# Kibana

**URL:** https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=1012

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1013

---

## [Unexpected highlighted words matching with value of index.query.default\_field](https://discuss.elastic.co/t/unexpected-highlighted-words-matching-with-value-of-index-query-default-field/41857)

<div class="topic-metadata">

**Author:** [@terramexx](https://discuss.elastic.co/u/terramexx)\
**Replies:** 3\
**Last updated:** [December 15, 2016, 8:03am UTC](https://discuss.elastic.co/t/unexpected-highlighted-words-matching-with-value-of-index-query-default-field/41857 "2016-12-15T08:03:30Z")

</div>

The results in our Discovery tab have by default highlights of the "message" word. In my opinion it is caused by specifying default\_field settings for our logstash indexes { "template": "logstash-\*", "settings":…

---

## [Visualizing parent-child relations](https://discuss.elastic.co/t/visualizing-parent-child-relations/23804)

<div class="topic-metadata">

**Author:** [@amos](https://discuss.elastic.co/u/amos)\
**Replies:** 7\
**Last updated:** [December 14, 2016, 11:34pm UTC](https://discuss.elastic.co/t/visualizing-parent-child-relations/23804 "2016-12-14T23:34:43Z")

</div>

Hi , I have created an index with parent/child relations (following this example: https://www.elastic.co/guide/en/elasticsearch/guide/current/indexing-parent-child.html ) POST /company/branch/\_bulk { "index": { "\_id…

---

## [Replace kibana 5.0.2 logo with company's logo? Only for corporate use](https://discuss.elastic.co/t/replace-kibana-5-0-2-logo-with-companys-logo-only-for-corporate-use/69043)

<div class="topic-metadata">

**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 9:14pm UTC](https://discuss.elastic.co/t/replace-kibana-5-0-2-logo-with-companys-logo-only-for-corporate-use/69043 "2016-12-14T21:14:36Z")

</div>

Any One tried this on Kibana 5.0.2 I see its possible in Kibana 4.X.X version but coming to kibana 5.X paths are change not sure where the files exists.

---

## [Importing Existing Beat Dashboards in offline server](https://discuss.elastic.co/t/importing-existing-beat-dashboards-in-offline-server/69075)

<div class="topic-metadata">

**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 8:11pm UTC](https://discuss.elastic.co/t/importing-existing-beat-dashboards-in-offline-server/69075 "2016-12-14T20:11:46Z")

</div>

Hi I'm trying to install Metric dashboard its my first time trying this Downloaded .zip beats tried still by defaults its taking to https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.1.1…

---

## [A scrollable dashboard?](https://discuss.elastic.co/t/a-scrollable-dashboard/69012)

<div class="topic-metadata">

**Author:** [@markd](https://discuss.elastic.co/u/markd)\
**Replies:** 3\
**Last updated:** [December 14, 2016, 7:57pm UTC](https://discuss.elastic.co/t/a-scrollable-dashboard/69012 "2016-12-14T19:57:27Z")

</div>

Hi, I have a visualization where I track CPU load of a few hosts. I noticed that the graphs are scaled down to fit the dashboard (Split Chart / Size field). Is there a way to implement a slide bar on a side of a visuali…

---

## [How kibana ui modules work?](https://discuss.elastic.co/t/how-kibana-ui-modules-work/69042)

<div class="topic-metadata">

**Author:** [@zhengjie](https://discuss.elastic.co/u/zhengjie)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 5:04pm UTC](https://discuss.elastic.co/t/how-kibana-ui-modules-work/69042 "2016-12-14T17:04:15Z")

</div>

Hi, I read some kibana 4.3 source code. I think 'discover' controller is in 'apps/discover' module, how 'ui/routes' find it? which seems in 'kibana' module. thanks! var app = require('ui/modules').get('apps/discover',…

---

## [Sum of Duration](https://discuss.elastic.co/t/sum-of-duration/68840)

<div class="topic-metadata">

**Author:** [@Aurevan](https://discuss.elastic.co/u/Aurevan)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 3:55pm UTC](https://discuss.elastic.co/t/sum-of-duration/68840 "2016-12-14T15:55:20Z")

