# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1448 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1449 --- ## [Looking for a way to visualize this data](https://discuss.elastic.co/t/looking-for-a-way-to-visualize-this-data/269226)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 1\ **Last updated:** [April 23, 2021, 11:27am UTC](https://discuss.elastic.co/t/looking-for-a-way-to-visualize-this-data/269226 "2021-04-23T11:27:06Z")
Hi there, I have exported sleep data from my phone and am wondering if there is a way to visualize it with Kibana. It has multiple start and end times in every line. Here's an example: In bed start,In bed Finish,Minut… --- ## [Kibana tsvb export data](https://discuss.elastic.co/t/kibana-tsvb-export-data/269803)
**Author:** [@Pedro\_77](https://discuss.elastic.co/u/Pedro_77)\ **Replies:** 1\ **Last updated:** [April 23, 2021, 11:22am UTC](https://discuss.elastic.co/t/kibana-tsvb-export-data/269803 "2021-04-23T11:22:48Z")
Hello, I have created sla report using filter ratio aggregation. Is there any way to export this data (just sla value) as csv or any other format out of ELK? for example into Zabbix? Or maybe there is a way to create a… --- ## [Need help with creating a Gauge in visual builder](https://discuss.elastic.co/t/need-help-with-creating-a-gauge-in-visual-builder/269731)
**Author:** [@amitava\_mozumder](https://discuss.elastic.co/u/amitava_mozumder)\ **Replies:** 1\ **Last updated:** [April 23, 2021, 10:53am UTC](https://discuss.elastic.co/t/need-help-with-creating-a-gauge-in-visual-builder/269731 "2021-04-23T10:53:26Z")
i am trying to a create a Gauge type in Visual Builder in Kiabana, to display the ratio between two document counts of different filters. can someone tell me what format i need to put the values in the numerator and deno… --- ## [Kibana service restarting after few seconds](https://discuss.elastic.co/t/kibana-service-restarting-after-few-seconds/270418)
**Author:** [@prat](https://discuss.elastic.co/u/prat)\ **Replies:** 24\ **Last updated:** [April 23, 2021, 10:38am UTC](https://discuss.elastic.co/t/kibana-service-restarting-after-few-seconds/270418 "2021-04-23T10:38:52Z")
We have kibana 7.4 installed on two servers where elasticsearch is also installed. Kibana service is getting restarted after some time. Can someone please help. Here is the kibana config file - cat /etc/kibana/kibana.… --- ## [Agg count with range count](https://discuss.elastic.co/t/agg-count-with-range-count/271070)
**Author:** [@Charley\_Maillot](https://discuss.elastic.co/u/Charley_Maillot)\ **Replies:** 0\ **Last updated:** [April 23, 2021, 10:24am UTC](https://discuss.elastic.co/t/agg-count-with-range-count/271070 "2021-04-23T10:24:46Z")
Hello, My doc look like { "path": "/foo/bar", "userId" : "33", } I would like to have the number of userId who have more than 100 docs between 50 and 100 docs less than 100 docs I try to… --- ## [Vega - Multi-level Sankey in Kibana](https://discuss.elastic.co/t/vega-multi-level-sankey-in-kibana/269145)
**Author:** [@cpu](https://discuss.elastic.co/u/cpu)\ **Replies:** 2\ **Last updated:** [April 23, 2021, 10:12am UTC](https://discuss.elastic.co/t/vega-multi-level-sankey-in-kibana/269145 "2021-04-23T10:12:30Z")
Hi All, Trying to achieve multi-level sankey in kibana, and I found the thread below: The user @dhruv477 reported his success... Please @dhruv477 could you share your solution? Or does anyone has a solution to share… --- ## [Embed dashboard iframe into publicly available website](https://discuss.elastic.co/t/embed-dashboard-iframe-into-publicly-available-website/271006)
**Author:** [@tampe125](https://discuss.elastic.co/u/tampe125)\ **Replies:** 2\ **Last updated:** [April 23, 2021, 9:34am UTC](https://discuss.elastic.co/t/embed-dashboard-iframe-into-publicly-available-website/271006 "2021-04-23T09:34:54Z")
I'm using Elastic Cloud to log my application data. However, I'd wish to display some generic, aggregate data on company website. The iframe mode is very useful, however it requires a valid elastic search user to acces… --- ## [Interactive Field Selection - Dynamic Split Series](https://discuss.elastic.co/t/interactive-field-selection-dynamic-split-series/271012)
