# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1943 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1944 --- ## [Query multiple indexes](https://discuss.elastic.co/t/query-multiple-indexes/240396)
**Author:** [@sai\_16](https://discuss.elastic.co/u/sai_16)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 9:42pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396 "2020-07-08T21:42:38Z")
I need to perform this,how is it possible? I have index1 - with cpu,mem,hostname details. index-2 with location details. Now i need to fetch cpu,mem information of hostnames starting with host\* and location is bgl.How… --- ## [Matching combined words in elasticsearch?](https://discuss.elastic.co/t/matching-combined-words-in-elasticsearch/240284)
**Author:** [@jnatten](https://discuss.elastic.co/u/jnatten)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 7:32am UTC](https://discuss.elastic.co/t/matching-combined-words-in-elasticsearch/240284 "2020-07-08T07:32:54Z")
Hi, We're using Elasticsearch for providing content search for users on our website, and I have a question regarding combined/compound words. In our language (Norwegian) "combined words" are a very regular occurrence, … --- ## [Need to fetch Avg CPU values for a particular set of hosts](https://discuss.elastic.co/t/need-to-fetch-avg-cpu-values-for-a-particular-set-of-hosts/240323)
**Author:** [@sai\_16](https://discuss.elastic.co/u/sai_16)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 10:29am UTC](https://discuss.elastic.co/t/need-to-fetch-avg-cpu-values-for-a-particular-set-of-hosts/240323 "2020-07-08T10:29:35Z")
I want to fetch all the records of avg cpu and memory usage for a particular set of hosts,with one hour of granularity. I'm using below query { "size": 0, "\_source" : \["@timestamp","beat.name","system.memory.used.pct",… --- ## [RSS Feeds ingestion](https://discuss.elastic.co/t/rss-feeds-ingestion/240332)
**Author:** [@anu\_gaur](https://discuss.elastic.co/u/anu_gaur)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 11:16am UTC](https://discuss.elastic.co/t/rss-feeds-ingestion/240332 "2020-07-08T11:16:26Z")
Hi, I have elasticsearch on elastic cloud deployment. I want to ingest RSS feeds into the elasticsearch on elastic cloud. Could you please guide for the same. --- ## [Received response for a request that has timed out Issue & \[o.e.c.c.C.CoordinatorPublication\] \[Master Node Name\] after \[30s\] publication of cluster state version \[number\] is still waiting for {Data Node Name}](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out-issue-o-e-c-c-c-coordinatorpublication-master-node-name-after-30s-publication-of-cluster-state-version-number-is-still-waiting-for-data-node-name/240353)
**Author:** [@ankitag79](https://discuss.elastic.co/u/ankitag79)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 1:31pm UTC](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out-issue-o-e-c-c-c-coordinatorpublication-master-node-name-after-30s-publication-of-cluster-state-version-number-is-still-waiting-for-data-node-name/240353 "2020-07-08T13:31:46Z")
Hi, Obviously, this error indicates cluster overload but this has become more frequent after adding more data nodes to cluster and separating out master only nodes. Also the throughput of the cluster has reduced. There… --- ## [Fetching all the buckets using Composite Search](https://discuss.elastic.co/t/fetching-all-the-buckets-using-composite-search/240381)
**Author:** [@ankitagarwal9156](https://discuss.elastic.co/u/ankitagarwal9156)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 3:30pm UTC](https://discuss.elastic.co/t/fetching-all-the-buckets-using-composite-search/240381 "2020-07-08T15:30:09Z")
Is there any way to fetch all the buckets (without pagination) using composite aggregation? Right now by default 10 buckets are returned. --- ## [\[script\_exception\] runtime error bad request](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/240397)
**Author:** [@rob2020](https://discuss.elastic.co/u/rob2020)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 9:30pm UTC](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/240397 "2020-07-08T21:30:17Z")
Hi, I am new in Kibana .So I added a scripted field in one of the index pattern. I am pretty sure the code should work fine. if (doc\['message.keyword'\].value.contains('errCode')) { return "match"; } return "No match"; W… --- ## [Hora errada en el Log de Kibana](https://discuss.elastic.co/t/hora-errada-en-el-log-de-kibana/238754)
**Author:** [@Consultoria\_SI](https://discuss.elastic.co/u/Consultoria_SI)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 9:21pm UTC](https://discuss.elastic.co/t/hora-errada-en-el-log-de-kibana/238754 "2020-07-08T21:21:31Z")
Buenas Tardes, Tengo instalado kibana y cuando quiero validar el log me sale una hora diferente a la configurada en el sistema. ¿Alguna forma solucionar este problema? --- ## [How to fetch the count of the documents from the sql query translate](https://discuss.elastic.co/t/how-to-fetch-the-count-of-the-documents-from-the-sql-query-translate/240394)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 4:06pm UTC](https://discuss.elastic.co/t/how-to-fetch-the-count-of-the-documents-from-the-sql-query-translate/240394 "2020-07-08T16:06:46Z")
I translate this elastic query sql POST \_sql?translate { "query": "SELECT HISTOGRAM(\\"@timestamp\\", INTERVAL 1 MONTH) AS month, count(DISTINCT(ID)) as id\_count, report\_period FROM \\"indexname-\*\\" WHERE \\"@t… --- ## [Horizontal Bar calculation string](https://discuss.elastic.co/t/horizontal-bar-calculation-string/240341)
**Author:** [@Anton91](https://discuss.elastic.co/u/Anton91)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 8:41pm UTC](https://discuss.elastic.co/t/horizontal-bar-calculation-string/240341 "2020-07-08T20:41:55Z")
Hello, i have the following question: I have a string field and i want to count it and then divide it by the sum and calculate \*100 at the end. Theoretically I want to find out what percentage of each application uses a… --- ## [The docker module seems missing](https://discuss.elastic.co/t/the-docker-module-seems-missing/240393)
**Author:** [@lyrixx](https://discuss.elastic.co/u/lyrixx)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 8:23pm UTC](https://discuss.elastic.co/t/the-docker-module-seems-missing/240393 "2020-07-08T20:23:33Z")
Hello, I saw this announcement https://www.elastic.co/fr/blog/brewing-in-beats-new-sample-dashboards-for-docker-and-redis so I wanted to try But I can not find the docker dashboard in kibana So I look at the code, and … --- ## [Specifying match\_phrases to search for dynamically](https://discuss.elastic.co/t/specifying-match-phrases-to-search-for-dynamically/238537)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 8:21pm UTC](https://discuss.elastic.co/t/specifying-match-phrases-to-search-for-dynamically/238537 "2020-07-08T20:21:25Z")
I have a list of bigrams that I would like to search for. How can I specify each of them dynamically ? "query" : { "bool" : { "must": \[ … --- ## [Curator "regular expression matching with timestrings"](https://discuss.elastic.co/t/curator-regular-expression-matching-with-timestrings/240401)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 8:05pm UTC](https://discuss.elastic.co/t/curator-regular-expression-matching-with-timestrings/240401 "2020-07-08T20:05:15Z")
Curator docs say What this means is that a simple timestring to match year and month, %Y.%m will result in a regular expression like this: ^.\*\\d{4}\\.\\d{2}.\*$ . This pattern will match any 4 digits, followed by a period… --- ## [Parsing Error Logs with line breaks](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419)
**Author:** [@milkene](https://discuss.elastic.co/u/milkene)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 7:49pm UTC](https://discuss.elastic.co/t/parsing-error-logs-with-line-breaks/240419 "2020-07-08T19:49:27Z")
Hi, I am trying to parse logs with Logstash using Grok filters. Most of the logs are a single line but some have line breaks and spaces between them. Is there a way to get Logstash to recognize them as one log rather tha… --- ## [Simple query string, default operator and, doesn't work with nested objects](https://discuss.elastic.co/t/simple-query-string-default-operator-and-doesnt-work-with-nested-objects/240426)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 7:48pm UTC](https://discuss.elastic.co/t/simple-query-string-default-operator-and-doesnt-work-with-nested-objects/240426 "2020-07-08T19:48:36Z")
