# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1276 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1277 --- ## [Ignore anomalies if the bucket count is lower than some threshold](https://discuss.elastic.co/t/ignore-anomalies-if-the-bucket-count-is-lower-than-some-threshold/281836)
**Author:** [@one](https://discuss.elastic.co/u/one)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 2:41pm UTC](https://discuss.elastic.co/t/ignore-anomalies-if-the-bucket-count-is-lower-than-some-threshold/281836 "2021-08-18T14:41:08Z")
I am investigating anomalies as the mean value of a field over buckets. So far, the results seem to be correct. However, in the domain I am working with, if the number of documents in the buckets is lower than some thres… --- ## [How can I parse 2 log files to 2 index in Kibana](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711)
**Author:** [@MT2021](https://discuss.elastic.co/u/MT2021)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-can-i-parse-2-log-files-to-2-index-in-kibana/281711 "2021-08-18T14:31:10Z")
Hi ELK community, I am a absolutely newbie in the Elasticsearch. I am getting a stuck in creating 2 pipelines towards 2 indexes of 2 log file (2 services in corresponding). My topo likes that: Filebeat ==\> logstash =… --- ## [Complex bucket aggregation](https://discuss.elastic.co/t/complex-bucket-aggregation/281689)
**Author:** [@Tkachleo](https://discuss.elastic.co/u/Tkachleo)\ **Replies:** 3\ **Last updated:** [August 18, 2021, 1:13pm UTC](https://discuss.elastic.co/t/complex-bucket-aggregation/281689 "2021-08-18T13:13:37Z")
Hi, I need some help with a complex aggregation. I have these 3 documents: { "id": 1, "@timestamp": "2021-08-17 12:00:00", "result": "FAIL" }, { "id": 2, "@timestamp": "2021-08-17 12:05:00", "result": "PAS… --- ## [Kibana OIDC Keycloak 401 Unauthorized](https://discuss.elastic.co/t/kibana-oidc-keycloak-401-unauthorized/281739)
**Author:** [@cawwot](https://discuss.elastic.co/u/cawwot)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 12:58pm UTC](https://discuss.elastic.co/t/kibana-oidc-keycloak-401-unauthorized/281739 "2021-08-18T12:58:49Z")
Trying to integrate Keycloak OIDC with Kibana to allow logins from keycloak users. Upon selecting the "login with keycloak" icon, I am correctly redirected to keycloak to login. after entering the credentials of a keyclo… --- ## [Logstash file input not processing (windows)](https://discuss.elastic.co/t/logstash-file-input-not-processing-windows/281720)
**Author:** [@alejandroalv87](https://discuss.elastic.co/u/alejandroalv87)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 12:23pm UTC](https://discuss.elastic.co/t/logstash-file-input-not-processing-windows/281720 "2021-08-18T12:23:43Z")
I am trying to process an apache log file to logstash and file is not getting process. My config file here: input { file { path =\> "C:\\Users\\alejandro.alvarez\\Downloads\\elasticsearch\_kibana\\data\\logs\\apache\_access.lo… --- ## [Use Filebeat for CSV logs?](https://discuss.elastic.co/t/use-filebeat-for-csv-logs/281722)
**Author:** [@ChrisClem1](https://discuss.elastic.co/u/ChrisClem1)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 12:21pm UTC](https://discuss.elastic.co/t/use-filebeat-for-csv-logs/281722 "2021-08-18T12:21:51Z")
I am new to elastic. I have many gigabytes of csv logs that I want to load into elastic. I assume that I use filebeat. What do I need to configure in filebeat apart from the path to the logs (/home/assessor/Desktop/audi… --- ## [Port need to open for filebeat and logstash](https://discuss.elastic.co/t/port-need-to-open-for-filebeat-and-logstash/281762)
**Author:** [@naaviin](https://discuss.elastic.co/u/naaviin)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 10:21am UTC](https://discuss.elastic.co/t/port-need-to-open-for-filebeat-and-logstash/281762 "2021-08-18T10:21:15Z")
Hi friends, I have open using firewalld port 5044 in ELK server. I i open source IP and source Port in ELK server. However i am hitting connection refuse when i telnet to logstash from beats server telnet 192.168.1.101… --- ## [Elasticsearch Net, "all shards failed" when one node is shut down, 7.11.1](https://discuss.elastic.co/t/elasticsearch-net-all-shards-failed-when-one-node-is-shut-down-7-11-1/281712)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 7\ **Last updated:** [August 18, 2021, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-net-all-shards-failed-when-one-node-is-shut-down-7-11-1/281712 "2021-08-18T10:19:08Z")
