# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1788 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1789 --- ## [Measuring planned downtime of a service](https://discuss.elastic.co/t/measuring-planned-downtime-of-a-service/249696)
**Author:** [@josaku](https://discuss.elastic.co/u/josaku)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 8:33am UTC](https://discuss.elastic.co/t/measuring-planned-downtime-of-a-service/249696 "2020-09-24T08:33:05Z")
Greetings :slight\_smile: We use Kibana 7.8 to measure the uptime of a windows service. We can calculate the percentage as well as the number of hours a windows service has been up or down. But when such a service is shu… --- ## [Thread pool size and the cluster settings API](https://discuss.elastic.co/t/thread-pool-size-and-the-cluster-settings-api/249741)
**Author:** [@Pradyumna\_Achar](https://discuss.elastic.co/u/Pradyumna_Achar)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 8:32am UTC](https://discuss.elastic.co/t/thread-pool-size-and-the-cluster-settings-api/249741 "2020-09-24T08:32:37Z")
Hello, I am a bit confused on the cluster settings API. The thread pool settings seem to be specific to a node. For example, in the same cluster, some nodes have 1 CPU and some have 5 CPUs. When I run the \_cluster/sett… --- ## [Problem with scripted field kibana when check doc\['message.keyword'\] empty](https://discuss.elastic.co/t/problem-with-scripted-field-kibana-when-check-doc-message-keyword-empty/249085)
**Author:** [@le\_ba\_nam](https://discuss.elastic.co/u/le_ba_nam)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 8:26am UTC](https://discuss.elastic.co/t/problem-with-scripted-field-kibana-when-check-doc-message-keyword-empty/249085 "2020-09-24T08:26:31Z")
I want to check doc\['message.keyword'\] message field whether is exist or empty, so I use this statement : if(doc\['message.keyword'\].empty ) { return "unavailable"; } else { return "available"; } (this statement… --- ## [Kibana v7.9.1 export to csv with '/n' in log only give first line](https://discuss.elastic.co/t/kibana-v7-9-1-export-to-csv-with-n-in-log-only-give-first-line/249757)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 8:03am UTC](https://discuss.elastic.co/t/kibana-v7-9-1-export-to-csv-with-n-in-log-only-give-first-line/249757 "2020-09-24T08:03:03Z")
Hi kibana only export the fist line of a multiline logline. How can I change it to include all lines. I find this strange because other files this work fine, but just not my ldap logs. Thanks MortenB, Oslo Norway --- ## [Kibana stuck in loading screen](https://discuss.elastic.co/t/kibana-stuck-in-loading-screen/249499)
**Author:** [@radragar](https://discuss.elastic.co/u/radragar)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 7:33am UTC](https://discuss.elastic.co/t/kibana-stuck-in-loading-screen/249499 "2020-09-24T07:33:45Z")
Hello, I'm just starting using ELK. I have done installed elasticsearch and no error but when I install Kibana I get stuck in loading screen here is the kibana log: ./kibana log \[10:15:10.023\] \[warning\]\[plugins-… --- ## [High latency queries appear every 20 minutes](https://discuss.elastic.co/t/high-latency-queries-appear-every-20-minutes/249095)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 6:57am UTC](https://discuss.elastic.co/t/high-latency-queries-appear-every-20-minutes/249095 "2020-09-24T06:57:29Z")
ES performance reliablity issue After I fix the issue above, I find another strange issue. The process of our es query is: \[user application\] -\> \[nginx load balance\] -\> \[ coordinating nodes\] -\> \[data nodes\] The sear… --- ## [Logstash service problem](https://discuss.elastic.co/t/logstash-service-problem/249746)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 6:50am UTC](https://discuss.elastic.co/t/logstash-service-problem/249746 "2020-09-24T06:50:57Z")
Hey everyone! I'm struggling with logstash running as a service. I have a couple of config files in /etc/logstash/conf.d/ and when I run my config by running this bin/logstash -f /etc/logstash/conf.d/my.conf --path.sett… --- ## [Elasticsearch support for ceph storage?](https://discuss.elastic.co/t/elasticsearch-support-for-ceph-storage/249740)
**Author:** [@sarthaksahu](https://discuss.elastic.co/u/sarthaksahu)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 6:37am UTC](https://discuss.elastic.co/t/elasticsearch-support-for-ceph-storage/249740 "2020-09-24T06:37:47Z")
I do saw a blog discussing about support of ceph storage. But the information a year old. Can you please confirm is ceph storage support in ES 7.8.0. --- ## [Merging documents based on matched fields values](https://discuss.elastic.co/t/merging-documents-based-on-matched-fields-values/249728)
**Author:** [@abregman](https://discuss.elastic.co/u/abregman)\ **Replies:** 1\ **Last updated:** [September 24, 2020, 6:24am UTC](https://discuss.elastic.co/t/merging-documents-based-on-matched-fields-values/249728 "2020-09-24T06:24:17Z")
I'll start by saying that I'm not sure what I need is actually to merge documents, it's simply the most suitable subject I've found. Every document created in my environment today has the following fields: job\_name and … --- ## [Watcher, Transform UTC timestamp on the payload to local time](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/249724)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [September 24, 2020, 6:08am UTC](https://discuss.elastic.co/t/watcher-transform-utc-timestamp-on-the-payload-to-local-time/249724 "2020-09-24T06:08:08Z")
In the payload of a watcher I have the timestamp field "@timestamp" : "2020-09-23T23:11:24.359Z", But this field is in UTC, and I want to change it to local time, I have tried the folowing "actions": { "send\_ema… --- ## [Elasticsearch through 400 bad request error](https://discuss.elastic.co/t/elasticsearch-through-400-bad-request-error/249735)
**Author:** [@Aniket\_Salvi](https://discuss.elastic.co/u/Aniket_Salvi)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 6:01am UTC](https://discuss.elastic.co/t/elasticsearch-through-400-bad-request-error/249735 "2020-09-24T06:01:12Z")
Hi, I am getting 400 bad request for some JSON data when I pushed 700 JSON in Elasticsearch from ACE queue. But I am able to push same JSON data through curl command. REST API POST http://xx.xx.xx.xx:xxxx/index-name… --- ## [Unable to authenticate user for REST request](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/249118)
**Author:** [@bhavikdhoot](https://discuss.elastic.co/u/bhavikdhoot)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 5:56am UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/249118 "2020-09-24T05:56:15Z")
Hi, I'm trying to connect to Elasticsearch through FileBeats using the following config in my filebeat.yml. output.elasticsearch: Array of hosts to connect to. #hosts: \["localhost:9200"\] hosts: \["server1:9600","serve… --- ## [What is system requirement for elasticsearch (elk setup)](https://discuss.elastic.co/t/what-is-system-requirement-for-elasticsearch-elk-setup/248807)
**Author:** [@aspat](https://discuss.elastic.co/u/aspat)\ **Replies:** 4\ **Last updated:** [September 24, 2020, 5:33am UTC](https://discuss.elastic.co/t/what-is-system-requirement-for-elasticsearch-elk-setup/248807 "2020-09-24T05:33:12Z")
Hello, I am new to ELK. I have to provide architectural solution for archival system in our project. How our current system is, We have a service/software which generate site data(Oil industry data), this data is ins… --- ## [Circuit Breaker in Visualization](https://discuss.elastic.co/t/circuit-breaker-in-visualization/249307)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 6\ **Last updated:** [September 24, 2020, 4:53am UTC](https://discuss.elastic.co/t/circuit-breaker-in-visualization/249307 "2020-09-24T04:53:03Z")
i want to get a visualization table, but i get a error and this response. reason": { "type": "circuit\_breaking\_exception", "reason": "\[parent\] Data too large, data for \[\\] would be \[66133455312/61.5gb\], which… --- ## [Can't start elasticsearch. please help](https://discuss.elastic.co/t/cant-start-elasticsearch-please-help/249720)
**Author:** [@Tomz](https://discuss.elastic.co/u/Tomz)\ **Replies:** 16\ **Last updated:** [September 24, 2020, 3:56am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-please-help/249720 "2020-09-24T03:56:45Z")
when I try run "sudo systemctl start elasticsearch" show me Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xe" for … --- ## [Unable to start kibana in a cluster](https://discuss.elastic.co/t/unable-to-start-kibana-in-a-cluster/249245)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 5\ **Last updated:** [September 24, 2020, 3:54am UTC](https://discuss.elastic.co/t/unable-to-start-kibana-in-a-cluster/249245 "2020-09-24T03:54:21Z")