**Author:** [@Jay\_Farias](https://discuss.elastic.co/u/Jay_Farias)\ **Replies:** 1\ **Last updated:** [April 23, 2021, 9:07am UTC](https://discuss.elastic.co/t/interactive-field-selection-dynamic-split-series/271012 "2021-04-23T09:07:52Z")
Hi, We would like to build some visualizations in Kibana that are split by a field the user can select (ie: split series bar chart where the split series is dynamic based on a dropdown of fields the user can select). Any… --- ## [Kibana Control Panel](https://discuss.elastic.co/t/kibana-control-panel/270880)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 1\ **Last updated:** [April 23, 2021, 8:45am UTC](https://discuss.elastic.co/t/kibana-control-panel/270880 "2021-04-23T08:45:20Z")
I added a control panel to my dashboard and it works when I am editing and using it in Kibana but when I import it to my website, the control panel no longer works. I was able to update the kibana autocomplete settings i… --- ## [Unexplained failure java.lang.OutOfMemoryError: Java heap space](https://discuss.elastic.co/t/unexplained-failure-java-lang-outofmemoryerror-java-heap-space/270100)
**Author:** [@Bertram\_van\_de\_Ven](https://discuss.elastic.co/u/Bertram_van_de_Ven)\ **Replies:** 14\ **Last updated:** [April 23, 2021, 8:37am UTC](https://discuss.elastic.co/t/unexplained-failure-java-lang-outofmemoryerror-java-heap-space/270100 "2021-04-23T08:37:20Z")
Dear, We've encounter 'random' out of memory errors that we can't explain. When we see the error occur we don't see an increase of Heap, system load, CPU or I/O. So I don't know where to search for the explanation why t… --- ## [Sending data to Multiple elasticsearch containers](https://discuss.elastic.co/t/sending-data-to-multiple-elasticsearch-containers/270532)
**Author:** [@safura\_zaheer](https://discuss.elastic.co/u/safura_zaheer)\ **Replies:** 10\ **Last updated:** [April 23, 2021, 7:58am UTC](https://discuss.elastic.co/t/sending-data-to-multiple-elasticsearch-containers/270532 "2021-04-23T07:58:00Z")
Hi all, I am having 3 docker containers of elasticsearch running on a single host on different ports, Now I want to send data to all the 3 containers so that I don't have any single point of failure . What are the diff… --- ## [Add tags or booleans to speed up queries?](https://discuss.elastic.co/t/add-tags-or-booleans-to-speed-up-queries/270947)
**Author:** [@GabrielM](https://discuss.elastic.co/u/GabrielM)\ **Replies:** 4\ **Last updated:** [April 22, 2021, 12:37pm UTC](https://discuss.elastic.co/t/add-tags-or-booleans-to-speed-up-queries/270947 "2021-04-22T12:37:45Z")
Hello, I want to query documents if the length of a field is more than 1k or 10k, etc. I'm trying to follow an Elasticsearch best practice to avoid doing queries like "if field\_length\> 1000" (Tune for search speed | El… --- ## [Cross-Cluster search Implementation Issues](https://discuss.elastic.co/t/cross-cluster-search-implementation-issues/270651)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [April 23, 2021, 6:37am UTC](https://discuss.elastic.co/t/cross-cluster-search-implementation-issues/270651 "2021-04-23T06:37:15Z")
Hello Team We have implemented Cross-Cluster Search in Elasticsearch version 7.8.0 clusters. For example Cluster-A and Cluster-B. Cluster-A elasticsearch.yml file has below parameters : cluster.remote.Cluster-B.seeds… --- ## [A different version of the library has been downloaded](https://discuss.elastic.co/t/a-different-version-of-the-library-has-been-downloaded/271038)
**Author:** [@tom-shumi](https://discuss.elastic.co/u/tom-shumi)\ **Replies:** 0\ **Last updated:** [April 23, 2021, 5:30am UTC](https://discuss.elastic.co/t/a-different-version-of-the-library-has-been-downloaded/271038 "2021-04-23T05:30:55Z")
I have defined version 6.8.6 Elasticsearch in build.gradle. implementation group: 'org.elasticsearch', name: 'elasticsearch', version: '6.8.6' Then version 6.8.6 and version 7.6.2 were downloaded. Why? Moreover, due … --- ## [Query for Unicode Character in process.name](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 2\ **Last updated:** [April 23, 2021, 2:49am UTC](https://discuss.elastic.co/t/query-for-unicode-character-in-process-name/270175 "2021-04-23T02:49:12Z")
Hi there, I am trying to query for a right-to-left override (RTLO) character (U+202E) within a process name. My query in Dev Tools in Kibana is this: GET /\[index\_name\]/\_eql/search { "query": """ process where pr… --- ## [Grok Pattern for date and time format "03-MAR-21 00:40:21"](https://discuss.elastic.co/t/grok-pattern-for-date-and-time-format-03-mar-21-0021/271014)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [April 23, 2021, 1:12am UTC](https://discuss.elastic.co/t/grok-pattern-for-date-and-time-format-03-mar-21-0021/271014 "2021-04-23T01:12:04Z")
