# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1965 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1966 --- ## [Why the color rendering is so different in Kibana?](https://discuss.elastic.co/t/why-the-color-rendering-is-so-different-in-kibana/239043)
**Author:** [@zhangyongzhe20](https://discuss.elastic.co/u/zhangyongzhe20)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 9:20am UTC](https://discuss.elastic.co/t/why-the-color-rendering-is-so-different-in-kibana/239043 "2020-06-29T09:20:37Z")
Recently, I noticed the diagram generated by the same color schema in Vega editor and Kibana vega is so different? I put the two screenshots for comparsion, one is in Vega editor and the other is in Kibana. Anyone can… --- ## [Exact match on fields of type "text" (beginning and end "anchored")](https://discuss.elastic.co/t/exact-match-on-fields-of-type-text-beginning-and-end-anchored/238435)
**Author:** [@ypid-geberit](https://discuss.elastic.co/u/ypid-geberit)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 9:13am UTC](https://discuss.elastic.co/t/exact-match-on-fields-of-type-text-beginning-and-end-anchored/238435 "2020-06-29T09:13:51Z")
Hi Is there a way to do an exact match on fields of type "text"? I mean ensure that all tokens are matched in the order specified and no additional tokens are contained in search result documents (no partial match)? I k… --- ## [Crashed when bulk write in high concurrency](https://discuss.elastic.co/t/crashed-when-bulk-write-in-high-concurrency/239083)
**Author:** [@JackYangzg](https://discuss.elastic.co/u/JackYangzg)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 9:12am UTC](https://discuss.elastic.co/t/crashed-when-bulk-write-in-high-concurrency/239083 "2020-06-29T09:12:19Z")
when bulk write in high concurrency, sometimes I got stacktrace like: 2020-06-29 16:04:50.735 ERROR xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx java.lang.NullPointerException: null at org.elasti… --- ## [Looking for kibana 6 config.js equivalent in 7.8](https://discuss.elastic.co/t/looking-for-kibana-6-config-js-equivalent-in-7-8/239069)
**Author:** [@MarcoRocco](https://discuss.elastic.co/u/MarcoRocco)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 8:31am UTC](https://discuss.elastic.co/t/looking-for-kibana-6-config-js-equivalent-in-7-8/239069 "2020-06-29T08:31:27Z")
Hey guys, I've been looking through the kibana 7.8 codebase for a place to store some variables that would be widely available one instantiated. In my previous custom kibana 6 version, I've used the config object to stor… --- ## [Can I search for special characters highlight in Elastic?](https://discuss.elastic.co/t/can-i-search-for-special-characters-highlight-in-elastic/239073)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 8:28am UTC](https://discuss.elastic.co/t/can-i-search-for-special-characters-highlight-in-elastic/239073 "2020-06-29T08:28:23Z")
I am using ElasticSearch RestHighLevelCilent api in java. Among them, use QueryStringQueryBuilder to input the string I want to search. Then, the matched string is wrapped around the tag with HighlightBuilder. Everyth… --- ## [.kibana\_1 and .kibana\_2 index diffrence](https://discuss.elastic.co/t/kibana-1-and-kibana-2-index-diffrence/238989)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 8:17am UTC](https://discuss.elastic.co/t/kibana-1-and-kibana-2-index-diffrence/238989 "2020-06-29T08:17:10Z")
Hello, can someone explain me the diffrence between .kibana\_1 and .kibana\_2 index. Regards --- ## [Break the string into terms](https://discuss.elastic.co/t/break-the-string-into-terms/239070)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 8:08am UTC](https://discuss.elastic.co/t/break-the-string-into-terms/239070 "2020-06-29T08:08:36Z")
Hi every one Lets imagine i have a field with this string "Hi my name is mohammad ali" what iam looking for is to break the string as below into the terms: Hi my my name name is is mohammad mohammad ali then i ne… --- ## [7.8v Dashboard file is not working on 7.7.1v of Kibana](https://discuss.elastic.co/t/7-8v-dashboard-file-is-not-working-on-7-7-1v-of-kibana/238826)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 5\ **Last updated:** [June 29, 2020, 7:48am UTC](https://discuss.elastic.co/t/7-8v-dashboard-file-is-not-working-on-7-7-1v-of-kibana/238826 "2020-06-29T07:48:13Z")
