<p>When <a href="https://www.elastic.co/products/stack/security">security features</a> are enabled in Elasticsearch, it is possible to enable an audit log as well. This log contains events that occur in the Elasticsearch node that might be interesting from a security perspective. To analyze these events easily, they can be indexed back into Elasticsearch, preferably into a separate cluster from the one that's generating the events. This blog post explains how this indexing feature has changed in recent times.
</p><p>Until version 6.7.0 of Elasticsearch, the recommended way of indexing audit logs back into Elasticsearch for easy analysis was to use the <code>index</code> output type when configuring the audit log settings. This output type was deprecated in version 6.7.0. In the same version, we introduced the <code>audit</code> fileset of the <code>elasticsearch</code> module in <a href="https://www.elastic.co/products/filebeat">Filebeat</a>, which performs the same role as the <code>index</code> output type of the Elasticsearch audit log.
</p><p>In version 7.0.0 of Elasticsearch, we removed the <code>index</code> output of the Elasticsearch audit log completely. Configuring Filebeat is henceforth the only alternative for easy analysis of the audit log.
</p><h2>Why has the <code>index</code> output type been retired?</h2><p>Although using the <code>index</code> output type was convenient from a configuration standpoint, there are strong technical reasons why this option is not suitable in production environments and so it has been retired. The main drawback is that the audit event throughput is related to the node’s request load. Nodes with higher traffic generate more audit events. The indexing throughput, however, is limited by the destination cluster’s capacity. If the destination cluster can’t keep up with the volume, then we eventually need to drop some of the audit events or selectively drop client requests. Moreover, the queueing buffer for audit events was in-memory with no disk persistence, because disk persistence was assured by the other dedicated logging output type <code>logfile</code>. All this can lead to audit data loss in a multitude of complex failure scenarios.
</p><p>In short, this functionality was hard to maintain and provided little gains. Instead, by “outsourcing” the indexing task to Filebeat, Elasticsearch’s audit trail only has to focus on one task: storing events on the persistent storage and with no queueing. The audit capacity eats at a resource (disk I/O) that the administrators already have to plan for. Filebeat, being a separate process that runs alongside the Elasticsearch node, can take the indexing load off the Elasticsearch node's shoulders. And since Filebeat works off the audit log files generated by the Elasticsearch node, these files act as a natural queue. If the Elasticsearch cluster receiving the audit log documents for indexing is under load, Filebeat will wait until the load lessens and then continue indexing from the last entry it ingested from the audit log file.
</p><p>Finally, using Filebeat provides you with additional options that weren’t available with the old <code>index</code> output, such as event filter (see examples below) or sending events to Logstash for enrichment or to Kafka for queueing before further routing.
</p><h2>Using Filebeat to ingest Elasticsearch audit logs</h2><p>Let's see what steps are involved in using Filebeat to ingest Elasticsearch audit logs into an Elasticsearch cluster.
</p><p>On every node in your Elasticsearch cluster, do the following:
</p><ol>
	<li>Enable the audit log for that node by setting <code>xpack.security.audit.enabled: true</code> inside the <code>elasticsearch.yml</code> config file. See <a href="https://www.elastic.co/guide/en/elastic-stack-overview/7.0/auditing.html">Auditing Security Events</a> for more details.</li>
	<li>Start the Elasticsearch node.</li>
	<li><a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-installation.html">Install Filebeat</a> alongside the Elasticsearch node. This could mean installing Filebeat on the same host or VM as the Elasticsearch node or in a sidecar container.</li>
	<li>Filebeat ships with a variety of modules, each catering to a well-known source of log files. In this case, we want to use the Elasticsearch module, so <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#running-elasticsearch-modules">enable it.</a></li>
	<li>Once the Elasticsearch Filebeat module is enabled, it will look in well-known paths for Elasticsearch log files and it will naturally follow them as they are rotated. If you want to customize these paths, edit the <code>elasticsearch.yml</code> file under the <code>modules.d</code> folder and make the necessary configuration changes. The <code>modules.d</code> folder is located in the same folder that contains <code>filebeat.yml</code>, which is the main Filebeat configuration file.</li>
	<li>To specify which Elasticsearch cluster you want to index your audit log events into, as well as other settings related to the Elasticsearch output (e.g., authentication settings), <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/elasticsearch-output.html">edit the <code>output.elasticsearch</code> section</a> in <code>filebeat.yml</code>.</li>
	<li>Finally, <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#running-elasticsearch-modules">start Filebeat</a>. Your Elasticsearch audit logs will be indexed into <code>filebeat-*</code> indices (by default) on the Elasticsearch cluster you configured in the previous step.</li>
