# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1514 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1515 --- ## [Possible workarounds for percentile in heatmaps?](https://discuss.elastic.co/t/possible-workarounds-for-percentile-in-heatmaps/266777)
**Author:** [@nnoop](https://discuss.elastic.co/u/nnoop)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 6:28pm UTC](https://discuss.elastic.co/t/possible-workarounds-for-percentile-in-heatmaps/266777 "2021-03-10T18:28:26Z")
Hi I'm new to ELK and currently trying to work on a heatmap that shows cpu utilisation and its percentile on Kibana 7.6.2. I have an index that contains kernel percent and user percent which I add together to create a sc… --- ## [Forming a new document with all the fields everytime a new event comes in](https://discuss.elastic.co/t/forming-a-new-document-with-all-the-fields-everytime-a-new-event-comes-in/265248)
**Author:** [@karanp](https://discuss.elastic.co/u/karanp)\ **Replies:** 7\ **Last updated:** [March 10, 2021, 6:27pm UTC](https://discuss.elastic.co/t/forming-a-new-document-with-all-the-fields-everytime-a-new-event-comes-in/265248 "2021-03-10T18:27:42Z")
Hello, So I am currently trying to figure this out and would love to know if my current approach is correct and if not, is there a way to do it. So, the question is We have these events coming in with each event having … --- ## [Using Nest.net indexing list\ where SomeType is abstract](https://discuss.elastic.co/t/using-nest-net-indexing-list-sometype-where-sometype-is-abstract/266848)
**Author:** [@RejectKid](https://discuss.elastic.co/u/RejectKid)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 5:40pm UTC](https://discuss.elastic.co/t/using-nest-net-indexing-list-sometype-where-sometype-is-abstract/266848 "2021-03-10T17:40:32Z")
I have an object public class SomeObject { List\ } There are several derived types of SomeType and populated in the list. However when i push this data into ES using Nest.net it strips out … --- ## [Is there a Vega equivalent to the C #include directive](https://discuss.elastic.co/t/is-there-a-vega-equivalent-to-the-c-include-directive/266805)
**Author:** [@Kayak007](https://discuss.elastic.co/u/Kayak007)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 5:34pm UTC](https://discuss.elastic.co/t/is-there-a-vega-equivalent-to-the-c-include-directive/266805 "2021-03-10T17:34:14Z")
Hi, Couldn't find any reference to an existing way to include code from a file in a Kibana Vega visualisation, like the #include directive in C. I have several Vega visualisations for which part of the code is the same… --- ## [Doing aggregations using flattened\_fields is slow](https://discuss.elastic.co/t/doing-aggregations-using-flattened-fields-is-slow/266832)
**Author:** [@Ronald\_de\_Haan](https://discuss.elastic.co/u/Ronald_de_Haan)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:41pm UTC](https://discuss.elastic.co/t/doing-aggregations-using-flattened-fields-is-slow/266832 "2021-03-10T16:41:31Z")
We consume and store data containing a field filter\_properties containing key =\> value fields. Up until now we use dynamic mapping to store that data but that's creating a lot of unique fields. So I decided to try the f… --- ## [2 different time](https://discuss.elastic.co/t/2-different-time/266640)
**Author:** [@111435](https://discuss.elastic.co/u/111435)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 4:34pm UTC](https://discuss.elastic.co/t/2-different-time/266640 "2021-03-10T16:34:33Z")
Hello guys! Please, I need your advise. From one client server to logstash comming 2 different logs with different time template: \[2021-02-24 00:00:06,335\] \[\[ACTIVE\] ExecuteThread: '121' for queue: 'weblogic.kernel.… --- ## [Crowdstrike dashboard doesn't load on Kibana](https://discuss.elastic.co/t/crowdstrike-dashboard-doesnt-load-on-kibana/266840)
**Author:** [@uforoid](https://discuss.elastic.co/u/uforoid)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 4:32pm UTC](https://discuss.elastic.co/t/crowdstrike-dashboard-doesnt-load-on-kibana/266840 "2021-03-10T16:32:36Z")
Hi everyone, I installed all the crowdstrike falcon SIEM, filebeat is able to retrieve all the data and upload them on elastic, I did "filebeat setup" to upload all the dashboards on kibana, but the crowdstrike dashboar… --- ## [Custom CSS code for dashboards](https://discuss.elastic.co/t/custom-css-code-for-dashboards/266740)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 4:31pm UTC](https://discuss.elastic.co/t/custom-css-code-for-dashboards/266740 "2021-03-10T16:31:28Z")
