Need Urgent Hekp: new node not joining to existed cluster

2015-03-10 Thread phani . nadiminti
Hi All, i have a scenario here. i have 2 nodes before in my cluster now i want to add new node to existing cluster here i am facing issue with node 3 when i start node 3 it is starting but it is not joining to other nodes in cluster.But the existed nodes detecting new node from there

How can I achieve group by function in the Kibana beta 3 scripted fields

2015-03-10 Thread aditya narayan patra
Hi, I have to achieve sum(column1)/sum(column2) * 100 group by column 3 in kibana beta 3 scripted fields. Please let me know how to proceed . Thanks Regards, Aditya Narayan Patra -- You received this message because you are subscribed to the Google Groups elasticsearch group. To

Re: Aggregations failing on fields with custom analyzer..

2015-03-10 Thread Anil Karaka
Hello David, Currently we are using Elasticsearch in production to support heavy aggregation queries. It was working fine, but recently data nodes keep leaving the cluster regularly.. Each node around 3-5 times a day. And the scary part is cluster is in red state for few minutes each day. We

Re: Help me understand how ES calculate the score to match query

2015-03-10 Thread Nhật Quang Phan
You can enable explain for your query and see how elasticsearch calculates score: { explain: true, query: { match: { title: xbox } } } On Tuesday, March 10, 2015 at 3:15:50 PM UTC+7, Xudong You wrote: I have two documents as follows: 1. { title:xbox } 2. { title:xbox xbox xbox }

Re: Need Urgent Hekp: new node not joining to existed cluster

2015-03-10 Thread phani . nadiminti
forgot to update you all three are master and data elligble. On Tuesday, March 10, 2015 at 3:06:41 PM UTC+5:30, phani.n...@goktree.com wrote: Hi All, i have a scenario here. i have 2 nodes before in my cluster now i want to add new node to existing cluster here i am facing issue

Re: Need help on QueryBuilder

2015-03-10 Thread Nhật Quang Phan
Must query like AND condition. Your query look like : keywords field must match Holi AND symptom field must match Holi. If you want OR condition, use Should query instead. On Monday, March 9, 2015 at 2:13:26 PM UTC+7, Vijayakumari B N wrote: Hi, I want to build Query for the requirement

Re: Set default fields other than _source in Kibana 4

2015-03-10 Thread Deborah Seohol
Do you find solution to set fields? On Tuesday, December 9, 2014 at 11:32:57 PM UTC+2, Kevin Burton wrote: I have probably 3-5 fields that should show up in the default results in Kibana 4. The problem is that when I reload the UI it always goes back to the default of _source, which isn't

Kibana4 suricata, logstash dashboard issue

2015-03-10 Thread Ismail Yenigul
Hi, I installed suricata 2.0.7 ,logstash-1.4.2 elasticsearch-1.4.4-1 and kibana 3.1.2 from http://mestizo.github.io/blog/2014/04/17/suricata-2-dot-0-plus-logstash-plus-elasticsearch-plus-kibana-on-centos-6/ without any issue But I just installed kibana 4 but could not find how to deploy

Re: Shield with Java Client

2015-03-10 Thread Zsolt Bákonyi
Dear Jettro. Can you help me, how could you do it? I try to comminicate to Elasticsearch with Shield plugin. This is done when I make CURL requests. Without shield plugin my JAVA code ( Client is same as yours ) works well. But after install Shield, and put Shield into maven depencies in my

Re: Aggregations failing on fields with custom analyzer..

2015-03-10 Thread David Pilato
I'm going to make sure you get an answer soonish. Best. -- David ;-) Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 10 mars 2015 à 03:18, Anil Karaka anilkar...@gmail.com a écrit : Hello David, Currently we are using Elasticsearch in production to support heavy aggregation

Re: limiting REST API commands to localhost with 2 node cluster

2015-03-10 Thread Mark Walkom
See https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html The bind_host setting controls what network interface Elasticsearch listens on, which is useful if you have multiple NICs. publish_host setting controls what IP address Elasticsearch uses to talk to other

Re: ElasticSearch across multiple data center architecture design options

2015-03-10 Thread Mark Walkom
1 - It's pretty simple and has been used before. 2 - it can be yes. You can have multiple tribe nodes though. 3 - This may be possible but you'd have to hack a fair bit of code, so it's not really practical. On 10 March 2015 at 13:00, Alex naye...@gmail.com wrote: Hi all, We are planning to

