renshuki

If you get a NET::ERR_CERT_COMMON_NAME_INVALID when trying to connect to Kibana from your browser, it means the CN and/or SAN you defined at the certificate generation is incorrect. Please refer to the Encrypt traffic between your browser and Kibana documentation for more details on how to properly generate a server certificate for Kibana.

renshuki

Add vis_type_table.legacyVisEnabled: true to kibana.yml

renshuki

Command:

tcpdump -A 'tcp port 9200 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)' -i lo0 | egrep -A 5 -i "POST /_bulk"

Expected output (w/ Content-Length):

...U...5POST /_bulk HTTP/1.1
Connection: Keep-Alive

renshuki

Resources on how to adjust scoring in Elasticsearch

• Similarity module
• Constant score query
• Function score query
• Script score query
• Ignoring TF/IDF

renshuki

e.g Delete Logstash logs after 45 days

appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:ls.logs}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = logstash-${sys:ls.log.format}-*
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.age = 45D

renshuki

Run GET _cat/thread_pool?v&h=node_name,name,max,pool_size,size,type,queue_size

Gives you details on Elasticsearch threadpool size, type, queue_size.

Example output

node_name           name                                    max pool_size size type                  queue_size
instance-0000000009 analyze                                             0    1 fixed                         16
instance-0000000009 ccr                                                32   32 fixed                        100

renshuki

// - Try to update matching documents using _update_by_query (https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-update-by-query.html)
// - If no matching documents, index a new one with desired data
//
// Install Elasticsearch Node.js client: npm install @elastic/elasticsearch

const { Client } = require('@elastic/elasticsearch')
const client = new Client({ node: 'http://localhost:9200' })


client.updateByQuery({

renshuki

{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input" : {
    "http" : {
 "request" : {

renshuki

Keybase proof

I hereby claim:

• I am renshuki on github.
• I am fcbrossard (https://keybase.io/fcbrossard) on keybase.
• I have a public key ASDqj90a23IOGVKTIh8wjEk0cLLD-OgGhihG__X3o-s2gAo

To claim this, I am signing this object:

renshuki

"transform": {
  "script": {
    "source": "return [ 'dups': ctx.payload.aggregations.my_buckets.buckets.stream().filter(t -> { return t.doc_count > 1 }).map(t -> { return ['key': t.key ] }).collect(Collectors.toList()) ]",
    "lang": "painless"
  }
}