# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=136

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 137

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/370637)

<div class="topic-metadata">

**Author:** [@Vo\_Phan](https://discuss.elastic.co/u/Vo_Phan)\
**Replies:** 1\
**Last updated:** [November 16, 2024, 10:21am UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/370637 "2024-11-16T10:21:03Z")

</div>

my server is down need urgent support

---

## [Metricbeat number value in decimal or percentage](https://discuss.elastic.co/t/metricbeat-number-value-in-decimal-or-percentage/368895)

<div class="topic-metadata">

**Author:** [@JT\_IGS](https://discuss.elastic.co/u/JT_IGS)\
**Replies:** 1\
**Last updated:** [November 16, 2024, 6:29am UTC](https://discuss.elastic.co/t/metricbeat-number-value-in-decimal-or-percentage/368895 "2024-11-16T06:29:38Z")

</div>

Have setup three data centers of ES and kibana and metricbeat under the data center would send data to current data center ES. All settings should be the same. However, found a strange behavior that two kibana show pe…

---

## [Metricbeat SQL Module - Elastic Agent Equivalent?](https://discuss.elastic.co/t/metricbeat-sql-module-elastic-agent-equivalent/370630)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 1\
**Last updated:** [November 16, 2024, 5:30am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-elastic-agent-equivalent/370630 "2024-11-16T05:30:56Z")

</div>

Hello we are in the process of migrating from Beats to Elastic Agent. Is there an equivalent to SQL module from Beats where you can query a database and ingest the data into elasticsearch?

---

## [Migration path/plan from Heartbeat uptime to Synthetics App does not exist](https://discuss.elastic.co/t/migration-path-plan-from-heartbeat-uptime-to-synthetics-app-does-not-exist/370628)

<div class="topic-metadata">

**Author:** [@FaizanGit](https://discuss.elastic.co/u/FaizanGit)\
**Replies:** 0\
**Last updated:** [November 15, 2024, 10:15pm UTC](https://discuss.elastic.co/t/migration-path-plan-from-heartbeat-uptime-to-synthetics-app-does-not-exist/370628 "2024-11-15T22:15:18Z")

</div>

Is there a migration path/plan for customers who are currently using Heartbeat Uptime App, and have to start using Synthetic App due to deprecation announcement from Elasticsearch? I am referring to Uptime monitoring de…

---

## [Can not create SSL for Elasticsearch and Kibana when deploying in AWS lighsail using docker](https://discuss.elastic.co/t/can-not-create-ssl-for-elasticsearch-and-kibana-when-deploying-in-aws-lighsail-using-docker/370629)

<div class="topic-metadata">

**Author:** [@Vamsi\_Popuri](https://discuss.elastic.co/u/Vamsi_Popuri)\
**Replies:** 0\
**Last updated:** [November 15, 2024, 10:28pm UTC](https://discuss.elastic.co/t/can-not-create-ssl-for-elasticsearch-and-kibana-when-deploying-in-aws-lighsail-using-docker/370629 "2024-11-15T22:28:42Z")

</div>

Hi all, I am trying to deploy Elasticsearch and Kibana in Ubuntu lightsail instance using docker. This might be very minor issue, but i am trying different methods from past 2 days and i am struck and any help will be a…

---

## [Extend trial license urgent request](https://discuss.elastic.co/t/extend-trial-license-urgent-request/370578)

<div class="topic-metadata">

**Author:** [@pranchalm](https://discuss.elastic.co/u/pranchalm)\
**Replies:** 3\
**Last updated:** [November 15, 2024, 5:56pm UTC](https://discuss.elastic.co/t/extend-trial-license-urgent-request/370578 "2024-11-15T17:56:33Z")

</div>

Hi team, Requesting to extend my trial license period, i am currently a masters student, i am developing a tool where i am making use of elastic-search's 8.15.0 trial license active features, and i have a demo upcoming …

---

## [Heartbeat tcp type monitor errors with io read tcp, i/o timeout](https://discuss.elastic.co/t/heartbeat-tcp-type-monitor-errors-with-io-read-tcp-i-o-timeout/370141)

<div class="topic-metadata">

**Author:** [@FaizanGit](https://discuss.elastic.co/u/FaizanGit)\
**Replies:** 2\
**Last updated:** [November 14, 2024, 10:50pm UTC](https://discuss.elastic.co/t/heartbeat-tcp-type-monitor-errors-with-io-read-tcp-i-o-timeout/370141 "2024-11-14T22:50:11Z")

</div>

I am using the Heartbeat version 8.6 and am connecting to self-managed elasticsearch version 8.11.4. Currently, I have over 60 http type monitors running and am successful in viewing their status in kibana. I added one…

