# Kibana

**URL:** https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=263

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 264

---

## [Different .kibana\_\* indices After upgrading](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 4\
**Last updated:** [November 29, 2021, 9:42am UTC](https://discuss.elastic.co/t/different-kibana-indices-after-upgrading/289912 "2021-11-29T09:42:30Z")

</div>

Upgrade ELK stack from 7.13 to 7.15 I checked /\_cat/indices/.kibana?v\* health status index uuid pri rep docs.count docs.deleted store.size pri.store.size green open .kiban…

---

## [Anomaly on specific value (0)](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400)

<div class="topic-metadata">

**Author:** [@zangero98](https://discuss.elastic.co/u/zangero98)\
**Replies:** 1\
**Last updated:** [November 29, 2021, 9:41am UTC](https://discuss.elastic.co/t/anomaly-on-specific-value-0/290400 "2021-11-29T09:41:12Z")

</div>

hello guys, (1) I want to make alerts with machine learning when a specific log source don't send any logs for 10 minutes (availability job). I tried it with low count and custom rules but there always showed up anomali…

---

## [Template mapping with one field](https://discuss.elastic.co/t/template-mapping-with-one-field/290311)

<div class="topic-metadata">

**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\
**Replies:** 2\
**Last updated:** [November 29, 2021, 7:18am UTC](https://discuss.elastic.co/t/template-mapping-with-one-field/290311 "2021-11-29T07:18:41Z")

</div>

Hi Experts, We are using multi fields Template mapping for some fields. example:- we are using attribute1 to attribute15 fields...for this we are set mapping for all individual fields with same property and data type. N…

---

## [Reading data from MS-SQL](https://discuss.elastic.co/t/reading-data-from-ms-sql/290391)

<div class="topic-metadata">

**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\
**Replies:** 1\
**Last updated:** [November 29, 2021, 4:49am UTC](https://discuss.elastic.co/t/reading-data-from-ms-sql/290391 "2021-11-29T04:49:11Z")

</div>

Dear All, Good morning I am trying to configure ES Kibana to read the data from MS-SQL to the Kibana dashboard, on the option of "adding data", we can see the option of "Microsoft SQL Server Metrics " , this option gi…

---

## [Human Readable Duration - Remove Day Format](https://discuss.elastic.co/t/human-readable-duration-remove-day-format/290108)

<div class="topic-metadata">

**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\
**Replies:** 10\
**Last updated:** [November 29, 2021, 4:48am UTC](https://discuss.elastic.co/t/human-readable-duration-remove-day-format/290108 "2021-11-29T04:48:39Z")

</div>

Hi, I would like to use the human-readable duration but report seconds, minutes and hours only. For example, I want to see 24 hours instead of 1 day. Is this possible? Thanks in advance, Matt

---

## [Table visualization: calculate percentage](https://discuss.elastic.co/t/table-visualization-calculate-percentage/290304)

<div class="topic-metadata">

**Author:** [@simonlucalandi](https://discuss.elastic.co/u/simonlucalandi)\
**Replies:** 3\
**Last updated:** [November 26, 2021, 4:49pm UTC](https://discuss.elastic.co/t/table-visualization-calculate-percentage/290304 "2021-11-26T16:49:34Z")

</div>

Hi all. Let's say that I have the following documents in an index { "user": "foo", "cost": 10, "revenue": 12 }, { "user": "bar", "cost": 20, "revenue": 25 } { "user": "foo", "cost": 15, "reve…

---

## [I would like to add new date range picker in kibana dashboard, my kibana setup is in developement mode in ubuntu 16.04](https://discuss.elastic.co/t/i-would-like-to-add-new-date-range-picker-in-kibana-dashboard-my-kibana-setup-is-in-developement-mode-in-ubuntu-16-04/289264)

<div class="topic-metadata">

**Author:** [@Swapnil\_Jadhav](https://discuss.elastic.co/u/Swapnil_Jadhav)\
**Replies:** 4\
**Last updated:** [November 26, 2021, 11:40am UTC](https://discuss.elastic.co/t/i-would-like-to-add-new-date-range-picker-in-kibana-dashboard-my-kibana-setup-is-in-developement-mode-in-ubuntu-16-04/289264 "2021-11-26T11:40:25Z")

</div>

Anyone knows that can help me to add this.. Thanks in advanced

---

## [Kibana error for theme validation](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878)

<div class="topic-metadata">

**Author:** [@DPattee](https://discuss.elastic.co/u/DPattee)\
**Replies:** 1\
**Last updated:** [November 26, 2021, 11:19am UTC](https://discuss.elastic.co/t/kibana-error-for-theme-validation/289878 "2021-11-26T11:19:14Z")

</div>

I just noticed that my kibana log is full of 'failed validation' errors... like zillions of them: log \[11:21:26.836\] \[warning\]\[ui-settings-service\] Ignore invalid UiSettings value. Error: \[validation \[theme:version\]\]…

---

## [Pie chart with filtering](https://discuss.elastic.co/t/pie-chart-with-filtering/290271)

<div class="topic-metadata">

**Author:** [@thenotoriousciu](https://discuss.elastic.co/u/thenotoriousciu)\
**Replies:** 3\
**Last updated:** [November 26, 2021, 11:14am UTC](https://discuss.elastic.co/t/pie-chart-with-filtering/290271 "2021-11-26T11:14:30Z")

</div>

Hello, everyone. I am trying to create a pie-chart based on the below data, but I am pretty sure that it can only be don with Vega, not with a regular pie-chart. However, I thought I could ask this question, see if anyo…

---

## [Unable to search for phrases between double quotes in Saved Objects Explorer](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 1\
**Last updated:** [November 26, 2021, 11:12am UTC](https://discuss.elastic.co/t/unable-to-search-for-phrases-between-double-quotes-in-saved-objects-explorer/288561 "2021-11-26T11:12:13Z")

</div>

Hello, It seems it's no longer possible to search for objects in the Saved Objects Explorer with multiple words between double quotes. The result is that it's very hard to find some objects... For example searching for…

---

## [In canvas, how do I get the content of one chart and use it in another chart?](https://discuss.elastic.co/t/in-canvas-how-do-i-get-the-content-of-one-chart-and-use-it-in-another-chart/288198)

<div class="topic-metadata">

**Author:** [@li\_li](https://discuss.elastic.co/u/li_li)\
**Replies:** 1\
**Last updated:** [November 26, 2021, 11:02am UTC](https://discuss.elastic.co/t/in-canvas-how-do-i-get-the-content-of-one-chart-and-use-it-in-another-chart/288198 "2021-11-26T11:02:53Z")

</div>

Hello, I have a question to ask, how does canvas get the content in the inserted chart? As shown below, in canvas, how do I get the ordinate A of this bar graph and apply it to another graph?

---

## [Markdown link removed?](https://discuss.elastic.co/t/markdown-link-removed/290134)

<div class="topic-metadata">

**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\
**Replies:** 2\
**Last updated:** [November 26, 2021, 10:51am UTC](https://discuss.elastic.co/t/markdown-link-removed/290134 "2021-11-26T10:51:51Z")

</div>

Hi, I've always used Text element in Canvas with this markdown: creating a link on Canvas. In this way I could have a link "panel". Now this doesn't work anymore. I have to put always a text inside square brackets..…

---

## [To change Label Position](https://discuss.elastic.co/t/to-change-label-position/290238)

<div class="topic-metadata">

**Author:** [@SwetaD](https://discuss.elastic.co/u/SwetaD)\
**Replies:** 4\
**Last updated:** [November 26, 2021, 10:36am UTC](https://discuss.elastic.co/t/to-change-label-position/290238 "2021-11-26T10:36:51Z")

</div>

Can someone please help on how to change the Label Position from bottom to top? ONU ALIAS to be on top instead of bottom. Using Kibana v7.10.0

---

## [400 bad request error](https://discuss.elastic.co/t/400-bad-request-error/290265)

<div class="topic-metadata">

**Author:** [@Keerthana\_Paga](https://discuss.elastic.co/u/Keerthana_Paga)\
**Replies:** 1\
**Last updated:** [November 26, 2021, 9:56am UTC](https://discuss.elastic.co/t/400-bad-request-error/290265 "2021-11-26T09:56:49Z")

</div>

root@:/etc/kibana# curl -IL localhost:5601 HTTP/1.1 302 Found location: /spaces/enter kbn-name: kbn-license-sig: cache-control: private, no-cache, no-store, must-revalidate content-length: 0 Date: Fri, 26 Nov 2021…

---

## [Creating Bar Chart with missing values on the x axis](https://discuss.elastic.co/t/creating-bar-chart-with-missing-values-on-the-x-axis/288967)

<div class="topic-metadata">

**Author:** [@bodach](https://discuss.elastic.co/u/bodach)\
**Replies:** 1\
**Last updated:** [November 26, 2021, 10:02am UTC](https://discuss.elastic.co/t/creating-bar-chart-with-missing-values-on-the-x-axis/288967 "2021-11-26T10:02:31Z")

</div>

Hello, I created a bar chart for different companies using a dropdown filter. I want to see all the values there even if they dont have any related values for that column. To give an example. This is showing all the v…

---

## [Unable to update ui setting request failed with status code: 429](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001)

