# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1311 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1312 --- ## [\_search filter data: is possible to do this?](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387)
**Author:** [@Marcsu](https://discuss.elastic.co/u/Marcsu)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/search-filter-data-is-possible-to-do-this/279387 "2021-07-22T14:27:57Z")
Hi, I'm trying to return only content that do match with a specific field value and not return the rest data of document... I mean, I try to realize a filter over data of document. I'm new in ES. Some idea to do that… --- ## [Gannt chart in Kibana using Vega](https://discuss.elastic.co/t/gannt-chart-in-kibana-using-vega/279241)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 5\ **Last updated:** [July 22, 2021, 2:23pm UTC](https://discuss.elastic.co/t/gannt-chart-in-kibana-using-vega/279241 "2021-07-22T14:23:20Z")
Goog Morning. I need to create a Gannt chart using Kibana. I know the first way to do that is using the Visualization section, introducing a Vega code. I need to visualize these fields from an Elastic Search Index: Robo… --- ## [Get The id of the ES document created by FSCrawler](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939)
**Author:** [@Francois\_Saab](https://discuss.elastic.co/u/Francois_Saab)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:20pm UTC](https://discuss.elastic.co/t/get-the-id-of-the-es-document-created-by-fscrawler/278939 "2021-07-22T14:20:57Z")
When FSCrawler sends a document to ES, i need to associate the \_id of the doc created by FSCrawler with an internal ID in our DB. How to get the \_id of the doc created by FSCrawler each time a new document is being inde… --- ## [Send splunk log using logstash](https://discuss.elastic.co/t/send-splunk-log-using-logstash/279376)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 2:05pm UTC](https://discuss.elastic.co/t/send-splunk-log-using-logstash/279376 "2021-07-22T14:05:16Z")
hi eeveryone, i have a splunk server, and i want to migrate splunk's log using logstash to my elasticsearch's server. is it possible? and how it is? --- ## [SQL Permissions for Monitoring Microsoft SQL Server using Metricbeat](https://discuss.elastic.co/t/sql-permissions-for-monitoring-microsoft-sql-server-using-metricbeat/279294)
**Author:** [@mroughton](https://discuss.elastic.co/u/mroughton)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 2:02pm UTC](https://discuss.elastic.co/t/sql-permissions-for-monitoring-microsoft-sql-server-using-metricbeat/279294 "2021-07-22T14:02:30Z")
I am looking to implement monitoring Microsoft SQL Server using Metricbeat. What are the minimum SQL user permissions needed for performance and transaction log metric sets? --- ## [Advantages of using redis](https://discuss.elastic.co/t/advantages-of-using-redis/279216)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:58pm UTC](https://discuss.elastic.co/t/advantages-of-using-redis/279216 "2021-07-22T13:58:49Z")
Look at some documentation when building the ELK. Sometimes install Redis in front of Logstash. Even though Logstash provides a buffer, is there any advantage to installing Logstash in front? If Redis is present but n… --- ## [Unable to use TSVB visualization even after specifying index](https://discuss.elastic.co/t/unable-to-use-tsvb-visualization-even-after-specifying-index/279311)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 5\ **Last updated:** [July 22, 2021, 1:47pm UTC](https://discuss.elastic.co/t/unable-to-use-tsvb-visualization-even-after-specifying-index/279311 "2021-07-22T13:47:19Z")
I'm trying out TSVB viz on kibana, and the visualization doesnt work as expected . Are there any rules to creating a TSVB viz ? like use a particular date format or visualize only a certain data pattern ? --- ## [Logstash upsert across multiple indexes](https://discuss.elastic.co/t/logstash-upsert-across-multiple-indexes/279307)
