# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1786

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1787

---

## [Cannot access Kibana from the browser](https://discuss.elastic.co/t/cannot-access-kibana-from-the-browser/249848)

<div class="topic-metadata">

**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\
**Replies:** 6\
**Last updated:** [September 24, 2020, 10:01pm UTC](https://discuss.elastic.co/t/cannot-access-kibana-from-the-browser/249848 "2020-09-24T22:01:24Z")

</div>

I am using a basic license with Logstash, Elasticsearch and Kibana. I am able to start all services successfully but Kibana cannot be accessed from the browser. It used to work but suddenly stop when reaching the hostnam…

---

## [CPU utilization showing differently in Dashboard](https://discuss.elastic.co/t/cpu-utilization-showing-differently-in-dashboard/248958)

<div class="topic-metadata">

**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\
**Replies:** 0\
**Last updated:** [September 17, 2020, 10:11am UTC](https://discuss.elastic.co/t/cpu-utilization-showing-differently-in-dashboard/248958 "2020-09-17T10:11:22Z")

</div>

Hi, In Metricbeat dashboard, Top10 cpu utilization showing different as below.. But when I click the host overview it's showing and host overview showing only 50% but disk utilization showing also in red, is it cou…

---

## [Deleting Elasticsearch indices without breaking Kibana visualizations](https://discuss.elastic.co/t/deleting-elasticsearch-indices-without-breaking-kibana-visualizations/249872)

<div class="topic-metadata">

**Author:** [@helenp](https://discuss.elastic.co/u/helenp)\
**Replies:** 5\
**Last updated:** [September 24, 2020, 9:40pm UTC](https://discuss.elastic.co/t/deleting-elasticsearch-indices-without-breaking-kibana-visualizations/249872 "2020-09-24T21:40:57Z")

</div>

Hello, How do you prevent Kibana visualizations from breaking due to deleted indices (as described in this thread)? I deleted some of my indices in Elasticsearch and afterwards saw the missing index pattern error in eac…

---

## [What is the Timelion query in Kibana to get the trend graph for today's top hit URLs count and the 1 day back data of same URLs for the trend comparison](https://discuss.elastic.co/t/what-is-the-timelion-query-in-kibana-to-get-the-trend-graph-for-todays-top-hit-urls-count-and-the-1-day-back-data-of-same-urls-for-the-trend-comparison/249117)

<div class="topic-metadata">

**Author:** [@Dubru](https://discuss.elastic.co/u/Dubru)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 9:39pm UTC](https://discuss.elastic.co/t/what-is-the-timelion-query-in-kibana-to-get-the-trend-graph-for-todays-top-hit-urls-count-and-the-1-day-back-data-of-same-urls-for-the-trend-comparison/249117 "2020-09-24T21:39:31Z")

</div>

Hi, I am using Elasticsearch, Kibana, Filebeat 7x version. I am trying to create a Timelion query in Kibana to get the today TOP HIT URLs count and 1 day back data of the same URLs for the trend comparison of those grap…

---

## [Elasticsearch in docker - data folder empty](https://discuss.elastic.co/t/elasticsearch-in-docker-data-folder-empty/249688)

<div class="topic-metadata">

**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 9:32pm UTC](https://discuss.elastic.co/t/elasticsearch-in-docker-data-folder-empty/249688 "2020-09-24T21:32:14Z")

</div>

Hi Im creating a volume for elasticsearch and it comes empty. When getting into the docker image, the path /usr/share/elasticsearch/data is empty. however, when i run \_cat/indices it displays the indices Can you advis…

---

## [Getting The Request for this panel failed in Visual Builder](https://discuss.elastic.co/t/getting-the-request-for-this-panel-failed-in-visual-builder/249003)

<div class="topic-metadata">

**Author:** [@Bgrayeski](https://discuss.elastic.co/u/Bgrayeski)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 8:59pm UTC](https://discuss.elastic.co/t/getting-the-request-for-this-panel-failed-in-visual-builder/249003 "2020-09-24T20:59:26Z")

</div>

Hi, I'm using Kibana 7.0 with PeopleSoft Elastic Search indexes. When I try to use the Visual Builder, I receive a message that "The request for this panel failed". I've seen references to security related to this err…

---

## [Errors using query inside sub-expression](https://discuss.elastic.co/t/errors-using-query-inside-sub-expression/249265)

<div class="topic-metadata">

**Author:** [@devbot](https://discuss.elastic.co/u/devbot)\
**Replies:** 2\
**Last updated:** [September 24, 2020, 8:55pm UTC](https://discuss.elastic.co/t/errors-using-query-inside-sub-expression/249265 "2020-09-24T20:55:54Z")

