# Kibana **URL:** https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=258 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 259 --- ## [Kibana suricata integration](https://discuss.elastic.co/t/kibana-suricata-integration/290363)
**Author:** [@algira37](https://discuss.elastic.co/u/algira37)\ **Replies:** 1\ **Last updated:** [December 13, 2021, 9:47am UTC](https://discuss.elastic.co/t/kibana-suricata-integration/290363 "2021-12-13T09:47:45Z")
Hello, I added suricata integration to my system, but I can't use filebeat suricata module so I configured filebeat to send logs without suricata module to ELK, I just wondering is there any solution to use kibana inte… --- ## [Kibana dashboard spacing between values in an array](https://discuss.elastic.co/t/kibana-dashboard-spacing-between-values-in-an-array/289402)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 2\ **Last updated:** [December 13, 2021, 9:45am UTC](https://discuss.elastic.co/t/kibana-dashboard-spacing-between-values-in-an-array/289402 "2021-12-13T09:45:52Z")
Hello I am passing values as an array to elasticsearch and when I saw the result I got a question. Is it possible to make line spacing in an array so that it can be easier to read? At the moment, the kibana dashboard … --- ## [Kibana Visualization filtering data based on aggregation](https://discuss.elastic.co/t/kibana-visualization-filtering-data-based-on-aggregation/291610)
**Author:** [@anas\_pp](https://discuss.elastic.co/u/anas_pp)\ **Replies:** 0\ **Last updated:** [December 13, 2021, 9:34am UTC](https://discuss.elastic.co/t/kibana-visualization-filtering-data-based-on-aggregation/291610 "2021-12-13T09:34:42Z")
I have requirement that to show the count of running jobs and completed in Pie chart . I am receiving status of jobs in real time . To show the count of the jobs that are currently in running state I have to filter those… --- ## [Kibana Single Click Drilldown events.value Array Issue](https://discuss.elastic.co/t/kibana-single-click-drilldown-events-value-array-issue/290925)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 3\ **Last updated:** [December 12, 2021, 6:56pm UTC](https://discuss.elastic.co/t/kibana-single-click-drilldown-events-value-array-issue/290925 "2021-12-12T18:56:37Z")
Hi there! I have an aggregation-based data table where I would like to use the drilldown capabilities. My table shows the following fields Id, Description, Severity, Hostname, Count My goal is to have a single click d… --- ## [Does watcher works on a higher version?](https://discuss.elastic.co/t/does-watcher-works-on-a-higher-version/291503)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 2\ **Last updated:** [December 12, 2021, 12:22pm UTC](https://discuss.elastic.co/t/does-watcher-works-on-a-higher-version/291503 "2021-12-12T12:22:19Z")
Hi I have a cluster with version 7.6.2 I want to upgrade the cluster with rpm package and just want to know, If I upgrade Elasticsearch and Kibana to 7.15.2 , after upgrading, all of my watcher work as same as the curr… --- ## [Filebeat not working](https://discuss.elastic.co/t/filebeat-not-working/291337)
**Author:** [@Shubham\_Singh](https://discuss.elastic.co/u/Shubham_Singh)\ **Replies:** 2\ **Last updated:** [December 11, 2021, 4:25pm UTC](https://discuss.elastic.co/t/filebeat-not-working/291337 "2021-12-11T16:25:19Z")
Filebeat is not logging logs from a path. Here is my filebeat config - filebeat.inputs: type: log enabled: true paths: /var/log/xyz/\*/ \*.log input\_type: log json.keys\_under\_root: true json.add\_error\_key: true j… --- ## [Filter out documents in Discover view that match a set of saved queries/searches?](https://discuss.elastic.co/t/filter-out-documents-in-discover-view-that-match-a-set-of-saved-queries-searches/291339)
**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\ **Replies:** 1\ **Last updated:** [December 10, 2021, 9:46pm UTC](https://discuss.elastic.co/t/filter-out-documents-in-discover-view-that-match-a-set-of-saved-queries-searches/291339 "2021-12-10T21:46:09Z")
My team is running a logging stack, where they need to follow up on error events in Kibana. Unfortunately, some errors take a while to get fixed, and some actually never get fixed because they are caused by external eve… --- ## [How to hide all the 'getting started/add data/' links](https://discuss.elastic.co/t/how-to-hide-all-the-getting-started-add-data-links/291285)
