# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1652 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1653 --- ## [ML unexplained results](https://discuss.elastic.co/t/ml-unexplained-results/258097)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 6:15pm UTC](https://discuss.elastic.co/t/ml-unexplained-results/258097 "2020-12-09T18:15:19Z")
Hello, I'm having unexplained results in an anomaly detection job. Attached an image, where you can see clearly that the typical value is 216 - it's almost a straight line. (for the past 2 months) The model in the oth… --- ## [Configure Kibana spaces via config file](https://discuss.elastic.co/t/configure-kibana-spaces-via-config-file/258096)
**Author:** [@Kostya\_Zgara](https://discuss.elastic.co/u/Kostya_Zgara)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 6:02pm UTC](https://discuss.elastic.co/t/configure-kibana-spaces-via-config-file/258096 "2020-12-09T18:02:08Z")
Hey everyone! I have a simple question, but no answer I cannot find in the documentation. I want to manage Kibana settings via a configuration file. I'm using ECK operator and bootstrapping Kibana via the operator. I wan… --- ## [Elasticsearch Aggregation - Return a list of array from documents found](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990)
**Author:** [@KuntalP](https://discuss.elastic.co/u/KuntalP)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 6:01pm UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-return-a-list-of-array-from-documents-found/257990 "2020-12-09T18:01:37Z")
Hi All, I am querying a time series data using the aggregation functionality. The data to be queried is of categorical nature. I use date histogram to first create buckets. From these generated buckets, I wish to extra… --- ## [Can not create an index](https://discuss.elastic.co/t/can-not-create-an-index/258055)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [December 9, 2020, 5:42pm UTC](https://discuss.elastic.co/t/can-not-create-an-index/258055 "2020-12-09T17:42:08Z")
Hi. I am trying to create a new index in Kibana. My logstash conf file looks like below: if \[type\] == "uatelectron\_appLog" { mutate { split =\> \["message", "|"\] … --- ## [Kibana Plugin Development: Clickable charts with data plugin in v7.10.0](https://discuss.elastic.co/t/kibana-plugin-development-clickable-charts-with-data-plugin-in-v7-10-0/258110)
**Author:** [@K\_Chaitanya](https://discuss.elastic.co/u/K_Chaitanya)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 5:33pm UTC](https://discuss.elastic.co/t/kibana-plugin-development-clickable-charts-with-data-plugin-in-v7-10-0/258110 "2020-12-09T17:33:55Z")
Hi, I was trying to incorporate clickable charts in my kibana plugin using data plugin something like this: SearchBar const onRefreshClick = (payload) =\> { const timeRange = data.query.timefilter.timefilter.getTim… --- ## [ELK Update - can not be imported as a dangling index, as index with same name already exists in cluster metadata](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530)
**Author:** [@snolfi](https://discuss.elastic.co/u/snolfi)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 5:33pm UTC](https://discuss.elastic.co/t/elk-update-can-not-be-imported-as-a-dangling-index-as-index-with-same-name-already-exists-in-cluster-metadata/256530 "2020-12-09T17:33:31Z")
Hello, we have updated an old version of elk from 5.6.4 to 6.8.13 (aiming to upgrade to 7.x). But when we restarted elasticsearch we had this error: \`\[2020-11-24T16:29:45,854\]\[WARN \]\[o.e.g.DanglingIndicesState\] \[coll01… --- ## [What does index pattern consist of?](https://discuss.elastic.co/t/what-does-index-pattern-consist-of/258163)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 5:23pm UTC](https://discuss.elastic.co/t/what-does-index-pattern-consist-of/258163 "2020-12-09T17:23:46Z")
Hi. I am new to Kibana. I already have existing index patterns and logs, so I mostly worked with visualization and dashboard. However, I don't quite understand index pattern. Can someone please explain index pattern in… --- ## [Rotate and remove old Logstash output logs](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803)
**Author:** [@denisdM](https://discuss.elastic.co/u/denisdM)\ **Replies:** 7\ **Last updated:** [December 9, 2020, 5:09pm UTC](https://discuss.elastic.co/t/rotate-and-remove-old-logstash-output-logs/256803 "2020-12-09T17:09:20Z")
Hello, I've got a Logstash installation (centos 7.6, Logstash 7.2.0) which work great but produce logs and never delete them. I've never changed any default configuration so the /etc/logstash/log4j2.properties files co… --- ## [Vega-Lite Aggregate stopped working after upgrade to 7.10 (from 7.6)](https://discuss.elastic.co/t/vega-lite-aggregate-stopped-working-after-upgrade-to-7-10-from-7-6/258161)
**Author:** [@brunet](https://discuss.elastic.co/u/brunet)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 4:30pm UTC](https://discuss.elastic.co/t/vega-lite-aggregate-stopped-working-after-upgrade-to-7-10-from-7-6/258161 "2020-12-09T16:30:55Z")
Dears, I had a nice bubble vizs with Vega Lite which stopped working after upgrading to 7.10. The \_docs are gathered ok from the index. But when transform/aggregate/sum is processed within Vega, undefined values appear… --- ## [Setting up a watcher is seems harder than it should be](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 10\ **Last updated:** [December 9, 2020, 4:29pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046 "2020-12-09T16:29:47Z")
