# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1913 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1914 --- ## [Create field based on calculated data](https://discuss.elastic.co/t/create-field-based-on-calculated-data/242138)
**Author:** [@Magnuss](https://discuss.elastic.co/u/Magnuss)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 6:32am UTC](https://discuss.elastic.co/t/create-field-based-on-calculated-data/242138 "2020-07-22T06:32:40Z")
Dear reader, I would like to do the following: I get data ingested everyday with the following fields.(example) Day 1 stock: 200 price: 10 Day 2 stock 200 price: 10 Day 1 stock: 200 price: 10 Day 3 stock 190 pric… --- ## [Master node's Elasticsearch sometimes dead while ingested data from filebeat](https://discuss.elastic.co/t/master-nodes-elasticsearch-sometimes-dead-while-ingested-data-from-filebeat/242035)
**Author:** [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Replies:** 8\ **Last updated:** [July 22, 2020, 6:26am UTC](https://discuss.elastic.co/t/master-nodes-elasticsearch-sometimes-dead-while-ingested-data-from-filebeat/242035 "2020-07-22T06:26:28Z")
I have a cluster with 2 nodes. Master node and data node. Both was fine back then. But it becoming a mess lately, like it is really slow ingesting csv data from filebeat, really slow kibana ui open. These is what it sho… --- ## [Kibana Time filter quick ranges for shifts](https://discuss.elastic.co/t/kibana-time-filter-quick-ranges-for-shifts/241994)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 2\ **Last updated:** [July 22, 2020, 6:04am UTC](https://discuss.elastic.co/t/kibana-time-filter-quick-ranges-for-shifts/241994 "2020-07-22T06:04:14Z")
Hi, I didnt found anything on the web to solve my problem. Is it possible to define a Range in Kibana Settings to Define the following 3 Shifts? Morning Shift (F), from 6–14 , Evening Shift (S), from 14–22 , Night Sh… --- ## [Scroll & heap size\\ another memory configuration](https://discuss.elastic.co/t/scroll-heap-size-another-memory-configuration/241732)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 6\ **Last updated:** [July 22, 2020, 5:57am UTC](https://discuss.elastic.co/t/scroll-heap-size-another-memory-configuration/241732 "2020-07-22T05:57:44Z")
Hi, I want to fetch 50 millions of records into data frame with scan(scroll...) what heap size do I need for that procedure? How can I know what is the right size for me? do I need to configure it only in the master … --- ## [Can metricbeat copy fields from basic fields like event or agent?](https://discuss.elastic.co/t/can-metricbeat-copy-fields-from-basic-fields-like-event-or-agent/242137)
**Author:** [@CHU\_XU](https://discuss.elastic.co/u/CHU_XU)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 5:53am UTC](https://discuss.elastic.co/t/can-metricbeat-copy-fields-from-basic-fields-like-event-or-agent/242137 "2020-07-22T05:53:46Z")
Hi experts, I'd like to copy the host name to event root when using system module. - copy\_fields: fields: - from: agent.name to: name fail\_on\_error: true ignore\_missing: false Output is: "ec… --- ## [Can kibana filter by parameter from Javascript?](https://discuss.elastic.co/t/can-kibana-filter-by-parameter-from-javascript/241828)
**Author:** [@Natchanan\_Jeawheng](https://discuss.elastic.co/u/Natchanan_Jeawheng)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 5:34am UTC](https://discuss.elastic.co/t/can-kibana-filter-by-parameter-from-javascript/241828 "2020-07-22T05:34:53Z")
Now i have creating a html website and i have embeded kibana iframe . I want to recieve parameter from website to filtering data to visualize in iframe thta I have embeded , Can't i do it? --- ## [Monitoring difference in count values on Kibana](https://discuss.elastic.co/t/monitoring-difference-in-count-values-on-kibana/240010)
**Author:** [@gaurav.raj917](https://discuss.elastic.co/u/gaurav.raj917)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 7:41pm UTC](https://discuss.elastic.co/t/monitoring-difference-in-count-values-on-kibana/240010 "2020-07-21T19:41:28Z")
I'm using metricbeat to push my application metrics to elasticsearch and then visualize it in Kibana. Metricbeat pushes metrics every 10 seconds to elasticsearch. My application is pushing count metric with different lab… --- ## [Reboot Hot nodes machine on elasticsearch cluster](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 5\ **Last updated:** [July 22, 2020, 5:13am UTC](https://discuss.elastic.co/t/reboot-hot-nodes-machine-on-elasticsearch-cluster/241481 "2020-07-22T05:13:27Z")
