# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1473 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1474 --- ## [Script for basic elastic healthchecks](https://discuss.elastic.co/t/script-for-basic-elastic-healthchecks/269440)
**Author:** [@ima](https://discuss.elastic.co/u/ima)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 3:44pm UTC](https://discuss.elastic.co/t/script-for-basic-elastic-healthchecks/269440 "2021-04-07T15:44:57Z")
hello, i have a mission of creating a script for automating elastic healthchecks, can anyone who has already worked on the same topic help me please. --- ## [Change color of Line Graph when it crosses a threshold \[7.12\]](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468)
**Author:** [@B2A3R9C9A](https://discuss.elastic.co/u/B2A3R9C9A)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:36pm UTC](https://discuss.elastic.co/t/change-color-of-line-graph-when-it-crosses-a-threshold-7-12/269468 "2021-04-07T15:36:49Z")
Hi, I have a visualization showcasing CPU Utilization over a given time series. I have set a threshold line of 80 to indicate when utilization is higher than normal. Is it possible on Kibana to change color of the li… --- ## [Connecting Kibana to Big Query](https://discuss.elastic.co/t/connecting-kibana-to-big-query/269447)
**Author:** [@nlogn](https://discuss.elastic.co/u/nlogn)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 3:32pm UTC](https://discuss.elastic.co/t/connecting-kibana-to-big-query/269447 "2021-04-07T15:32:57Z")
We currently use Google BigQuery to store our production logs. I was wondering if it's possible to connect Kibana directly to Google BigQuery to browse and visualize logs? --- ## [Summ of two buckets](https://discuss.elastic.co/t/summ-of-two-buckets/269366)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 3:18pm UTC](https://discuss.elastic.co/t/summ-of-two-buckets/269366 "2021-04-07T15:18:51Z")
Hi. I'm using Kibana to show a particular metric for data collected from a local SIP device. My data is indexed like this: { "\_index": "calls", "\_type": "\_doc", "\_id": "0ysOqHgBtkTNQGR8TH85", "\_version": 1, … --- ## [Try to reduce number of mapped field before migrating from elasticsearch 2.4](https://discuss.elastic.co/t/try-to-reduce-number-of-mapped-field-before-migrating-from-elasticsearch-2-4/269496)
**Author:** [@kintetsu](https://discuss.elastic.co/u/kintetsu)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 3:12pm UTC](https://discuss.elastic.co/t/try-to-reduce-number-of-mapped-field-before-migrating-from-elasticsearch-2-4/269496 "2021-04-07T15:12:05Z")
Hi, we are still running elasticsearch 2.4 and planning to migrate to the 7.x in the near future. To prepare for the upgrade we already used the migration plugin and found out that our current mapping is a problem. We h… --- ## [Elastic search aggregation not fetching complete Java trace](https://discuss.elastic.co/t/elastic-search-aggregation-not-fetching-complete-java-trace/269365)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 3:05pm UTC](https://discuss.elastic.co/t/elastic-search-aggregation-not-fetching-complete-java-trace/269365 "2021-04-07T15:05:47Z")
Hello Experts, I have created Data Table visualization and API for aggregations to get the application logs. It is fetching only 2 lines of log messages in the Data Table, if the log contains more than 3 lines example J… --- ## [How to recover cluster when 2 master nodes have been lost](https://discuss.elastic.co/t/how-to-recover-cluster-when-2-master-nodes-have-been-lost/269472)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 3:05pm UTC](https://discuss.elastic.co/t/how-to-recover-cluster-when-2-master-nodes-have-been-lost/269472 "2021-04-07T15:05:07Z")
Hi everyone, I have the following situation, my cluster is formed by 3 master nodes and 3 data nodes, unfortunately due to a hardware problem we lost 2 master nodes at same time and the left one was not able to assume a… --- ## [Fail to upgrade Kibana from 7.11 to 7.12](https://discuss.elastic.co/t/fail-to-upgrade-kibana-from-7-11-to-7-12/269370)
