# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1182 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1183 --- ## [Adding new documents to production cluster](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910)
**Author:** [@lacerated](https://discuss.elastic.co/u/lacerated)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:34am UTC](https://discuss.elastic.co/t/adding-new-documents-to-production-cluster/287910 "2021-10-29T00:34:32Z")
I have constantly used Elasticsearch cluster with search queries. Once a week i get a batch of new documents i need to add to index. If i add them to index it will greatly slower search speeds while indexing and merging … --- ## [Get log not in right time](https://discuss.elastic.co/t/get-log-not-in-right-time/287916)
**Author:** [@quyennguyen](https://discuss.elastic.co/u/quyennguyen)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/get-log-not-in-right-time/287916 "2021-10-29T00:32:38Z")
I got log of Apache (access.log). But I never get it at the right time. Example like this pic. The time in the Elastic with the time in Apache server I set up the same timezone. And Apache has log at that time too. W… --- ## [Startup script?](https://discuss.elastic.co/t/startup-script/287923)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [October 29, 2021, 12:32am UTC](https://discuss.elastic.co/t/startup-script/287923 "2021-10-29T00:32:18Z")
Is there some way to create startup scripts? I'm using monstache to connect mongodb and Elasticsearch and I need to add an index template before monstache starts syncing data. --- ## [Sudden High CPU with GC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908)
**Author:** [@nuwancs](https://discuss.elastic.co/u/nuwancs)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:31am UTC](https://discuss.elastic.co/t/sudden-high-cpu-with-gc/287908 "2021-10-29T00:31:42Z")
Hi Team Please refer to the screenshot and we observe high CPU spikes with the GC. Please help us resolve this. ELS v 7.5.2 RAM: Total 32 GB, 16GB allocated to ES It's a 7 node cluster --- ## [Killing pending tasks](https://discuss.elastic.co/t/killing-pending-tasks/287795)
**Author:** [@lucien.guillermin](https://discuss.elastic.co/u/lucien.guillermin)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:29am UTC](https://discuss.elastic.co/t/killing-pending-tasks/287795 "2021-10-29T00:29:33Z")
Hi everyone, We work on an Elasticsearch cluster which seems locked. We found out that we have critical tasks we launched a few days ago : curl -X GET 10.129.28.194:9200/\_cluster/pending\_tasks?pretty { "tasks" : \[ … --- ## [Additing Conditions to API Results](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:28am UTC](https://discuss.elastic.co/t/additing-conditions-to-api-results/287594 "2021-10-29T00:28:15Z")
I was wondering if there is any way to filter API results in Dev Tools to show conditions. For example, instead of this: GET \_cat/shards?v=true&h=index,shard,prirep,state,docs,store,node,segments.count,unassigned.detail… --- ## [Api\_key does not work behind reverse ssl proxy](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945)
**Author:** [@gkiesecker](https://discuss.elastic.co/u/gkiesecker)\ **Replies:** 3\ **Last updated:** [October 29, 2021, 12:08am UTC](https://discuss.elastic.co/t/api-key-does-not-work-behind-reverse-ssl-proxy/287945 "2021-10-29T00:08:08Z")
This is my first time using ELK stack, and I have found it very useful. I wanted to deploy it behind a reverse ssl proxy using nginx, and have most of the features working fine. However, I am unable to get the xpack.sec… --- ## [ADVICE For loadbalance](https://discuss.elastic.co/t/advice-for-loadbalance/287957)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 10:24pm UTC](https://discuss.elastic.co/t/advice-for-loadbalance/287957 "2021-10-28T22:24:35Z")