</div>

Hi, I have an ELK who collect the logs of a firewall, in this log i have à field duration who is actually a data type, but i would like to make a sum of all this duration by user, i haven't idea of how i can do this tr…

---

## [Scripted field with stored script](https://discuss.elastic.co/t/scripted-field-with-stored-script/68256)

<div class="topic-metadata">

**Author:** [@mrvincnezo](https://discuss.elastic.co/u/mrvincnezo)\
**Replies:** 5\
**Last updated:** [December 14, 2016, 3:26pm UTC](https://discuss.elastic.co/t/scripted-field-with-stored-script/68256 "2016-12-14T15:26:42Z")

</div>

Is it possible to create a scripted field in Kibana that will use a stored script or file script instead of the dynamic script? I currently have 12 scripted field in Kibana and I am constantly hitting the script.max\_co…

---

## [Own plugin: route for \_cat/indices?](https://discuss.elastic.co/t/own-plugin-route-for--cat-indices/69006)

<div class="topic-metadata">

**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\
**Replies:** 4\
**Last updated:** [December 14, 2016, 11:55am UTC](https://discuss.elastic.co/t/own-plugin-route-for--cat-indices/69006 "2016-12-14T11:55:16Z")

</div>

Hi all, Kibana Version: 5.0.0 For an own plugin I'd like to receive the list of all indices, i.e. the ouput of GET /\_cat/indices?index=myindices-\*&h=index But I could not figure out how to set up the route in the e…

---

## [Kibana Query for missing values](https://discuss.elastic.co/t/kibana-query-for-missing-values/68940)

<div class="topic-metadata">

**Author:** [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\
**Replies:** 1\
**Last updated:** [December 14, 2016, 11:30am UTC](https://discuss.elastic.co/t/kibana-query-for-missing-values/68940 "2016-12-14T11:30:26Z")

</div>

Hello, We have values stored in Elastcisearch with different values for one key like below... computer\_name:1 computer\_name:2 computer\_name:3 etc These values are coming from different client machines. Is there anywa…

---

## [Ranking (league) table](https://discuss.elastic.co/t/ranking-league-table/68996)

<div class="topic-metadata">

**Author:** [@anton-da](https://discuss.elastic.co/u/anton-da)\
**Replies:** 1\
**Last updated:** [December 14, 2016, 11:16am UTC](https://discuss.elastic.co/t/ranking-league-table/68996 "2016-12-14T11:16:23Z")

</div>

Hello, could somebody suggest how I would approach to visualise a table like this: \[image\] With position change? My data would be daily visits for urls, so that I could see the delta in rankings. I think it is not pos…

---

## [Could kibana can import index patterns from elasticsearch indexes automatically?](https://discuss.elastic.co/t/could-kibana-can-import-index-patterns-from-elasticsearch-indexes-automatically/68983)

<div class="topic-metadata">

**Author:** [@microchao](https://discuss.elastic.co/u/microchao)\
**Replies:** 1\
**Last updated:** [December 14, 2016, 10:31am UTC](https://discuss.elastic.co/t/could-kibana-can-import-index-patterns-from-elasticsearch-indexes-automatically/68983 "2016-12-14T10:31:48Z")

</div>

Hi, Now the elasticsearch has many indexes. These indexes pattern like aaa-2016\_12\_14.log and bbb-2016\_12\_14.log and others. And it will generate new index everyday, it pattern will be the xxx-YYYY\_mm\_dd.I want the …

---

## [Query statistics difference](https://discuss.elastic.co/t/query-statistics-difference/68988)

<div class="topic-metadata">

**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Replies:** 1\
**Last updated:** [December 14, 2016, 9:13am UTC](https://discuss.elastic.co/t/query-statistics-difference/68988 "2016-12-14T09:13:19Z")

</div>

Hi, I have queried data from Kibana and took 3 samples of statistics for the same query. I have got 3 different results. Query Duration 2366ms Request Duration 2502ms Hits 3 Index - Query Duration 2346ms Reques…

---

## [Get data for time range window](https://discuss.elastic.co/t/get-data-for-time-range-window/68904)

<div class="topic-metadata">

**Author:** [@Martin\_Duris](https://discuss.elastic.co/u/Martin_Duris)\
**Replies:** 4\
**Last updated:** [December 14, 2016, 8:44am UTC](https://discuss.elastic.co/t/get-data-for-time-range-window/68904 "2016-12-14T08:44:05Z")

</div>

Hi, lets have simple login data (@timestamp, id of user). This data we have for one month. Can i create table / bar graph where will be count of logins (per day) for all month BUT only during 14:00 - 18:00. something…

---

## [Advanced settings via config file possible?](https://discuss.elastic.co/t/advanced-settings-via-config-file-possible/68862)

<div class="topic-metadata">

**Author:** [@ShinyMcShine](https://discuss.elastic.co/u/ShinyMcShine)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 7:37am UTC](https://discuss.elastic.co/t/advanced-settings-via-config-file-possible/68862 "2016-12-14T07:37:38Z")

</div>

Hello there! Is it possible to set the advanced settings (e.g. doc\_table:highlight or state:storeinSessionStorage) via config file? I'm doing a lot of testing right now, which also involves an occasional fresh installa…

---

## [Why is query duration is faster in the 2nd attempt than the initial attempt in Kibana dashboard?](https://discuss.elastic.co/t/why-is-query-duration-is-faster-in-the-2nd-attempt-than-the-initial-attempt-in-kibana-dashboard/68963)

<div class="topic-metadata">

**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Replies:** 4\
**Last updated:** [December 14, 2016, 4:32am UTC](https://discuss.elastic.co/t/why-is-query-duration-is-faster-in-the-2nd-attempt-than-the-initial-attempt-in-kibana-dashboard/68963 "2016-12-14T04:32:08Z")

</div>

Hi. I recently realized that query performance is much better in the 2nd attempt than the initial attempt in Kibana dashboard . Initial attempt. Query Duration 5056ms Request Duration 5257ms Hits 1863206 Index "ope…

---

## [KIBANA: This field is present in your elasticsearch mapping but not in any documents in the search results. You may still be able to visualize or search on it](https://discuss.elastic.co/t/kibana-this-field-is-present-in-your-elasticsearch-mapping-but-not-in-any-documents-in-the-search-results-you-may-still-be-able-to-visualize-or-search-on-it/68847)

<div class="topic-metadata">

**Author:** [@pjhu](https://discuss.elastic.co/u/pjhu)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 2:05am UTC](https://discuss.elastic.co/t/kibana-this-field-is-present-in-your-elasticsearch-mapping-but-not-in-any-documents-in-the-search-results-you-may-still-be-able-to-visualize-or-search-on-it/68847 "2016-12-14T02:05:34Z")

</div>

Please help me.

---

## [Timelion -1M offeset producing unexpected results](https://discuss.elastic.co/t/timelion-1m-offeset-producing-unexpected-results/68500)

<div class="topic-metadata">

**Author:** [@sjivan](https://discuss.elastic.co/u/sjivan)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 1:45am UTC](https://discuss.elastic.co/t/timelion-1m-offeset-producing-unexpected-results/68500 "2016-12-14T01:45:11Z")

</div>

Hi, What does -1M offset in Timelion translate to? Is it aware of calendar months or does it just translate to the number of days in the current month? I have the Kibana time filter set to last month and the metric is …

---

## [Kibana single date picker visualization plugin](https://discuss.elastic.co/t/kibana-single-date-picker-visualization-plugin/68748)

<div class="topic-metadata">

**Author:** [@sjivan](https://discuss.elastic.co/u/sjivan)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 1:33am UTC](https://discuss.elastic.co/t/kibana-single-date-picker-visualization-plugin/68748 "2016-12-14T01:33:20Z")

