# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1847 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1848 --- ## [Issue when calculating MAX TPS using MAX Bucket Aggregation](https://discuss.elastic.co/t/issue-when-calculating-max-tps-using-max-bucket-aggregation/242979)
**Author:** [@rpotnuru](https://discuss.elastic.co/u/rpotnuru)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 6:48pm UTC](https://discuss.elastic.co/t/issue-when-calculating-max-tps-using-max-bucket-aggregation/242979 "2020-08-24T18:48:56Z")
Hello, I am trying to add a visualization to calculate MAX TPS for an API, attached the Visualization settings. I am selecting the minimum interval in my date histogram as 1s, but the metric result I am getting is fo… --- ## [Different query result between http and kibana](https://discuss.elastic.co/t/different-query-result-between-http-and-kibana/246107)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 6:33pm UTC](https://discuss.elastic.co/t/different-query-result-between-http-and-kibana/246107 "2020-08-24T18:33:03Z")
Hi experts, I'm trying to undestand something with a query result but I still don't get it... I have a index (td\_movies) with a lot of movies. I want to search for the movies where the title contains "star" or "wars". … --- ## [Forwarding Rsyslog to Logstash](https://discuss.elastic.co/t/forwarding-rsyslog-to-logstash/246162)
**Author:** [@elasticus3r](https://discuss.elastic.co/u/elasticus3r)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 6:31pm UTC](https://discuss.elastic.co/t/forwarding-rsyslog-to-logstash/246162 "2020-08-24T18:31:04Z")
Hello, I am forwarding my rsyslog to Logstash to which I can see traffic coming on 5001 within logstash using tcpdump command: tcpdump -Xni ens192 port 5001 and src \ However, I am not seeing this serv… --- ## [Kibana infinite loop with elastic operator on Kubernetes](https://discuss.elastic.co/t/kibana-infinite-loop-with-elastic-operator-on-kubernetes/246145)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 6:24pm UTC](https://discuss.elastic.co/t/kibana-infinite-loop-with-elastic-operator-on-kubernetes/246145 "2020-08-24T18:24:07Z")
Hi, So I'm facing this issue that seems to be around for a long time and dealt with in different manners, yet, I don't see a way to deal with it when using ECK. Any ideas on how to fix the kibana "infinite loop" (302) w… --- ## [Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/242646)
**Author:** [@star\_trj](https://discuss.elastic.co/u/star_trj)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 6:27pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/242646 "2020-08-24T18:27:27Z")
hi ,i have problem to connect kibana with elasticsearch. my OS is Manjaro and it is Arch base. i install the latest version of elastic & kibana (7.8.0) and try to handle errors, change port or delete kibana and install… --- ## [Query datastream - all shards - how to avoid?](https://discuss.elastic.co/t/query-datastream-all-shards-how-to-avoid/246127)
**Author:** [@abenas](https://discuss.elastic.co/u/abenas)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 5:51pm UTC](https://discuss.elastic.co/t/query-datastream-all-shards-how-to-avoid/246127 "2020-08-24T17:51:20Z")
Hi, We currently use a date pattern in index name to contain a monthly breakdown of documents. In this way, an app can query the right index (or indexes) based on an initial/end date, avoiding hitting all indexes / sha… --- ## [Running custom aggregations in ES](https://discuss.elastic.co/t/running-custom-aggregations-in-es/243213)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 5:31pm UTC](https://discuss.elastic.co/t/running-custom-aggregations-in-es/243213 "2020-08-24T17:31:36Z")
Is it possible to run custom "aggregations" directly db side? I know there are builtin functionalities like averaging etc. But I want to run a custom function on the data that is stored in a specific index. --- ## [Parsing JSON input with multiple arrays as events](https://discuss.elastic.co/t/parsing-json-input-with-multiple-arrays-as-events/246040)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 6\ **Last updated:** [August 24, 2020, 5:30pm UTC](https://discuss.elastic.co/t/parsing-json-input-with-multiple-arrays-as-events/246040 "2020-08-24T17:30:25Z")