</ol><h2>Common considerations</h2><h3>Indexing a subset of audit log events</h3><p>By default every event that appears in the audit log file will be picked up by Filebeat and indexed into Elasticsearch. However, you may want to index only certain audit log events. This can be achieved by using Filebeat's <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/drop-event.html"><code>drop_event</code> processor</a> with the appropriate <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/defining-processors.html#conditions">conditions</a>.
</p><p>For instance, you may want to only index audit log events involving the <code>elastic</code> user. To achieve this, edit the <code>modules.d/elasticsearch.yml</code> file and under the <code>audit</code> fileset section, add the following:
</p><pre class="prettyprint">input:
  processors:
    - decode_json_fields:
        fields: [ "message" ]
        target: temp
    - drop_event:
        when:
          not:
            contains:
              temp.user.name: elastic
    - drop_fields:
        fields: [ "temp" ]
</pre><p>You can view the list of available <a href="https://www.elastic.co/guide/en/elastic-stack-overview/7.0/audit-event-types.html#audit-event-attributes">audit event fields</a> in the documentation.
</p><h3>Indexing audit log events in multiple Elasticsearch clusters</h3><p>A single Filebeat instance can only send events to a single Elasticsearch cluster. This means that if you would like to send your audit log events to multiple Elasticsearch clusters that you have a couple of options:
</p><ol>
	<li><strong>Run multiple Filebeat instances.</strong> Configure the <code>output.elasticsearch</code> section, particularly the <code>hosts</code> setting, of each instance to send to a different Elasticsearch cluster.<br><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt2c69bcf91c87d84e/5cd3b32126b60d975bc8bb1f/audit-logs-filebeat-1.png" data-sys-asset-uid="blt2c69bcf91c87d84e" alt="Run multiple Filebeat instances" style="display: block; margin: auto;"></li>
	<li><strong>Run a single Filebeat instance and send your audit logs to Logstash by configuring the <code>output.logstash</code> section in your <code>filebeat.yml</code>.</strong> Then configure your Logstash pipeline to with multiple <a href="https://www.elastic.co/guide/en/logstash/7.0/plugins-outputs-elasticsearch.html"><code>elasticsearch</code> outputs</a> to send to multiple Elasticsearch clusters.<br><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt150a8864c4e92de5/5cd3b338a2ceb62a594890f4/audit-logs-filebeat-2.png" data-sys-asset-uid="blt150a8864c4e92de5" alt="Run a single Filebeat instance and send your audit logs to Logstash" style="display: block; margin: auto;"></li>
	<li><strong>Run a single Filebeat instance and send your audit logs to one Elasticsearch cluster.</strong> Then use <a href="https://www.elastic.co/guide/en/elastic-stack-overview/current/xpack-ccr.html">cross-cluster replication</a> to replicate the audit logs index over to another Elasticsearch cluster.<br><img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt3cc9f3bd5b4c4b9b/5cd3b35008e4032f59d1a656/audit-logs-filebeat-3.png" data-sys-asset-uid="blt3cc9f3bd5b4c4b9b" alt="Run a single Filebeat instance and send your audit logs to one Elasticsearch cluster" style="display: block; margin: auto;"></li>
</ol><h2>Analyzing audit logs in Elasticsearch</h2><p>Once your audit logs have been indexed into <code>filebeat-*</code> indices, you can start running queries against them and creating visualizations in Kibana.
</p><p>For instance, here's a sample query to count the different types of Elasticsearch transport-level actions that were performed every hour:
</p><pre class="prettyprint">POST filebeat-*/_search
{
  "size": 0, 
  "query": {
    "bool": {
      "filter": {
        "term": {
          "event.dataset": "elasticsearch.audit"
        }
      }
    }
  },
  "aggs": {
    "by_hour": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h"
      },
      "aggs": {
        "by_event_type": {
          "terms": {
            "field": "elasticsearch.audit.action"
          }
        }
      }
    }
  }
}
</pre><h2>But wait, there's more!</h2><p>Not only can Filebeat ingest Elasticsearch audit logs but it can also ingest other types of Elasticsearch logs —&nbsp;the <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#_literal_server_literal_log_fileset_settings">main server log</a>, <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#_literal_gc_literal_log_fileset_settings">GC log</a>, <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#_literal_slowlog_literal_log_fileset_settings">slow log</a> and <a href="https://www.elastic.co/guide/en/beats/filebeat/7.0/filebeat-module-elasticsearch.html#_literal_deprecation_literal_log_fileset_settings">deprecation log</a>. Think of all the amazing correlation and other analysis you could do in Kibana about the all the events happening in your Elasticsearch cluster!
</p><p>And if you're looking for an Elasticsearch cluster to send your audit — and other — logs to try taking our <a href="https://cloud.elastic.co/">Elasticsearch Service</a> for a 14-day free trial!
</p><p>As always, questions are welcome (and encouraged) on our <a href="https://discuss.elastic.co/">Discuss forums</a>.
</p>