</div>

Hi, I have a requirement to allow the user to easily pick a single date from a date picker and this should effectively apply an absolute range filter for the day from 00:00:00.000 to 23:59:59.999. The Kibana Absolute dat…

---

## [How to auto set the defualt index-pattern?](https://discuss.elastic.co/t/how-to-auto-set-the-defualt-index-pattern/68877)

<div class="topic-metadata">

**Author:** [@shalq](https://discuss.elastic.co/u/shalq)\
**Replies:** 2\
**Last updated:** [December 14, 2016, 12:55am UTC](https://discuss.elastic.co/t/how-to-auto-set-the-defualt-index-pattern/68877 "2016-12-14T00:55:14Z")

</div>

I have setup ELK 5.1.1, and I want every user has its own default index-pattern, so I'd like to know how kibana get default index ? I inspect the http request on firefox, but I can't find any request about fetching def…

---

## [Extract the underlying query from a filter which I created visually](https://discuss.elastic.co/t/extract-the-underlying-query-from-a-filter-which-i-created-visually/68767)

<div class="topic-metadata">

**Author:** [@coder-98103](https://discuss.elastic.co/u/coder-98103)\
**Replies:** 3\
**Last updated:** [December 13, 2016, 11:08pm UTC](https://discuss.elastic.co/t/extract-the-underlying-query-from-a-filter-which-i-created-visually/68767 "2016-12-13T23:08:43Z")

</div>

I am new to the Elastic Stack, so far it has been super-fun to learn. Thanks for making this great toolkit available! The feature I most love in Kibana is the feature where you select a region from a timeline or a slic…

---

## [Datatable config case help](https://discuss.elastic.co/t/datatable-config-case-help/68123)

<div class="topic-metadata">

**Author:** [@joodies](https://discuss.elastic.co/u/joodies)\
**Replies:** 3\
**Last updated:** [December 13, 2016, 8:37pm UTC](https://discuss.elastic.co/t/datatable-config-case-help/68123 "2016-12-13T20:37:01Z")

</div>

Assuming i have data as follow in ES, type status a new a wip b new b new a done then i need a data-table in Kibana 5.0, type new wip done a 1 …

---

## [Inspect Button in Kibana 5.0.2](https://discuss.elastic.co/t/inspect-button-in-kibana-5-0-2/68884)

<div class="topic-metadata">

**Author:** [@Ravikumar\_G](https://discuss.elastic.co/u/Ravikumar_G)\
**Replies:** 4\
**Last updated:** [December 13, 2016, 8:35pm UTC](https://discuss.elastic.co/t/inspect-button-in-kibana-5-0-2/68884 "2016-12-13T20:35:38Z")

</div>

Hi I'm trying to find Inspect button in kibana 5.0.2 as we can see kibana 3.1.2 has flexibility to select to see api request url is it possible in new kibana 5.0.2 ? curl -XGET '//localhost:9200/\_\_es/logstash-2016.12.…

---

## [How to split URL in kibana](https://discuss.elastic.co/t/how-to-split-url-in-kibana/64873)

<div class="topic-metadata">

**Author:** [@florentmair](https://discuss.elastic.co/u/florentmair)\
**Replies:** 3\
**Last updated:** [December 13, 2016, 8:27pm UTC](https://discuss.elastic.co/t/how-to-split-url-in-kibana/64873 "2016-12-13T20:27:09Z")

</div>

Hello Is it possible to parse URL, keep the first argument and graph it. For example, i have some datas like this : site1/page1.html site1/page2.html site1/dir/index.html site2/index.php site3/index.php i want visua…

---

## [Using a string value (multistate) as Y-Axis](https://discuss.elastic.co/t/using-a-string-value-multistate-as-y-axis/66120)

<div class="topic-metadata">

**Author:** [@Myllka](https://discuss.elastic.co/u/Myllka)\
**Replies:** 7\
**Last updated:** [December 13, 2016, 8:25pm UTC](https://discuss.elastic.co/t/using-a-string-value-multistate-as-y-axis/66120 "2016-12-13T20:25:50Z")