Hello everyone, as mentioned in the title, seem like simple\_query\_string with default operator and doesn't work with nested data type. For example, i have a mapping like bellow: PUT test1 { "mappings": { "propert… --- ## [Dissect combined with multiline pattern gives errors](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728)
**Author:** [@kainazzzo](https://discuss.elastic.co/u/kainazzzo)\ **Replies:** 5\ **Last updated:** [July 8, 2020, 7:40pm UTC](https://discuss.elastic.co/t/dissect-combined-with-multiline-pattern-gives-errors/239728 "2020-07-08T19:40:19Z")
I have log files being picked up and dissected fine when they are single line. I even have a multi line pattern ensuring that the message attribute contains all the lines I want. What I can't seem to figure out is how t… --- ## [Creating dropdowns within a dashboard to select particular visualisation](https://discuss.elastic.co/t/creating-dropdowns-within-a-dashboard-to-select-particular-visualisation/240224)
**Author:** [@Ram2416](https://discuss.elastic.co/u/Ram2416)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 7:39pm UTC](https://discuss.elastic.co/t/creating-dropdowns-within-a-dashboard-to-select-particular-visualisation/240224 "2020-07-08T19:39:14Z")
Hi, I've currently multiple visualizations embedded within a dashboard. When I open the dashboard, What I see is all the visualizations present in the dashboard all at once. I would like to know if there is any way aro… --- ## [Using G1GC in ES 7.7.0](https://discuss.elastic.co/t/using-g1gc-in-es-7-7-0/239547)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 6:52pm UTC](https://discuss.elastic.co/t/using-g1gc-in-es-7-7-0/239547 "2020-07-08T18:52:02Z")
Hello Guys, I am using ES 7.7.0 JDK is bin/java --version openjdk 14 2020-03-17 OpenJDK Runtime Environment AdoptOpenJDK (build 14+36) OpenJDK 64-Bit Server VM AdoptOpenJDK (build 14+36, mixed mode, sharing) -Xm… --- ## [Different results in different graphs - same data in kibana](https://discuss.elastic.co/t/different-results-in-different-graphs-same-data-in-kibana/240292)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 6:51pm UTC](https://discuss.elastic.co/t/different-results-in-different-graphs-same-data-in-kibana/240292 "2020-07-08T18:51:22Z")
Hi, I'm using this visualization in kibana - filebeat : Top pages \[Filebeat Nginx\] ECS In the (Time Series) , I can see that robots.txt has 5 visits, but when switching to the (Top N) tab robots.txt value is zero! Als… --- ## [Nodes frequently removed from cluster version 7.3.2](https://discuss.elastic.co/t/nodes-frequently-removed-from-cluster-version-7-3-2/237334)
**Author:** [@jleezer](https://discuss.elastic.co/u/jleezer)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 6:06pm UTC](https://discuss.elastic.co/t/nodes-frequently-removed-from-cluster-version-7-3-2/237334 "2020-07-08T18:06:40Z")
This issue has been plaguing us for quite sometime and various attempts at solving it haven't produced anything. Any help is greatly appreciated. We're seeing issues where the data nodes drop from the cluster. Sometimes … --- ## [Getting Error in ingest pipeline](https://discuss.elastic.co/t/getting-error-in-ingest-pipeline/240042)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 5:20pm UTC](https://discuss.elastic.co/t/getting-error-in-ingest-pipeline/240042 "2020-07-08T17:20:52Z")
Hi, We are using filebeat and ingest pipeline to load the csv data file. if the last value is null in any line, getting error while mapping the field headers in ingest pipeline for those lines. Sample ingest pipeline: … --- ## [Problem removing nested object using UpdateByQuery](https://discuss.elastic.co/t/problem-removing-nested-object-using-updatebyquery/240409)
**Author:** [@maynestream](https://discuss.elastic.co/u/maynestream)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 5:15pm UTC](https://discuss.elastic.co/t/problem-removing-nested-object-using-updatebyquery/240409 "2020-07-08T17:15:25Z")
Hi all, Apologies if there are similar answers, I have extensively searched, but this does appear to be quite a niche problem. As the title suggests, I have a scenario where I am using UpdateByQuery (java API) using gr… --- ## [Register FieldFormat plugin in v. 7.6.2](https://discuss.elastic.co/t/register-fieldformat-plugin-in-v-7-6-2/240408)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 5:13pm UTC](https://discuss.elastic.co/t/register-fieldformat-plugin-in-v-7-6-2/240408 "2020-07-08T17:13:45Z")