Hi, I am currently using the http\_poller input to pull from an API which is giving me 4 arrays which hold 4 different kinds of events. I am trying to move them all into another array and tag each event so that I know wh… --- ## [Visualizing inactive users](https://discuss.elastic.co/t/visualizing-inactive-users/246057)
**Author:** [@reale](https://discuss.elastic.co/u/reale)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 5:15pm UTC](https://discuss.elastic.co/t/visualizing-inactive-users/246057 "2020-08-24T17:15:44Z")
Hi guys, I'm currently working on Kibana visualization, and I'm stuck in searching the right path to find inactive users. Is there a way to query for users who didn't login in the last x amount of time? Thank you in ad… --- ## [Logstash wildcard](https://discuss.elastic.co/t/logstash-wildcard/246121)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 5:12pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121 "2020-08-24T17:12:49Z")
Logstash recieves many .log files such as mongod.log and mysqld.log. I deal with it in logstash by having an if statement for each file such as: if \[log\]\[file\]\[path\] =~ "mysqld.log" I've been asked to also ship data fr… --- ## [How to include log field value in the alert body message](https://discuss.elastic.co/t/how-to-include-log-field-value-in-the-alert-body-message/245876)
**Author:** [@akhettar](https://discuss.elastic.co/u/akhettar)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 5:10pm UTC](https://discuss.elastic.co/t/how-to-include-log-field-value-in-the-alert-body-message/245876 "2020-08-24T17:10:22Z")
Hello there, I would like to include a log's field value in the alert body message. The alert is pushed to slack channel. From the log entry below, I wanted to include the payload.message and payload.customData.orders T… --- ## [Request timed out within 30000ms](https://discuss.elastic.co/t/request-timed-out-within-30000ms/245840)
**Author:** [@chaitra\_pc](https://discuss.elastic.co/u/chaitra_pc)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:59pm UTC](https://discuss.elastic.co/t/request-timed-out-within-30000ms/245840 "2020-08-24T16:59:47Z")
I doing a fresh installation of Elastic searh and Kibana. I have elastic search running on default port 9200, however, I am unable to start Kibana. Error: log \[02:00:46.810\] \[info\]\[savedobjects-service\] Waiting unt… --- ## [Create custom tag based filtering criteria and visualise on Kibana](https://discuss.elastic.co/t/create-custom-tag-based-filtering-criteria-and-visualise-on-kibana/245826)
**Author:** [@byc-art](https://discuss.elastic.co/u/byc-art)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:56pm UTC](https://discuss.elastic.co/t/create-custom-tag-based-filtering-criteria-and-visualise-on-kibana/245826 "2020-08-24T16:56:17Z")
Hi, I want to create custom tags to files based on the filtering criteria and visualise these tags on dashboard. For example, I want to label files with 'Shakespear' if the files contain words like 'Hamlet' or 'Macbeth'… --- ## [How to remove unwanted filters in kibana](https://discuss.elastic.co/t/how-to-remove-unwanted-filters-in-kibana/245546)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:55pm UTC](https://discuss.elastic.co/t/how-to-remove-unwanted-filters-in-kibana/245546 "2020-08-24T16:55:25Z")
I am getting below hyperlinks in my kibana when i try to select filters, but i do not want most of them as they do not seem to be relevant, please let me know how they can be removed.. --- ## [How to use search\_after with rest low client api](https://discuss.elastic.co/t/how-to-use-search-after-with-rest-low-client-api/246156)
**Author:** [@abhishek\_chaturvedi](https://discuss.elastic.co/u/abhishek_chaturvedi)\ **Replies:** 0\ **Last updated:** [August 24, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-to-use-search-after-with-rest-low-client-api/246156 "2020-08-24T16:54:16Z")
How to use search\_after in below implementation: String esQuery = String.format(searchTextQuery, startDate, endDate, formattedQueries); request.setJsonEntity(esQuery); String offset = String.valueOf((Integer.parseIn… --- ## [Rest API/Reporting in Kibana 7.4.2](https://discuss.elastic.co/t/rest-api-reporting-in-kibana-7-4-2/245927)