</div>

I'm on Kibana 7.4 I'm trying to understand how to use queries inside sub-expressions. In canvas I have a markdown element that works perfectly fine with: filters group="default" | essql query="select SUM…

---

## [Watcher Troubleshooting](https://discuss.elastic.co/t/watcher-troubleshooting/247587)

<div class="topic-metadata">

**Author:** [@vvwood](https://discuss.elastic.co/u/vvwood)\
**Replies:** 4\
**Last updated:** [September 24, 2020, 8:37pm UTC](https://discuss.elastic.co/t/watcher-troubleshooting/247587 "2020-09-24T20:37:38Z")

</div>

Greetings all, For this post, I am seeking advice on how to go about troubleshooting watcher configurations. I have 2 different use cases that I am seeking to use watcher for and so far I have run in to a few challenges…

---

## [Targeting Field Content](https://discuss.elastic.co/t/targeting-field-content/249543)

<div class="topic-metadata">

**Author:** [@teej](https://discuss.elastic.co/u/teej)\
**Replies:** 16\
**Last updated:** [September 24, 2020, 8:10pm UTC](https://discuss.elastic.co/t/targeting-field-content/249543 "2020-09-24T20:10:42Z")

</div>

Hi, I am trying to get grok to target certain fields and extract the content that follows. For example: \<c\_port\>3186\</c\_port\> I want to find c\_port and extract the number that follows, in this case 3186. I have tried …

---

## [Exclude weekends from Visual Builder Moving Average visualization](https://discuss.elastic.co/t/exclude-weekends-from-visual-builder-moving-average-visualization/249327)

<div class="topic-metadata">

**Author:** [@Rizin\_Hussain](https://discuss.elastic.co/u/Rizin_Hussain)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 7:19pm UTC](https://discuss.elastic.co/t/exclude-weekends-from-visual-builder-moving-average-visualization/249327 "2020-09-24T19:19:05Z")

</div>

Hi, New to Kibana and Elasticsearch, and need some help. We have files list document that are mainly created during the week, and neither very small number of files list or zero on the weekend. We are building a movin…

---

## [How to view ES cluster CPU load?](https://discuss.elastic.co/t/how-to-view-es-cluster-cpu-load/249685)

<div class="topic-metadata">

**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\
**Replies:** 3\
**Last updated:** [September 24, 2020, 7:14pm UTC](https://discuss.elastic.co/t/how-to-view-es-cluster-cpu-load/249685 "2020-09-24T19:14:39Z")

</div>

Hi, is there a curl command I can run to pull the CPU load from each server in my ES cluster?

---

## [Kibana \> Visualize \> Data Table \> Metric Count \> How to set Range for the Counted value?](https://discuss.elastic.co/t/kibana-visualize-data-table-metric-count-how-to-set-range-for-the-counted-value/249597)

<div class="topic-metadata">

**Author:** [@Andreasau](https://discuss.elastic.co/u/Andreasau)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 7:10pm UTC](https://discuss.elastic.co/t/kibana-visualize-data-table-metric-count-how-to-set-range-for-the-counted-value/249597 "2020-09-24T19:10:13Z")

</div>

Good day All, Can anyone kindly teach me how to set Range for the Counted value in the Data Table (Visualize)? Real situation: I created a Table which shown the stock level for each product in each shop location, I w…

---

## [Hide Management app in Home app (Kibana 7.9.1)](https://discuss.elastic.co/t/hide-management-app-in-home-app-kibana-7-9-1/249861)

<div class="topic-metadata">

**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Replies:** 2\
**Last updated:** [September 24, 2020, 6:52pm UTC](https://discuss.elastic.co/t/hide-management-app-in-home-app-kibana-7-9-1/249861 "2020-09-24T18:52:24Z")

</div>

Hi, Note: I am using ELK 7.9.1 I am trying to grant users the "minimum access required" to do their job and at the same time I am trying to maximize security all I can. I'm aware that system role kibana\_dashboard\_only\_…

---

## [Disk utilization dashboard for all server](https://discuss.elastic.co/t/disk-utilization-dashboard-for-all-server/249192)

<div class="topic-metadata">

**Author:** [@pankaj0172](https://discuss.elastic.co/u/pankaj0172)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 6:49pm UTC](https://discuss.elastic.co/t/disk-utilization-dashboard-for-all-server/249192 "2020-09-24T18:49:24Z")

</div>

Hi, Can anyone help me to create disk utilization dashboard for all servers like Top host Memory & Cpu System Metric? I tried but not able to figure it out this?

