# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1649 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1650 --- ## [Average line is not shown as expected in vega visualization](https://discuss.elastic.co/t/average-line-is-not-shown-as-expected-in-vega-visualization/258314)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:11pm UTC](https://discuss.elastic.co/t/average-line-is-not-shown-as-expected-in-vega-visualization/258314 "2020-12-10T18:11:47Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "description": "Bar chart with text labels. Apply scale padding to make the frame cover the labels.", "data": { "values": \[ {"a": "A", … --- ## [Alert Notification just once](https://discuss.elastic.co/t/alert-notification-just-once/256030)
**Author:** [@user007](https://discuss.elastic.co/u/user007)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 6:11pm UTC](https://discuss.elastic.co/t/alert-notification-just-once/256030 "2020-12-10T18:11:14Z")
Is it possible to send an alert notification only once (when the alert starts) and not repeatedly within a certain time frame? Thanks for your help! --- ## [Index Patterns Keep Disappearing](https://discuss.elastic.co/t/index-patterns-keep-disappearing/258292)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 5:39pm UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/258292 "2020-12-10T17:39:15Z")
Hi All, I'm currently using version 7.8.0, I've indexed some documents into ES, but when I create a n Index Pattern in Kibana, it disappear automatically. Please see below some screenshots of this issue. GET \_cat/indi… --- ## [Kibana Lucene search of an array field](https://discuss.elastic.co/t/kibana-lucene-search-of-an-array-field/258313)
**Author:** [@gaz1](https://discuss.elastic.co/u/gaz1)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/kibana-lucene-search-of-an-array-field/258313 "2020-12-10T17:36:00Z")
Hi there. I have a few docs in an index that go as the following example: ''' "\_index" : "metrics", "\_type" : "\_doc", "\_id" : "5fd1814e8a7b8b0023d747d5", "\_source" : { "socketId" : "hh9WMhPM1z1tD8SyAAdN", "events"… --- ## [Distinct values of one field based on date range](https://discuss.elastic.co/t/distinct-values-of-one-field-based-on-date-range/257176)
**Author:** [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:33pm UTC](https://discuss.elastic.co/t/distinct-values-of-one-field-based-on-date-range/257176 "2020-12-10T17:33:41Z")
Hello community :wave: , I struggling with Elasticsearch query and sadly I cannot get correct response. :unamused: What I want is get unique/disctinct values for specific field in last X minutes. I have something like… --- ## [Required logstash patterns to extract JSON format log](https://discuss.elastic.co/t/required-logstash-patterns-to-extract-json-format-log/255516)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:31pm UTC](https://discuss.elastic.co/t/required-logstash-patterns-to-extract-json-format-log/255516 "2020-12-10T17:31:40Z")
Hi All, Below is the log message which is in JSON format, would like to extract couple of keys from the below log ( say ex: x-forwarded-for, host, etc..). can any please help me to write logstash filters to extract the … --- ## [Export CSV doesn't work v7.9.0](https://discuss.elastic.co/t/export-csv-doesnt-work-v7-9-0/258247)
**Author:** [@111382](https://discuss.elastic.co/u/111382)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:31pm UTC](https://discuss.elastic.co/t/export-csv-doesnt-work-v7-9-0/258247 "2020-12-10T17:31:35Z")
Hi everyone! I hope some of you met the same trouble with csv report generation. I read articles at the forum but didn't get the same case. So I try to export saved search in Kibana 7.9.0 but receive Service Unavailable… --- ## [Exported CSV from search table in dashboard has column values missing](https://discuss.elastic.co/t/exported-csv-from-search-table-in-dashboard-has-column-values-missing/257882)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:30pm UTC](https://discuss.elastic.co/t/exported-csv-from-search-table-in-dashboard-has-column-values-missing/257882 "2020-12-10T17:30:23Z")
