# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1761 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1762 --- ## [Kibana Discover page sorting when Hide 'Time' column enabled](https://discuss.elastic.co/t/kibana-discover-page-sorting-when-hide-time-column-enabled/251326)
**Author:** [@CODE-REaD](https://discuss.elastic.co/u/CODE-REaD)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 2:52pm UTC](https://discuss.elastic.co/t/kibana-discover-page-sorting-when-hide-time-column-enabled/251326 "2020-10-08T14:52:32Z")
Background: Kibana and Elasticsearch version: 7.9.2, installed with yum from repo elasticsearch-7.x, running on free license. Platform: CentOS 7 I had enabled Kibana's Advanced setting titled Hide 'Time' column (doc\_ta… --- ## [Running multiple SQL Queries in logstash JDBC plugin](https://discuss.elastic.co/t/running-multiple-sql-queries-in-logstash-jdbc-plugin/251394)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 2:51pm UTC](https://discuss.elastic.co/t/running-multiple-sql-queries-in-logstash-jdbc-plugin/251394 "2020-10-08T14:51:57Z")
I know that multiple JDBC input plugins can be used in logstash to support the multiple SQL statements. Would like to know whether these are run sequentially or parallelly. Is there any way I can enforce them to run one … --- ## [How to preserve timestamp while re-indexing?](https://discuss.elastic.co/t/how-to-preserve-timestamp-while-re-indexing/251461)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-preserve-timestamp-while-re-indexing/251461 "2020-10-08T14:51:03Z")
I'm reindexing from 6.4 to 7.9 and while I got all documents as it is one thing I noticed timestamp is different, how do I preserve old timestamp in the document? --- ## [Can I run elasticsearch completely in memory?](https://discuss.elastic.co/t/can-i-run-elasticsearch-completely-in-memory/251063)
**Author:** [@kagrahar](https://discuss.elastic.co/u/kagrahar)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 2:38pm UTC](https://discuss.elastic.co/t/can-i-run-elasticsearch-completely-in-memory/251063 "2020-10-08T14:38:17Z")
I have about 15TB of DRAM. Can I create RAMdisk of 1TB size and completely run elastic search in memory? My data is about 300GB. Thanks in advance --- ## [7.9: "....creating index, cause \[auto(bulk api)\],..." ignores null\_values set in legacy index template](https://discuss.elastic.co/t/7-9-creating-index-cause-auto-bulk-api-ignores-null-values-set-in-legacy-index-template/251463)
**Author:** [@jze](https://discuss.elastic.co/u/jze)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:22pm UTC](https://discuss.elastic.co/t/7-9-creating-index-cause-auto-bulk-api-ignores-null-values-set-in-legacy-index-template/251463 "2020-10-08T14:22:29Z")
Excerpt from template: (Ruby hash) index\_patterns: \[ "ldb-dvm-\*", \], order: 200, ... ... aliases: { 'ldb-dvm' =\> {}, }, mappings: { \_source: { enabled: true, }, dynamic\_templates: \[{ string… --- ## [Put array elements into new fields with logstash filter](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980)
**Author:** [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 2:06pm UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980 "2020-10-08T14:06:56Z")
Hello, I have an issue finding a solution for my problem : My filebeat sends IIS logs to logstash, with an URIPATH field named iis.uri, it looks like : /aaaaa/bbbbb/cccccc/dddddd/eeeeee I copy this field i wanna keep… --- ## [Ingest Pipeline parsing the wrong week](https://discuss.elastic.co/t/ingest-pipeline-parsing-the-wrong-week/251456)
**Author:** [@Antonis\_Michael](https://discuss.elastic.co/u/Antonis_Michael)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:06pm UTC](https://discuss.elastic.co/t/ingest-pipeline-parsing-the-wrong-week/251456 "2020-10-08T14:06:08Z")
Hello, I am trying to parse weekly indices by utilizing the ingest pipelines in elasticsearch but I keep getting a week before the actual week of the year. Would you know what the issue is? { "date\_index\_name" : { "d… --- ## [Import Audibeat dashboard into Kibana](https://discuss.elastic.co/t/import-audibeat-dashboard-into-kibana/251453)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 2:00pm UTC](https://discuss.elastic.co/t/import-audibeat-dashboard-into-kibana/251453 "2020-10-08T14:00:28Z")