When i try to download the dashboard file from Kibana 7.8v and import it into kibana 7.7.1v it is showing me that there is some error. Do i have to change anything in 7.8th version of Kibana dashboard to work on 7.7.1 --- ## [Filebeat putting too much load on the system. Seems to be related to gc.log](https://discuss.elastic.co/t/filebeat-putting-too-much-load-on-the-system-seems-to-be-related-to-gc-log/238966)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 7:46am UTC](https://discuss.elastic.co/t/filebeat-putting-too-much-load-on-the-system-seems-to-be-related-to-gc-log/238966 "2020-06-29T07:46:20Z")
On our elastic 7.7.1 stack, when we enabled our elastic log ingestion via filebeat, we saw a significant load on our data and ingestion nodes. Our log path parameter was defined as /var/log/elasticsearch/\*.json and all … --- ## [Failed to get audit status before adding rules](https://discuss.elastic.co/t/failed-to-get-audit-status-before-adding-rules/239060)
**Author:** [@martin.ellis](https://discuss.elastic.co/u/martin.ellis)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 7:37am UTC](https://discuss.elastic.co/t/failed-to-get-audit-status-before-adding-rules/239060 "2020-06-29T07:37:22Z")
When I start auditbeat I get this error message 2020-06-29T14:49:06.560+1000 ERROR \[auditd\] auditd/audit\_linux.go:148 Failure adding audit rules {"error": "failed to get audit status before adding… --- ## [Export logs from Azure event Hub to Elastic Cloud managed elastic search](https://discuss.elastic.co/t/export-logs-from-azure-event-hub-to-elastic-cloud-managed-elastic-search/239065)
**Author:** [@Kanthu\_Canty](https://discuss.elastic.co/u/Kanthu_Canty)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 7:35am UTC](https://discuss.elastic.co/t/export-logs-from-azure-event-hub-to-elastic-cloud-managed-elastic-search/239065 "2020-06-29T07:35:39Z")
Hell Team, I am working on a solution, where we are using Azure Managed resources and these Azure managed resource logs need to be sent/export to elastic cloud managed elastic search and Kibana. How can we achieve this … --- ## [Watcher for report with attachment failed due to ssl handshake exception](https://discuss.elastic.co/t/watcher-for-report-with-attachment-failed-due-to-ssl-handshake-exception/238924)
**Author:** [@vinayak](https://discuss.elastic.co/u/vinayak)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 7:08am UTC](https://discuss.elastic.co/t/watcher-for-report-with-attachment-failed-due-to-ssl-handshake-exception/238924 "2020-06-29T07:08:47Z")
Unable to send reporting attachment by the help of watcher. My watch query : PUT \_watcher/watch/sample\_report\_ssl { "trigger" : { "schedule": { "interval": "1m" } }, "actions" : { "email\_admin" … --- ## [Convert text field containg xml string](https://discuss.elastic.co/t/convert-text-field-containg-xml-string/238856)
**Author:** [@Mips128](https://discuss.elastic.co/u/Mips128)\ **Replies:** 5\ **Last updated:** [June 29, 2020, 6:57am UTC](https://discuss.elastic.co/t/convert-text-field-containg-xml-string/238856 "2020-06-29T06:57:54Z")
Hi, I am pretty new to elasticsearch and I have a problem that I can't even solve using google. Therefore, I really appreciate any help. I use a tool (log2timeline) to create an Index and add data to it. I am not able … --- ## [Potential race condition in ChildMemoryCircuitBreaker.limit()](https://discuss.elastic.co/t/potential-race-condition-in-childmemorycircuitbreaker-limit/238996)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 0\ **Last updated:** [June 28, 2020, 9:51am UTC](https://discuss.elastic.co/t/potential-race-condition-in-childmemorycircuitbreaker-limit/238996 "2020-06-28T09:51:15Z")
In the method of ChildMemoryCircuitBreaker.addEstimateBytesAndMaybeBreak(), the limit() method would atomically compare and set the used value. when we test the high qps query to ES-node, the major cost is ChildMemoryCi… --- ## [Is there a performance issue if all the primary shards are located on a single node?](https://discuss.elastic.co/t/is-there-a-performance-issue-if-all-the-primary-shards-are-located-on-a-single-node/239035)
**Author:** [@Webtrend\_Inc](https://discuss.elastic.co/u/Webtrend_Inc)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 6:55am UTC](https://discuss.elastic.co/t/is-there-a-performance-issue-if-all-the-primary-shards-are-located-on-a-single-node/239035 "2020-06-29T06:55:36Z")
We have a 3 node data cluster that contains index with 3 primary shards and 2 replica Initially, each data node had 1 primary shard but when we had to replace one of the data nodes recently, all the primary shards are n… --- ## [Negating filter (RestHighLevelClient)](https://discuss.elastic.co/t/negating-filter-resthighlevelclient/239061)