**Author:** [@jpchev](https://discuss.elastic.co/u/jpchev)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:39pm UTC](https://discuss.elastic.co/t/logstash-upsert-across-multiple-indexes/279307 "2021-07-22T13:39:51Z")
hi there, I need to import data in elasticsearch with an upsert logic, for this I use the following logstash plugin output { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "myindex-{+YYYY.MM.dd}" doc… --- ## [Possible to have {{context.hits}} return as an array?](https://discuss.elastic.co/t/possible-to-have-context-hits-return-as-an-array/277583)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/possible-to-have-context-hits-return-as-an-array/277583 "2021-07-22T13:35:33Z")
Dear all =) I would like to have {{context.hits}} as a JSON array, so I have tried different things. If I put the following in a Kibana rule body {"documents":"{{context.hits}}"} then all the documents are stored as … --- ## [Autocomplete best match is not first in results](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186)
**Author:** [@net](https://discuss.elastic.co/u/net)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 1:35pm UTC](https://discuss.elastic.co/t/autocomplete-best-match-is-not-first-in-results/279186 "2021-07-22T13:35:02Z")
When I search for "charles sta" the first result in the list is "U.S. Dept. of State, Office of Logistics Management, Charleston" and the second result is "Charles Stark Draper Laboratory, Inc. (CSDL)" The second result… --- ## [\_grokparsefailure but grok debugger looks good](https://discuss.elastic.co/t/grokparsefailure-but-grok-debugger-looks-good/279269)
**Author:** [@baumi](https://discuss.elastic.co/u/baumi)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 1:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-but-grok-debugger-looks-good/279269 "2021-07-22T13:14:39Z")
Hello everyone, I need some help with my grok pattern, because Logstash is not able to parse it. Kibana and other grok debuggers are able to parse the logs. Sample Log: Mar 10 00:59:50\\t1.1.1.1\\ttest@static\\t0/0/0/000… --- ## [How to read the body (json data) of the request in a custom plugin](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 12:37pm UTC](https://discuss.elastic.co/t/how-to-read-the-body-json-data-of-the-request-in-a-custom-plugin/279375 "2021-07-22T12:37:17Z")
I am trying to create a custom plugin which needs to read the body of the request (by body i mean json data that is sent along with the request) so i should be able to read the json data of a request like POST myendpoi… --- ## [How to export forecast data into a destination index](https://discuss.elastic.co/t/how-to-export-forecast-data-into-a-destination-index/279380)
**Author:** [@StephaneB](https://discuss.elastic.co/u/StephaneB)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 12:30pm UTC](https://discuss.elastic.co/t/how-to-export-forecast-data-into-a-destination-index/279380 "2021-07-22T12:30:42Z")
Hello, I'm currently using API to create job, datafeed and associated forecast in order to determine if some predicted values will exceed a specific threshold in the next weeks: if no value exceeds the threshold then … --- ## [Is there a way invoke shell script or python script as part of filebeat output or processor](https://discuss.elastic.co/t/is-there-a-way-invoke-shell-script-or-python-script-as-part-of-filebeat-output-or-processor/279252)
**Author:** [@naresh\_b](https://discuss.elastic.co/u/naresh_b)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 12:24pm UTC](https://discuss.elastic.co/t/is-there-a-way-invoke-shell-script-or-python-script-as-part-of-filebeat-output-or-processor/279252 "2021-07-22T12:24:59Z")
As part of LSF accounting file monitoring, need some processing(parsing job\_finish event) for each event entry using LSF API (python or c). Want to keep this agent as simple as possible, hence considering to use only fil… --- ## [How to parse smile serialized files (files with .dat) (files with snap-\* and meta-\* prefixes)](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621)
**Author:** [@shadowfox38](https://discuss.elastic.co/u/shadowfox38)\ **Replies:** 17\ **Last updated:** [July 22, 2021, 11:54am UTC](https://discuss.elastic.co/t/how-to-parse-smile-serialized-files-files-with-dat-files-with-snap-and-meta-prefixes/278621 "2021-07-22T11:54:27Z")
When Elastic search snapshot deletes fail in between, some dangling indexes are left, which increase the size of the repository. I wanted to find such indexes by referring to the snapshot metadata files. I need help in … --- ## [Field expansion for \[\*\] matches too many fields, limit: 1024, got: 1998](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168)
