# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1873 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1874 --- ## [Tags field filter](https://discuss.elastic.co/t/tags-field-filter/241520)
**Author:** [@Yachee\_Leo](https://discuss.elastic.co/u/Yachee_Leo)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 8:25am UTC](https://discuss.elastic.co/t/tags-field-filter/241520 "2020-08-12T08:25:44Z")
I have a 'tags' feild in under my index, it contains 3 values like : a,b,c. I want to filter out just 'a' in visualizition/timelion, but every time the results would contain all 3 values, how can I get rid of b and c ? t… --- ## [Adding new data node to 3 node elasticsearch cluster](https://discuss.elastic.co/t/adding-new-data-node-to-3-node-elasticsearch-cluster/244547)
**Author:** [@pdkgamage](https://discuss.elastic.co/u/pdkgamage)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 8:16am UTC](https://discuss.elastic.co/t/adding-new-data-node-to-3-node-elasticsearch-cluster/244547 "2020-08-12T08:16:11Z")
Hi, There is 3 node elasticsearch cluster. one is running as master node and other two running as data node. All these nodes are having 900GB hard disk. So i wanted to add new data node which having 350GB hard disk. Pl… --- ## [Using doc\_count to calculate percentage after aggregation](https://discuss.elastic.co/t/using-doc-count-to-calculate-percentage-after-aggregation/243611)
**Author:** [@surjray](https://discuss.elastic.co/u/surjray)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 8:14am UTC](https://discuss.elastic.co/t/using-doc-count-to-calculate-percentage-after-aggregation/243611 "2020-08-12T08:14:57Z")
Dear all, I am currently attempting to use the doc\_count field (result of aggregation operation: aggregations.aggregation\_name.buckets -\> doc\_count for each bucket) to calculate some percentages, namely pass and fail fo… --- ## [\[Elasticsearch Docker\] \[Errno 111\] Connection refused when connecting with python script](https://discuss.elastic.co/t/elasticsearch-docker-errno-111-connection-refused-when-connecting-with-python-script/243678)
**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\ **Replies:** 5\ **Last updated:** [August 12, 2020, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-docker-errno-111-connection-refused-when-connecting-with-python-script/243678 "2020-08-12T08:13:51Z")
Hey, I got an issue with a dockerized elasticsearch cluster that I would like to connect with a simple python indexing script. After executing docker-compose up it brings up the cluster, kibana as well, but when it tri… --- ## [3 node cluster failure](https://discuss.elastic.co/t/3-node-cluster-failure/244533)
**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\ **Replies:** 5\ **Last updated:** [August 12, 2020, 7:54am UTC](https://discuss.elastic.co/t/3-node-cluster-failure/244533 "2020-08-12T07:54:48Z")
Hi, I am new to elasticsearch. I have created a 3 node elasticsearch cluster. All master and data set to true. All 3 nodes are running: Centos 8, ES version 7.8.1 Java - openjdk 11.0.8 2020-07-14 LTS. Firewall - in … --- ## [Cant see my Beats list in ES version 7.8.0](https://discuss.elastic.co/t/cant-see-my-beats-list-in-es-version-7-8-0/244181)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 2:24pm UTC](https://discuss.elastic.co/t/cant-see-my-beats-list-in-es-version-7-8-0/244181 "2020-08-11T14:24:47Z")
Hello, After updating to ES version 7.8.0 i cant see my Beats list in Beat management What can i do to see them as i did before the update? Important note: Despite the fact that i dont see them in the beats manage… --- ## [Multiple filebeat inputs and multiple logstash pipelines](https://discuss.elastic.co/t/multiple-filebeat-inputs-and-multiple-logstash-pipelines/244626)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 4\ **Last updated:** [August 12, 2020, 7:30am UTC](https://discuss.elastic.co/t/multiple-filebeat-inputs-and-multiple-logstash-pipelines/244626 "2020-08-12T07:30:23Z")
Dear all, this is my scenario: one directory with two types of files that i want to proccess with one pipeline each. File types are identified by his name. I am very new to pipeline logstash, i usually go with a single… --- ## [Can't get document message fields printed in my alerts using ctx](https://discuss.elastic.co/t/cant-get-document-message-fields-printed-in-my-alerts-using-ctx/242513)
