# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1749 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1750 --- ## [Elasticsearch Thread Pool Details](https://discuss.elastic.co/t/elasticsearch-thread-pool-details/252164)
**Author:** [@cpiment](https://discuss.elastic.co/u/cpiment)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-thread-pool-details/252164 "2020-10-15T09:59:51Z")
Hi everyone, Sometimes we have some elasticsearch nodes that get a write queue size \> 200, so they begin rejecting requests. I have been searching this forum and the documentation for a way to get the details of the wr… --- ## [Metric visualization shows no results instead of 0 in count aggregation with terms exclusion](https://discuss.elastic.co/t/metric-visualization-shows-no-results-instead-of-0-in-count-aggregation-with-terms-exclusion/251794)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 12\ **Last updated:** [October 15, 2020, 9:41am UTC](https://discuss.elastic.co/t/metric-visualization-shows-no-results-instead-of-0-in-count-aggregation-with-terms-exclusion/251794 "2020-10-15T09:41:11Z")
Hi, I've created a Metric visualization with 2 metrics: Top hit aggregation on "name" field that I have Count aggregation On top of that I created a filter to get only the results from the recent minute. So, I get a… --- ## [Specifying Filebeat paths with "-"](https://discuss.elastic.co/t/specifying-filebeat-paths-with/252043)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 9:26am UTC](https://discuss.elastic.co/t/specifying-filebeat-paths-with/252043 "2020-10-15T09:26:02Z")
Hello All , I have a filebeat config like this - type: log enabled: true paths: - //XXXXXX/E122\_WWUSA-OPRD-CmpLog/XXXX/XXXXX/\*.log - //XXXXXX/E122\_WWUSA-OPRD-CmpLog/XXXX/XXXXX/\*.log I have the folder wit… --- ## [Filebeat](https://discuss.elastic.co/t/filebeat/252146)
**Author:** [@111387](https://discuss.elastic.co/u/111387)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 9:22am UTC](https://discuss.elastic.co/t/filebeat/252146 "2020-10-15T09:22:26Z")
receiving CEF format log using filebeat cef module and send to logstash While viewing the parsed results, I could see that there was an error tag. "error": { "message": \[ "malformed value for filePath at pos 168"… --- ## [Use a logstash plugin within iteration](https://discuss.elastic.co/t/use-a-logstash-plugin-within-iteration/252159)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 0\ **Last updated:** [October 15, 2020, 9:21am UTC](https://discuss.elastic.co/t/use-a-logstash-plugin-within-iteration/252159 "2020-10-15T09:21:59Z")
Hello, I've got documents where a field might contain multiple values. All the values from that field have to be looked up in a different index, to get the document enriched. "countries" : "India|Congo|Italy" I shoul… --- ## [Grok expressions do not match field value](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 9:10am UTC](https://discuss.elastic.co/t/grok-expressions-do-not-match-field-value/251654 "2020-10-15T09:10:54Z")
Hello, I am trying to parse posgresql audit logs which is in csv format (sample line below) 2020-10-05 00:23:14.603 GMT,ixq\_dc\_monitor,postgres,11450,10.10.60.83:59536,5f7a6772.2cba,1,authentication,2020-10-05 00:23:14… --- ## [Filter with aggregate value in Query DSL](https://discuss.elastic.co/t/filter-with-aggregate-value-in-query-dsl/251915)
**Author:** [@coline](https://discuss.elastic.co/u/coline)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 9:07am UTC](https://discuss.elastic.co/t/filter-with-aggregate-value-in-query-dsl/251915 "2020-10-15T09:07:26Z")
Hi everybody, I'm kind of new on elastic and I'm trying to apply this filter on my index : cpu \> 0.6 x max\_daily\_cpu. I succeed to create a query to get the max daily CPU : POST /\_search { "size": 0, "aggs"… --- ## [How to create chart](https://discuss.elastic.co/t/how-to-create-chart/251261)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 14\ **Last updated:** [October 15, 2020, 9:04am UTC](https://discuss.elastic.co/t/how-to-create-chart/251261 "2020-10-15T09:04:03Z")
