# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1293 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1294 --- ## [Negative CPU Usage on default dashboard "\[Elastic Agent\] Agent metrics"](https://discuss.elastic.co/t/negative-cpu-usage-on-default-dashboard-elastic-agent-agent-metrics/279762)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [August 5, 2021, 9:25am UTC](https://discuss.elastic.co/t/negative-cpu-usage-on-default-dashboard-elastic-agent-agent-metrics/279762 "2021-08-05T09:25:03Z")
Hello, Added a few Elastic agents to my Elastic Cloud trial and after 24 hours, I noticed negative CPU Usages on the builtin "\[Elastic Agent\] Agent metrics" dashboard.. After checking the configuration, the TSVB vis… --- ## [Can Logstash Base64 decode then parse json from a cloudfront log?](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 9:06am UTC](https://discuss.elastic.co/t/can-logstash-base64-decode-then-parse-json-from-a-cloudfront-log/280367 "2021-08-05T09:06:05Z")
Hello, we are using AWS's image resizer Serverless Image Handler | Implementations | AWS Solutions To get an image, you need to base64 encode a json object such as {"bucket":"my-s3-bucket","key":"path/to/your/image.jpg… --- ## [Delay in response after using function\_score for sorting of documents according to field match](https://discuss.elastic.co/t/delay-in-response-after-using-function-score-for-sorting-of-documents-according-to-field-match/280113)
**Author:** [@AshuCh](https://discuss.elastic.co/u/AshuCh)\ **Replies:** 0\ **Last updated:** [July 31, 2021, 6:09am UTC](https://discuss.elastic.co/t/delay-in-response-after-using-function-score-for-sorting-of-documents-according-to-field-match/280113 "2021-07-31T06:09:55Z")
When using function\_score to sort the document on base of score response is taking too much time to come it's in minutes. The problem is I need sorting according to fields. When using boost not getting the relevant data. … --- ## [Use another document's value for script\_score computation](https://discuss.elastic.co/t/use-another-documents-value-for-script-score-computation/280511)
**Author:** [@SatyaAditya](https://discuss.elastic.co/u/SatyaAditya)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 8:44am UTC](https://discuss.elastic.co/t/use-another-documents-value-for-script-score-computation/280511 "2021-08-05T08:44:39Z")
Hi, Is there a way to use a different document's field value in the script\_Score query? My use-case is I have a query which is asked by multiple users and count of the query asked by the user in this way { "… --- ## [CircuitBreakException \](https://discuss.elastic.co/t/circuitbreakexception-transport-request/280320)
**Author:** [@grrkaan](https://discuss.elastic.co/u/grrkaan)\ **Replies:** 4\ **Last updated:** [August 5, 2021, 7:43am UTC](https://discuss.elastic.co/t/circuitbreakexception-transport-request/280320 "2021-08-05T07:43:56Z")
My setup is 1 master node and 18 data node.My master node also data node.My tps events/sec 70-100 and my jvm options like this. Elasticsearch version 7.5.0 open-jdk 13 Machines has a 32 GB Memory. And i got an error w… --- ## [To modify multiple field names through logstash](https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876)
**Author:** [@raju.d](https://discuss.elastic.co/u/raju.d)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 7:38am UTC](https://discuss.elastic.co/t/to-modify-multiple-field-names-through-logstash/279876 "2021-08-05T07:38:36Z")
Hello, I came across an old discussion -\> Rename or Change Available Fields . Unfortunately in that discussion, the final configuration that worked has not been shared! I am working on same and wanted to get rid of jso… --- ## [Urgent Help: How to use date range in sub-aggregation in Kibana](https://discuss.elastic.co/t/urgent-help-how-to-use-date-range-in-sub-aggregation-in-kibana/280467)
**Author:** [@BIIntern1](https://discuss.elastic.co/u/BIIntern1)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 6:40am UTC](https://discuss.elastic.co/t/urgent-help-how-to-use-date-range-in-sub-aggregation-in-kibana/280467 "2021-08-05T06:40:43Z")
Hi all, I am trying to slice the data in Kibana using date range sub aggregation. It is giving me the required data in required format when I am putting just "now" for To but when I tried putting "now-1d" under To in or… --- ## [Why is the query result in Discover different from the real data?](https://discuss.elastic.co/t/why-is-the-query-result-in-discover-different-from-the-real-data/280059)
