# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1972 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1973 --- ## [Ingest Attachment Plugin: How to add data to an existing array?](https://discuss.elastic.co/t/ingest-attachment-plugin-how-to-add-data-to-an-existing-array/238651)
**Author:** [@Sven.0](https://discuss.elastic.co/u/Sven.0)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 1:36pm UTC](https://discuss.elastic.co/t/ingest-attachment-plugin-how-to-add-data-to-an-existing-array/238651 "2020-06-25T13:36:08Z")
Hi :slightly\_smiling\_face: I'm a beginner to Elasticsearch, so maybe this is simple to solve, but I haven't found a solution to my problem: I have an object with an array containing attachment data, and I want to be ab… --- ## [OSS Version to Basic Version](https://discuss.elastic.co/t/oss-version-to-basic-version/238652)
**Author:** [@Anthony\_Whitehead](https://discuss.elastic.co/u/Anthony_Whitehead)\ **Replies:** 5\ **Last updated:** [June 25, 2020, 1:22pm UTC](https://discuss.elastic.co/t/oss-version-to-basic-version/238652 "2020-06-25T13:22:27Z")
Hi, I've been tasked with deciding where we move with Elastic & Kibana, we're currently on 6.8 and have an OSS version, we also have an aweful lot of data and we will NOT be able to reingest this. Having just watched Ela… --- ## [Kibana : Unexpected token \< in JSON at position 1](https://discuss.elastic.co/t/kibana-unexpected-token-in-json-at-position-1/238674)
**Author:** [@krpatel19](https://discuss.elastic.co/u/krpatel19)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 12:53pm UTC](https://discuss.elastic.co/t/kibana-unexpected-token-in-json-at-position-1/238674 "2020-06-25T12:53:53Z")
We are getting below exceptions while accessing Elasticsearch through GCP https load balancer. It is happening for KIbana endpoint as well as for elasticsearch endpoint made for application configured as internal http LB… --- ## [Unable to connect between elastic search and kibana](https://discuss.elastic.co/t/unable-to-connect-between-elastic-search-and-kibana/238667)
**Author:** [@neelbasu](https://discuss.elastic.co/u/neelbasu)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 12:35pm UTC](https://discuss.elastic.co/t/unable-to-connect-between-elastic-search-and-kibana/238667 "2020-06-25T12:35:55Z")
We have elastic search on a VM and Kibana on the server. We have changed the yml file in elastic search - server IP and port of elastic search. Eg 10.142.425.3:9200 But we are unable to connect to the server Error :: U… --- ## [How to change background of login page in kibana 7.6.0?](https://discuss.elastic.co/t/how-to-change-background-of-login-page-in-kibana-7-6-0/234494)
**Author:** [@Emna1](https://discuss.elastic.co/u/Emna1)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 12:35pm UTC](https://discuss.elastic.co/t/how-to-change-background-of-login-page-in-kibana-7-6-0/234494 "2020-06-25T12:35:06Z")
Hi, Please i want to remove imgs in login page of kibana 7.6.0 and i want to add my own img in backgroud , how can i do that please? --- ## [Create Scripted Field using substring before "."](https://discuss.elastic.co/t/create-scripted-field-using-substring-before/238096)
**Author:** [@giacman](https://discuss.elastic.co/u/giacman)\ **Replies:** 10\ **Last updated:** [June 25, 2020, 12:20pm UTC](https://discuss.elastic.co/t/create-scripted-field-using-substring-before/238096 "2020-06-25T12:20:12Z")
I'm trying to create a Scripted Field for a dashboard in Kibana. My original field is called topic and has the following values, as an example: a b a.c b.f a.c.d b.e.t I would like to build a r… --- ## [Not able to perform exact search](https://discuss.elastic.co/t/not-able-to-perform-exact-search/238654)
**Author:** [@aravinda](https://discuss.elastic.co/u/aravinda)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 12:09pm UTC](https://discuss.elastic.co/t/not-able-to-perform-exact-search/238654 "2020-06-25T12:09:25Z")
Iam not able to perform the exact search with the below json query. "query":{ "match":{ "fieldName":"metaData.domainName", "value" :"Business Resiliency" } } Iam getting all the record like "Transaction Resiliency… --- ## [Installing NPM Packages for Plugin Development](https://discuss.elastic.co/t/installing-npm-packages-for-plugin-development/237707)
