# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=710 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 711 --- ## [Data not appearing in dashboards](https://discuss.elastic.co/t/data-not-appearing-in-dashboards/317582)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 2\ **Last updated:** [November 8, 2022, 2:08am UTC](https://discuss.elastic.co/t/data-not-appearing-in-dashboards/317582 "2022-11-08T02:08:32Z")
Hi, I have two filebeat indices/datastreams: filebeat-8.4.0 filebeat-8.4.0-custom These are both targeted by a Data View : filebeat-\* Using this data view in Discover, I can see all the events from both indices, how… --- ## [Moving indices to Docker](https://discuss.elastic.co/t/moving-indices-to-docker/320069)
**Author:** [@Jozef](https://discuss.elastic.co/u/Jozef)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 7:56pm UTC](https://discuss.elastic.co/t/moving-indices-to-docker/320069 "2022-12-05T19:56:09Z")
Hi, I am currently trying to test the overhead a docker container adds to query latency, among other tests requiring a containerized ES. In order to do this I am creating a container and mounting the folder containing th… --- ## [How can i exclude 0 from an uniqe count?](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471)
**Author:** [@Jakomo04](https://discuss.elastic.co/u/Jakomo04)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 4:46pm UTC](https://discuss.elastic.co/t/how-can-i-exclude-0-from-an-uniqe-count/320471 "2022-12-05T16:46:48Z")
Hi, I have to do a Visualization that only shows the data over 10 of an unique count i tried "clamp(unique\_count('info.job-id.keyword') - 10, 0, 1) \* unique\_count('info.job-id.keyword')" . Now i have all the data under … --- ## [Logstash multiline and clone](https://discuss.elastic.co/t/logstash-multiline-and-clone/320478)
**Author:** [@adrianfusco](https://discuss.elastic.co/u/adrianfusco)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 4:28pm UTC](https://discuss.elastic.co/t/logstash-multiline-and-clone/320478 "2022-12-05T16:28:40Z")
I am sending some information from filebeat using one kind of multiline pattern. At some point, I realized I need to use another multiline pattern based on the log\_source. My idea was clone the beat and if the log\_sour… --- ## [Dashboard panels don't show data though underlying visualizations appear to work](https://discuss.elastic.co/t/dashboard-panels-dont-show-data-though-underlying-visualizations-appear-to-work/318588)
**Author:** [@jenrem](https://discuss.elastic.co/u/jenrem)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 3:44pm UTC](https://discuss.elastic.co/t/dashboard-panels-dont-show-data-though-underlying-visualizations-appear-to-work/318588 "2022-12-05T15:44:41Z")
Some panels on a dashboard no longer show data though when you go in to edit the visualization, it does show the data. The affected visualizations are based on follower indexes that had stopped receiving data from… --- ## [Insert ML Job Swimlane](https://discuss.elastic.co/t/insert-ml-job-swimlane/318258)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 1\ **Last updated:** [November 7, 2022, 3:29pm UTC](https://discuss.elastic.co/t/insert-ml-job-swimlane/318258 "2022-11-07T15:29:52Z")
I would like to insert the anomaly timeline swimlane visualization (for ML jobs) into Kibana Canvas workpad. I see that I can insert it into a dashboard, but don't see a way to use in Canvas. And apparently, it does not … --- ## [Rollover of Index and delete delta data as per customer configuration](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452)
**Author:** [@atpr](https://discuss.elastic.co/u/atpr)\ **Replies:** 3\ **Last updated:** [December 5, 2022, 2:48pm UTC](https://discuss.elastic.co/t/rollover-of-index-and-delete-delta-data-as-per-customer-configuration/320452 "2022-12-05T14:48:32Z")
Hi Experts, I have customer requirement where each customer can opt XGB of data or Y days of data and n no of records. Customer is saying they only want this much, if more data is coming, please delete oldest among all.… --- ## [Tune for indexing speed](https://discuss.elastic.co/t/tune-for-indexing-speed/318873)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 10\ **Last updated:** [December 5, 2022, 2:15pm UTC](https://discuss.elastic.co/t/tune-for-indexing-speed/318873 "2022-12-05T14:15:37Z")
