# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1757 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1758 --- ## [Kibana Visualization](https://discuss.elastic.co/t/kibana-visualization/251437)
**Author:** [@Sh3ldoris](https://discuss.elastic.co/u/Sh3ldoris)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 8:53am UTC](https://discuss.elastic.co/t/kibana-visualization/251437 "2020-10-12T08:53:42Z")
Hi everyone, I'm using Kibana 7.9.2 and I've made this query in DevTools console: POST audit/\_search { "size": 0, "aggs": { "sales\_per\_month": { "date\_histogram": { "field": "timestamp", "… --- ## [Unable to get Filebeat setup correctly](https://discuss.elastic.co/t/unable-to-get-filebeat-setup-correctly/251651)
**Author:** [@jonckvanderkogel](https://discuss.elastic.co/u/jonckvanderkogel)\ **Replies:** 7\ **Last updated:** [October 12, 2020, 9:09am UTC](https://discuss.elastic.co/t/unable-to-get-filebeat-setup-correctly/251651 "2020-10-12T09:09:15Z")
Hi everyone, I'm trying to get Filebeat set up on a local Mac Mini so it will ingest log files of a process to Elasticsearch. The log files contain a custom JSON format. I got it sort of working but in Elasticsearch the… --- ## [Elasticsearch nested object based filter and count operation](https://discuss.elastic.co/t/elasticsearch-nested-object-based-filter-and-count-operation/251733)
**Author:** [@bl4cksta](https://discuss.elastic.co/u/bl4cksta)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 8:45am UTC](https://discuss.elastic.co/t/elasticsearch-nested-object-based-filter-and-count-operation/251733 "2020-10-12T08:45:24Z")
I am new on elasticsearch. trying to use it on analytics calculations. I don't know, does it possible to do that but, I am trying to find customers who has 0 purchases. I stored, orders as nested object arrays for each c… --- ## [Node is not added to the cluster](https://discuss.elastic.co/t/node-is-not-added-to-the-cluster/251579)
**Author:** [@djuwa4](https://discuss.elastic.co/u/djuwa4)\ **Replies:** 7\ **Last updated:** [October 12, 2020, 8:38am UTC](https://discuss.elastic.co/t/node-is-not-added-to-the-cluster/251579 "2020-10-12T08:38:39Z")
I created a cluster for five nodes. However, one of the nodes does not see the rest and creates a cluster where this node is the only participant. I do everything in the same way on all nodes. Here is its config: cluste… --- ## [Processing a json file in filebeat](https://discuss.elastic.co/t/processing-a-json-file-in-filebeat/251438)
**Author:** [@humartinez](https://discuss.elastic.co/u/humartinez)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 8:30am UTC](https://discuss.elastic.co/t/processing-a-json-file-in-filebeat/251438 "2020-10-12T08:30:29Z")
Hi there!, I got a filebeat config (see further below) that is currently working, and Its supposed to read a log file written in JSON and then send it, in this case to a kafka topic. The the log message is stored in un… --- ## [Elasticsearch change primary shards number](https://discuss.elastic.co/t/elasticsearch-change-primary-shards-number/251716)
**Author:** [@vodka\_pivo](https://discuss.elastic.co/u/vodka_pivo)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 7:47am UTC](https://discuss.elastic.co/t/elasticsearch-change-primary-shards-number/251716 "2020-10-12T07:47:58Z")
Hello! i have 3 node elasticsearch cluster and i have index with 1 primary and 1 replica shards so i want to change the primary shard number from 1 to 2 using this method Split index API | Elasticsearch Guide \[7.9\] | E… --- ## [Splitting JSON extracted fields for new-line behaves incorrectly vs JSON original message](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 7:46am UTC](https://discuss.elastic.co/t/splitting-json-extracted-fields-for-new-line-behaves-incorrectly-vs-json-original-message/251688 "2020-10-12T07:46:15Z")
I've an example dataset as below { "org": "COMPANY11", "department": { "name": "Human Resources", "id": "HR" }, "http\_request": "Host: www.something.co.uk\\r\\nConnection: keep-alive\\r\\nUser-Agent: Mozilla… --- ## [Auto-upgrade Elastic Agent to bugfix releases](https://discuss.elastic.co/t/auto-upgrade-elastic-agent-to-bugfix-releases/250845)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 3\ **Last updated:** [October 12, 2020, 7:38am UTC](https://discuss.elastic.co/t/auto-upgrade-elastic-agent-to-bugfix-releases/250845 "2020-10-12T07:38:27Z")