**Author:** [@vaishno.avi](https://discuss.elastic.co/u/vaishno.avi)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:27am UTC](https://discuss.elastic.co/t/field-expansion-for-matches-too-many-fields-limit-1024-got-1998/279168 "2021-07-22T10:27:12Z")
Hello, We have recently moved from AWS ES 5.x to 7.10. While performing search operation I go get the above error. In total my fields are between 2500 to 4000 for now. I know these values are not good, but this somehow … --- ## [Unable to Fetch data from rollups collector - OFFLINE INSTALL](https://discuss.elastic.co/t/unable-to-fetch-data-from-rollups-collector-offline-install/278953)
**Author:** [@Karevavery](https://discuss.elastic.co/u/Karevavery)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:20am UTC](https://discuss.elastic.co/t/unable-to-fetch-data-from-rollups-collector-offline-install/278953 "2021-07-22T10:20:16Z")
Hi, my kibana service is showing logged warnings and I cannot access the webpage either. error log stating: Cannot read property ‘id’ of undefined\\n at id (/usr/share/kibana/x-pack/legacy/plugins/rollup/server/usage/col… --- ## [Query using ESSQL Conditional (CASE) Function missing some records](https://discuss.elastic.co/t/query-using-essql-conditional-case-function-missing-some-records/278552)
**Author:** [@girvandip](https://discuss.elastic.co/u/girvandip)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:15am UTC](https://discuss.elastic.co/t/query-using-essql-conditional-case-function-missing-some-records/278552 "2021-07-22T10:15:47Z")
Hello, I am working with Canvas in Kibana. Below is the example of the data in tabular format: | timestamp | Id | message | --------------------------------- | 08:49:10 | 1 | TE | | 08:50:20 |… --- ## [File structure cannot be determined on data visualizer](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070)
**Author:** [@Adrienb02](https://discuss.elastic.co/u/Adrienb02)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 10:05am UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined-on-data-visualizer/277070 "2021-07-22T10:05:58Z")
Hello everyone ! In advance, sorry for my english. I have an issue with the Data Visualizer. In my case, I have created a json file. My problem is that the data visualizer doesn't want my file as an input. The error … --- ## [ES is getting killed :(](https://discuss.elastic.co/t/es-is-getting-killed/279362)
**Author:** [@kamal\_khushi](https://discuss.elastic.co/u/kamal_khushi)\ **Replies:** 2\ **Last updated:** [July 22, 2021, 9:40am UTC](https://discuss.elastic.co/t/es-is-getting-killed/279362 "2021-07-22T09:40:29Z")
OS:-ubuntu ram:-16gb Storage:-500GB CPU:-i5 10th gen i have Cloned ES in two different directory : Es1 Es2 Then first i launched Es1/bin/elastisearch And next i launched Es2/bin/elastisearch while Es2 is launchi… --- ## [Filebeat multiline Issue](https://discuss.elastic.co/t/filebeat-multiline-issue/279338)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 5:41am UTC](https://discuss.elastic.co/t/filebeat-multiline-issue/279338 "2021-07-22T05:41:46Z")
Hi Team, I have an issue in filebeat Multiline pattern, below are my logs and filebeat configuration. sample\_logs 21-04-01 Name Succ Fail Reject Thrput Response time (ms) … --- ## [Filtering on a property of the first element in a Nested property array](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298)
**Author:** [@Sikelela\_Nkohla](https://discuss.elastic.co/u/Sikelela_Nkohla)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 7:54am UTC](https://discuss.elastic.co/t/filtering-on-a-property-of-the-first-element-in-a-nested-property-array/279298 "2021-07-22T07:54:52Z")
We have the following document structure : "Document" : { "arvTreatmentStarted" : "started", "followUps" : \[ { "followUpDate" : "2012-01-01", "arvDrugs" : { "dispenseDoseQuantity" : "30", "dispenseDoseDaysSupply… --- ## [Esrally giving multiple search queries in the same track.json](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184)