Hey Everyone, We're having some issues optimizing the indexing speed on our cluster. Try as we might, we can't go over 200k/s. Here are the things we tried: Increasing the amount of documents used in a bulk request - … --- ## [The Windows x86\_64 MSI file for Packetbeat 8.3.2 won't work with default\_route](https://discuss.elastic.co/t/the-windows-x86-64-msi-file-for-packetbeat-8-3-2-wont-work-with-default-route/320446)
**Author:** [@beejaygee](https://discuss.elastic.co/u/beejaygee)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 2:12pm UTC](https://discuss.elastic.co/t/the-windows-x86-64-msi-file-for-packetbeat-8-3-2-wont-work-with-default-route/320446 "2022-12-05T14:12:42Z")
The Windows x86\_64 MSI file for Packetbeat 8.3.2 won't work with default\_route setting. I have found that if I compile the v8.3.2 source and swap the exe out for my compiled version that it works as expected. If I use th… --- ## [64 Gb limit for per NODE](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950)
**Author:** [@Kamran\_Ahmadzade](https://discuss.elastic.co/u/Kamran_Ahmadzade)\ **Replies:** 11\ **Last updated:** [December 5, 2022, 2:03pm UTC](https://discuss.elastic.co/t/64-gb-limit-for-per-node/319950 "2022-12-05T14:03:54Z")
Why do we have 64 GB limit for per node in cluster ? --- ## [Logstash netscaler citrix input](https://discuss.elastic.co/t/logstash-netscaler-citrix-input/319571)
**Author:** [@perezdev](https://discuss.elastic.co/u/perezdev)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 1:58pm UTC](https://discuss.elastic.co/t/logstash-netscaler-citrix-input/319571 "2022-12-05T13:58:41Z")
Hello, I'm trying to collect logs from Netscaler Citrix using ipfix protocol, but I'm not able to decode properly the message. This is my input configuration file: input { udp { port =\> 9913 codec =\> netflow… --- ## [Unable to install Fleet Server](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110)
**Author:** [@leschev](https://discuss.elastic.co/u/leschev)\ **Replies:** 20\ **Last updated:** [December 5, 2022, 1:51pm UTC](https://discuss.elastic.co/t/unable-to-install-fleet-server/319110 "2022-12-05T13:51:59Z")
Hello! I am trying to install Fleet Server with my self-hosted ELK. So, I have the error: sudo ./elastic-agent install -f --fleet-server-es=https://\*\*\*\*.org:9200 --fleet-server-service-token=AAEAAWV\*\*\*\* --fleet-serv… --- ## [Kibana: how to set up alerts on a boolean field](https://discuss.elastic.co/t/kibana-how-to-set-up-alerts-on-a-boolean-field/318694)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 1:11pm UTC](https://discuss.elastic.co/t/kibana-how-to-set-up-alerts-on-a-boolean-field/318694 "2022-12-05T13:11:23Z")
Hi, I have a dataset that contains fields pertaining to a specific optical transport device. My dataset: "slot": "LM-1", "source": "1.3.1.8", "timestamp": 1668113939, "serial\_no": "xxxxxxxx", "hardware\_version": "001"… --- ## [How to special date time format to timestamp format](https://discuss.elastic.co/t/how-to-special-date-time-format-to-timestamp-format/320444)
**Author:** [@akif\_bal](https://discuss.elastic.co/u/akif_bal)\ **Replies:** 6\ **Last updated:** [December 5, 2022, 1:09pm UTC](https://discuss.elastic.co/t/how-to-special-date-time-format-to-timestamp-format/320444 "2022-12-05T13:09:56Z")
I have a log type that I cannot manipulate. How can I convert the Time format in the log to timestamp format? Example log: "0001 021222 095725 00240541029896158 11 00 00 0000000000 000 0" Date and time that comes with … --- ## [Some devices(routers/firewall) logs are not coming in ELK Kibana](https://discuss.elastic.co/t/some-devices-routers-firewall-logs-are-not-coming-in-elk-kibana/319610)
