# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1482 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1483 --- ## [How to combine multi timelines in one vega graph using layers](https://discuss.elastic.co/t/how-to-combine-multi-timelines-in-one-vega-graph-using-layers/266932)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 9:30pm UTC](https://discuss.elastic.co/t/how-to-combine-multi-timelines-in-one-vega-graph-using-layers/266932 "2021-03-31T21:30:37Z")
hi experts, am trying to combine multi time lines Vega graphic to one but i'm stock, can anyone check my code, where i missed. { $schema: https://vega.github.io/schema/vega-lite/v2.json data: { url: { %con… --- ## [Logstash importing hostname incorrectly](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496)
**Author:** [@ASA01](https://discuss.elastic.co/u/ASA01)\ **Replies:** 6\ **Last updated:** [March 31, 2021, 9:02pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496 "2021-03-31T21:02:39Z")
Running across something I don't understand after building a new stack with the latest release of Logstash (7.11.1). It appears to be entering the hostname wrong or I understand it wrong. The system hostname is cmscd h… --- ## [Query\_string with fuzzy and stammer filter works wierd](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956)
**Author:** [@fedoroko](https://discuss.elastic.co/u/fedoroko)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 7:58pm UTC](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956 "2021-03-31T19:58:31Z")
Found some strange thing with query\_string and stemmer/snowball filters, can't understand how does it work and how to fix this, help me, please. Analyzer and filter: 'analyzer' =\> \[ … --- ## [Source.bytes not showing up as a field in elb fileset for aws](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 7:12pm UTC](https://discuss.elastic.co/t/source-bytes-not-showing-up-as-a-field-in-elb-fileset-for-aws/268675 "2021-03-31T19:12:31Z")
I am trying to use the aws module for filebeat. My goal is to recreate the ELB Inbound Traffic \[Filebeat AWS\] visualization. It does not work by default. I've added an s3 bucket for collecting elb logs and an s3 bucket n… --- ## [Console not listing exact match above partial match](https://discuss.elastic.co/t/console-not-listing-exact-match-above-partial-match/268401)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 7:12pm UTC](https://discuss.elastic.co/t/console-not-listing-exact-match-above-partial-match/268401 "2021-03-31T19:12:04Z")
Hello: Is there a way to configure kibana to list exact match first before partial match in console? I tried to delete indices with certain pattern (date time). for example: When I type "202101", I am getting a list … --- ## [Suricata -\> Filebeat -\> Elasticsearch](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 6:51pm UTC](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944 "2021-03-31T18:51:59Z")
Hi there! I´m implementing a IDS solution (suricata). I am sending logs via filebeat to a remote ELK server. What happens is that i´m not getting real-time searches. For instance, on the "Discovery" page an event that h… --- ## [Filter postgresql ERROR, FATAL, PANIC messages from postgresql logs](https://discuss.elastic.co/t/filter-postgresql-error-fatal-panic-messages-from-postgresql-logs/268843)
**Author:** [@elk\_newbie](https://discuss.elastic.co/u/elk_newbie)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 6:46pm UTC](https://discuss.elastic.co/t/filter-postgresql-error-fatal-panic-messages-from-postgresql-logs/268843 "2021-03-31T18:46:21Z")
Hi community, Is there any way to filter only ERROR, FATAL and PANIC messages from Postgresql logs? appreciate any help! Regards Patrick --- ## [Time in logstash is getting different due to daylight saving time](https://discuss.elastic.co/t/time-in-logstash-is-getting-different-due-to-daylight-saving-time/268934)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 5:35pm UTC](https://discuss.elastic.co/t/time-in-logstash-is-getting-different-due-to-daylight-saving-time/268934 "2021-03-31T17:35:16Z")
Hi i am using ruby code in logstash as below and getting the time one hour less. ruby { code =\> "event.set('current\_window\_end', Time.now());" } if current time is 10 :00 (in London) getting the time as 9:00. i have … --- ## [How to embed visualization into my app](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591)
**Author:** [@whitediver](https://discuss.elastic.co/u/whitediver)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 4:48pm UTC](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591 "2021-03-31T16:48:04Z")
Since the embedVisualizationWithId was removed from the Kibana, I have no way to embed visualization into my Kibana app. Does anybody know what I should use instead? --- ## [Using ILP with rollup](https://discuss.elastic.co/t/using-ilp-with-rollup/267204)
**Author:** [@vishal\_ramanlal](https://discuss.elastic.co/u/vishal_ramanlal)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 4:21pm UTC](https://discuss.elastic.co/t/using-ilp-with-rollup/267204 "2021-03-31T16:21:57Z")
I am trying to configure Kibana to use a rollup to parse and simplify apache James data. I can currently push data to an index which sets the data according to a template. I can also use rollup to get and simplify the da… --- ## [Discover JSON missing \_source field](https://discuss.elastic.co/t/discover-json-missing-source-field/268922)