Hi! I have a three nodes cluster setup on version 7.11.1, with this configuration file: bootstrap.memory\_lock: false cluster.initial\_master\_nodes: - STHLM-04 - STHLM-05 - STHLM-06 cluster.name: ELASTIC-TEST disco… --- ## [API call for ML job Kibana settings](https://discuss.elastic.co/t/api-call-for-ml-job-kibana-settings/281763)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 9:31am UTC](https://discuss.elastic.co/t/api-call-for-ml-job-kibana-settings/281763 "2021-08-18T09:31:24Z")
Hi, I am creating datafeeds and ML jobs via API calls and they are working just fine, but I always have to open Kibana and select Synchronize saved objects if I want them to show up in the UI. Is there a way to do the … --- ## [Avoid logging password when using hint based autodiscover](https://discuss.elastic.co/t/avoid-logging-password-when-using-hint-based-autodiscover/281797)
**Author:** [@Rasmus\_Breinholm\_Rom](https://discuss.elastic.co/u/Rasmus_Breinholm_Rom)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 9:24am UTC](https://discuss.elastic.co/t/avoid-logging-password-when-using-hint-based-autodiscover/281797 "2021-08-18T09:24:49Z")
Hi When using Hint based autodiscover, it is possible to configure usernames and password for modules like MySql using labels on a docker container. The problem with this is that all labels are logged into elasticsearc… --- ## [Trouble with adding and removing indexes using core Kibana Api](https://discuss.elastic.co/t/trouble-with-adding-and-removing-indexes-using-core-kibana-api/274853)
**Author:** [@kibanaPluginDev](https://discuss.elastic.co/u/kibanaPluginDev)\ **Replies:** 7\ **Last updated:** [August 18, 2021, 9:20am UTC](https://discuss.elastic.co/t/trouble-with-adding-and-removing-indexes-using-core-kibana-api/274853 "2021-08-18T09:20:29Z")
We are really facing problems in implementing elasticsearch requests from Kibana Plugin using the core kibana API for elasticsearch? Also referred migration examples and the legacy to new platform migration document. Cou… --- ## [Property totalHits always 0](https://discuss.elastic.co/t/property-totalhits-always-0/281789)
**Author:** [@Christophe\_NOWOSAD](https://discuss.elastic.co/u/Christophe_NOWOSAD)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 9:09am UTC](https://discuss.elastic.co/t/property-totalhits-always-0/281789 "2021-08-18T09:09:09Z")
Hello, I am using Elastic client in our Springboot API (client version 6.5.4). My application is using 2 different indexes, one is on version 6, the second on version 7. For the version 6, everything is working fine, … --- ## [Using Kibana REST API to generate visualization](https://discuss.elastic.co/t/using-kibana-rest-api-to-generate-visualization/281554)
**Author:** [@U2P](https://discuss.elastic.co/u/U2P)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 9:06am UTC](https://discuss.elastic.co/t/using-kibana-rest-api-to-generate-visualization/281554 "2021-08-18T09:06:32Z")
Hello everyone, I'm looking to generate dashboards and visualizations using the Kibana API and run a Python script. I watch a lot of other threads but couldn't find what I needed. The context: A python script parses… --- ## [Having issues translating query dsl to NEST](https://discuss.elastic.co/t/having-issues-translating-query-dsl-to-nest/281585)
**Author:** [@woal\_idal](https://discuss.elastic.co/u/woal_idal)\ **Replies:** 5\ **Last updated:** [August 18, 2021, 9:05am UTC](https://discuss.elastic.co/t/having-issues-translating-query-dsl-to-nest/281585 "2021-08-18T09:05:01Z")
I have a console application that will read the logs from elasticsearch and insert those logs to a database. However I am having an issue with the count api implementation in NEST. Whenever, I type the following in the C… --- ## [Journalbeat and logfiles](https://discuss.elastic.co/t/journalbeat-and-logfiles/281013)