Hello there , I will get syslog messages from firewall devices and send them to kafka as a producer. Because there may be several consumers which will consume events so they may be on different offsets. Now my questio… --- ## [Update the value of a field in index based on its value in another index](https://discuss.elastic.co/t/update-the-value-of-a-field-in-index-based-on-its-value-in-another-index/287952)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 2\ **Last updated:** [October 28, 2021, 9:38pm UTC](https://discuss.elastic.co/t/update-the-value-of-a-field-in-index-based-on-its-value-in-another-index/287952 "2021-10-28T21:38:57Z")
There's an index\_A that contains say about 10K docs. It has many fields like field\_1, field\_2, ...field\_n and one of the fields is product\_name. Then there's another index\_B that contains about 10 docs only and is a mas… --- ## [Watcher Timezone problem in email body](https://discuss.elastic.co/t/watcher-timezone-problem-in-email-body/285957)
**Author:** [@Tombal](https://discuss.elastic.co/u/Tombal)\ **Replies:** 2\ **Last updated:** [October 28, 2021, 7:39pm UTC](https://discuss.elastic.co/t/watcher-timezone-problem-in-email-body/285957 "2021-10-28T19:39:57Z")
Hello , Not a pro of painless language but while my ml job is working fine. It seems like timezone is GMT not GMT+3 in my mail body. "subject": "Apigw ML Time Alerts...", "body": { "html": "\\n \\n \\n Elasti… --- ## [Create a preview with a media between events](https://discuss.elastic.co/t/create-a-preview-with-a-media-between-events/287013)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [October 28, 2021, 7:04pm UTC](https://discuss.elastic.co/t/create-a-preview-with-a-media-between-events/287013 "2021-10-28T19:04:08Z")
Good afternoon, I would like to know how to create an average between the events, below is an example: event 1 time =\> 1:00:00 id=\> 1 event 2 time =\> 1:10:00 id=\> 2 event 3 =\> 1:30:00 id=\> 3 event 3 =\> 1:33:00 … --- ## [Can anyone help on nested json parsing with Logstash?](https://discuss.elastic.co/t/can-anyone-help-on-nested-json-parsing-with-logstash/287661)
**Author:** [@dudwell](https://discuss.elastic.co/u/dudwell)\ **Replies:** 10\ **Last updated:** [October 28, 2021, 5:08pm UTC](https://discuss.elastic.co/t/can-anyone-help-on-nested-json-parsing-with-logstash/287661 "2021-10-28T17:08:31Z")
I am currently looking to parse some json records on logstash to then push to opensearch/kibana for analysis. Specifically I hope to pull the "rtt" and associated "instance" value metric from each message body so I can r… --- ## [Numeral Formatting](https://discuss.elastic.co/t/numeral-formatting/287358)
**Author:** [@marcos.freitas](https://discuss.elastic.co/u/marcos.freitas)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 4:55pm UTC](https://discuss.elastic.co/t/numeral-formatting/287358 "2021-10-28T16:55:17Z")
how to add prefix and change separators, example: BRL 10,192.25 / USD 10,000 / BRL 1,000, etc. --- ## [Metric Text Graph to show Graph contents](https://discuss.elastic.co/t/metric-text-graph-to-show-graph-contents/287698)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 6\ **Last updated:** [October 28, 2021, 4:50pm UTC](https://discuss.elastic.co/t/metric-text-graph-to-show-graph-contents/287698 "2021-10-28T16:50:31Z")
Hi I have a metric text graph to show unique user count. I wanted to know who are those unique users. Is it possible? Regards Ram --- ## [Javascript and index templates](https://discuss.elastic.co/t/javascript-and-index-templates/287940)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 4:28pm UTC](https://discuss.elastic.co/t/javascript-and-index-templates/287940 "2021-10-28T16:28:27Z")
I'm trying to create an index template as followed: client.indices.putTemplate({name:"loctmplt", body: { index\_patterns: \['\*'\], template: { mappings: { properties: { location: { propertie… --- ## [How to use last value in a custom visualization?](https://discuss.elastic.co/t/how-to-use-last-value-in-a-custom-visualization/286213)
**Author:** [@Joao\_Silva](https://discuss.elastic.co/u/Joao_Silva)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 3:51pm UTC](https://discuss.elastic.co/t/how-to-use-last-value-in-a-custom-visualization/286213 "2021-10-28T15:51:44Z")
I have been trying to create a custom visualization with vega to display some simple data. In this case, I wanted to display the data from a vehicle where it would show the battery current vs the vehicle speed (I'm start… --- ## [Dynamic range and Histogram function](https://discuss.elastic.co/t/dynamic-range-and-histogram-function/287931)
