# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1807 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1808 --- ## [Change in fuzzy + highlighting behavior between ES6 (6.7.2) and ES7 (7.9.0)](https://discuss.elastic.co/t/change-in-fuzzy-highlighting-behavior-between-es6-6-7-2-and-es7-7-9-0/248581)
**Author:** [@mdunn](https://discuss.elastic.co/u/mdunn)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 9:18pm UTC](https://discuss.elastic.co/t/change-in-fuzzy-highlighting-behavior-between-es6-6-7-2-and-es7-7-9-0/248581 "2020-09-14T21:18:15Z")
We are currently in the process of upgrading from ES6 (6.7.2) to ES7 (7.9.0) and we have noticed a change in behavior with regards to highlighting when fuzzy search is turned on. We are using the unified highlighter as … --- ## [Elastic I/O Optimised Scaling](https://discuss.elastic.co/t/elastic-i-o-optimised-scaling/248361)
**Author:** [@Omair\_Malik](https://discuss.elastic.co/u/Omair_Malik)\ **Replies:** 5\ **Last updated:** [September 14, 2020, 8:03pm UTC](https://discuss.elastic.co/t/elastic-i-o-optimised-scaling/248361 "2020-09-14T20:03:51Z")
Hi All, We currently have the following setup at Elastic: x1 Data Configuration in 3 zones = 3 nodes in total x1 Kabana node x1 APM node Due to shards running low in the coming months, we want to add another node ie … --- ## [Metricbeat - system network - how does it work?](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507)
**Author:** [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 8:46pm UTC](https://discuss.elastic.co/t/metricbeat-system-network-how-does-it-work/248507 "2020-09-14T20:46:02Z")
Hi, In the background of metricbeat once I configure it to collect system.network metrics with period of 15 minutes, what does it do? More specificaly what is exactly the value mentioned in system.network.out.bytes/sys… --- ## [Sorting of number in discover not working](https://discuss.elastic.co/t/sorting-of-number-in-discover-not-working/248544)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 8:19pm UTC](https://discuss.elastic.co/t/sorting-of-number-in-discover-not-working/248544 "2020-09-14T20:19:57Z")
I have number field when I try to sort it out it does not sort. is there some setting I am missing or is it bug I only selected this one field in my discover. do not display the timestamp as I don't want it. but any wa… --- ## [Elasticserach cluster in red state and a lot of unassigned shards](https://discuss.elastic.co/t/elasticserach-cluster-in-red-state-and-a-lot-of-unassigned-shards/248579)
**Author:** [@Sahishnu\_Maharjan](https://discuss.elastic.co/u/Sahishnu_Maharjan)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 8:02pm UTC](https://discuss.elastic.co/t/elasticserach-cluster-in-red-state-and-a-lot-of-unassigned-shards/248579 "2020-09-14T20:02:19Z")
Greetings, I was given a broken graylog cluster to fix. Upon examination, elasticsearch cluster (7 node: 1 master 6 data) was red as its fs was 100%. After clearing older data, I started noticing unassigned shards error.… --- ## [Export specific fields from data](https://discuss.elastic.co/t/export-specific-fields-from-data/248578)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 8:00pm UTC](https://discuss.elastic.co/t/export-specific-fields-from-data/248578 "2020-09-14T20:00:38Z")
Hi All, We need to export specific fields from a particular index. The export can be in any format. Problem is that the size of the index is large and on top of that we need information based on last 30 days. I did s… --- ## [Flip the starting position for Bar Chart](https://discuss.elastic.co/t/flip-the-starting-position-for-bar-chart/248377)
**Author:** [@trojan22](https://discuss.elastic.co/u/trojan22)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 7:49pm UTC](https://discuss.elastic.co/t/flip-the-starting-position-for-bar-chart/248377 "2020-09-14T19:49:10Z")
Hello, I have a simple question. I have created a Horizontal Bar Chart (would apply to vertical chart as well) in Kibana(v7.1.1). By default, the bars start from left and go to right. What I mean is the Y Axis is at th… --- ## [Monitoring\_user role does not work when assigned to AD-based role mapping](https://discuss.elastic.co/t/monitoring-user-role-does-not-work-when-assigned-to-ad-based-role-mapping/248489)
