Re: java, mlockall and high cpu kswapd

Quick update, As much for myself or if anybody else comes across this problem in the future. We moved both master and query nodes to use 70% of our calculated 'usable_memory'. Things seem stable now. We are still concerned about being able to maximize java heap size on our query (aka

Re: Kibana group by terms

Michael, If the value is being parsed into separate words, just try using the FIELD.raw version instead, Best, LM On Friday, October 17, 2014 9:54:40 PM UTC+2, Michael Irwin wrote: I'm using Kibana w/ logstash to view web server logs. I'd like to add a graph that displays uniques of the

Re: Search Plugin to intercept search response

Hi, if I understand correctly, seems it should be possible to use SimpleRequest over TransportClient, is this correct? I couldn't get it to work using: Client client = new TransportClient().addTransportAddress(new InetSocketTransportAddress(localhost, 9300)); but when switched to node client,

Re: Filters: odd behavior

Thanks guys for your responses. My question was due an strange behavior when using 'not' and 'geo_distance' filters. I want to filter some results that have undesirable words, such as 'sex', 'xxx', etc... And then geo filter those good results, but if I place 'not' filter first, then when geo

Shard Recommendation for Elasticsearch

Hi All, I currently am planning on building out to a 4 Elasticsearch data node cluster from currently at 2 and have a question regarding how many shards to use for the indexes. I am running the ELK stack and currently each index file, one per day, is creating 5 shards per node. As you can

Re: Kibana group by terms

That's what I needed. Thanks! -- Mike On 2014-10-18, Lorenzo Mangani wrote: Michael, If the value is being parsed into separate words, just try using the FIELD.raw version instead, Best, LM On Friday, October 17, 2014 9:54:40 PM UTC+2, Michael Irwin wrote: I'm using Kibana

Re: running master nodes on application servers

Is there some reason why your Elasticsearch nodes cannot serve as both master and data? I believe that dedicated master nodes should only come into play with large clusters, way beyond the 3 you have. If your master nodes are tied to your app nodes, then I believe you will have less resiliency

Re: Filters: odd behavior

The structure of your query is odd. Either it is some format that I am not aware of or the Elasticsearch parser is not doing a good job at determining it is invalid. Your two filters should be joined via a bool filter. Sometime like (not tested): { query: { filtered: { query: {

Re: Question: shard awareness allocation and shard allocation filtering

On Thu, Oct 16, 2014 at 11:42 AM, Grégoire Seux kamaradclim...@gmail.com wrote: - are awareness and filtering supposed to cooperate? A quick look at the code confirm that allocation deciders are fully orthogonal. Should I open a github issue to discuss adding support for cooperating deciders ?

Re: Shard Recommendation for Elasticsearch

The number of shards will help you scale out in case you add more nodes in the future. With your current shard count at 5, you cannot optimally deploy and distribute a 6+ node cluster. However, your data is time-based, one per day. Are queries on historical data important? I would start off with a

Re: copy index

Jorg, That is exactly the kind of thing I'm looking for. I'm having a little bit of difficulty getting it to do what I want. I want to push an index to another index and change the mapping. I can import / export okay but the push is having difficulty picking up the new mappings. The syntax

another EC2 publish_host public ip problem

Hi, I can't figure out why Elasticsearch still can't be reached from the public ip of the ec2 instance. This is my config file cloud.aws.access_key: AKIAXPWEW2A cloud.aws.secret_key: EvU0I5Xx+b+FlRXXXSSDFfM2Z plugin.mandatory: cloud-aws cluster.name: escluster node.name: