# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1687 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1688 --- ## ["error":{"type":"missing\_references","references":\[{"type":"search","id":"dfd3ea60-0154-11eb-8672-4ba31b1f4ee1"}\]](https://discuss.elastic.co/t/error-type-missing-references-references-type-search-id-dfd3ea60-0154-11eb-8672-4ba31b1f4ee1/255979)
**Author:** [@PADMAVATHI\_GUNTURU](https://discuss.elastic.co/u/PADMAVATHI_GUNTURU)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 8:09pm UTC](https://discuss.elastic.co/t/error-type-missing-references-references-type-search-id-dfd3ea60-0154-11eb-8672-4ba31b1f4ee1/255979 "2020-11-19T20:09:46Z")
Hi, I'm importing a dashboard from one kibana to another kibana, While importing I'm got the error "missing\_references". Here dashboard having 8 visualizations. Here I have a doubt that, when importing the dashboard, the… --- ## [Kibana scripted fields](https://discuss.elastic.co/t/kibana-scripted-fields/255930)
**Author:** [@Gokul6](https://discuss.elastic.co/u/Gokul6)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 7:36pm UTC](https://discuss.elastic.co/t/kibana-scripted-fields/255930 "2020-11-19T19:36:08Z")
i am differentiating two date fields and getting the time in milliseconds as output. here is my code if(!doc\['confirmedAt'\].empty) { return doc\['confirmedAt'\].value.getMillis() - doc\['createdAt'\].value.getMillis() } … --- ## [Calculating MTTR(Mean Time to Recovery)](https://discuss.elastic.co/t/calculating-mttr-mean-time-to-recovery/255741)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:13pm UTC](https://discuss.elastic.co/t/calculating-mttr-mean-time-to-recovery/255741 "2020-11-19T19:13:06Z")
I have an Index having build failed and succeeded status with respective time stamp. I want to calculate MTTR(Mean Time to Recovery) using scripted field or any other option available. Any suggestions? --- ## [Get datepart from @timestamp in 7.1](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752)
**Author:** [@himanshur](https://discuss.elastic.co/u/himanshur)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:09pm UTC](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752 "2020-11-19T19:09:23Z")
I am trying to get the date part from the @timestamp field in 7.1. Looks like all the date functions were introduced in 7.5. Is there a way I can get the date part using SQL in Kibana Trying the below query SELECT dat… --- ## [Problem execute watcher "Cannot invoke \\"Object.getClass()\\" because \\"callArgs\[0\]\\" is null"](https://discuss.elastic.co/t/problem-execute-watcher-cannot-invoke-object-getclass-because-callargs-0-is-null/255763)
**Author:** [@John\_Martinez](https://discuss.elastic.co/u/John_Martinez)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:05pm UTC](https://discuss.elastic.co/t/problem-execute-watcher-cannot-invoke-object-getclass-because-callargs-0-is-null/255763 "2020-11-19T19:05:57Z")
Hello experts, the following watcher should be executed when five failed logins occur in five minutes. { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": {… --- ## [Time Series Sum aggregation](https://discuss.elastic.co/t/time-series-sum-aggregation/255770)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:03pm UTC](https://discuss.elastic.co/t/time-series-sum-aggregation/255770 "2020-11-19T19:03:07Z")
I have a series of endpoint readings each containing an integer value as read at that point in time (on the hour) and I am trying to generate a time series sum aggregation. I want to view it for a year but I want to kee… --- ## [Kibana metric visualization - Get Inner hits count](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781)
**Author:** [@Abhilash\_Sathe](https://discuss.elastic.co/u/Abhilash_Sathe)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:59pm UTC](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781 "2020-11-19T18:59:53Z")
Here's my code to get inner hits count. GET my\_index/\_search { "\_source": \[ "inner\_hits" \], "query": { "nested": { "path": "someNestedK… --- ## [Grok cant detect change of line](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796 "2020-11-18T07:36:45Z")