**Author:** [@yyyayo](https://discuss.elastic.co/u/yyyayo)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 6:26am UTC](https://discuss.elastic.co/t/why-is-the-query-result-in-discover-different-from-the-real-data/280059 "2021-08-05T06:26:59Z")
When I tried to search a field equaling some value, I got the right result. However, the data showed in the result was different from the real or the searched one. It looked like this: As I searched n2\_hash : -918160… --- ## [JVM error in elasticsearch log causes failure in application](https://discuss.elastic.co/t/jvm-error-in-elasticsearch-log-causes-failure-in-application/279108)
**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\ **Replies:** 12\ **Last updated:** [August 5, 2021, 5:56am UTC](https://discuss.elastic.co/t/jvm-error-in-elasticsearch-log-causes-failure-in-application/279108 "2021-08-05T05:56:02Z")
Hi all, Elasticsearch application failed due to jvm errors. i tried to fix that changing: esJavaOpts: "-Xmx8g -Xms8g" in yaml file. unfortunately this did not help. In general the app is bases on 3 servers with 8 cpu an… --- ## [Problem with indexing](https://discuss.elastic.co/t/problem-with-indexing/280496)
**Author:** [@ailengcon](https://discuss.elastic.co/u/ailengcon)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 5:55am UTC](https://discuss.elastic.co/t/problem-with-indexing/280496 "2021-08-05T05:55:55Z")
Okey, third time's the charm. I want to use elasticsearch to search a mongoDb, and I've manage to make the connection (using monstache) but the dynamic indexing does not index the documents right. I have one db with lot… --- ## [I don't get the same result with Split series/Sub aggregation/Terms](https://discuss.elastic.co/t/i-dont-get-the-same-result-with-split-series-sub-aggregation-terms/280373)
**Author:** [@anon89617342](https://discuss.elastic.co/u/anon89617342)\ **Replies:** 2\ **Last updated:** [August 5, 2021, 5:54am UTC](https://discuss.elastic.co/t/i-dont-get-the-same-result-with-split-series-sub-aggregation-terms/280373 "2021-08-05T05:54:00Z")
I'm creating multiple graphs on the same indices with Terms aggregation on Kibana. The wired thing is that sum of counts on each graph is not the same while the time range and search query is exactly the same. Any idea … --- ## [Elasticsearch7.9 How to write data in the form yyyy-MM-dd HH:mm:ss.SSSSSS](https://discuss.elastic.co/t/elasticsearch7-9-how-to-write-data-in-the-form-yyyy-mm-dd-hhss-ssssss/280486)
**Author:** [@qracle](https://discuss.elastic.co/u/qracle)\ **Replies:** 0\ **Last updated:** [August 5, 2021, 3:14am UTC](https://discuss.elastic.co/t/elasticsearch7-9-how-to-write-data-in-the-form-yyyy-mm-dd-hhss-ssssss/280486 "2021-08-05T03:14:06Z")
es version：7.9 script 1： PUT \_template/test\_template { "index\_patterns": \["test\_index\*"\], "settings": { "index" : { "max\_result\_window" : "10000", "number\_of\_shards" : "1", "number\_of\_replicas" … --- ## [Error start kibana cannot find module](https://discuss.elastic.co/t/error-start-kibana-cannot-find-module/280420)
**Author:** [@grimaldo](https://discuss.elastic.co/u/grimaldo)\ **Replies:** 1\ **Last updated:** [August 5, 2021, 1:15am UTC](https://discuss.elastic.co/t/error-start-kibana-cannot-find-module/280420 "2021-08-05T01:15:52Z")
Dear friends, when I try to lift the kibana, the error below occurs, any ideas? Cannot find module './persistence\_defense\_evasion\_hidden\_launch\_agent\_deamon\_logonitem\_process.json' Thanks --- ## [Filebeat sonicwall module](https://discuss.elastic.co/t/filebeat-sonicwall-module/280469)
**Author:** [@WilGG](https://discuss.elastic.co/u/WilGG)\ **Replies:** 1\ **Last updated:** [August 5, 2021, 1:08am UTC](https://discuss.elastic.co/t/filebeat-sonicwall-module/280469 "2021-08-05T01:08:42Z")
Hi Everyone, Can someone provide me with a SonicWall module sample config file for filebeat? When I try to modify sonicwall.yml, the filebeat service crashes. when it is set to default comment state I am able to run th… --- ## [Kibaba Plugin - how to insert data into elasticsearch](https://discuss.elastic.co/t/kibaba-plugin-how-to-insert-data-into-elasticsearch/280374)