Hi there, I've set the agent upgrading setting in the Ingest Manager to Automatically update agent binaries to use the latest minor version.. My stack is on 7.9.2, and I have agents on 7.9.0 and 7.9.1. Those probably w… --- ## [Vertical zoom, drag, Y axis position](https://discuss.elastic.co/t/vertical-zoom-drag-y-axis-position/250747)
**Author:** [@Philippe\_Graca](https://discuss.elastic.co/u/Philippe_Graca)\ **Replies:** 5\ **Last updated:** [October 12, 2020, 7:18am UTC](https://discuss.elastic.co/t/vertical-zoom-drag-y-axis-position/250747 "2020-10-12T07:18:39Z")
Hello all I'm currently trying to use kibana to analyse data coming out of SCADA monitoring software. I would like to be able to view the following graph X-Axis: Time Y-axis 1: A temperature beetween 0 to 1200 degree… --- ## [Setup logstash as system daemon](https://discuss.elastic.co/t/setup-logstash-as-system-daemon/251401)
**Author:** [@Somesh\_ng](https://discuss.elastic.co/u/Somesh_ng)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 6:47am UTC](https://discuss.elastic.co/t/setup-logstash-as-system-daemon/251401 "2020-10-12T06:47:31Z")
Can someone help me in setting up logstash as a system daemon. I have download logstash-7.9.1.tar.gz --- ## [Elastic Search Node deleted](https://discuss.elastic.co/t/elastic-search-node-deleted/251707)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 6:27am UTC](https://discuss.elastic.co/t/elastic-search-node-deleted/251707 "2020-10-12T06:27:24Z")
We had an unfortunate incident that one of the node (ubuntu server) has corrupted and couldn't recover the data on the node. We also had single shards with no replicas. Now the Cluster is still in Red color. What would t… --- ## [GeoPoint in Java not mapping geo\_point](https://discuss.elastic.co/t/geopoint-in-java-not-mapping-geo-point/251682)
**Author:** [@aatif26](https://discuss.elastic.co/u/aatif26)\ **Replies:** 5\ **Last updated:** [October 12, 2020, 5:58am UTC](https://discuss.elastic.co/t/geopoint-in-java-not-mapping-geo-point/251682 "2020-10-12T05:58:04Z")
I am using ElasticSearch and JAVA REST High Level Client v7.9 Following is my agent class public class Agent { private GeoPoint location; private long timestamp; private long available; public Agent(G… --- ## [Filebeat is unable to send logs into kafka](https://discuss.elastic.co/t/filebeat-is-unable-to-send-logs-into-kafka/251674)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 5:36am UTC](https://discuss.elastic.co/t/filebeat-is-unable-to-send-logs-into-kafka/251674 "2020-10-12T05:36:56Z")
Earlier we were using Filebeat to logstash setup for logs but to make sure no log is lost during down time so we thought to use kafka in between of logstash and filebeat so that kafka would save logs incase of down time. … --- ## [Logstash adding tag issue](https://discuss.elastic.co/t/logstash-adding-tag-issue/250787)
**Author:** [@Ashish\_Jindal](https://discuss.elastic.co/u/Ashish_Jindal)\ **Replies:** 7\ **Last updated:** [October 12, 2020, 4:35am UTC](https://discuss.elastic.co/t/logstash-adding-tag-issue/250787 "2020-10-12T04:35:33Z")
We had given a task as Try adding tag A if the data read is a. a b a c d Ensure that the input data is tagged with type as a test, and write the output to the file output.txt in the path usr/share/logstash . For whi… --- ## [Complex regexp](https://discuss.elastic.co/t/complex-regexp/251673)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 6\ **Last updated:** [October 12, 2020, 4:17am UTC](https://discuss.elastic.co/t/complex-regexp/251673 "2020-10-12T04:17:44Z")
hello everybody, i'm new in elasticsearch and i'm creating an internal search engine for my company. i'm try to make a query that must returns only files contained in some paths. here is my PHP code: $params\['body'\]\[… --- ## [Response of asynchronous bulk request when a node dies](https://discuss.elastic.co/t/response-of-asynchronous-bulk-request-when-a-node-dies/251422)
**Author:** [@harisk](https://discuss.elastic.co/u/harisk)\ **Replies:** 3\ **Last updated:** [October 12, 2020, 3:32am UTC](https://discuss.elastic.co/t/response-of-asynchronous-bulk-request-when-a-node-dies/251422 "2020-10-12T03:32:07Z")
I have trouble with the response of asynchronous bulk request when a node dies. For example, I run 1 master node, 2 data nodes, and 2 client nodes (coordinating nodes). I test on the index with 2 primary shards without… --- ## [Filebeat multiline message display](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386)
