# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1509 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1510 --- ## [Vertical Bar Unique Count all counts = 1](https://discuss.elastic.co/t/vertical-bar-unique-count-all-counts-1/264171)
**Author:** [@j4sper](https://discuss.elastic.co/u/j4sper)\ **Replies:** 6\ **Last updated:** [March 14, 2021, 6:06pm UTC](https://discuss.elastic.co/t/vertical-bar-unique-count-all-counts-1/264171 "2021-03-14T18:06:29Z")
I'm trying to visualize dns log data in a vertical chart. X-axis should be remote\_host. Y-axis should be count of remote\_host. I do this by setting Data -\> Metrics -\> Y-axis -\> Aggregation to Unique Count and Field to r… --- ## [Csv to float from logstash to elasticsearch](https://discuss.elastic.co/t/csv-to-float-from-logstash-to-elasticsearch/267105)
**Author:** [@ofitz](https://discuss.elastic.co/u/ofitz)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 3:48pm UTC](https://discuss.elastic.co/t/csv-to-float-from-logstash-to-elasticsearch/267105 "2021-03-14T15:48:39Z")
I have some problems to read CSV and convert the values as float in Array My Demo Dataset: 215900;216100;216300;216430; 216750;216950;217230;217500; 217780;217930;218100;218250; My logstash Config: input { file { … --- ## [Update all collection based on pattern](https://discuss.elastic.co/t/update-all-collection-based-on-pattern/267199)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 5:47pm UTC](https://discuss.elastic.co/t/update-all-collection-based-on-pattern/267199 "2021-03-14T17:47:54Z")
Hi, I have a several indexes, they all contains data such this one: { "\_index" : "item\_index", "imageUri" : "https://cdn.socloze.com/cdn/e\_07266e9e-d294.jpg" ... } and I wish to convert all the "/cdn/" into "/v1/c… --- ## [Schedule ElasticSearch 6.1.2 snapshots](https://discuss.elastic.co/t/schedule-elasticsearch-6-1-2-snapshots/267154)
**Author:** [@mwise29](https://discuss.elastic.co/u/mwise29)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:56pm UTC](https://discuss.elastic.co/t/schedule-elasticsearch-6-1-2-snapshots/267154 "2021-03-14T16:56:28Z")
We have an older ElasticSearch cluster that is currently running version 6.1.2. I noticed it didn't have any snapshots of the data. SLM isn't supported with that version so I was wondering how snapshots could be schedu… --- ## [Elastic TLS: "xpack.security.http.ssl.enabled: true" vs proxy](https://discuss.elastic.co/t/elastic-tls-xpack-security-http-ssl-enabled-true-vs-proxy/267197)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 4:39pm UTC](https://discuss.elastic.co/t/elastic-tls-xpack-security-http-ssl-enabled-true-vs-proxy/267197 "2021-03-14T16:39:43Z")
Hi Elastic 7.11.1 Planning on configuring TLS for elasticsearch port 9200 I was wondering, is there a difference, whether I configure TLS with: elasticsearch.yml: xpack.security.http.ssl.enabled: true or via apache/… --- ## [How hot node differ from warm node](https://discuss.elastic.co/t/how-hot-node-differ-from-warm-node/267186)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:40pm UTC](https://discuss.elastic.co/t/how-hot-node-differ-from-warm-node/267186 "2021-03-14T16:40:00Z")
Total index=25 Logs/day=50gbx2(copies)=100gb Shards/day=25x2=50 shards Log retention 60 days Logs for 60 days=100x60=6Tb Shards for 60 days=50x60=3000 So we are planning to use 3 master node with 8gb heap 6 hot dat… --- ## [Elasticsearch shards size increase sometimes](https://discuss.elastic.co/t/elasticsearch-shards-size-increase-sometimes/267188)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 4:01pm UTC](https://discuss.elastic.co/t/elasticsearch-shards-size-increase-sometimes/267188 "2021-03-14T16:01:14Z")
I have a time based index called log-wlb-sysmon-2021.03.13 its index size is 19gb with replication 38gb.I created 2 shards(1p+1r) Sometimes its size increases from 38gb to 44gb.I am using ilm policy for this index in th… --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/267193)