audit-logs-filebeat-banner.jpg

audit-logs-filebeat-thumb.jpg

Indexing Elasticsearch Audit Logs with Filebeat

main_image.png

You know, for visualizing your Logstash pipelines

under-the-hood-mechanic.jpg

under-the-hood-720x420.jpg

Kibana under the hood: object persistence

Elasticsearch 2.2.0 released with a query profiler and supercharged geopoint fields.

<html><head></head><body><p>
	Welcome to 
	<em>This Week in Elasticsearch and Apache Lucene</em>! With this weekly series, we&apos;re bringing you an update on all things Elasticsearch and Apache Lucene at Elastic, including the latest on commits, releases and other learning resources.
</p><h2>Top News</h2><blockquote class="twitter-tweet" data-cards="hidden" data-lang="en">Elasticsearch 2.2.0 released with a query profiler and supercharged geopoint fields. <a href="https://t.co/CKjrpuLKYg">https://t.co/CKjrpuLKYg</a> Already available on Found<br>&#x2014; elastic (@elastic) <a href="https://twitter.com/elastic/status/694572167686651904">February 2, 2016</a></blockquote><script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script><h2>Elasticsearch Core</h2><p><strong>2.2:</strong>
</p><ul>
	<li>The <a href="https://github.com/elastic/elasticsearch/pull/16383" target="_blank">SmbDirectoryWrapper in the Azure plugin</a> is now an elasticsearch package to avoid hiding bugs like calling ensureOpen on the wrong directory.</li>
	<li>The <a href="https://github.com/elastic/elasticsearch/pull/16325" target="_blank">NotSerializableExceptionWrappe<wbr>r</a> now includes the exception class name.</li>
</ul><p><strong>2.x:</strong>
</p><ul>
	<li>Upgrade to <a href="https://github.com/elastic/elasticsearch/pull/16400" target="_blank">lucene 5.5.0-snapshot-4de5f1d</a></li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/14846" target="_blank">RPM and deb signing</a> is now tested during build.</li>
	<li>Requests that shouldn&apos;t be allowed according to CORS settings are now <a href="https://github.com/elastic/elasticsearch/pull/16092" target="_blank">rejected before they are executed</a>.</li>
</ul><p><strong>master:</strong>
</p><ul>
	<li>The <a href="https://github.com/elastic/elasticsearch/pull/16336" target="_blank">plugin CLI has been refactored</a> to reduce complexity and ambiguity, and to <a href="https://github.com/elastic/elasticsearch/pull/16359" target="_blank">improve exception handling</a>.</li>
	<li>The ingest pipeline adds <a href="https://github.com/elastic/elasticsearch/pull/16324" target="_blank">processor tags</a> to the ingest metadata on failure.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16276" target="_blank">Catch processor/pipeline exceptions</a> and throw structured exceptions.</li>
	<li>Added the <a href="https://github.com/elastic/elasticsearch/pull/16432" target="_blank">foreach processor</a> to ingest for dealing with arrays.</li>
	<li>Prevent index/delete/flush requests from <a href="https://github.com/elastic/elasticsearch/pull/16274" target="_blank">bouncing between two primary shard copies</a> during relocation.</li>
	<li>Shard failure requests for <a href="https://github.com/elastic/elasticsearch/pull/16275" target="_blank">no longer existing shards</a>3 now generate an exception.</li>
	<li>Clean <a href="https://github.com/elastic/elasticsearch/pull/15900" target="_blank">handoff during primary relocation</a> now ensures that no index/delete requests are lost. This fixes a long standing issue: <a href="https://github.com/elastic/elasticsearch/issues/8706" target="_blank">Delete might returns false `isFound()` while primary is relocated</a></li>
	<li>Tasks can <a href="https://github.com/elastic/elasticsearch/pull/16356" target="_blank">report their status</a>.</li>
	<li>The settings filter <a href="https://github.com/elastic/elasticsearch/pull/16425" target="_blank">to remove private settings</a> is now immutable.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16448" target="_blank">Pluggable custom gateways</a> are no longer supported.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16243" target="_blank">Shard version information</a> is no longer used for shard routing now that we have allocation IDs.</li>
	<li>The bin/plugin script is now called <a href="https://github.com/elastic/elasticsearch/pull/16454" target="_blank">bin/elasticsearch-plugin</a>.</li>
	<li>The TermVector API no longer supports the <a href="https://github.com/elastic/elasticsearch/pull/16452" target="_blank">DFS option</a> as it was very heavy and added little value.</li>
	<li>The cat API now respects the <a href="https://github.com/elastic/elasticsearch/pull/14421" target="_blank">Accepts  header</a> instead of the Content-type header, when choosing the response format.</li>
	<li>The <a href="https://github.com/elastic/elasticsearch/pull/16469" target="_blank">IndicesFieldDataCache</a> has been simplified and no longer uses Guice.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16479" target="_blank">MessageDigest instances are no longer cloned</a> (as some platforms don&apos;t support it) but return thread local instances instead.</li>
</ul><p><strong>Ongoing:</strong>
</p><ul>
	<li>The reindex API can be run in the background with the <a href="https://github.com/elastic/elasticsearch/pull/16100" target="_blank">wait_for_completion </a>parameter, which defaults to `true`. It also supports a <a href="https://github.com/elastic/elasticsearch/pull/16029" target="_blank">progress indicator</a>.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16453" target="_blank">Unify plugin packaging</a> structure across projects.</li>
	<li>Index folders will now include the <a href="https://github.com/elastic/elasticsearch/pull/16442" target="_blank">index UUID</a> (and sanitise the index name to avoid problems with different file systems).</li>
	<li>Work continues on the <a href="https://github.com/elastic/elasticsearch/pulls?q=is%3Apr+is%3Aclosed+label%3A%22%3ASearch+Refactoring%22" target="_blank">monumental search refactoring</a>.</li>
</ul><h2>Apache Lucene</h2><div>
	<ul>
		<li>The current plan is to&#xA0;<a href="http://markmail.org/message/sgxuw3ly4eyuqi7y" target="_blank">cut the 5.5.0 release branch in a few days</a>&#xA0;and once the 5.5.0 release is done we&apos;ll get the 6.0.0 release process underway!&#xA0;</li>