Hi there! I'm looking into adding some custom CSS code to personalize a bit my dashboard. Say that I have a custom dashboard, I want the panels to have rounded corners. I have tested this code w/ the Firefox inspector (… --- ## [Forcemerge multiple indices = high fragmentation on disk?](https://discuss.elastic.co/t/forcemerge-multiple-indices-high-fragmentation-on-disk/265586)
**Author:** [@MichelV](https://discuss.elastic.co/u/MichelV)\ **Replies:** 8\ **Last updated:** [March 10, 2021, 4:25pm UTC](https://discuss.elastic.co/t/forcemerge-multiple-indices-high-fragmentation-on-disk/265586 "2021-03-10T16:25:42Z")
I'm applying an ILM policy on older (daily) indices. In warm phase I have enabled forcemerge to reduce the number of segments. If I assign the ILM policy to multiple indices, say 30 days, will the forcemerge run on all … --- ## [ILM is not getting disabled in metricbeat with helm chart install](https://discuss.elastic.co/t/ilm-is-not-getting-disabled-in-metricbeat-with-helm-chart-install/266838)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 4:14pm UTC](https://discuss.elastic.co/t/ilm-is-not-getting-disabled-in-metricbeat-with-helm-chart-install/266838 "2021-03-10T16:14:08Z")
Hi I am trying. to disable ILM on metricbeat in k8s environment. I am installing metricbeat using helm chart and modified values.yml to disable the ILM. However, in the logs, I see that ILM is always enabled. Can yo… --- ## [Auditd log - creating a single event from log lines with same ID](https://discuss.elastic.co/t/auditd-log-creating-a-single-event-from-log-lines-with-same-id/266827)
**Author:** [@alanoe](https://discuss.elastic.co/u/alanoe)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:09pm UTC](https://discuss.elastic.co/t/auditd-log-creating-a-single-event-from-log-lines-with-same-id/266827 "2021-03-10T15:09:00Z")
I was using auditbeat to track audit events. However, if it goes down for a long time, I lose events, as I mentioned in https://discuss.elastic.co/t/auditd-events-created-while-auditbeat-is-down/266369. Due to that, my t… --- ## [No dynamic or static mapping - data not searchable?](https://discuss.elastic.co/t/no-dynamic-or-static-mapping-data-not-searchable/266270)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 4:00pm UTC](https://discuss.elastic.co/t/no-dynamic-or-static-mapping-data-not-searchable/266270 "2021-03-10T16:00:52Z")
I have a template that disables dynamic mapping and statically maps a few specific fields. When data is ingested that does not fit the static mappings, I can see the data in elasticsearch, but I can't search it. Queryin… --- ## [ConnectTransportException non-master-eligible node found](https://discuss.elastic.co/t/connecttransportexception-non-master-eligible-node-found/266417)
**Author:** [@SSRR](https://discuss.elastic.co/u/SSRR)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 4:00pm UTC](https://discuss.elastic.co/t/connecttransportexception-non-master-eligible-node-found/266417 "2021-03-10T16:00:28Z")
I'm configuring Elasticserach 7.9.0 cluster with 2 hosts. The elasticsearch.yml in host1 is setup with node.master as true and host2 is setup with node.master as false. Both hosts have elasticsearch started but with err… --- ## [EuiOverlayMask is over the EuiCollapsibleNav it comes from](https://discuss.elastic.co/t/euioverlaymask-is-over-the-euicollapsiblenav-it-comes-from/266410)
**Author:** [@Thomas\_Vaudry-Read](https://discuss.elastic.co/u/Thomas_Vaudry-Read)\ **Replies:** 6\ **Last updated:** [March 10, 2021, 3:57pm UTC](https://discuss.elastic.co/t/euioverlaymask-is-over-the-euicollapsiblenav-it-comes-from/266410 "2021-03-10T15:57:00Z")
Developing a Kibana plugin, and have a 3rd header layer in the page. When I set-up a button in the EuiHeader to open a EuiCollapsibleNav, the overlay covers the nav element and nothing is selectable. Here is a slice of t… --- ## [How to change logstash default timezone](https://discuss.elastic.co/t/how-to-change-logstash-default-timezone/266771)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 3:53pm UTC](https://discuss.elastic.co/t/how-to-change-logstash-default-timezone/266771 "2021-03-10T15:53:04Z")
I am using Logstash to populate data to Elasticsearch server. By default Elasticsearch using UTC format to populate the data. How to change UTC to local time zone? --- ## [Logstash not using bundled JDK](https://discuss.elastic.co/t/logstash-not-using-bundled-jdk/266814)