**Author:** [@Boris\_Becker](https://discuss.elastic.co/u/Boris_Becker)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-error/267193 "2021-03-14T15:21:15Z")
Do filebeat connected to logstash if it got the error (how it can be fixed?): 2021-03-14T15:06:08.306Z ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://vpc-au… --- ## [Help with equation in ruby](https://discuss.elastic.co/t/help-with-equation-in-ruby/267172)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 1\ **Last updated:** [March 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/help-with-equation-in-ruby/267172 "2021-03-14T14:43:14Z")
I'm doing some calculations in ruby and works well when doing basic stuff like subtracting a from b but I have something a little more complex that I just cant get the syntax right or work out the most efficient way to d… --- ## [Multiple Webhook](https://discuss.elastic.co/t/multiple-webhook/267178)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 2:37pm UTC](https://discuss.elastic.co/t/multiple-webhook/267178 "2021-03-14T14:37:58Z")
Hi I want to make an alert(watcher) with multiple action. For example, I need to call more than two hosts(with different path and port) so I need to use my\_webhook according to the bellow page: "actions" : { "my\_we… --- ## [Ingest Pipeline Convert Processor is not converting](https://discuss.elastic.co/t/ingest-pipeline-convert-processor-is-not-converting/267166)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 2\ **Last updated:** [March 14, 2021, 2:37pm UTC](https://discuss.elastic.co/t/ingest-pipeline-convert-processor-is-not-converting/267166 "2021-03-14T14:37:22Z")
I am using Filebeat, Elasticsearch and Kibana 7.10.2 in docker containers I have a working pipeline: PUT /\_ingest/pipeline/test\_grok\_pipeline { "description": "Test grok pattern", "processors": \[ { "grok"… --- ## [How to create geo-point fields from longitude / latitude](https://discuss.elastic.co/t/how-to-create-geo-point-fields-from-longitude-latitude/267179)
**Author:** [@lostsoul352](https://discuss.elastic.co/u/lostsoul352)\ **Replies:** 7\ **Last updated:** [March 14, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-create-geo-point-fields-from-longitude-latitude/267179 "2021-03-14T14:33:25Z")
ELK 7.10. I've used the geoip filter in logstash to get geo data from a remote IP Address. Now I have geo data appearing in elastic. I want to be able to map these on a map chart and I don't understand how to do the … --- ## [Cross Cluster Replication monitoring](https://discuss.elastic.co/t/cross-cluster-replication-monitoring/267184)
**Author:** [@eli.cohen](https://discuss.elastic.co/u/eli.cohen)\ **Replies:** 1\ **Last updated:** [March 14, 2021, 1:46pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-monitoring/267184 "2021-03-14T13:46:10Z")
We use Prometheus and Grafana as a monitoring solution. I would like to know if there is a Prometheus exporter for CCR. If not, then what is the best way to monitor the replication state, replication lag per index and ot… --- ## [Which version is recommended?](https://discuss.elastic.co/t/which-version-is-recommended/267134)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 3\ **Last updated:** [March 14, 2021, 8:58am UTC](https://discuss.elastic.co/t/which-version-is-recommended/267134 "2021-03-14T08:58:39Z")
Which version(s) of Java or OpenJDK is recommended for Elasticsearch 7.11.1 ? --- ## [Conditional setting of values in VEGA (for gantt chart)](https://discuss.elastic.co/t/conditional-setting-of-values-in-vega-for-gantt-chart/266580)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 4\ **Last updated:** [March 14, 2021, 8:16am UTC](https://discuss.elastic.co/t/conditional-setting-of-values-in-vega-for-gantt-chart/266580 "2021-03-14T08:16:36Z")
I want to create gantt chat display where "end" bar is dependent on the application status. If "status" is "Running" - I want to set endTime to "now()" If "status" is "not Running" - I want to use endTime field from th… --- ## [Table in canvas not showing](https://discuss.elastic.co/t/table-in-canvas-not-showing/267148)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 2\ **Last updated:** [March 14, 2021, 6:34am UTC](https://discuss.elastic.co/t/table-in-canvas-not-showing/267148 "2021-03-14T06:34:30Z")