**Author:** [@s-newman](https://discuss.elastic.co/u/s-newman)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 11:58am UTC](https://discuss.elastic.co/t/installing-npm-packages-for-plugin-development/237707 "2020-06-25T11:58:25Z")
I am developing a Kibana plugin for a personal project, and I would like to install an NPM package for my plugin to use. Specifically, I would like to install eslint-plugin-react-hooks as a development dependency. Unfor… --- ## [Kibana high availability configuration](https://discuss.elastic.co/t/kibana-high-availability-configuration/238650)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 11:37am UTC](https://discuss.elastic.co/t/kibana-high-availability-configuration/238650 "2020-06-25T11:37:28Z")
Hi All, We have a two node elasticsearch cluster set up in version 7.6.2 Node A - elasticsearch Node B - elasticsearch & kibana elasticsearch we have set up in cluster, now how do we make kibana to be in HA, do i nee… --- ## [\[filebeat panw module\] set timezone when hostname field contains keyword](https://discuss.elastic.co/t/filebeat-panw-module-set-timezone-when-hostname-field-contains-keyword/238634)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 9:53am UTC](https://discuss.elastic.co/t/filebeat-panw-module-set-timezone-when-hostname-field-contains-keyword/238634 "2020-06-25T09:53:48Z")
How can I set timezone to ex EST when hostname field contains us-east-1? I tried something like this but it does not work: - date: if: "observer.hostname.toLowerCase().contains('useast') " field: "\_temp\_.… --- ## [Pull alerts from Solar Winds](https://discuss.elastic.co/t/pull-alerts-from-solar-winds/238493)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 3\ **Last updated:** [June 25, 2020, 10:54am UTC](https://discuss.elastic.co/t/pull-alerts-from-solar-winds/238493 "2020-06-25T10:54:53Z")
Code Share. I use powershell to pull all new alerts from Solarwinds and here is the code. First I check to see what the max alertid is in elasticsearch then I query solarwinds db to find all alerts after this max aler… --- ## [Elastic search 2.3.2 set Domain name with Https](https://discuss.elastic.co/t/elastic-search-2-3-2-set-domain-name-with-https/238590)
**Author:** [@Manikandan\_Selvaraj](https://discuss.elastic.co/u/Manikandan_Selvaraj)\ **Replies:** 5\ **Last updated:** [June 25, 2020, 10:45am UTC](https://discuss.elastic.co/t/elastic-search-2-3-2-set-domain-name-with-https/238590 "2020-06-25T10:45:32Z")
Hi Team, We are using Elastic search 2.3.2 version. We plan to configure SSL for elastic search URL instead of HTTP to HTTPS as well mention in subDomain also password protect. We have installed Elastic search in Windo… --- ## [Kibana dashboard not accessible via IE](https://discuss.elastic.co/t/kibana-dashboard-not-accessible-via-ie/238526)
**Author:** [@Dublin\_2020](https://discuss.elastic.co/u/Dublin_2020)\ **Replies:** 3\ **Last updated:** [June 25, 2020, 10:31am UTC](https://discuss.elastic.co/t/kibana-dashboard-not-accessible-via-ie/238526 "2020-06-25T10:31:44Z")
Hi Guys , need your opinion on the issue i am facing with kibana dashboard. i am trying to access the dashboard via IE browser and it throws error as cannot connect to the elasticserach cluster currently configured fo… --- ## [Display total sum in Kibana Dashboards](https://discuss.elastic.co/t/display-total-sum-in-kibana-dashboards/238302)
**Author:** [@Sherrie](https://discuss.elastic.co/u/Sherrie)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 10:28am UTC](https://discuss.elastic.co/t/display-total-sum-in-kibana-dashboards/238302 "2020-06-25T10:28:36Z")
The following are my log messages: These together with date and time are grouped under "message" Read 24 records from duplicate error queue into database 30s, 39 Read 22 records from duplicate error queue into database… --- ## [Elasticsearch 7.4.2 returning pinned-query not supported?](https://discuss.elastic.co/t/elasticsearch-7-4-2-returning-pinned-query-not-supported/238629)
**Author:** [@Dave\_Russell](https://discuss.elastic.co/u/Dave_Russell)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 10:26am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-2-returning-pinned-query-not-supported/238629 "2020-06-25T10:26:08Z")
{ "name" : "node-test-1", "cluster\_name" : "elasticsearch", "cluster\_uuid" : "5BDsy2RNQwioVSKUe5ZJrg", "version" : { "number" : "7.4.2", "build\_flavor" : "oss", "build\_type" : "deb", "build\_hash"… --- ## [Memory distribution on different nodes](https://discuss.elastic.co/t/memory-distribution-on-different-nodes/238477)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 9\ **Last updated:** [June 25, 2020, 10:25am UTC](https://discuss.elastic.co/t/memory-distribution-on-different-nodes/238477 "2020-06-25T10:25:37Z")
Hi All, I am new to ELK cluster model and facing few issues with it and need your help on this. Currently elasticsearch is running on 6 different nodes but memory is getting used mostly in 2 nodes. Can someone suggest ,… --- ## [Auditbeat Log all command not just \`sudo \\`](https://discuss.elastic.co/t/auditbeat-log-all-command-not-just-sudo-cmd/238640)
**Author:** [@esseti](https://discuss.elastic.co/u/esseti)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 10:21am UTC](https://discuss.elastic.co/t/auditbeat-log-all-command-not-just-sudo-cmd/238640 "2020-06-25T10:21:44Z")
Hello, I've setup the audit beat and it intercepts the commands that have sudo in front. however, it does not log the command from normal users and neither for root user. so that, if I do sudo su there's no log of comm… --- ## [Faulty Discover, Shard Loading Problem In Kibana 7.6](https://discuss.elastic.co/t/faulty-discover-shard-loading-problem-in-kibana-7-6/238487)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 5\ **Last updated:** [June 25, 2020, 10:19am UTC](https://discuss.elastic.co/t/faulty-discover-shard-loading-problem-in-kibana-7-6/238487 "2020-06-25T10:19:12Z")
Just 2 hours ago, I could sucessfully pull out all my data for that same time range. Now i can't, it gives me Shard failure and idk whats happening. The distinguishing point is that Discover only started to behave like … --- ## [How thread pool is calculated, in a cluster with different cpu core count?](https://discuss.elastic.co/t/how-thread-pool-is-calculated-in-a-cluster-with-different-cpu-core-count/238638)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 10:11am UTC](https://discuss.elastic.co/t/how-thread-pool-is-calculated-in-a-cluster-with-different-cpu-core-count/238638 "2020-06-25T10:11:50Z")
We are running a cluster, with 6 data nodes (24 cpu cores), and 2 http nodes (8 cpu cores) (receive http traffic). I can see ("/\_nodes"), each node have a a different thread pool "write" (24 max for data nodes, and 8 ma… --- ## [Import api doesn't like exported objects](https://discuss.elastic.co/t/import-api-doesnt-like-exported-objects/238380)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [June 25, 2020, 10:07am UTC](https://discuss.elastic.co/t/import-api-doesnt-like-exported-objects/238380 "2020-06-25T10:07:01Z")
I'm trying to use the saved object import api to load some objects into Kibana (so I don't have to do it manually every time I reset ELK after I've stuffed up). I've got the file going in, but it doesn't seem to like t… --- ## [Most efficient way to count entries with specific fields](https://discuss.elastic.co/t/most-efficient-way-to-count-entries-with-specific-fields/237366)
**Author:** [@Jeremy\_LHEZ](https://discuss.elastic.co/u/Jeremy_LHEZ)\ **Replies:** 7\ **Last updated:** [June 25, 2020, 9:49am UTC](https://discuss.elastic.co/t/most-efficient-way-to-count-entries-with-specific-fields/237366 "2020-06-25T09:49:01Z")
Hello everyone, I am currently working on a program and I need to count the number of entries in an index containing some specific fields. I work in JAVA with a RestHighLevelClient, and I use PutStoredScriptRequest to … --- ## [Filebeat extract\_array for panw module for config and system logs](https://discuss.elastic.co/t/filebeat-extract-array-for-panw-module-for-config-and-system-logs/238512)
**Author:** [@gadelkareem](https://discuss.elastic.co/u/gadelkareem)\ **Replies:** 2\ **Last updated:** [June 25, 2020, 9:40am UTC](https://discuss.elastic.co/t/filebeat-extract-array-for-panw-module-for-config-and-system-logs/238512 "2020-06-25T09:40:30Z")
Are there any examples of extract\_array for palo alto firewalls for config and system logs? ref: https://github.com/elastic/beats/blob/e99074029172a9c6d01f953005c3cdc2b58d6cb2/x-pack/filebeat/module/panw/panos/config/in… --- ## [Split JSON array into multiple events using ingest pipelines?](https://discuss.elastic.co/t/split-json-array-into-multiple-events-using-ingest-pipelines/238519)