</div>

Hi everyone, I'm new at using Kibana and I need some help. I managed to create some graphics with my datas from Logstash/Elasticsearch (like how many of certain type of message by day), but I'm now stuck with one graph…

---

## [How to aggregate data like mysql query? - kibana](https://discuss.elastic.co/t/how-to-aggregate-data-like-mysql-query-kibana/67922)

<div class="topic-metadata">

**Author:** [@bu.gworks.mobi](https://discuss.elastic.co/u/bu.gworks.mobi)\
**Replies:** 4\
**Last updated:** [December 13, 2016, 8:22pm UTC](https://discuss.elastic.co/t/how-to-aggregate-data-like-mysql-query-kibana/67922 "2016-12-13T20:22:12Z")

</div>

Below mysql query return life time sales report and avg sales report from sales\_order table. I have pushed sale\_order table into elasticsearch but I don't know how to aggregate for the below query in kibana to view life …

---

## [Kibana 5 - Stacked bar plot with a different filter for each color](https://discuss.elastic.co/t/kibana-5-stacked-bar-plot-with-a-different-filter-for-each-color/67270)

<div class="topic-metadata">

**Author:** [@Uri\_Elias](https://discuss.elastic.co/u/Uri_Elias)\
**Replies:** 2\
**Last updated:** [December 13, 2016, 8:21pm UTC](https://discuss.elastic.co/t/kibana-5-stacked-bar-plot-with-a-different-filter-for-each-color/67270 "2016-12-13T20:21:35Z")

</div>

Hi all, I'm having a bit of truble trying to get Kibana do a certain bar chart. In a ridiculous reduction, it looks like this: My data consists of documents of the following structure: FULL NAME: "Michael Jordan" P…

---

## [Kibana 5 | apply regex on scripted fields](https://discuss.elastic.co/t/kibana-5-apply-regex-on-scripted-fields/66898)

<div class="topic-metadata">

**Author:** [@jerome831361](https://discuss.elastic.co/u/jerome831361)\
**Replies:** 6\
**Last updated:** [December 13, 2016, 8:19pm UTC](https://discuss.elastic.co/t/kibana-5-apply-regex-on-scripted-fields/66898 "2016-12-13T20:19:33Z")

</div>

Hello, I'm using Kibana to view my logs. I have some URLs like this: /myapp/bla/bla/test.shtml;jsessionid=3CF74CA6abht48753DA243C5338222EE.jvmid?show=blaa At the moment, I'm using the following regex in logstash to…

---

## [Extract data with a Scripted Field - get domain name from URL string?](https://discuss.elastic.co/t/extract-data-with-a-scripted-field-get-domain-name-from-url-string/61746)

<div class="topic-metadata">

**Author:** [@Grant\_Griffith](https://discuss.elastic.co/u/Grant_Griffith)\
**Replies:** 2\
**Last updated:** [December 13, 2016, 8:14pm UTC](https://discuss.elastic.co/t/extract-data-with-a-scripted-field-get-domain-name-from-url-string/61746 "2016-12-13T20:14:48Z")

</div>

Hey everyone, I'm using an ELK stack for our bind (DNS) query logs and would like to create a "Top Domains" visualization which I can almost do with the full 'dns\_dest' field. But, I don't want the full URL of the lookup…

---

## [Why is Kibana unable to aggregate non-indexed fields that have doc\_values=True?](https://discuss.elastic.co/t/why-is-kibana-unable-to-aggregate-non-indexed-fields-that-have-doc-values-true/67879)

<div class="topic-metadata">

**Author:** [@leom](https://discuss.elastic.co/u/leom)\
**Replies:** 4\
**Last updated:** [December 13, 2016, 5:02pm UTC](https://discuss.elastic.co/t/why-is-kibana-unable-to-aggregate-non-indexed-fields-that-have-doc-values-true/67879 "2016-12-13T17:02:02Z")

</div>

I have an index with a field, F, that has the following mapping: "mapping": { "type": "double", "doc\_values": True, "index": False …

[Previous page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=1011)

[Next page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=1013)