**Author:** [@vadrix](https://discuss.elastic.co/u/vadrix)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 2:56am UTC](https://discuss.elastic.co/t/filebeat-multiline-message-display/251386 "2020-10-12T02:56:41Z")
Hi.. i am trying to create multiline for "t message" on elasticsearch but it's always showing sing line for each log on elasticsearch this from elasticsearch and this from logs file on filebeat.inputs i am us… --- ## [How to Validate elasticsearch queries](https://discuss.elastic.co/t/how-to-validate-elasticsearch-queries/251672)
**Author:** [@dipack-v](https://discuss.elastic.co/u/dipack-v)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 1:30am UTC](https://discuss.elastic.co/t/how-to-validate-elasticsearch-queries/251672 "2020-10-12T01:30:37Z")
Hi, Is there any way to validate the queries created with QueryBuilders, For instance if we are using RDBMS, we can Embedded lightweight db to test the data layer. Is there anything similar in elasticsearch ? --- ## [Getting sum of a field in xml](https://discuss.elastic.co/t/getting-sum-of-a-field-in-xml/251657)
**Author:** [@Ameeruddin\_Mohammed](https://discuss.elastic.co/u/Ameeruddin_Mohammed)\ **Replies:** 3\ **Last updated:** [October 11, 2020, 9:19pm UTC](https://discuss.elastic.co/t/getting-sum-of-a-field-in-xml/251657 "2020-10-11T21:19:58Z")
hi, i am new to elk. with a lot of googling and checking responses of @Badger i was able to come up with a working config to load data as i wanted. sample loaded data { "@timestamp" =\> xxx, "host" =\> "xxx", "data" =\>… --- ## [Scripted field is not showing value of destination.domain field](https://discuss.elastic.co/t/scripted-field-is-not-showing-value-of-destination-domain-field/250499)
**Author:** [@Dubru](https://discuss.elastic.co/u/Dubru)\ **Replies:** 3\ **Last updated:** [October 11, 2020, 9:10pm UTC](https://discuss.elastic.co/t/scripted-field-is-not-showing-value-of-destination-domain-field/250499 "2020-10-11T21:10:58Z")
Hi, I am using ElasticSearch and Kibana 7x version, I am trying to concatenate two fields values. Before I write actual concatenation painless script, I tried accessing field values from scripted field. when I run the… --- ## [Custom field formatter](https://discuss.elastic.co/t/custom-field-formatter/250801)
**Author:** [@g\_k\_b](https://discuss.elastic.co/u/g_k_b)\ **Replies:** 3\ **Last updated:** [October 11, 2020, 9:08pm UTC](https://discuss.elastic.co/t/custom-field-formatter/250801 "2020-10-11T21:08:54Z")
Hello there! :slight\_smile: I need to create a custom field formatter; I found this article which is a kind of guide for Kibana 4.. Where could I find something similar for Kibana 7.? I'm asking because I noticed that… --- ## [Use of "Terms" as "Buckets" with "Parent Pipeline Aggregations" e.g. "Derivative"](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966)
**Author:** [@malsioufi](https://discuss.elastic.co/u/malsioufi)\ **Replies:** 4\ **Last updated:** [October 11, 2020, 9:03pm UTC](https://discuss.elastic.co/t/use-of-terms-as-buckets-with-parent-pipeline-aggregations-e-g-derivative/250966 "2020-10-11T21:03:05Z")
Hi, I am working on some visualization to track number of issues (let's say bugs) over different versions of a system, and I am aiming to build a visualization with Kibana that uses the release name as X-axis and the di… --- ## [Getting Error:{"statusCode":404,"error":"Not Found","message":"Not Found"} While trying to view system health status through metricbeat plugin with deployed kibana source code](https://discuss.elastic.co/t/getting-error-statuscode-404-error-not-found-message-not-found-while-trying-to-view-system-health-status-through-metricbeat-plugin-with-deployed-kibana-source-code/250933)
**Author:** [@vkg0312](https://discuss.elastic.co/u/vkg0312)\ **Replies:** 3\ **Last updated:** [October 11, 2020, 9:01pm UTC](https://discuss.elastic.co/t/getting-error-statuscode-404-error-not-found-message-not-found-while-trying-to-view-system-health-status-through-metricbeat-plugin-with-deployed-kibana-source-code/250933 "2020-10-11T21:01:40Z")
while trying to work with kibana source code I wanted to visualize system health status data on kibana using metricbeat while metric beat is performing status check by calling rest api"http://localhost:5603/api/status" … --- ## [Dynamic Routing in kibana](https://discuss.elastic.co/t/dynamic-routing-in-kibana/250536)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 4\ **Last updated:** [October 11, 2020, 8:53pm UTC](https://discuss.elastic.co/t/dynamic-routing-in-kibana/250536 "2020-10-11T20:53:33Z")