**Author:** [@Hoai\_Le](https://discuss.elastic.co/u/Hoai_Le)\ **Replies:** 1\ **Last updated:** [August 4, 2021, 11:40pm UTC](https://discuss.elastic.co/t/kibaba-plugin-how-to-insert-data-into-elasticsearch/280374 "2021-08-04T23:40:33Z")
let say I have a plugin with route: router.post( { path: '/api/dashboard\_real\_time/create', validate: { body: schema.object({ fullName: schema.string(), age: schema.number(), … --- ## [Kibana not installing](https://discuss.elastic.co/t/kibana-not-installing/280456)
**Author:** [@rushantnarula](https://discuss.elastic.co/u/rushantnarula)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 10:36pm UTC](https://discuss.elastic.co/t/kibana-not-installing/280456 "2021-08-04T22:36:51Z")
FATAL Error: Cannot find module './credential\_access\_access\_to\_browser\_credentials\_procargs.json' Require stack: F:\\BLACKCOFFER\\Elasticsearch\\elasticsearch-7.13.4-windows-x86\_64\\kibana-7.14.0-windows-x86\_64\\kibana-7.… --- ## [Filebeat multiline log into ES/Kib](https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478)
**Author:** [@marc\_b](https://discuss.elastic.co/u/marc_b)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-multiline-log-into-es-kib/280478 "2021-08-04T22:31:29Z")
Hi, Searching for assistance here if possible. I have log files that are created by using the 'SET' command piped into a file. (exporting environment variables) in the example shape below - ALLUSERSPROFILE=C:\\ProgramD… --- ## [SSL password not working](https://discuss.elastic.co/t/ssl-password-not-working/280410)
**Author:** [@prithvirajsivarajan](https://discuss.elastic.co/u/prithvirajsivarajan)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 10:24am UTC](https://discuss.elastic.co/t/ssl-password-not-working/280410 "2021-08-04T10:24:55Z")
I had a elasticsearch instance on my linux server. I didn't setup any cluster or node in the elasticsearch.yml file. I had setup SSL for the server and setup a username and password for authentication. It was all working… --- ## [Downgrade from 7.14 to 7.13.4](https://discuss.elastic.co/t/downgrade-from-7-14-to-7-13-4/280460)
**Author:** [@JSieminski](https://discuss.elastic.co/u/JSieminski)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 9:37pm UTC](https://discuss.elastic.co/t/downgrade-from-7-14-to-7-13-4/280460 "2021-08-04T21:37:55Z")
I see a lot of people asking about downgrades and it seems to be not supported. I was in the process of updating my nodes from 7.7 to 7.13.4 and I wasn't putting the actual version of elastic when doing my update. As a r… --- ## [How to optimise/cleanup config with multiple mutations?](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 1\ **Last updated:** [August 4, 2021, 8:23pm UTC](https://discuss.elastic.co/t/how-to-optimise-cleanup-config-with-multiple-mutations/280464 "2021-08-04T20:23:50Z")
There are a lot of new field creations, renames, and removals in my filter plugin. And if, for example, I try to club the renames together, the mutations don't get executed correctly and i end up with only half the mutat… --- ## [Getting curator 'Schema error'](https://discuss.elastic.co/t/getting-curator-schema-error/280002)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 8:10pm UTC](https://discuss.elastic.co/t/getting-curator-schema-error/280002 "2021-08-04T20:10:00Z")
Hi Team, I have installed curator-5.8.1 but can see its not working from day one. Getting below error in/var/log/curator\_snapshot\_backup.log 2021-07-21 02:00:02,232 ERROR Schema error: expected dict for dictionar… --- ## [Azure Signin data =\> field \[message\] already exists](https://discuss.elastic.co/t/azure-signin-data-field-message-already-exists/278446)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 8:06pm UTC](https://discuss.elastic.co/t/azure-signin-data-field-message-already-exists/278446 "2021-08-04T20:06:28Z")
Hello, I've seen multiple occurences in the Azure signin logs where user.name was not populated. Those documents always have an error.message containing "field \[message\] already exists". This seem like a bug.. The mess… --- ## [Data Visualizer with Grok pattern](https://discuss.elastic.co/t/data-visualizer-with-grok-pattern/280463)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 6:43pm UTC](https://discuss.elastic.co/t/data-visualizer-with-grok-pattern/280463 "2021-08-04T18:43:34Z")
