# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1314 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1315 --- ## [RUBY Filter to event.set each entity in an Array](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 2\ **Last updated:** [July 21, 2021, 12:42am UTC](https://discuss.elastic.co/t/ruby-filter-to-event-set-each-entity-in-an-array/277749 "2021-07-21T00:42:44Z")
I am stuck on how to use a Ruby script to manipulate a field with in an array. If anyone can help with this I need to take the Field "\[body\]\[entities\]\[sentiment\]\[confidence\]" and \* 100 and add that as another Field "\[bod… --- ## [Kibana dashboard multiple panels and filtering](https://discuss.elastic.co/t/kibana-dashboard-multiple-panels-and-filtering/279116)
**Author:** [@IsAa](https://discuss.elastic.co/u/IsAa)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 10:43pm UTC](https://discuss.elastic.co/t/kibana-dashboard-multiple-panels-and-filtering/279116 "2021-07-20T22:43:44Z")
Hi, I have a dashboard containing multiple panels which use different indices. But when I use a filter on one of the panels. It is applied to other panels too which use different indices. Which means filter operation f… --- ## [Date processor error](https://discuss.elastic.co/t/date-processor-error/279173)
**Author:** [@omurad](https://discuss.elastic.co/u/omurad)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 9:36pm UTC](https://discuss.elastic.co/t/date-processor-error/279173 "2021-07-20T21:36:04Z")
I'm looking to parse the following date using the "Date" ingest processor 20/Jul/2021:07:28:46 --0400 I tried doing so using these formats dd/MMM/yyyy:HH:mm:ss -ZZZZZ dd/MMM/yyyy:HH:mm:ss '-'ZZZZZ However, I get the… --- ## [Object type vs Data type in Filebeat](https://discuss.elastic.co/t/object-type-vs-data-type-in-filebeat/279185)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 8:25pm UTC](https://discuss.elastic.co/t/object-type-vs-data-type-in-filebeat/279185 "2021-07-20T20:25:57Z")
Hello, I'm circling back on this older discussion I posted about object type vs concrete types trying to push data to elasticsearch using filebeat: The error I've been running into is this: {"type":"mapper\_parsing\_e… --- ## [Difference between using (in the Field Metric) Count and Unique Count](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173)
**Author:** [@rosammb](https://discuss.elastic.co/u/rosammb)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 7:55pm UTC](https://discuss.elastic.co/t/difference-between-using-in-the-field-metric-count-and-unique-count/278173 "2021-07-20T19:55:03Z")
Hi, I'm using 6.8.3 Elastic version. I'm having problems when I create visualizes and using the Field Metric. If I use Unique count the result is different than if I use count. My feeling is that Unique count is the co… --- ## [Kibana icon colorless](https://discuss.elastic.co/t/kibana-icon-colorless/279187)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 7:31pm UTC](https://discuss.elastic.co/t/kibana-icon-colorless/279187 "2021-07-20T19:31:11Z")
Hi, Updated from 7.10.2 to 7.13.3. Kibana favicon seems colorless. Any specific reason? Is this an indication to a problem? Thanks. --- ## [Watcher is not returning any hit and returns Null](https://discuss.elastic.co/t/watcher-is-not-returning-any-hit-and-returns-null/278676)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 7\ **Last updated:** [July 20, 2021, 7:25pm UTC](https://discuss.elastic.co/t/watcher-is-not-returning-any-hit-and-returns-null/278676 "2021-07-20T19:25:45Z")
Hi, I created one watcher but the condition is not getting successful and returning hit =0, and finally, it is returning a null value. When I built the dashboard using the same condition value is getting displayed there,… --- ## [Logstash KV filter time field](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183)