Is there a possibility where I can pass the fields to filter to an exisiting chart in kibana through the url ? So I can see the chart with the filter that is applied --- ## [Logstash log10 function in ruby](https://discuss.elastic.co/t/logstash-log10-function-in-ruby/251668)
**Author:** [@Ameeruddin\_Mohammed](https://discuss.elastic.co/u/Ameeruddin_Mohammed)\ **Replies:** 2\ **Last updated:** [October 11, 2020, 8:49pm UTC](https://discuss.elastic.co/t/logstash-log10-function-in-ruby/251668 "2020-10-11T20:49:27Z")
hi, I have to use log10 function, can anyone support. tried both options but didnt work event.set("AvgRssiHigh", 10\*log10((s.sum/b.sum) / 1000000000000)) event.set("AvgRssiHigh", 10\*((s.sum/b.sum) / 1000000000000).lo… --- ## [How to select default tenant as "GLOBAL" in KIbana Dashboard](https://discuss.elastic.co/t/how-to-select-default-tenant-as-global-in-kibana-dashboard/251079)
**Author:** [@vinay\_rathore](https://discuss.elastic.co/u/vinay_rathore)\ **Replies:** 2\ **Last updated:** [October 11, 2020, 2:59pm UTC](https://discuss.elastic.co/t/how-to-select-default-tenant-as-global-in-kibana-dashboard/251079 "2020-10-11T14:59:07Z")
Hello, We have 2 tenants currently in Kibana Dashboard, Private and Global in Kibana dashboard which is hosted by aws. Every time i login the dashboard opens with Private as tenant by default. Is there a way i can con… --- ## [Curl against an encrypted Elasticsearch instance with certificate verification](https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 1\ **Last updated:** [October 11, 2020, 11:27am UTC](https://discuss.elastic.co/t/curl-against-an-encrypted-elasticsearch-instance-with-certificate-verification/251503 "2020-10-11T11:27:10Z")
Hi there! SHORT QUESTION: How can I make a curl request to a local ES cluster (3 nodes running on localhost) in the form of curl -XGET "https://localhost:9200" -u elastic --cacert elasticsearch-ca.pem, verifying the ce… --- ## [Want to fetch last one day filebeat data as CSV format and to store into S3](https://discuss.elastic.co/t/want-to-fetch-last-one-day-filebeat-data-as-csv-format-and-to-store-into-s3/251675)
**Author:** [@Ayush\_Agrahari](https://discuss.elastic.co/u/Ayush_Agrahari)\ **Replies:** 0\ **Last updated:** [October 11, 2020, 10:38am UTC](https://discuss.elastic.co/t/want-to-fetch-last-one-day-filebeat-data-as-csv-format-and-to-store-into-s3/251675 "2020-10-11T10:38:59Z")
We have filebeat running (filebeat -\> logstash -\> Elasticsearch \<- kafka) in ELK Setup. We are looking for some mechanism which store last 1 day data of filebeat-\* index as CSV format into S3 as night cron job. Is there… --- ## [If enable ILM in config file, then cannot set custom elastic output index](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307)
**Author:** [@tonysue](https://discuss.elastic.co/u/tonysue)\ **Replies:** 7\ **Last updated:** [October 10, 2020, 5:45pm UTC](https://discuss.elastic.co/t/if-enable-ilm-in-config-file-then-cannot-set-custom-elastic-output-index/251307 "2020-10-10T17:45:24Z")
setup.template.overwrite: true output.elasticsearch.index: "winlogbeat=%{\[agent.version\]}"-city-firm-hostname-%{+yyyy,MM,dd}-000001" setup.template.name: "winlogbeat" setup.template.pattern: "winlogbeat-\*" setup.ilm.… --- ## [Logging Queries in Elasticsearch 7.x](https://discuss.elastic.co/t/logging-queries-in-elasticsearch-7-x/251591)
**Author:** [@Michael\_Woodham](https://discuss.elastic.co/u/Michael_Woodham)\ **Replies:** 1\ **Last updated:** [October 11, 2020, 7:40am UTC](https://discuss.elastic.co/t/logging-queries-in-elasticsearch-7-x/251591 "2020-10-11T07:40:39Z")
Is there an option to log queries made to Elasticsearch. I see that there was a slowlog option in elasticsearch 5 to log these by setting the thresholds to 1ms, but this appears to be gone in elasticsearch 7.x I am curr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1756) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1758)