**Author:** [@danona45](https://discuss.elastic.co/u/danona45)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 7:09am UTC](https://discuss.elastic.co/t/cant-get-document-message-fields-printed-in-my-alerts-using-ctx/242513 "2020-08-12T07:09:15Z")
Hi, I am trying to setup my trigger to send message to slack and embed some fields from documents sampled by my monitor. I am using Opendistro 7.4.0 in AWS. I only managed to reference the total hits though using the … --- ## [Connection error when using a domain in python client to connect the elasticsearch](https://discuss.elastic.co/t/connection-error-when-using-a-domain-in-python-client-to-connect-the-elasticsearch/244650)
**Author:** [@Tristan\_D](https://discuss.elastic.co/u/Tristan_D)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 7:08am UTC](https://discuss.elastic.co/t/connection-error-when-using-a-domain-in-python-client-to-connect-the-elasticsearch/244650 "2020-08-12T07:08:30Z")
I can't connect to the es with the direct ip:9200, so I use a domain. The domain is mapping to es\_ip:9200. It's fine when I use curl command to test the connection. curl ai-xiaov-async.vivo.com.cn/\_cat/indices But in … --- ## [Multiply scores between 'distance\_feature' and 'dismax'?](https://discuss.elastic.co/t/multiply-scores-between-distance-feature-and-dismax/244638)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 10:03pm UTC](https://discuss.elastic.co/t/multiply-scores-between-distance-feature-and-dismax/244638 "2020-08-11T22:03:49Z")
Hi, Imagine I have 3 queries: "distance\_feature": { ... time... } "distance\_feature": { ... location... } "dis\_max" : { ... } Currently, to combine it I do this: "query" : { "bool" : { "must" : \[ "distance\_fe… --- ## [Getting Error "all shards failed" when I go for re-indexing](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577)
**Author:** [@Sarwar\_Kori](https://discuss.elastic.co/u/Sarwar_Kori)\ **Replies:** 7\ **Last updated:** [August 12, 2020, 6:46am UTC](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577 "2020-08-12T06:46:01Z")
{ "error" : { "root\_cause" : , "type" : "search\_phase\_execution\_exception", "reason" : "all shards failed", "phase" : "query", "grouped" : true, "failed\_shards" : }, "status" : 503 } --- ## [Is there an option to return the query string in the result?](https://discuss.elastic.co/t/is-there-an-option-to-return-the-query-string-in-the-result/244611)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 5:30am UTC](https://discuss.elastic.co/t/is-there-an-option-to-return-the-query-string-in-the-result/244611 "2020-08-12T05:30:20Z")
Like the topic suggested. Is there an option to return back what my query is for the result? What I am looking for is to embed an ID to the request so we can easily identify the source of requester. So the task detail… --- ## [Is kibana 6.8.7 supports drill down dash boards?](https://discuss.elastic.co/t/is-kibana-6-8-7-supports-drill-down-dash-boards/244585)
**Author:** [@kibana\_anil](https://discuss.elastic.co/u/kibana_anil)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:12am UTC](https://discuss.elastic.co/t/is-kibana-6-8-7-supports-drill-down-dash-boards/244585 "2020-08-12T05:12:32Z")
Hi I am working on kibana 6.8.7 version Drill down records from Visualize as follows :: Create a search in Discover 'Abc\_Search' and it has a filter which is "filter1' on the 'abc\*' index. Create a Visualize bas… --- ## [How to connect Django and Elasticsearch by using Logstash?](https://discuss.elastic.co/t/how-to-connect-django-and-elasticsearch-by-using-logstash/244645)
**Author:** [@Jun.8](https://discuss.elastic.co/u/Jun.8)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 4:33am UTC](https://discuss.elastic.co/t/how-to-connect-django-and-elasticsearch-by-using-logstash/244645 "2020-08-12T04:33:16Z")
Hi, I'm trying to send data in Django sqlite DB to Elasticsearch by using Logstash. I made two tables in Django and they are in sqlite DB basically embedded in Django. And I want send these datas to elasticsearch by usi… --- ## [Query on getting the complete event data in output plugin](https://discuss.elastic.co/t/query-on-getting-the-complete-event-data-in-output-plugin/244608)