**Author:** [@ianmuscat](https://discuss.elastic.co/u/ianmuscat)\ **Replies:** 1\ **Last updated:** [June 25, 2020, 9:33am UTC](https://discuss.elastic.co/t/split-json-array-into-multiple-events-using-ingest-pipelines/238519 "2020-06-25T09:33:46Z")
I have some logs being forwarded using Filebeat to Elasticsearch which contain a JSON array. { "docs": \[ { "\_source": { ... "snapshot": \[ { "address": "127.0.0.1", … --- ## [Document lost or not indexed during bulk index](https://discuss.elastic.co/t/document-lost-or-not-indexed-during-bulk-index/236795)
**Author:** [@nerd2000](https://discuss.elastic.co/u/nerd2000)\ **Replies:** 3\ **Last updated:** [June 25, 2020, 9:23am UTC](https://discuss.elastic.co/t/document-lost-or-not-indexed-during-bulk-index/236795 "2020-06-25T09:23:09Z")
Hi, Here's the context: I have a database with 1.5M rows of data with unique ids The elastic cluster has 3 nodes on elasticsearch 7.7 The index has 9 shards with1 replica I have a python script that get the data from… --- ## [Mapping recommendations](https://discuss.elastic.co/t/mapping-recommendations/238619)
**Author:** [@111302](https://discuss.elastic.co/u/111302)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 8:53am UTC](https://discuss.elastic.co/t/mapping-recommendations/238619 "2020-06-25T08:53:23Z")
Hi, I have several question regarding ES mapping. Should all the fields of the document be included in the mapping? or only those that i will search on? Are fields without mapping even searchable? if they are, how much… --- ## [Expand search result from a document id](https://discuss.elastic.co/t/expand-search-result-from-a-document-id/238616)
**Author:** [@Thomas\_Ardal](https://discuss.elastic.co/u/Thomas_Ardal)\ **Replies:** 2\ **Last updated:** [June 25, 2020, 8:48am UTC](https://discuss.elastic.co/t/expand-search-result-from-a-document-id/238616 "2020-06-25T08:48:48Z")
I have an index of time-based data. I want to be able to expand a search result for a document with an id. Something like "show the 10 documents before and the 10 documents after document with id x". I have a couple of i… --- ## [CONTROL visualization doesn't show all values](https://discuss.elastic.co/t/control-visualization-doesnt-show-all-values/238623)
**Author:** [@elisavet](https://discuss.elastic.co/u/elisavet)\ **Replies:** 0\ **Last updated:** [June 25, 2020, 8:37am UTC](https://discuss.elastic.co/t/control-visualization-doesnt-show-all-values/238623 "2020-06-25T08:37:25Z")
Hello! I want to use a CONTROL visualization of a string field but it doesn't show all possible values. I have no other filters such as time to limit the range of values. What can I do so that all values are shown? PS… --- ## [Search froma a pdf file content](https://discuss.elastic.co/t/search-froma-a-pdf-file-content/238254)
**Author:** [@Romy\_Bobby](https://discuss.elastic.co/u/Romy_Bobby)\ **Replies:** 8\ **Last updated:** [June 25, 2020, 8:28am UTC](https://discuss.elastic.co/t/search-froma-a-pdf-file-content/238254 "2020-06-25T08:28:54Z")
Hi, I have created a trail account in ES ,installed the elastic search package and configured it. to Insert the file i have converted it to base64 format and indexed and created a type . the file can be retrieved fro… --- ## [Transforms - enabling filters as group\_by](https://discuss.elastic.co/t/transforms-enabling-filters-as-group-by/238218)
**Author:** [@Xavier\_Marti\_Bofill](https://discuss.elastic.co/u/Xavier_Marti_Bofill)\ **Replies:** 4\ **Last updated:** [June 25, 2020, 8:19am UTC](https://discuss.elastic.co/t/transforms-enabling-filters-as-group-by/238218 "2020-06-25T08:19:52Z")
Right now options for grouping by in transforms are terms, histogram and date\_histogram. Is the plan adding filters anytime soon? If not, I guess best option would be to create different transforms (one for each filter… --- ## [\[Kibana 7.8\] Installing Timelion Fails: No Valid URL Specified](https://discuss.elastic.co/t/kibana-7-8-installing-timelion-fails-no-valid-url-specified/237878)
**Author:** [@vps-eric](https://discuss.elastic.co/u/vps-eric)\ **Replies:** 5\ **Last updated:** [June 25, 2020, 8:11am UTC](https://discuss.elastic.co/t/kibana-7-8-installing-timelion-fails-no-valid-url-specified/237878 "2020-06-25T08:11:57Z")
I am attempting to install Timelion 7.8 on my free Kibana instance. However, the following occurs: \[user@localhost ~\]$ /usr/share/kibana/bin/kibana-plugin install timelion Found previous install attempt. Deleting... Bab… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1971) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1973)