**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:25pm UTC](https://discuss.elastic.co/t/how-to-hide-all-the-getting-started-add-data-links/291285 "2021-12-10T17:25:10Z")
just trying to configure the system (kibana/elastic) for endusers. how can I avoid all the links to 'add data', links to '/home/app#' and everything else that is nice to have in a 'how to get started' mode. but I am … --- ## [Rollup feature can't create job - Index pattern must match indices that contain time fields](https://discuss.elastic.co/t/rollup-feature-cant-create-job-index-pattern-must-match-indices-that-contain-time-fields/291436)
**Author:** [@cjabrantes](https://discuss.elastic.co/u/cjabrantes)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 5:07pm UTC](https://discuss.elastic.co/t/rollup-feature-cant-create-job-index-pattern-must-match-indices-that-contain-time-fields/291436 "2021-12-10T17:07:16Z")
Hi, I was exploring the rollup data feature, but i m not able to create a job via kibana UI, but i get the following error: Nevertheless i have date fields in the indice. Any ideas? Thanks, --- ## [Discrepancy between CPU usage shown in Kibana vs AWS cloud watch metrics](https://discuss.elastic.co/t/discrepancy-between-cpu-usage-shown-in-kibana-vs-aws-cloud-watch-metrics/291346)
**Author:** [@taugusti](https://discuss.elastic.co/u/taugusti)\ **Replies:** 5\ **Last updated:** [December 10, 2021, 3:24pm UTC](https://discuss.elastic.co/t/discrepancy-between-cpu-usage-shown-in-kibana-vs-aws-cloud-watch-metrics/291346 "2021-12-10T15:24:49Z")
I run Elasticsearch on EC2 instances launched in AWS. I use version 7.11.2. I've been load testing searches and I see CPU spikes up to 100% on data nodes when I look in Kibana. However, in AWS cloud watch I never see CPU… --- ## [Not able to save Visualize or Query](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358)
**Author:** [@Luiz](https://discuss.elastic.co/u/Luiz)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 10:52am UTC](https://discuss.elastic.co/t/not-able-to-save-visualize-or-query/291358 "2021-12-10T10:52:09Z")
Hi all, I am not able to save new query or visualize in Kibana, I am getting message "An error occurred while saving. Error: Forbidden" I am using version 7.11.0. I have search about the error here and other forums all… --- ## [Kibana rule auditlogs overwhelm audit logs](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301)
**Author:** [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-rule-auditlogs-overwhelm-audit-logs/291301 "2021-12-10T08:26:49Z")
Hello There, We are trying to single out user actions, which contains update create or delete actions under audit\_logs. Our unix administration trying to catch these logs and produce mail alerts, but since we have rules… --- ## [Is any API to get request string of Kibana?](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281)
**Author:** [@Frank\_Kuo](https://discuss.elastic.co/u/Frank_Kuo)\ **Replies:** 2\ **Last updated:** [December 10, 2021, 12:44am UTC](https://discuss.elastic.co/t/is-any-api-to-get-request-string-of-kibana/291281 "2021-12-10T00:44:22Z")
Hello, I have many search objects at Kibana. Is any API to get request string? just set up server info/ object name, and output is request string. Is any API there? (to get discover-\>inspect-\>request string) --- ## [Can´t start Fleet server](https://discuss.elastic.co/t/can-t-start-fleet-server/291352)
**Author:** [@almedor](https://discuss.elastic.co/u/almedor)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:51pm UTC](https://discuss.elastic.co/t/can-t-start-fleet-server/291352 "2021-12-09T16:51:50Z")
Hi, I´ve just deployed an ELK develop environment (windows msi) but i can´t (i don´t know) how to deploy the fleet server. I´ve followed these steps: but i always received the same error: What am i missing or doing wr… --- ## [Pie chart labels canvas](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 4:48pm UTC](https://discuss.elastic.co/t/pie-chart-labels-canvas/291351 "2021-12-09T16:48:39Z")