		<li>More progress on the challenging change to&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6835" target="_blank">push retrying of file deletion down under the&#xA0;<code>Directory</code>&#xA0;abstraction</a>, instead of making it the caller&apos;s job&#xA0;</li>
		<li>The new postings-based geo point queries&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6997" target="_blank">are graduating from the experimental sandbox module into the spatial module</a>, and the previous spatial module classes (with optional&#xA0;<code>spatial4j</code>&#xA0;dependency) are moving to a&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7015" target="_blank">new&#xA0;<code>spatial-extras</code>&#xA0;module</a>, as a precursor to&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6930" target="_blank">nice geo point performance gains</a>&#xA0;added in a backwards compatible way&#xA0;</li>
		<li>Our copyright headers&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7013" target="_blank">now appear at the very top of all sources</a>, and&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7012" target="_blank">our IDE configs are now fixed do so for new source files as well</a>&#xA0;</li>
		<li>Randomized tests uncovered&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7011" target="_blank">a missing try-with-resources in the new&#xA0;<code>SimpleTextPointWriter</code>&#xA0;</a></li>
		<li>We don&apos;t need to&#xA0;<code>Files.deleteIfExists</code>&#xA0;when creating a new index file, since we&#xA0;<a href="https://github.com/apache/lucene-solr/commit/72b79308cbce0ab31948df1efeb0cdd5e9eb027f" target="_blank">already pass the&#xA0;<code>TRUNCATE_EXISTING</code>&#xA0;option</a>&#xA0;</li>
		<li><code>IndexWriter</code>&#xA0;now logs&#xA0;<a href="https://github.com/apache/lucene-solr/commit/a48ba5090beafc725ab04e67996e42f0b3f31348" target="_blank">how long it took to flush each part</a>&#xA0;of a new segment&#xA0;</li>
		<li>Now it&apos;s possible&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7010" target="_blank">to fully wrap another&#xA0;<code>MergePolicy</code>&#xA0;</a></li>
		<li>More&#xA0;<a href="https://github.com/apache/lucene-solr/commit/62dfc815b030ca051379a12061fb0a9aa98ca09c" target="_blank">geo math tweaks</a>&#xA0;to avoid exceeding the legal range for latitude and longitude&#xA0;</li>
		<li>A new&#xA0;<code>expectThrows</code>&#xA0;utility&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7009" target="_blank">uses lambda expressions to compactly expect a test to throw a specific exception and fail otherwise</a>, but we still need to somehow cutover numerous tests&#xA0;</li>
		<li><code>BaseMergePolicyTestCase</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7006" target="_blank">is now used by more tests</a>, but it&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7008" target="_blank">caused a reproducible test failure</a>&#xA0;fixed by&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7010" target="_blank">this issue</a>&#xA0;</li>
		<li><code>TieredMergePolicy</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7005" target="_blank">had an extra&#xA0;<code>=</code>&#xA0;in an exception message</a>&#xA0;</li>
		<li>The new&#xA0;<code>TestSwappedIndexFiles,</code>&#xA0;<wbr>designed to ensure that copying the same file name from a different index is always detected as corruption, had a scary failure, but&#xA0;<a href="https://github.com/apache/lucene-solr/commit/15fed60b050c14e09638ebc7d56df99d24631fc6" target="_blank">it was a simple test bug</a>&#xA0;</li>
		<li>Some more small fixes for the new (coming in 6.0.0) point values:&#xA0;<br>
		<ul>
			<li>Point fields&#xA0;<a href="https://github.com/apache/lucene-solr/commit/5d5b082e6d68413c274c8259c235c2d56b14a760" target="_blank">failed to detect some misuse</a>&#xA0;</li>
			<li>2D point values&#xA0;<a href="https://github.com/apache/lucene-solr/commit/07c9b2bdad1c072678763993c0ba2ed3bba810bc" target="_blank">are also exercised in a few more tests</a>&#xA0;</li>
			<li>We now&#xA0;<a href="https://github.com/apache/lucene-solr/commit/ddbf3a21687249f3e8481f80839052ad0b8f746b" target="_blank">test&#xA0;<code>addIndexes</code>&#xA0;with point values when the field numbers changed</a>, and across different codecs&#xA0;</li>
			<li>The new&#xA0;<code>BasePointFormatTestCase</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7000" target="_blank">sh<wbr>ares common code and makes it easy to test new point formats in the future</a>&#xA0;</li>
			<li>Tests that assert two readers are equal&#xA0;<a href="https://github.com/apache/lucene-solr/commit/9332b1602cc0f7312fc22a3d088c549299015691" target="_blank">now also verify the point values are the same</a>&#xA0;</li>
		</ul></li>
		<li>Codec level encryption&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6966" target="_blank">offers fine-grained control over which parts of the index need encryption</a>&#xA0;</li>
		<li>Another&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7017" target="_blank">corner case geo point test failure</a>&#xA0;</li>
		<li><code>FastVectorHighlighter</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7016" target="_blank">hits&#xA0;<code>Str&lt;wbr&gt;ingIndexOutOfBoundsException</code>&#xA0;</a>i<wbr>n some cases&#xA0;</li>
		<li>We should standardize on&#xA0;<code>TimeUnit</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7014" target="_blank">for time conversions</a>&#xA0;</li>
		<li>The&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6996" target="_blank">points based and postings based geo implementations use different encodings with different quantization errors</a>&#xA0;</li>
		<li><code>MultiCollector</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7002" target="_blank">might throw&#xA0;<code>NullPointerException</code>&#xA0;</a>whe<wbr>n one if its sub-collectors throws&#xA0;<code>CollectTerminatedExcept&lt;wbr&gt;ion</code>&#xA0;</li>
		<li>A new utility class&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7003" target="_blank">runs a&#xA0;<code>TokenFilter</code>&#xA0;on a string and prints the results</a>&#xA0;to help debugging&#xA0;</li>
		<div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 13px;">
			<div dir="ltr">
			</div>
		</div>
	</ul>
</div><h2>Watch This Space</h2><p><a href="https://www.elastic.co/blog/feed">Stay tuned to this blog</a>, where we&apos;ll share more news on the whole Elastic&#xA0;ecosystem including news, learning resources and cool use cases!
</p></body></html>