**Author:** [@Ramadevi](https://discuss.elastic.co/u/Ramadevi)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:33pm UTC](https://discuss.elastic.co/t/rest-api-reporting-in-kibana-7-4-2/245927 "2020-08-24T16:33:40Z")
Hi Team, In Kibana 7.4 Version, we could see Reporting and Rest API where as we can't see the feature's with the basic Kibana version(7.4.2) we have. Could you please suggest on this. Thanks & Regards, Ramadevi Edam… --- ## [Kibana partial/substring matches are not working](https://discuss.elastic.co/t/kibana-partial-substring-matches-are-not-working/245844)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:28pm UTC](https://discuss.elastic.co/t/kibana-partial-substring-matches-are-not-working/245844 "2020-08-24T16:28:08Z")
Hi, Setup: Elasticsearch version 7.6.1 field name is log, here is the config in index template: "log": { "type": "text", "fields": { "keyword": { "type": "keyword… --- ## [Logstash http\_poller json parsing error](https://discuss.elastic.co/t/logstash-http-poller-json-parsing-error/245990)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 19\ **Last updated:** [August 24, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-http-poller-json-parsing-error/245990 "2020-08-24T16:27:26Z")
Hello , I am using http\_poller logstash input plugin to poll rest API ( JIRA ) . When i poll it , these are the sample fields maxresults startAt tags issues Fields under issues issues { fields … --- ## [Filebeat processor for single line logs?](https://discuss.elastic.co/t/filebeat-processor-for-single-line-logs/242812)
**Author:** [@t3fsx](https://discuss.elastic.co/u/t3fsx)\ **Replies:** 6\ **Last updated:** [August 24, 2020, 4:24pm UTC](https://discuss.elastic.co/t/filebeat-processor-for-single-line-logs/242812 "2020-08-24T16:24:15Z")
I ran into this threat in Github so I just copy-paste: Steps to Reproduce: Enable Apache module in Filebeat and use the DNS processor; configuration example below: - dns: type: reverse action: append field… --- ## [Matching fields and create new field](https://discuss.elastic.co/t/matching-fields-and-create-new-field/245620)
**Author:** [@Rajesh\_M](https://discuss.elastic.co/u/Rajesh_M)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:11pm UTC](https://discuss.elastic.co/t/matching-fields-and-create-new-field/245620 "2020-08-24T16:11:52Z")
Hi, I have an index with our application logs, which is exported directly to ELK. Below is one of the session log, {"@timestamp": "2020-08-19T13:42:15.236Z", "session": "fdb56d5f", "client": "192.168.1.2", "operation":… --- ## [Numerator ignore global filter](https://discuss.elastic.co/t/numerator-ignore-global-filter/245452)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:08pm UTC](https://discuss.elastic.co/t/numerator-ignore-global-filter/245452 "2020-08-24T16:08:47Z")
Hi, I am creating coverage over time using TSVB using filter ratio. I want the global filter (the control visualization) only filter the numerator, but keep the denominator unchange, so that my client can see different t… --- ## [Monitoring shows no\_data](https://discuss.elastic.co/t/monitoring-shows-no-data/246135)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:00pm UTC](https://discuss.elastic.co/t/monitoring-shows-no-data/246135 "2020-08-24T16:00:11Z")
I have the problem that sometimes the "Monitoring" Tab in Kibana shows me nothing. Sometimes instead of home?\_g=() there is no\_data?\_g() at the end of that URL. (Sometimes I am even surprised to see "no\_data" immediat… --- ## [What is the difference between \_bulk\_get and export](https://discuss.elastic.co/t/what-is-the-difference-between-bulk-get-and-export/245932)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 3:57pm UTC](https://discuss.elastic.co/t/what-is-the-difference-between-bulk-get-and-export/245932 "2020-08-24T15:57:43Z")