**Author:** [@RaonyO](https://discuss.elastic.co/u/RaonyO)\ **Replies:** 5\ **Last updated:** [July 20, 2021, 7:21pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-time-field/279183 "2021-07-20T19:21:12Z")
hello guys, i'm using kv filter to filter syslogs in logstash to be sent to elasticsearch. but the kv is creating a field with time and data instead of being in value, how to fix this? is reaching the field limit becaus… --- ## [All output pipelines stop when one errors (using pipeline-to-pipeline)](https://discuss.elastic.co/t/all-output-pipelines-stop-when-one-errors-using-pipeline-to-pipeline/279155)
**Author:** [@mgeldert](https://discuss.elastic.co/u/mgeldert)\ **Replies:** 4\ **Last updated:** [July 20, 2021, 5:45pm UTC](https://discuss.elastic.co/t/all-output-pipelines-stop-when-one-errors-using-pipeline-to-pipeline/279155 "2021-07-20T17:45:39Z")
I'm running logstash 7.12.1 in a container based on the standard Docker image, with the New Relic output installed on top. Despite the fact I am using pipeline-to-pipeline, I am hitting a situation where, if one output … --- ## [Heartbeat : Panic error using SSL Verification\_mode None](https://discuss.elastic.co/t/heartbeat-panic-error-using-ssl-verification-mode-none/276396)
**Author:** [@tjussey](https://discuss.elastic.co/u/tjussey)\ **Replies:** 4\ **Last updated:** [July 20, 2021, 5:30pm UTC](https://discuss.elastic.co/t/heartbeat-panic-error-using-ssl-verification-mode-none/276396 "2021-07-20T17:30:31Z")
Hi everyone, I'm using Heartbeat 7.13.1 on Debian 9.13. I setup monitors like this one : heartbeat.monitors: - type: http enabled: true id: anId name: aName urls: \["https//private.fr:59862"\] schedule: '@ever… --- ## [Logstash xml filter ruby cleanup code help](https://discuss.elastic.co/t/logstash-xml-filter-ruby-cleanup-code-help/279099)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 5:16pm UTC](https://discuss.elastic.co/t/logstash-xml-filter-ruby-cleanup-code-help/279099 "2021-07-20T17:16:48Z")
I'm using the xml logstash filter to parse xml values into json, but I'm having issues indexing them into Elasticsearch due to an issue where a null string gets parsed into an empty object. Source String Snip: \ **Author:** [@Baygon](https://discuss.elastic.co/u/Baygon)\ **Replies:** 22\ **Last updated:** [July 20, 2021, 3:29pm UTC](https://discuss.elastic.co/t/advice-on-scaling-writes/278518 "2021-07-20T15:29:13Z") Hi, Our systems are generating CSV files containing all events that happened during the past hour. There are about 15.000 CSV files generated every hour, containing thousand of events each. A quick estimate would mean… --- ## [How to limit data Print When I use ES as input](https://discuss.elastic.co/t/how-to-limit-data-print-when-i-use-es-as-input/279014)
**Author:** [@London\_Kim](https://discuss.elastic.co/u/London_Kim)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 3:23pm UTC](https://discuss.elastic.co/t/how-to-limit-data-print-when-i-use-es-as-input/279014 "2021-07-20T15:23:39Z")
I am using ES as an input tool. I am trying to output data to stdout, but I want to see only about 5 data as a test. But until I stop logstash, logstash continues to load data. How can I control the data for as many cas… --- ## [Issue with metricbeat keystore integration](https://discuss.elastic.co/t/issue-with-metricbeat-keystore-integration/278889)
**Author:** [@lokeshv1989](https://discuss.elastic.co/u/lokeshv1989)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 3:13pm UTC](https://discuss.elastic.co/t/issue-with-metricbeat-keystore-integration/278889 "2021-07-20T15:13:21Z")
Hi there, we are trying to use keystore in metricbeats to protect a password value but looks like the ${pwd} which we use in the metricbeat.yml is not able to reference the pwd value i have set in keystore basically lo… --- ## [Kibana Bar chart - Replacing alldocs name in x-axis](https://discuss.elastic.co/t/kibana-bar-chart-replacing-alldocs-name-in-x-axis/279076)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [July 20, 2021, 3:07pm UTC](https://discuss.elastic.co/t/kibana-bar-chart-replacing-alldocs-name-in-x-axis/279076 "2021-07-20T15:07:31Z")
Hi all, I'm creating a bar chart with split series option instead of x-axis because i want to show all values with different colours. However, I'm unable to change "\_all All docs" name. I want it according to my name … --- ## [Missing events while using Filebeat multiline.flush\_pattern](https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 0\ **Last updated:** [July 20, 2021, 2:39pm UTC](https://discuss.elastic.co/t/missing-events-while-using-filebeat-multiline-flush-pattern/279175 "2021-07-20T14:39:27Z")
