# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1607 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1608 --- ## [Delete document from elasticsearch](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910)
**Author:** [@mac1](https://discuss.elastic.co/u/mac1)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 10:01pm UTC](https://discuss.elastic.co/t/delete-document-from-elasticsearch/260910 "2021-01-12T22:01:26Z")
hi, delete\_by\_query is safe to delete huge volume of data (in gbs) in one go. Will it create any performance issues in ES. Will it free the space automatically ? --- ## [Export a csv from ElasticSearch 6.8 kibana](https://discuss.elastic.co/t/export-a-csv-from-elasticsearch-6-8-kibana/260873)
**Author:** [@Biran\_Redlinger](https://discuss.elastic.co/u/Biran_Redlinger)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:50pm UTC](https://discuss.elastic.co/t/export-a-csv-from-elasticsearch-6-8-kibana/260873 "2021-01-12T21:50:33Z")
I'm trying to export csv file from kibana es (6.8) But this is what I see: How can I import to csv file? Thanks! --- ## [Problem on kibana](https://discuss.elastic.co/t/problem-on-kibana/260905)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 12\ **Last updated:** [January 12, 2021, 9:46pm UTC](https://discuss.elastic.co/t/problem-on-kibana/260905 "2021-01-12T21:46:59Z")
Kibana is having trouble loading. I have the following capture: Do I have to delete any indexes? Are there other solutions? --- ## [Update Documents with new Field](https://discuss.elastic.co/t/update-documents-with-new-field/260906)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 9:40pm UTC](https://discuss.elastic.co/t/update-documents-with-new-field/260906 "2021-01-12T21:40:22Z")
I have a set of data wherein generic identifiers exist. This is partially due to another index which also uses these generic identifiers and our use of Timelion to display dashboards with a combination of data from both… --- ## [Hi, I am trying to create time count in mins since the link is up in heartbeat from the time it was down using TSVP Graph](https://discuss.elastic.co/t/hi-i-am-trying-to-create-time-count-in-mins-since-the-link-is-up-in-heartbeat-from-the-time-it-was-down-using-tsvp-graph/260453)
**Author:** [@Gaurav2](https://discuss.elastic.co/u/Gaurav2)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:38pm UTC](https://discuss.elastic.co/t/hi-i-am-trying-to-create-time-count-in-mins-since-the-link-is-up-in-heartbeat-from-the-time-it-was-down-using-tsvp-graph/260453 "2021-01-12T21:38:00Z")
I tried it by calculating the count of summary.up and summary.down and with some logic in painless script. but not luck --- ## [Defining fields for metricsets](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720)
**Author:** [@efftee](https://discuss.elastic.co/u/efftee)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 9:31pm UTC](https://discuss.elastic.co/t/defining-fields-for-metricsets/260720 "2021-01-12T21:31:29Z")
Hi there, Using a single metricbeat agent to finetune settings before a larger deployment to 3000+ hosts, and trying to contain the number of fields to only those required, I seem to hit a wall at the "metricsets" level… --- ## [Network I/O](https://discuss.elastic.co/t/network-i-o/260902)
**Author:** [@Srikanth\_Kesireddy](https://discuss.elastic.co/u/Srikanth_Kesireddy)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 9:01pm UTC](https://discuss.elastic.co/t/network-i-o/260902 "2021-01-12T21:01:10Z")
How to Monitor Network I/O in my VM and Which beat is suitable for that? --- ## [Should I store ES GC logs in my stack? And is there a way to condense them?](https://discuss.elastic.co/t/should-i-store-es-gc-logs-in-my-stack-and-is-there-a-way-to-condense-them/260887)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 8:48pm UTC](https://discuss.elastic.co/t/should-i-store-es-gc-logs-in-my-stack-and-is-there-a-way-to-condense-them/260887 "2021-01-12T20:48:24Z")
While poking around looking for ways to save space, I noticed that Elasticsearch .gc logs were 80% of my Filebeat logs. I turned them off yesterday afternoon. This morning I did a comparison of how many hits I got yeste… --- ## [I want to split the existing index to daily index](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 6\ **Last updated:** [January 12, 2021, 8:08pm UTC](https://discuss.elastic.co/t/i-want-to-split-the-existing-index-to-daily-index/260501 "2021-01-12T20:08:55Z")
