# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1703 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1704 --- ## [Kibana delete field from index pattern](https://discuss.elastic.co/t/kibana-delete-field-from-index-pattern/255043)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 2:23pm UTC](https://discuss.elastic.co/t/kibana-delete-field-from-index-pattern/255043 "2020-11-11T14:23:52Z")
Hi, I made a typo mistake in logstash and it caused a field with a wrong name (ts\_duration). I've deleted the data from elasticsearch and now data is in correct field (duration). I did some search and I've found out t… --- ## [Kibana 7.9 - Customizatios not reflecting on the browser](https://discuss.elastic.co/t/kibana-7-9-customizatios-not-reflecting-on-the-browser/254348)
**Author:** [@RichaSinha08](https://discuss.elastic.co/u/RichaSinha08)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 2:17pm UTC](https://discuss.elastic.co/t/kibana-7-9-customizatios-not-reflecting-on-the-browser/254348 "2020-11-11T14:17:36Z")
Hello, When I make customizations in Kibana 7.9.2 code, though they are reflecting in the optimize/bundles but not on the browser(localhost:5601) Earlier I had successfully done customizations for Kibana 7.4. Do I hav… --- ## [Customizable axis labels in TSVB Time Series Visualization](https://discuss.elastic.co/t/customizable-axis-labels-in-tsvb-time-series-visualization/254708)
**Author:** [@akash\_keswani](https://discuss.elastic.co/u/akash_keswani)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:56pm UTC](https://discuss.elastic.co/t/customizable-axis-labels-in-tsvb-time-series-visualization/254708 "2020-11-11T13:56:05Z")
Hi, Can anyone help me on how can we customize axis labels in TSVB Time Series Visualization - e.g. instead of 'per x weeks ' as a x-axis label, I'd really like the ability to relabel it to what i want. --- ## [Action unauthorized for user](https://discuss.elastic.co/t/action-unauthorized-for-user/255065)
**Author:** [@Samir\_Said](https://discuss.elastic.co/u/Samir_Said)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 1:50pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065 "2020-11-11T13:50:41Z")
I have created a user using: Stack Management / Users and added roles: kibana\_admin, kibana\_system however, the user got error when tried to run queury: { "error" : { "root\_cause" : \[ { "type" : "… --- ## [Parsing netflow (XML) logs, problems with encoding](https://discuss.elastic.co/t/parsing-netflow-xml-logs-problems-with-encoding/255073)
**Author:** [@th-ink](https://discuss.elastic.co/u/th-ink)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:49pm UTC](https://discuss.elastic.co/t/parsing-netflow-xml-logs-problems-with-encoding/255073 "2020-11-11T13:49:26Z")
Hi all, I have some netflow logs in .xml that I need to parse with logstash. All is well until I reach payload field, which has differnet char set (?) and logstash crashes. This is the error message returned: Error pa… --- ## [Kibana is stock on “Kibana server is not ready yet”](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021 "2020-11-11T13:49:10Z")
Hi everyone After installing Inhanced-Table plugin, my Kibana is stock on following message "Kibana server is not ready yet" However after some minutes it completely became out of reach and I face with "Unable to co… --- ## [Display bytes per second in Line viz](https://discuss.elastic.co/t/display-bytes-per-second-in-line-viz/254004)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:40pm UTC](https://discuss.elastic.co/t/display-bytes-per-second-in-line-viz/254004 "2020-11-11T13:40:21Z")
Hello, with the lockdown, I'm currently working on a dashboard to sum up the throughput on our remote connection systems. I've created a custom script as such : { "script" : "doc\['Bytes'\].value / 60" } and forced the… --- ## [Best practice to delete old Snapshots on Elasticsearch 2.4](https://discuss.elastic.co/t/best-practice-to-delete-old-snapshots-on-elasticsearch-2-4/255063)
