# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=919 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 920 --- ## [How to add compound conditions in search template?](https://discuss.elastic.co/t/how-to-add-compound-conditions-in-search-template/305898)
**Author:** [@omkarrane](https://discuss.elastic.co/u/omkarrane)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 8:58am UTC](https://discuss.elastic.co/t/how-to-add-compound-conditions-in-search-template/305898 "2022-06-01T08:58:49Z")
Use Case: We have 2 conditions Query parameter matches All of dishFamilyId, dishTypeId, dishPreparationStyleId should match (they might not be present as well) Eg. Its possible that dishTypeId and dishPreparationStyle… --- ## [Absolute values in TSVB](https://discuss.elastic.co/t/absolute-values-in-tsvb/306004)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 8:57am UTC](https://discuss.elastic.co/t/absolute-values-in-tsvb/306004 "2022-06-01T08:57:49Z")
How do we show absolute values of a field in TSVB? --- ## [Filebeat json parser is trying to parse excluded lines](https://discuss.elastic.co/t/filebeat-json-parser-is-trying-to-parse-excluded-lines/304674)
**Author:** [@dosmanak](https://discuss.elastic.co/u/dosmanak)\ **Replies:** 5\ **Last updated:** [June 1, 2022, 8:56am UTC](https://discuss.elastic.co/t/filebeat-json-parser-is-trying-to-parse-excluded-lines/304674 "2022-06-01T08:56:07Z")
filebeat log is filled with errors "Error decoding JSON: invalid character" filebeat.yml --- filebeat.inputs: - type: filestream id: 0 paths: - '/data/mixed\_json\_plain.log' exclude\_lines: \[ "^PLAIN"… --- ## [If condition in Kibana Table Visualization](https://discuss.elastic.co/t/if-condition-in-kibana-table-visualization/305751)
**Author:** [@micaelle](https://discuss.elastic.co/u/micaelle)\ **Replies:** 5\ **Last updated:** [June 1, 2022, 8:34am UTC](https://discuss.elastic.co/t/if-condition-in-kibana-table-visualization/305751 "2022-06-01T08:34:24Z")
Hi, is it possible to use if condition in a Kibana Table Visualization? I want to build a financial table that counts a line item and then multiply the quantity with a specific value for each volume level. --- ## [How to dislink time picker and X-axis of Lens](https://discuss.elastic.co/t/how-to-dislink-time-picker-and-x-axis-of-lens/306089)
**Author:** [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 8:28am UTC](https://discuss.elastic.co/t/how-to-dislink-time-picker-and-x-axis-of-lens/306089 "2022-06-01T08:28:20Z")
I have a trouble with when I want to select documents from an index pattern by their Time field using time picker and visualize a date histogram on another datetime field. I created an index and an index pattern with T… --- ## [Arranging x axis by value of y axis for a formula field](https://discuss.elastic.co/t/arranging-x-axis-by-value-of-y-axis-for-a-formula-field/305973)
**Author:** [@behappy\_alwayz0401](https://discuss.elastic.co/u/behappy_alwayz0401)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 8:20am UTC](https://discuss.elastic.co/t/arranging-x-axis-by-value-of-y-axis-for-a-formula-field/305973 "2022-06-01T08:20:28Z")
I'm creating a tree map lens visualization. I have a field "account name" under "group by" and have a formula (absolute value) on a number field "Delta value" under "size by". When I try to rearrange the order of the "gr… --- ## [Group by function in Discover](https://discuss.elastic.co/t/group-by-function-in-discover/305922)
**Author:** [@temp\_account](https://discuss.elastic.co/u/temp_account)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 8:10am UTC](https://discuss.elastic.co/t/group-by-function-in-discover/305922 "2022-06-01T08:10:28Z")
i used a lot of Kibana/Discover in work. As you know, in the query result of Discover, in each log record, there may be many fields included, eg. userid, flowid, userip, username, userAction, etc. Several log record ma… --- ## [Is there a way to find out on logstash pipeline status?](https://discuss.elastic.co/t/is-there-a-way-to-find-out-on-logstash-pipeline-status/306066)