This is likely a simple one but what's the grok pattern for this? I have gone through all the ones I could find but I cant get a match for the format 03-MAR-21 00:40:2 Currently I am using a string but need to change i… --- ## [Replace @timestamp with actual timestamp from log file](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022)
**Author:** [@kommineni24](https://discuss.elastic.co/u/kommineni24)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 11:04pm UTC](https://discuss.elastic.co/t/replace-timestamp-with-actual-timestamp-from-log-file/271022 "2021-04-22T23:04:46Z")
Hi, I am trying to index my mail-relay log files to Elastic search. All the log entries are being indexed into a field named message . @timestamp field shows the time the entry was indexed and not the timestamp from the… --- ## [Nested aggregation of runtime nested field returns empty buckets](https://discuss.elastic.co/t/nested-aggregation-of-runtime-nested-field-returns-empty-buckets/271015)
**Author:** [@matheus.mohr](https://discuss.elastic.co/u/matheus.mohr)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 8:40pm UTC](https://discuss.elastic.co/t/nested-aggregation-of-runtime-nested-field-returns-empty-buckets/271015 "2021-04-22T20:40:09Z")
Before I describe the issue, it's worth noting that this issue is happening at the end of a long process of migrating a 2.4 ES cluster to 7.12, with multiple updates to mappings and queries, so please have in mind that I… --- ## [Logstash dissect and grok pattern matching issue](https://discuss.elastic.co/t/logstash-dissect-and-grok-pattern-matching-issue/270983)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 6\ **Last updated:** [April 22, 2021, 8:38pm UTC](https://discuss.elastic.co/t/logstash-dissect-and-grok-pattern-matching-issue/270983 "2021-04-22T20:38:47Z")
Hi, I'm trying to use dissect and grok pattern matching together in order to get the desired field:value pair that I want. However, I don't understand why it's not working. I'm parsing the description field which can co… --- ## [Saved "field" parameter is now invalid. Please select a new field](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 8:38pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598 "2021-04-22T20:38:09Z")
I am attempting to reload sample dashboards (in this case for Winlogbeat) associated with our custom index patterns - as opposed to the default winlogbeat-\*. Here are the steps I followed: Exported the target index pat… --- ## [Widget stay on "Edit" mode](https://discuss.elastic.co/t/widget-stay-on-edit-mode/270839)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 12\ **Last updated:** [April 22, 2021, 7:49pm UTC](https://discuss.elastic.co/t/widget-stay-on-edit-mode/270839 "2021-04-22T19:49:36Z")
Hello everyone, I'm on Kibana v 7.12.0 I have strange problem, on the same dashboard, some widget stay on "edit" mode, with the gear on top right of them, and other widget switch good on "View mode" (so the gear leave … --- ## [Dense\_vector element-wise operation](https://discuss.elastic.co/t/dense-vector-element-wise-operation/270181)
**Author:** [@ruodingt\_trendii](https://discuss.elastic.co/u/ruodingt_trendii)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 7:40pm UTC](https://discuss.elastic.co/t/dense-vector-element-wise-operation/270181 "2021-04-22T19:40:17Z")
Hi mates, I just encountered an issue with dense\_vector I am trying to implement an additive\_chi2\_kernel as my score function. additive\_chi2\_kernel is a way to compare similarity of two histogram The function is as s… --- ## [7.10.1 vs 7.12.0 metricbeat problem](https://discuss.elastic.co/t/7-10-1-vs-7-12-0-metricbeat-problem/271007)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 7:37pm UTC](https://discuss.elastic.co/t/7-10-1-vs-7-12-0-metricbeat-problem/271007 "2021-04-22T19:37:15Z")
I upgraded 7.10.1 to 7.12.0 and now I have two index but it give me lot of weired problem Cannot use field \[agent.version\] due to ambiguities being mapped as \[2\] incompatible types: \[text\] I have data coming in to both… --- ## [How to get local time zone in painless field](https://discuss.elastic.co/t/how-to-get-local-time-zone-in-painless-field/270834)