This Week in Elasticsearch and Apache Lucene - Query Profiler and Geopoint Fields

Just how easy is it clone your cluster in our hosted #Elasticsearch service? (Hint: very)

<html><head></head><body><p>
	Welcome to 
	<em>This Week in Elasticsearch and Apache Lucene</em>! With this weekly series, we&apos;re bringing you an update on all things Elasticsearch and Apache Lucene at Elastic, including the latest on commits, releases and other learning resources.
</p><h2>Top News</h2><blockquote class="twitter-tweet" data-cards="hidden" lang="en">Just how easy is it clone your cluster in our hosted <a href="https://twitter.com/hashtag/Elasticsearch?src=hash">#Elasticsearch</a> service? (Hint: very) <a href="https://t.co/I3ySOOFz04">https://t.co/I3ySOOFz04</a> <a href="https://t.co/M9HoK1KTgw">pic.twitter.com/M9HoK1KTgw</a><br>&#x2014; elastic (@elastic) <a href="https://twitter.com/elastic/status/693166096652701696">January 29, 2016</a></blockquote><script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script><h2>Elasticsearch Core</h2><p><strong>Changes in 2.2:</strong><br>
</p><ul>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16196" target="_blank">Closures</a> are once again allowed in the Groovy scripting plugin, and a <a href="https://github.com/apache/groovy/pull/248" target="_blank">PR has been submitted to Groovy</a> to remove the need for the supressAccessChecks permis<wbr>sion.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16209" target="_blank">Translog recovery</a> is fast again.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/15320" target="_blank">Command line options</a> now work correctly on Windows.</li>
	<li>The Tribe node wasn&apos;t passing on a <a href="https://github.com/elastic/elasticsearch/pull/16258" target="_blank">custom --path.conf</a> to its node clients, which resulted in security exceptions.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16222" target="_blank">Query and top-level inner hits results</a> shouldn&apos;t overwrite each other.</li>
	<li>Geo-shapes didn&apos;t work in the percolator if <a href="https://github.com/elastic/elasticsearch/pull/16043" target="_blank">map_unmapped_fields_as_string</a> was enabled.</li>
</ul><p><strong>Changes in 2.x:</strong>
</p><ul>
	<li>Disabled fielddata loading was <a href="https://github.com/elastic/elasticsearch/pull/16179" target="_blank">silently ignored on empty indices</a>.</li>
	<li>Throw an exception if the <a href="https://github.com/elastic/elasticsearch/pull/16305" target="_blank">Lucene version</a> is not the expected one.</li>
	<li>Include the <a href="https://github.com/elastic/elasticsearch/pull/16325" target="_blank">exception name</a> for not serializable exceptions.</li>
</ul><p><strong>Changes in master:</strong>
</p><ul>
	<li>Shard failure requests for <a href="https://github.com/elastic/elasticsearch/pull/16089" target="_blank">no longer existing shards</a> should always be considered successful.</li>
	<li>The term-level<a href="https://github.com/elastic/elasticsearch/pull/16211" target="_blank"> fuzzy query is deprecated</a> in favour of the match query with the fuzziness parameter.</li>
	<li>Boolean settings in mappings <a href="https://github.com/elastic/elasticsearch/pull/16146" target="_blank">are now strict</a>.</li>
	<li>The &quot;index&quot; mapping param now <a href="https://github.com/elastic/elasticsearch/pull/16161" target="_blank">accepts only true/false</a>.</li>
	<li>Setting index: false will <a href="https://github.com/elastic/elasticsearch/pull/16141" target="_blank">no longer disable doc values</a> as well.</li>
	<li>Doc values are <a href="https://github.com/elastic/elasticsearch/pull/16147" target="_blank">controlled by the doc_values setting</a> only, not by fielddata_format.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pulls?q=is%3Apr+is%3Aclosed+label%3A%3ASettings+sort%3Aupdated-desc" target="_blank">Many more global settings</a> have been migrated to the new settings infrastructure.</li>
	<li>The new <a href="https://github.com/elastic/elasticsearch/pull/16245" target="_blank">scripting language is called Painless</a>.</li>
	<li><a href="https://github.com/elastic/elasticsearch/pull/16125" target="_blank">Deep pagination</a> is now possible with the search_after parameter.</li>
	<li>The ingest node should make <a href="https://github.com/elastic/elasticsearch/pull/16248" target="_blank">deep copies</a> of data structures.</li>
	<li>Disabled the ability to <a href="https://github.com/elastic/elasticsearch/pull/16257" target="_blank">fsync on every operation</a> (instead of every request) and only schedule fsync if really needed.</li>
	<li>Shards are marked as <a href="https://github.com/elastic/elasticsearch/pull/16250" target="_blank">active during recovery</a>, to ensure the indexing buffer is big enough.</li>
	<li>TermVector APIs no longer <a href="https://github.com/elastic/elasticsearch/pull/16285" target="_blank">update mappings</a>.</li>
	<li>Tracking of parent tasks now include <a href="https://github.com/elastic/elasticsearch/pull/15931" target="_blank">master node, replication, and broadcast actions</a>.</li>
	<li>Load average info has been <a href="https://github.com/elastic/elasticsearch/pull/16061" target="_blank">normalised across different OSes</a>.</li>
	<li>Improve <a href="https://github.com/elastic/elasticsearch/pull/16276" target="_blank">exceptions from ingest pipelines</a>.</li>
	<li>Ensure all <a href="https://github.com/elastic/elasticsearch/pull/16316" target="_blank">resources are closed</a> when closing a node.</li>
</ul><p><strong>Ongoing:</strong>
</p><ul>
	<li>Work has started on using <a href="https://github.com/elastic/elasticsearch/pull/16217" target="_blank">UUIDs to identify indices</a> on the file system, rather than relying just on index names.</li>
	<li>The reindex API is starting <a href="https://github.com/elastic/elasticsearch/pull/16100" target="_blank">to use the task management framework</a>.</li>
	<li>Search refactoring continues with the suggesters and sorting. A design bug in aggs refactoring (creating one instance per node instead of per shard) will require quite a big change.</li>
