# Kibana **URL:** https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=276 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 277 --- ## [Subtracting 2 fields different document on Scripted Field / json input](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203)
**Author:** [@rikizita3](https://discuss.elastic.co/u/rikizita3)\ **Replies:** 1\ **Last updated:** [October 8, 2021, 2:44pm UTC](https://discuss.elastic.co/t/subtracting-2-fields-different-document-on-scripted-field-json-input/286203 "2021-10-08T14:44:12Z")
I have a set of data below. I want to add the red marker then subtract it to the blue marker. I tried using Scripted Field. But when I go back to discovery I have this error. If I will put it on the line gra… --- ## [Get Laste Value of each host with Query DSL in Discover](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 12:55pm UTC](https://discuss.elastic.co/t/get-laste-value-of-each-host-with-query-dsl-in-discover/286002 "2021-10-08T12:55:46Z")
Hi, Actually i store logs in Elastic. I would like to get all the last log collected from each host in Discover. If there is 20 differents hosts, the Discover have to show me 20 logs. I think i can use Elasticsearch Qu… --- ## [Create user with multiple roles(of different spaces) and having access to only single space](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591)
**Author:** [@srinielk](https://discuss.elastic.co/u/srinielk)\ **Replies:** 10\ **Last updated:** [October 8, 2021, 12:20pm UTC](https://discuss.elastic.co/t/create-user-with-multiple-roles-of-different-spaces-and-having-access-to-only-single-space/284591 "2021-10-08T12:20:56Z")
please advise how to create user with multiple roles(of different spaces) and having access to only single space --- ## [Alerting in Kibana](https://discuss.elastic.co/t/alerting-in-kibana/286212)
**Author:** [@josh12](https://discuss.elastic.co/u/josh12)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 10:57am UTC](https://discuss.elastic.co/t/alerting-in-kibana/286212 "2021-10-08T10:57:10Z")
Hi all, i saw alerting is paid version like sending mail or slack. I saw there is alterntive which iselastalert2. However, there is elastalert as well .what the difference. I plan to use docker --- ## [Options list control is not case sensitive](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 2\ **Last updated:** [October 8, 2021, 8:01am UTC](https://discuss.elastic.co/t/options-list-control-is-not-case-sensitive/285448 "2021-10-08T08:01:43Z")
Hi all, I'm using the version 7.13.4 The answers I found for this topic don't resolve my problem. It seems that the 'options list' control is not case sensitive. My mapping is: ... "template" : { "settin… --- ## [No matching indices found: No indices match pattern](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108)
**Author:** [@driveirk](https://discuss.elastic.co/u/driveirk)\ **Replies:** 3\ **Last updated:** [October 8, 2021, 5:25am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern/286108 "2021-10-08T05:25:56Z")
I have a lot of index patterns and not all of them now have an index in the elasticity, after updating the kibana from 7.8.1 to 7.14.0 I cannot go to Management - Index Patterns because of: Heavy load during transition … --- ## [Canvas image in data table cell](https://discuss.elastic.co/t/canvas-image-in-data-table-cell/286015)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 5:39pm UTC](https://discuss.elastic.co/t/canvas-image-in-data-table-cell/286015 "2021-10-07T17:39:01Z")
Trying to add image to data table in canvas Already formatted field in index pattern to use url of image -\> still getting the {value} in canvas data cell Trying to replace the {value} with Image html code =\> Canvas d… --- ## [Can't work with object's properties for aggregations](https://discuss.elastic.co/t/cant-work-with-objects-properties-for-aggregations/285939)
**Author:** [@Thomas\_DRABO](https://discuss.elastic.co/u/Thomas_DRABO)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:59pm UTC](https://discuss.elastic.co/t/cant-work-with-objects-properties-for-aggregations/285939 "2021-10-07T15:59:39Z")
Hello everyone, I'm trying to work with a property containing an array of objects in my index. You can find the index's mapping behind. This is my index mapping. PUT test-index { "mappings": { "properties": { … --- ## [Rules and connectors examples?](https://discuss.elastic.co/t/rules-and-connectors-examples/286061)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:51pm UTC](https://discuss.elastic.co/t/rules-and-connectors-examples/286061 "2021-10-07T15:51:26Z")
This seems pretty simple but I haven't found a way to get it accomplished. For rules and alerts I'm looking to send an email triggered from a windows event id. For example EventID 4740. The elastic query works it trigge… --- ## [How to convert kubernetes cpu usage and memory usage of metricbeat fields to percentage IN METRICBEAT index elasticsearch](https://discuss.elastic.co/t/how-to-convert-kubernetes-cpu-usage-and-memory-usage-of-metricbeat-fields-to-percentage-in-metricbeat-index-elasticsearch/285727)
**Author:** [@Jay\_Gajjar](https://discuss.elastic.co/u/Jay_Gajjar)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:27pm UTC](https://discuss.elastic.co/t/how-to-convert-kubernetes-cpu-usage-and-memory-usage-of-metricbeat-fields-to-percentage-in-metricbeat-index-elasticsearch/285727 "2021-10-07T15:27:08Z")
Hello, how can i get the percentage of Kubernetes node CPU usage and Kubernetes node memory usage from metricbeat, as i am making a custom plugin where I wanted to show it in percentage. moreover i'm making Elasticsearch… --- ## [Cannot Transform with Watcher's For Each Functionality](https://discuss.elastic.co/t/cannot-transform-with-watchers-for-each-functionality/283868)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:10pm UTC](https://discuss.elastic.co/t/cannot-transform-with-watchers-for-each-functionality/283868 "2021-10-07T15:10:20Z")
I am trying to develop a complex watcher. The beginning is a chain input that uses aggregations and a bucket selector to narrow down my payload to a list of actionable ID's. At that point, I need to query the original in… --- ## [Watcher alert with specific field](https://discuss.elastic.co/t/watcher-alert-with-specific-field/284302)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 3:08pm UTC](https://discuss.elastic.co/t/watcher-alert-with-specific-field/284302 "2021-10-07T15:08:40Z")
Hi, I have set a watcher alert that is trigger when a field inside my index is over a threshold. How can I integrate in my mail alert the value of another field in the index. For example, a mail like: The documen… --- ## [\[Vega Map\] How to get geoshapes from elasticsearch index coordinates](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677)
**Author:** [@lehti](https://discuss.elastic.co/u/lehti)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 2:10pm UTC](https://discuss.elastic.co/t/vega-map-how-to-get-geoshapes-from-elasticsearch-index-coordinates/285677 "2021-10-07T14:10:31Z")
Hi! I need to make a map using Vega-visualization. The coordinates come from an Elasticsearch index. I can load the index into Vega just fine. The issue is that I have no idea how to get Vega to understand the coordinat… --- ## [Canvas Time Filter not selectable, on edge browser](https://discuss.elastic.co/t/canvas-time-filter-not-selectable-on-edge-browser/286114)
**Author:** [@ErSumit](https://discuss.elastic.co/u/ErSumit)\ **Replies:** 1\ **Last updated:** [October 7, 2021, 1:47pm UTC](https://discuss.elastic.co/t/canvas-time-filter-not-selectable-on-edge-browser/286114 "2021-10-07T13:47:15Z")
Time Filter on canvas is working as image, mean its not allowing to click on it to change the time filter. On hover default arrow is displayed Browser Console: canvas#/workpad/workpad-651efed0-bbf4-4ec9-900d-c7eb8cc… --- ## [Batch Process Failed resolution](https://discuss.elastic.co/t/batch-process-failed-resolution/285389)
**Author:** [@2f404140b7ab0f69189f](https://discuss.elastic.co/u/2f404140b7ab0f69189f)\ **Replies:** 3\ **Last updated:** [October 7, 2021, 1:23pm UTC](https://discuss.elastic.co/t/batch-process-failed-resolution/285389 "2021-10-07T13:23:55Z")
I'm using Kibana 7.15.0 and I am constantly experiencing "Batch process failed" when I try to view an index on the Discover section. Can someone explain why this happens and what can be the solution please? --- ## [Spammed by deprication warnings on scripted fields](https://discuss.elastic.co/t/spammed-by-deprication-warnings-on-scripted-fields/286032)
**Author:** [@flalar](https://discuss.elastic.co/u/flalar)\ **Replies:** 5\ **Last updated:** [October 7, 2021, 9:44am UTC](https://discuss.elastic.co/t/spammed-by-deprication-warnings-on-scripted-fields/286032 "2021-10-07T09:44:32Z")
We' getting spammed in kibana dashboards with following deprecation messages Warning: 299 Elasticsearch-7.15.0-79d65f6e357953a5b3cbcc5e2c7c21073d89aa29 "\[script\]\[1:1019\] Deprecated field \[inline\] used, expected \[source\]… --- ## [Table and sub-aggregation buckets result](https://discuss.elastic.co/t/table-and-sub-aggregation-buckets-result/286104)
**Author:** [@Vladimir\_Pavlovsky](https://discuss.elastic.co/u/Vladimir_Pavlovsky)\ **Replies:** 0\ **Last updated:** [October 7, 2021, 7:56am UTC](https://discuss.elastic.co/t/table-and-sub-aggregation-buckets-result/286104 "2021-10-07T07:56:42Z")
Hello! I have documents with ip and login. Every user can connecting with different ip address. Anyway i have this query: Result: I need to get all ip addresses to each login like this response: | LOGIN | IP1,… --- ## [Kibana email connector issues](https://discuss.elastic.co/t/kibana-email-connector-issues/284502)
**Author:** [@morgan.atwood](https://discuss.elastic.co/u/morgan.atwood)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 7:51pm UTC](https://discuss.elastic.co/t/kibana-email-connector-issues/284502 "2021-10-06T19:51:48Z")
Hey y'all :wave: Wondering if anyone has experienced the same issue as me with setting up a email connector in Kibana while using the "secure" switch? I'm used to using just watchers and setting up alerts through that m… --- ## [File structure cannot be determined](https://discuss.elastic.co/t/file-structure-cannot-be-determined/286065)
**Author:** [@Surya\_Raviraj](https://discuss.elastic.co/u/Surya_Raviraj)\ **Replies:** 1\ **Last updated:** [October 6, 2021, 7:45pm UTC](https://discuss.elastic.co/t/file-structure-cannot-be-determined/286065 "2021-10-06T19:45:55Z")
I am trying to upload a very basic csv file, however elastic keeps throwing me the "File structure cannot be determined" error. I'm attaching a picture of my csv file here. I've made sure all the time formats are the sam… --- ## [Export has limited columns](https://discuss.elastic.co/t/export-has-limited-columns/285584)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 11\ **Last updated:** [October 6, 2021, 4:08pm UTC](https://discuss.elastic.co/t/export-has-limited-columns/285584 "2021-10-06T16:08:21Z")
Hello, I hope this message finds the community members safe and healthy. I'm having incomplete data when exporting via Kibana & the output is erratic. I am carrying out the searches on the same index Total documents… --- ## [Monitoring Request Failed - Saved object not found](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/280952)
**Author:** [@surphix](https://discuss.elastic.co/u/surphix)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 3:36pm UTC](https://discuss.elastic.co/t/monitoring-request-failed-saved-object-not-found/280952 "2021-10-06T15:36:44Z")
Hi, I'm having issues with Kibana & Monitoring. Every time I navigate to the monitoring page I receive the following error, "Monitoring Request Failed Saved object \[task/{UUID}\] not found HTTP 404" { "type": "log",… --- ## [Data Visualizer won't accept dd/mm/yyyy format when importing data](https://discuss.elastic.co/t/data-visualizer-wont-accept-dd-mm-yyyy-format-when-importing-data/285732)
**Author:** [@Stud21](https://discuss.elastic.co/u/Stud21)\ **Replies:** 5\ **Last updated:** [October 6, 2021, 9:22am UTC](https://discuss.elastic.co/t/data-visualizer-wont-accept-dd-mm-yyyy-format-when-importing-data/285732 "2021-10-06T09:22:58Z")
I'm trying to import the films.csv file in Data Visualizer and it gives me a 'date\_time\_exception' error. Trying to import the data by 'Apply override settings' link it just does not accept the format, 'dd/mm/yyyy'' Ho… --- ## [Kibana 7.11.1 failing on Docker 7 Raspberry PI4 (arm7)](https://discuss.elastic.co/t/kibana-7-11-1-failing-on-docker-7-raspberry-pi4-arm7/264984)