**Author:** [@ahoffskov](https://discuss.elastic.co/u/ahoffskov)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 7:26pm UTC](https://discuss.elastic.co/t/monitoring-user-role-does-not-work-when-assigned-to-ad-based-role-mapping/248489 "2020-09-14T19:26:12Z")
When assigning the monitoring\_user role to a role mapping, where users assigned to the role are based on users from Active Directory, access is denied. The AD Users are also granted the Kibana\_admin role. Using a local … --- ## [Count the number of phrase hits in a specific document](https://discuss.elastic.co/t/count-the-number-of-phrase-hits-in-a-specific-document/248572)
**Author:** [@spyderman4g63](https://discuss.elastic.co/u/spyderman4g63)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 6:23pm UTC](https://discuss.elastic.co/t/count-the-number-of-phrase-hits-in-a-specific-document/248572 "2020-09-14T18:23:33Z")
Is there a way to search for a document by id (\_doc) and then count the number of times a phrase is mentioned? Given the text in a field called 'message': "Bob Smith is a plumber. Bob Smith is also a racecar driver. Bob… --- ## [Winlogbeat API Key Permissions](https://discuss.elastic.co/t/winlogbeat-api-key-permissions/248382)
**Author:** [@Coinology](https://discuss.elastic.co/u/Coinology)\ **Replies:** 4\ **Last updated:** [September 14, 2020, 6:53pm UTC](https://discuss.elastic.co/t/winlogbeat-api-key-permissions/248382 "2020-09-14T18:53:04Z")
All, I'm hoping someone can help. I used to output data from Winlogbeat to Logstash and index from there, everything worked fine. With 7.9 I attempted to use Elasticsearch output and received the below: WARN \[elasticse… --- ## [Cisco asa module Drop events - help required](https://discuss.elastic.co/t/cisco-asa-module-drop-events-help-required/248442)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 6:39pm UTC](https://discuss.elastic.co/t/cisco-asa-module-drop-events-help-required/248442 "2020-09-14T18:39:02Z")
Hi Team , We are currently using Cisco asa module for capturing firewall logs. Is there any option in Cisco asa module to capture only logs with specific severity (eg: log.level: informational) and drop all other events… --- ## [ES output in Logstash](https://discuss.elastic.co/t/es-output-in-logstash/248390)
**Author:** [@pvaithee07](https://discuss.elastic.co/u/pvaithee07)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 6:36pm UTC](https://discuss.elastic.co/t/es-output-in-logstash/248390 "2020-09-14T18:36:31Z")
Hello All - I have a requirement where i have to send my data to ES index using the ES output plugin from Logstash. If the write to ES Index is successful, i need to write a log (in another ES index) that the record ins… --- ## [Unable to export more than 10k url saved objects](https://discuss.elastic.co/t/unable-to-export-more-than-10k-url-saved-objects/248565)
**Author:** [@chakragod](https://discuss.elastic.co/u/chakragod)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 6:08pm UTC](https://discuss.elastic.co/t/unable-to-export-more-than-10k-url-saved-objects/248565 "2020-09-14T18:08:43Z")
Hello, I am trying to use the saved\_objects/export api as documented here https://www.elastic.co/guide/en/kibana/current/saved-objects-api-export.html. But I am hitting a 10,000 object limit: "message": "Can't export mo… --- ## [Logstash maximum indexes](https://discuss.elastic.co/t/logstash-maximum-indexes/248563)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 5:48pm UTC](https://discuss.elastic.co/t/logstash-maximum-indexes/248563 "2020-09-14T17:48:15Z")
I saw that today's data is missing in kibana. After investigating I noticed that today's index doesn't exist (I create an index everyday. Today's index should be filebeat-7.9.0-2020.09.14) This is what logstash has to s… --- ## [Canvas - Visualization Custom titles not saved](https://discuss.elastic.co/t/canvas-visualization-custom-titles-not-saved/248477)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 5:47pm UTC](https://discuss.elastic.co/t/canvas-visualization-custom-titles-not-saved/248477 "2020-09-14T17:47:47Z")
As per the heading, I have added Visualization elements which are used in other Dashboards to my workpad in Canvas. I add a custom title, but every so often I refresh or happen to see the titles do not get saved and rev… --- ## [Kibana table sample size](https://discuss.elastic.co/t/kibana-table-sample-size/248449)
**Author:** [@AditiKhalatkar](https://discuss.elastic.co/u/AditiKhalatkar)\ **Replies:** 13\ **Last updated:** [September 14, 2020, 5:43pm UTC](https://discuss.elastic.co/t/kibana-table-sample-size/248449 "2020-09-14T17:43:05Z")
How much can be the maximum value for discover:sampleSize in Kibana/Advanced Settings? I have tried setting it to 10000 because of a few use cases (since my table crashes because of too many rows at times). Also, I saw a… --- ## [Nginx Kibana: Bad gateway 502](https://discuss.elastic.co/t/nginx-kibana-bad-gateway-502/248392)
**Author:** [@davideluque](https://discuss.elastic.co/u/davideluque)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/nginx-kibana-bad-gateway-502/248392 "2020-09-14T17:37:46Z")
Continuing the discussion from https://discuss.elastic.co/t/bad-gateway-nginx/127473 I have fixed this by running the following command in the terminal: setsebool httpd\_can\_network\_connect on -P This is because the we… --- ## [Bad Gateway (nginx)](https://discuss.elastic.co/t/bad-gateway-nginx/127473)
**Author:** [@Hackedia](https://discuss.elastic.co/u/Hackedia)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 5:37pm UTC](https://discuss.elastic.co/t/bad-gateway-nginx/127473 "2020-09-14T17:37:38Z")
Hi everyone ! I did a very simple installation (from digital ocean tutorial) of an ELK server on CentOS and i get this "bad gateway" error (after sending htpasswd credentials). More information here : Checking local 5… --- ## [How to increase the speed of restoring snapshots using GCS](https://discuss.elastic.co/t/how-to-increase-the-speed-of-restoring-snapshots-using-gcs/248562)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 4:29pm UTC](https://discuss.elastic.co/t/how-to-increase-the-speed-of-restoring-snapshots-using-gcs/248562 "2020-09-14T16:29:32Z")
Can this be "max\_restore\_bytes\_per\_sec" : "10gb" used to increase restoring snapshots on GKE elasticsearch using GCS bucket. Can anyone please answer this one --- ## [Tableau Connector with Elastic JDBC driver](https://discuss.elastic.co/t/tableau-connector-with-elastic-jdbc-driver/248344)
**Author:** [@otorih](https://discuss.elastic.co/u/otorih)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 4:28pm UTC](https://discuss.elastic.co/t/tableau-connector-with-elastic-jdbc-driver/248344 "2020-09-14T16:28:54Z")
Hello, I couldn't find any satisfying solution on google and after double-checking that this hasn't already been answered here, I decided to write that post to seek for some help. I am currently trying to connect Table… --- ## [Timelion query question for getting date](https://discuss.elastic.co/t/timelion-query-question-for-getting-date/247711)
**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 4:23pm UTC](https://discuss.elastic.co/t/timelion-query-question-for-getting-date/247711 "2020-09-14T16:23:53Z")
Hello? I have a simple question for query of timelion kibana. i want to draw the total documents count of specific index. Here is query sample. .es( index=test\*, timefield=@timestamp, q='elasticsearch.index.name:t… --- ## [Timelion query with hypen in string](https://discuss.elastic.co/t/timelion-query-with-hypen-in-string/248301)
**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 4:19pm UTC](https://discuss.elastic.co/t/timelion-query-with-hypen-in-string/248301 "2020-09-14T16:19:51Z")
Hello? Can I use query with hypen in string on timelion expression ? Here is query sample. .es( index=test\*, timefield=@timestamp, q='elasticsearch.index.name:test-01\_a-\*', metric='avg:elasticsearch.index.total.do… --- ## [Kibana Timelion Question Split Label More than 1 field](https://discuss.elastic.co/t/kibana-timelion-question-split-label-more-than-1-field/247283)