**Author:** [@Sivaramakrishhna\_Amb](https://discuss.elastic.co/u/Sivaramakrishhna_Amb)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 11:38am UTC](https://discuss.elastic.co/t/some-devices-routers-firewall-logs-are-not-coming-in-elk-kibana/319610 "2022-12-05T11:38:59Z")
Some devices(routers/firewall) logs are not coming in ELK Kibana protocol used is tcp --- ## [Rolling upgrades, master nodes & voting\_config\_exclusions](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [December 5, 2022, 11:33am UTC](https://discuss.elastic.co/t/rolling-upgrades-master-nodes-voting-config-exclusions/320463 "2022-12-05T11:33:44Z")
Hi, We are planning to upgrade our v7.8 cluster to v7.17, in a rolling upgrade. The cluster has 22 nodes and all nodes have both Master and Data roles. We're planning to leave the currently elected master node till la… --- ## [Search\_after but with paging](https://discuss.elastic.co/t/search-after-but-with-paging/319886)
**Author:** [@daniel77](https://discuss.elastic.co/u/daniel77)\ **Replies:** 5\ **Last updated:** [December 5, 2022, 10:55am UTC](https://discuss.elastic.co/t/search-after-but-with-paging/319886 "2022-12-05T10:55:04Z")
We know the from + size parameters in a search query are limited to 10000. In a search which returns 20k hits, and assuming each page is 1k results, it's impossible to retrieve any page beyond #10 (like page 11, from set… --- ## [Integration of ELK in TheHive](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455)
**Author:** [@Midiou\_00](https://discuss.elastic.co/u/Midiou_00)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 9:50am UTC](https://discuss.elastic.co/t/integration-of-elk-in-thehive/320455 "2022-12-05T09:50:29Z")
Hi everyone, I want to integrate ELK in Thehive SOAR. This is an open source SOAR. May somebody help me for the processus please ? --- ## [Do EQL deprecations also imply deprecation of the Java API?](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462)
**Author:** [@martinwun](https://discuss.elastic.co/u/martinwun)\ **Replies:** 0\ **Last updated:** [December 5, 2022, 10:48am UTC](https://discuss.elastic.co/t/do-eql-deprecations-also-imply-deprecation-of-the-java-api/320462 "2022-12-05T10:48:50Z")
Hello, in the release notes for 7.13 it states the following in the section on "EQL deprecations": "The wildcard function is deprecated." What is not clear to me is whether or not this is also affecting the Java API… --- ## [Kibana import CSV only return partial data](https://discuss.elastic.co/t/kibana-import-csv-only-return-partial-data/319255)
**Author:** [@Virendra\_Negi](https://discuss.elastic.co/u/Virendra_Negi)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 10:28am UTC](https://discuss.elastic.co/t/kibana-import-csv-only-return-partial-data/319255 "2022-12-05T10:28:57Z")
I see there is already a reference ticket around this Reporting - CSV Export: contains partial data nothing conclusive came out from it, Hence creating a new one. the OP in the previous post is correct Kibana does not r… --- ## [Auto delete index on the basis of index size](https://discuss.elastic.co/t/auto-delete-index-on-the-basis-of-index-size/316186)
**Author:** [@Mangesh\_Mathe](https://discuss.elastic.co/u/Mangesh_Mathe)\ **Replies:** 1\ **Last updated:** [October 10, 2022, 9:51pm UTC](https://discuss.elastic.co/t/auto-delete-index-on-the-basis-of-index-size/316186 "2022-10-10T21:51:40Z")
I Want to delete two different production index if it exceeds 50GB size. I tried to use ILM policy on the basis of index size, I tried rollover condition with hot phase max\_size 50GB and then delete phase after 1 hour. … --- ## [How to alert based on filter query count? Index Threshold Rule Type?](https://discuss.elastic.co/t/how-to-alert-based-on-filter-query-count-index-threshold-rule-type/319119)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-alert-based-on-filter-query-count-index-threshold-rule-type/319119 "2022-12-05T10:12:03Z")
I want to set up an alert in Kibana Observability where if the number of records returned for event.dataset: login and event.outcome: failure is greater than 10 for the past minute, then set the alert rule to active. I'… --- ## [ILM Policy Clarification](https://discuss.elastic.co/t/ilm-policy-clarification/318229)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 10:00am UTC](https://discuss.elastic.co/t/ilm-policy-clarification/318229 "2022-12-05T10:00:07Z")