**Author:** [@varunbsgaur](https://discuss.elastic.co/u/varunbsgaur)\ **Replies:** 1\ **Last updated:** [April 22, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-get-local-time-zone-in-painless-field/270834 "2021-04-22T18:34:22Z")
int year = doc\['timestamp'\].value.year; int month = doc\['timestamp'\].value.monthOfYear; int day = doc\['timestamp'\].value.dayOfMonth; int hour = doc\['timestamp'\].value.hourOfDay; int minutes = doc\['timestamp'\].value.m… --- ## [Log Files are not getting generated in the defined path of logstash.yml](https://discuss.elastic.co/t/log-files-are-not-getting-generated-in-the-defined-path-of-logstash-yml/271003)
**Author:** [@Krishna\_Kumar](https://discuss.elastic.co/u/Krishna_Kumar)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 6:32pm UTC](https://discuss.elastic.co/t/log-files-are-not-getting-generated-in-the-defined-path-of-logstash-yml/271003 "2021-04-22T18:32:09Z")
Hi All, I am a beginner in ELK. Could you please advise here. In one of the ec2 server we have installed Logstash in that we have mounted the EBS volume under /data path and we are providing this path under log.path in… --- ## [Log files are not getting generated in the defined path (logstash.yml)](https://discuss.elastic.co/t/log-files-are-not-getting-generated-in-the-defined-path-logstash-yml/271002)
**Author:** [@Clyton](https://discuss.elastic.co/u/Clyton)\ **Replies:** 0\ **Last updated:** [April 22, 2021, 6:28pm UTC](https://discuss.elastic.co/t/log-files-are-not-getting-generated-in-the-defined-path-logstash-yml/271002 "2021-04-22T18:28:00Z")
Hi All, In Debugging Settings of logstash.yml, I'm defining as below, log.level: info path.log: /var/log/logstash However, for some reason, the logs are getting generated in /usr/share/logstash/logs Besides, I hav… --- ## [Disable cut time windows to data in Kibana 7.12.0 visualizations](https://discuss.elastic.co/t/disable-cut-time-windows-to-data-in-kibana-7-12-0-visualizations/270488)
**Author:** [@Bastian\_Jager](https://discuss.elastic.co/u/Bastian_Jager)\ **Replies:** 3\ **Last updated:** [April 22, 2021, 6:03pm UTC](https://discuss.elastic.co/t/disable-cut-time-windows-to-data-in-kibana-7-12-0-visualizations/270488 "2021-04-22T18:03:15Z")
I have a new question regarding Kibana 7.12. Since the update the x-axis (by timestamp) gets cut/limited to the available data and this is not like it was before. Here is the data from last 2 days. The red line is the … --- ## [Problem when splitting a nested JSON array](https://discuss.elastic.co/t/problem-when-splitting-a-nested-json-array/270864)
**Author:** [@pedro\_gonzalez](https://discuss.elastic.co/u/pedro_gonzalez)\ **Replies:** 4\ **Last updated:** [April 22, 2021, 5:59pm UTC](https://discuss.elastic.co/t/problem-when-splitting-a-nested-json-array/270864 "2021-04-22T17:59:15Z")
Hi, I have seen multiple thread talking about this problem but with some differences. I have the following log schema: "messageId": 123, "timestamp": "2020-09-14T03:35:37", "extra": { "name": "typefood", "food\_… --- ## [Adding logstash IP address field when processing filter](https://discuss.elastic.co/t/adding-logstash-ip-address-field-when-processing-filter/270055)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 2\ **Last updated:** [April 22, 2021, 5:48pm UTC](https://discuss.elastic.co/t/adding-logstash-ip-address-field-when-processing-filter/270055 "2021-04-22T17:48:33Z")
Dear Elastic Community, We are using several logstash servers behind a loadbalancer. All you client are sending their logs through those VIP created on the load balancer, not directly to the logstash servers. For the "b… --- ## [Winlogbeat unable to connect ELK Ubuntu](https://discuss.elastic.co/t/winlogbeat-unable-to-connect-elk-ubuntu/270675)
**Author:** [@Coeus.IT](https://discuss.elastic.co/u/Coeus.IT)\ **Replies:** 3\ **Last updated:** [April 22, 2021, 5:21pm UTC](https://discuss.elastic.co/t/winlogbeat-unable-to-connect-elk-ubuntu/270675 "2021-04-22T17:21:43Z")
Hi Good Day, I have setup a Ubuntu with ELK installed. Wants to receive logs from Windows 10 machine. The ELK and the Windows currently on same network since testing. Have enabled xpack.security to true. Get auto gener… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1447) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1449)