# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1794 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1795 --- ## [Pipeline Delay 7.9](https://discuss.elastic.co/t/pipeline-delay-7-9/249148)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 10\ **Last updated:** [September 21, 2020, 5:44pm UTC](https://discuss.elastic.co/t/pipeline-delay-7-9/249148 "2020-09-21T17:44:51Z")
Hello everyone, I have such work bench: 3 nodes of Elastic 1 node of Logstash 1 node of Kibana 1 Winlogbeat agent The Winlogbeat agent ships logs from the Windows machine, that collecting logs from all of my company… --- ## [Winlogbeat 7.9 pipeline delay](https://discuss.elastic.co/t/winlogbeat-7-9-pipeline-delay/249405)
**Author:** [@AleksandrN](https://discuss.elastic.co/u/AleksandrN)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 6:12pm UTC](https://discuss.elastic.co/t/winlogbeat-7-9-pipeline-delay/249405 "2020-09-21T18:12:15Z")
Hello everyone! I have a delay for docs going throught my pipeline and asked about it here https://discuss.elastic.co/t/pipeline-delay-7-9/249148 In conclusion, it turns out that the most suspiciouse point of a pipelin… --- ## [How to install ELK in a raspberry PI](https://discuss.elastic.co/t/how-to-install-elk-in-a-raspberry-pi/249281)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-install-elk-in-a-raspberry-pi/249281 "2020-09-21T18:04:18Z")
Hi Im trying to install ELK in a raspberry PI and i have little success by now. I have installed the package via apt-get install, and the java version is not compatible. I have downgraded java to jre8 and i have problem… --- ## [Master Elasticsearch node on same host as data node?](https://discuss.elastic.co/t/master-elasticsearch-node-on-same-host-as-data-node/249149)
**Author:** [@dshih](https://discuss.elastic.co/u/dshih)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 6:03pm UTC](https://discuss.elastic.co/t/master-elasticsearch-node-on-same-host-as-data-node/249149 "2020-09-21T18:03:11Z")
Is there any benefit to enabling Elasticsearch master nodes if they will run on the same hosts as a data nodes? Background My company ships a product with a hosted (AWS-based) and on-premises offering. For hosted, we … --- ## [How to query for anomalous state changes based on duration](https://discuss.elastic.co/t/how-to-query-for-anomalous-state-changes-based-on-duration/248551)
**Author:** [@ehausig1](https://discuss.elastic.co/u/ehausig1)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 5:44pm UTC](https://discuss.elastic.co/t/how-to-query-for-anomalous-state-changes-based-on-duration/248551 "2020-09-21T17:44:06Z")
I'm trying to determine if there is a way that I can query an Elasticsearch index for a particular data anomaly we sometimes encounter. Here is a contrived example of the dataset (with some annotations): \[ { "\_id… --- ## [How to create a new line on a kibana canvas table](https://discuss.elastic.co/t/how-to-create-a-new-line-on-a-kibana-canvas-table/248179)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 10\ **Last updated:** [September 21, 2020, 5:32pm UTC](https://discuss.elastic.co/t/how-to-create-a-new-line-on-a-kibana-canvas-table/248179 "2020-09-21T17:32:55Z")
Hello, I'm new here, and in kibana. I would like to know if it is possible and how it would be, to put a new line on a table. I made an essql query: essql:SELECT sum(segrelatorio) as value,severidade FROM "databases\*… --- ## [Warning about ambiguous (mutate filter + split)](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881 "2020-09-21T16:33:12Z")
Hi everyone, I have a Log that I read using the file plugin and the multiline codec (so far so good), I separate the columns that I want to get using a mutate and split in the filter, however in the execution of my .con… --- ## [How to match IP address to hostname (dns filter)](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 4:26pm UTC](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988 "2020-09-21T16:26:30Z")
Hi all, I'm trying to match the IP address to hostname. Data is json file and it is originally pcap file. I used dns filter in logstash.conf file. mutate { add\_field =\> { "src\_hostname" =\> "%{\[layers\]\[ip\]\[ip\_ip\_sr… --- ## [Grok Syntax](https://discuss.elastic.co/t/grok-syntax/249372)
**Author:** [@kotis](https://discuss.elastic.co/u/kotis)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 4:13pm UTC](https://discuss.elastic.co/t/grok-syntax/249372 "2020-09-21T16:13:26Z")
Hi all :slight\_smile: , I need help with a log file that I need to make a filter from it but I can't since I am not very experienced with grok.. The log is like 2020-07-27 03:04:04,708 INFO hosty.bow.hh.hsw\_5421 Targ… --- ## [ES-Hadoop compatibility with Spark 2.4.4](https://discuss.elastic.co/t/es-hadoop-compatibility-with-spark-2-4-4/249393)
**Author:** [@Jonas555](https://discuss.elastic.co/u/Jonas555)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 4:08pm UTC](https://discuss.elastic.co/t/es-hadoop-compatibility-with-spark-2-4-4/249393 "2020-09-21T16:08:55Z")
Hello, We have an EMR v5.28 cluster that comes with Spark 2.4.4. Our understanding is that Elasticsearch-Hadoop is not compatible with Spark 2.4.4 since Spark is compiled with Scala 2.12, and ES-Hadoop requires Scala 2.… --- ## [Update values by curl cmd](https://discuss.elastic.co/t/update-values-by-curl-cmd/249386)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 3:59pm UTC](https://discuss.elastic.co/t/update-values-by-curl-cmd/249386 "2020-09-21T15:59:18Z")