Hello, I try create chart but ... I have 4 queries: Messages Sent (Internal) "query": "event\_id: \\"SEND\\" AND connector\_id: \\"Intra-Organization SMTP Send Connector\\" AND directionality: \\"Originating\\"" Mes… --- ## [ElasticSearch cluster for DC failure tolerance](https://discuss.elastic.co/t/elasticsearch-cluster-for-dc-failure-tolerance/251840)
**Author:** [@vodka\_pivo](https://discuss.elastic.co/u/vodka_pivo)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 8:48am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-for-dc-failure-tolerance/251840 "2020-10-15T08:48:56Z")
I have a 5 node ElasticSearch cluster which locates in 3 DataCenters DC1: ES01 (master-eligible, data) ES02 (data) DC2: ES03 (master-eligible, data) ES04 (data) DC3: ES05 (Master only node) so i need to continue R… --- ## [Alerts and Actions proxy for connectors](https://discuss.elastic.co/t/alerts-and-actions-proxy-for-connectors/251476)
**Author:** [@Sinios](https://discuss.elastic.co/u/Sinios)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 8:47am UTC](https://discuss.elastic.co/t/alerts-and-actions-proxy-for-connectors/251476 "2020-10-15T08:47:10Z")
Hello, I am playing with the new feature "Alerts and Actions" which seems very interessting but we are facing one issue: we can not specify the proxy for Slack alerting like we did before with the watcher Is there any … --- ## [How to add document details to an Alert Slack Action?](https://discuss.elastic.co/t/how-to-add-document-details-to-an-alert-slack-action/252031)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 7:52am UTC](https://discuss.elastic.co/t/how-to-add-document-details-to-an-alert-slack-action/252031 "2020-10-15T07:52:22Z")
Hello, I've created an Alert and Action. I've defined the Action to be a message to our team's Slack channel. The message lacks details of the erroneous document. How can I provide aggregation/document details in the… --- ## [Kibana pod doesn't come up , Log says Another Kibana instance appears to be migrating the index. Waiting for that migration to complete](https://discuss.elastic.co/t/kibana-pod-doesnt-come-up-log-says-another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete/251850)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 7:52am UTC](https://discuss.elastic.co/t/kibana-pod-doesnt-come-up-log-says-another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete/251850 "2020-10-15T07:52:12Z")
Hi , While upgrading Elasticsearch & kibana from version ELK-7.0.1 to ELK-7.8.0 , Kibana pod doesn't come up , and shows the below message in the Kibana log. we are using helm way to upgrade . {"type":"log","@timesta… --- ## [What's the best way to backup ILM policies & index templates](https://discuss.elastic.co/t/whats-the-best-way-to-backup-ilm-policies-index-templates/251231)
**Author:** [@Chr0my](https://discuss.elastic.co/u/Chr0my)\ **Replies:** 4\ **Last updated:** [October 15, 2020, 7:26am UTC](https://discuss.elastic.co/t/whats-the-best-way-to-backup-ilm-policies-index-templates/251231 "2020-10-15T07:26:51Z")
Hi everyone, I'm currently looking for a way to backup ILM policies and index templates automatically, but I cannot find where these informations are stored, and I don't want to snapshot my entire cluster. Is it stored… --- ## [Kibana 7.9.1 to 7.9.2 failure](https://discuss.elastic.co/t/kibana-7-9-1-to-7-9-2-failure/249883)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 7:16am UTC](https://discuss.elastic.co/t/kibana-7-9-1-to-7-9-2-failure/249883 "2020-10-15T07:16:59Z")
Ok I'm at a loss normally the updates even failed ones are easy to fix. Roll back to 7.9.1 worked thankfully. On the journal log when attempting to start kibana 7.9.2 with the elasticsearch already updated to 7.9.2 and … --- ## [LDAPS and chain of certificates](https://discuss.elastic.co/t/ldaps-and-chain-of-certificates/250724)
**Author:** [@v.n](https://discuss.elastic.co/u/v.n)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 6:59am UTC](https://discuss.elastic.co/t/ldaps-and-chain-of-certificates/250724 "2020-10-15T06:59:54Z")
I try to set up authentication through Active Directory. My problem is in connection using LDAPS. We have our own CA service and all certificates are issued by one of them. So we have root CA, then Sub CA which issues al… --- ## [Regexp Not Evaluating as Expected](https://discuss.elastic.co/t/regexp-not-evaluating-as-expected/251954)