---

## [Logstash file input periodically skips over files](https://discuss.elastic.co/t/logstash-file-input-periodically-skips-over-files/370583)

<div class="topic-metadata">

**Author:** [@ddiguru](https://discuss.elastic.co/u/ddiguru)\
**Replies:** 7\
**Last updated:** [November 15, 2024, 5:02pm UTC](https://discuss.elastic.co/t/logstash-file-input-periodically-skips-over-files/370583 "2024-11-15T17:02:54Z")

</div>

I am attempting to use the file input module to "watch" a directory for inbound files. Gzipped log files are shipped to this directory from various remote hosts, and the file input picks them up, decompresses or processe…

---

## [Metricbeat/Elastic Agent - How to get Filesystem Label](https://discuss.elastic.co/t/metricbeat-elastic-agent-how-to-get-filesystem-label/370615)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 0\
**Last updated:** [November 15, 2024, 4:25pm UTC](https://discuss.elastic.co/t/metricbeat-elastic-agent-how-to-get-filesystem-label/370615 "2024-11-15T16:25:00Z")

</div>

I understand with filesystem metricset you can grab the drive letter or the mount point to be exact. Is there a way to grab the filesystem label like this:

---

## [Alerting - Filter Query not working](https://discuss.elastic.co/t/alerting-filter-query-not-working/370612)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 3\
**Last updated:** [November 15, 2024, 3:59pm UTC](https://discuss.elastic.co/t/alerting-filter-query-not-working/370612 "2024-11-15T15:59:55Z")

</div>

Hello, I was testing out the Metric Threshold to alert on disk usage. I want to exclude some hosts from the alert, but I seem to get this error

---

## [Elasticsearch is about to reach the maximum number of shards it can host, based on your current settings](https://discuss.elastic.co/t/elasticsearch-is-about-to-reach-the-maximum-number-of-shards-it-can-host-based-on-your-current-settings/370561)

<div class="topic-metadata">

**Author:** [@Arianit](https://discuss.elastic.co/u/Arianit)\
**Replies:** 2\
**Last updated:** [November 15, 2024, 3:29pm UTC](https://discuss.elastic.co/t/elasticsearch-is-about-to-reach-the-maximum-number-of-shards-it-can-host-based-on-your-current-settings/370561 "2024-11-15T15:29:10Z")

</div>

Can this issue cause problem that it doesnt show log in Kibana. ps. Im new in elastic.

---

## [Line - Lens Issue](https://discuss.elastic.co/t/line-lens-issue/369301)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 2\
**Last updated:** [November 15, 2024, 3:14pm UTC](https://discuss.elastic.co/t/line-lens-issue/369301 "2024-11-15T15:14:50Z")

</div>

Hello, we upgraded recently to 8.15.3 It looks like some line graphs changed to dots: why is that?

---

## [Self Managed - Solution View Release](https://discuss.elastic.co/t/self-managed-solution-view-release/370584)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 2\
**Last updated:** [November 15, 2024, 3:09pm UTC](https://discuss.elastic.co/t/self-managed-solution-view-release/370584 "2024-11-15T15:09:45Z")

</div>

Hello, I understand that Solution Views are currently under Cloud-Hosted environments, but Self-Managed customers would love to use them. When can we expect to see this? Sorry, I am impatient. I just really like …

---

## [Drill Down with timestamps](https://discuss.elastic.co/t/drill-down-with-timestamps/361574)

<div class="topic-metadata">

**Author:** [@Madeline\_Nguyen](https://discuss.elastic.co/u/Madeline_Nguyen)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:29pm UTC](https://discuss.elastic.co/t/drill-down-with-timestamps/361574 "2024-11-15T14:29:46Z")

</div>

Greetings all, I'm doing some stuff with drill down topics and I have a requirement of making links from dashboard to data table that including the timestamp set on the dashboard too. Are there any possible solutions f…

---

## [Taking ratio of two series in TSVB](https://discuss.elastic.co/t/taking-ratio-of-two-series-in-tsvb/368256)

<div class="topic-metadata">

**Author:** [@smondal](https://discuss.elastic.co/u/smondal)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:17pm UTC](https://discuss.elastic.co/t/taking-ratio-of-two-series-in-tsvb/368256 "2024-11-15T14:17:37Z")

</div>

I am trying to create a line chart in TSVB which is the ratio of "Numerator" and "Denominator" defined as follows: Added a series called "Numerator" by first creating a metric with aggregation = "Cardinality" on a fiel…

---

## [Exporting visualisations' data](https://discuss.elastic.co/t/exporting-visualisations-data/366547)

<div class="topic-metadata">

**Author:** [@Nikita\_Vasyliev](https://discuss.elastic.co/u/Nikita_Vasyliev)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:16pm UTC](https://discuss.elastic.co/t/exporting-visualisations-data/366547 "2024-11-15T14:16:04Z")