	<li>Updating mappings with <a href="https://github.com/elastic/elasticsearch/pull/16264" target="_blank">update_all_types </a>isn&apos;t working correctly.</li>
</ul><h2>Apache Lucene</h2><div>
	<ul>
		<li>We plan to&#xA0;<a href="http://markmail.org/message/7ujfy4curzdrmp4t">do a 5.5.0 release soon</a>, to get all backported 5.x features out to the world, and to also debug the release process with git, and then get 6.0.0 release started&#xA0;</li>
		<li>Java 9&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6989">changes the API for un-mapping previously memory mapped pages</a>, but users still risk a SIGSEGV when they try to use an&#xA0;<code>IndexReader</code>&#xA0;after it&apos;s closed&#xA0;</li>
		<li>The&#xA0;<a href="https://github.com/apache/lucene-solr/commit/55005f0a7dc46aef23cd46bb56d8693666f6a1b0">switch from subversion to git</a>&#xA0;has a long wiggling tail: lots of&#xA0;<a href="https://github.com/apache/lucene-solr/commit/9f0e2cc83f6e319142a3cc343ea421ab34040d65">build</a>&#xA0;<a href="https://github.com/apache/lucene-solr/commit/b18d2b333035245cd9edac55d4ca5e6b5b0759e6">fixes</a>, including&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6995">detecting if you changed git branches</a>&#xA0;and forcing a clean build if so to prevent scary looking false test failures;&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-7001">our developer resources page now reflects the switch</a>; we&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6985">share notes on what long series of git commands seem to work</a>; we fixed our shadow maven build&#xA0;<a href="https://github.com/apache/lucene-solr/commit/7f41c65ae994d3962de6a2abf4e82e54e4b80502">to also switch from subversion to git</a>; and&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6998?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&amp;focusedCommentId=15121901#comment-15121901">we discuss the joy of merge bubbles</a>&#xA0;</li>
		<li>800+ new top-level-domains have been created since&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6993">we last fixed&#xA0;<code>StandardTokenizer</code>&#xA0;to detect them</a>!&#xA0;</li>
		<li><a href="https://issues.apache.org/jira/browse/LUCENE-7000">Improved</a>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6998">test</a>&#xA0;<a href="https://github.com/apache/lucene-solr/commit/da5cc3cad56c97d203d9f1ffe267e24ce615766b">coverage</a>&#xA0;for the new point values (coming soon in Lucene 6.0.0)&#xA0;<a href="https://github.com/apache/lucene-solr/commit/c403083872408b6f70f10b999fc2ae706804a672">has</a>&#xA0;<a href="https://github.com/apache/lucene-solr/commit/ddbf3a21687249f3e8481f80839052ad0b8f746b">uncovered</a>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6999">missing heroics in its exception handling</a>&#xA0;</li>
		<li>The new postings-based geo queries&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6997">are ready to graduate out of the sandbox module, which provides no backwards compatibility</a>&#xA0;</li>
		<li>The new divergence from independence similarity&#xA0;<a href="https://github.com/apache/lucene-solr/commit/283d9bb4b7aaaae02ebd285566bdc59dd3950cac">continues to</a>&#xA0;<a href="https://github.com/apache/lucene-solr/commit/bf00c961a26c2cdd0f5f34a1c9f145d89fa489e0">wreak havoc</a>&#xA0;<a href="https://github.com/apache/lucene-solr/commit/6ba91648376fcd6c7cda521915800d8b9c9b8df5">on tests</a>&#xA0;</li>
		<li>Add a&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6956">more accurate &quot;does polygon intersect rectangle&quot; method</a>&#xA0;to fix recent test failures uncovered by randomized geo tests&#xA0;</li>
		<li>Improve geo tests&#xA0;<a href="https://github.com/apache/lucene-solr/commit/f31560bd8ee7ac84cc93c3344abf0085d9e142d5">to confirm that the quantized encoding is stable and its error falls within the claimed tolerance</a>&#xA0;</li>
		<li><code>MemoryIndex</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6992">now has sugar methods to directly create a&#xA0;<code>MemoryIndex</code>&#xA0;from a document or fields</a>&#xA0;</li>
		<li>All&#xA0;<code>TermsQuery</code>&#xA0;constructors&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6470">are now efficient, avoiding creating lots of temporary&#xA0;<code>Term</code>&#xA0;objects</a>&#xA0;</li>
		<li><code>IndexableFielid.tokenStream</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6988">no longer throws&#xA0;<code>IOException</code>&#xA0;</a></li>
		<li>Fix the build again&#xA0;<a href="https://github.com/apache/lucene-solr/commit/9d35aafc565a880c5cae7c21fa6c10fbdd0399ec">to detect if running tests incorrectly results in source code changes</a>!&#xA0;</li>
		<li>Scary looking test failures&#xA0;<a href="https://github.com/apache/lucene-solr/commit/74e5f1c6ae45aad2bf2580e10e0712fe35ac0a0b">turned out to just be consumers abusing&#xA0;<code>IndexInput</code>&#xA0;by sharing an instance across threads without cloning first</a>&#xA0;</li>
		<li><code>LuceneTestCase</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6978">now uses standardized language tags</a>&#xA0;to represent the randomized&#xA0;<code>Locale</code>&#xA0;</li>
		<li>Some&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6930">nice performance gains</a>&#xA0;are coming to geo point queries by customizing how terms are created from the geohashes&#xA0;</li>
		<li>The&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6996">points based and postiongs based geo implementations use different encodings with different quantization errors</a>&#xA0;</li>
		<li>The &quot;exotic&quot; rectangles selected by point values (BKD tree)&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6994">still cause problems for the lat/lon 2D geo apis</a>&#xA0;</li>
		<li>The complex&#xA0;<code>WordDelimiterFilter</code>&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6991">sometimes produces incorrect tokens</a>&#xA0;</li>
		<li>Should we&#xA0;<a href="https://issues.apache.org/jira/browse/LUCENE-6990">enable storing a Lucene index in Mongo DB</a>?&#xA0;</li>
	</ul>
</div><h2>Watch This Space</h2><p><a href="https://www.elastic.co/blog/feed">Stay tuned to this blog</a>, where we&apos;ll share more news on the whole Elastic&#xA0;ecosystem including news, learning resources and cool use cases!
</p></body></html>