Hello Team We have docker based ELK setup with 17 nodes among which 4 nodes are hot nodes. Docker containers for all 4 hot nodes are on the same machine. The machine also contains one hyper node and one kibana docker co… --- ## [How to parse nested logs with JSON through logstash](https://discuss.elastic.co/t/how-to-parse-nested-logs-with-json-through-logstash/241781)
**Author:** [@Ranjan\_Bansal](https://discuss.elastic.co/u/Ranjan_Bansal)\ **Replies:** 4\ **Last updated:** [July 22, 2020, 4:59am UTC](https://discuss.elastic.co/t/how-to-parse-nested-logs-with-json-through-logstash/241781 "2020-07-22T04:59:04Z")
Hello All, I am facing issue while parsing nested JSON in my logs. I checked some of the posts over internet regarding nested JSON but none actually resolved my problem. There might be the case I am making some mistake … --- ## [Custom Sort in BAR Charts](https://discuss.elastic.co/t/custom-sort-in-bar-charts/241225)
**Author:** [@vikramnr](https://discuss.elastic.co/u/vikramnr)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 4:41am UTC](https://discuss.elastic.co/t/custom-sort-in-bar-charts/241225 "2020-07-22T04:41:21Z")
As title suggest, I'm trying to understand if there any ways to sort bars charts, Say if I have Critical, High, Medium & Low and if I try alphabetical descending or ascending I'm not achieving this order. Any help would… --- ## [High "took" time but low query time](https://discuss.elastic.co/t/high-took-time-but-low-query-time/241668)
**Author:** [@tawik](https://discuss.elastic.co/u/tawik)\ **Replies:** 5\ **Last updated:** [July 22, 2020, 4:20am UTC](https://discuss.elastic.co/t/high-took-time-but-low-query-time/241668 "2020-07-22T04:20:31Z")
Hello, We are trying to identify the source of high latency in our searches to our Elasticsearch cluster. Elasticsearch returns one field called "took" which is the time a request takes within ES (i.e. discounting time … --- ## [Exporting all documents from index but Excel is limited](https://discuss.elastic.co/t/exporting-all-documents-from-index-but-excel-is-limited/241855)
**Author:** [@ion\_popa](https://discuss.elastic.co/u/ion_popa)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 4:17am UTC](https://discuss.elastic.co/t/exporting-all-documents-from-index-but-excel-is-limited/241855 "2020-07-22T04:17:57Z")
Hello, I've been assigned a task to export all the documents from an index to a .csv file so I'm using Logstash for that but when I open up the .csv using Excel, I've reached the limit of 1,048,576 rows per sheet and I … --- ## [Gauge](https://discuss.elastic.co/t/gauge/242127)
**Author:** [@Sharissa](https://discuss.elastic.co/u/Sharissa)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 3:57am UTC](https://discuss.elastic.co/t/gauge/242127 "2020-07-22T03:57:07Z")
Hi Team, I have two numerical fields that contain Success & Error Transactions. I'd like setup gauge in percentages. Success %=(Success/Total)\*100 Error%=(Error/Total)\*100 This should leave me with a success & error … --- ## [Problem when using Elasticsearch and Tesseract-OCR](https://discuss.elastic.co/t/problem-when-using-elasticsearch-and-tesseract-ocr/238770)
**Author:** [@hanguyen.uet](https://discuss.elastic.co/u/hanguyen.uet)\ **Replies:** 14\ **Last updated:** [July 22, 2020, 3:48am UTC](https://discuss.elastic.co/t/problem-when-using-elasticsearch-and-tesseract-ocr/238770 "2020-07-22T03:48:12Z")
Hi everybody! I have a directory containing text data at /opt/data/. When a new file is uploaded to that directory. Is there a way to automatically use tesseract-ocr to convert to another language, then use elasticsearc… --- ## [Elasticsearch put role API](https://discuss.elastic.co/t/elasticsearch-put-role-api/239428)
**Author:** [@Hari\_Prasanth\_Logana](https://discuss.elastic.co/u/Hari_Prasanth_Logana)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 3:47am UTC](https://discuss.elastic.co/t/elasticsearch-put-role-api/239428 "2020-07-22T03:47:20Z")
I started using the create role API and it works as expected: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role.html I got the list of default roles in elastic search, /\_security/role … --- ## [Can ingest pipeline or logstash input plugin be configured in linux where log source is from mounted windows dir as nfs partition](https://discuss.elastic.co/t/can-ingest-pipeline-or-logstash-input-plugin-be-configured-in-linux-where-log-source-is-from-mounted-windows-dir-as-nfs-partition/241504)