**Author:** [@Silas-91](https://discuss.elastic.co/u/Silas-91)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 1:28pm UTC](https://discuss.elastic.co/t/best-practice-to-delete-old-snapshots-on-elasticsearch-2-4/255063 "2020-11-11T13:28:54Z")
Hi all, does anyone know the best way to delete the old snapshots at elasticsearch 2.4. And what will happen if I delete a snapshot from 5 days ago? These are incremental snapshots. How do they behave when restoring? T… --- ## [Data stream rollover exceeded max\_size](https://discuss.elastic.co/t/data-stream-rollover-exceeded-max-size/255069)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:25pm UTC](https://discuss.elastic.co/t/data-stream-rollover-exceeded-max-size/255069 "2020-11-11T13:25:16Z")
hi i defined "test-log" data stream,add the ilm as follow "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "10mb" }, "set\_priority": { "p… --- ## [2 hit observed in kibana whreas I ingest only once using logstash](https://discuss.elastic.co/t/2-hit-observed-in-kibana-whreas-i-ingest-only-once-using-logstash/255064)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:02pm UTC](https://discuss.elastic.co/t/2-hit-observed-in-kibana-whreas-i-ingest-only-once-using-logstash/255064 "2020-11-11T13:02:41Z")
I have my logstash config file as below, input{ file { type =\> "json" path =\> "D:/a-json.json" start\_position =\> "beginning" sincedb\_path =\> "NUL" mode =\> "read" file\_completed\_action =\> "log" file\_comple… --- ## [Elasticsearch S3 repository creation - Reload secure settings](https://discuss.elastic.co/t/elasticsearch-s3-repository-creation-reload-secure-settings/255035)
**Author:** [@Tanex](https://discuss.elastic.co/u/Tanex)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-repository-creation-reload-secure-settings/255035 "2020-11-11T13:01:54Z")
Hi All, I am using elasticsearch docker . The elasticsearch version Version: 6.2.1 I set my s3 credentials in elasticsearch-keystore . Now, i want to reload the secure settings. But i am getting the below errors. Plea… --- ## [How to add date format in \_delete\_by\_query](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 15\ **Last updated:** [November 11, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600 "2020-11-11T12:56:30Z")
Hello Team Could you please help me how to add a format while performing operation of "\_delete\_by\_query" on Index were condition of deletion is based on range --\> on a field having type as "epoch" and i can pass the da… --- ## [Fetching data from 3 index based on one unique field](https://discuss.elastic.co/t/fetching-data-from-3-index-based-on-one-unique-field/255047)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 12:48pm UTC](https://discuss.elastic.co/t/fetching-data-from-3-index-based-on-one-unique-field/255047 "2020-11-11T12:48:00Z")
Hi All, I have a requirement where I have three indexes In my first index there are three fields (id,name,age) In my second index, there are three fields(id, experience,company code) In my third index , there are thre… --- ## [What happens to copy\_to field when one of the origins values modified/deleted](https://discuss.elastic.co/t/what-happens-to-copy-to-field-when-one-of-the-origins-values-modified-deleted/255060)
**Author:** [@jac1241](https://discuss.elastic.co/u/jac1241)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:44pm UTC](https://discuss.elastic.co/t/what-happens-to-copy-to-field-when-one-of-the-origins-values-modified-deleted/255060 "2020-11-11T12:44:58Z")
Hello, I didn't find any reference in docs for this question. I want to use copy\_to to copy multiple fields to a signle field, when one of the original fields might be modified. For example: I have 2 fields: user\_ta… --- ## [Logstash idles out after a duration](https://discuss.elastic.co/t/logstash-idles-out-after-a-duration/255057)
**Author:** [@vyas.radhakrishnan](https://discuss.elastic.co/u/vyas.radhakrishnan)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:28pm UTC](https://discuss.elastic.co/t/logstash-idles-out-after-a-duration/255057 "2020-11-11T12:28:27Z")
We have a logstash pipeline . Input is a kafka topic , output is elastic search. If the topic does not receive any messages for hours , we observe a delay in processing the next message from topic when it comes. The log… --- ## [Not able to collect TTY logs using AuditBeat in Kubernetes (AWS EKS)](https://discuss.elastic.co/t/not-able-to-collect-tty-logs-using-auditbeat-in-kubernetes-aws-eks/254006)