Hello, I want to split the existing index of size 200gb into daily index, That index has data of 1 month. I have setup of 8 core cpu and 16gb ram. what query should I write on dev tools or is there any other way to ex… --- ## [Need assistance on combined processors within metricbeat module](https://discuss.elastic.co/t/need-assistance-on-combined-processors-within-metricbeat-module/260416)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:41pm UTC](https://discuss.elastic.co/t/need-assistance-on-combined-processors-within-metricbeat-module/260416 "2021-01-12T19:41:27Z")
Hello, I need assistance on getting a combined processor up and running. Situation: I'm running metricbeat 7.9.1. I would like to set up the metricbeat to monitor windows services when: windows.service.display\_name … --- ## [Functionbeat deploy fails, citing issue with s3 bucket](https://discuss.elastic.co/t/functionbeat-deploy-fails-citing-issue-with-s3-bucket/260767)
**Author:** [@Jonathan\_Detert](https://discuss.elastic.co/u/Jonathan_Detert)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 7:36pm UTC](https://discuss.elastic.co/t/functionbeat-deploy-fails-citing-issue-with-s3-bucket/260767 "2021-01-12T19:36:59Z")
I'm trying to use functionbeat for my first time, with a single function, of type kinesis, using functionbeat v6.8.13. When I run 'functionbeat deploy kinesis' (where 'kinesis' is the name i chose for the function name)… --- ## [StatsD: metricset 'statsd/server' is not registered, module not found](https://discuss.elastic.co/t/statsd-metricset-statsd-server-is-not-registered-module-not-found/260641)
**Author:** [@shugydw](https://discuss.elastic.co/u/shugydw)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 7:20pm UTC](https://discuss.elastic.co/t/statsd-metricset-statsd-server-is-not-registered-module-not-found/260641 "2021-01-12T19:20:54Z")
Hello. I am encountering an error with StatsD module. Please help! Exiting: 1 error: 1 error: metricset 'statsd/server' is not registered, module not found Here is the confirguration module: statsd period: 10s met… --- ## [XDELETE is not working - Doesn't delete data from all the Data nodes for ES](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876)
**Author:** [@ajayvembu](https://discuss.elastic.co/u/ajayvembu)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 6:34pm UTC](https://discuss.elastic.co/t/xdelete-is-not-working-doesnt-delete-data-from-all-the-data-nodes-for-es/260876 "2021-01-12T18:34:22Z")
Currently we are using Elastic Search 2.3.1 and trying to issue XDELETE command on the indices. I understand it's pretty old version & has attained EOL but I assume the underlying working mechanism of XDELETE wouldn't ch… --- ## [Removing the Observability App in Kibana 7.9.3](https://discuss.elastic.co/t/removing-the-observability-app-in-kibana-7-9-3/260846)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 5\ **Last updated:** [January 12, 2021, 6:32pm UTC](https://discuss.elastic.co/t/removing-the-observability-app-in-kibana-7-9-3/260846 "2021-01-12T18:32:08Z")
Hi, I am trying to remove Observability from the navigation menu. There does not appear to be an option in the Edit space settings. --- ## [Google Cloud discovery not working](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871)
**Author:** [@Mark\_Pevec](https://discuss.elastic.co/u/Mark_Pevec)\ **Replies:** 8\ **Last updated:** [January 12, 2021, 6:06pm UTC](https://discuss.elastic.co/t/google-cloud-discovery-not-working/260871 "2021-01-12T18:06:03Z")
Has anyone ever successfully used the Google Cloud discovery plugin successfully? After testing and debugging for a week I can't get it working. I am using the latest 7.x release (installed on debian-10 following all th… --- ## [Visualize buckets by using text fields](https://discuss.elastic.co/t/visualize-buckets-by-using-text-fields/260646)