</div>

Hi, I'm curious is there an automated way to get the data from the visualisation? Attaching the screenshot of what I mean My goal is to get the 'response' object of the Kibana visualisation in JSON/CSV format. I also…

---

## [Lens - Pie Legend Location](https://discuss.elastic.co/t/lens-pie-legend-location/363159)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:13pm UTC](https://discuss.elastic.co/t/lens-pie-legend-location/363159 "2024-11-15T14:13:01Z")

</div>

Hello, Wasn't there used to be an option on where you can place the legend? Seems to be gone? Kibana/Elasticsearch : 8.14.3

---

## [Styling specific elements in a Kibana dashboard](https://discuss.elastic.co/t/styling-specific-elements-in-a-kibana-dashboard/360532)

<div class="topic-metadata">

**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:11pm UTC](https://discuss.elastic.co/t/styling-specific-elements-in-a-kibana-dashboard/360532 "2024-11-15T14:11:45Z")

</div>

Is there a way to change the styling of a Kibana dashboard, for example, changing the font color, size, weight, etc. of specific elements. Like we can do using CSS?

---

## [Moving average count based if greater than upper threshold then red color if moving avg count if lower threshold then blue color in kibana formula or vertical bar chart](https://discuss.elastic.co/t/moving-average-count-based-if-greater-than-upper-threshold-then-red-color-if-moving-avg-count-if-lower-threshold-then-blue-color-in-kibana-formula-or-vertical-bar-chart/359938)

<div class="topic-metadata">

**Author:** [@Ravisankar123](https://discuss.elastic.co/u/Ravisankar123)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:10pm UTC](https://discuss.elastic.co/t/moving-average-count-based-if-greater-than-upper-threshold-then-red-color-if-moving-avg-count-if-lower-threshold-then-blue-color-in-kibana-formula-or-vertical-bar-chart/359938 "2024-11-15T14:10:04Z")

</div>

Moving average count based if greater than upper threshold then red color if moving avg count if lower threshold then blue color in kibana formula or vertical bar chart in kibana

---

## [Kibana Visualization: average of the 99th percentile](https://discuss.elastic.co/t/kibana-visualization-average-of-the-99th-percentile/364663)

<div class="topic-metadata">

**Author:** [@Ehab\_Arman](https://discuss.elastic.co/u/Ehab_Arman)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:06pm UTC](https://discuss.elastic.co/t/kibana-visualization-average-of-the-99th-percentile/364663 "2024-11-15T14:06:49Z")

</div>

Hello Kibana experts, I am new to Elastic and been playing around with Kibana dashboard visualization. One thing I am trying to do is to create a dashboard to display the 99th percentile of total latency. What I expect…

---

## [Create new filters on an index](https://discuss.elastic.co/t/create-new-filters-on-an-index/364804)

<div class="topic-metadata">

**Author:** [@jaime\_solas](https://discuss.elastic.co/u/jaime_solas)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:05pm UTC](https://discuss.elastic.co/t/create-new-filters-on-an-index/364804 "2024-11-15T14:05:53Z")

</div>

I have done the ingestion from logstash for elastic, but I try to filter and I don't know how to do it, the ingestion has been based on an xml file like the following \<?xml version="1.0" encoding="UTF-8"?\>\<html xmlns="h…

---

## [Table aggregation](https://discuss.elastic.co/t/table-aggregation/370577)

<div class="topic-metadata">

**Author:** [@nnikushkin](https://discuss.elastic.co/u/nnikushkin)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 2:04pm UTC](https://discuss.elastic.co/t/table-aggregation/370577 "2024-11-15T14:04:53Z")

</div>

Hello! Here is the initial data: POST someindex/\_doc { "name": "Amsterdam", "documents": { "locations": \[ { "category": "aaa", "url": "https://aaa1.com" }, { "category"…

---

## [Visualisation challenge - not able to include documents without field](https://discuss.elastic.co/t/visualisation-challenge-not-able-to-include-documents-without-field/367156)

<div class="topic-metadata">

**Author:** [@Damir\_Ciganovic-Jank](https://discuss.elastic.co/u/Damir_Ciganovic-Jank)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 1:13pm UTC](https://discuss.elastic.co/t/visualisation-challenge-not-able-to-include-documents-without-field/367156 "2024-11-15T13:13:44Z")

</div>

Hello, first time poster here so be gentle with me :slight\_smile: When creating a Visualisation (for example: Lens - Top Values), there is an option to pick a field and in "Advanced" section to check "Include documents …