This is basically the same question as this post: But this one does not have a solution, at the very least the last post does not solve my issue. Although I believe there are typos in the last post also. I am trying t… --- ## [Flatten json and create dynamic field](https://discuss.elastic.co/t/flatten-json-and-create-dynamic-field/240360)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [July 8, 2020, 5:03pm UTC](https://discuss.elastic.co/t/flatten-json-and-create-dynamic-field/240360 "2020-07-08T17:03:23Z")
I know ruby will be involve I have try few code that I found on forum. but didn't work out here is my input message =\> '{"jobid":348332180, "runtime":{"cputime": 24, "totalelapsed": 105},"dataflow":\[{"gate": "v204.06",… --- ## [Firewall cisco ASA and beats](https://discuss.elastic.co/t/firewall-cisco-asa-and-beats/239612)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 5\ **Last updated:** [July 8, 2020, 4:28pm UTC](https://discuss.elastic.co/t/firewall-cisco-asa-and-beats/239612 "2020-07-08T16:28:51Z")
Hello , i am using elasticsearch and kibana on server centos 7 , i have configured beats directly sent to elasticsearch ( without need to configure logstash) and it works perfectly from both centos agents and windows age… --- ## [Logstash windows memory offset delete](https://discuss.elastic.co/t/logstash-windows-memory-offset-delete/240347)
**Author:** [@amaleswar](https://discuss.elastic.co/u/amaleswar)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 4:17pm UTC](https://discuss.elastic.co/t/logstash-windows-memory-offset-delete/240347 "2020-07-08T16:17:28Z")
Hello Team, I want to delete anything after dll, example showing below. I\`m trying to use mutate gsub but failing Parsed data: "CallTrace" =\> \[ \[ 0\] "c:\\windows\\system32\\nll.dll+92c34", \[ 1\] "c:\\windows\\system32\\ker… --- ## [Find documents that might have unindexed fields](https://discuss.elastic.co/t/find-documents-that-might-have-unindexed-fields/239709)
**Author:** [@ddreier](https://discuss.elastic.co/u/ddreier)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 4:14pm UTC](https://discuss.elastic.co/t/find-documents-that-might-have-unindexed-fields/239709 "2020-07-08T16:14:03Z")
We recently disabled dynamic field mapping on one of our logging index templates after a field explosion basically took down our cluster. Most documents (log lines) coming into the indices should only have fields that a… --- ## [Grouping of similar errors](https://discuss.elastic.co/t/grouping-of-similar-errors/240399)
**Author:** [@Shloka](https://discuss.elastic.co/u/Shloka)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 4:13pm UTC](https://discuss.elastic.co/t/grouping-of-similar-errors/240399 "2020-07-08T16:13:49Z")
Hi I'm looking for help with logstash configuration We have filebeat on the target servers which reads the log lines and sends to logstash installed on another central server. The logstash further filters the lines bas… --- ## [Netinfo data not added to events using add\_host\_metadata processor](https://discuss.elastic.co/t/netinfo-data-not-added-to-events-using-add-host-metadata-processor/240387)
**Author:** [@ricalo](https://discuss.elastic.co/u/ricalo)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 3:57pm UTC](https://discuss.elastic.co/t/netinfo-data-not-added-to-events-using-add-host-metadata-processor/240387 "2020-07-08T15:57:25Z")
I'm trying to add host.ip and host.mac fields to filebeat events, but the fields are not showing up in Kibana. I'm using the following related configuration in filebeat.yml: processors: - add\_host\_metadata: net… --- ## [Control Visualization List Filtering on scripted metric field](https://discuss.elastic.co/t/control-visualization-list-filtering-on-scripted-metric-field/226286)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 17\ **Last updated:** [July 8, 2020, 3:56pm UTC](https://discuss.elastic.co/t/control-visualization-list-filtering-on-scripted-metric-field/226286 "2020-07-08T15:56:14Z")
I have several Kibana dashboards that use Option List control filters to allow users to easily filter data. Many of the fields that I filter on for the list are scripted fields in the index. This works great most of the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1942) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1944)