**Author:** [@imaneg](https://discuss.elastic.co/u/imaneg)\ **Replies:** 4\ **Last updated:** [January 12, 2021, 6:01pm UTC](https://discuss.elastic.co/t/visualize-buckets-by-using-text-fields/260646 "2021-01-12T18:01:59Z")
Hello, I would like to visualize buckets by using text fields rather than keywords. For doing this I enabled fielddata on the targeted text field. I am able to see the results when I am running the aggregation from dev … --- ## [Kibana](https://discuss.elastic.co/t/kibana/260868)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 5:18pm UTC](https://discuss.elastic.co/t/kibana/260868 "2021-01-12T17:18:11Z")
Hi, I set up 3 node elastic cluster with kibana on docker. And it was working. But I after restart it again by docker-compose.yml everything is showing running but kibana is now not opening in browser but in docker side… --- ## [How to Query for length with elasticsearch (KQL)](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815)
**Author:** [@Elasticnewbie1](https://discuss.elastic.co/u/Elasticnewbie1)\ **Replies:** 15\ **Last updated:** [January 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/how-to-query-for-length-with-elasticsearch-kql/259815 "2021-01-12T16:53:44Z")
Hey there, im new to this elk world and im currently working on a threat hunting project with ELK/Zeek. My problem is, that i want for example to query for DNS.Length \> 75 within zeek data. I know that its easy to do i… --- ## [\[BUG?\] date\_histogram hard\_bounds returns unknown\_field](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825)
**Author:** [@demasie](https://discuss.elastic.co/u/demasie)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 4:45pm UTC](https://discuss.elastic.co/t/bug-date-histogram-hard-bounds-returns-unknown-field/260825 "2021-01-12T16:45:09Z")
The following snippet returns error reason \[date\_histogram\] unknown field \[hard\_bounds\] did you mean \[extended\_bounds\]? { date\_histogram: { field: 'date', calendar\_interval: 'day', hard\_bounds: { min: '2020-11… --- ## [Elasticsearch fails to start on VM Boot](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-vm-boot/260645)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 5\ **Last updated:** [January 12, 2021, 4:37pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-on-vm-boot/260645 "2021-01-12T16:37:34Z")
I am running Ubuntu 20. Upon starting my machine, kibana fails, saying it can't connect to localhost:9200. I check on Elasticsearch, and I see this: ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/sy… --- ## [Logstash stops writing to output file](https://discuss.elastic.co/t/logstash-stops-writing-to-output-file/260860)
**Author:** [@jorism](https://discuss.elastic.co/u/jorism)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 4:17pm UTC](https://discuss.elastic.co/t/logstash-stops-writing-to-output-file/260860 "2021-01-12T16:17:36Z")
We have configured beats to collect access logs on different servers, and write those to logstash. After a while, logstash (latest version stops writing to the output file. The process keeps running but it stops writin… --- ## [Translate searchSourceJSON to Query DQL](https://discuss.elastic.co/t/translate-searchsourcejson-to-query-dql/260847)
**Author:** [@hyxelt](https://discuss.elastic.co/u/hyxelt)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 4:00pm UTC](https://discuss.elastic.co/t/translate-searchsourcejson-to-query-dql/260847 "2021-01-12T16:00:01Z")
I am trying to convert searchSourceJSON attribute of savedObject in DQL. But I haven't found a way to do it. The idea is to be able to execute the query that is stored in the object and execute it directly in ElasticSea… --- ## [Filtering timeseries by highlighting graph](https://discuss.elastic.co/t/filtering-timeseries-by-highlighting-graph/260769)
**Author:** [@David\_Tomasheski](https://discuss.elastic.co/u/David_Tomasheski)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 3:58pm UTC](https://discuss.elastic.co/t/filtering-timeseries-by-highlighting-graph/260769 "2021-01-12T15:58:27Z")
I have data flowing into an index that I use to populate multiple timeseries bar charts. My dashboard is set to view from 3 months ago until now. This looks great however say I want to zoom in on the latest data. If I cl… --- ## [Access to elastic.co cluster Kibana error](https://discuss.elastic.co/t/access-to-elastic-co-cluster-kibana-error/260856)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 3:48pm UTC](https://discuss.elastic.co/t/access-to-elastic-co-cluster-kibana-error/260856 "2021-01-12T15:48:44Z")