**Author:** [@eafrost.cissp](https://discuss.elastic.co/u/eafrost.cissp)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 6:56am UTC](https://discuss.elastic.co/t/regexp-not-evaluating-as-expected/251954 "2020-10-15T06:56:54Z")
I'm trying to drop events for which the winlog.event\_data.TargetUserName ends with $ but keep the event when winlog.event\_data.TargetUserName has $ not as the end character. Using the regular expressions 101 tester (http… --- ## [Benefits/Drawbacks of using custom HTTP calls VS curator?](https://discuss.elastic.co/t/benefits-drawbacks-of-using-custom-http-calls-vs-curator/251931)
**Author:** [@vazma](https://discuss.elastic.co/u/vazma)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 6:12am UTC](https://discuss.elastic.co/t/benefits-drawbacks-of-using-custom-http-calls-vs-curator/251931 "2020-10-15T06:12:46Z")
Hi, I am thinking to use normal HTTP calls to DELETE some indexes instead of using curator. IS curator except DELETE also executes more checks? What are the drawbacks of just using simple HTTP calls? Thank you --- ## [Vega Transform Geopoint](https://discuss.elastic.co/t/vega-transform-geopoint/251703)
**Author:** [@edbautista](https://discuss.elastic.co/u/edbautista)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 6:12am UTC](https://discuss.elastic.co/t/vega-transform-geopoint/251703 "2020-10-15T06:12:11Z")
Hello, I'm trying to emulate the \[Flights\] Airport Connections (Hover Over Airport) Vega Visualization. I think the problem is at the transform bloc where the lat and long fields are specified. On the demo, the format … --- ## [Email Notification when column value reached to threshold value in dashboards](https://discuss.elastic.co/t/email-notification-when-column-value-reached-to-threshold-value-in-dashboards/251209)
**Author:** [@sajjithreddy](https://discuss.elastic.co/u/sajjithreddy)\ **Replies:** 3\ **Last updated:** [October 15, 2020, 6:05am UTC](https://discuss.elastic.co/t/email-notification-when-column-value-reached-to-threshold-value-in-dashboards/251209 "2020-10-15T06:05:06Z")
Hi Team, I am trying to send email notification when a column value reached to threshold value in dashboards in Kibana. Is there any way to send notification ?? If so, please provide me with the solution. Thanks in a… --- ## [Scripted Field in Kibana](https://discuss.elastic.co/t/scripted-field-in-kibana/252037)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 13\ **Last updated:** [October 15, 2020, 5:58am UTC](https://discuss.elastic.co/t/scripted-field-in-kibana/252037 "2020-10-15T05:58:31Z")
Hi all, i want to calculate the capacity of every room using scripted field: my data looks ike this: rooms { "board": "Soft All Inclusive", "quantity": 1, "roomId": 42114, "paxes": { "infant": 1, "adults": 2, … --- ## [Elastic search considers date field send by java service as string](https://discuss.elastic.co/t/elastic-search-considers-date-field-send-by-java-service-as-string/251924)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 5:56am UTC](https://discuss.elastic.co/t/elastic-search-considers-date-field-send-by-java-service-as-string/251924 "2020-10-15T05:56:46Z")
Hi I have created a java service and i am indexing the response into elasticseaarch i am sending a date value but elasticsearch considers it as string. Code is already deployed in production. How to change the incoming f… --- ## [How to add Date in mutate add field](https://discuss.elastic.co/t/how-to-add-date-in-mutate-add-field/251601)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 10\ **Last updated:** [October 15, 2020, 5:46am UTC](https://discuss.elastic.co/t/how-to-add-date-in-mutate-add-field/251601 "2020-10-15T05:46:21Z")
Hi Team I am using logstash v7.8 to extract data from ES v7.8 index and inserting respective records to ES v7.8 index-2. While doing so , I want to use filter --\> mutate --\> add\_field ==\> { "doc\_date" =\> "now-1d" } Ho… --- ## [How can buckets be sorted by doc\_count ratio?](https://discuss.elastic.co/t/how-can-buckets-be-sorted-by-doc-count-ratio/250068)