Filebeat "multiline.flush\_pattern" is flushing the multiline line event starting with "multiline.pattern" and ending with "multiline.flush\_pattern". I am facing 2 issues with multiline.flush\_pattern, The lines after "… --- ## [ELK SQL query](https://discuss.elastic.co/t/elk-sql-query/278934)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 2:17pm UTC](https://discuss.elastic.co/t/elk-sql-query/278934 "2021-07-20T14:17:12Z")
Hello Team, I want to Execute SQL query on my Index data , where i have 6 records of same transaction id in Index. In each record there is timestamp , so i need to calculate timestamp diff between 1st , 6th and 2dn ,3… --- ## [Edge N-gram at word level](https://discuss.elastic.co/t/edge-n-gram-at-word-level/279166)
**Author:** [@mmoreram](https://discuss.elastic.co/u/mmoreram)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 1:47pm UTC](https://discuss.elastic.co/t/edge-n-gram-at-word-level/279166 "2021-07-20T13:47:38Z")
In Elasticsearch, edge n-gram divides a word into progressive tokens, starting from the begining, and adding a new letter per each token. Is there a way to add the same logic at word level? "This is a sentence" \["T… --- ## [Direct link to doc & get index pattern ID of \*](https://discuss.elastic.co/t/direct-link-to-doc-get-index-pattern-id-of/278663)
**Author:** [@amit.haim](https://discuss.elastic.co/u/amit.haim)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 1:46pm UTC](https://discuss.elastic.co/t/direct-link-to-doc-get-index-pattern-id-of/278663 "2021-07-20T13:46:22Z")
Hi everyone, I didn't found any solution online yet: Is it possible to get a direct link to elastic doc by the \_id arg? Is it possible to get the index pattern ID of \*? thank you all --- ## [How to Upload Old logs (Which are deleted/missed)](https://discuss.elastic.co/t/how-to-upload-old-logs-which-are-deleted-missed/279163)
**Author:** [@rajuk](https://discuss.elastic.co/u/rajuk)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-upload-old-logs-which-are-deleted-missed/279163 "2021-07-20T13:29:45Z")
Hello, I am using an AWS ES, logstash, and Filebeat. Recently we lost/missed the one-week data due to the logstash down. Can someone suggest how to upload the old deleted/missed data. Appreciate Your suggestions. Th… --- ## [Filter with regex to select lines that contain a certain word type](https://discuss.elastic.co/t/filter-with-regex-to-select-lines-that-contain-a-certain-word-type/279162)
**Author:** [@boubou](https://discuss.elastic.co/u/boubou)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 1:27pm UTC](https://discuss.elastic.co/t/filter-with-regex-to-select-lines-that-contain-a-certain-word-type/279162 "2021-07-20T13:27:00Z")
Hello, I would like to know if it is possible to make a filter, in kibana, which contain the word "error". Indeed, I have in a log field (named "message") lines similar to these : message: ANS2832E Incremental snapsh… --- ## [Wildcard search only returns partial results](https://discuss.elastic.co/t/wildcard-search-only-returns-partial-results/279069)
**Author:** [@muns](https://discuss.elastic.co/u/muns)\ **Replies:** 4\ **Last updated:** [July 20, 2021, 12:54pm UTC](https://discuss.elastic.co/t/wildcard-search-only-returns-partial-results/279069 "2021-07-20T12:54:03Z")
Hello, i have the following NEST query and my issue is that the wildcard search is only performed on the last field, "title". It ignores the author and subject fields, even though it should be returning data because ther… --- ## [IO Reactor errors closing connection](https://discuss.elastic.co/t/io-reactor-errors-closing-connection/279148)
**Author:** [@Mariusz\_Pala](https://discuss.elastic.co/u/Mariusz_Pala)\ **Replies:** 11\ **Last updated:** [July 20, 2021, 12:18pm UTC](https://discuss.elastic.co/t/io-reactor-errors-closing-connection/279148 "2021-07-20T12:18:22Z")
Hi, I asked ES about the IOReactor connection issues(Request cannot be executed; I/O reactor status: STOPPED) and as per an answer in my ticket RestHighLevelClient disconnection issues · Issue #75364 · elastic/elasticse… --- ## [Time control panel in dashboard](https://discuss.elastic.co/t/time-control-panel-in-dashboard/278948)