**Author:** [@ssddgreg](https://discuss.elastic.co/u/ssddgreg)\ **Replies:** 3\ **Last updated:** [October 6, 2021, 8:55am UTC](https://discuss.elastic.co/t/kibana-7-11-1-failing-on-docker-7-raspberry-pi4-arm7/264984 "2021-10-06T08:55:23Z")
Hi, I am trying to run Kibana 7.11.1 as a Docker container on Raspberry Pi 4. I can build the image, however I hit the following error on docker run: {"type":"log","@timestamp":"2021-02-21T13:02:58+00:00","tags":\["… --- ## [Canvas line-chart with multiple lines](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924)
**Author:** [@marcw](https://discuss.elastic.co/u/marcw)\ **Replies:** 2\ **Last updated:** [October 6, 2021, 8:24am UTC](https://discuss.elastic.co/t/canvas-line-chart-with-multiple-lines/285924 "2021-10-06T08:24:51Z")
I'm new to Kibana. I have the following data: DateTime Temperature1 Temperature2 Temparature3 2021-10-05 09:00:00 5 2 9 2021-10-05 10:00:00 6 1 7 I want to create on a canvas a line-chart, x-axis is the Dat… --- ## [Create a Single Rule with Multiple Thresholds with Different Actions per Threshold?](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 10:15pm UTC](https://discuss.elastic.co/t/create-a-single-rule-with-multiple-thresholds-with-different-actions-per-threshold/285956 "2021-10-05T22:15:22Z")
Hi All, I was wondering if anyone know if the following is possible Rules and Connectors, as I wasn't able to figure out how to do it in the GUI. Have a single rule, let's call it Disk Usage. The goal of this rule is… --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 6\ **Last updated:** [October 5, 2021, 5:47pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/285402 "2021-10-05T17:47:05Z")
I am slowly making headway with my installation of ELK Stack 7.13.4. I was at one point unable to connect and was showing a block, which turned out to be firewalls on the Red Hat Linux 8 operating systems. I have allow… --- ## [Kibana 7.14.2 Event Filter drop fails to drop events](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 12\ **Last updated:** [October 5, 2021, 5:38pm UTC](https://discuss.elastic.co/t/kibana-7-14-2-event-filter-drop-fails-to-drop-events/284763 "2021-10-05T17:38:01Z")
Kibana 7.14.2 is no longer dropping events that are in the events filter drop list. This is creating massive amounts of excessive unneeded data. 30+mil events per hour. In kibana, Elastic Security, Event filters section… --- ## [Kibana json input](https://discuss.elastic.co/t/kibana-json-input/285857)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 1\ **Last updated:** [October 5, 2021, 1:38am UTC](https://discuss.elastic.co/t/kibana-json-input/285857 "2021-10-05T01:38:06Z")
Hi there! I have a custom visualization that reports on network traffic by protocol, source and destination. I have added to my Split rows bucket a custom JSON input to strip out the last octet and to display the commun… --- ## [KIbana Cardinality/Unique Count Metric Lens / TSVB](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 3\ **Last updated:** [October 5, 2021, 4:11pm UTC](https://discuss.elastic.co/t/kibana-cardinality-unique-count-metric-lens-tsvb/285944 "2021-10-05T16:11:54Z")
Hi all, Little question: When working with normal metric aggregations it is possible under "Advanced" to set this parameter {"precision\_threshold": 40000} Does exists any way to set this threshold either globally or i… --- ## [How to make data table of last value](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 4\ **Last updated:** [October 5, 2021, 2:19pm UTC](https://discuss.elastic.co/t/how-to-make-data-table-of-last-value/285921 "2021-10-05T14:19:36Z")
Hi, Do you know how to create a data table with the laste value of every host (for example) ? And is it possible to apply a filter based on last value ? (I dont want to see all hosts) [Previous page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=275) [Next page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=277)