# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1083 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1084 --- ## [Kibana vega context and timefield](https://discuss.elastic.co/t/kibana-vega-context-and-timefield/295102)
**Author:** [@Tingda\_Du](https://discuss.elastic.co/u/Tingda_Du)\ **Replies:** 8\ **Last updated:** [January 23, 2022, 5:09pm UTC](https://discuss.elastic.co/t/kibana-vega-context-and-timefield/295102 "2022-01-23T17:09:05Z")
When I include the lines of // Apply dashboard context filters when set %context%: true // Filter the time picker (upper right corner) with this field %timefield%: @timestamp I got this error: \* Infinite extent for fi… --- ## [How to different syslog in the same port?](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134)
**Author:** [@baalchina](https://discuss.elastic.co/u/baalchina)\ **Replies:** 6\ **Last updated:** [January 23, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-different-syslog-in-the-same-port/295134 "2022-01-23T15:22:24Z")
Hi all, I have many network devices, I forward their syslog to a logstash server, and then to elastisearch. In logstash, I start many ports, such 514,515,516... and each port to different log types, and when output to e… --- ## [Logstash Aggregate Problem tag in subdirectories Please Help](https://discuss.elastic.co/t/logstash-aggregate-problem-tag-in-subdirectories-please-help/295116)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 7\ **Last updated:** [January 23, 2022, 3:20pm UTC](https://discuss.elastic.co/t/logstash-aggregate-problem-tag-in-subdirectories-please-help/295116 "2022-01-23T15:20:04Z")
Hi i trying to use logstash aggregate to tag all log events i main and sub folders. I want all logs in APP1 folders and subfolders to have tag "APP1" and all logs in app2 folders to have APP2 etc. My friend did some ki… --- ## [Filter to remember field accross lines with between start and stop tag](https://discuss.elastic.co/t/filter-to-remember-field-accross-lines-with-between-start-and-stop-tag/295147)
**Author:** [@melorium](https://discuss.elastic.co/u/melorium)\ **Replies:** 3\ **Last updated:** [January 23, 2022, 2:41pm UTC](https://discuss.elastic.co/t/filter-to-remember-field-accross-lines-with-between-start-and-stop-tag/295147 "2022-01-23T14:41:07Z")
Hi. I have a log with a s tart and stop tag. 2021-12-30 13:15:08.614 +0100 \[AWT-EventQueue-0\] 51818 INFO com.nuix.data.keystore.b - Read 0 passwords from C:\\CASE\\Test Log 1-1\\Stores\\DecryptionKeys\\pgpkeylist.dat This… --- ## [UnexpectedElasticsearchClientException](https://discuss.elastic.co/t/unexpectedelasticsearchclientexception/294794)
**Author:** [@Katgust](https://discuss.elastic.co/u/Katgust)\ **Replies:** 1\ **Last updated:** [January 23, 2022, 10:42am UTC](https://discuss.elastic.co/t/unexpectedelasticsearchclientexception/294794 "2022-01-23T10:42:22Z")
Im getting the following error Elasticsearch.Net.UnexpectedElasticsearchClientException: Message: expected:'{', actual:'" "', at offset:390 I understand the reason why but I'm not sure if it's solvable. Im trying to g… --- ## [Cant get grok working with nginx log](https://discuss.elastic.co/t/cant-get-grok-working-with-nginx-log/293061)
**Author:** [@Constantine](https://discuss.elastic.co/u/Constantine)\ **Replies:** 5\ **Last updated:** [December 29, 2021, 12:59pm UTC](https://discuss.elastic.co/t/cant-get-grok-working-with-nginx-log/293061 "2021-12-29T12:59:55Z")
Hi, Can someone help me with nginx logs please. I have full nginx log: 2021-12-28T17:00:34+00:00 site="demo" server="demotest" dest\_port="443" dest\_ip="172.19.0.3" src="172.31.27.65" src\_ip="172.31.27.65" user="-" tim… --- ## [Data to large](https://discuss.elastic.co/t/data-to-large/295133)
**Author:** [@eden\_shirazi](https://discuss.elastic.co/u/eden_shirazi)\ **Replies:** 1\ **Last updated:** [January 23, 2022, 8:36am UTC](https://discuss.elastic.co/t/data-to-large/295133 "2022-01-23T08:36:05Z")
Hi, I have Elasticsearch cluster version 5.1.2 on windows 2012 r2 server. One of the servers in the cluster having an issue that I don't know how to solve... (i'm new at the elastic) In the log file it seems like that… --- ## [Date field shows different values](https://discuss.elastic.co/t/date-field-shows-different-values/294788)