**Author:** [@Daniel\_Carmel](https://discuss.elastic.co/u/Daniel_Carmel)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 3:47pm UTC](https://discuss.elastic.co/t/logstash-not-using-bundled-jdk/266814 "2021-03-10T15:47:59Z")
Hey Elastic team, im using logstash 7.11.0 and ubuntu 14.04 Whenever i run it manually like this sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash logstash running as expected and using bundled JDK,… --- ## [EL7.11 Index recoveries stuck at translog stage](https://discuss.elastic.co/t/el7-11-index-recoveries-stuck-at-translog-stage/266830)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:15pm UTC](https://discuss.elastic.co/t/el7-11-index-recoveries-stuck-at-translog-stage/266830 "2021-03-10T15:15:58Z")
Hi community. I'm experiencing a problem I never saw before during index recovery... after the loss of a server, where a master and data nodes where running (something I've seen EL clustering managing exceptionally well… --- ## [API REST AWS COST EXPLORER](https://discuss.elastic.co/t/api-rest-aws-cost-explorer/266828)
**Author:** [@Oscar\_Lopez](https://discuss.elastic.co/u/Oscar_Lopez)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:09pm UTC](https://discuss.elastic.co/t/api-rest-aws-cost-explorer/266828 "2021-03-10T15:09:27Z")
Good morning, does anyone know if it is feasible to consume the aws cost explorer rest api with logstash, I know that there are three options in aws, one is through the CLI, another through a JDK and the last one that is… --- ## [Best approach to multi-word search as you type](https://discuss.elastic.co/t/best-approach-to-multi-word-search-as-you-type/266826)
**Author:** [@tbzl](https://discuss.elastic.co/u/tbzl)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 3:00pm UTC](https://discuss.elastic.co/t/best-approach-to-multi-word-search-as-you-type/266826 "2021-03-10T15:00:51Z")
Hi, I would like to add some sort of "search as you type" functionality but have been struggling to find the right one. Say I have the following product name: Some Brand Sweater Striped Green What would be the best m… --- ## [Filebeat: Error while retrieving FD information: error getting number of open FD: key not found](https://discuss.elastic.co/t/filebeat-error-while-retrieving-fd-information-error-getting-number-of-open-fd-key-not-found/266822)
**Author:** [@meissen](https://discuss.elastic.co/u/meissen)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 2:37pm UTC](https://discuss.elastic.co/t/filebeat-error-while-retrieving-fd-information-error-getting-number-of-open-fd-key-not-found/266822 "2021-03-10T14:37:58Z")
Hello, after upgrading filebeat to version 7.9.0 I'm getting the following error : Filebeat: Error while retrieving FD information: error getting number of open FD: key not found the filebeat agent is started via the … --- ## [Adding rollover configuration in ELK 7.6](https://discuss.elastic.co/t/adding-rollover-configuration-in-elk-7-6/265521)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 2:32pm UTC](https://discuss.elastic.co/t/adding-rollover-configuration-in-elk-7-6/265521 "2021-03-10T14:32:13Z")
I am trying to rollover indices that are over 30 days and need to target indices that are already in the elasticsearch along with new indices Our indices get created on weekly basis and i am not able to add an rollover … --- ## [Has error making http request: Get "http://npipe/state": been fixed yet for Elastic Agent 7.10.2?](https://discuss.elastic.co/t/has-error-making-http-request-get-http-npipe-state-been-fixed-yet-for-elastic-agent-7-10-2/266722)
**Author:** [@dvo](https://discuss.elastic.co/u/dvo)\ **Replies:** 4\ **Last updated:** [March 10, 2021, 2:25pm UTC](https://discuss.elastic.co/t/has-error-making-http-request-get-http-npipe-state-been-fixed-yet-for-elastic-agent-7-10-2/266722 "2021-03-10T14:25:05Z")
I'm testing a single Windows agent, and Kibana is littered with these errors, and it looks bad to the potential customer. I've got to get it cleaned up. error making http request: Get "http://npipe/state": open \\default… --- ## [Unable to establish connection](https://discuss.elastic.co/t/unable-to-establish-connection/266808)