Hi, I want to import a log file using Data Visualizer. The first few lines are as follows: Aug 4 12:05:25 gavin daemon.notice openvpn\[843\]: TCP/UDP: Closing socket Aug 4 12:05:25 gavin daemon.notice openvpn\[843\]: SI… --- ## [Histogram to show object count for missing days in date histogram](https://discuss.elastic.co/t/histogram-to-show-object-count-for-missing-days-in-date-histogram/280247)
**Author:** [@SUMANT\_MISHRA](https://discuss.elastic.co/u/SUMANT_MISHRA)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 6:30pm UTC](https://discuss.elastic.co/t/histogram-to-show-object-count-for-missing-days-in-date-histogram/280247 "2021-08-04T18:30:05Z")
Hi, I need support in creating a histogram that can show the count of objects on a daily basis if the date (in the histogram) falls within a date range. It should show count of the objects even if there is no object ava… --- ## [Highlighting date/Numeric fields on search](https://discuss.elastic.co/t/highlighting-date-numeric-fields-on-search/280459)
**Author:** [@saqib619](https://discuss.elastic.co/u/saqib619)\ **Replies:** 1\ **Last updated:** [August 4, 2021, 5:13pm UTC](https://discuss.elastic.co/t/highlighting-date-numeric-fields-on-search/280459 "2021-08-04T17:13:15Z")
How to get the date/numeric field highlighted when we search in elasticsearch? The requirement is to search the key word in all the fields and list the fields with that value. We are able to get the highlight for the st… --- ## [Elasticsearch logo spinning 7.11 -EKS1.19](https://discuss.elastic.co/t/elasticsearch-logo-spinning-7-11-eks1-19/280353)
**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\ **Replies:** 6\ **Last updated:** [August 4, 2021, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-logo-spinning-7-11-eks1-19/280353 "2021-08-04T16:55:56Z")
Recently installed Elasticsearch kibana 7.11 on EKS. The node health is green as well. Only issue iam facing is that when I log into kibana the logo which appears on the left hand top corner before the verbiage elastic k… --- ## [KIbana Session timout (v7.14.0)](https://discuss.elastic.co/t/kibana-session-timout-v7-14-0/280452)
**Author:** [@varunpappu](https://discuss.elastic.co/u/varunpappu)\ **Replies:** 8\ **Last updated:** [August 4, 2021, 4:48pm UTC](https://discuss.elastic.co/t/kibana-session-timout-v7-14-0/280452 "2021-08-04T16:48:27Z")
Kibana 7.14.0 latest update ends in session timeout every 5 minutes and its really annoying to work with. Didnot face this issue with previous versions. Very hard when we are monitoring something on large scale. --- ## [Master node failed to retrieve password](https://discuss.elastic.co/t/master-node-failed-to-retrieve-password/280458)
**Author:** [@Jinlian\_Chen](https://discuss.elastic.co/u/Jinlian_Chen)\ **Replies:** 0\ **Last updated:** [August 4, 2021, 4:23pm UTC](https://discuss.elastic.co/t/master-node-failed-to-retrieve-password/280458 "2021-08-04T16:23:04Z")
I have use helm to deploy a cluster with 3 master node + 4 data node. Master node part of config: esConfig: elasticsearch.yml: | bootstrap.memory\_lock: true xpack.security.enabled: true xpack.ml.e… --- ## [How to move basic elasticsearch to OSS elasticsearch](https://discuss.elastic.co/t/how-to-move-basic-elasticsearch-to-oss-elasticsearch/280361)
**Author:** [@JC83](https://discuss.elastic.co/u/JC83)\ **Replies:** 3\ **Last updated:** [August 4, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-move-basic-elasticsearch-to-oss-elasticsearch/280361 "2021-08-04T14:33:24Z")
Planning to move basic elasticsearch to OSS elasticsearch . is there any documents available? --- ## [Base64 decoding & decompression of json](https://discuss.elastic.co/t/base64-decoding-decompression-of-json/280442)
**Author:** [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)\ **Replies:** 2\ **Last updated:** [August 4, 2021, 3:54pm UTC](https://discuss.elastic.co/t/base64-decoding-decompression-of-json/280442 "2021-08-04T15:54:02Z")
I have a JSON input containing a \[message\]\[message\_json\] field which is compressed & base64 encoded at the source. This is the python code used to decode, decompress, and deserialize the field: message\['message\_json'\] … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1292) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1294)