**Author:** [@Thomas\_E](https://discuss.elastic.co/u/Thomas_E)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 6:51am UTC](https://discuss.elastic.co/t/negating-filter-resthighlevelclient/239061 "2020-06-29T06:51:59Z")
I have BoolQueryBuilder queryBuilder = boolQuery(); queryBuilder.filter(termQuery(...)) and now want to add a filter with a negated condition. With BoolQueryBuilder queryBuilder = boolQuery(); queryBuilder.filter(ter… --- ## [Read data from ElasticSearch data using vega](https://discuss.elastic.co/t/read-data-from-elasticsearch-data-using-vega/238670)
**Author:** [@issaissa](https://discuss.elastic.co/u/issaissa)\ **Replies:** 6\ **Last updated:** [June 29, 2020, 6:39am UTC](https://discuss.elastic.co/t/read-data-from-elasticsearch-data-using-vega/238670 "2020-06-29T06:39:14Z")
This is my vega code: { $schema: https://vega.github.io/schema/vega-lite/v2.json data: { url: { %context%: true %timefield%: "incident\_date\_time" index: incident\* body: { … --- ## [Is it possible to JOIN different indexes? Or is there a way to achieve an equivalent effect?](https://discuss.elastic.co/t/is-it-possible-to-join-different-indexes-or-is-there-a-way-to-achieve-an-equivalent-effect/239059)
**Author:** [@fuqda](https://discuss.elastic.co/u/fuqda)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 6:31am UTC](https://discuss.elastic.co/t/is-it-possible-to-join-different-indexes-or-is-there-a-way-to-achieve-an-equivalent-effect/239059 "2020-06-29T06:31:48Z")
Is it possible to JOIN different indexes? Or is there a way to achieve an equivalent effect? If you change the existing mapping, I think you will have to re-populate the index with data again. I would like to create a … --- ## [Grok pattern is working if the "input" is a file, but not if the "input" is beats](https://discuss.elastic.co/t/grok-pattern-is-working-if-the-input-is-a-file-but-not-if-the-input-is-beats/238935)
**Author:** [@Aj\_t](https://discuss.elastic.co/u/Aj_t)\ **Replies:** 2\ **Last updated:** [June 27, 2020, 6:37pm UTC](https://discuss.elastic.co/t/grok-pattern-is-working-if-the-input-is-a-file-but-not-if-the-input-is-beats/238935 "2020-06-27T18:37:24Z")
Sorry about the long post. I have a multi-line CAS log I am shipping via filebeats to logstash running on a different server. Here's a sample of the original multi-line log: 2020-06-21 00:24:00,833 INFO \[org.apereo.ins… --- ## [Kibana Calculate Difference in Percentage Between 2 Values](https://discuss.elastic.co/t/kibana-calculate-difference-in-percentage-between-2-values/239056)
**Author:** [@muthucse](https://discuss.elastic.co/u/muthucse)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 5:23am UTC](https://discuss.elastic.co/t/kibana-calculate-difference-in-percentage-between-2-values/239056 "2020-06-29T05:23:05Z")
Hello All, I was trying to calculate the difference in percentage. Not able to do in kibana with the below values. Last 7 day avg. (5) Today's avg. (2.5) Difference in Percentage: 100 % How to achieve this ? --- ## [How to change output data format in winlogbeat as influx](https://discuss.elastic.co/t/how-to-change-output-data-format-in-winlogbeat-as-influx/239053)
**Author:** [@kumarbn](https://discuss.elastic.co/u/kumarbn)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 5:07am UTC](https://discuss.elastic.co/t/how-to-change-output-data-format-in-winlogbeat-as-influx/239053 "2020-06-29T05:07:25Z")
unable to change output data format as influx . currently getting alert in json format on kafka server ..please provide suggestions --- ## [Slowlog not created on all nodes](https://discuss.elastic.co/t/slowlog-not-created-on-all-nodes/239050)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 4:25am UTC](https://discuss.elastic.co/t/slowlog-not-created-on-all-nodes/239050 "2020-06-29T04:25:07Z")
Hello, I am trying to create and monitor slowlogs. I have configured for testing purposes PUT /index\*/\_settings { "index.search.slowlog.threshold.query.warn": "0s", "index.search.slowlog.threshold.query.info":… --- ## [SSL Transport setup with Ansible](https://discuss.elastic.co/t/ssl-transport-setup-with-ansible/237993)