---

## [Download Dashboards without access to management page](https://discuss.elastic.co/t/download-dashboards-without-access-to-management-page/249056)

<div class="topic-metadata">

**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Replies:** 2\
**Last updated:** [September 24, 2020, 6:42pm UTC](https://discuss.elastic.co/t/download-dashboards-without-access-to-management-page/249056 "2020-09-24T18:42:51Z")

</div>

Hello, Is it possible to download the generated dashboard reports anywhere other then the management page? Or is it possible to make the notification about a completed report stay visible until a user explicitly closes…

---

## [Searching for %](https://discuss.elastic.co/t/searching-for/249254)

<div class="topic-metadata">

**Author:** [@Ozberk\_Akbas](https://discuss.elastic.co/u/Ozberk_Akbas)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 6:26pm UTC](https://discuss.elastic.co/t/searching-for/249254 "2020-09-24T18:26:01Z")

</div>

Hello people; For detecting sql injections on our decoy server, we need to search a parameter like '1'='1 but this entry from the url will be encoded as ACSII url characters. So we need to search % with a query. How ca…

---

## [Link Controls with Datatable](https://discuss.elastic.co/t/link-controls-with-datatable/249816)

<div class="topic-metadata">

**Author:** [@salunkerahul](https://discuss.elastic.co/u/salunkerahul)\
**Replies:** 2\
**Last updated:** [September 24, 2020, 6:10pm UTC](https://discuss.elastic.co/t/link-controls-with-datatable/249816 "2020-09-24T18:10:41Z")

</div>

Hi I'm using Kibana 7.4.2 and on my dashboard I'd like to have a Drop down(controls) and a data table associated to an index I've created the following visualizations: Dropdowns(controls) and a Datatable What I'm st…

---

## [Kibana data table need to have additional column to display ratio](https://discuss.elastic.co/t/kibana-data-table-need-to-have-additional-column-to-display-ratio/249389)

<div class="topic-metadata">

**Author:** [@geekganesh](https://discuss.elastic.co/u/geekganesh)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 5:58pm UTC](https://discuss.elastic.co/t/kibana-data-table-need-to-have-additional-column-to-display-ratio/249389 "2020-09-24T17:58:47Z")

</div>

In Kibana data table, i have two columns which is an aggregation of two fields. Say sum of task-started and sum of task-completed. I need to have a third column which is a ratio of two aggregated columns. How to achieve …

---

## [Elasticsearch will not start "error loading whitelist(s)"](https://discuss.elastic.co/t/elasticsearch-will-not-start-error-loading-whitelist-s/245314)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 20\
**Last updated:** [September 24, 2020, 5:58pm UTC](https://discuss.elastic.co/t/elasticsearch-will-not-start-error-loading-whitelist-s/245314 "2020-09-24T17:58:15Z")

</div>

My cluster ran low on space and ended up red due to unallocated shards. After cleaning out some data and doing my best to get the shards all allocated again, I tried restarting the node with the most disk space. Now it …

---

## [Sentiment Analysis in ELK cloud](https://discuss.elastic.co/t/sentiment-analysis-in-elk-cloud/249860)

<div class="topic-metadata">

**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 5:36pm UTC](https://discuss.elastic.co/t/sentiment-analysis-in-elk-cloud/249860 "2020-09-24T17:36:13Z")

</div>

Hi team, I have a trial version of the Platinum plan in Elastic Cloud. I have chosen the Platinum plan because of the Machine Learning platform. I am trying to use the ELK solution in order to do a text analytics on su…

---

## [HTML in markdown in kibana canvas](https://discuss.elastic.co/t/html-in-markdown-in-kibana-canvas/249036)

<div class="topic-metadata">

**Author:** [@igal.gluh](https://discuss.elastic.co/u/igal.gluh)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 5:14pm UTC](https://discuss.elastic.co/t/html-in-markdown-in-kibana-canvas/249036 "2020-09-24T17:14:51Z")

</div>

Hi , can we use plain HTML in markdown in kibana canvas ?

---

## [How to import GeoJSON into elastic search and Filter using a polygon](https://discuss.elastic.co/t/how-to-import-geojson-into-elastic-search-and-filter-using-a-polygon/249752)

<div class="topic-metadata">

**Author:** [@Surag\_MT](https://discuss.elastic.co/u/Surag_MT)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 5:13pm UTC](https://discuss.elastic.co/t/how-to-import-geojson-into-elastic-search-and-filter-using-a-polygon/249752 "2020-09-24T17:13:58Z")

</div>

I want to import a collection of linestrings from GeoJSON into elastic search. The number of features that I want to import will be in the range of millions. I am planning to show these features using Mapbox GL by query…

---

## [Disable ml mode snapshot annotations](https://discuss.elastic.co/t/disable-ml-mode-snapshot-annotations/249842)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 3\
**Last updated:** [September 24, 2020, 5:09pm UTC](https://discuss.elastic.co/t/disable-ml-mode-snapshot-annotations/249842 "2020-09-24T17:09:55Z")

