# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1352 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1353 --- ## [Why using \`fields\` changes the behavior of default operator?](https://discuss.elastic.co/t/why-using-fields-changes-the-behavior-of-default-operator/276840)
**Author:** [@iLemming](https://discuss.elastic.co/u/iLemming)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 7:12pm UTC](https://discuss.elastic.co/t/why-using-fields-changes-the-behavior-of-default-operator/276840 "2021-06-23T19:12:44Z")
I have encountered a strange thing while trying to use fields: option in a "query\_string" query: Let's assume we have an entity and when using a query such as: "query\_string" : { "default\_operator" : "AND", "qu… --- ## [How to modify visualisations from Kibana in Canvas?](https://discuss.elastic.co/t/how-to-modify-visualisations-from-kibana-in-canvas/275843)
**Author:** [@cass](https://discuss.elastic.co/u/cass)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 6:44pm UTC](https://discuss.elastic.co/t/how-to-modify-visualisations-from-kibana-in-canvas/275843 "2021-06-23T18:44:04Z")
Hello everyone, I am creating a report with Canvas. I'm adding charts that I've already created in Visualize and I would like to know if it's possible to: modify the color used in the legend of the chart; remove the … --- ## [How to disable user interaction with an embedded (iframe) visualization](https://discuss.elastic.co/t/how-to-disable-user-interaction-with-an-embedded-iframe-visualization/276811)
**Author:** [@Kostas\_elastic](https://discuss.elastic.co/u/Kostas_elastic)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 6:22pm UTC](https://discuss.elastic.co/t/how-to-disable-user-interaction-with-an-embedded-iframe-visualization/276811 "2021-06-23T18:22:52Z")
Hi all, I have embedded with Iframes a kibana visualization into a web page. Is there any way to disable certain user actions that interact with the visualization? For example, to disable the users' ability to scroll, f… --- ## [Ruby exceptions logstash](https://discuss.elastic.co/t/ruby-exceptions-logstash/276829)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 6:19pm UTC](https://discuss.elastic.co/t/ruby-exceptions-logstash/276829 "2021-06-23T18:19:24Z")
Hi all, i'm in trouble with Ruby exceptions i get 2 types of exceptions: \[ERROR\]\[logstash.filters.ruby \]\[windows-patching\]\[7da18e5397d31e1f8d249dc2ef273bcbcc32d26e064f064c3138ef1bcbc3c2a0\] Ruby exception occurred: … --- ## [Visualize how much time (24h) processes took on the server](https://discuss.elastic.co/t/visualize-how-much-time-24h-processes-took-on-the-server/276728)
**Author:** [@kwoxer](https://discuss.elastic.co/u/kwoxer)\ **Replies:** 5\ **Last updated:** [June 23, 2021, 5:24pm UTC](https://discuss.elastic.co/t/visualize-how-much-time-24h-processes-took-on-the-server/276728 "2021-06-23T17:24:29Z")
I would like to have a diagram like this But I was only able to get this one This is the defined fields: So my question are: how can I show hours instead of the second? how to have bars that show the second… --- ## [Adding prefex to the field extracted via KV plugin](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 5:18pm UTC](https://discuss.elastic.co/t/adding-prefex-to-the-field-extracted-via-kv-plugin/276621 "2021-06-23T17:18:55Z")
Hello every body, Apr 1 15:00:01 pc-tst cft: 21/04/20 00:00:00 CFTC12I IDTU=A0007GK PART=LKOR STATE=Y PHASE=Y PHASESTEP=C DIRECT=S TYPE=F SENTINEL\_STATE=POST\_PROC Deleted Is there a method to rename the fields extr… --- ## [Logstash Per Pipeline logs update?](https://discuss.elastic.co/t/logstash-per-pipeline-logs-update/276751)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 4:58pm UTC](https://discuss.elastic.co/t/logstash-per-pipeline-logs-update/276751 "2021-06-23T16:58:19Z")
Hi everyone! Saw this thread. Now I'd like to know if do we have any update on logstash's per pipeline logfiles? --- ## [Most visited domains (IPs)](https://discuss.elastic.co/t/most-visited-domains-ips/276761)