**Author:** [@paulbrown4](https://discuss.elastic.co/u/paulbrown4)\ **Replies:** 9\ **Last updated:** [April 7, 2021, 3:01pm UTC](https://discuss.elastic.co/t/fail-to-upgrade-kibana-from-7-11-to-7-12/269370 "2021-04-07T15:01:12Z")
Kibana times out waiting for index migration. {"type":"log","@timestamp":"2021-04-06T13:09:46-05:00","tags":\["info","savedobjects-service"\],"pid":9608,"message":"\[.kibana\] UPDATE\_TARGET\_MAPPINGS -\> UPDATE\_TARGET\_MAPPING… --- ## [Elastic Lab 1.4](https://discuss.elastic.co/t/elastic-lab-1-4/269131)
**Author:** [@Troy\_Kelley](https://discuss.elastic.co/u/Troy_Kelley)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 2:59pm UTC](https://discuss.elastic.co/t/elastic-lab-1-4/269131 "2021-04-07T14:59:20Z")
Hello, I am working through the elastic lab 1.4. I am not using virtual lab, I am running mine locally. For some reason I did not have the blogs\_sql.conf when I installed Elastic. So, I found an example on the web, cr… --- ## [Question about wildcard query](https://discuss.elastic.co/t/question-about-wildcard-query/269129)
**Author:** [@anyla](https://discuss.elastic.co/u/anyla)\ **Replies:** 8\ **Last updated:** [April 7, 2021, 2:56pm UTC](https://discuss.elastic.co/t/question-about-wildcard-query/269129 "2021-04-07T14:56:00Z")
Hi all, It seems that there is something about wildcard queries that it is not clear to me As far as I understand, Wildcard queries are term queries so. the search term is not analysed itself and it is "compared" aga… --- ## [Save logstash and metricbeat indices on diferent place](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425)
**Author:** [@jobanuls](https://discuss.elastic.co/u/jobanuls)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 2:37pm UTC](https://discuss.elastic.co/t/save-logstash-and-metricbeat-indices-on-diferent-place/269425 "2021-04-07T14:37:44Z")
Hi, I want have two path on my elasticsearch node for save metricbeat indices in the second path. Anyone knows how save metricbeat indices on second path directly? ElasticVersión : 7.9.2-1 --- ## [Logstash HTTP output plugin not reading metadata fields correctly for user/password fields, what am I doing wrong](https://discuss.elastic.co/t/logstash-http-output-plugin-not-reading-metadata-fields-correctly-for-user-password-fields-what-am-i-doing-wrong/269482)
**Author:** [@R.L](https://discuss.elastic.co/u/R.L)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/logstash-http-output-plugin-not-reading-metadata-fields-correctly-for-user-password-fields-what-am-i-doing-wrong/269482 "2021-04-07T14:32:37Z")
This is my config: filter { prune { blacklist\_names =\> \[ "timestamp", "path", "size", "@version", "host" \] } uuid { target =\> "\[@metadata\]\[snapshot\]\[id\]" overwrit… --- ## [Filter out terms aggregation buckets in elastic search after applying aggregation](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486)
**Author:** [@ruzeenpalsetia](https://discuss.elastic.co/u/ruzeenpalsetia)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 2:32pm UTC](https://discuss.elastic.co/t/filter-out-terms-aggregation-buckets-in-elastic-search-after-applying-aggregation/269486 "2021-04-07T14:32:09Z")
Below is snapshot of the dataset: recordNo employeeId employeeStatus employeeAddr 1 employeeA Permanent 2 employeeA ABC … --- ## [Filebeat configuration module path issue](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871 "2021-04-07T14:16:11Z")
Dear All, I am trying to follow this tutorial here to build a dashboard on some public data sets. However, whenever I tried to run ./filebeat, the following error appeared: 2021-03-31T14:19:44.685+0800 ERROR \[mod… --- ## [Logstash-oss yum packages missing?](https://discuss.elastic.co/t/logstash-oss-yum-packages-missing/269258)
**Author:** [@mentzerk](https://discuss.elastic.co/u/mentzerk)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 2:12pm UTC](https://discuss.elastic.co/t/logstash-oss-yum-packages-missing/269258 "2021-04-07T14:12:45Z")
Hello, I've been installing the logstash-oss package for some time now from the elastic.co yum repo, but today, it seems that the "-oss" packages are no longer included in the repo. Is this maybe a known change that I m… --- ## [Filebeat Crowdstrike Module doesn't handle unix timestamps of 0 correctly](https://discuss.elastic.co/t/filebeat-crowdstrike-module-doesnt-handle-unix-timestamps-of-0-correctly/269045)