Hello all, I have the following file that i want to grok: AG 100045 1FB702 27.12.2011 675337068 ZFA31200000...... AG 100045 X 17.11.1961 084260332 5352... AG 100046 1SF995 22.04.2016 217347660 TMBET6NH1G4...... AG 1… --- ## [Bucket key/item counting](https://discuss.elastic.co/t/bucket-key-item-counting/255826)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:54pm UTC](https://discuss.elastic.co/t/bucket-key-item-counting/255826 "2020-11-19T18:54:45Z")
Hello, I have a bucket that looks like this: { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "va… --- ## [External IPs - Kibana Dashboard - Version 7.9.1](https://discuss.elastic.co/t/external-ips-kibana-dashboard-version-7-9-1/255337)
**Author:** [@krinfra](https://discuss.elastic.co/u/krinfra)\ **Replies:** 25\ **Last updated:** [November 19, 2020, 6:45pm UTC](https://discuss.elastic.co/t/external-ips-kibana-dashboard-version-7-9-1/255337 "2020-11-19T18:45:55Z")
Good Morning. I have a problem with Kibana. I need my Kibana to be able to bring the external IPs, it can only show internal IPs on my dashboards. A friend said that I have to log the External IP into my index for this … --- ## [Why Kibana server is not ready yet](https://discuss.elastic.co/t/why-kibana-server-is-not-ready-yet/255870)
**Author:** [@powerinside](https://discuss.elastic.co/u/powerinside)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:39pm UTC](https://discuss.elastic.co/t/why-kibana-server-is-not-ready-yet/255870 "2020-11-19T18:39:47Z")
I got "Kibana server is not ready yet" message. It happened after i was trying to enable TLS on the HTTP layer in Elasticsearch. i added following lines to kibana.yml and restarted services. I reverted all settings back… --- ## [Elasticsearch 7.7.1 shards getting unassigned](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006 "2020-11-19T18:37:53Z")
We recently upgraded our elasticsearch cluster from 5.6.16 to 7.7.1. After that sometimes I am observing that few of the shards not getting assigned. My node stats is placed here. The allocation explanation for an una… --- ## [How many users' traffic can be handled by one kibana instance?](https://discuss.elastic.co/t/how-many-users-traffic-can-be-handled-by-one-kibana-instance/255932)
**Author:** [@DSMilestone](https://discuss.elastic.co/u/DSMilestone)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 5:25pm UTC](https://discuss.elastic.co/t/how-many-users-traffic-can-be-handled-by-one-kibana-instance/255932 "2020-11-19T17:25:33Z")
we have implemented a ES cluster with 4 nodes; out of 4, 3 nodes are master eligible nodes and also those nodes are data nodes, 4th node is a data node and also marked as a ingest node. We use this cluster for logs. We … --- ## [How to Restore snapshop from 5 node cluster to single node host?](https://discuss.elastic.co/t/how-to-restore-snapshop-from-5-node-cluster-to-single-node-host/255761)
**Author:** [@elkdummy](https://discuss.elastic.co/u/elkdummy)\ **Replies:** 21\ **Last updated:** [November 19, 2020, 5:24pm UTC](https://discuss.elastic.co/t/how-to-restore-snapshop-from-5-node-cluster-to-single-node-host/255761 "2020-11-19T17:24:22Z")
Hello all, I am trying to restore a snapshot from a 5 node v6.8 to a single v7.9 host. When restoring the snapshot it finishes almost instantly. So no data was imported as its 166gb snapshot. My status goes red and sho… --- ## [How to make the "Save Search" as the dafault page in "Discover"](https://discuss.elastic.co/t/how-to-make-the-save-search-as-the-dafault-page-in-discover/256021)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 5:23pm UTC](https://discuss.elastic.co/t/how-to-make-the-save-search-as-the-dafault-page-in-discover/256021 "2020-11-19T17:23:54Z")
Hi, I have created a "Save Search" in the Kibana's "Discover" mode with the table view of one of the index. But everytime when I click the "Discover" tab, it will not give me my Save Search. And I need to open it from O… --- ## [Problem with split add field](https://discuss.elastic.co/t/problem-with-split-add-field/256018)