Hi, I configured my cluster to integrate Auditbeat logs. How I can import, in a specific space, auditbeat dashboards into Kibana, without to set configuration into auditbeat.yml ? Can I find dashboards somewhere and im… --- ## [Change Primary shards number](https://discuss.elastic.co/t/change-primary-shards-number/250963)
**Author:** [@vodka\_pivo](https://discuss.elastic.co/u/vodka_pivo)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 2:00pm UTC](https://discuss.elastic.co/t/change-primary-shards-number/250963 "2020-10-08T14:00:25Z")
Hello! i use elasticsearch 7.4.0 and i want to change the primary shards number on existing indices how can i do this? i want to increase some primary shards, and decrease --- ## [Elasticsearch Index life cycle policy timing](https://discuss.elastic.co/t/elasticsearch-index-life-cycle-policy-timing/251180)
**Author:** [@jijo.john](https://discuss.elastic.co/u/jijo.john)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 1:58pm UTC](https://discuss.elastic.co/t/elasticsearch-index-life-cycle-policy-timing/251180 "2020-10-08T13:58:18Z")
Hi Team, Can you please let me know what exactly "Timing for Warm phase" means . My Hot Phase Time is 50GB or 30 days , and my index reaches 50 GB in 5 days , but i would like to keep the index in Hot phase for another… --- ## [How to get size disk closed index - Mapper size plugin](https://discuss.elastic.co/t/how-to-get-size-disk-closed-index-mapper-size-plugin/250685)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 1:55pm UTC](https://discuss.elastic.co/t/how-to-get-size-disk-closed-index-mapper-size-plugin/250685 "2020-10-08T13:55:17Z")
Hi, Is it possible to retrieve disk size information of closed index with mapper size plugin ? I need to create index disk usage statistics but I don't really know how to get closed index information.. Kind regards, … --- ## [Index lifecycle error, unauthorized for user](https://discuss.elastic.co/t/index-lifecycle-error-unauthorized-for-user/251442)
**Author:** [@whysmer](https://discuss.elastic.co/u/whysmer)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 12:58pm UTC](https://discuss.elastic.co/t/index-lifecycle-error-unauthorized-for-user/251442 "2020-10-08T12:58:52Z")
Hello, I have the following error for rollover & index winlogbeat: Index lifecycle error security\_exception: action \[indices:admin/rollover\] is unauthorized for user \[beats\_admin\] This user have exactly the same pe… --- ## [Nested Object Cardinality Aggregation not Working](https://discuss.elastic.co/t/nested-object-cardinality-aggregation-not-working/251400)
**Author:** [@hetvakil](https://discuss.elastic.co/u/hetvakil)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 1:49pm UTC](https://discuss.elastic.co/t/nested-object-cardinality-aggregation-not-working/251400 "2020-10-08T13:49:11Z")
I want to get Total Unique email count in a Nested object. Below is the example of the document. When we keep Nested object as property in mapping then the count for cardinality is always showing zero while if that objec… --- ## [Retrieve metricbeat parameters from Elasticsearch using java Rest high level client](https://discuss.elastic.co/t/retrieve-metricbeat-parameters-from-elasticsearch-using-java-rest-high-level-client/251416)
**Author:** [@pathfinder225](https://discuss.elastic.co/u/pathfinder225)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:48am UTC](https://discuss.elastic.co/t/retrieve-metricbeat-parameters-from-elasticsearch-using-java-rest-high-level-client/251416 "2020-10-08T10:48:53Z")
Hi Team, We have to retrieve below parameters from our metric beat index from elasticsearch, index pattern would look like something like metricbeat-appId All these parameters are not present in single document they ar… --- ## [Changing node.attr.data from hot to warm](https://discuss.elastic.co/t/changing-node-attr-data-from-hot-to-warm/251447)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 1:27pm UTC](https://discuss.elastic.co/t/changing-node-attr-data-from-hot-to-warm/251447 "2020-10-08T13:27:21Z")