Re: Help me understand how ES calculate the score to match query

2015-03-10 Thread Doug Turnbull
A couple of things are going on here First read Why is Relevance Broken. You're IDF might not be changing due to sharding. https://www.elastic.co/guide/en/elasticsearch/guide/current/relevance-is-broken.html Second docFreq reflects this terms actual document frequency (how many documents does

Re: Kibana4 suricata, logstash dashboard issue

2015-03-10 Thread Mark Walkom
KB 3 dashboards are not compatible with KB4 unfortunately On 10/03/2015 6:03 am, Ismail Yenigul ismailyeni...@gmail.com wrote: Hi, I installed suricata 2.0.7 ,logstash-1.4.2 elasticsearch-1.4.4-1 and kibana 3.1.2 from

Re: Need Urgent Hekp: new node not joining to existed cluster

2015-03-10 Thread Mark Walkom
Try using unicast instead of multicast discovery On 10/03/2015 2:36 am, phani.nadimi...@goktree.com wrote: Hi All, i have a scenario here. i have 2 nodes before in my cluster now i want to add new node to existing cluster here i am facing issue with node 3 when i start node 3 it is

Re: Please help to understand these Exceptions

2015-03-10 Thread Mark Walkom
It looks like heap pressure. How many indices, how many shards, how much data do you have in the cluster? On 8 March 2015 at 19:24, Chris Neal chris.n...@derbysoft.net wrote: Thank you Mark for your reply. I do have Marvel running, on a separate cluster even, so I do have that data from the

Re: Help me understand how ES calculate the score to match query

2015-03-10 Thread Xudong You
Thanks! I tried the explain and better understand how the score comes. But still has question on the IDF score, the IDF in the explain output of my query is: { value: 0.30685282, description: idf(docFreq=1, maxDocs=1) } What does docFreq and maxDocs in above mean? Per the IDF definition, the

Re: filtered has_child query?

2015-03-10 Thread Perryn Fowler
The query as written will return a result because you are querying for *Parent* documents that 'have children' matching your has_child query. You can tell because the type in the url will be 'Foo'. Hence, the filter you have specified is not run against the children, but against the *parents*. In

Re: Help me understand how ES calculate the score to match query

2015-03-10 Thread Xudong You
Thanks a lot! I now better understand how IDF in ES works, as you said, it is caused by sharding. After I added enough documents, I do see changes on IDF value as well as docFreq and maxDocs in output. On Wednesday, March 11, 2015 at 9:54:13 AM UTC+8, Doug Turnbull wrote: A couple of things

Not able to start Log Stash

2015-03-10 Thread vikas gopal
Hi Experts, As mentioned in the docs I have downloaded logstash-1.4.2.tar.gz. I have extracted it to m local E: drive . I am using the following command to run it via cmd E:\logstash\logstash-1.4.2\binlogstash -e 'input { stdin { } } output { stdout{} }'. It says no such command -e. Please

logstash failed to send ping to elasticsearch

2015-03-10 Thread Monika Bhadauria
Hi guys, I have my Elasticsearch on one server and logstash on another. I am getting the following error in my logstash, will need your inputs: log4j, [2015-03-11T05:26:32.662] WARN: org.elasticsearch.discovery.zen.ping.unicast: [logstash-ip-172-xx-xxx-7-8623-2016] failed to send ping to

How to to count occurrences of a phrase within field text

2015-03-10 Thread George Harth
Is there a way to ask for the number of occurrences of a given phrase within a single field? The phrase can contain spaces. I have been able to count instances of a single word using the terms aggregation, but that doesn't seem to work for phrases. I tried including double quotes around the

why IndicesExistsRequest is always comes as false on very startup of ES data node

2015-03-10 Thread Gaurav gupta
I need to check if any index already exist or not or re-start or start up the ES Data node. I am facing issue if I restart the ES Data node and then directly check if an index exist or not. I am always getting response as false (even if it exist and a valid one). But if, I perform a search or any

fielddata and date_histogram aggregation

2015-03-10 Thread Anant Aneja
I was reading up on when ES builds fielddata : https://www.elastic.co/guide/en/elasticsearch/guide/current/fielddata.html A footnote on this page reads 'It is required for any operation that needs to look up the value contained in a specific document'. Would this also be true when building

Re: fielddata and date_histogram aggregation

2015-03-10 Thread Anant Aneja
Ignore the bit about high cardinality. IMO, the use of fielddata for date_historgram is counter intuitive, since the buckets made a ranges as defined by the grain, and therefore the buckets are pre-defined in a sense which means the inverted index should itself be sufficient for building the

Re: Shield with Java Client

2015-03-10 Thread Zsolt Bákonyi
Thank you for reply, but nothing changed... You know the most funny thing is, if i left only this in my code: Client client = new TransportClient().addTransportAddress(new InetSocketTransportAddress(localhost, 9300)); Basic client without settings, and the exception is the same. If i

Finding first appearence of each value in a field?