This Week in Elasticsearch and Apache Lucene - Cluster Cloning in Hosted Elasticsearch

<p>One of the new features in Kibana 4.1 that we are <em>really</em>&nbsp;excited about is field formatters. Field formatters allow you to display your data in Kibana the way you prefer to <em>see</em>&nbsp;it, regardless of how it is actually <em>stored</em>&nbsp;in Elasticsearch. For instance, if you are storing date&nbsp;values in Elasticsearch and&nbsp;would like them to be displayed in&nbsp;mm/dd/yyyy format, you can easily&nbsp;do that now, courtesy of field formatters!
</p>
<p><span></span>Here's how you can start formatting your fields in Kibana :
</p>
<ol>
	<li>Go to the Settings tab.</li>
	<li><span></span>In the left column, click on the index pattern that contains the field you want to format.</li>
	<li><span></span>In the list of fields that shows up, find the field you want to format and click the pencil icon to its right.</li>
	<li><span></span>Choose the format for the field and fill out the form that shows up below.</li>
</ol>
<p>Watch the following short screencast as it walks through the steps listed above. In this example, a field with a raw number value representing bytes of some data is being formatted using the Bytes field formatter:<br>
</p>
<div class="video embed-container" style="height: 319.725px;">
	<img style="width: 100%; margin: auto; display: block;" class="vidyard-player-embed" src="https://play.vidyard.com/BAY6XEY7hu5uHGnwb9VLUB.jpg" data-uuid="BAY6XEY7hu5uHGnwb9VLUB" data-v="4" data-type="inline">
</div>
<p><br>
</p>
<p>But field formatters can be used for more than formatting bytes values. You can create links, insert images (see screenshot below), and much more.<br><br>Here is an example of using&nbsp;http status cats to represent the HTTP status codes from the log files:<br>
</p>
<p><a href="https://api.contentstack.io/v2/assets/575e4c8243e9adc538713933/download?uid=bltb735fbc36c76a187?uid=bltb735fbc36c76a187" target="_blank"><img src="https://api.contentstack.io/v2/assets/575e4c8243e9adc538713933/download?uid=bltb735fbc36c76a187?uid=bltb735fbc36c76a187" data-sys-asset-uid="blte6dd3c3f9e91b05a" alt="" style="width: 707px; height: 275px;"></a>
</p>
<p>And here's what it ends up looking like:<br>
</p>
<p><a href="https://api.contentstack.io/v2/assets/575e4c839985d58976376889/download?uid=blt7dcd8dbe3aff8868?uid=blt7dcd8dbe3aff8868" target="_blank"><img src="https://api.contentstack.io/v2/assets/575e4c839985d58976376889/download?uid=blt7dcd8dbe3aff8868?uid=blt7dcd8dbe3aff8868" data-sys-asset-uid="bltf6f22967e17a5f50" alt="" style="width: 707px; height: 536.231833910035px;"></a>
</p>
<p>Go ahead.&nbsp;Give it a whirl.
</p>
<p><br>
</p>

Field Formatters in Kibana 4.1

<html><head></head><body><p><img src="https://api.contentstack.io/v2/assets/575e4c740342dfd738262c95/download?uid=blt717ba7f6313c4218?uid=blt717ba7f6313c4218" data-sys-asset-uid="blt6704c5b4843bee8c" style="float:right; margin:4px 5px;"><em>UPDATE September 21, 2015: This blog post was updated to reflect the new settings in elasticsearch.yml. These settings were supported starting with Elasticsearch 1.5 and the old settings were deprecated at that time. Starting with Elasticsearch 2.0, only the new settings will be supported.</em></p><p>In cloud environments like Azure, multicast is often (always?) forbidden. So you need to provide a list of nodes to help Elasticsearch to discover the nodes of the cluster. Starting new instances could be then tricky as you have to maintain a minimal list of nodes.
</p><p>And what happens when a virtual machine goes down? When it comes back up, it could have a new IP address. So you need to edit unicast settings for each node, right?
</p><p>We are pleased to announce the first release of <a href="https://github.com/elasticsearch/elasticsearch-cloud-azure/">Azure cloud plugin for elasticsearch</a>. This first release uses the Azure API for the unicast discovery mechanism and simplifies your cluster growth management a lot.
</p><h1>Azure Virtual Machine Discovery</h1><p>Azure plugin uses <a href="http://msdn.microsoft.com/en-us/library/windowsazure/ee460799.aspx">Azure REST API</a> to perform automatic discovery, which is similar to multicast discovery in multicast-friendly environments. You just have to:
</p><ul>
	<li>Create Azure instances (VMs)</li>
	<li>Install Elasticsearch</li>
	<li>Install Azure cloud plugin</li>
	<li>Modify <code>elasticsearch.yml</code> file and define Azure cloud settings (Azure API key, subscription ID and service name)</li>
	<li>Start Elasticsearch</li>
</ul><p>And&#x2026; You&apos;re done!
</p><h1>Want More Details?</h1><p>Suppose that you want to build an Ubuntu 13 virtual machine running Elasticsearch.  Let&apos;s say that you already have an <a href="http://www.windowsazure.com/">Azure account</a> with your <a href="http://www.windowsazure.com/en-us/manage/linux/how-to-guides/ssh-into-linux/">ssh keys</a> already defined and uploaded to Azure, that you have installed <a href="http://www.windowsazure.com/en-us/develop/nodejs/how-to-guides/command-line-tools/">Windows Azure Command-Line Tool</a>, that you have a <a href="http://www.windowsazure.com/en-us/develop/net/how-to-guides/blob-storage/#create-account">storage account</a> ready to use.
</p><pre class="prettyprint lang-bash noescape"># You first need to generate a java keystore (azurekeystore.pkcs12) 
# from your existing ssh key (azure-private.key) and certificate (azure-certificate.pem)
openssl x509 -outform der -in azure-certificate.pem -out azure-certificate.cer
openssl pkcs8 -topk8 -nocrypt -in azure-private.key -inform PEM -out azure-pk.pem -outform PEM
openssl x509 -inform der -in azure-certificate.cer -out azure-cert.pem
cat azure-cert.pem azure-pk.pem &gt; azure.pem.txt
openssl pkcs12 -export -in azure.pem.txt -out azurekeystore.pkcs12 -name azure -noiter -nomaciter
# Deploy an Ubuntu image on an extra small instance in West Europe:
azure vm create azure-elasticsearch-cluster \
  b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-13_10-amd64-server-20130808-alpha3-en-us-30GB \
  --vm-name myesnode1 \
  --location &quot;West Europe&quot; \
  --vm-size extrasmall \
  --ssh 22 \
  --ssh-cert /tmp/azure-certificate.pem \
  elasticsearch password1234!!
# &quot;elasticsearch/password1234!!&quot; are the SSH login/password for this instance.
# Connect to your instance when started
# SSH settings for convenience
HOST=myescluster.cloudapp.net
SSH_OPTIONS=&quot;-o User=elasticsearch -o IdentityFile=/tmp/azure-private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null&quot;
# Copy your keystore to the VM
scp $SSH_OPTIONS /tmp/azurekeystore.pkcs12 $HOST:/home/elasticsearch
# Connect to the VM
ssh $SSH_OPTIONS $HOST
</pre><p>Install either the latest OpenJDK using <code>sudo apt-get install openjdk-7-jre-headless</code> or <a href="http://www.webupd8.org/2012/01/install-oracle-java-jdk-7-in-ubuntu-via.html">Oracle JDK</a> and then install Elasticsearch and its Azure cloud plugin:
</p><pre class="prettyprint lang-bash noescape">curl -s https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-0.90.10.deb \
  -o elasticsearch-0.90.10.deb
sudo dpkg -i elasticsearch-0.90.10.deb
sudo /usr/share/elasticsearch/bin/plugin -install \ 
  elasticsearch/elasticsearch-cloud-azure/1.0.0.alpha1
</pre><p>Edit <code>/etc/elasticsearch/elasticsearch.yml</code> and add:
</p><pre class="prettyprint lang-yaml noescape">cloud.azure.management:
   subscription.id: your_azure_subscription_id
   cloud.service.name: your_azure_cloud_service_name
   keystore:
      path: /home/elasticsearch/azurekeystore.pkcs12
      password: your_password_for_keystore