**Author:** [@benyitzhaki](https://discuss.elastic.co/u/benyitzhaki)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 12:24pm UTC](https://discuss.elastic.co/t/not-able-to-collect-tty-logs-using-auditbeat-in-kubernetes-aws-eks/254006 "2020-11-11T12:24:41Z")
I would like to audit users shell activity using AuditBeat and the auditd module integration, by looking at TTY logs. I have followed every possible doc and can't get it up and running. I can see executions, but can't s… --- ## [Logstash DLQ commit\_offsets =\> true seems to be ignored?](https://discuss.elastic.co/t/logstash-dlq-commit-offsets-true-seems-to-be-ignored/255053)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:18pm UTC](https://discuss.elastic.co/t/logstash-dlq-commit-offsets-true-seems-to-be-ignored/255053 "2020-11-11T12:18:41Z")
I'm now playing around with the dead letter queue feature of Logstash. First I tried around with commit\_offsets =\> false to be able to set up everything and as expected the DLQ events were ingested after each restart of … --- ## [Filtering specific data as per requirements from Logtash](https://discuss.elastic.co/t/filtering-specific-data-as-per-requirements-from-logtash/255052)
**Author:** [@Sandesh\_Thombare](https://discuss.elastic.co/u/Sandesh_Thombare)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:15pm UTC](https://discuss.elastic.co/t/filtering-specific-data-as-per-requirements-from-logtash/255052 "2020-11-11T12:15:36Z")
Hi All, I am new to the logstash and trying to setup monitoring in Kibana. We have below messages & i would like to capture the message between GetInstallBase. and send it to kibana. 2020-10-28 12:10:11,149 \[fault (s… --- ## [KQL filter if more values](https://discuss.elastic.co/t/kql-filter-if-more-values/254961)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 12:12pm UTC](https://discuss.elastic.co/t/kql-filter-if-more-values/254961 "2020-11-11T12:12:50Z")
Hi, Looking to query a field such as process.args:"atbroker.exe" but would only want a hit if there is more in process.args than just atbroker.exe Is this possible? Thanks Phil --- ## [Restore saved objects from a remote .kibana index](https://discuss.elastic.co/t/restore-saved-objects-from-a-remote-kibana-index/254933)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 8\ **Last updated:** [November 11, 2020, 12:00pm UTC](https://discuss.elastic.co/t/restore-saved-objects-from-a-remote-kibana-index/254933 "2020-11-11T12:00:33Z")
Hello, I tried to reindex .kibana\_2(latest) of our production elastic to my local elastic. The problem is that Not all the saved objects have been transferred. What kind of data .kibana\_2 includes? Shouldn't all saved … --- ## [Kibana plugin handling errors returned by the API](https://discuss.elastic.co/t/kibana-plugin-handling-errors-returned-by-the-api/255019)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 11:30am UTC](https://discuss.elastic.co/t/kibana-plugin-handling-errors-returned-by-the-api/255019 "2020-11-11T11:30:44Z")
I'm trying to display an error message in my kibana plugin. I do it over http.get(...).then (..).catch( e=\>{console.log(e)}). In the browser console, I see, for example, error: bad request and nothing else. I expected to… --- ## [Sort and Stats Aggregation](https://discuss.elastic.co/t/sort-and-stats-aggregation/254426)
**Author:** [@abhinav\_elk](https://discuss.elastic.co/u/abhinav_elk)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 11:28am UTC](https://discuss.elastic.co/t/sort-and-stats-aggregation/254426 "2020-11-11T11:28:11Z")
I have a mapping of type { "properties":{ "Costs":{ "type":"nested", "properties":{ "price":{ "type":"integer" } … --- ## [Auto interval date histogram illegal argument exception, buckets must be less than 333](https://discuss.elastic.co/t/auto-interval-date-histogram-illegal-argument-exception-buckets-must-be-less-than-333/255042)