1 I used the following command to enable Watcher: PUT \_cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": true } } When I goto the Watcher to create a watcher, ther… --- ## [Searching indices when creating vis's returns 0 results](https://discuss.elastic.co/t/searching-indices-when-creating-viss-returns-0-results/258158)
**Author:** [@Matt\_Klaver](https://discuss.elastic.co/u/Matt_Klaver)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 4:14pm UTC](https://discuss.elastic.co/t/searching-indices-when-creating-viss-returns-0-results/258158 "2020-12-09T16:14:04Z")
Our index naming convention uses dashes (-) in the names, and when creating a visualization and searching through that list of indices that pops up we're able to search on anything before the dash, but once we add the da… --- ## [Set a nested field with a variable](https://discuss.elastic.co/t/set-a-nested-field-with-a-variable/258153)
**Author:** [@dwatbmc](https://discuss.elastic.co/u/dwatbmc)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 4:00pm UTC](https://discuss.elastic.co/t/set-a-nested-field-with-a-variable/258153 "2020-12-09T16:00:29Z")
Can't find a way to do this with Mutate, so I am attempting it in Ruby, but still failing: I have two fields: \[log\]\[group\] = "panos" \[log\]\[type\] = "threat" Based on these two field values, I want to copy the JSON Obj… --- ## [How to Analyze field with elasticsearch](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143)
**Author:** [@111417](https://discuss.elastic.co/u/111417)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 3:48pm UTC](https://discuss.elastic.co/t/how-to-analyze-field-with-elasticsearch/258143 "2020-12-09T15:48:46Z")
I want to parse field with spacial format (like Json) with using elasticsearch without logstash , is that possible with using elasticsearch analyze? If it's possible,where can i start? Or there is another way? exampl… --- ## [What does "include related object" mean in Export?](https://discuss.elastic.co/t/what-does-include-related-object-mean-in-export/258151)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 3:39pm UTC](https://discuss.elastic.co/t/what-does-include-related-object-mean-in-export/258151 "2020-12-09T15:39:13Z")
Hi. I am trying to export my dashboard that uses multiple visualizations. When I export it, there is option called "include related objects". I am not sure what it means. I tried exporting with and without it and compar… --- ## [Converting self signed certificate to ones from 3rd party - Kibana server](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 3:35pm UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396 "2020-12-09T15:35:24Z")
Hello People, I'm using elk stack running on 7.9.2 version. Now I use self signed certificates, generated by certutil built-in elasticsearch (bin/elasticsearch-certutil cert) I have a few questions about certificates: … --- ## [Logstash - Output - Http - Message](https://discuss.elastic.co/t/logstash-output-http-message/258150)
**Author:** [@rguerrero](https://discuss.elastic.co/u/rguerrero)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:31pm UTC](https://discuss.elastic.co/t/logstash-output-http-message/258150 "2020-12-09T15:31:59Z")
The next pipeline work good. input { jdbc { jdbc\_driver\_library =\> "C:\\\\03\_ELK\\\\logstash\\\\drivers\\\\ojdbc6-11.2.0.3.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\>… --- ## [Unable to install logstash-codec-sflow plugin in logstash 5.3.2 version](https://discuss.elastic.co/t/unable-to-install-logstash-codec-sflow-plugin-in-logstash-5-3-2-version/258148)
**Author:** [@praveen\_cs](https://discuss.elastic.co/u/praveen_cs)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:24pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-codec-sflow-plugin-in-logstash-5-3-2-version/258148 "2020-12-09T15:24:53Z")
Hi, Unable to install logstash-codec-sflow plugin in logstash 5.3.2 version ,Tried with logstash version 7.9.2 it is installing , why it is not allowing to install with logstash version 5.3.2 and am getting the foll… --- ## [Update dynamic/static properties with CCR](https://discuss.elastic.co/t/update-dynamic-static-properties-with-ccr/258144)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 3:17pm UTC](https://discuss.elastic.co/t/update-dynamic-static-properties-with-ccr/258144 "2020-12-09T15:17:08Z")
Hi. In the section replication mechanics here I see below quote The follower index automatically retrieves some updates applied to the leader index, while other updates are retrieved as needed I don't sure what is… --- ## [Prefix query not analyzed](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901)
**Author:** [@davide-martins](https://discuss.elastic.co/u/davide-martins)\ **Replies:** 3\ **Last updated:** [December 9, 2020, 3:11pm UTC](https://discuss.elastic.co/t/prefix-query-not-analyzed/257901 "2020-12-09T15:11:31Z")
Dear team, I'm trying to setup a query that contain a specific prefix in a provided text (not a keyword). PUT my-index { "mappings": { "properties": { "title": { "type": "text", … --- ## [CCR exception/warning issue. RetentionLeaseNotFoundException](https://discuss.elastic.co/t/ccr-exception-warning-issue-retentionleasenotfoundexception/257977)