discovery:
  type: azure
</pre><p>Restart Elasticsearch and you&apos;re done! Now this instance uses the Azure API to get a list of available nodes.
</p><pre class="prettyprint lang-bash noescape">sudo service elasticsearch restart
</pre><h1>Scaling Out!</h1><p>Hey! But we have started only one node! It&apos;s not really a cluster, right? Let&apos;s scale out and bring more nodes to the party!
</p><pre class="prettyprint lang-bash noescape"># From your local machine, shutdown azure node and create an image:
azure vm shutdown myesnode1
azure vm capture myesnode1 esnode-image --delete
# Start 10 instances:
for x in $(seq 1 10)
    do
        echo &quot;Launching azure instance #$x...&quot;
        azure vm create azure-elasticsearch-cluster \
                        esnode-image \
                        --vm-name myesnode$x \
                        --vm-size extrasmall \
                        --ssh $((21 + $x)) \
                        --ssh-cert /tmp/azure-certificate.pem \
                        --connect \
                        elasticsearch password1234!!
    done
</pre><p>You should now have a cluster running with 10 nodes!
</p><h1>What&apos;s Next?</h1><p>First, we love to hear feedback from our community! Feel free to ask questions on the <a href="https://groups.google.com/forum/?fromgroups#!forum/elasticsearch">mailing list</a> and raise issues or ask for feature requests on <a href="https://github.com/elasticsearch/elasticsearch-cloud-azure/issues">GitHub</a>. Pull requests are warmly welcomed too!
</p><p>We plan to add a blog post on how to use it with Microsoft Windows virtual machines.
</p><p>Also, Elasticsearch 1.0 comes with the great <a href="/guide/en/elasticsearch/reference/master/modules-snapshots.html">Snapshot and Restore</a> feature.  This basically means that we will provide new capabilities to use <a href="http://www.windowsazure.com/en-us/develop/net/how-to-guides/blob-storage/#create-account">Azure Blob Storage</a> for snapshots.
</p><p>Stay tuned!
</p></body></html>

Azure Cloud Plugin for Elasticsearch

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Shaunak Kashyap

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Communication Preferences - ONLY for /communication-preferences

<p>提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/elastic-cloud-account-terms" target="_self">服务条款</a>，并且您同意通过您提供的上述联系方式接收<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">所选的通信</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。</p>

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Serverless GDPR Text

<p>提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/serverless-preview-terms" target="_self">服务条款</a>，并且 Elastic 可以使用您提供的上述详细信息与您联系，以向您介绍我们相关的<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">产品和服务</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。</p>

<p>By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.</p>

Cloud Trial GDPR Text

<p>提交即表示您同意 <a href="/cn/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud 服务条款</a>。我们将会按照 <a href="/cn/legal/privacy-statement">Elastic 的隐私声明</a>处理您的个人数据。
</p>

<p>By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.</p>

Newsletter GDPR Text

<p>提交即表示您确认您已阅读并同意我们的<a href="/cn/legal/terms-of-use" target="_self">服务条款</a>，并且 Elastic 可以使用您提供的上述详细信息与您联系，以向您介绍我们相关的<a href="/cn/legal/privacy-statement#how-we-use-the-information" target="_self">产品和服务</a>。如需了解更多信息，或想随时取消订阅，请参阅 <a href="/cn/legal/privacy-statement/" target="_self">Elastic 的隐私声明</a>。</p>

Explore similar demos

Overview

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

The content on this page is not available in the selected language.

本页内容尚不支持所选语言。Elastic 正在不断努力，以实现对多种语言内容的支持。感谢您在此期间给予的耐心与陪伴！

Author

Articles by

Learn more

Watch now (no PT)

Watch now

See all top stories

All (no PT translation)

Contact information

Press Release

Share on Reddit

Share this story

Share by Email

Thank you for your interest!

Contact Info

Follow us on Youtube

Load More

Share on LinkedIn

Follow us on LinkedIn

Search Integrations

All Solutions

Video for

Follow us on Twitter

See when this webinar starts in my time zone

查看本次网络研讨会在我的时区的开始时间

Register to Watch

Register now

See All Posts

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

无法实时参加？注册后我们会给您发送录像。您还将收到相关内容的电子邮件。

Author

Articles by Shaunak Kashyap

Indexing Elasticsearch Audit Logs with Filebeat

You know, for visualizing your Logstash pipelines

Kibana under the hood: object persistence

This Week in Elasticsearch and Apache Lucene - Query Profiler and Geopoint Fields

This Week in Elasticsearch and Apache Lucene - Cluster Cloning in Hosted Elasticsearch

Field Formatters in Kibana 4.1

Azure Cloud Plugin for Elasticsearch

Sign up for Elastic Cloud free trial