I'm new to canvas so my question might be stupid. I'm trying to add metricbeat data to a table using essql. In the preview data section, I can see my data but the table's empty. Here's the expression I'm using: filters… --- ## [Can't launch Elasticsearch](https://discuss.elastic.co/t/cant-launch-elasticsearch/267168)
**Author:** [@PaulGureghian](https://discuss.elastic.co/u/PaulGureghian)\ **Replies:** 0\ **Last updated:** [March 14, 2021, 1:20am UTC](https://discuss.elastic.co/t/cant-launch-elasticsearch/267168 "2021-03-14T01:20:56Z")
My JAVA\_HOME code in .profile export JAVA\_HOME=/usr/lib/jvm/java-1.11.0-openjdk-amd64 export PATH=$JAVA\_HOME/bin:$PATH And when I try to launch: \[elasticsearch-7.11.1\] ./bin/elasticsearch Exception in thread "main" j… --- ## [Elasticsearch suddenly unavailable](https://discuss.elastic.co/t/elasticsearch-suddenly-unavailable/267153)
**Author:** [@cdalexndr](https://discuss.elastic.co/u/cdalexndr)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 7:32pm UTC](https://discuss.elastic.co/t/elasticsearch-suddenly-unavailable/267153 "2021-03-13T19:32:40Z")
After some time, the service suddenly doesn't work... org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]; I'm using a single node instance, ES 7… --- ## [Detection engine](https://discuss.elastic.co/t/detection-engine/266490)
**Author:** [@Liora](https://discuss.elastic.co/u/Liora)\ **Replies:** 5\ **Last updated:** [March 13, 2021, 6:26pm UTC](https://discuss.elastic.co/t/detection-engine/266490 "2021-03-13T18:26:18Z")
Hi everyone, how can i please enable the Detections feature in Kibana? Who is the user with the mentioned privileges? Thank you --- ## [Show field value as icon/svg](https://discuss.elastic.co/t/show-field-value-as-icon-svg/267050)
**Author:** [@SKiD](https://discuss.elastic.co/u/SKiD)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 6:01pm UTC](https://discuss.elastic.co/t/show-field-value-as-icon-svg/267050 "2021-03-13T18:01:55Z")
Hey, I read some stuff about showing images in Kibana in the Discovery screen. Now I was curious and tested some things out. I was able to show URLs as picture, that worked great, but what I wasn't able to do is showing… --- ## [GeoIP - how to only show users who are or have logged on from multiple locations](https://discuss.elastic.co/t/geoip-how-to-only-show-users-who-are-or-have-logged-on-from-multiple-locations/266817)
**Author:** [@FinT](https://discuss.elastic.co/u/FinT)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 5:50pm UTC](https://discuss.elastic.co/t/geoip-how-to-only-show-users-who-are-or-have-logged-on-from-multiple-locations/266817 "2021-03-13T17:50:35Z")
elastic stack 6.5.1. This question can be applied to any similar query to filter events. I have visualised users (donut) who have logged in remotely. The inner ring shows users, the outer shows countries. Due to the lar… --- ## [Elasticsearch on-premise licensing](https://discuss.elastic.co/t/elasticsearch-on-premise-licensing/266821)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [March 13, 2021, 4:21pm UTC](https://discuss.elastic.co/t/elasticsearch-on-premise-licensing/266821 "2021-03-13T16:21:18Z")
Hi all, I have a question regarding Elasticsearch licensing. I got a license for an on-premise Elasticsearch deployment that says max\_nodes=12. I know I can apply it to an Elasticsearch cluster comprised of up to 12 d… --- ## [Grok Debugger in Dev tools Parses differently than logstash](https://discuss.elastic.co/t/grok-debugger-in-dev-tools-parses-differently-than-logstash/266602)