**Author:** [@anon68795679](https://discuss.elastic.co/u/anon68795679)\ **Replies:** 10\ **Last updated:** [April 7, 2021, 2:05pm UTC](https://discuss.elastic.co/t/filebeat-crowdstrike-module-doesnt-handle-unix-timestamps-of-0-correctly/269045 "2021-04-07T14:05:33Z")
Hi, Crowdstrike store events with a ProcessEndTime of "0". For example shortened json: { "event": { "ProcessStartTime": 1617278228, "ProcessEndTime": 0, } } Both fields are parsed by the same… --- ## [Calculating time spent in state with Metricbeat and Kibana](https://discuss.elastic.co/t/calculating-time-spent-in-state-with-metricbeat-and-kibana/269457)
**Author:** [@m\_x](https://discuss.elastic.co/u/m_x)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 2:00pm UTC](https://discuss.elastic.co/t/calculating-time-spent-in-state-with-metricbeat-and-kibana/269457 "2021-04-07T14:00:26Z")
Hi, I would like to calculate the time spent in a certain state with Metricbeat and Kibana . For example : how long have the system been up during specified period ? how long have a user spent logged in ?. I'm discoveri… --- ## [Filebeat : Exiting: No outputs are defined. Please define one under the output section](https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478)
**Author:** [@sourabhjain104](https://discuss.elastic.co/u/sourabhjain104)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-exiting-no-outputs-are-defined-please-define-one-under-the-output-section/269478 "2021-04-07T13:58:09Z")
Hello All, I am trying to send logs data from my local drive to logstash using filebeat 7.11.0. I was able to do it successfully and also create index pattern in kibana. I wanted to do some modification so I deleted m… --- ## [Enrich-Policy with daily changes in reference data](https://discuss.elastic.co/t/enrich-policy-with-daily-changes-in-reference-data/269474)
**Author:** [@Oren\_Zomer](https://discuss.elastic.co/u/Oren_Zomer)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 1:57pm UTC](https://discuss.elastic.co/t/enrich-policy-with-daily-changes-in-reference-data/269474 "2021-04-07T13:57:44Z")
We are trying to create an enrich-processor to add more data to our event documents, based on an existing reference data that may contain ~10k documents. I've read the example in: However, in my case the reference dat… --- ## [Elk requirement](https://discuss.elastic.co/t/elk-requirement/269441)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 7\ **Last updated:** [April 7, 2021, 1:33pm UTC](https://discuss.elastic.co/t/elk-requirement/269441 "2021-04-07T13:33:51Z")
hi , i hope this message finds you well, so How much cpu(GHz) /memory/storage at least I need to use ELK stack . regards. --- ## [Did Search Alert land in 7.12?](https://discuss.elastic.co/t/did-search-alert-land-in-7-12/269470)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 1:32pm UTC](https://discuss.elastic.co/t/did-search-alert-land-in-7-12/269470 "2021-04-07T13:32:17Z")
Dear all =) When I read the release notes for 7.12 Elasticsearch version 7.12.0 | Elasticsearch Guide \[7.12\] | Elastic I don't see Search Alert \[Alerting\] Search alert by ymao1 · Pull Request #88528 · elastic/kibana · G… --- ## [Sorting log data by specific key](https://discuss.elastic.co/t/sorting-log-data-by-specific-key/269469)
**Author:** [@74db36a597f21b891b3f](https://discuss.elastic.co/u/74db36a597f21b891b3f)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 1:12pm UTC](https://discuss.elastic.co/t/sorting-log-data-by-specific-key/269469 "2021-04-07T13:12:48Z")
Hello there. I faced with the same problem as described here Documents order in Elasticsearch after processing with filebeat/logstash. Several log lines can be created at the same second, so their order can be incorrect… --- ## [Could not index event to elasticsearch limit of total fields \[1000\]](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-limit-of-total-fields-1000/269464)