Hello ! Can I update the "instanceof" values by there equivalents labels ( municipalities and cities of Serbia == Q783930 ) by curl API ? Thanks :slight\_smile: returned answer sample: { "\_index" : "enwiki\_latest", … --- ## [Multiple logs are concatenated to single event by Logstash](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947)
**Author:** [@Khushboo\_Kumari](https://discuss.elastic.co/u/Khushboo_Kumari)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 3:44pm UTC](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947 "2020-09-21T15:44:20Z")
Hi all, I am using Filebeat to send Multiline logs to Logstash , Filebeat input is a file ( logs.txt), In case multiple events are published to (Logs.txt ) in a millisecond, they all are added as 1 log event to ES. Ple… --- ## [Big logs files with TFS elasticsearch](https://discuss.elastic.co/t/big-logs-files-with-tfs-elasticsearch/248806)
**Author:** [@Freud](https://discuss.elastic.co/u/Freud)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 2:54pm UTC](https://discuss.elastic.co/t/big-logs-files-with-tfs-elasticsearch/248806 "2020-09-21T14:54:55Z")
Hi, We have a TFS 2018 and since a few days elasticsearch create 5Go logs file every days. I don't know what is the matter with it. The log contain 2 type of WARN "cluster.action.shard" and "indices.cluster" Can some… --- ## [Call Kibana with data](https://discuss.elastic.co/t/call-kibana-with-data/248841)
**Author:** [@sonnenteich](https://discuss.elastic.co/u/sonnenteich)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 2:51pm UTC](https://discuss.elastic.co/t/call-kibana-with-data/248841 "2020-09-21T14:51:04Z")
Hello, I am pretty new to elastic, so maybe this is a dummy question. I query my elastic with an external app and I want to show the one selected result or all queried results in Kibana. Is there away to call Kibana wi… --- ## [Not getting proper response from API](https://discuss.elastic.co/t/not-getting-proper-response-from-api/248758)
**Author:** [@chenna123](https://discuss.elastic.co/u/chenna123)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:27pm UTC](https://discuss.elastic.co/t/not-getting-proper-response-from-api/248758 "2020-09-21T14:27:38Z")
Hi, I'm facing an issue with API, following these below line to invoke API from Powershell and expecting json response but I'm getting HTML response instead. API - http://xxxxxxxxx/api/saved\_objects/\_find?type=dashboar… --- ## [Set aggregation and how to visualize in Kibana](https://discuss.elastic.co/t/set-aggregation-and-how-to-visualize-in-kibana/248928)
**Author:** [@onTop](https://discuss.elastic.co/u/onTop)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:24pm UTC](https://discuss.elastic.co/t/set-aggregation-and-how-to-visualize-in-kibana/248928 "2020-09-21T14:24:46Z")
Hi, I have a unique requirement. Let's say I have 2 fields in my document. Build Version Defects If X and Y are 2 build versions, I want to visualize defects that are common to X and Y and defects that are unique to … --- ## [How to add two new fields to a document](https://discuss.elastic.co/t/how-to-add-two-new-fields-to-a-document/249259)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 2:16pm UTC](https://discuss.elastic.co/t/how-to-add-two-new-fields-to-a-document/249259 "2020-09-21T14:16:37Z")
Hi, I'm trying to add two new fields to a document: all2\_business\_index.car, car being an array. The code below throws a null\_pointer\_exception How canI fix this, thank you Blockquote "script\_stack": \[ … --- ## [Customize kibana discover table](https://discuss.elastic.co/t/customize-kibana-discover-table/249129)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 2:08pm UTC](https://discuss.elastic.co/t/customize-kibana-discover-table/249129 "2020-09-21T14:08:28Z")
hi, i want to know if it is possible to have a personalized visualization of the kibana dicover table, with colors or anything else that adds a decoration to be decided or if it is possible to represent data in a custom… --- ## [Multiline config for continuation with empty lines interspersed](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365)
**Author:** [@kornexl](https://discuss.elastic.co/u/kornexl)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 2:03pm UTC](https://discuss.elastic.co/t/multiline-config-for-continuation-with-empty-lines-interspersed/249365 "2020-09-21T14:03:21Z")
I want to use multiline feature for messages in error.log. The error lines to match are mixed with empty lines Error cccccc continuation error line The default multiline pattern ( ^\[\[:space:\]\] ) for this type of cont… --- ## [Log Parsing](https://discuss.elastic.co/t/log-parsing/249255)
**Author:** [@mansa](https://discuss.elastic.co/u/mansa)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 2:04pm UTC](https://discuss.elastic.co/t/log-parsing/249255 "2020-09-21T14:04:08Z")
Actually we have two variety of logs. Syslogs which comes from Linux device ( start with time) Syslog but comes from cisco devices Logs which comes from cisco device start with hostname and logs which comes from linux… --- ## [Precise distinct count](https://discuss.elastic.co/t/precise-distinct-count/249374)