---

## [Performance Issue with Single-Type Index vs. Multi-Type Index in Elasticsearch](https://discuss.elastic.co/t/performance-issue-with-single-type-index-vs-multi-type-index-in-elasticsearch/370604)

<div class="topic-metadata">

**Author:** [@HARSHAL\_CHAUDHARI](https://discuss.elastic.co/u/HARSHAL_CHAUDHARI)\
**Replies:** 1\
**Last updated:** [November 15, 2024, 1:08pm UTC](https://discuss.elastic.co/t/performance-issue-with-single-type-index-vs-multi-type-index-in-elasticsearch/370604 "2024-11-15T13:08:44Z")

</div>

I have a scenario where I initially created an index with a single type, and later, I created a new index by combining multiple types into one index. During performance testing, I've noticed that the index with a single …

---

## [Logstash sizing for a large environment](https://discuss.elastic.co/t/logstash-sizing-for-a-large-environment/370558)

<div class="topic-metadata">

**Author:** [@liuke](https://discuss.elastic.co/u/liuke)\
**Replies:** 3\
**Last updated:** [November 15, 2024, 10:25am UTC](https://discuss.elastic.co/t/logstash-sizing-for-a-large-environment/370558 "2024-11-15T10:25:07Z")

</div>

Hello everyone, i'm trying to setup an ELK stack that has to receive approximately 4.5TB of events per day, with peaks of 100k EPS during working hours. The collection must be done using logstash and all the events will…

---

## [Can't get host.name from filebeat input by journad mode](https://discuss.elastic.co/t/cant-get-host-name-from-filebeat-input-by-journad-mode/370296)

<div class="topic-metadata">

**Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\
**Replies:** 9\
**Last updated:** [November 15, 2024, 7:41am UTC](https://discuss.elastic.co/t/cant-get-host-name-from-filebeat-input-by-journad-mode/370296 "2024-11-15T07:41:28Z")

</div>

Here we have a journald remote server, which holds all uploaded jourand logs from different host. And it's fed to filebeat as input. And in kibana, I only see all the logs with host.name as this log server's hostname. It…

---

## [Cannot connect to Kibana(no response)](https://discuss.elastic.co/t/cannot-connect-to-kibana-no-response/370585)

<div class="topic-metadata">

**Author:** [@chung](https://discuss.elastic.co/u/chung)\
**Replies:** 4\
**Last updated:** [November 15, 2024, 5:08am UTC](https://discuss.elastic.co/t/cannot-connect-to-kibana-no-response/370585 "2024-11-15T05:08:52Z")

</div>

I installed Elasticsearch 8.16 successfully ❯ curl localhost:9200 { "name" : "debian", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "8bKtWy\_zTImqaRYnzC453g", "version" : { "number" : "8.16.0", "bui…

---

## [\[idea\] Would creating "indexes" as "aliases" by default make sense?](https://discuss.elastic.co/t/idea-would-creating-indexes-as-aliases-by-default-make-sense/358993)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 2\
**Last updated:** [November 14, 2024, 9:22pm UTC](https://discuss.elastic.co/t/idea-would-creating-indexes-as-aliases-by-default-make-sense/358993 "2024-11-14T21:22:50Z")

</div>

As a follow up to my post on index renaming I had this idea. What if Elasticsearch created each index as an alias to the actual index in the first place? As in, when creating a new index, unless the user overrides it, …

---

## [GKE Elastic Agent, Ingest pipeline permissions question](https://discuss.elastic.co/t/gke-elastic-agent-ingest-pipeline-permissions-question/370571)

<div class="topic-metadata">

**Author:** [@marksie1988](https://discuss.elastic.co/u/marksie1988)\
**Replies:** 1\
**Last updated:** [November 14, 2024, 7:22pm UTC](https://discuss.elastic.co/t/gke-elastic-agent-ingest-pipeline-permissions-question/370571 "2024-11-14T19:22:56Z")

</div>

Hi All, I have elastic cloud, with the elastic-agent deployed in a kubernetes cluster, this has a GCP integration to get messages from pubsub. Once the agent gets the messages from pubsub i have an ingest pipeline that…

---

## [Slow indexing speed on just one index](https://discuss.elastic.co/t/slow-indexing-speed-on-just-one-index/369955)

<div class="topic-metadata">

**Author:** [@ivanlawrence](https://discuss.elastic.co/u/ivanlawrence)\
**Replies:** 19\
**Last updated:** [November 14, 2024, 6:36pm UTC](https://discuss.elastic.co/t/slow-indexing-speed-on-just-one-index/369955 "2024-11-14T18:36:22Z")

</div>

I looked around the internet and the forums but can't find something similar... Background I have a two data node cluster (and one tie-breaker) with about 10 indexes of all the same kind of documents (same properties). …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=135)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=137)