**Author:** [@biggtimber](https://discuss.elastic.co/u/biggtimber)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 3:54am UTC](https://discuss.elastic.co/t/ssl-transport-setup-with-ansible/237993 "2020-06-29T03:54:06Z")
How do normal installations of the elasticstack work with SSL Transport/HTTP when using Ansible? I'm using the github ansible role setup. From the documentation, it shows the cert setup using elasticsearch-certutil to g… --- ## [Can not run kibana by source code](https://discuss.elastic.co/t/can-not-run-kibana-by-source-code/238397)
**Author:** [@Fent](https://discuss.elastic.co/u/Fent)\ **Replies:** 6\ **Last updated:** [June 29, 2020, 3:44am UTC](https://discuss.elastic.co/t/can-not-run-kibana-by-source-code/238397 "2020-06-29T03:44:27Z")
Hi, I try to run kibana by source code ,but it seem no work well This my step: Step1 Download the kibana source code download from https://github.com/elastic/kibana/archive/v7.4.2.zip and unzip to d:\\elk\\kibana … --- ## [Add format to docvalues in elasticsearch js client request](https://discuss.elastic.co/t/add-format-to-docvalues-in-elasticsearch-js-client-request/239045)
**Author:** [@sudosu](https://discuss.elastic.co/u/sudosu)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:09am UTC](https://discuss.elastic.co/t/add-format-to-docvalues-in-elasticsearch-js-client-request/239045 "2020-06-29T03:09:50Z")
Hi, Using the Elasticsearch client js, I am able to add the doc values to the request like so: callWithRequest(\_req, 'search', { index: indexPatternTitle, scroll: '1m', body: body, docvalue\_fields:'time… --- ## [How to improve the accuracy of Unique Count metric in Kibana](https://discuss.elastic.co/t/how-to-improve-the-accuracy-of-unique-count-metric-in-kibana/239012)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 2:29am UTC](https://discuss.elastic.co/t/how-to-improve-the-accuracy-of-unique-count-metric-in-kibana/239012 "2020-06-29T02:29:00Z")
Hi, I am seeing some differences in the counts. Background: Number of documents: 1,384,896 Unique counts of fields A, B and C are reported as : 3641, 3791, 3799 With {"precision\_threshold":40000} Unique counts of fie… --- ## [\[Kibana\] How to divide using the sum of two columns?](https://discuss.elastic.co/t/kibana-how-to-divide-using-the-sum-of-two-columns/239037)
**Author:** [@skyskai](https://discuss.elastic.co/u/skyskai)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 1:31am UTC](https://discuss.elastic.co/t/kibana-how-to-divide-using-the-sum-of-two-columns/239037 "2020-06-29T01:31:26Z")
I want to construct a new column by dividing the sum of column A by the sum of column B as shown below. '--------------------------------------------------------------------------------- | Date | Sum of Col A… --- ## [Elasticsearch failed when i try to setup x-pack](https://discuss.elastic.co/t/elasticsearch-failed-when-i-try-to-setup-x-pack/238984)
**Author:** [@Amine\_Aloui](https://discuss.elastic.co/u/Amine_Aloui)\ **Replies:** 6\ **Last updated:** [June 29, 2020, 12:30am UTC](https://discuss.elastic.co/t/elasticsearch-failed-when-i-try-to-setup-x-pack/238984 "2020-06-29T00:30:56Z")
when i try to setup x-pack in remote server i have some issues (in my local ,it works perfectly) ,but it dosn't in remote sever first : vi /etc/elasticsearch/elasticsearch.yml i add this option: xpack.security.enabl… --- ## [Mapping for object with dynamic keys](https://discuss.elastic.co/t/mapping-for-object-with-dynamic-keys/238993)
**Author:** [@luckyb56](https://discuss.elastic.co/u/luckyb56)\ **Replies:** 1\ **Last updated:** [June 28, 2020, 11:56pm UTC](https://discuss.elastic.co/t/mapping-for-object-with-dynamic-keys/238993 "2020-06-28T23:56:59Z")
Have a document like this: { "stats": { "fruits.v:apple": 30, "fruits.v:orange": 150, "vegetables.v: broccoli": 40 } } Can I keep the key name as is? What kind of dynami… --- ## [Can any kibana version greater than 6.5 be used to connect to elasticsearch 6.5?](https://discuss.elastic.co/t/can-any-kibana-version-greater-than-6-5-be-used-to-connect-to-elasticsearch-6-5/239033)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 1\ **Last updated:** [June 28, 2020, 9:51pm UTC](https://discuss.elastic.co/t/can-any-kibana-version-greater-than-6-5-be-used-to-connect-to-elasticsearch-6-5/239033 "2020-06-28T21:51:31Z")
Can any kibana version greater than 6.5 (e.g. 6.7, 6.8 or 7.x) be used to connect to elasticsearch 6.5? My understanding is that they should be compatible (same version with elasticsearch). Is it true? Thank you in adv… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1964) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1966)