Hello, Just wondering what's the expected behaviour when we change the node.attr.data attribute from hot to warm in elasticsearch.yml and restart elasticsearch. As I'm preparing to add some new warm nodes to our cluster… --- ## [Winlogbeat Sysmon Registry events missing event.category](https://discuss.elastic.co/t/winlogbeat-sysmon-registry-events-missing-event-category/251282)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 1:14pm UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-registry-events-missing-event-category/251282 "2020-10-08T13:14:35Z")
Hello, My Sysmon registry events (Registry object added or deleted (rule: RegistryEvent)) seem to be missing an event.category field. (7.8) What event.category should be given to these Sysmon events? Grtz Willem --- ## [Syslog data that is going into logstash not being picked up by elasticsearch](https://discuss.elastic.co/t/syslog-data-that-is-going-into-logstash-not-being-picked-up-by-elasticsearch/251332)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 1:10pm UTC](https://discuss.elastic.co/t/syslog-data-that-is-going-into-logstash-not-being-picked-up-by-elasticsearch/251332 "2020-10-08T13:10:06Z")
I have all my servers pushing syslog data to 4 logstash servers, the logstash servers are not forwarding syslog information into elasticsearch, here is my conf file input { tcp { port =\> 5514 type =\> syslog } udp { … --- ## [Logstash filter doesn't apply on the output](https://discuss.elastic.co/t/logstash-filter-doesnt-apply-on-the-output/251443)
**Author:** [@BTH.S3](https://discuss.elastic.co/u/BTH.S3)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 1:00pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-apply-on-the-output/251443 "2020-10-08T13:00:29Z")
Recently I've deployed FileBeat in two remote servers for gathering log messages and send to the logstash on the local server. The connection between FireBeat and Logstash is perfect. The messages have been transferring… --- ## [Parse multiline JSON object from Docker log](https://discuss.elastic.co/t/parse-multiline-json-object-from-docker-log/251406)
**Author:** [@bellackn](https://discuss.elastic.co/u/bellackn)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 12:45pm UTC](https://discuss.elastic.co/t/parse-multiline-json-object-from-docker-log/251406 "2020-10-08T12:45:11Z")
Hey there, I am trying to parse multiline JSON objects that Filebeat collects from Docker container JSON logfiles and then sends them to Logstash. Specifically, it's Java stacktraces. My output looks like this: {"log":… --- ## [JSON Request With Saved Object Find API](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265)
**Author:** [@git-blame](https://discuss.elastic.co/u/git-blame)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 12:44pm UTC](https://discuss.elastic.co/t/json-request-with-saved-object-find-api/251265 "2020-10-08T12:44:58Z")
In the Find API, there is a has\_reference parameter which is an object with fields type and id. However, There is no example I can find of how to format that as a URL (e.g., for a curl get) This comment implies that I … --- ## [How to get the consolidated aggregartion on specfic part of String](https://discuss.elastic.co/t/how-to-get-the-consolidated-aggregartion-on-specfic-part-of-string/251432)
**Author:** [@rajan01](https://discuss.elastic.co/u/rajan01)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-get-the-consolidated-aggregartion-on-specfic-part-of-string/251432 "2020-10-08T12:44:44Z")
In the elastic search we have logs with fi\_id as BA-844, BAX-844, BA-SYSTEM-844 and BA-090, BAX-090, BA-SYSTEM-WER-090 and many more with same numeric value as last part of the string. I want to write the elastic query … --- ## [Upgrade cluster to 7.9.2, master\_not\_discovered\_exception](https://discuss.elastic.co/t/upgrade-cluster-to-7-9-2-master-not-discovered-exception/251287)
**Author:** [@JSkier](https://discuss.elastic.co/u/JSkier)\ **Replies:** 3\ **Last updated:** [October 8, 2020, 12:33pm UTC](https://discuss.elastic.co/t/upgrade-cluster-to-7-9-2-master-not-discovered-exception/251287 "2020-10-08T12:33:33Z")
Hi, This started out with Kibana not working, now seeing the root issue may be with my 3 node cluster no longer working. I get this error (telnet to 9300 works on all three search nodes): {"error":{"root\_cause":\[{"typ… --- ## [Group and keep only first result of that group](https://discuss.elastic.co/t/group-and-keep-only-first-result-of-that-group/250624)