**Author:** [@ion\_utale](https://discuss.elastic.co/u/ion_utale)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 2:02pm UTC](https://discuss.elastic.co/t/precise-distinct-count/249374 "2020-09-21T14:02:29Z")
Hi, i am just frustrated that i am unable to do an distinct count. on 6.8 Cardinality is just an approximation. I have over 20k buckets and cardinaly with precision\_threshold = 40000 is still retuning me wrong value… --- ## [Parsing whole file as a single event](https://discuss.elastic.co/t/parsing-whole-file-as-a-single-event/249317)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:59pm UTC](https://discuss.elastic.co/t/parsing-whole-file-as-a-single-event/249317 "2020-09-21T13:59:57Z")
Hi all, I would like to monitor a directory, where per event a file is written; each event-file consists of several key=value pairs. \> /var/log/dir/history.\* \> head /var/log/dir/history.1234 key1 = value1 key… --- ## [Elasticsearch cluster going down , whenever trying to run query for more than 2 days](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309 "2020-09-21T13:52:20Z")
Hi All, I am new to elasticsearch, so don't much idea about it's performance, but whenever I am trying to run a visualization report for more than 2 days then it is resulting in cluster going down. We have some huge loa… --- ## [Strange behavior of s3 snapshots](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367)
**Author:** [@aros](https://discuss.elastic.co/u/aros)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367 "2020-09-21T13:40:38Z")
Hi, we lately encounters some strange behavoir of our s3 snapshots. We backup indices to wasabi using the s3 repository plugin with several repositories and slm policies registered. Each repository is registered once at… --- ## [Allow vector functions in script fields context](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884)
**Author:** [@Denne](https://discuss.elastic.co/u/Denne)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 1:32pm UTC](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884 "2020-09-21T13:32:30Z")
Hi! I use for a very specific use case script fields for scoring different attributes of documents using custom painless scripts, where the query context is used for filtering non-relevant documents (in the example bel… --- ## [Strange results with lte range comparison for dates in ES 6.5.0](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855)
**Author:** [@Jeremy\_LHEZ](https://discuss.elastic.co/u/Jeremy_LHEZ)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:11pm UTC](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855 "2020-09-21T13:11:48Z")
Hello, I am trying to add a filter to some of my queries to make sure my results are contained in a specific date interval. My complete final query (executed in kibana) looks like this: { "query":{ … --- ## [Installing the SentiNL plugin](https://discuss.elastic.co/t/installing-the-sentinl-plugin/249352)
**Author:** [@kennedy](https://discuss.elastic.co/u/kennedy)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:06pm UTC](https://discuss.elastic.co/t/installing-the-sentinl-plugin/249352 "2020-09-21T13:06:46Z")
Hi there , I'm using a docker-compose file for elasticsearch and kibana service. Its up and working. Now , in Kibana i want to include the sentiNL plugin . Please help me with how that can be done. --- ## [Getting total count based on collapsed value](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358)
**Author:** [@mohanaprakash](https://discuss.elastic.co/u/mohanaprakash)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 12:39pm UTC](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358 "2020-09-21T12:39:22Z")
I am new to elastic search and i am trying to extract total number of concurrent users active in the given period. For example i have a data as below User Login Time Logout Time A 2020-09-21T10:00:00 2020-09-21… --- ## [Alternative lucene query to implement rate() function in elasticsearch](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143)
**Author:** [@Sankpra34](https://discuss.elastic.co/u/Sankpra34)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:59am UTC](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143 "2020-09-21T11:59:45Z")
I need to convert my PromQL query from my Grafana dashboard into Elasticsearch supported Lucene's query. Currently, there is no such function that can be used as rate() function. Is there any way to implement rate() func… --- ## [Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last required field arrived](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252)
**Author:** [@piyalkuet](https://discuss.elastic.co/u/piyalkuet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:53am UTC](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252 "2020-09-21T11:53:58Z")
Dear all, I am facing issues creating a rollup job for big indexes. While saving it gives me a exception "Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last r… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1793) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1795)