**Author:** [@newelastic](https://discuss.elastic.co/u/newelastic)\ **Replies:** 1\ **Last updated:** [June 1, 2022, 8:00am UTC](https://discuss.elastic.co/t/is-there-a-way-to-find-out-on-logstash-pipeline-status/306066 "2022-06-01T08:00:23Z")
I've a logstash pipeline which extracts the data from the Elasticsearch and outputs to a file. Is there a way to check if the pipeline is successfully completed by writing to the output file? Right now, I keep checking t… --- ## [Logstash Configuration file in 8.2](https://discuss.elastic.co/t/logstash-configuration-file-in-8-2/306019)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 7:58am UTC](https://discuss.elastic.co/t/logstash-configuration-file-in-8-2/306019 "2022-06-01T07:58:04Z")
After upgrading the ELK stack to 8.2 my logstash configuration file where i have defined the filters for logstash-filter-geoip have changed some key names , like victimASN.as\_org is now coming as victimASN.as.organizatio… --- ## [Kibana 8.x Installation without GUI](https://discuss.elastic.co/t/kibana-8-x-installation-without-gui/305405)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 7:26am UTC](https://discuss.elastic.co/t/kibana-8-x-installation-without-gui/305405 "2022-06-01T07:26:35Z")
Hi there, I want to install Kibana 8.x - actually I already did it. But: There are these new steps when building a new cluster from scratch: /usr/share/Elasticsearch/bin/Elasticsearch-create-enrollment-token -s kibana … --- ## [Requirements production cluster](https://discuss.elastic.co/t/requirements-production-cluster/306029)
**Author:** [@diegz](https://discuss.elastic.co/u/diegz)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 7:18am UTC](https://discuss.elastic.co/t/requirements-production-cluster/306029 "2022-06-01T07:18:55Z")
Hello everyone, I would like to implement the elk stack for log management for a SIEM. In a production context I would like to create a cluster of 3 elastic nodes. What are your advices and best practices? 2 x node.r… --- ## [Could use elasticsearch to do keyword extraction](https://discuss.elastic.co/t/could-use-elasticsearch-to-do-keyword-extraction/306083)
**Author:** [@zhugw](https://discuss.elastic.co/u/zhugw)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 6:49am UTC](https://discuss.elastic.co/t/could-use-elasticsearch-to-do-keyword-extraction/306083 "2022-06-01T06:49:08Z")
Want to extract some keyword from texts , could use tf-idf or textrank algorithm to implement it , e.g. scikit-learn tf-idf Could use Elasticsearch to implement this purpose(keyword extraction), that is put text into in… --- ## [Nodes can't join the cluster](https://discuss.elastic.co/t/nodes-cant-join-the-cluster/305701)
**Author:** [@Ali\_Panahian](https://discuss.elastic.co/u/Ali_Panahian)\ **Replies:** 7\ **Last updated:** [June 1, 2022, 6:24am UTC](https://discuss.elastic.co/t/nodes-cant-join-the-cluster/305701 "2022-06-01T06:24:02Z")
Hi i'm trying to cluster 3 node Elasticsearch in multi host using docker all of my nodes run successfully and frist one create and join the cluster as master but other nodes got cluster\_uis: na this is my docker-compo… --- ## [Data type is showing as text value in data view rather than decimal when uploaded using mysql config file by logstash](https://discuss.elastic.co/t/data-type-is-showing-as-text-value-in-data-view-rather-than-decimal-when-uploaded-using-mysql-config-file-by-logstash/306078)
**Author:** [@akshay\_bhardwaj](https://discuss.elastic.co/u/akshay_bhardwaj)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 6:22am UTC](https://discuss.elastic.co/t/data-type-is-showing-as-text-value-in-data-view-rather-than-decimal-when-uploaded-using-mysql-config-file-by-logstash/306078 "2022-06-01T06:22:16Z")
Hi i create a sql connection using logstash and upload a data but my data is showing as text as shown in figure. --- ## [Elastic: How to correct the auto generated mapping?](https://discuss.elastic.co/t/elastic-how-to-correct-the-auto-generated-mapping/305819)
**Author:** [@Gopala00](https://discuss.elastic.co/u/Gopala00)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 6:08am UTC](https://discuss.elastic.co/t/elastic-how-to-correct-the-auto-generated-mapping/305819 "2022-06-01T06:08:53Z")
I'm using Elastic cloud hosted in Azure and use NEST for the client. I have a part of auto generated mapping that I need to change from "Bonus" : { "type" : "text", "fields" : { "keyword" : { … --- ## [The cluster cannot discover the master or other nodes](https://discuss.elastic.co/t/the-cluster-cannot-discover-the-master-or-other-nodes/305997)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 6:00am UTC](https://discuss.elastic.co/t/the-cluster-cannot-discover-the-master-or-other-nodes/305997 "2022-06-01T06:00:32Z")