**Author:** [@azxqw](https://discuss.elastic.co/u/azxqw)\ **Replies:** 2\ **Last updated:** [April 7, 2021, 12:58pm UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch-limit-of-total-fields-1000/269464 "2021-04-07T12:58:42Z")
Hi all, I have some trouble with a particular pipeline. I'm trying to index events from our F5 waf, however i get this error on every event. I dont understand why elasticsearch decided that there are more than 1000 fie… --- ## [Scripted field in kibana](https://discuss.elastic.co/t/scripted-field-in-kibana/269465)
**Author:** [@Changra](https://discuss.elastic.co/u/Changra)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 12:50pm UTC](https://discuss.elastic.co/t/scripted-field-in-kibana/269465 "2021-04-07T12:50:57Z")
Hi Team, I have been to substract the date value and store the value in the variable defined as " duration" and then check if the value is smaller than 2 then return a value through scripted filed in kibana \` \`\` if… --- ## [Create watcher using index pattern](https://discuss.elastic.co/t/create-watcher-using-index-pattern/267478)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [April 7, 2021, 11:13am UTC](https://discuss.elastic.co/t/create-watcher-using-index-pattern/267478 "2021-04-07T11:13:06Z")
I have 2 indices (xx-001 and xx-002), and an index pattern xx-\* can i create watcher for xx-\*? how? --- ## [Issues collecting data from Windows servers](https://discuss.elastic.co/t/issues-collecting-data-from-windows-servers/269433)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 7, 2021, 9:54am UTC](https://discuss.elastic.co/t/issues-collecting-data-from-windows-servers/269433 "2021-04-07T09:54:31Z")
Hi Forum Just a Noobie for this kind of setup - but linuxnerd for +30 years - I have build a server with Elasticsearch/Kibana and Logstash -and are running into some issues. From Linux - I can collect the data/logs and… --- ## [Ingest\_pipeline - Elastic Cloud](https://discuss.elastic.co/t/ingest-pipeline-elastic-cloud/268175)
**Author:** [@evgeniy777](https://discuss.elastic.co/u/evgeniy777)\ **Replies:** 3\ **Last updated:** [April 7, 2021, 10:46am UTC](https://discuss.elastic.co/t/ingest-pipeline-elastic-cloud/268175 "2021-04-07T10:46:55Z")
Hi all ! i'm using Elastic Cloud solution and FileBeat on my servers. made a simple ingest\_pipeline for parsing my custom app logs. On Filebeat config i'm defining "cloud.auth:" and "cloud.id:", but i don't know how… --- ## [I push documents to elastic successfully but they are not visualized in Kibana's Discover](https://discuss.elastic.co/t/i-push-documents-to-elastic-successfully-but-they-are-not-visualized-in-kibanas-discover/269267)
**Author:** [@orfeas2021](https://discuss.elastic.co/u/orfeas2021)\ **Replies:** 4\ **Last updated:** [April 7, 2021, 10:42am UTC](https://discuss.elastic.co/t/i-push-documents-to-elastic-successfully-but-they-are-not-visualized-in-kibanas-discover/269267 "2021-04-07T10:42:46Z")
Hi! I have a 3-node installation (1 master, 2 data) , installed into the OpenStack VMs. I want to push data (logs) from an application to the stack and find them in Discover section of Kibana. (I have installed Kibana o… --- ## [How to add parameters to URL in Markdown](https://discuss.elastic.co/t/how-to-add-parameters-to-url-in-markdown/268224)
**Author:** [@Dvir\_Alony](https://discuss.elastic.co/u/Dvir_Alony)\ **Replies:** 6\ **Last updated:** [April 7, 2021, 10:36am UTC](https://discuss.elastic.co/t/how-to-add-parameters-to-url-in-markdown/268224 "2021-04-07T10:36:20Z")
Hi, I created a dashboard with two TSVB visualization, one control/filter and one markdown. I defined a URL in Markdown visualization (see 4 in png) I want to add tree parameters to the URL first control/filter fiel… --- ## [Elasticsearch SQL ODBC Driver error of all shards failed](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-error-of-all-shards-failed/268448)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 7\ **Last updated:** [April 7, 2021, 10:19am UTC](https://discuss.elastic.co/t/elasticsearch-sql-odbc-driver-error-of-all-shards-failed/268448 "2021-04-07T10:19:18Z")
I'm using Elasticsearch Odbc as driver between my C++ code and Elasticsearch engine. When firing sql select query, the shards are getting failed. Please help me through this. Thanks in advance. [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1472) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1474)