**Author:** [@Jihed\_BACCOUCHE](https://discuss.elastic.co/u/Jihed_BACCOUCHE)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 12:02pm UTC](https://discuss.elastic.co/t/time-control-panel-in-dashboard/278948 "2021-07-20T12:02:14Z")
hiii, please I want to add a control panel in my dashboard according to a date field in my data which is of type timestamp i want an option that give me the Opportunity to select a date from a calendar o something saim… --- ## [Date Time parsing problems](https://discuss.elastic.co/t/date-time-parsing-problems/279088)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 6\ **Last updated:** [July 20, 2021, 11:38am UTC](https://discuss.elastic.co/t/date-time-parsing-problems/279088 "2021-07-20T11:38:09Z")
Hello I have a bunch of dates to sort, this is the format I have: 2018-05-12 00:00pm GMT (always 00:00pm) 2021-04-01 1:17am GMT If I try to ingest with no template, elasticsearch detects them as a string, but if I map… --- ## [I want to Filter the Visualization only with one controller](https://discuss.elastic.co/t/i-want-to-filter-the-visualization-only-with-one-controller/278171)
**Author:** [@aswanth\_jabba](https://discuss.elastic.co/u/aswanth_jabba)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 11:35am UTC](https://discuss.elastic.co/t/i-want-to-filter-the-visualization-only-with-one-controller/278171 "2021-07-20T11:35:55Z")
I am using TSVB for Visualization. I want the visualization should be filtered only based of the Agile Release Train and ignore remaining Filters (Program Increment, Iteration). Ignore Global Filter wouldn't work be… --- ## [How do I change text size canvas kibana filter time](https://discuss.elastic.co/t/how-do-i-change-text-size-canvas-kibana-filter-time/278828)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 11:24am UTC](https://discuss.elastic.co/t/how-do-i-change-text-size-canvas-kibana-filter-time/278828 "2021-07-20T11:24:42Z")
How do I change text size canvas kibana filter time --- ## [Does donut chart available with ranking?](https://discuss.elastic.co/t/does-donut-chart-available-with-ranking/278608)
**Author:** [@paigekim](https://discuss.elastic.co/u/paigekim)\ **Replies:** 1\ **Last updated:** [July 20, 2021, 11:12am UTC](https://discuss.elastic.co/t/does-donut-chart-available-with-ranking/278608 "2021-07-20T11:12:57Z")
Hello, I am currently drawing the top 50 revenue. I am just wondering whether I can add a ranking next to each title of legend so that it would be easier to recognize the ranking of each portion. Current legend shows it… --- ## [What happens with my message field if I use decode\_json\_fields processor?](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279036)
**Author:** [@testisnullus](https://discuss.elastic.co/u/testisnullus)\ **Replies:** 2\ **Last updated:** [July 20, 2021, 11:07am UTC](https://discuss.elastic.co/t/what-happens-with-my-message-field-if-i-use-decode-json-fields-processor/279036 "2021-07-20T11:07:26Z")
Hi all! I have the next message field: message: {"app":"rbac","args":\[\],"commandTag":null,"fields.time":353859,"file":"adapter.go","func":"Log","level":"info","msg":"Exec","pid":28700,"sql":";","time":"2021-07-20T07:59… --- ## [Visualize - How to visualize on a field using fuzzy logic](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072)
**Author:** [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\ **Replies:** 5\ **Last updated:** [July 20, 2021, 11:06am UTC](https://discuss.elastic.co/t/visualize-how-to-visualize-on-a-field-using-fuzzy-logic/279072 "2021-07-20T11:06:57Z")
Hi All This might be a bit of a strange question and hopefully someone can just point me straight at some documentation. I want to visualize on a text field where I know that part of the message will contain a fixed str… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1313) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1315)