH_URL variable to localhost:9200 the kibana process will look for … Read more
The query you’re looking for is this one: _exists_:status_code AND NOT status_code:200 This link shows you all what’s supported by query string queries.
If you’ve installed ES on Linux, the default data folder is in /var/lib/elasticsearch (CentOS) or /var/lib/elasticsearch/data (Ubuntu) If you’re on Windows or if you’ve simply extracted ES from the ZIP/TGZ file, then you should have a data sub-folder in the extraction folder.
Kibana itself doesn’t support authentication or restricting access to dashboards. You can restrict access to Kibana 4 using nginx as a proxy in front of Kibana as described here: https://serverfault.com/a/345244. Just set proxy_pass to port 5601 and disable this port on firewall for others. This will completly enable or disable Kibana. Elastic also has a … Read more
Kibana 4 logs to stdout by default. Here is an excerpt of the config/kibana.yml defaults: # Enables you specify a file where Kibana stores log output. # logging.dest: stdout So when invoking it with service, use the log capture method of that service. For example, on a Linux distribution using Systemd / systemctl (e.g. RHEL … Read more
If I understand your question properly, you’re trying to use the “Exclude Pattern” to exclude certain values from populating in the chart. The “Exclude Pattern” and “Include Pattern” fields are for Regular Expressions and are documented here: http://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html. If you want to exclude multiple fields, you could do something like this: term1|term2|term3