**Author:** [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 3:00pm UTC](https://discuss.elastic.co/t/ccr-exception-warning-issue-retentionleasenotfoundexception/257977 "2020-12-09T15:00:36Z")
Scenario Create leader cluster Create index with index.soft\_deletes.retention\_lease.period = 5s (\*\*\*). This period I choose only for test purposes. Index document and wait 5s before next step so retention lease expire C… --- ## [Store value of filed as array](https://discuss.elastic.co/t/store-value-of-filed-as-array/258141)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 2:50pm UTC](https://discuss.elastic.co/t/store-value-of-filed-as-array/258141 "2020-12-09T14:50:41Z")
I am trying to store a json response from an API that received by http plugin of Logstash, in Elasticsearch. one of fields called users returns value like this "users" =\> \[ \[0\] { … --- ## [Dateparsefailure](https://discuss.elastic.co/t/dateparsefailure/258133)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [December 9, 2020, 2:15pm UTC](https://discuss.elastic.co/t/dateparsefailure/258133 "2020-12-09T14:15:06Z")
hi all, i have very simple input , why i am getting date parse failure here ? \`input { stdin{} } filter { date { match =\> \[ "message", "MMM dd yyyy HH:mm:ss" \] } } output { stdout { codec =\> "rubyde… --- ## [CCR follower for large index fails](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043)
**Author:** [@toryohanson](https://discuss.elastic.co/u/toryohanson)\ **Replies:** 0\ **Last updated:** [December 8, 2020, 7:40pm UTC](https://discuss.elastic.co/t/ccr-follower-for-large-index-fails/258043 "2020-12-08T19:40:11Z")
Hello! I'w trying to configure Elasticsearch CCR using manuals at elastic.co Everything works fine for small indexes. But, when it comes to indexes large then 2 GB, something strange happens - index following is pause… --- ## [Value got nulled when ingesting to ES from Hadoop using Spark](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135)
**Author:** [@anung](https://discuss.elastic.co/u/anung)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:53pm UTC](https://discuss.elastic.co/t/value-got-nulled-when-ingesting-to-es-from-hadoop-using-spark/258135 "2020-12-09T13:53:22Z")
my env: cloudera hadoop 6.3 es 7.10 spark 2.4.0 elasticsearch-spark-20\_2.11-7.10.0.jar my code very simple: import org.elasticsearch.spark.rdd.api.java.JavaEsSpark; JavaEsSpark.saveToEs(rdd\_tJava\_1, "nyc\_yellow\_taxi… --- ## [Index attributes from a multiline json string](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:43pm UTC](https://discuss.elastic.co/t/index-attributes-from-a-multiline-json-string/258132 "2020-12-09T13:43:12Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [How to index json attributes on ES from a json multiline log](https://discuss.elastic.co/t/how-to-index-json-attributes-on-es-from-a-json-multiline-log/258130)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:38pm UTC](https://discuss.elastic.co/t/how-to-index-json-attributes-on-es-from-a-json-multiline-log/258130 "2020-12-09T13:38:53Z")
Hi All, I need some advice here, I don't want to reinvent the wheel. With Filebeat 6.7.0 I'm picking up logs in typical docker format, , i.e. json strings with "log", "stream" and "time" attributes. In the logs, each … --- ## [Only partial data getting deciphered using cipher filter](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 0\ **Last updated:** [December 9, 2020, 1:38pm UTC](https://discuss.elastic.co/t/only-partial-data-getting-deciphered-using-cipher-filter/258129 "2020-12-09T13:38:06Z")
Hi Team, I want to decipher a cipher text using logstash. My client is using AES128 encryption. So in logstash I am using cipher filter to decipher the ciphertext. They have also provided me the key , but unfortunately… --- ## [Dashboard - show only last distinct values](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035)
**Author:** [@Vita\_Rosenberg](https://discuss.elastic.co/u/Vita_Rosenberg)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:34pm UTC](https://discuss.elastic.co/t/dashboard-show-only-last-distinct-values/257035 "2020-12-09T13:34:58Z")
I want to show only the last distinct values. Hence without the records with yellow color. Is it possible? --- ## [Kibana settings API](https://discuss.elastic.co/t/kibana-settings-api/258100)
**Author:** [@6NMgfDwZ3](https://discuss.elastic.co/u/6NMgfDwZ3)\ **Replies:** 2\ **Last updated:** [December 9, 2020, 1:08pm UTC](https://discuss.elastic.co/t/kibana-settings-api/258100 "2020-12-09T13:08:10Z")
Hello, ELK 7.10.0 / Kibana Is there any way to change Kibana options Stack Managament / Advanced Settings / "dateFormat" + "dateFormat:tz" + etc. through an API? I haven't found any info about that in the documentatio… --- ## [Kibana Discover order by field](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 5\ **Last updated:** [December 9, 2020, 1:03pm UTC](https://discuss.elastic.co/t/kibana-discover-order-by-field/258102 "2020-12-09T13:03:49Z")
I want to order documents in Discover by a date field using KQL or Lucene. Can you guide me please? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1651) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1653)