**Author:** [@dyegoe](https://discuss.elastic.co/u/dyegoe)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/auto-interval-date-histogram-illegal-argument-exception-buckets-must-be-less-than-333/255042 "2020-11-11T11:14:38Z")
I tried to create an auto\_date\_histogram to generate some graphs in our application and I would like to keep the length of this graph as 360 points (buckets). I'm trying to achieve at least for the last 6h a graph per m… --- ## [Logstash output script not working: Append array while upserting](https://discuss.elastic.co/t/logstash-output-script-not-working-append-array-while-upserting/250824)
**Author:** [@Bastian\_Jager](https://discuss.elastic.co/u/Bastian_Jager)\ **Replies:** 4\ **Last updated:** [November 11, 2020, 10:27am UTC](https://discuss.elastic.co/t/logstash-output-script-not-working-append-array-while-upserting/250824 "2020-11-11T10:27:55Z")
My plan is to uploads logs with logstash and update a field if this is present already in ES. There is the field "origin" with maybe this “origin” : \[ “live” \] and on upload it should become “origin” : \[ “live, “upload\].… --- ## [New plugin on previous version on Kibana](https://discuss.elastic.co/t/new-plugin-on-previous-version-on-kibana/255020)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 10:11am UTC](https://discuss.elastic.co/t/new-plugin-on-previous-version-on-kibana/255020 "2020-11-11T10:11:22Z")
Hi, We are running on production version 7.0.1 of Kibana, and we have a request to create a new plugin. While we were trying to use the plugin kibana generator on the dev environment, it looks like we are able to create… --- ## [Search Request are Getting Socket Timeout](https://discuss.elastic.co/t/search-request-are-getting-socket-timeout/255014)
**Author:** [@dillibabu.mekala](https://discuss.elastic.co/u/dillibabu.mekala)\ **Replies:** 6\ **Last updated:** [November 11, 2020, 10:02am UTC](https://discuss.elastic.co/t/search-request-are-getting-socket-timeout/255014 "2020-11-11T10:02:57Z")
Hi Team, We have an index containing 365 days data. We have started reprocessing existing 1-Day data (i.e reprocessing includes-\> Insert New Data + then delete the Old data), we observed that while reprocessing is goin… --- ## [Snmp v3 logstash not working in pipeline](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 5\ **Last updated:** [November 11, 2020, 9:48am UTC](https://discuss.elastic.co/t/snmp-v3-logstash-not-working-in-pipeline/254940 "2020-11-11T09:48:56Z")
Hello, I'm struggling with a strange problem with Logstash. I've created a config to query a few switches with SNMP v3 et get targeted interfaces statistics When I run logstash with the config file, everything works f… --- ## [Cannot connect Kibana to Elasticsearch with different port in docker](https://discuss.elastic.co/t/cannot-connect-kibana-to-elasticsearch-with-different-port-in-docker/254919)
**Author:** [@doston](https://discuss.elastic.co/u/doston)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 9:35am UTC](https://discuss.elastic.co/t/cannot-connect-kibana-to-elasticsearch-with-different-port-in-docker/254919 "2020-11-11T09:35:56Z")
I could not connect Kibana to Elasticsearch that is running in a different port in docker. Here is my docker file: version: '3.2' services: elasticsearch\_new\_1: image: docker.elastic.co/elasticsearch/elasticsearch… --- ## [Elasticsearch 6.8.10 memory leak](https://discuss.elastic.co/t/elasticsearch-6-8-10-memory-leak/253972)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 6\ **Last updated:** [November 11, 2020, 9:33am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-10-memory-leak/253972 "2020-11-11T09:33:01Z")
100+ node es cluster , hot/warm arch The stale node heap is 31gb, and multiple nodes occupy 90% of the heap irregularly. It will appear again one week after restarting. segment memory(14g), query cache(2.6g), single st… --- ## [Elasticsearch Datasheet Documentation](https://discuss.elastic.co/t/elasticsearch-datasheet-documentation/255028)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-datasheet-documentation/255028 "2020-11-11T09:05:51Z")
Hi, Is anyone here have elastic-search datasheet documentation? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1702) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1704)