**Author:** [@nfored](https://discuss.elastic.co/u/nfored)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 3:10pm UTC](https://discuss.elastic.co/t/grok-debugger-in-dev-tools-parses-differently-than-logstash/266602 "2021-03-13T15:10:31Z")
I can copy and paste a the log from kibana discover into the debugger, then open up the .conf file copy and past the grok from there, and press simulate. Ever single time without fail it works, but Its only partly workin… --- ## [How to split array json into multiple fields](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 3\ **Last updated:** [March 13, 2021, 2:39pm UTC](https://discuss.elastic.co/t/how-to-split-array-json-into-multiple-fields/267112 "2021-03-13T14:39:27Z")
Hi All, I have a array json which am getting from http end point "summary": { "result": \[ { "status": { "offlineCount": 0, "warningCount": 0, "onlineCount": 1… --- ## [Kibana Data Visualization With Multiple Instances](https://discuss.elastic.co/t/kibana-data-visualization-with-multiple-instances/267076)
**Author:** [@gokhungok](https://discuss.elastic.co/u/gokhungok)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 1:30pm UTC](https://discuss.elastic.co/t/kibana-data-visualization-with-multiple-instances/267076 "2021-03-13T13:30:44Z")
Hello we're searching some data visualization tools and Kibana is one of the best tools for our requirements for now. But we need to clarify one case; We'll use Kibana as feature for one of our products and this product… --- ## [Processing old newsgroup messages](https://discuss.elastic.co/t/processing-old-newsgroup-messages/267147)
**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 11:33am UTC](https://discuss.elastic.co/t/processing-old-newsgroup-messages/267147 "2021-03-13T11:33:15Z")
Hi, I'm working on a project to index millions of newsgroups messages dating from the early 80s to the present day. The messages are supplied as individual files. I'm using logstash in "read" mode with the multiline code… --- ## [Get logs from my ip only in Paketbeat](https://discuss.elastic.co/t/get-logs-from-my-ip-only-in-paketbeat/267145)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 10:25am UTC](https://discuss.elastic.co/t/get-logs-from-my-ip-only-in-paketbeat/267145 "2021-03-13T10:25:11Z")
Hi, Can anybody tell how can I set a condition in packetbeat.yml to get traffic from my ip only and not from different subnets? In other words the destination.ip: should be only my ip and any other ip in the subnet. I'… --- ## [Configuring logstash for multiple input (port and log file path)](https://discuss.elastic.co/t/configuring-logstash-for-multiple-input-port-and-log-file-path/267140)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 6:03am UTC](https://discuss.elastic.co/t/configuring-logstash-for-multiple-input-port-and-log-file-path/267140 "2021-03-13T06:03:13Z")
Hi I've Configured three of my network devices to write their logs in separated file in /var/log and also i configured my Logstash to read these file as input and it's working well and i could create index for them and … --- ## [Elastic-Agent system logs stops](https://discuss.elastic.co/t/elastic-agent-system-logs-stops/267135)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [March 13, 2021, 4:19am UTC](https://discuss.elastic.co/t/elastic-agent-system-logs-stops/267135 "2021-03-13T04:19:52Z")
Hi, In de default integration 'system' you can add 'system syslog logs' to collect. I added a few logs here. That's working. But every 2 days or so this logging stops. A workaround is to edit the interation, change not… --- ## [Get the documents with max of @version based on document\_id](https://discuss.elastic.co/t/get-the-documents-with-max-of-version-based-on-document-id/266877)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 1\ **Last updated:** [March 13, 2021, 3:47am UTC](https://discuss.elastic.co/t/get-the-documents-with-max-of-version-based-on-document-id/266877 "2021-03-13T03:47:00Z")
Hi All, I have certain documents in my index with each document having a document\_id as primary key with the combination of "Campaign" and "Camp Line" which will be %{Campaign}%{Camp Line} Every Document has @version. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1508) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1510)