**Author:** [@gius78](https://discuss.elastic.co/u/gius78)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 5:17pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018 "2020-11-19T17:17:15Z")
Hello, I am using logstash 7.6.2 I am trying to parse a CEF log, separated by pipes "|" I've done: mutate { copy =\> { "cefmessage" =\> "tmp\_message" } split =\> { "tmp\_message" =\> "|" } … --- ## [Filebeat httpjason input](https://discuss.elastic.co/t/filebeat-httpjason-input/255813)
**Author:** [@pankaj](https://discuss.elastic.co/u/pankaj)\ **Replies:** 2\ **Last updated:** [November 18, 2020, 4:47pm UTC](https://discuss.elastic.co/t/filebeat-httpjason-input/255813 "2020-11-18T16:47:11Z")
I tried configure the test httpjson input but that failing filebeat service to start. filebeat.inputs: Fetch your public IP every minute. type: httpjson url: https://api.ipify.org/?format=json interval: 1m processo… --- ## [Kibana creating bar visualization with different filters on each bar, y axis advanced option json input](https://discuss.elastic.co/t/kibana-creating-bar-visualization-with-different-filters-on-each-bar-y-axis-advanced-option-json-input/256013)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 4:27pm UTC](https://discuss.elastic.co/t/kibana-creating-bar-visualization-with-different-filters-on-each-bar-y-axis-advanced-option-json-input/256013 "2020-11-19T16:27:34Z")
Hi, I would like to create a bar chart looks like below. But each bar in the bar chart will need to have different filters. For example, one of the bar call record\_id, and this bar need to have filter in the filter 1, a… --- ## [Session Count per number of Transactions](https://discuss.elastic.co/t/session-count-per-number-of-transactions/255959)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 4:14pm UTC](https://discuss.elastic.co/t/session-count-per-number-of-transactions/255959 "2020-11-19T16:14:14Z")
Hi, I am trying to solve the following problem with little success so far concerning Barcharts: X-axis --\> Number of rows per Session Y-axis --\> Count of Sessions So it would look something like this: There are 4 … --- ## [Kibana fails to start after 7.9.3 -\> 7.10.0 upgrade](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 4:10pm UTC](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737 "2020-11-19T16:10:23Z")
Just updated Elastic stack from 7.9.3 to 7.10 and now kibana fails to start. I didn't notice anything in breaking changes that would apply. License is Basic, authentication is not used. \[16:24:26.937\] \[error\]\[data\]\[e… --- ## [Influxdb ( Victoria Metrics ) Error + Filtering Logstash ( remove - split )](https://discuss.elastic.co/t/influxdb-victoria-metrics-error-filtering-logstash-remove-split/255994)
**Author:** [@recepbalibey](https://discuss.elastic.co/u/recepbalibey)\ **Replies:** 7\ **Last updated:** [November 19, 2020, 3:29pm UTC](https://discuss.elastic.co/t/influxdb-victoria-metrics-error-filtering-logstash-remove-split/255994 "2020-11-19T15:29:12Z")
Here is only one example from my JSON file \>\> {"host":"ABCDEFASD","groups":\["ABVD","TEST"\],"applications": \["NETWORK"\],"itemid":143172,"name":"Operational status of interface Se0/1/0:17","clock":1604283792,"ns":92656332… --- ## [How to use SSL LetsEncrypt in Kibana?](https://discuss.elastic.co/t/how-to-use-ssl-letsencrypt-in-kibana/255446)
**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 3:17pm UTC](https://discuss.elastic.co/t/how-to-use-ssl-letsencrypt-in-kibana/255446 "2020-11-19T15:17:00Z")
Hello, Kibana can't start and throw this permission error in journal: { Error: EACCES: permission denied, open '/etc/kibana/privkey.pem' I'm using Let's encrypt to get the domain certified: So all I did was creating … --- ## [\_grokparsefailure](https://discuss.elastic.co/t/grokparsefailure/255996)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 2:51pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996 "2020-11-19T14:51:03Z")