**Author:** [@colttt](https://discuss.elastic.co/u/colttt)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 7:42am UTC](https://discuss.elastic.co/t/journalbeat-and-logfiles/281013 "2021-08-18T07:42:30Z")
Hello short question, is it possible that journalbeat also read normal logfiles (like from nginx/apache) or does it read just journald? And if yes, have I to pay attention to something? thanks in advanced! --- ## [Create a custom ECS settings via github repo](https://discuss.elastic.co/t/create-a-custom-ecs-settings-via-github-repo/280769)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 7:41am UTC](https://discuss.elastic.co/t/create-a-custom-ecs-settings-via-github-repo/280769 "2021-08-18T07:41:41Z")
Hi, I'm trying to generate ecs template with custom settings. For that, I used this repo GitHub - elastic/ecs: Elastic Common Schema. Command used : python scripts/generator.py --template-settings template.json --ref … --- ## [Logstash data unload](https://discuss.elastic.co/t/logstash-data-unload/281506)
**Author:** [@onlinekap](https://discuss.elastic.co/u/onlinekap)\ **Replies:** 8\ **Last updated:** [August 18, 2021, 7:30am UTC](https://discuss.elastic.co/t/logstash-data-unload/281506 "2021-08-18T07:30:17Z")
Hello, I am newbie here.. I have a bunch of ELK indexes that returns below output when querying via POSTMAN GET request. \ { "took": 5, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0… --- ## ["Precomputed hashes" on client side](https://discuss.elastic.co/t/precomputed-hashes-on-client-side/281774)
**Author:** [@jidetashuo](https://discuss.elastic.co/u/jidetashuo)\ **Replies:** 0\ **Last updated:** [August 18, 2021, 6:46am UTC](https://discuss.elastic.co/t/precomputed-hashes-on-client-side/281774 "2021-08-18T06:46:55Z")
I found documentation on "Precomputed hashes" on client side but it does not mention how,how I can generate murmur hash outside of ElasticSearch and later use that to find cardinality --- ## [Elasticsearch Restful API query string](https://discuss.elastic.co/t/elasticsearch-restful-api-query-string/281707)
**Author:** [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Replies:** 1\ **Last updated:** [August 18, 2021, 6:16am UTC](https://discuss.elastic.co/t/elasticsearch-restful-api-query-string/281707 "2021-08-18T06:16:46Z")
The query String in Kibana is : system:APC AND host: F12\*R2R\* AND message:"Turn to Phase \[F12P7\]" , and I want to query through Restful API like below: String bodycontent="{" +" \\"\_source\\": \[\\"@timest… --- ## [Kibana Timestamp](https://discuss.elastic.co/t/kibana-timestamp/281761)
**Author:** [@irfanifse](https://discuss.elastic.co/u/irfanifse)\ **Replies:** 2\ **Last updated:** [August 18, 2021, 4:08am UTC](https://discuss.elastic.co/t/kibana-timestamp/281761 "2021-08-18T04:08:05Z")
Hi, I have requirement on Timestamp Time range calculation for particular hours Eg: if a document comes to kibana at 9AM i need to find how many document came from that time and waiting for further process from respect… --- ## [Secondary rollup of existing rollup index](https://discuss.elastic.co/t/secondary-rollup-of-existing-rollup-index/281706)
**Author:** [@pavan\_v](https://discuss.elastic.co/u/pavan_v)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 2:51pm UTC](https://discuss.elastic.co/t/secondary-rollup-of-existing-rollup-index/281706 "2021-08-17T14:51:24Z")
Hi, I have an index which is created from a Rollup job. Its content is as follows: "hits": { "total": 4, "max\_score": 1, "hits": \[ { "\_index": "my\_rollup\_1m\_2021.08.17", "\_type": "\_doc… --- ## [Export Download CSV data from Kibana Visualization to API](https://discuss.elastic.co/t/export-download-csv-data-from-kibana-visualization-to-api/281599)
**Author:** [@chaman17](https://discuss.elastic.co/u/chaman17)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 11:31pm UTC](https://discuss.elastic.co/t/export-download-csv-data-from-kibana-visualization-to-api/281599 "2021-08-17T23:31:28Z")
Hi Team Is there a way to fetch CSV data from kibana visualization using FAST API? I have created a kibana visualization using filters and am able to get the downloaded CSV data from kibana dashboard UI. Now, my requir… --- ## [Percolate query performance optimization](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750)