**Author:** [@\_codex](https://discuss.elastic.co/u/_codex)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 4:50pm UTC](https://discuss.elastic.co/t/most-visited-domains-ips/276761 "2021-06-23T16:50:17Z")
Hello good people of the internet, Firstly I know how FRUSTRATING it is to answer stupid questions regarding technical stuff however I am in charge of SOC for our company and we have just changed from SPLUNK to Kibana 7… --- ## [Write slow on elastic cluster](https://discuss.elastic.co/t/write-slow-on-elastic-cluster/276622)
**Author:** [@Sunil\_Chand](https://discuss.elastic.co/u/Sunil_Chand)\ **Replies:** 11\ **Last updated:** [June 23, 2021, 4:18pm UTC](https://discuss.elastic.co/t/write-slow-on-elastic-cluster/276622 "2021-06-23T16:18:36Z")
Hi All One of clusters has the following specs 8 nodes (8 data and 5 master eligible) each with 15GB heap space running on servers with 32GB of RAM. Elasticsearch version 7.6.2 on linux each node has 8 TB of space a… --- ## [\[KBN-ES Development\] yarn es snapshot doesn't work](https://discuss.elastic.co/t/kbn-es-development-yarn-es-snapshot-doesnt-work/276798)
**Author:** [@Flavio1](https://discuss.elastic.co/u/Flavio1)\ **Replies:** 6\ **Last updated:** [June 23, 2021, 3:54pm UTC](https://discuss.elastic.co/t/kbn-es-development-yarn-es-snapshot-doesnt-work/276798 "2021-06-23T15:54:41Z")
Hi all, i'm trying to start kbn development enviroment to create my first plugin. I follow the guide in this link: getting started fork from kibana repo clone the repo on my local bootstrap kibana I can bootstrap pr… --- ## [How can I import data that belongs to array?](https://discuss.elastic.co/t/how-can-i-import-data-that-belongs-to-array/276818)
**Author:** [@111485](https://discuss.elastic.co/u/111485)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 3:50pm UTC](https://discuss.elastic.co/t/how-can-i-import-data-that-belongs-to-array/276818 "2021-06-23T15:50:47Z")
I want to separate STRING into ARRAY and get a count. The example is as follows. (Table) Name Count MG3 | 2 MG4 | 1 When set through KIBANA LENS, it is only enabled as a keyword, and when set, only the count of … --- ## [Help with elesticsearch and metricbeat](https://discuss.elastic.co/t/help-with-elesticsearch-and-metricbeat/276192)
**Author:** [@Gustavo\_Lira](https://discuss.elastic.co/u/Gustavo_Lira)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 3:30pm UTC](https://discuss.elastic.co/t/help-with-elesticsearch-and-metricbeat/276192 "2021-06-23T15:30:50Z")
I am configuring metricbeat in a node with windows 10 to connect with elasticsearch and kibana, both are configured in a single computer but it does not throw me data in kibana, I attach configuration of metricbeat.yml, … --- ## [Metricbeat elasticsearch module and SSL configuration](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-and-ssl-configuration/274532)
**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 10:12am UTC](https://discuss.elastic.co/t/metricbeat-elasticsearch-module-and-ssl-configuration/274532 "2021-06-23T10:12:27Z")
tl;dr: I'm having trouble getting metricbeat elasticsearch module to work properly after enabling ssl. Background I followed the tutorials to get ssl/tls set up on my test cluster. There is one node that is the elastic… --- ## [FATAL CLI ERROR YAMLException: can not read a block mapping entry; a multiline key may not be an implicit key at line 32, column 1:](https://discuss.elastic.co/t/fatal-cli-error-yamlexception-can-not-read-a-block-mapping-entry-a-multiline-key-may-not-be-an-implicit-key-at-line-32-column-1/276796)
**Author:** [@bera5186](https://discuss.elastic.co/u/bera5186)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 1:30pm UTC](https://discuss.elastic.co/t/fatal-cli-error-yamlexception-can-not-read-a-block-mapping-entry-a-multiline-key-may-not-be-an-implicit-key-at-line-32-column-1/276796 "2021-06-23T13:30:31Z")
I am getting this error while running kibana and inspecting kibana logs with journalctl -u kibana I am starting kibana with sudo systemctl start kibana Kibana version 7.10 link to my kibana.yml    /var/log… --- ## [Help with resetting credentials not understanding how to](https://discuss.elastic.co/t/help-with-resetting-credentials-not-understanding-how-to/276810)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 2:39pm UTC](https://discuss.elastic.co/t/help-with-resetting-credentials-not-understanding-how-to/276810 "2021-06-23T14:39:00Z")