**Author:** [@lanwin](https://discuss.elastic.co/u/lanwin)\ **Replies:** 4\ **Last updated:** [October 8, 2020, 11:18am UTC](https://discuss.elastic.co/t/group-and-keep-only-first-result-of-that-group/250624 "2020-10-08T11:18:44Z")
Is there any way to do a search, do a group (and discard all but one result of that group)? We have a simple parent-\>children relationship (building also a group). Our problem is now that we have a complex filter and it… --- ## [Make Readable message in kibana](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 11:17am UTC](https://discuss.elastic.co/t/make-readable-message-in-kibana/251428 "2020-10-08T11:17:48Z")
In the above picture you can see message,timestamp and fields which is added by grok pattern. with use grok pattern take value from message and added into fields(set names in grok). now in fields you can see values b… --- ## [Query by max date](https://discuss.elastic.co/t/query-by-max-date/251424)
**Author:** [@Kennethtruyers](https://discuss.elastic.co/u/Kennethtruyers)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 11:10am UTC](https://discuss.elastic.co/t/query-by-max-date/251424 "2020-10-08T11:10:55Z")
I have an index that is append only. Every change gets saved as a new document, together with a date property. In order to get the current active data I need to group all entities by their ID and get the one with the lat… --- ## [How to sort with case insensitive in elasticsearch](https://discuss.elastic.co/t/how-to-sort-with-case-insensitive-in-elasticsearch/251420)
**Author:** [@Mak\_Mak](https://discuss.elastic.co/u/Mak_Mak)\ **Replies:** 0\ **Last updated:** [October 8, 2020, 10:59am UTC](https://discuss.elastic.co/t/how-to-sort-with-case-insensitive-in-elasticsearch/251420 "2020-10-08T10:59:15Z")
My index name is data\_new Below is the code to insert into index test = \[ {'id':1,'name': 'Cost Accounting 400', 'professor': \['Bill Cage', 'accounting'\]}, { 'id':2, 'name': 'Computer Internals 250', 'professor'… --- ## [Unable to start logstash](https://discuss.elastic.co/t/unable-to-start-logstash/251396)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 2\ **Last updated:** [October 8, 2020, 10:58am UTC](https://discuss.elastic.co/t/unable-to-start-logstash/251396 "2020-10-08T10:58:51Z")
Team, I am trying to start logstash but unable to do so as it says the port is being used but there is no such port used in the host. \[2020-10-08T04:18:10,305\]\[INFO \]\[logstash.inputs.http \]\[httpd\]\[c8cb23d9d60ec3c13… --- ## [How to create an Alert for APM ML job?](https://discuss.elastic.co/t/how-to-create-an-alert-for-apm-ml-job/251221)
**Author:** [@insanity13](https://discuss.elastic.co/u/insanity13)\ **Replies:** 1\ **Last updated:** [October 8, 2020, 10:47am UTC](https://discuss.elastic.co/t/how-to-create-an-alert-for-apm-ml-job/251221 "2020-10-08T10:47:07Z")
How to create an Alert for APM ML job? For Uptime, it offers to create automatically. But I can't find a way to create an alert for APM anomalies. --- ## [Logstash create value based on duplicate field](https://discuss.elastic.co/t/logstash-create-value-based-on-duplicate-field/250852)
**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\ **Replies:** 5\ **Last updated:** [October 8, 2020, 10:19am UTC](https://discuss.elastic.co/t/logstash-create-value-based-on-duplicate-field/250852 "2020-10-08T10:19:42Z")
Hello, I wan't know if it's possible to get duplicate value un field and create another field based on that value. Supposed I have logs: Field1, Field2, Field3 A,B, C A,D, E B, E, T B, R, H S, V, X What I wan't … --- ## [Scripted field getting 12 hours date time difference](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999)
**Author:** [@ahmadsayeed3](https://discuss.elastic.co/u/ahmadsayeed3)\ **Replies:** 11\ **Last updated:** [October 8, 2020, 10:16am UTC](https://discuss.elastic.co/t/scripted-field-getting-12-hours-date-time-difference/248999 "2020-10-08T10:16:22Z")
Hi, I am trying to get difference between current date time and a field(date time). Timezone for date formatting: UTC Date format: MM/D/YYYY HH:mm:ss.SSS Date with nanoseconds format: MMM D, YYYY @ HH:mm:ss.SSSSSSSS… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1760) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1762)