According to the prompt "this node must discover master-eligible nodes \[es-node01, es-node02, es-node03\]", es-node03 does not find other nodes. According to the results I searched, cluster.initial\_master\_nodes needs to b… --- ## [DNS lookup failure "elasticsearch"](https://discuss.elastic.co/t/dns-lookup-failure-elasticsearch/305939)
**Author:** [@kosmylo](https://discuss.elastic.co/u/kosmylo)\ **Replies:** 6\ **Last updated:** [June 1, 2022, 3:41am UTC](https://discuss.elastic.co/t/dns-lookup-failure-elasticsearch/305939 "2022-06-01T03:41:36Z")
I have a simple express app with Nginx and I use Filebeat with ELK stack. Filebeat takes in charge of streaming log file from Nginx to Logstash then processing it and visualize to Kibana. This pipeline works fine. Howeve… --- ## [Moving kibana visualisation to a new cluster with differently named indexes](https://discuss.elastic.co/t/moving-kibana-visualisation-to-a-new-cluster-with-differently-named-indexes/305114)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 3\ **Last updated:** [June 1, 2022, 3:35am UTC](https://discuss.elastic.co/t/moving-kibana-visualisation-to-a-new-cluster-with-differently-named-indexes/305114 "2022-06-01T03:35:35Z")
I have just upgraded to 17.7.1 and I now find that I can no longer change the index pattern associated with a visualisation by exporting it, deleting the the index temporarily and importing it back it. It used to detec… --- ## [Logstash Mutate Filter](https://discuss.elastic.co/t/logstash-mutate-filter/306057)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 2\ **Last updated:** [June 1, 2022, 3:14am UTC](https://discuss.elastic.co/t/logstash-mutate-filter/306057 "2022-06-01T03:14:34Z")
Hello I am using Logstash version 7.8.0 in our environment. I am using logstash to extract data from JDBC database using input - jdbc and output == Elasticsearch v7.8.0 doing so , in between I am using filter - muta… --- ## [Where is elasticsearch.client module on python?](https://discuss.elastic.co/t/where-is-elasticsearch-client-module-on-python/306070)
**Author:** [@kkojouri](https://discuss.elastic.co/u/kkojouri)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 12:59am UTC](https://discuss.elastic.co/t/where-is-elasticsearch-client-module-on-python/306070 "2022-06-01T00:59:32Z")
Hello, We have upgraded our clusters to 8.2.0 but are currently having issues with our python scripts for cluster management. Previously, we were using Elasticsearch.client module to manage users, roles, and role mappin… --- ## [Failed to process file when import a dashboard file into kibana](https://discuss.elastic.co/t/failed-to-process-file-when-import-a-dashboard-file-into-kibana/305231)
**Author:** [@William\_Bai](https://discuss.elastic.co/u/William_Bai)\ **Replies:** 4\ **Last updated:** [June 1, 2022, 2:27am UTC](https://discuss.elastic.co/t/failed-to-process-file-when-import-a-dashboard-file-into-kibana/305231 "2022-06-01T02:27:43Z")
When I import a dashboard.ndjson file from kibana 7.5.1 to kibana 7.4.1, it failed with error "the file could not be processed" Then I tried call import api in kibana dev tool console, there's mapper parsing exception i… --- ## [Unable to delete replicas on existing indices with ILM](https://discuss.elastic.co/t/unable-to-delete-replicas-on-existing-indices-with-ilm/306051)
**Author:** [@mhoward](https://discuss.elastic.co/u/mhoward)\ **Replies:** 2\ **Last updated:** [May 31, 2022, 7:50pm UTC](https://discuss.elastic.co/t/unable-to-delete-replicas-on-existing-indices-with-ilm/306051 "2022-05-31T19:50:26Z")
Hello. I have been trying to implement a change to my ILM where indices moved to the "cold" state will have their replica deleted. They currently have 1 replica. I've already made the change in the Index Lifecycle Pol… --- ## [Elastic agent on Raspberry Pi](https://discuss.elastic.co/t/elastic-agent-on-raspberry-pi/305182)