**Author:** [@Gundam\_Airline](https://discuss.elastic.co/u/Gundam_Airline)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 4:09pm UTC](https://discuss.elastic.co/t/kibana-timelion-question-split-label-more-than-1-field/247283 "2020-09-14T16:09:47Z")
How can I split more than 1 field in the label for Timelion. I have seen multiple post that shows 1 variable as shown in the link below but nothing for 2 or more. Can someone please give me an example that could assist m… --- ## [Scroll query performance regression upgrading to ES v7.9 from v6.8](https://discuss.elastic.co/t/scroll-query-performance-regression-upgrading-to-es-v7-9-from-v6-8/248556)
**Author:** [@rankida](https://discuss.elastic.co/u/rankida)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 3:57pm UTC](https://discuss.elastic.co/t/scroll-query-performance-regression-upgrading-to-es-v7-9-from-v6-8/248556 "2020-09-14T15:57:19Z")
We have a query that returns a stupid amount of results (98k). I won't go into details as to why. To achieve this we use a scroll with 1,000 documents per batch. We recently (finally) upgraded to v7.x of ElasticSearch a… --- ## [Kibana : Alerts and Actions. How to insert alerts via API?](https://discuss.elastic.co/t/kibana-alerts-and-actions-how-to-insert-alerts-via-api/248418)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 2:53pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-how-to-insert-alerts-via-api/248418 "2020-09-14T14:53:44Z")
Reading through the document, it is not clear how to PUT/POST an alert action to Kibana. Will tihs be an API of its own or just a new of data into .kibana index? As per the \ definition \`\\` (Required, stri… --- ## [What's wrong with my mutate filter?](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536)
**Author:** [@Haptomai](https://discuss.elastic.co/u/Haptomai)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536 "2020-09-14T14:58:48Z")
Hi there, first time requiring help here :wink: In order to filter some different inputs (actually same filebeat input, but multiple beats/formats are sent), I achieved to get this following logstash pipeline: input {… --- ## [Unescape XML](https://discuss.elastic.co/t/unescape-xml/248548)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 3:06pm UTC](https://discuss.elastic.co/t/unescape-xml/248548 "2020-09-14T15:06:28Z")
I have a field which contains data that came from an XML node. For some reason, this XML was not unescaped so I end up with values like instead of a line feed (CrLf). Is there any way of unescaping this in an… --- ## [GCP machine type (N1,N2 and N2D) recommendations for ELK](https://discuss.elastic.co/t/gcp-machine-type-n1-n2-and-n2d-recommendations-for-elk/248547)
**Author:** [@hemanth49841](https://discuss.elastic.co/u/hemanth49841)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/gcp-machine-type-n1-n2-and-n2d-recommendations-for-elk/248547 "2020-09-14T14:58:18Z")
Hi All, We are planning deploy elk stack on Google cloud Platform. What are best recommended instance type (N1,N2 ,N2D, Compute optimised and memory optimised) for elastic, logstash and kibana nodes. Thanks in Advance… --- ## [Visualization of sparse data in TSVB](https://discuss.elastic.co/t/visualization-of-sparse-data-in-tsvb/247113)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 6\ **Last updated:** [September 14, 2020, 2:49pm UTC](https://discuss.elastic.co/t/visualization-of-sparse-data-in-tsvb/247113 "2020-09-14T14:49:42Z")
Hello, I use TSVB to visualize data that is being sent every 1 minute to Elasticsearch. The problem is, sometimes the data takes a little bit more time to be calculated, and so it is being sent after 1 min and 5 second… --- ## [Inspect =\> Download CSV =\> Formatted CSV, download file using Python](https://discuss.elastic.co/t/inspect-download-csv-formatted-csv-download-file-using-python/248508)
**Author:** [@balajipothula](https://discuss.elastic.co/u/balajipothula)\ **Replies:** 3\ **Last updated:** [September 14, 2020, 2:41pm UTC](https://discuss.elastic.co/t/inspect-download-csv-formatted-csv-download-file-using-python/248508 "2020-09-14T14:41:50Z")
HI Team, I had Kibana version 7.4 Inspect =\> Download CSV =\> Formatted CSV Can I download table visualization Formatted data by using Python code or CURL Thanks and regards, BALAJI [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1806) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1808)