**Author:** [@RomanK](https://discuss.elastic.co/u/RomanK)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 12:55pm UTC](https://discuss.elastic.co/t/unable-to-establish-connection/266808 "2021-03-10T12:55:39Z")
Our architecture has microservices that cannot connect to the internal network by themselves (for security reasons). Is it possible to establish a TCP connection from the Elasticsearch side? --- ## [Default Route for specific spaces](https://discuss.elastic.co/t/default-route-for-specific-spaces/266702)
**Author:** [@Lambo1971](https://discuss.elastic.co/u/Lambo1971)\ **Replies:** 5\ **Last updated:** [March 10, 2021, 12:21pm UTC](https://discuss.elastic.co/t/default-route-for-specific-spaces/266702 "2021-03-10T12:21:31Z")
Hi, I read somewhere that each space can now have its own default route via the advanced settings page. However, i only appear to be able to see an advanced settings option under the kibana menu item for the Default spac… --- ## [How to sum two fields in Kibana?](https://discuss.elastic.co/t/how-to-sum-two-fields-in-kibana/266765)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 6\ **Last updated:** [March 10, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-to-sum-two-fields-in-kibana/266765 "2021-03-10T11:44:12Z")
I have two different fields. Let Suppose A and B and I want sum of these two fields A+B and create new field and save records in this new created field. --- ## [Can we control space between label and aggregated value in metric visualization?](https://discuss.elastic.co/t/can-we-control-space-between-label-and-aggregated-value-in-metric-visualization/266767)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 2\ **Last updated:** [March 10, 2021, 10:57am UTC](https://discuss.elastic.co/t/can-we-control-space-between-label-and-aggregated-value-in-metric-visualization/266767 "2021-03-10T10:57:24Z")
Hello, In any way can we control space between label and aggregated value in metric visualization, as 'g' is getting cut in text, as shown in above image. --- ## [Logstash file input reading partial lines with docker setup](https://discuss.elastic.co/t/logstash-file-input-reading-partial-lines-with-docker-setup/266798)
**Author:** [@jong99](https://discuss.elastic.co/u/jong99)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 10:47am UTC](https://discuss.elastic.co/t/logstash-file-input-reading-partial-lines-with-docker-setup/266798 "2021-03-10T10:47:46Z")
I've been having difficulty with the logstash input filter sometimes picking up partial lines with my setup. I think it may be related to how I am using docker but I'm running out of ideas. I have logstash in a docker … --- ## [How to adjust Tooltip width? More than half of text is hidden-2](https://discuss.elastic.co/t/how-to-adjust-tooltip-width-more-than-half-of-text-is-hidden-2/266789)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 10:24am UTC](https://discuss.elastic.co/t/how-to-adjust-tooltip-width-more-than-half-of-text-is-hidden-2/266789 "2021-03-10T10:24:30Z")
Hi all, the tooltip in most charts such as line chart,vertical bar chart is not customizable . Only half tooltip appears. There is already an issue which was raised, but no action: An enhancement issue is already r… --- ## [Cannot link Java class io.netty.handler.ssl.OpenSsl](https://discuss.elastic.co/t/cannot-link-java-class-io-netty-handler-ssl-openssl/266790)
**Author:** [@zarak](https://discuss.elastic.co/u/zarak)\ **Replies:** 0\ **Last updated:** [March 10, 2021, 10:01am UTC](https://discuss.elastic.co/t/cannot-link-java-class-io-netty-handler-ssl-openssl/266790 "2021-03-10T10:01:28Z")
Hello ! I'm running Logstash 6.8.14 on debian. It's running fine, until I try to send a SIHGUP to reload the pipelines and config. I now have this in the logs, restarting it doesn't solve the issue: Mar 10 10:51:39 hos… --- ## [Filebeat-7.10.2-mongodb-log-pipeline: cannot write to a field alias \[cloud.availability\_zone\]](https://discuss.elastic.co/t/filebeat-7-10-2-mongodb-log-pipeline-cannot-write-to-a-field-alias-cloud-availability-zone/266783)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 1\ **Last updated:** [March 10, 2021, 10:00am UTC](https://discuss.elastic.co/t/filebeat-7-10-2-mongodb-log-pipeline-cannot-write-to-a-field-alias-cloud-availability-zone/266783 "2021-03-10T10:00:08Z")
Dear experts, after migration from 6.8.13 to 7.10.2, MongoDB events logged are no more properly parsed by the factory mongodb ingest pipelines. To be honest, I have no idea about the root cause. Many thanks for your he… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1513) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1515)