**Author:** [@l3keboy](https://discuss.elastic.co/u/l3keboy)\ **Replies:** 15\ **Last updated:** [May 31, 2022, 6:55pm UTC](https://discuss.elastic.co/t/elastic-agent-on-raspberry-pi/305182 "2022-05-31T18:55:39Z")
Hello All! I am trying to install the elastic agent to a raspberry pi and trying to enroll it onto our fleet server. When trying to install the agent I get the error: ./elastic-agent: 1: Syntax error: word unexpected (… --- ## [Canvas - Time Filter has no Data Source?](https://discuss.elastic.co/t/canvas-time-filter-has-no-data-source/305763)
**Author:** [@Dave21854207](https://discuss.elastic.co/u/Dave21854207)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 5:09pm UTC](https://discuss.elastic.co/t/canvas-time-filter-has-no-data-source/305763 "2022-05-31T17:09:58Z")
I cant find any info on how to add a data source to the canvas time filter? It just appears to be a static image --- ## [Kibana: rule compares difference of two aggregations](https://discuss.elastic.co/t/kibana-rule-compares-difference-of-two-aggregations/305393)
**Author:** [@Johannnnnn](https://discuss.elastic.co/u/Johannnnnn)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 4:44pm UTC](https://discuss.elastic.co/t/kibana-rule-compares-difference-of-two-aggregations/305393 "2022-05-31T16:44:08Z")
I got two aggregations, both calculating the run time of a test suite differentiating on the specific release. So the results are two long numbers (nanoseconds). I want to create an alert to send me an e-mail when the d… --- ## [Watcher alert for index sizes](https://discuss.elastic.co/t/watcher-alert-for-index-sizes/305633)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 4:42pm UTC](https://discuss.elastic.co/t/watcher-alert-for-index-sizes/305633 "2022-05-31T16:42:35Z")
Hi Team, I am trying to create an alert when any one of the index size crosses 200GB. I have created a watcher like below but i am getting an compile error not sure what was wrong. Could you please help me with this. {… --- ## [Kibana Canvas: How can I use a filter to show data per project?](https://discuss.elastic.co/t/kibana-canvas-how-can-i-use-a-filter-to-show-data-per-project/305627)
**Author:** [@Linda\_T](https://discuss.elastic.co/u/Linda_T)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:50pm UTC](https://discuss.elastic.co/t/kibana-canvas-how-can-i-use-a-filter-to-show-data-per-project/305627 "2022-05-31T15:50:19Z")
Hi everyone, I have a question regarding the use of filters in Canvas, because within my Canvas report I want to show programme data as well as filtered data per project. Situation: I have created a Kibana Dashboard f… --- ## [Kibana alerts and actions setup](https://discuss.elastic.co/t/kibana-alerts-and-actions-setup/305758)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:31pm UTC](https://discuss.elastic.co/t/kibana-alerts-and-actions-setup/305758 "2022-05-31T15:31:41Z")
i am trying to get alerting and actions working but it seems to be disabled. Kibana points me to Alerting and Actions | Kibana Guide \[7.10\] | Elastic I have security setup already in Elasticsearch for authentication. x… --- ## [String to table](https://discuss.elastic.co/t/string-to-table/305309)
**Author:** [@fredyfredburger](https://discuss.elastic.co/u/fredyfredburger)\ **Replies:** 1\ **Last updated:** [May 31, 2022, 3:25pm UTC](https://discuss.elastic.co/t/string-to-table/305309 "2022-05-31T15:25:44Z")
I have a data feed that provides the linux df command as a value in my Elasticsearch database. The df output is contianed as a string in a single field. I need to display this in Canvas as a table, but can't figure out… --- ## [Add a time field in elasticsearch and calculate time between two event](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971)
**Author:** [@The-morpho](https://discuss.elastic.co/u/The-morpho)\ **Replies:** 3\ **Last updated:** [May 31, 2022, 2:48pm UTC](https://discuss.elastic.co/t/add-a-time-field-in-elasticsearch-and-calculate-time-between-two-event/305971 "2022-05-31T14:48:57Z")
I'm new to Elasticsearch. I’m working with log files stored in Elasticsearch, that contains information about some operations on differents levels, I have a field timestamp that represents the time when each operation h… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=918) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=920)