2015-03-10 Thread Peter Trei
I'm very new to ELK, but learning. Maybe someone else has done this? I have a set of records in per-day indices which include a timestamp, and a hostname (along with many other fields). Any given hostname (eg: www.facebook.com) may appear many times, My goal is to create a report of the

Kibana 4 does not see _timestamp field

2015-03-10 Thread Micah Yoder
Hi, I'm pumping data into ElasticSearch (actually using rsyslog instead of logstash) into a date-based index with a mapping that stores the _timestamp. When I go in with Kibana 4.0.1 and start setting it up, it sees the indexes, but the drop down where you select the time field name is empty

limiting REST API commands to localhost with 2 node cluster

2015-03-10 Thread Scott
Hello, in the interest of security I had read that it was best to limit being able to query elasticsearch directly to localhost, and only allow users to search elasticsearch using Kibana. This has worked fine by setting the network.bind_host to localhost, but when I go to add another node to

Re: Need Urgent Hekp: new node not joining to existed cluster

2015-03-10 Thread mkBig
try the following: 1. restart all servers simultaneously 2. and verify if you have plugins in existing cluster, that are installed in new node as well -- You received this message because you are subscribed to the Google Groups elasticsearch group. To unsubscribe from this group and stop

Resuming a river plugin after failure

2015-03-10 Thread reza sadoddin
I was using ElasricSearch river plugin for indexing wikipedia. However, I got the following error message in the middle of indexing, and the process stopped. Can I resume indexing from the point of failure? Thanks, ][ERROR][river.wikipedia ] [Mayhem] [wikipedia][my_river] failed to

Profiling and optimizing queries

2015-03-10 Thread unlucio
Hello everybody, In the attempt to optimize a query I followed the suggestions I found in this presentation: https://speakerdeck.com/polyfractal/elasticsearch-query-optimization transforming my query form: { index: products_en, from: 0, size: 100, q: apple iphone AND visible:1,

Re: Elasticsearch import configuration files

2015-03-10 Thread Michael Power
Is there any other way of modifying the elasticsearch configuration without modifying the package manager installed elasticsearch.yml file? On Monday, March 9, 2015 at 4:18:19 PM UTC-7, Mark Walkom wrote: You cannot use an array in path.conf. On 9 March 2015 at 15:02, Michael Power

filtered has_child query?

2015-03-10 Thread asanderson
Is a filtered has_child query possible where the filter is applied to the child document before the query of the has_child? e.g. Given the example below... curl -X PUT http://localhost:9200/foobar; -d {\mappings\:{\Foo\:{},\Bar\:{\_parent\:{\type\:\Foo\ curl -X PUT

Help me understand how ES calculate the score to match query

2015-03-10 Thread Xudong You
I have two documents as follows: 1. { title:xbox } 2. { title:xbox xbox xbox } Then I search the documents with following query: { query:{match:{title:xbox}} } ES returns result as follows: {took:133,timed_out:false,_shards:{total:5,successful:5,failed:0},hits:{total:2,max_score:0.30685282,

How to get field name and data type by javascript

2015-03-10 Thread tao hiko
Hi All, I need to get information of index/type by javascript and below is expected result In ES by mapping command via Sense { testindex: { mappings: { test: { _id: { path: anlz }, properties: { f1: {

how to create dashboard

2015-03-10 Thread vikas gopal
Hi Experts, Since i am new to this technology , I need your assistance to start building dashboard in ELK. I have downloaded all the 3 tools (E,L,K) . I want to create a dashboard from a syslog file . I don't know how I can get data into ELK and prepare dashboard out of it. Please suggest from

Re: Elasticsearch import configuration files

2015-03-10 Thread Mark Walkom
You can define your own path by calling the ES binary with -Des.path.config=/path On 10/03/2015 3:46 pm, Michael Power michael.power.eloto...@gmail.com wrote: Is there any other way of modifying the elasticsearch configuration without modifying the package manager installed elasticsearch.yml