</div>

Hello, The ML snapshot annotations are really annoying.. For example: We don't really care about when a snapshot has been taken.. 2 points: Can we disable the snapshot annotations in ML explorer and series? Curren…

---

## [Export CVS](https://discuss.elastic.co/t/export-cvs/248720)

<div class="topic-metadata">

**Author:** [@Anex](https://discuss.elastic.co/u/Anex)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 4:56pm UTC](https://discuss.elastic.co/t/export-cvs/248720 "2020-09-24T16:56:44Z")

</div>

Buenas tardes, Tengo problemas con la exportación de datos a cvs en kibana según la documentación debería salirme una opción dentro de share para exportar a cvs pero en la imagen que comparto se tiene otras opciones,…

---

## [Winlogbeat doesnt send windows defender events](https://discuss.elastic.co/t/winlogbeat-doesnt-send-windows-defender-events/249689)

<div class="topic-metadata">

**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\
**Replies:** 2\
**Last updated:** [September 24, 2020, 4:54pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-send-windows-defender-events/249689 "2020-09-24T16:54:40Z")

</div>

is there any way I can ship windows defender even to Elasticsearch ? I cannot see any Windows defender related events in Elasticsearch. Can anyone help me on this ?

---

## [Kibana 7.9 out of memory messages for various visualizations](https://discuss.elastic.co/t/kibana-7-9-out-of-memory-messages-for-various-visualizations/249832)

<div class="topic-metadata">

**Author:** [@Rhonda\_Gregory](https://discuss.elastic.co/u/Rhonda_Gregory)\
**Replies:** 1\
**Last updated:** [September 24, 2020, 4:32pm UTC](https://discuss.elastic.co/t/kibana-7-9-out-of-memory-messages-for-various-visualizations/249832 "2020-09-24T16:32:06Z")

</div>

We were running 7.6.2 and upgraded both elasticsearch and kibana to 7.9.0. When looking at various visualizations we get out of memory errors in Chrome and abort in Firefox. One viz is a date histogram at 1 minute int…

---

## [Watcher Enabling in ES configuration](https://discuss.elastic.co/t/watcher-enabling-in-es-configuration/249672)

<div class="topic-metadata">

**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\
**Replies:** 6\
**Last updated:** [September 24, 2020, 4:19pm UTC](https://discuss.elastic.co/t/watcher-enabling-in-es-configuration/249672 "2020-09-24T16:19:50Z")

</div>

HI Team, I want to configure watcher in my ES 6.4 version. Before that i have few question and i need answer for it and really appreciate if i can able to rectify my questions. 1. I have 3 master and 3 data node,do i …

---

## [Improper behaviour of Logstash kv filter](https://discuss.elastic.co/t/improper-behaviour-of-logstash-kv-filter/249791)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 4\
**Last updated:** [September 24, 2020, 4:06pm UTC](https://discuss.elastic.co/t/improper-behaviour-of-logstash-kv-filter/249791 "2020-09-24T16:06:33Z")

</div>

filter { if \[type\] == "rsyslog" { if \[message\] { kv { source =\> "message" field\_split =\> "," prefix =\> "syslog\_" transform\_key =\> "lowercase" } } } } { "\_index": "client\_syslog-2020.09.24", "\_type": "\_doc", "\_id":…

---

## [Filebeat to Logstash split message log to different tables](https://discuss.elastic.co/t/filebeat-to-logstash-split-message-log-to-different-tables/249840)

<div class="topic-metadata">

**Author:** [@cedrikson](https://discuss.elastic.co/u/cedrikson)\
**Replies:** 0\
**Last updated:** [September 24, 2020, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-split-message-log-to-different-tables/249840 "2020-09-24T14:55:54Z")

</div>

Hello guys! Please can someone help me..... I look for a solution that i get my filebeat logs in a perfekt readable log..... This is how my log look like....but i like different columns (Ip,User) here everything stand…

---

## [Multiline json over TCP is not parsed](https://discuss.elastic.co/t/multiline-json-over-tcp-is-not-parsed/249438)

<div class="topic-metadata">

**Author:** [@cristi.mitroi](https://discuss.elastic.co/u/cristi.mitroi)\
**Replies:** 7\
**Last updated:** [September 24, 2020, 2:56pm UTC](https://discuss.elastic.co/t/multiline-json-over-tcp-is-not-parsed/249438 "2020-09-24T14:56:40Z")

</div>

I have the following multiline json: " {"businessId":"335","technicId":"41180883","teller":"progr\_1 ","pid":"0024444930","timestamp":"16:03:31.0664","sursa":"test.mbv","nr\_linie":"391","mesaj":"MESSAGE PUT TIME IS 16…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1785)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1787)