Hi All, I have installed elasticsearch version 7.6.4 have installed and configured all the settings and started elasticsearch service and was able to start the service, i have verified it by logging in to console also … --- ## [Document timestamp field 7.8](https://discuss.elastic.co/t/document-timestamp-field-7-8/249732)
**Author:** [@Dotnetrockstar](https://discuss.elastic.co/u/Dotnetrockstar)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 3:24am UTC](https://discuss.elastic.co/t/document-timestamp-field-7-8/249732 "2020-09-24T03:24:44Z")
Is it possible to add a timestamp field to each document when created or last updated? Elastic version 7.8. I need to know last time document was updated. --- ## [Adding iframe (grafana) into Kibana](https://discuss.elastic.co/t/adding-iframe-grafana-into-kibana/249160)
**Author:** [@asharm60](https://discuss.elastic.co/u/asharm60)\ **Replies:** 2\ **Last updated:** [September 24, 2020, 2:57am UTC](https://discuss.elastic.co/t/adding-iframe-grafana-into-kibana/249160 "2020-09-24T02:57:35Z")
How to do embedding (grafana view) into kibana ? Is there any way to do this ? --- ## [How to normalize similarity score using 'more\_like\_this'](https://discuss.elastic.co/t/how-to-normalize-similarity-score-using-more-like-this/249721)
**Author:** [@Sangmin\_Lee](https://discuss.elastic.co/u/Sangmin_Lee)\ **Replies:** 0\ **Last updated:** [September 24, 2020, 12:54am UTC](https://discuss.elastic.co/t/how-to-normalize-similarity-score-using-more-like-this/249721 "2020-09-24T00:54:11Z")
Hi. I'm using 'more like this' to get the similarity of the given text. As you know, the score is not normalized. I want to get a normalized value \[0, 1\] so that I can cut out documents below the threshold score. I t… --- ## [Manually move replica shard to another node](https://discuss.elastic.co/t/manually-move-replica-shard-to-another-node/249554)
**Author:** [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Replies:** 6\ **Last updated:** [September 23, 2020, 5:08pm UTC](https://discuss.elastic.co/t/manually-move-replica-shard-to-another-node/249554 "2020-09-23T17:08:51Z")
I have an unassigned replica shard that I need to assign to a node but the only node available that has "room" already has the same primary shard assigned to it. My setup: 4 node cluster with 1 replica. I only have an i… --- ## [PR curve in kibana from softmax](https://discuss.elastic.co/t/pr-curve-in-kibana-from-softmax/249646)
**Author:** [@Doron\_Har\_Noy](https://discuss.elastic.co/u/Doron_Har_Noy)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 10:39pm UTC](https://discuss.elastic.co/t/pr-curve-in-kibana-from-softmax/249646 "2020-09-23T22:39:16Z")
Hi all, I'm trying to create a pr curve or ROC curve from my data. (https://en.wikipedia.org/wiki/Receiver\_operating\_characteristic, https://machinelearningmastery.com/roc-curves-and-precision-recall-curves-for-imbalan… --- ## [Automated Archival of data in indices](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707)
**Author:** [@ted1621](https://discuss.elastic.co/u/ted1621)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 10:10pm UTC](https://discuss.elastic.co/t/automated-archival-of-data-in-indices/249707 "2020-09-23T22:10:21Z")
Can anyone provide instructions on how I would set up a automated task to archive and move to cold storage any data in my indices that is over 45 days old. Also in regards to indices that are no longer receiving data st… --- ## [Invalid Certificate Errors when setting up SSL/HTTPS for Elasticsearch in Docker](https://discuss.elastic.co/t/invalid-certificate-errors-when-setting-up-ssl-https-for-elasticsearch-in-docker/249713)