<div class="topic-metadata">

**Author:** [@ftester](https://discuss.elastic.co/u/ftester)\
**Replies:** 5\
**Last updated:** [November 25, 2021, 10:59pm UTC](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-429/290001 "2021-11-25T22:59:19Z")

</div>

Hello guys, The Scinario: I have 4 dockers, elasticsearch, kibana, filebeat, dvwa. So basically, I should attack dvwa and see the apache logs on kibana dashboard. I use Ubuntu server 20.4 to set up the docker on it an…

---

## [Heartbeat monitoring for a particular URL fails](https://discuss.elastic.co/t/heartbeat-monitoring-for-a-particular-url-fails/289219)

<div class="topic-metadata">

**Author:** [@maheshe](https://discuss.elastic.co/u/maheshe)\
**Replies:** 1\
**Last updated:** [November 25, 2021, 2:58pm UTC](https://discuss.elastic.co/t/heartbeat-monitoring-for-a-particular-url-fails/289219 "2021-11-25T14:58:35Z")

</div>

Hi, We are using heartbeat 7.9 client to dump the monitoring logs to Elasticsearch/Kibana 7.11 version. One particular url is returning monitor.status down even though the site is up and is returning 200. This is the s…

---

## [Alerts/Rules - Elasticsearch query grouped on hostname](https://discuss.elastic.co/t/alerts-rules-elasticsearch-query-grouped-on-hostname/290145)

<div class="topic-metadata">

**Author:** [@Garry](https://discuss.elastic.co/u/Garry)\
**Replies:** 0\
**Last updated:** [November 25, 2021, 9:03am UTC](https://discuss.elastic.co/t/alerts-rules-elasticsearch-query-grouped-on-hostname/290145 "2021-11-25T09:03:25Z")

</div>

I have an Elasticsearch query which emails out on an specific Windows Event Log event id. This is a basic query... { "query":{ "query\_string" : { "query" : "10028", "fields": \["event.code"\] } } } What I woul…

---

## [Anomaly detection in Machine learning kibana](https://discuss.elastic.co/t/anomaly-detection-in-machine-learning-kibana/290018)

<div class="topic-metadata">

**Author:** [@MAHALAKSHMI\_S](https://discuss.elastic.co/u/MAHALAKSHMI_S)\
**Replies:** 6\
**Last updated:** [November 25, 2021, 5:28am UTC](https://discuss.elastic.co/t/anomaly-detection-in-machine-learning-kibana/290018 "2021-11-25T05:28:57Z")

</div>

I created a "Categorization" based anomaly detection job and explored the job results in Kibana. I have used "Payload"(i.e String) field for categorization. Here I'm not sure what does "typical" value in anomaly explor…

---

## [How to create index-pattern for a specific tenant in Elasticsearch Kibana using API?](https://discuss.elastic.co/t/how-to-create-index-pattern-for-a-specific-tenant-in-elasticsearch-kibana-using-api/290087)

<div class="topic-metadata">

**Author:** [@triptesh1212](https://discuss.elastic.co/u/triptesh1212)\
**Replies:** 3\
**Last updated:** [November 25, 2021, 4:27am UTC](https://discuss.elastic.co/t/how-to-create-index-pattern-for-a-specific-tenant-in-elasticsearch-kibana-using-api/290087 "2021-11-25T04:27:16Z")

</div>

Hi I am following this API - Open Distro for Elasticsearch Documentation documentation to create tenant at Elasticsearch. We can also create an index using index API Create index API | Elasticsearch Guide \[7.15\] | Elast…

---

## [How to Create Login failed Rule](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862)

<div class="topic-metadata">

**Author:** [@Renz\_Aguilar](https://discuss.elastic.co/u/Renz_Aguilar)\
**Replies:** 2\
**Last updated:** [November 25, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862 "2021-11-25T01:46:22Z")

</div>

Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer.

---

## [Mapping conflict!](https://discuss.elastic.co/t/mapping-conflict/290084)

<div class="topic-metadata">

**Author:** [@Skeldren](https://discuss.elastic.co/u/Skeldren)\
**Replies:** 1\
**Last updated:** [November 24, 2021, 11:30pm UTC](https://discuss.elastic.co/t/mapping-conflict/290084 "2021-11-24T23:30:04Z")

</div>

Hey Guys! I have a question regarding a problem of Mapping conflict! I had to change one field type from string to integer. Due to the Index pattern include include both old indexes and new indexes, there are now confl…

---

## [Filter is removed when visualisation is saved](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655)

<div class="topic-metadata">

**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\
**Replies:** 2\
**Last updated:** [November 24, 2021, 9:39pm UTC](https://discuss.elastic.co/t/filter-is-removed-when-visualisation-is-saved/289655 "2021-11-24T21:39:04Z")

</div>

when trying to save a lens visualisation after adding a filter, the filter is instantly removed. See attached gif. Anyone know what might be the cause?