**Author:** [@yanglingqiang](https://discuss.elastic.co/u/yanglingqiang)\ **Replies:** 1\ **Last updated:** [October 15, 2020, 4:45am UTC](https://discuss.elastic.co/t/how-can-buckets-be-sorted-by-doc-count-ratio/250068 "2020-10-15T04:45:40Z")
I have data { "id": 1, "buyer\_id": 101, "total\_count": 2 } { "id": 2, "buyer\_id": 101, "total\_count": 2 } { "id": 3, "buyer\_id": 102, "total\_count": 1 } After aggregation by buyer\_id, I want to sort by… --- ## [Kibana interface opening problem](https://discuss.elastic.co/t/kibana-interface-opening-problem/251891)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 4:25am UTC](https://discuss.elastic.co/t/kibana-interface-opening-problem/251891 "2020-10-15T04:25:00Z")
Hi Experts, After installing elastic serach and kibana with 7.8.1 version I am not able to open the Kibana landing page in chrome (or in any browser) http://elasticsearchip:kibanaport/ Curl output \

**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 5\ **Last updated:** [October 15, 2020, 2:59am UTC](https://discuss.elastic.co/t/simple-kibana-term-query-not-searching-the-all-the-fields/252113 "2020-10-15T02:59:38Z") Hello, I'm puzzled by the following explanation here: Kibana Query Language | Kibana Guide \[8.11\] | Elastic Terms without fields are matched against the default field in your index settings. If a default field is not s… --- ## [How to search special characters in elasticsearch](https://discuss.elastic.co/t/how-to-search-special-characters-in-elasticsearch/251997)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 2:40am UTC](https://discuss.elastic.co/t/how-to-search-special-characters-in-elasticsearch/251997 "2020-10-15T02:40:44Z")
I want query terms name in string "9.999%". But it not working. setting document 'analysis' =\> \[ 'analyzer' =\> \[ 'default' =\> \[ 'type' =\> 'custom', 'tokenizer' =\> 'whitespace', 'filter' =\> \[ 'lowercase', 'word\_d… --- ## [How to convert format "yyyy-MM-dd HH:mm:ss in logstash?](https://discuss.elastic.co/t/how-to-convert-format-yyyy-mm-dd-hhss-in-logstash/252005)
**Author:** [@pamiers](https://discuss.elastic.co/u/pamiers)\ **Replies:** 2\ **Last updated:** [October 15, 2020, 2:28am UTC](https://discuss.elastic.co/t/how-to-convert-format-yyyy-mm-dd-hhss-in-logstash/252005 "2020-10-15T02:28:12Z")
I fetch the data through Oracle, and the database has a field updated\_at in the format "yyyy-MM-dd HH:mm:ss". However, it has been automatically changed to ISO8601 format in logstash. So I try to change the format "yyyy-… --- ## [Kibana embedded dashboard IFrame empty](https://discuss.elastic.co/t/kibana-embedded-dashboard-iframe-empty/250971)
**Author:** [@buncieboy](https://discuss.elastic.co/u/buncieboy)\ **Replies:** 4\ **Last updated:** [October 14, 2020, 10:51pm UTC](https://discuss.elastic.co/t/kibana-embedded-dashboard-iframe-empty/250971 "2020-10-14T22:51:05Z")
When I load our dashboard from a remote cluster, all works as intended. Loading the same dashboard from my local docker cluster the dashboard is completely empty (not even a "no results found" message). Inspecting the so… --- ## [Time stamp is wrong](https://discuss.elastic.co/t/time-stamp-is-wrong/251958)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 10\ **Last updated:** [October 14, 2020, 10:14pm UTC](https://discuss.elastic.co/t/time-stamp-is-wrong/251958 "2020-10-14T22:14:28Z")
I have a problem with the time stamp I get the date right, but the time is wrong I get like 5 hours in advance, the date is right but I do not know why I get another time of execution, set the time zone in kibana, but I … --- ## [The time zone of the time stamp is incorrect](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 2\ **Last updated:** [October 14, 2020, 9:24pm UTC](https://discuss.elastic.co/t/the-time-zone-of-the-time-stamp-is-incorrect/252081 "2020-10-14T21:24:14Z")
I have a problem with the time stamp, I have the correct date, but the time is wrong, I have like 5 hours in advance, the date is correct but I do not know why I have another time of execution, I put the time zone but it… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1748) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1750)