I know export has includeReferencesDeep and \_bulk\_get has fields which makes them different, but is there any difference if I just send a list of type and id to both end points like this? I experiment a little and find … --- ## [Export raw data(that is displayed in Kibana dashboard) to csv](https://discuss.elastic.co/t/export-raw-data-that-is-displayed-in-kibana-dashboard-to-csv/244034)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 4\ **Last updated:** [August 24, 2020, 3:47pm UTC](https://discuss.elastic.co/t/export-raw-data-that-is-displayed-in-kibana-dashboard-to-csv/244034 "2020-08-24T15:47:31Z")
Hi, I want to export all the raw data that is aggregated by all the visualizations and filters in Kibana dashboard (not from Discovery tab) In the following shot you can see that it was supported once but I can't se… --- ## [Painless script too long](https://discuss.elastic.co/t/painless-script-too-long/246043)
**Author:** [@wfeng888](https://discuss.elastic.co/u/wfeng888)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 3:46pm UTC](https://discuss.elastic.co/t/painless-script-too-long/246043 "2020-08-24T15:46:15Z")
When i use painless script, i get the following error: Does this "plugin" mean the elasticsearch built-in aggregation function or something else? --- ## [How to visualize data from different CSV file?](https://discuss.elastic.co/t/how-to-visualize-data-from-different-csv-file/245448)
**Author:** [@atiqah\_yusri](https://discuss.elastic.co/u/atiqah_yusri)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 3:19pm UTC](https://discuss.elastic.co/t/how-to-visualize-data-from-different-csv-file/245448 "2020-08-24T15:19:24Z")
Hi everyone, I already load 2 CSV files into the elasticsearch. so, now I want to visualize them using kibana, but not all data I want to visualize. for example: -csv\_1: have columns name \[Student name, student id, gen… --- ## [Openam acess log grok filter](https://discuss.elastic.co/t/openam-acess-log-grok-filter/245883)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 3:17pm UTC](https://discuss.elastic.co/t/openam-acess-log-grok-filter/245883 "2020-08-24T15:17:19Z")
Hi, Can any please help on and provide the grok pattern for the below logs. i want to get the uid(uid=12398938) in a separate field or if i can get the complete "uid=12398938,ou=people,dc=abcdef,dc=com" in seperate fie… --- ## [Use Logstash to Ingest Entire .txt file](https://discuss.elastic.co/t/use-logstash-to-ingest-entire-txt-file/246141)
**Author:** [@spyderman4g63](https://discuss.elastic.co/u/spyderman4g63)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 3:07pm UTC](https://discuss.elastic.co/t/use-logstash-to-ingest-entire-txt-file/246141 "2020-08-24T15:07:07Z")
Is it possible to ingest the entire contents of a txt file into a field using logstash? I don't want a multiline delimeter. --- ## [Adding tokenizer/patternReplace on phoneNumber using NEST client](https://discuss.elastic.co/t/adding-tokenizer-patternreplace-on-phonenumber-using-nest-client/246142)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 0\ **Last updated:** [August 24, 2020, 3:01pm UTC](https://discuss.elastic.co/t/adding-tokenizer-patternreplace-on-phonenumber-using-nest-client/246142 "2020-08-24T15:01:05Z")
Hi, i have phone numbers in elastic search -\> saved as ,in any of below formats "+46 23234 5656" "0 23234 5656" "23234-5656" "232345656" so if i search for "232345656" i want all 4 results shown above,can anyone te… --- ## [Unable to show region maps on Dashboard](https://discuss.elastic.co/t/unable-to-show-region-maps-on-dashboard/246012)
**Author:** [@krishnendu](https://discuss.elastic.co/u/krishnendu)\ **Replies:** 7\ **Last updated:** [August 24, 2020, 2:58pm UTC](https://discuss.elastic.co/t/unable-to-show-region-maps-on-dashboard/246012 "2020-08-24T14:58:36Z")
I have been able to create a map visualisation. But the tiles do not load when the map is put into a dashboard. Visualisatuion : In Dashboard: Can someone help me ? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1846) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1848)