**Author:** [@text2sky](https://discuss.elastic.co/u/text2sky)\ **Replies:** 2\ **Last updated:** [July 22, 2020, 3:03am UTC](https://discuss.elastic.co/t/can-ingest-pipeline-or-logstash-input-plugin-be-configured-in-linux-where-log-source-is-from-mounted-windows-dir-as-nfs-partition/241504 "2020-07-22T03:03:15Z")
can ingest pipeline or logstash input plugin be configured in linux where log source is from mounted windows dir as nfs partition Setup: logstash/ingest pipeline is running in linux App logs are getting stored in wind… --- ## [How to do script sorting with inner\_hits?](https://discuss.elastic.co/t/how-to-do-script-sorting-with-inner-hits/242129)
**Author:** [@yanlin.liu](https://discuss.elastic.co/u/yanlin.liu)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 2:52am UTC](https://discuss.elastic.co/t/how-to-do-script-sorting-with-inner-hits/242129 "2020-07-22T02:52:09Z")
I have an index with template like this: "properties": { "id": {"type": "long"}, "connections": { "type": "nested", "properties": { "connectionId": {"type": "long"}, "targetId": {"type": "long"}, "archive": {"typ… --- ## [Elasticsearch All Shards failed on cluster with multiple nodes on azure VM](https://discuss.elastic.co/t/elasticsearch-all-shards-failed-on-cluster-with-multiple-nodes-on-azure-vm/241809)
**Author:** [@pranav\_patwardhan](https://discuss.elastic.co/u/pranav_patwardhan)\ **Replies:** 6\ **Last updated:** [July 22, 2020, 2:39am UTC](https://discuss.elastic.co/t/elasticsearch-all-shards-failed-on-cluster-with-multiple-nodes-on-azure-vm/241809 "2020-07-22T02:39:49Z")
I have Elasticsearch cluster with 3 master nodes, 2 data nodes, and cluster node deployed on different Virtual Machine on Azure. It was working fine but suddenly it failed and now \[search\_phase\_execution\_exception\] all s… --- ## [Error while installing Kibana search guard plugin](https://discuss.elastic.co/t/error-while-installing-kibana-search-guard-plugin/242123)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 2:22am UTC](https://discuss.elastic.co/t/error-while-installing-kibana-search-guard-plugin/242123 "2020-07-22T02:22:29Z")
Hi All, i am getting this below error while installing the search guard plugin for kibana. i am using kibana version 7.2.0. I have installed the search guard plugin for elastic search but getting issues while configur… --- ## [Filebeat on Kubernetes with SSL to remote Elastic server](https://discuss.elastic.co/t/filebeat-on-kubernetes-with-ssl-to-remote-elastic-server/242126)
**Author:** [@rainfarmer](https://discuss.elastic.co/u/rainfarmer)\ **Replies:** 0\ **Last updated:** [July 22, 2020, 2:14am UTC](https://discuss.elastic.co/t/filebeat-on-kubernetes-with-ssl-to-remote-elastic-server/242126 "2020-07-22T02:14:30Z")
Hello! I'm trying to my filebeat kubernetes daemonset to talk to my remote elastic search server. It works when ssl is off. When ssl is on, it gets cert error. I downloaded the ca.crt from elastic. But I'm not sure h… --- ## [O365 get tenant authen token through proxy](https://discuss.elastic.co/t/o365-get-tenant-authen-token-through-proxy/239289)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [July 22, 2020, 1:30am UTC](https://discuss.elastic.co/t/o365-get-tenant-authen-token-through-proxy/239289 "2020-07-22T01:30:28Z")
Hi all. I have been trying to get o365 log using filebeat and there is apear to be a problems, the current filebeat that i am ussing need to get the authentication token but our serrver are put behind a proxy, is there… --- ## [Elasticsearch Installation - “jdk “ ” was unexpected at this time”](https://discuss.elastic.co/t/elasticsearch-installation-jdk-was-unexpected-at-this-time/242102)
**Author:** [@jatin\_w](https://discuss.elastic.co/u/jatin_w)\ **Replies:** 1\ **Last updated:** [July 22, 2020, 12:05am UTC](https://discuss.elastic.co/t/elasticsearch-installation-jdk-was-unexpected-at-this-time/242102 "2020-07-22T00:05:05Z")
Hello team, I am trying to install and configure Elasticsearch on - prem server. And as a prerequisite I have install Java 1.8 (8.02610.12) version But after running command to install Elasticsearch I am getting " “jd… --- ## [Parsing Error when changing Julian time on Logstashfilter](https://discuss.elastic.co/t/parsing-error-when-changing-julian-time-on-logstashfilter/242112)