Hi, I am using 7.8.0 . I have used discover search tables and data tables in kibana dashboards. When I download CSV from the dashboard for a search table, it doesn't contain values for some .keyword columns. When I dow… --- ## [Not able to show field values in Kibana](https://discuss.elastic.co/t/not-able-to-show-field-values-in-kibana/257188)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:27pm UTC](https://discuss.elastic.co/t/not-able-to-show-field-values-in-kibana/257188 "2020-12-10T17:27:25Z")
I have JSON documents that I send through a lambda to Elasticsearch and these JSONs have certain fields nested that are flattened in the process, I can see that they are correctly showed in my Index Pattern, like this: … --- ## [Limits of scripted fields](https://discuss.elastic.co/t/limits-of-scripted-fields/258030)
**Author:** [@Juanfri](https://discuss.elastic.co/u/Juanfri)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:26pm UTC](https://discuss.elastic.co/t/limits-of-scripted-fields/258030 "2020-12-10T17:26:04Z")
Hi! First of all, sorry for my bad english. I need some help in order to understand if I can use scripted fields for my purpose. I want to calculate a field by a multiplication with other fields. However, I must know … --- ## [Rally](https://discuss.elastic.co/t/rally/255661)
**Author:** [@ahmedloai](https://discuss.elastic.co/u/ahmedloai)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 5:20pm UTC](https://discuss.elastic.co/t/rally/255661 "2020-12-10T17:20:25Z")
Hello I am using rally as a Benchmarking tool for elastic. I have actually 2 issues: Index-name: is there a way to change or add prefix for the indices created during a race? I tried index\_settings but it does not w… --- ## [Kafka input plugin](https://discuss.elastic.co/t/kafka-input-plugin/258303)
**Author:** [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:17pm UTC](https://discuss.elastic.co/t/kafka-input-plugin/258303 "2020-12-10T17:17:54Z")
The documentation does not really make sense when it comes to poll\_timeout\_ms and fetch\_max\_wait\_ms. According to the documentation: fetch\_max\_wait\_ms has a default value of 500ms poll\_timeout\_ms has a default value o… --- ## [Keep data synchronize with Indices](https://discuss.elastic.co/t/keep-data-synchronize-with-indices/258257)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:12pm UTC](https://discuss.elastic.co/t/keep-data-synchronize-with-indices/258257 "2020-12-10T17:12:01Z")
I'm using Elasticsearch 7.9.0. and using ingress to process and enrich data. I want to share data in indices Elasticsearch with another app. This app have api to collect data. Have any way to keep sync data in indices … --- ## [Kibana json input](https://discuss.elastic.co/t/kibana-json-input/258246)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:09pm UTC](https://discuss.elastic.co/t/kibana-json-input/258246 "2020-12-10T17:09:51Z")
I want to utilize the advance section (json input )in visualization.How we can write the query to modify the visualization.Any help or information on this will be highly appreciated. --- ## [Queuing tasks and snapshot operation not working](https://discuss.elastic.co/t/queuing-tasks-and-snapshot-operation-not-working/258286)
**Author:** [@afonsoavr](https://discuss.elastic.co/u/afonsoavr)\ **Replies:** 8\ **Last updated:** [December 10, 2020, 5:02pm UTC](https://discuss.elastic.co/t/queuing-tasks-and-snapshot-operation-not-working/258286 "2020-12-10T17:02:17Z")
Hi, I has the cluster elasticsearch with 6 data nodes and 3 master. When execute the snapshot I receive the error "process\_cluster\_event\_timeout\_exception". I look in my cluster "/\_cat/pending\_tasks" it has 69 tasks w… --- ## [Auditbeat: Prefix syscall arguments value with '0x' so that they can be handled by "convert" processor](https://discuss.elastic.co/t/auditbeat-prefix-syscall-arguments-value-with-0x-so-that-they-can-be-handled-by-convert-processor/258308)