**Author:** [@bimanarajesh](https://discuss.elastic.co/u/bimanarajesh)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 3:49am UTC](https://discuss.elastic.co/t/query-on-getting-the-complete-event-data-in-output-plugin/244608 "2020-08-12T03:49:46Z")
Hi, In the logstash output plugin, i would like to get the complete event data. Could you please advice on how we can achieve that,. Once the event is received, I would like to wrap it around another json object. This w… --- ## [Metricbeat jolokia autodiscover question](https://discuss.elastic.co/t/metricbeat-jolokia-autodiscover-question/243736)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 8\ **Last updated:** [August 12, 2020, 2:45am UTC](https://discuss.elastic.co/t/metricbeat-jolokia-autodiscover-question/243736 "2020-08-12T02:45:43Z")
this is my config , no jvm data sent to es ,so what goes wrong with this config version : 7.6.0 metricbeat.yml metricbeat.config.modules: # Mounted \`metricbeat-daemonset-modules\` configmap: path: ${path.config}/mo… --- ## [Ruby - First few characters (substring)](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 4\ **Last updated:** [August 12, 2020, 2:09am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493 "2020-08-12T02:09:46Z")
Hey All, Trying to get the first 4 characters of a field that is obtained via XPATH. This is what i currently have, but it copies everything rather then the first 4 characters. Been stumped on it for the past couple ho… --- ## [ElasticSearch automatically skips decimals in floating numbers](https://discuss.elastic.co/t/elasticsearch-automatically-skips-decimals-in-floating-numbers/244578)
**Author:** [@AGP1](https://discuss.elastic.co/u/AGP1)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 1:18am UTC](https://discuss.elastic.co/t/elasticsearch-automatically-skips-decimals-in-floating-numbers/244578 "2020-08-12T01:18:15Z")
I have a panel configured to retrieve a floating number from Elasticsearh, I am interested in the decimals of that number, but apparently the panel omits the numbers after the comma and leaves them at 0 as if it were a w… --- ## [Vega plot y-axis "undefined"](https://discuss.elastic.co/t/vega-plot-y-axis-undefined/243503)
**Author:** [@dataplatform12345](https://discuss.elastic.co/u/dataplatform12345)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 12:47am UTC](https://discuss.elastic.co/t/vega-plot-y-axis-undefined/243503 "2020-08-12T00:47:46Z")
Hi all, I'm trying to plot a simple horizontal bar chart using vega in Kibana after transforming the original index using a groupby aggregate. It appears the plotting doesn't work and the y-axis scale ends up as "undefi… --- ## [Vega radio input don't show defaul](https://discuss.elastic.co/t/vega-radio-input-dont-show-defaul/243182)
**Author:** [@Michaela\_Krkosova](https://discuss.elastic.co/u/Michaela_Krkosova)\ **Replies:** 11\ **Last updated:** [August 12, 2020, 12:40am UTC](https://discuss.elastic.co/t/vega-radio-input-dont-show-defaul/243182 "2020-08-12T00:40:24Z")
Hi to all I have Vega visualization with radio input signal. "signals": \[ {"name": "Zobrazení", "value": "Celkově", "bind": {"input": "radio", "options": \["Celkově", "Po zaměstnancích"\]}}, {"name": "Období", "value":… --- ## [Kibana second instance on a different domain - best practices?](https://discuss.elastic.co/t/kibana-second-instance-on-a-different-domain-best-practices/244485)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 5\ **Last updated:** [August 11, 2020, 11:17pm UTC](https://discuss.elastic.co/t/kibana-second-instance-on-a-different-domain-best-practices/244485 "2020-08-11T23:17:00Z")
Hey All, I have 1 Elasticsearch cluster (version 7.6.x) that is connected to Kibana (2 nodes behind a load balancer). I would like to create another Kibana instance on a different domain. So users from that other domai… --- ## [Curl command to connect to elastic cloud](https://discuss.elastic.co/t/curl-command-to-connect-to-elastic-cloud/244641)
**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 10:40pm UTC](https://discuss.elastic.co/t/curl-command-to-connect-to-elastic-cloud/244641 "2020-08-11T22:40:55Z")
I want to use curl or other mechanisms to connect to elastic cloud clusters. What is the best way to achieve them? --- ## [Extract 'Year' from 'new Date()' function in Kibana scripted field](https://discuss.elastic.co/t/extract-year-from-new-date-function-in-kibana-scripted-field/244463)