**Author:** [@kibanauser4](https://discuss.elastic.co/u/kibanauser4)\ **Replies:** 6\ **Last updated:** [October 28, 2021, 3:39pm UTC](https://discuss.elastic.co/t/dynamic-range-and-histogram-function/287931 "2021-10-28T15:39:41Z")
Hi, I'm new to Kibana and this is my first time creating visualizations in Kibana so I need a little help. My dataset is pretty simple and I do not have a timestamp field. One of the fields is "price" and I wanted to cre… --- ## [Struggling to understand OneOfNPrior::addSamples formulae](https://discuss.elastic.co/t/struggling-to-understand-oneofnprior-addsamples-formulae/286929)
**Author:** [@ProfSimoes](https://discuss.elastic.co/u/ProfSimoes)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 2:41pm UTC](https://discuss.elastic.co/t/struggling-to-understand-oneofnprior-addsamples-formulae/286929 "2021-10-28T14:41:29Z")
Hi guys! I've been trying to understand the way One of N Prior (COneOfNPrior::addSamples) deals with model selection. The code documentation does a neat work explaining all the formulae: This means that the joint pos… --- ## [Using where filter with multi values field on data table](https://discuss.elastic.co/t/using-where-filter-with-multi-values-field-on-data-table/285498)
**Author:** [@ishu](https://discuss.elastic.co/u/ishu)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 2:32pm UTC](https://discuss.elastic.co/t/using-where-filter-with-multi-values-field-on-data-table/285498 "2021-10-28T14:32:29Z")
Hello, I used to work on Splunk and working with multi values field, and it's easy break multivalue fields using "stats x by xx" command and perform a where filter after. We considered this log with multi values field … --- ## [Best solution for this case](https://discuss.elastic.co/t/best-solution-for-this-case/287900)
**Author:** [@auto\_reply\_007](https://discuss.elastic.co/u/auto_reply_007)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 2:31pm UTC](https://discuss.elastic.co/t/best-solution-for-this-case/287900 "2021-10-28T14:31:12Z")
I have a cluster consisting of 4 data and 1 master node each node has: cpu: 4 ram: 16 and we have 1 largest index of 215 gigabytes (1 primary and 1 replica shard) on peak days, this index is very heavily loaded (we … --- ## [What role do I enable for kibana dashboard CSV download?](https://discuss.elastic.co/t/what-role-do-i-enable-for-kibana-dashboard-csv-download/286520)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 7\ **Last updated:** [October 28, 2021, 2:17pm UTC](https://discuss.elastic.co/t/what-role-do-i-enable-for-kibana-dashboard-csv-download/286520 "2021-10-28T14:17:26Z")
I have the exact issue as mentioned in this other thread but unfortunately I'm unable to get it working based on the responses provided there. I have a custom role with a "read" access on dashboard. The user is unable t… --- ## [Kibana Data Table Exclude](https://discuss.elastic.co/t/kibana-data-table-exclude/287721)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 1:58pm UTC](https://discuss.elastic.co/t/kibana-data-table-exclude/287721 "2021-10-28T13:58:04Z")
Hi, I am trying to exclude all the items which contain /abr\_live/amlst\* from Kibana data table. It does not work. How can I use wildcard in the Buckets -\> Advanced -\> Exclude? Thanks, --- ## [Not all logs are being sent on ES, requests are timing out](https://discuss.elastic.co/t/not-all-logs-are-being-sent-on-es-requests-are-timing-out/287924)
**Author:** [@anis-eze](https://discuss.elastic.co/u/anis-eze)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 1:51pm UTC](https://discuss.elastic.co/t/not-all-logs-are-being-sent-on-es-requests-are-timing-out/287924 "2021-10-28T13:51:30Z")
Hi All, We have been having issues with there being gaps in Metricbeats being sent to Kibana. When checking the Metricbeat logs, the following errors are displayed: \[2021-10-28T11:42:53,422\]\[INFO \]\[o.e.x.s.a.Authoriza… --- ## [TIMESTAMP behavior is not good](https://discuss.elastic.co/t/timestamp-behavior-is-not-good/287920)