Hello, I've taken over an ES cluster with Kibana and the person who was setting this cluster up is no longer around and unable to lean on for information. The issue we are running into is authentication. Before the cl… --- ## [Resize Lens visualization in Canvas](https://discuss.elastic.co/t/resize-lens-visualization-in-canvas/276799)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 2:37pm UTC](https://discuss.elastic.co/t/resize-lens-visualization-in-canvas/276799 "2021-06-23T14:37:14Z")
Hi, I put a Lens Treemap on my Canvas and tried to resize it with the drag and drop controls, but I found that I couldn't stretch it beyond my screen size. Also, this method is not too exact, is there a way to specify t… --- ## [Removal of non-inclusive terms "whitelist" with neutral language](https://discuss.elastic.co/t/removal-of-non-inclusive-terms-whitelist-with-neutral-language/276780)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 1:42pm UTC](https://discuss.elastic.co/t/removal-of-non-inclusive-terms-whitelist-with-neutral-language/276780 "2021-06-23T13:42:20Z")
Hi, Kibana has a configuration property elasticsearch.requestHeadersWhitelist. There are concerns raised on usage of this non-inclusive terminology. Linux team has approved on replacing these non-inclusive terminologie… --- ## [How to remove "dotted border" from visualizations when imported to Canvas Workpads?](https://discuss.elastic.co/t/how-to-remove-dotted-border-from-visualizations-when-imported-to-canvas-workpads/276785)
**Author:** [@jamesraznor](https://discuss.elastic.co/u/jamesraznor)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 1:39pm UTC](https://discuss.elastic.co/t/how-to-remove-dotted-border-from-visualizations-when-imported-to-canvas-workpads/276785 "2021-06-23T13:39:16Z")
Hi, After update to 7.13 all visualisations in Canvas Workpads are dotted around, there's a way to remove it? --- ## [Lens Visualization](https://discuss.elastic.co/t/lens-visualization/276789)
**Author:** [@Prasanth\_V](https://discuss.elastic.co/u/Prasanth_V)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 1:38pm UTC](https://discuss.elastic.co/t/lens-visualization/276789 "2021-06-23T13:38:29Z")
How to redirect the particular dashboard URL using lens visualization??? --- ## [Logstash GeoIP Kibana point-to-point maps problems](https://discuss.elastic.co/t/logstash-geoip-kibana-point-to-point-maps-problems/276783)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 11:32am UTC](https://discuss.elastic.co/t/logstash-geoip-kibana-point-to-point-maps-problems/276783 "2021-06-23T11:32:01Z")
I have Logstash with Geoip enabled and even having everything correctly it tells me that I don't have the correct index selected for the creation of map Point to point, as you can see: Code: input { file { … --- ## [How to modify multiple index names in Elasticsearch](https://discuss.elastic.co/t/how-to-modify-multiple-index-names-in-elasticsearch/276664)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 5\ **Last updated:** [June 23, 2021, 1:29pm UTC](https://discuss.elastic.co/t/how-to-modify-multiple-index-names-in-elasticsearch/276664 "2021-06-23T13:29:22Z")
I have indices like below, europe\_serbia\_people europe\_germany\_people etc. (I have a lot of indices) I want to change all indices with putting "old" keyword to end of indices. I mean the indices that starts with euro… --- ## [Simple Query (1 cardinality, 19,000 docs) takes ~100k ms to complete](https://discuss.elastic.co/t/simple-query-1-cardinality-19-000-docs-takes-100k-ms-to-complete/276654)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 12:58pm UTC](https://discuss.elastic.co/t/simple-query-1-cardinality-19-000-docs-takes-100k-ms-to-complete/276654 "2021-06-23T12:58:35Z")
Hi All, Elasticsearch: 7.13.2 I am wondering if anyone could help provide some input into an issue that I'm seeing. I am using a fairly simple query: Query is executed against filebeat-\* "query": { "bool": { … --- ## [Problem with sharing kibana link after enabling state:storeInSessionStorage](https://discuss.elastic.co/t/problem-with-sharing-kibana-link-after-enabling-state-storeinsessionstorage/276627)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 12:46pm UTC](https://discuss.elastic.co/t/problem-with-sharing-kibana-link-after-enabling-state-storeinsessionstorage/276627 "2021-06-23T12:46:04Z")