**Author:** [@docteur\_saoul](https://discuss.elastic.co/u/docteur_saoul)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:00pm UTC](https://discuss.elastic.co/t/auditbeat-prefix-syscall-arguments-value-with-0x-so-that-they-can-be-handled-by-convert-processor/258308 "2020-12-10T17:00:58Z")
Hi, I'm looking for a way to add the traced process metadata for ptrace events on linux. This could be done using the add\_process\_metadata and the PID (second argument of ptrace syscall). However, auditd.data.aX fields … --- ## [Elasticsearch issue](https://discuss.elastic.co/t/elasticsearch-issue/258182)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [December 10, 2020, 4:46pm UTC](https://discuss.elastic.co/t/elasticsearch-issue/258182 "2020-12-10T16:46:24Z")
Hello there, I am using ELK 7.9.2 and I see following issue with elasticsearch and kibana. \*\*Elasticsearch\*\* \[2020-12-09T15:13:39,596\]\[WARN \]\[o.e.c.r.a.AllocationService\] \[master\] \[.kibana\_1\]\[0\] marking unavailable sh… --- ## [Can I hide legend from visualization?](https://discuss.elastic.co/t/can-i-hide-legend-from-visualization/258298)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/can-i-hide-legend-from-visualization/258298 "2020-12-10T16:32:13Z")
Is there way to hide or remove legend from visualization? I am working on vertical bar.. --- ## [Why collect the same log when I set different port?](https://discuss.elastic.co/t/why-collect-the-same-log-when-i-set-different-port/258211)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 4:29pm UTC](https://discuss.elastic.co/t/why-collect-the-same-log-when-i-set-different-port/258211 "2020-12-10T16:29:08Z")
I have two conf file in /etc/logstash/conf.d/. One is named "nas\_ftp.conf" and include below setting:\`\`\` input { tcp { port =\> 10515 } } filter { } output { elasticsearch { hosts … --- ## [Vega: Access nested fields of a JSON file](https://discuss.elastic.co/t/vega-access-nested-fields-of-a-json-file/258277)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 9\ **Last updated:** [December 10, 2020, 4:19pm UTC](https://discuss.elastic.co/t/vega-access-nested-fields-of-a-json-file/258277 "2020-12-10T16:19:49Z")
Consider the below response for an Elasticsearch query. "aggregations" : { "terms" : { "doc\_count\_error\_upper\_bound" : 0, "sum\_other\_doc\_count" : 0, "buckets" : \[ { "key" : "1", … --- ## [Vega: Field collapsing and inner hits not working for Vega visualization](https://discuss.elastic.co/t/vega-field-collapsing-and-inner-hits-not-working-for-vega-visualization/258233)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 4:06pm UTC](https://discuss.elastic.co/t/vega-field-collapsing-and-inner-hits-not-working-for-vega-visualization/258233 "2020-12-10T16:06:39Z")
Hi, I have an index with two fields; ID and Status. Each ID will have 3 statuses; start, pending and end, which are included in the same index. What I want to achieve is to get the last status for each ID from the index… --- ## [Limited time period in Canvas](https://discuss.elastic.co/t/limited-time-period-in-canvas/257219)
**Author:** [@axfla](https://discuss.elastic.co/u/axfla)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/limited-time-period-in-canvas/257219 "2020-12-10T15:30:25Z")
Hi, I am trying to make line graphs in Canvas based on an Elasticsearch SQL query. When I use the "preview data" button, the data is here. If I use data from the last 14 days, it works. But for some reason, if I try to … --- ## [Programmatically backup existing index pattern](https://discuss.elastic.co/t/programmatically-backup-existing-index-pattern/258058)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 3:28pm UTC](https://discuss.elastic.co/t/programmatically-backup-existing-index-pattern/258058 "2020-12-10T15:28:47Z")
I have 2 index patterns that are named exactly the same. One of them must be deleted to reduce confusion. When I get the json of them (through dev tools), I can see slight differences between them. I want to back them up… --- ## [How to downgrade elasticsearch single node from 7.9.2 to 7.9.1 with out any data loss](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-single-node-from-7-9-2-to-7-9-1-with-out-any-data-loss/258207)