**Author:** [@Mike\_Smith1](https://discuss.elastic.co/u/Mike_Smith1)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 10:04pm UTC](https://discuss.elastic.co/t/extract-year-from-new-date-function-in-kibana-scripted-field/244463 "2020-08-11T22:04:54Z")
How can I extract only year (2020) from new Date() function in Kibana scripted field? Following is scripted field entry new Date() Preview of above function displays { "\_id": "a38be692-7b1c-4d9b-a8eb-cfedb15e6937", … --- ## [Supported kafka version with logstash 7.5.1](https://discuss.elastic.co/t/supported-kafka-version-with-logstash-7-5-1/244632)
**Author:** [@satish92](https://discuss.elastic.co/u/satish92)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 9:35pm UTC](https://discuss.elastic.co/t/supported-kafka-version-with-logstash-7-5-1/244632 "2020-08-11T21:35:45Z")
I upgraded the kafka from 0.10.0 to 2.5 and also logstash from 2.4 to 7.5.1 after upgrade logstash is sending empty messages to Kafka( i can see this in kafka UI) but I can see messages in kafka UI which is forwarded fro… --- ## [Fields didn't show up](https://discuss.elastic.co/t/fields-didnt-show-up/244550)
**Author:** [@ayoub11](https://discuss.elastic.co/u/ayoub11)\ **Replies:** 3\ **Last updated:** [August 11, 2020, 9:27pm UTC](https://discuss.elastic.co/t/fields-didnt-show-up/244550 "2020-08-11T21:27:29Z")
Hi, i'm using " Visualize data from a log file experimental" to upload a json file into kibana, but when i imported the file, it didn't display the fields contained in json file. Here is what i get: Here is a snippe… --- ## [Watching a Rollup indice?](https://discuss.elastic.co/t/watching-a-rollup-indice/244528)
**Author:** [@nesnoos](https://discuss.elastic.co/u/nesnoos)\ **Replies:** 3\ **Last updated:** [August 11, 2020, 9:15pm UTC](https://discuss.elastic.co/t/watching-a-rollup-indice/244528 "2020-08-11T21:15:04Z")
Hello everybody, Is it possible to watch a rollup indice ? I try to do this , but it doesn't seem to work. Is there a workaround ? thks --- ## [Logstash filtr strange behavior](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228)
**Author:** [@masech](https://discuss.elastic.co/u/masech)\ **Replies:** 16\ **Last updated:** [August 11, 2020, 9:09pm UTC](https://discuss.elastic.co/t/logstash-filtr-strange-behavior/244228 "2020-08-11T21:09:49Z")
Hi guys. I noticed that the convert\_datatype option of the Dissect filter has a strange result. Pipeline: input { stdin { } } filter { # split IPv4 address into octets dissect { mapping =\> { … --- ## [Logstash sending same message 3 times](https://discuss.elastic.co/t/logstash-sending-same-message-3-times/244610)
**Author:** [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\ **Replies:** 0\ **Last updated:** [August 11, 2020, 5:45pm UTC](https://discuss.elastic.co/t/logstash-sending-same-message-3-times/244610 "2020-08-11T17:45:40Z")
We have Pivotal Cloud Foundry as a platform and we are sending logs to ELK. So our setup is like we have an F5 load balancer which sends logs to 3 Logstash servers and these 3 Logstash servers send logs to 3 Elastic serv… --- ## [Event outcome and winlog.keywords - Possible Bug](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 1\ **Last updated:** [August 11, 2020, 8:07pm UTC](https://discuss.elastic.co/t/event-outcome-and-winlog-keywords-possible-bug/242353 "2020-08-11T20:07:29Z")
Hi, I'm using winlogbeat in DC that are in different languages (English and Spanish). Looking at the event.outcome I realized that was missing in the events coming from the DC with Spanish set. That is because the eve… --- ## [How do I write logstash pipelines in elastic cloud?](https://discuss.elastic.co/t/how-do-i-write-logstash-pipelines-in-elastic-cloud/244612)
**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\ **Replies:** 2\ **Last updated:** [August 11, 2020, 7:34pm UTC](https://discuss.elastic.co/t/how-do-i-write-logstash-pipelines-in-elastic-cloud/244612 "2020-08-11T19:34:48Z")
I want to upload csv and json files to ES within ES Cloud version. I want to use logstash to do the data movement. How do I upload the csv and json files on EC to make the configuration work within logstash UI available. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1872) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1874)