Hello Team, Firstly I would like to define my flow, my setup uses all three components ELK, and the data is sent from a Big Data Platform to Kafka from which logstash reads and sends it to elastic. So I planned to setup… --- ## [Spaces on Kibana](https://discuss.elastic.co/t/spaces-on-kibana/318315)
**Author:** [@Anil\_Alapati](https://discuss.elastic.co/u/Anil_Alapati)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 9:32am UTC](https://discuss.elastic.co/t/spaces-on-kibana/318315 "2022-12-05T09:32:32Z")
Hi, This is regarding spaces on the Kibana. To restrict access on spaces. I read like , we need to create a role and an user . Assign the space roll to the user. I followed the steps and create a role and an user. Assi… --- ## [2 nodes logstash](https://discuss.elastic.co/t/2-nodes-logstash/320012)
**Author:** [@maxxl](https://discuss.elastic.co/u/maxxl)\ **Replies:** 9\ **Last updated:** [December 5, 2022, 6:26am UTC](https://discuss.elastic.co/t/2-nodes-logstash/320012 "2022-12-05T06:26:35Z")
1 logstash works fine 2 logstash, wrong view in kibana --- ## [Need to bypass authentication in kibana as dashboards are embedd using iframes in custom website](https://discuss.elastic.co/t/need-to-bypass-authentication-in-kibana-as-dashboards-are-embedd-using-iframes-in-custom-website/316539)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 3\ **Last updated:** [November 7, 2022, 6:19am UTC](https://discuss.elastic.co/t/need-to-bypass-authentication-in-kibana-as-dashboards-are-embedd-using-iframes-in-custom-website/316539 "2022-11-07T06:19:06Z")
Hello All, I want to know possible ways to bypass basic authentication that is enabled in kibana. Issue: I have custom website that has dashboards integrated using iframes.Now Issue is whenever the user logins to webs… --- ## [GC on elastic search data nodes and node automatically reconnect from the cluster](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 4\ **Last updated:** [December 5, 2022, 4:23am UTC](https://discuss.elastic.co/t/gc-on-elastic-search-data-nodes-and-node-automatically-reconnect-from-the-cluster/319426 "2022-12-05T04:23:47Z")
Hi Team, we are getting the below alerts in elasticsearch data nodes. \[2022-11-20T21:27:36,237\]\[INFO \]\[o.e.m.j.JvmGcMonitorService\] \[esnode1\] \[gc\]\[438806\] overhead, spent \[276ms\] collecting in the last \[1s\] \[2022-11-2… --- ## [The limit of Data stream](https://discuss.elastic.co/t/the-limit-of-data-stream/320255)
**Author:** [@2019240081](https://discuss.elastic.co/u/2019240081)\ **Replies:** 1\ **Last updated:** [December 5, 2022, 12:37am UTC](https://discuss.elastic.co/t/the-limit-of-data-stream/320255 "2022-12-05T00:37:12Z")
I had to choose between data stream and index strategy with alias and found es doc which helps to determine whether use data stream or not If you frequently update or delete existing time series data, use an index alias… --- ## [Can't start elasticsearch 8.5 with docker](https://discuss.elastic.co/t/cant-start-elasticsearch-8-5-with-docker/318029)
**Author:** [@FatNerd](https://discuss.elastic.co/u/FatNerd)\ **Replies:** 13\ **Last updated:** [December 5, 2022, 12:36am UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-8-5-with-docker/318029 "2022-12-05T00:36:46Z")
I'm trying to execute the docker-compose.yml from this page Install Elasticsearch with Docker | Elasticsearch Guide \[8.5\] | Elastic In the .env file, I left everything to default except the two passwords Ther first se… --- ## [Backup Centralized Pipeline Management](https://discuss.elastic.co/t/backup-centralized-pipeline-management/318294)
**Author:** [@heric](https://discuss.elastic.co/u/heric)\ **Replies:** 0\ **Last updated:** [November 7, 2022, 7:09am UTC](https://discuss.elastic.co/t/backup-centralized-pipeline-management/318294 "2022-11-07T07:09:15Z")
Hi, Is there any API / command that we can use to backup logstash pipelines that are created in centralized pipeline management ? i have quite a lot of pipelines and copy paste from centralized pipeline management will… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=709) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=711)