Hi, I have a pie chart in canvas that I would like to only show the percentage in the pie, and next to it the legend. I tried to clink in inspect to try some CSS but with no avail, because I just don't know what I'm doi… --- ## [Unable to perform a Regex Search for Asterisk](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036)
**Author:** [@GreenBlueSkys](https://discuss.elastic.co/u/GreenBlueSkys)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 4:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-a-regex-search-for-asterisk/291036 "2021-12-09T16:44:18Z")
\[Edit: Elastic parsed out the Asterisk, the proper log is now visible\] I am trying to perform a search against an AWS CloudTrail log identifying different instances of the asterisk (or escaped wildcard). To do this I a… --- ## [Kibana not successfully filtering in Discover](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918)
**Author:** [@agentw](https://discuss.elastic.co/u/agentw)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 2:51pm UTC](https://discuss.elastic.co/t/kibana-not-successfully-filtering-in-discover/290918 "2021-12-09T14:51:44Z")
I recently updated our Elastic instances to 7.15.2. I am seeing mixed results when applying filters in Discover. For example, when filtering out a host on the agent.hostname field (i.e. 'NOT agent.hostname: example\_host)… --- ## [Kibana Logs Stream as Dashboard Visualization are not streaming live](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758)
**Author:** [@kshepitzki1](https://discuss.elastic.co/u/kshepitzki1)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 2:36pm UTC](https://discuss.elastic.co/t/kibana-logs-stream-as-dashboard-visualization-are-not-streaming-live/290758 "2021-12-09T14:36:39Z")
When I save a Kibana Live Log Stream as a visualization in the Visualization Library and then import it into a Dashboard, the Live Streaming feature is gone and I have to manually refresh it. I need it in a dashboard so… --- ## [Flood-stage watermark?](https://discuss.elastic.co/t/flood-stage-watermark/291217)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 3\ **Last updated:** [December 9, 2021, 1:50pm UTC](https://discuss.elastic.co/t/flood-stage-watermark/291217 "2021-12-09T13:50:19Z")
Hello. English isn't my first language. How do I troubleshoot this error-message? What does it mean? What is the solution? We never got this error when we used the old daily indices. Now we get them after transitionin… --- ## [Apply ingest node pipeline to an index/data stream](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328)
**Author:** [@girija](https://discuss.elastic.co/u/girija)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 1:07pm UTC](https://discuss.elastic.co/t/apply-ingest-node-pipeline-to-an-index-data-stream/291328 "2021-12-09T13:07:40Z")
Hello, I have created a ingest node pipeline to transform data received via elastic. Now I need to apply this pipeline to my index so that I can see the transformed fields under discover, and also create charts usin… --- ## [How to find a large text from documents](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324)
**Author:** [@RamyaE](https://discuss.elastic.co/u/RamyaE)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/how-to-find-a-large-text-from-documents/291324 "2021-12-09T12:27:45Z")
Hi All, I have a textfield with name textContent, where we insert all the contents. I wanted to find the large text from all the textContents. How can I find the large text from those documents, or anyway to know the w… --- ## [Possible to have Kibana rules check at fixed times?](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 11:31am UTC](https://discuss.elastic.co/t/possible-to-have-kibana-rules-check-at-fixed-times/291316 "2021-12-09T11:31:53Z")
Dear all =) When creating a Elasticsearch query to check every 24 hours, it will check every day at the same time it was created. Is it possible to have it check at a specific time? E.g. I create it at 14:00, but it sh… --- ## [How can we restrict to show data on kibana from different users?](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214)