---

## [Plotting the result of nested aggregations in kibana](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074)

<div class="topic-metadata">

**Author:** [@M.KRISHNAKANT\_ACHARY](https://discuss.elastic.co/u/M.KRISHNAKANT_ACHARY)\
**Replies:** 1\
**Last updated:** [November 24, 2021, 3:11pm UTC](https://discuss.elastic.co/t/plotting-the-result-of-nested-aggregations-in-kibana/290074 "2021-11-24T15:11:15Z")

</div>

I have an index which has nested data types. when I am running this query { "size":0, "aggs": { "tenant": { "nested": { "path": "custom\_details.tenantname" }, "aggs": { "count1…

---

## [Negative axis does not work in TVSB](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010)

<div class="topic-metadata">

**Author:** [@sidharth\_vijayakumar](https://discuss.elastic.co/u/sidharth_vijayakumar)\
**Replies:** 2\
**Last updated:** [November 24, 2021, 9:23am UTC](https://discuss.elastic.co/t/negative-axis-does-not-work-in-tvsb/290010 "2021-11-24T09:23:03Z")

</div>

I am trying to plot a graph on kibana using TSVB where inbound traffic is on top and outbound traffic is on the bottom. I am not able to get it in negative y axis I tried to follow this demo but does not work in my kiban…

---

## [Is there a way to stop visualizations from refreshing when editing a Lens?](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020)

<div class="topic-metadata">

**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\
**Replies:** 2\
**Last updated:** [November 24, 2021, 9:41am UTC](https://discuss.elastic.co/t/is-there-a-way-to-stop-visualizations-from-refreshing-when-editing-a-lens/290020 "2021-11-24T09:41:34Z")

</div>

Hi, I'm using Kibana 7.15. is it possible to tell Kibana to stop refresh visualizations when editing a Lens? It's really slow and seems to affect the UI as I can't edit anything while visualization is refreshing. There s…

---

## [Kibana Enhanced Table 2 Total Values on Different Condition](https://discuss.elastic.co/t/kibana-enhanced-table-2-total-values-on-different-condition/289913)

<div class="topic-metadata">

**Author:** [@Avnish\_Singh](https://discuss.elastic.co/u/Avnish_Singh)\
**Replies:** 6\
**Last updated:** [November 24, 2021, 7:33am UTC](https://discuss.elastic.co/t/kibana-enhanced-table-2-total-values-on-different-condition/289913 "2021-11-24T07:33:23Z")

</div>

Hi, I have created an enhanced table now there is an option to do a sum on a computed column but it does the sum of the entire column whereas I want 2 sums based on condition. Is it possible if yes then how?

---

## [Modify sourcecode to achieve dashboard only mode](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936)

<div class="topic-metadata">

**Author:** [@laigood](https://discuss.elastic.co/u/laigood)\
**Replies:** 5\
**Last updated:** [November 24, 2021, 1:52am UTC](https://discuss.elastic.co/t/modify-sourcecode-to-achieve-dashboard-only-mode/289936 "2021-11-24T01:52:14Z")

</div>

I have an unsecurity es cluster，and i deploy a normal kibana for daily mangement and analysis data.then i want to deploy another kibana to achieve dashboard only mode,i want to modify source code to cut out other functio…

---

## [Port number ECS field data type](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992)

<div class="topic-metadata">

**Author:** [@groth](https://discuss.elastic.co/u/groth)\
**Replies:** 2\
**Last updated:** [November 23, 2021, 11:42pm UTC](https://discuss.elastic.co/t/port-number-ecs-field-data-type/289992 "2021-11-23T23:42:38Z")

</div>

Can someone please explain to me why port number ECS fields like source.port, destination.port, etc. are defined as numerical type long? When would port numbers from logs ever need to be used in any kind of mathematical …

---

## [Wildcard search in field doesn't work as expected](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365)

<div class="topic-metadata">

**Author:** [@lchan](https://discuss.elastic.co/u/lchan)\
**Replies:** 2\
**Last updated:** [November 23, 2021, 9:14pm UTC](https://discuss.elastic.co/t/wildcard-search-in-field-doesnt-work-as-expected/289365 "2021-11-23T21:14:42Z")

</div>

Hi all, I am on 7.13.1 on ElasticCloud. I mapped hostname via Logstash with syslog but for some reason the KQL search doesn't come out right. What am I doing wrong? search: hostname: cr1-ams1 Result: cr1-ams1 cr2-…

[Previous page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=262)

[Next page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=264)