**Author:** [@Aviel\_Bashari](https://discuss.elastic.co/u/Aviel_Bashari)\ **Replies:** 2\ **Last updated:** [January 23, 2022, 7:08am UTC](https://discuss.elastic.co/t/date-field-shows-different-values/294788 "2022-01-23T07:08:22Z")
Hi, i have a python script that converts CSV files into ndjson files, add a date custom field with iso format and pushes to elk using the 'Elasticsearch' package. I'm having an issue with the values shows in the Kibana… --- ## [Intermittent issues with Elasticsearch. Where do I even start?](https://discuss.elastic.co/t/intermittent-issues-with-elasticsearch-where-do-i-even-start/295064)
**Author:** [@Henrik41](https://discuss.elastic.co/u/Henrik41)\ **Replies:** 5\ **Last updated:** [January 23, 2022, 6:18am UTC](https://discuss.elastic.co/t/intermittent-issues-with-elasticsearch-where-do-i-even-start/295064 "2022-01-23T06:18:27Z")
Using Magento 2.3.4 Elasticsearch 7.16.3 java 1.8.0\_312 I installed it on Ubuntu 20.04 with 2cpu and 2g RAM. /etc/default/Elasticsearch ES\_HEAP\_SIZE=1g ES\_STARTUP\_SLEEP\_TIME=5 MAX\_OPEN\_FILES=65535 MAX\_LOCKED\_MEM… --- ## [About Comments within Logstash Plugin Config](https://discuss.elastic.co/t/about-comments-within-logstash-plugin-config/295120)
**Author:** [@usb](https://discuss.elastic.co/u/usb)\ **Replies:** 2\ **Last updated:** [January 23, 2022, 4:34am UTC](https://discuss.elastic.co/t/about-comments-within-logstash-plugin-config/295120 "2022-01-23T04:34:53Z")
Hi everyone. Recently, I am trying to add more comments to my Logstash pipeline config so that it is more understandable. However, I found that it seems comments cannot be added in-between lines of a plugin config. For … --- ## [How to keep 3 numbers for all shards？](https://discuss.elastic.co/t/how-to-keep-3-numbers-for-all-shards/295125)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 1\ **Last updated:** [January 23, 2022, 3:26am UTC](https://discuss.elastic.co/t/how-to-keep-3-numbers-for-all-shards/295125 "2022-01-23T03:26:01Z")
I have three nodes, and I want to maintain 3 primary shards and 1 replica for each index on the cluster. I know that I can specify a template by setting a template and logstash output, but is there a way to do it once an… --- ## [Kibana is not ready yet error after v7.16.2 Upgrade](https://discuss.elastic.co/t/kibana-is-not-ready-yet-error-after-v7-16-2-upgrade/293652)
**Author:** [@vincpas](https://discuss.elastic.co/u/vincpas)\ **Replies:** 5\ **Last updated:** [January 22, 2022, 9:15pm UTC](https://discuss.elastic.co/t/kibana-is-not-ready-yet-error-after-v7-16-2-upgrade/293652 "2022-01-22T21:15:02Z")
I have completed upgrading Elasticsearch cluster from 7.10.2 to 7.16.2. After completing Kibana upgrade from 7.10.2 to 7.16.2, I am now getting Kibana is not ready yet error. I verified the Elasticsearch cluster is in go… --- ## [What is Auditbeat audit syntax to exclude a process or path?](https://discuss.elastic.co/t/what-is-auditbeat-audit-syntax-to-exclude-a-process-or-path/295117)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 1\ **Last updated:** [January 22, 2022, 7:54pm UTC](https://discuss.elastic.co/t/what-is-auditbeat-audit-syntax-to-exclude-a-process-or-path/295117 "2022-01-22T19:54:56Z")
I have Auditbeat running with a bunch of CIS benchmark proposed auditd rules. One of my processes generates a bunch of false positive "time change" logs that I would like to filter out. audit: type=1300 audit(1642859012.… --- ## [Kibana shows indices in gb size!](https://discuss.elastic.co/t/kibana-shows-indices-in-gb-size/295042)
**Author:** [@Akanksha\_Pandey](https://discuss.elastic.co/u/Akanksha_Pandey)\ **Replies:** 8\ **Last updated:** [January 22, 2022, 2:10pm UTC](https://discuss.elastic.co/t/kibana-shows-indices-in-gb-size/295042 "2022-01-22T14:10:29Z")
Hi, My Elasticsearch version 7.9.2. I'm using Filebeat to ship logs directly to Elasticsearch. All the services are running as docker container- Elasticsearch, Filebeat, Kibana The issue is- some of the Kibana indices… --- ## [Avoid exclamation error on Canvas Visual Element when row is zero](https://discuss.elastic.co/t/avoid-exclamation-error-on-canvas-visual-element-when-row-is-zero/295105)
**Author:** [@zx8086](https://discuss.elastic.co/u/zx8086)\ **Replies:** 2\ **Last updated:** [January 22, 2022, 11:31am UTC](https://discuss.elastic.co/t/avoid-exclamation-error-on-canvas-visual-element-when-row-is-zero/295105 "2022-01-22T11:31:29Z")
Hi Guys, I have a DropDownFilter controlling two sets of Gauges for two sets of data. At times the filter would not return any data and i get an error - Empty Table. Is there a way to handle this failure in a nice way… --- ## [\_dateparsefailure](https://discuss.elastic.co/t/dateparsefailure/294997)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 9\ **Last updated:** [January 22, 2022, 10:22am UTC](https://discuss.elastic.co/t/dateparsefailure/294997 "2022-01-22T10:22:20Z")