Good day. I'm trying to parse tomcat logs with logstash using the filebeat input plugin. My log-files look like: 2020-11-19 11:34:40,260 \[thread0-exec-1\] WARN org.springframework.web.servlet.PageNotFound - Request me… --- ## [Filebeat: file output with dynamic filename](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002)
**Author:** [@james\_m](https://discuss.elastic.co/u/james_m)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 2:49pm UTC](https://discuss.elastic.co/t/filebeat-file-output-with-dynamic-filename/256002 "2020-11-19T14:49:29Z")
Hi, I'm using the file output module to write some container logs to NFS. I can't figure out how to make the output filename dynamic - I'd like the filename to be the container name. I suspect I have two options. S… --- ## [How gsub parse the log line](https://discuss.elastic.co/t/how-gsub-parse-the-log-line/255803)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 2:32pm UTC](https://discuss.elastic.co/t/how-gsub-parse-the-log-line/255803 "2020-11-19T14:32:12Z")
I have a log file in json format having values and corresponding sub-values till 2 levels. All are encapsulated with double quotes. Normally the log is having simple key-value pairs having key and values encapsulated wit… --- ## [Create a conf file using grok or json filter](https://discuss.elastic.co/t/create-a-conf-file-using-grok-or-json-filter/255903)
**Author:** [@Omair](https://discuss.elastic.co/u/Omair)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/create-a-conf-file-using-grok-or-json-filter/255903 "2020-11-19T14:09:23Z")
Hi.. I'm new to elastic stack and trying to learn using filters to structure my data but unfortunately not getting much help. Below is the application log 2020-11-19T00:08:34.627+0500 INFO 141799 com.l7tech.server.p… --- ## [Range of values for system.process.memory.rss.pct and system.process.cpu.total.norm.pct](https://discuss.elastic.co/t/range-of-values-for-system-process-memory-rss-pct-and-system-process-cpu-total-norm-pct/255992)
**Author:** [@musician](https://discuss.elastic.co/u/musician)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 2:06pm UTC](https://discuss.elastic.co/t/range-of-values-for-system-process-memory-rss-pct-and-system-process-cpu-total-norm-pct/255992 "2020-11-19T14:06:18Z")
Hello, I wanted to find out if the range of values for system.process.memory.rss.pct and system.process.cpu.total.norm.pct if from: 0.0 to 1.0 or 0.0 to 100.0. --- ## [In Kibana dashboard, latest logs are not showing](https://discuss.elastic.co/t/in-kibana-dashboard-latest-logs-are-not-showing/255993)
**Author:** [@shajimsh](https://discuss.elastic.co/u/shajimsh)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 1:35pm UTC](https://discuss.elastic.co/t/in-kibana-dashboard-latest-logs-are-not-showing/255993 "2020-11-19T13:35:39Z")
Team, Even though we have latest records in the table, we are not able to see these latest records in kibana dashboard, below is the logstash jdbc query for fetching latest record. But it was working properly previously… --- ## [Logstash help with pattern for grok needed](https://discuss.elastic.co/t/logstash-help-with-pattern-for-grok-needed/255518)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 1:02pm UTC](https://discuss.elastic.co/t/logstash-help-with-pattern-for-grok-needed/255518 "2020-11-19T13:02:32Z")
Hello, I am trying to parse some data which is in one of the two following formats: Sample data: Data from service service-a loaded Data from service service-b not loaded With the following Grok Pattern: Data from se… --- ## [ILM isn’t it working properly](https://discuss.elastic.co/t/ilm-isn-t-it-working-properly/253248)
**Author:** [@Armen\_Khachikyan](https://discuss.elastic.co/u/Armen_Khachikyan)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 12:51pm UTC](https://discuss.elastic.co/t/ilm-isn-t-it-working-properly/253248 "2020-11-19T12:51:44Z")
Hey guys, I have a question about ILM... I am working on devices logs, have Logstash pipeline for logs, and all of them work correctly. After Installing ILM policy, I have added the policy to my logstash’s elasticsearc… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1686) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1688)