**Author:** [@dasish](https://discuss.elastic.co/u/dasish)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 1:23pm UTC](https://discuss.elastic.co/t/timestamp-behavior-is-not-good/287920 "2021-10-28T13:23:47Z")
logstash is shipping the data for the below query as expected cast(systimestamp at time zone 'UTC' as timestamp ) however cast( CREATION\_TIMESTAMP at time zone 'UTC' as timestamp) is providing additional 2 hour (if yo… --- ## [\[esaggs\] \> error in data table visulisation](https://discuss.elastic.co/t/esaggs-error-in-data-table-visulisation/287917)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 3\ **Last updated:** [October 28, 2021, 1:23pm UTC](https://discuss.elastic.co/t/esaggs-error-in-data-table-visulisation/287917 "2021-10-28T13:23:36Z")
Hi, We have an index with a large amount of data coming through and have created a data table to visualize the data. The data table contains 1 metric and 5 buckets and the size for each bucket has been set to 50,000 to … --- ## [Display percentage bar in Lens](https://discuss.elastic.co/t/display-percentage-bar-in-lens/287907)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 5\ **Last updated:** [October 28, 2021, 1:18pm UTC](https://discuss.elastic.co/t/display-percentage-bar-in-lens/287907 "2021-10-28T13:18:12Z")
Hello everyone, I have a question and I want to know if this is possible. I have a lens visualization I want to display on the vertical axis beside the what is currently is in left, a percentage bar also on vertical axi… --- ## [Performance upgrade in server logs, but degrade in full text search](https://discuss.elastic.co/t/performance-upgrade-in-server-logs-but-degrade-in-full-text-search/287257)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 12:45pm UTC](https://discuss.elastic.co/t/performance-upgrade-in-server-logs-but-degrade-in-full-text-search/287257 "2021-10-28T12:45:45Z")
According to Elasticsearch benchmarks, ES 7.15.0 became slower than ES 6.8.14 in term, pharse, mothly\_agg queris in pmc track, but faster in most of queries (except hourly\_agg) in http logs track. So, which changes of E… --- ## [How do I get rid of the message "Unexpected character ('\]' (code 93)): expected a value"](https://discuss.elastic.co/t/how-do-i-get-rid-of-the-message-unexpected-character-code-93-expected-a-value/287911)
**Author:** [@fribse](https://discuss.elastic.co/u/fribse)\ **Replies:** 0\ **Last updated:** [October 28, 2021, 12:33pm UTC](https://discuss.elastic.co/t/how-do-i-get-rid-of-the-message-unexpected-character-code-93-expected-a-value/287911 "2021-10-28T12:33:06Z")
I can see the error reappearing all the time. Is there a way I can fix this without loosing the indexes? elasticsearch | \[2021-10-28T12:18:59,524\]\[WARN \]\[r.suppressed \] \[es01\] path: /winlog\*/\_search, pa… --- ## [API call to elasticsearch](https://discuss.elastic.co/t/api-call-to-elasticsearch/286980)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 4\ **Last updated:** [October 28, 2021, 12:07pm UTC](https://discuss.elastic.co/t/api-call-to-elasticsearch/286980 "2021-10-28T12:07:40Z")
Hello everyone, I am thinking to something and I am not sure if it is possible and i was thinking you can guide or say if it is possible or not So I want to query directly the Elasticsearch, get the output in csv or w… --- ## [How to disable Kibana Lens Suggestions bar](https://discuss.elastic.co/t/how-to-disable-kibana-lens-suggestions-bar/287902)
**Author:** [@nastymajestic](https://discuss.elastic.co/u/nastymajestic)\ **Replies:** 1\ **Last updated:** [October 28, 2021, 11:07am UTC](https://discuss.elastic.co/t/how-to-disable-kibana-lens-suggestions-bar/287902 "2021-10-28T11:07:04Z")
As a title, how to disable the Suggestions bar in Kibana Lens? I'm working on huge sets of data and the suggestion bar is slowing down the process. Is there a way to disable it? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1181) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1183)