So I don't know why I got the so kind error : \_dateparsefailure below You can find one of data input |date|time|millisecond| |18.11.2021|09:29:15|257| code: ruby { code =\> " event\_millisecond = ('000' + eve… --- ## [How to get the hapi server object in the latest version](https://discuss.elastic.co/t/how-to-get-the-hapi-server-object-in-the-latest-version/294905)
**Author:** [@qixian](https://discuss.elastic.co/u/qixian)\ **Replies:** 4\ **Last updated:** [January 22, 2022, 9:32am UTC](https://discuss.elastic.co/t/how-to-get-the-hapi-server-object-in-the-latest-version/294905 "2022-01-22T09:32:04Z")
At the kibana 6.4,when i develop the custom plugin,I can use the hapi server object like this , but at the latest kibana version,how can i get the hapi server object ?Do I need to pull in the http\_server.js? --- ## [Some words are not searched by elasticsearch](https://discuss.elastic.co/t/some-words-are-not-searched-by-elasticsearch/295100)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 4\ **Last updated:** [January 22, 2022, 6:16am UTC](https://discuss.elastic.co/t/some-words-are-not-searched-by-elasticsearch/295100 "2022-01-22T06:16:41Z")
Hello I have noticed that some of the words that the user searches for are not searched by Elasticsearch For example, if the user searches for machine L, Elasticsearch only searches for L and does not search for the wo… --- ## [Which is better in terms of performance? one wildcard or six matches](https://discuss.elastic.co/t/which-is-better-in-terms-of-performance-one-wildcard-or-six-matches/295057)
**Author:** [@Amir\_Faramarzi](https://discuss.elastic.co/u/Amir_Faramarzi)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 1:09pm UTC](https://discuss.elastic.co/t/which-is-better-in-terms-of-performance-one-wildcard-or-six-matches/295057 "2022-01-21T13:09:42Z")
Hello Based on the words searched by the user, I want to prioritize products whose matched words are closer to the beginning of the product name. For example, if we have two products as follows "Samsung mobile phone c… --- ## [How to know user who log into Kibana](https://discuss.elastic.co/t/how-to-know-user-who-log-into-kibana/294568)
**Author:** [@harith](https://discuss.elastic.co/u/harith)\ **Replies:** 2\ **Last updated:** [January 21, 2022, 11:37pm UTC](https://discuss.elastic.co/t/how-to-know-user-who-log-into-kibana/294568 "2022-01-21T23:37:17Z")
Hi guys, I'm new here. Sorry if I'm in wrong category. My question: How can I know user who log into my Kibana? Kibana: Free version 7.4.0 Elasticsearch: Free version 7.4.0 What I've already done: I set \ **Author:** [@adnan-krit](https://discuss.elastic.co/u/adnan-krit)\ **Replies:** 3\ **Last updated:** [January 21, 2022, 10:49pm UTC](https://discuss.elastic.co/t/creating-our-own-kibana-metric-based-upon-the-api-response/294075 "2022-01-21T22:49:53Z") Hi Discussion Team, Is there any way we can create our own metric based on an Elasticsearch API response ? So my use case is, that i want to keep track on rejected requests on my Elasticsearch cluster (i.e, response fr… --- ## [Clicking 1 field but filtering based on other field for drildowns](https://discuss.elastic.co/t/clicking-1-field-but-filtering-based-on-other-field-for-drildowns/294836)
**Author:** [@orhiee](https://discuss.elastic.co/u/orhiee)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 10:08pm UTC](https://discuss.elastic.co/t/clicking-1-field-but-filtering-based-on-other-field-for-drildowns/294836 "2022-01-21T22:08:57Z")
Sorry for the possible confusing title, but here is what I am trying to do: in my dashboard for DNS I have name of the domain and number of hits (ex: elastic.co - 100hits). When I click the (+) on Kibana next to "elast… --- ## [Migration Deprecation for Phantom Index Templates](https://discuss.elastic.co/t/migration-deprecation-for-phantom-index-templates/295096)