Hi, I have created a filter in kibana which makes the URL very big so I enabled state:storeInSessionStorageand it works fine. The problem though is that when I share this link or paste it into another tab I have an err… --- ## [What causes the count function to return an empty result](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613)
**Author:** [@RhodesOfficial](https://discuss.elastic.co/u/RhodesOfficial)\ **Replies:** 9\ **Last updated:** [June 23, 2021, 12:33pm UTC](https://discuss.elastic.co/t/what-causes-the-count-function-to-return-an-empty-result/276613 "2021-06-23T12:33:08Z")
I have a complex query statement（some data were desensitized）, but count (1) returns an empty result. NPE occurs in my code. So what causes this result？ Thank you for answering my question！ --- ## [After reindex, new index has same documents but data size is much less](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768)
**Author:** [@Rosita\_Andrade](https://discuss.elastic.co/u/Rosita_Andrade)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/276768 "2021-06-23T12:06:41Z")
Hi, This seems to be a similar case as After reindex, new index has same documents but data size is much less. I used the Reindex API and my new index is significantly smaller in size. I have a feeling, that it might b… --- ## [Multi fields, multi prefixes search](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504)
**Author:** [@janlmpn](https://discuss.elastic.co/u/janlmpn)\ **Replies:** 3\ **Last updated:** [June 23, 2021, 11:49am UTC](https://discuss.elastic.co/t/multi-fields-multi-prefixes-search/276504 "2021-06-23T11:49:01Z")
Hello All, hope someone can enlighten me on this one. Suppose I have the following data: { "index": { "\_index": "courses\_test", "\_id": 1 } } { "Course Name": "Bachelor of Arts in Music", "Job Role": "Theatre & Media Dir… --- ## [Adding Threat Intel fields in Elasticsearch data](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782)
**Author:** [@Naveen\_Kumar\_Reddy\_S](https://discuss.elastic.co/u/Naveen_Kumar_Reddy_S)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 11:25am UTC](https://discuss.elastic.co/t/adding-threat-intel-fields-in-elasticsearch-data/276782 "2021-06-23T11:25:15Z")
How we can add threat intel data for elastic agent logs before they are entering into the Elasticsearch cluster? I am trying to add some new fields to each log before based on the details present in that logs. Example:… --- ## [How do I include the date and image without markdown](https://discuss.elastic.co/t/how-do-i-include-the-date-and-image-without-markdown/276142)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 11:11am UTC](https://discuss.elastic.co/t/how-do-i-include-the-date-and-image-without-markdown/276142 "2021-06-23T11:11:42Z")
I need that when I make a filter on the date what is written in the markdown appears with this information, and I would also like to include a logo. follow image --- ## [Elastic Agent vs Fluentd/Fluentbit](https://discuss.elastic.co/t/elastic-agent-vs-fluentd-fluentbit/276762)
**Author:** [@CyberWarriorBob](https://discuss.elastic.co/u/CyberWarriorBob)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 9:31am UTC](https://discuss.elastic.co/t/elastic-agent-vs-fluentd-fluentbit/276762 "2021-06-23T09:31:23Z")
I am unsure if this is the right platform to ask this, but here it goes - I am trying to find out what are the differences between Elastic Agent and Fluentd/Fluentbit, I am trying to find out also if it worth the change… --- ## [Exporting snapshot for security and hot backup](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767)
**Author:** [@Bibas](https://discuss.elastic.co/u/Bibas)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 10:14am UTC](https://discuss.elastic.co/t/exporting-snapshot-for-security-and-hot-backup/276767 "2021-06-23T10:14:49Z")
Hello ! I have 2 question : I know that snapshot and restore is the best way to backup an elasticsearch cluster, but since my ES is running inside a docker container which have a named volume, is it possible to back… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1351) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1353)