**Author:** [@frebri](https://discuss.elastic.co/u/frebri)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 4:01pm UTC](https://discuss.elastic.co/t/discover-json-missing-source-field/268922 "2021-03-31T16:01:47Z")
Hi, We reinstalled Kibana and Elastic with 7.12 and are accustomed to look at certain documents through just pure json, since it has a specific order and grouping. After the upgrade, the JSON tab seems to "pretty print"… --- ## [400 error from \_reindex](https://discuss.elastic.co/t/400-error-from-reindex/268926)
**Author:** [@drdwilcox](https://discuss.elastic.co/u/drdwilcox)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 2:54pm UTC](https://discuss.elastic.co/t/400-error-from-reindex/268926 "2021-03-31T14:54:23Z")
I am attempting to use reindex to effect the conversion of a single field from a string to a float. I have run this on several indices without issue, but in my most recent attempt, I get the following error after 29,000 … --- ## [Default log paths used for beats](https://discuss.elastic.co/t/default-log-paths-used-for-beats/268907)
**Author:** [@Bryce\_Fernandes](https://discuss.elastic.co/u/Bryce_Fernandes)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 3:50pm UTC](https://discuss.elastic.co/t/default-log-paths-used-for-beats/268907 "2021-03-31T15:50:04Z")
Hi, I have an AIX server and cant install beats on it so as a workaround want to forward logs in another server and install beats and read from there. I wanted to know the default paths used by: Metricbeat system mod… --- ## [Preventing specific events from being indexed](https://discuss.elastic.co/t/preventing-specific-events-from-being-indexed/268522)
**Author:** [@tsmori](https://discuss.elastic.co/u/tsmori)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 3:48pm UTC](https://discuss.elastic.co/t/preventing-specific-events-from-being-indexed/268522 "2021-03-31T15:48:30Z")
Is there a way to prevent specific events from being indexed? I don't mean specific fields, but conditionals for a field. For example, we're ingesting netflow traffic data and I want to exclude all events that have both… --- ## [Tabelle in Vega](https://discuss.elastic.co/t/tabelle-in-vega/268793)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 3:35pm UTC](https://discuss.elastic.co/t/tabelle-in-vega/268793 "2021-03-31T15:35:36Z")
hello guys, I have a requirement, looks like this scenario, from a CSV file 5 columns are imported into kibana and the expected visualization of it data is to create kind of table Visia.. where the values of the fields… --- ## [Logstash Kafka input : conditonnal consuming?](https://discuss.elastic.co/t/logstash-kafka-input-conditonnal-consuming/268664)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 12\ **Last updated:** [March 31, 2021, 3:27pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-conditonnal-consuming/268664 "2021-03-31T15:27:08Z")
Hello ! I have multiple firewall log sources. All these sources push the logs in a dedicated topic named "firewall". In logstash, I would like to have a different pipeline for each of these sources to apply different p… --- ## [Kibana change of decimal values in colour](https://discuss.elastic.co/t/kibana-change-of-decimal-values-in-colour/266327)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 3:12pm UTC](https://discuss.elastic.co/t/kibana-change-of-decimal-values-in-colour/266327 "2021-03-31T15:12:08Z")
Hi all, I'm a float numeric field which i have values like 21.283774493. I have managed to limit to 2 digits like 21.28. Now the problem is when i use conditional colour for my number in edit field option, format goes… --- ## [Kibana (7.11.1) isn't showing logs](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399)
**Author:** [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\ **Replies:** 13\ **Last updated:** [March 31, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399 "2021-03-31T15:11:44Z")
Hi, I have an index, that is containing log data, but the data can't be seen under Observability -\> Logs. I have also created an index pattern and choose a time field. I adjusted the settings of Observability -\> Logs t… --- ## [Metricbeat extreme memory usage](https://discuss.elastic.co/t/metricbeat-extreme-memory-usage/268850)
**Author:** [@Francisco\_Gomez1](https://discuss.elastic.co/u/Francisco_Gomez1)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 3:07pm UTC](https://discuss.elastic.co/t/metricbeat-extreme-memory-usage/268850 "2021-03-31T15:07:51Z")
I'm getting serius metricbeat memory spikes. i'm currently using metricbeat 7.11 in my server as we can see in the next screenshot the memory usage is just to high. i din't found any error log in the service , i'm no… --- ## [Strange ILM error "Mapping definition for ... has unsupported parameters: \[normalizer : my\_normalizer\]"](https://discuss.elastic.co/t/strange-ilm-error-mapping-definition-for-has-unsupported-parameters-normalizer-my-normalizer/268092)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 2:52pm UTC](https://discuss.elastic.co/t/strange-ilm-error-mapping-definition-for-has-unsupported-parameters-normalizer-my-normalizer/268092 "2021-03-31T14:52:38Z")