**Author:** [@jesse\_c](https://discuss.elastic.co/u/jesse_c)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:41pm UTC](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750 "2021-08-17T21:41:58Z")
We're on Elasticsearch 7.9. We have a percolate index that hosts about 120 queries. The index has 5 shards, each of which has two replicas. We started to encounter performance issues after adding around 10 queries that … --- ## [Logstash always outputting only 9 documents](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 10:19pm UTC](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751 "2021-08-17T22:19:24Z")
I have a json file with 4K json objects in it. Each object is on its own line. I'm using the file plugin with the multiline codec to have Logstash parse all the objects. I'm also flattening the json objects and then send… --- ## [What happens to unampped fields? What are the performance disadvantage of not mapping a field?](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746)
**Author:** [@Vaibhav\_Singal](https://discuss.elastic.co/u/Vaibhav_Singal)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:59pm UTC](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746 "2021-08-17T21:59:37Z")
I have an index with dynamic mapping set to false. PUT index\_a { "mappings": { "\_doc": { "dynamic": false, "properties": { "\_doc": { "properties": { "id": { … --- ## [Restore multiple snapshot](https://discuss.elastic.co/t/restore-multiple-snapshot/281686)
**Author:** [@Abhinav\_Shrivastava](https://discuss.elastic.co/u/Abhinav_Shrivastava)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:56pm UTC](https://discuss.elastic.co/t/restore-multiple-snapshot/281686 "2021-08-17T21:56:00Z")
Hi all, We are taking daily snapshots for elasticsearch. I want to restore the snapshot for last 10 days. I don't want to run API for each snapshot. can someone help me to restore last 10 days snapshot in one go ? --- ## [Add nodes or add CPU](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744)
**Author:** [@terrainc](https://discuss.elastic.co/u/terrainc)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:08pm UTC](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744 "2021-08-17T21:08:46Z")
Hi! I have 3 nodes cluster (build on virtual machines 24 cores 72Gb mem each). 120k/s messages. Cpu usage about 75-80% so, probably, I need to add more CPU. Also I want to add more disk space (x2 more). So I have two w… --- ## [Filebeat with syslog input loses millisecond precision](https://discuss.elastic.co/t/filebeat-with-syslog-input-loses-millisecond-precision/281748)
**Author:** [@chaserb](https://discuss.elastic.co/u/chaserb)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-with-syslog-input-loses-millisecond-precision/281748 "2021-08-17T20:26:55Z")
Hello, I have filebeat 7.12.0 on Debian 10 with two log inputs and one syslog input all going to the same index in an elasticsearch output. For the log inputs, I'm seeing @timestamp values in the index with millisecond … --- ## [Can I get BM25 score as part of script field?](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747)
**Author:** [@12minutes](https://discuss.elastic.co/u/12minutes)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 7:59pm UTC](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747 "2021-08-17T19:59:30Z")
The default score will be calculated in a different way. Just wondering is there any easy way to get default bm25 score as part of script function/script field? --- ## [Not able to edit alert in kibana 7.14 "Transaction error rate threshold"](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 7:53pm UTC](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501 "2021-08-17T19:53:54Z")
I have upgrade kibana 7.13 to 7.14 but I am not able to edit or change threshold value and time for kibana alert " Transaction error rate threshold" kibana version : 7.14 please find attachment for screen shot. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1275) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1277)