You can’t use the quick sort feature on your fields/colums cs it’s disabled/greyed out? Most likely you did add your documents to your index without doing explicit mapping on index creation. Of course it’s possible to drop your data into the index without defining an explicit mappin, but the quick sort option will be disabled […]
Install maildir-utils and use to parse the files and write a json. Use to eliminate bad characters who do not fit into your charset. Some (windows) mail clients (outlook?) put an CRLF at the end of to, cc, bcc or subject , so do something like an Elasticsearch will not accept json files encapsulated in […]
i.e. from encoded mailheaders (=?UTF-8?Q?Thomas_Gr=c3=a4fner?=) or simply use the qprint command
Set ulimit -n: Edit /etc/profile and add ulimit -n 65535 Disable swapping by removing all swap lines from your fstab. As an alternative add the following line to your elasticsearch.yml: bootstrap.memory_lock: true Then test it using the famous Kibana (DevTools) Console: GET _nodes?filter_path=**.mlockall It should return true. Do not tune the java dns timeouts.
Create a helper table, containing rows md5 hashes: Get a rows hash from your main table you want to watch rows: Write it into your helper table: Now check your main table rows for changed md5’s:
Check C:\Windows\SoftwareDistribution\EventCache.v2. It should be empty. If its filled to the brim with binaries, delete them all. It’s a WSUS server problem, not a client problem. I did a major wsus cleanup and reindexing, these measures were successful. Check my other wsus blogposts.
Execute the follwing SQL statement, ite sets the timeout limit from 600 to 0 (unlimited):