Hey guys, i've got strange ILM error during an ILM phase: ... policy \[p-ilm\] for index \[p-auditbeat-000009\] failed on step \[{"phase":"hot","action":"rollover","name":"attempt-rollover"}\]. Moving to ERROR step Mapping d… --- ## [Could not dynamically add mapping for field \[stats.something.else\]. Existing mapping for \[stats.something\] must be of type object but found \[long\]](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919)
**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 2:48pm UTC](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919 "2021-03-31T14:48:44Z")
The problem seems to be that we have both a field called stats.something and another field called stats.something.else. I get the above error when I try to submit the second piece of data. I could replace each dot with … --- ## [Heatmap with custom space](https://discuss.elastic.co/t/heatmap-with-custom-space/268902)
**Author:** [@Eddie\_Adams](https://discuss.elastic.co/u/Eddie_Adams)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 2:42pm UTC](https://discuss.elastic.co/t/heatmap-with-custom-space/268902 "2021-03-31T14:42:54Z")
{"timestamp": "2021-03-31T14:07:50.465", "key": "h", "code": "4", "type": "\[down\]"} {"timestamp": "2021-03-31T14:07:50.592", "key": "e", "code": "14", "type": "\[down\]"} {"timestamp": "2021-03-31T14:07:50.697", "key": "… --- ## [Best approach to apply Fine Grained Access Control to index documents](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817)
**Author:** [@grugna](https://discuss.elastic.co/u/grugna)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 1:31pm UTC](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817 "2021-03-31T13:31:55Z")
I have a service that apply fine grained access control to ES index document and I am facing some ES limitation / performance issue. For this reason I am not sure if my approach is correct, of if there is a better way to… --- ## [Bucket Path to access Top-hits aggregation in elasticsearch query](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 12:34pm UTC](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904 "2021-03-31T12:34:27Z")
Hello, I have an index "jmx\_metrics-\*" that contains JVM monitoring data from Jconsole. Following it the mapping of index. { "jmx\_metrics-2021.03" : { "aliases" : { }, "mappings" : { "properties" : { … --- ## [ElasticSearch performance trouble when indexing data](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745)
**Author:** [@nicolaipre](https://discuss.elastic.co/u/nicolaipre)\ **Replies:** 10\ **Last updated:** [March 31, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745 "2021-03-31T11:01:41Z")
Hi. I have about 4 TB of data I want to index in Elasticsearch. The amount of data per index will vary, depending on the source data file. These are only static files containing old data that will be ingested and made s… --- ## [Search multiple values for a single field](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 12\ **Last updated:** [March 31, 2021, 11:52am UTC](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327 "2021-03-31T11:52:42Z")
Hii.. All , I am pretty new in elk search, I want to find out multiple values for a single field (diseases:” fever,covid\_19”) with in a must with wildcard condition here the data is like this Diseases: “fever, headache… --- ## [Date Range Not Working with Now](https://discuss.elastic.co/t/date-range-not-working-with-now/268825)
**Author:** [@rohan\_5894](https://discuss.elastic.co/u/rohan_5894)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 11:50am UTC](https://discuss.elastic.co/t/date-range-not-working-with-now/268825 "2021-03-31T11:50:38Z")
I am trying to show only those documents where published\_at date is less than now-7d/d. #It seems ES is not working correctly here. I tried with an example of showing documents which are having published\_at filed greater… --- ## [Flare.json not loading for TREEMAP](https://discuss.elastic.co/t/flare-json-not-loading-for-treemap/268869)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 11:50am UTC](https://discuss.elastic.co/t/flare-json-not-loading-for-treemap/268869 "2021-03-31T11:50:13Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your setup… --- ## [Winlogbeat keystore windows](https://discuss.elastic.co/t/winlogbeat-keystore-windows/268769)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 6\ **Last updated:** [March 31, 2021, 11:12am UTC](https://discuss.elastic.co/t/winlogbeat-keystore-windows/268769 "2021-03-31T11:12:29Z")
I have created a keystore for winlogbeats as the administrator and modified winlogbeat.yml When i try and start the service it fails (running as local system) if i run winlogbeat manually it starts I can see the issue… --- ## [High level concepts of elastic stack in containerized environment](https://discuss.elastic.co/t/high-level-concepts-of-elastic-stack-in-containerized-environment/268750)
**Author:** [@siplsag](https://discuss.elastic.co/u/siplsag)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 11:08am UTC](https://discuss.elastic.co/t/high-level-concepts-of-elastic-stack-in-containerized-environment/268750 "2021-03-31T11:08:34Z")
We think about using an Elastic (ELK) stack to process logs from our servers. We have about ten virtual Ubuntu servers that run on prem. All of those servers run some docker images, currently orchestrated by docker-compo… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1481) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1483)