**Author:** [@encompassJeff](https://discuss.elastic.co/u/encompassJeff)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 9:45pm UTC](https://discuss.elastic.co/t/invalid-certificate-errors-when-setting-up-ssl-https-for-elasticsearch-in-docker/249713 "2020-09-23T21:45:00Z")
Hi there! Some basic background: My client has recently requested that we transition to using ELK stack to power our search and metrics. We are running Laravel 5.8/PHP 7.3 on the backend (feeding a ReactJS front-end via… --- ## [Compare Dates in Logstash Pipeline](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 9:51pm UTC](https://discuss.elastic.co/t/compare-dates-in-logstash-pipeline/247415 "2020-09-23T21:51:17Z")
I have created a data field during the pipeline and I am trying to find a way to compare that field to see if it is 30 days old or newer. I am not sure how to do about it however. This is the code I have for creating th… --- ## [Only query new documents from Elasticsearch index](https://discuss.elastic.co/t/only-query-new-documents-from-elasticsearch-index/249703)
**Author:** [@mussa572](https://discuss.elastic.co/u/mussa572)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 9:49pm UTC](https://discuss.elastic.co/t/only-query-new-documents-from-elasticsearch-index/249703 "2020-09-23T21:49:46Z")
I am writing a python program which will query elasticsearch index . I am using a match all query in the while loop which looks for the new documents . First problem is that I always get all the documents every time I q… --- ## [Performance when inserting/deleting many documents](https://discuss.elastic.co/t/performance-when-inserting-deleting-many-documents/249676)
**Author:** [@Roman\_Kagan](https://discuss.elastic.co/u/Roman_Kagan)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 9:47pm UTC](https://discuss.elastic.co/t/performance-when-inserting-deleting-many-documents/249676 "2020-09-23T21:47:36Z")
Hello: We have a very old Elastic 2.2.0 instance running in production that contains approximately 26 million documents. We also insert 230k (yes - thousands) of documents a week and mark for deletion 30k documents a … --- ## [Number of hours in an interval of date](https://discuss.elastic.co/t/number-of-hours-in-an-interval-of-date/249683)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 4:11pm UTC](https://discuss.elastic.co/t/number-of-hours-in-an-interval-of-date/249683 "2020-09-23T16:11:03Z")
Hi guys , i want to create it a scripted field where i count the number of hours in an interval of date when the sum of the number of transactions is below a certain value, my fields are : nbre\_of\_transaction , date an… --- ## [Unable to create visualization from command prompt in Kibana 6.8](https://discuss.elastic.co/t/unable-to-create-visualization-from-command-prompt-in-kibana-6-8/249706)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 8:37pm UTC](https://discuss.elastic.co/t/unable-to-create-visualization-from-command-prompt-in-kibana-6-8/249706 "2020-09-23T20:37:26Z")
Hi Team, I am unable to create visualization from command using curl in ELK 6.8. I have a working solution which I followed from the below link and it is working in ELK5. As per the solution shared, it is going to w… --- ## [SNMP/MIBs issue error: no such instance currently exists at this OID](https://discuss.elastic.co/t/snmp-mibs-issue-error-no-such-instance-currently-exists-at-this-oid/249700)
**Author:** [@ShermSherm51](https://discuss.elastic.co/u/ShermSherm51)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 7:37pm UTC](https://discuss.elastic.co/t/snmp-mibs-issue-error-no-such-instance-currently-exists-at-this-oid/249700 "2020-09-23T19:37:41Z")
I'm getting logstash errors: no such instance currently exists at this OID Sep 23 15:30:04 \ logstash\[27639\]: "iso.org.dod.internet.private.enterprises.purestorage.pureObjects.pureProductVersion… --- ## [Fliebeats + apache files](https://discuss.elastic.co/t/fliebeats-apache-files/249583)
**Author:** [@vsekvsek](https://discuss.elastic.co/u/vsekvsek)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 8:18pm UTC](https://discuss.elastic.co/t/fliebeats-apache-files/249583 "2020-09-23T20:18:00Z")
I am trying to load some local log files into filebeat and get this error. .\\filebeat.exe setup -e 2020-09-22T13:28:52.813-0700 ERROR \[esclientleg\] eslegclient/connection.go:261 error connecting to Elasticsear… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1787) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1789)