**Author:** [@cspencer](https://discuss.elastic.co/u/cspencer)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 8:29pm UTC](https://discuss.elastic.co/t/migration-deprecation-for-phantom-index-templates/295096 "2022-01-21T20:29:54Z")
I just upgraded my Elasticsearch cluster from 7.13.4 to 7.16.3 . After upgrading all nodes in the cluster, I checked the migration deprecations endpoint and found this warning: GET \_migration/deprecations { "cluster\_se… --- ## [How snapshots works when using different Storage Class (GCS)?](https://discuss.elastic.co/t/how-snapshots-works-when-using-different-storage-class-gcs/294753)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 2\ **Last updated:** [January 21, 2022, 8:07pm UTC](https://discuss.elastic.co/t/how-snapshots-works-when-using-different-storage-class-gcs/294753 "2022-01-21T20:07:39Z")
Hello, Currently I'm using snapshot repositories stored in Google Cloud Storage that was created with the standard storage class. Now I have the need to create new snapshots on another Google Cloud project and I was th… --- ## [Limit of total fields \[1000\] in index exceeded](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded/295093)
**Author:** [@galion96](https://discuss.elastic.co/u/galion96)\ **Replies:** 0\ **Last updated:** [January 21, 2022, 6:33pm UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded/295093 "2022-01-21T18:33:11Z")
Hello, I saw that there are some concerns to raising the total limit on fields above 1000. I have a situation where I am not sure how to approach it from the design point of view. I lots simple key value pairs: key1:1… --- ## [Calculation of percentages](https://discuss.elastic.co/t/calculation-of-percentages/295082)
**Author:** [@RaulSan](https://discuss.elastic.co/u/RaulSan)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 6:00pm UTC](https://discuss.elastic.co/t/calculation-of-percentages/295082 "2022-01-21T18:00:08Z")
Hello! I am somewhat of a newbie to Kibana. I'm not sure how to calculate percentages. I tell you my problem with a simple example. I have candies of different flavors bought in different stores. I have already eaten … --- ## [Querying on multiple flattened sub-fields for an array of items](https://discuss.elastic.co/t/querying-on-multiple-flattened-sub-fields-for-an-array-of-items/294990)
**Author:** [@robert-n-stewart](https://discuss.elastic.co/u/robert-n-stewart)\ **Replies:** 4\ **Last updated:** [January 21, 2022, 5:00pm UTC](https://discuss.elastic.co/t/querying-on-multiple-flattened-sub-fields-for-an-array-of-items/294990 "2022-01-21T17:00:01Z")
If I have a flattened or object field named X, which is an array of objects with subfields A and B, how can I query for an item that has specific values for both A and B? E.g. if I run the following: { "query": { … --- ## [Facing issues in logstash](https://discuss.elastic.co/t/facing-issues-in-logstash/295075)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 4:44pm UTC](https://discuss.elastic.co/t/facing-issues-in-logstash/295075 "2022-01-21T16:44:59Z")
/usr/share/logstash/bin/logstash --config.test\_and\_exit -f nginx.conf --path.settings /etc/logstash -----------------Getting this error when i run the logstash --------------------------------------------- Thread.exclu… --- ## [Logstash 8.0 @timestamp with nanoseconds precision](https://discuss.elastic.co/t/logstash-8-0-timestamp-with-nanoseconds-precision/294910)
**Author:** [@ale\_ve](https://discuss.elastic.co/u/ale_ve)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 4:29pm UTC](https://discuss.elastic.co/t/logstash-8-0-timestamp-with-nanoseconds-precision/294910 "2022-01-21T16:29:01Z")
Hi, I'd need help to understand how to set the @timestamp field with the content of another field that contains date and time with nanoseconds precision. I've tried to use the date match but it's not clear to me which p… --- ## [Metricbeat beat-xpack shows only 1 beat instance per type in Kibana monitoring in custom AWS cluster,](https://discuss.elastic.co/t/metricbeat-beat-xpack-shows-only-1-beat-instance-per-type-in-kibana-monitoring-in-custom-aws-cluster/295072)
**Author:** [@ronaldkonjer](https://discuss.elastic.co/u/ronaldkonjer)\ **Replies:** 1\ **Last updated:** [January 21, 2022, 3:44pm UTC](https://discuss.elastic.co/t/metricbeat-beat-xpack-shows-only-1-beat-instance-per-type-in-kibana-monitoring-in-custom-aws-cluster/295072 "2022-01-21T15:44:24Z")
I'm trying to configure my logging cluster using metricbeat with the following modules: Enabled: elasticsearch-xpack kibana-xpack logstash-xpack beat-xpack system whereas my metricbeat config looks like this: # A… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1082) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1084)