Hello, We have a cluster hosted on elastic.co, every time i access the Kiban dashboard I get the following error \[instance-\*\*\*\*\] failed to execute \[script\] transform for \[disVcG\_pRUaBuOK\_EkrBpw\_elasticsearch\_cluster\_st… --- ## [Issue with max\_determinized\_states while selecting 1500+ columns](https://discuss.elastic.co/t/issue-with-max-determinized-states-while-selecting-1500-columns/260853)
**Author:** [@kavipadm](https://discuss.elastic.co/u/kavipadm)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 3:33pm UTC](https://discuss.elastic.co/t/issue-with-max-determinized-states-while-selecting-1500-columns/260853 "2021-01-12T15:33:55Z")
Hi Team, I am trying to query elasticsearch from spark - However, running into the below error while selecting 1500+ columns: org.elasticsearch.hadoop.rest.EsHadoopInvalidRequest: org.elasticsearch.hadoop.rest.EsHadoop… --- ## [Is there any way to aggregate an average without outliers?](https://discuss.elastic.co/t/is-there-any-way-to-aggregate-an-average-without-outliers/259940)
**Author:** [@ofir\_y](https://discuss.elastic.co/u/ofir_y)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 2:33pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-aggregate-an-average-without-outliers/259940 "2021-01-12T14:33:01Z")
I need a way to create a transform that will aggregate the average of a field but without the outliers (let's say all values that falls between 10%-90% percentiles). for example if I have the following values: \[1,2,3,4,… --- ## [How to make stats visible(turned on) always in a Kibana visualization](https://discuss.elastic.co/t/how-to-make-stats-visible-turned-on-always-in-a-kibana-visualization/260760)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 1\ **Last updated:** [January 12, 2021, 1:55pm UTC](https://discuss.elastic.co/t/how-to-make-stats-visible-turned-on-always-in-a-kibana-visualization/260760 "2021-01-12T13:55:38Z")
When I hover mouse over a visualization(in a bar/pie chart) I get to see stats like percentage etc. Is it possible to make this visible(turned on) always? without needing to hover the mouse on it. See attached screen s… --- ## [Logstash multi pipeline optimal configuration](https://discuss.elastic.co/t/logstash-multi-pipeline-optimal-configuration/260832)
**Author:** [@Dimitrios\_Dellios](https://discuss.elastic.co/u/Dimitrios_Dellios)\ **Replies:** 0\ **Last updated:** [January 12, 2021, 1:27pm UTC](https://discuss.elastic.co/t/logstash-multi-pipeline-optimal-configuration/260832 "2021-01-12T13:27:57Z")
Greetings! I am currently running Logstash 7.9.2, on a production node, with Logstash being the only one of the stack installed there. My node has 8 cores. I am running a multiple pipeline configuration, with some pipel… --- ## [Logstash grok filter not working](https://discuss.elastic.co/t/logstash-grok-filter-not-working/260270)
**Author:** [@vinodhini](https://discuss.elastic.co/u/vinodhini)\ **Replies:** 3\ **Last updated:** [January 12, 2021, 1:12pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/260270 "2021-01-12T13:12:17Z")
I am trying to get my grok filter working. "\[20/Oct/2020:16:37:57.750 -0500\] BIND RESULT instanceName="abc.com" threadID=9 conn=2312717 op=0 msgID=1 request erIP="123.12.12.1" version="3" dn="uid=xyz,ou=appids,ou=admin… --- ## [\[parsing date error\]: date\_time\_parse\_exception: Failed to parse with all enclosed parsers](https://discuss.elastic.co/t/parsing-date-error-date-time-parse-exception-failed-to-parse-with-all-enclosed-parsers/260804)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [January 12, 2021, 11:13am UTC](https://discuss.elastic.co/t/parsing-date-error-date-time-parse-exception-failed-to-parse-with-all-enclosed-parsers/260804 "2021-01-12T11:13:51Z")
Hello, I am using elasticsearch, Kibana and Logstash all version 7.10.1 I would like to ingest data from URLhaus, so I have created a template like that: PUT \_template/urlhaus { "index\_patterns": \["urlhaus-\*"\], "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1606) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1608)