**Author:** [@Sameera\_De\_Silva](https://discuss.elastic.co/u/Sameera_De_Silva)\ **Replies:** 4\ **Last updated:** [July 22, 2021, 7:25am UTC](https://discuss.elastic.co/t/esrally-giving-multiple-search-queries-in-the-same-track-json/279184 "2021-07-22T07:25:27Z")
Could we give multiple search queries in the same track.json I want to give 2 queries which given below/ So I added it in several places in different ways to organize it . However, when I validate the .json , I get … --- ## [RabbitMQ Input plugin: PKIX path building failed in Logstash 6.8.15](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349)
**Author:** [@Pragatheswar](https://discuss.elastic.co/u/Pragatheswar)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 7:23am UTC](https://discuss.elastic.co/t/rabbitmq-input-plugin-pkix-path-building-failed-in-logstash-6-8-15/279349 "2021-07-22T07:23:45Z")
Problem statement Hi guys, I ahve upgraded Logstash from 6.2.2 to 6.5.0. Post that I receive the following error when trying to configure logstash client certificates: \[2018-12-10T22:10:32,949\]\[ERROR\]\[logstash.inputs.… --- ## [Is it possible for kibana to start with blank page before selecting options in control](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 7:12am UTC](https://discuss.elastic.co/t/is-it-possible-for-kibana-to-start-with-blank-page-before-selecting-options-in-control/279289 "2021-07-22T07:12:47Z")
I ingested a couple of log files, and it gets populated on the "maps" visualization perfectly . however i wanted to know if its possible for kibana to start with no plots on the map and have it plot only when we choo… --- ## [Installing specific elasticsearch version in Homebrew - Mac OS](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 6:33am UTC](https://discuss.elastic.co/t/installing-specific-elasticsearch-version-in-homebrew-mac-os/278586 "2021-07-22T06:33:12Z")
Hi all, I'm having trouble in installing specific versions of elasticsearch in mac OS using Homebrew. In Homebrew, I can only install the latest version which is available. If I want to install a version eg: 7.13.2 , … --- ## [I want to show time diff](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342)
**Author:** [@byun618](https://discuss.elastic.co/u/byun618)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 6:19am UTC](https://discuss.elastic.co/t/i-want-to-show-time-diff/279342 "2021-07-22T06:19:54Z")
hello every one. this is the data. and i want to show time diff between max and min. p.s this is my first post. so feel free to comment about my post 'form', 'rule' or something --- ## [Search through encrypted data](https://discuss.elastic.co/t/search-through-encrypted-data/278922)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [July 22, 2021, 4:41am UTC](https://discuss.elastic.co/t/search-through-encrypted-data/278922 "2021-07-22T04:41:30Z")
Hello: Apparently, in healthcare, the new stipulation evolving - to encrypt the PHI data (no, not the disk - data) - so no one would be able to get the data in cleartext. I know, I know devs can decrypt the data if the… --- ## [Issues with signals in VEGA visualization](https://discuss.elastic.co/t/issues-with-signals-in-vega-visualization/279222)
**Author:** [@elad\_sheinfeld](https://discuss.elastic.co/u/elad_sheinfeld)\ **Replies:** 3\ **Last updated:** [July 22, 2021, 4:18am UTC](https://discuss.elastic.co/t/issues-with-signals-in-vega-visualization/279222 "2021-07-22T04:18:25Z")
Hey all, I'm using ELK version 7.13.3 Using the code below, I'm trying to draw nodes connected to networks. The default fill of the nodes is blue, but when a user is clicking a node, it will be filled with red and the… --- ## [Packetbeat FLOW and analysis results for individual protocols](https://discuss.elastic.co/t/packetbeat-flow-and-analysis-results-for-individual-protocols/279333)
**Author:** [@chinaxushi](https://discuss.elastic.co/u/chinaxushi)\ **Replies:** 0\ **Last updated:** [July 22, 2021, 4:05am UTC](https://discuss.elastic.co/t/packetbeat-flow-and-analysis-results-for-individual-protocols/279333 "2021-07-22T04:05:50Z")
packetbeat,If HTTP protocol and FLOW analysis are enabled, and an HTTP request comes in and responds normally (whether it returns 200,404), will both HTTP and FLOW be analyzed, or will it only be analyzed and output with… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1310) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1312)