**Author:** [@sajesh\_sb](https://discuss.elastic.co/u/sajesh_sb)\ **Replies:** 5\ **Last updated:** [December 9, 2021, 11:19am UTC](https://discuss.elastic.co/t/how-can-we-restrict-to-show-data-on-kibana-from-different-users/291214 "2021-12-09T11:19:52Z")
There are two dashboards created which are having independent data. I need to create three users - Admin, user-1, and user-2. Admin can see both the dashboards, user-1 should be able to see dashboard-1 and user-2 should … --- ## [Añadir valor mediante scripted field a otro campo](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312)
**Author:** [@Javier\_Garcia\_Alvare](https://discuss.elastic.co/u/Javier_Garcia_Alvare)\ **Replies:** 0\ **Last updated:** [December 9, 2021, 10:47am UTC](https://discuss.elastic.co/t/anadir-valor-mediante-scripted-field-a-otro-campo/291312 "2021-12-09T10:47:44Z")
Hola, alguien me puede ayudar. Necesito mediante scripted fields copiar una dato de un campo a otro campo existente. Es decir: el nombre del scripted filed es: vMEDIO if (doc\['CANAL'\].value.toString().length() \>= 5 &&… --- ## [Unable to send email with watcher](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661)
**Author:** [@Alejandro\_Chaves](https://discuss.elastic.co/u/Alejandro_Chaves)\ **Replies:** 2\ **Last updated:** [December 9, 2021, 8:24am UTC](https://discuss.elastic.co/t/unable-to-send-email-with-watcher/290661 "2021-12-09T08:24:11Z")
{ "id" : "send\_email", "type" : "email", "status" : "failure", "error" : { "root\_cause" : \[ { "type" : "messaging\_exception", "reason" : "failed to send email with subject \[Watcher Notification\] via account \[gmai… --- ## [Merging two fields in a visualization](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 4\ **Last updated:** [December 9, 2021, 7:53am UTC](https://discuss.elastic.co/t/merging-two-fields-in-a-visualization/291139 "2021-12-09T07:53:43Z")
Team! I need to merge two fields into one in a Kibana visualization. Does anyone know how to do that? Have a good one :slight\_smile: --- ## [Increase Kibana data table bucket size](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284)
**Author:** [@cps598](https://discuss.elastic.co/u/cps598)\ **Replies:** 1\ **Last updated:** [December 9, 2021, 7:40am UTC](https://discuss.elastic.co/t/increase-kibana-data-table-bucket-size/291284 "2021-12-09T07:40:21Z")
Kibana v 7.15.1 I want to show some items in the Kibana data table. And I found that the size of the bucket restricts the showing results. For example, if I set the size to 20, some log data will not be displayed on the… --- ## [TSVB metrics moving around/shaking on screen and strange refresh behaviour](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167)
**Author:** [@Sketchy](https://discuss.elastic.co/u/Sketchy)\ **Replies:** 2\ **Last updated:** [December 8, 2021, 9:59pm UTC](https://discuss.elastic.co/t/tsvb-metrics-moving-around-shaking-on-screen-and-strange-refresh-behaviour/291167 "2021-12-08T21:59:04Z")
Having issues, for a long time now with the TSVB metrics moving around on the screen, shaking about/moving side to side. It used to be much worse in previous versions and I have seen the issue happening again recently on… --- ## [No data after CSV Export - Kibana](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 5\ **Last updated:** [December 8, 2021, 7:24pm UTC](https://discuss.elastic.co/t/no-data-after-csv-export-kibana/288486 "2021-12-08T19:24:34Z")
Continuing the discussion from Reporting - CSV Export: contains partial data: Hi Team, currently we are facing two issues related to csv Export. If index is frozen then how to export data in csv as we are getting emp… --- ## [Dashboard - Creating a complex graph with 3 metrics](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121)
**Author:** [@Alice\_S](https://discuss.elastic.co/u/Alice_S)\ **Replies:** 1\ **Last updated:** [December 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/dashboard-creating-a-complex-graph-with-3-metrics/291121 "2021-12-08T19:10:26Z")
Hi, I would really appreciate getting some help: I'm trying to visualize my data in a more convenient way and to combine 3 graphs into one. The graph should show distinct users and the sum of a specific column by time… [Previous page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=257) [Next page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=259)