**Author:** [@Vinay\_Kumar2](https://discuss.elastic.co/u/Vinay_Kumar2)\ **Replies:** 9\ **Last updated:** [December 10, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-single-node-from-7-9-2-to-7-9-1-with-out-any-data-loss/258207 "2020-12-10T15:21:22Z")
We are planning to downgrade elasticsearch 7.9.2 to 7.9.1. Please let us know how it will works with out any data loss along with the details. --- ## [Fleet Data Stream empty but only in default space](https://discuss.elastic.co/t/fleet-data-stream-empty-but-only-in-default-space/257902)
**Author:** [@danielhofer](https://discuss.elastic.co/u/danielhofer)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 3:18pm UTC](https://discuss.elastic.co/t/fleet-data-stream-empty-but-only-in-default-space/257902 "2020-12-10T15:18:18Z")
Testing fleet and like it so much but only the default space shows data on the data stream view. Tried some rolles and user-settings but had no chance to get the data shown in other spaces. --- ## [API limited search results](https://discuss.elastic.co/t/api-limited-search-results/258300)
**Author:** [@hohooss](https://discuss.elastic.co/u/hohooss)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 3:18pm UTC](https://discuss.elastic.co/t/api-limited-search-results/258300 "2020-12-10T15:18:13Z")
Hello, I trying to do an elasticsearch API call that will retrieve results more than 200,000 hits, as it was confirmed by Kibana GUI search, but I always get the following message, i.e. 10000 hits: "took": 102, "ti… --- ## [Running filebeat modules alongside a custom pipeline](https://discuss.elastic.co/t/running-filebeat-modules-alongside-a-custom-pipeline/258272)
**Author:** [@pbatley](https://discuss.elastic.co/u/pbatley)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 3:16pm UTC](https://discuss.elastic.co/t/running-filebeat-modules-alongside-a-custom-pipeline/258272 "2020-12-10T15:16:39Z")
I am completely new to Elastic so apologies if this is trivial. I have managed to set up the ELK stack (self managed, all on same host machine) and have got filebeat's apache module enable sending logs to logstash. I us… --- ## [Multi field search with wildcard expression in query](https://discuss.elastic.co/t/multi-field-search-with-wildcard-expression-in-query/258001)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 3:12pm UTC](https://discuss.elastic.co/t/multi-field-search-with-wildcard-expression-in-query/258001 "2020-12-10T15:12:04Z")
Expecting text "abc" search against field1 or field2 to get the results. what is wrong in below query? s =\> s .Query(q =\> q .DisMax(d =\> d .Queries(q1 =\> q1 .Wildcard(w =\> w .Field(f =\> f.field1).Value("abc\*") .F… --- ## [Elasticsearch - update existing documents in different index](https://discuss.elastic.co/t/elasticsearch-update-existing-documents-in-different-index/258295)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 3:05pm UTC](https://discuss.elastic.co/t/elasticsearch-update-existing-documents-in-different-index/258295 "2020-12-10T15:05:16Z")
Here is my data set ticket\_id: T100 ticket\_status: open ticket\_updated\_date: 20201201T10:10:22 ticket\_id: T101 ticket\_status: open ticket\_updated\_date: 20201201T11:10:22 ticket\_id: T101 ticket\_status: closed ticket\_up… --- ## [How can i took all Hit values record in python?](https://discuss.elastic.co/t/how-can-i-took-all-hit-values-record-in-python/258273)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 3:00pm UTC](https://discuss.elastic.co/t/how-can-i-took-all-hit-values-record-in-python/258273 "2020-12-10T15:00:20Z")
'took': 14, 'timed\_out': False, '\_shards': {'total': 1, 'successful': 1, 'skipped': 0, 'failed': 0}, 'hits': {'total': {'value': 99, 'relation': 'eq'}, 'max\_score': 1.0,\`Preformatted text\` when I am trying with thi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1648) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1650)