**Author:** [@ben\_men](https://discuss.elastic.co/u/ben_men)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 11:43pm UTC](https://discuss.elastic.co/t/parsing-error-when-changing-julian-time-on-logstashfilter/242112 "2020-07-21T23:43:36Z")
I was trying to parse Julian time in Logstash and got dateparsefailure. Here is the log event I have 2020/197/21:13:57.605 FINE jdk.internal.event.EventHelper.logX509CertificateEvent Here is the filter I have: a… --- ## [Update mappings without having to delete indexes](https://discuss.elastic.co/t/update-mappings-without-having-to-delete-indexes/241870)
**Author:** [@g30](https://discuss.elastic.co/u/g30)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 11:27pm UTC](https://discuss.elastic.co/t/update-mappings-without-having-to-delete-indexes/241870 "2020-07-21T23:27:22Z")
Hi, We are using elastic search for a file storage api implementation where by files are stored with metadata and the metadata is stored to elastic search. We are having issues at the moment where by when we need to add… --- ## [Metricbeat reporting incorrect system.diskio.iostat.queue.avg\_size values](https://discuss.elastic.co/t/metricbeat-reporting-incorrect-system-diskio-iostat-queue-avg-size-values/242107)
**Author:** [@mferreira22](https://discuss.elastic.co/u/mferreira22)\ **Replies:** 0\ **Last updated:** [July 21, 2020, 10:27pm UTC](https://discuss.elastic.co/t/metricbeat-reporting-incorrect-system-diskio-iostat-queue-avg-size-values/242107 "2020-07-21T22:27:14Z")
I'm using Elastic's machine learning to detect anomalies in system usage data, one of the fields being system.diskio.iostat.queue.avg\_size. The data we are receiving occasionally reports anomalies in the disk IO average… --- ## [Logstash - parse to fields with grok](https://discuss.elastic.co/t/logstash-parse-to-fields-with-grok/242033)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 5\ **Last updated:** [July 21, 2020, 8:32pm UTC](https://discuss.elastic.co/t/logstash-parse-to-fields-with-grok/242033 "2020-07-21T20:32:24Z")
TL;DR at bottom I have a custom generated log file that I made that lists commands users run (along with some other thing). For that, I have got a grok script that successfully parses the message into fields. I've start… --- ## [Kibana Upgrade to 7.8 : FATAL CLI ERROR Error: ENOENT: no such file or directory](https://discuss.elastic.co/t/kibana-upgrade-to-7-8-fatal-cli-error-error-enoent-no-such-file-or-directory/239885)
**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\ **Replies:** 6\ **Last updated:** [July 21, 2020, 7:52pm UTC](https://discuss.elastic.co/t/kibana-upgrade-to-7-8-fatal-cli-error-error-enoent-no-such-file-or-directory/239885 "2020-07-21T19:52:41Z")
Upgraded from 7.7 to 7.8 elasticsearch works fine but kibana shows me this error : FATAL CLI ERROR Error: ENOENT: no such file or directory, open '/usr/share/kibana/config/kibana.yml' at Object.openSync (fs.js:443:3) … --- ## [Can winlogbeat push direct to http?](https://discuss.elastic.co/t/can-winlogbeat-push-direct-to-http/242081)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 1\ **Last updated:** [July 21, 2020, 7:37pm UTC](https://discuss.elastic.co/t/can-winlogbeat-push-direct-to-http/242081 "2020-07-21T19:37:50Z")
Hi, Is there any out of the box functionality for Winlogbeat to push direct to a http endpoint? (our personal API) Thanks --- ## [All nodes except Master show as “Offline” Monitoring Cluster 7.8.0](https://discuss.elastic.co/t/all-nodes-except-master-show-as-offline-monitoring-cluster-7-8-0/242068)
**Author:** [@vijay.sangha](https://discuss.elastic.co/u/vijay.sangha)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 7:22pm UTC](https://discuss.elastic.co/t/all-nodes-except-master-show-as-offline-monitoring-cluster-7-8-0/242068 "2020-07-21T19:22:35Z")
I have configured a single node dedicated Monitoring Cluster with Elastic Latest version 7.8.0. Trying to send Data from all my 9 Nodes ( 3 Master, 2 Coordinating, 4 Data Nodes), but in the Monitoring Cluster Kibana--\>St… --- ## [Follow a huge list of customer with kibana ML](https://discuss.elastic.co/t/follow-a-huge-list-of-customer-with-kibana-ml/240395)
**Author:** [@AmS](https://discuss.elastic.co/u/AmS)\ **Replies:** 3\ **Last updated:** [July 21, 2020, 7:10pm UTC](https://discuss.elastic.co/t/follow-a-huge-list-of-customer-with-kibana-ml/240395 "2020-07-21T19:10:05Z")
Hello, I would like to follow a specific list of customers defined by ip address. For our application deployment we do this in a number of steps like beta (which may concern more than 1000 customers). I would like to … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1912) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1914)