# Kibana

**URL:** https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=923

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 924

---

## [How to use scripted fields, very basics](https://discuss.elastic.co/t/how-to-use-scripted-fields-very-basics/100528)

<div class="topic-metadata">

**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\
**Replies:** 1\
**Last updated:** [September 14, 2017, 1:00pm UTC](https://discuss.elastic.co/t/how-to-use-scripted-fields-very-basics/100528 "2017-09-14T13:00:19Z")

</div>

Hi, I am trying to understand how to use scripted fields (the basics of it), using date field and I am unsuccessful. I saw a lot of 'painless' code in the format as inside this link, but they are all in PUT GET format…

---

## [Search over all fields with all\_fields and default\_field differ](https://discuss.elastic.co/t/search-over-all-fields-with-all-fields-and-default-field-differ/100217)

<div class="topic-metadata">

**Author:** [@WimmerELO](https://discuss.elastic.co/u/WimmerELO)\
**Replies:** 4\
**Last updated:** [September 14, 2017, 10:51am UTC](https://discuss.elastic.co/t/search-over-all-fields-with-all-fields-and-default-field-differ/100217 "2017-09-14T10:51:10Z")

</div>

Hi, we are using Kibana 5.4.1 (and so ES) and we need to search over all fields without the \_all field in Kibana Discover. As solution we thought that we could set the Kibana option: "query:queryString:options" to { "…

---

## [Kibana dashboard of "Elastic for Operational Analytics" webinar](https://discuss.elastic.co/t/kibana-dashboard-of-elastic-for-operational-analytics-webinar/98724)

<div class="topic-metadata">

**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\
**Replies:** 5\
**Last updated:** [September 14, 2017, 10:10am UTC](https://discuss.elastic.co/t/kibana-dashboard-of-elastic-for-operational-analytics-webinar/98724 "2017-09-14T10:10:57Z")

</div>

Hey, Are the kibana dashboards used for the recent “Elastic for Operational Analytics” webinar available somewhere? I am in particular interested by the dashboard shown at 12min and the distribution per country. I hav…

---

## [Can not run Kibana](https://discuss.elastic.co/t/can-not-run-kibana/100341)

<div class="topic-metadata">

**Author:** [@sophir](https://discuss.elastic.co/u/sophir)\
**Replies:** 5\
**Last updated:** [September 14, 2017, 9:38am UTC](https://discuss.elastic.co/t/can-not-run-kibana/100341 "2017-09-14T09:38:53Z")

</div>

Hi There I cannot find instructions on how to set the yml file. I have the files extracted on Windows 7. What should I do in order to run Kibana? Can you refer me to the appropriate section in a document? Or just let m…

---

## [Cannot visualize data from different logs in same index with one common field](https://discuss.elastic.co/t/cannot-visualize-data-from-different-logs-in-same-index-with-one-common-field/99815)

<div class="topic-metadata">

**Author:** [@sushanth](https://discuss.elastic.co/u/sushanth)\
**Replies:** 5\
**Last updated:** [September 14, 2017, 7:21am UTC](https://discuss.elastic.co/t/cannot-visualize-data-from-different-logs-in-same-index-with-one-common-field/99815 "2017-09-14T07:21:25Z")

</div>

I have two log files (to be simple) one with ID NAME another with ID STATUS When I pull them into elastic search, It gets parsed in different timestamps So, I cannot use all those 3 fields inside a single visualizati…

---

## [Aggregate multiple rows fields data in single data](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358)

<div class="topic-metadata">

**Author:** [@vinay\_garg](https://discuss.elastic.co/u/vinay_garg)\
**Replies:** 6\
**Last updated:** [September 14, 2017, 6:00am UTC](https://discuss.elastic.co/t/aggregate-multiple-rows-fields-data-in-single-data/100358 "2017-09-14T06:00:43Z")

</div>

Hi, Environment: Elasticsearch, Logstash, Kibana(5.6) I have multiple Fields data. Each field is related to JMX. JMX configuration is: "host":"localhost", "port":1099, "url" : "service:jmx:rmi:///jndi/rmi://localh…

---

## [How to set separate interval for different timelion added in Dashboard](https://discuss.elastic.co/t/how-to-set-separate-interval-for-different-timelion-added-in-dashboard/100381)

<div class="topic-metadata">

**Author:** [@Suyog\_Kale](https://discuss.elastic.co/u/Suyog_Kale)\
**Replies:** 2\
**Last updated:** [September 14, 2017, 4:00am UTC](https://discuss.elastic.co/t/how-to-set-separate-interval-for-different-timelion-added-in-dashboard/100381 "2017-09-14T04:00:39Z")

</div>

Hello, I have added two different timelion in dashboard, I have set interval in both timelion es query. Timelion 1: .es(interval=1M,split=country:5,timefield=ts,q='type:sales') Timelion 2: .es(interval=1h,split=coun…

---

## [Tracking slow pipelines](https://discuss.elastic.co/t/tracking-slow-pipelines/99886)

<div class="topic-metadata">

**Author:** [@CDR](https://discuss.elastic.co/u/CDR)\
**Replies:** 2\
**Last updated:** [September 13, 2017, 10:06pm UTC](https://discuss.elastic.co/t/tracking-slow-pipelines/99886 "2017-09-13T22:06:12Z")

</div>

Hello, I read a little bit ago about how there is a feature either in Kibana or Xpack that allowed showed a nice visualization as to which groks/pipelines were slowing the processing of Logstash. I cannot seem to find i…

---

## [Random time out in cross-cluster seach Kibana (5.5)](https://discuss.elastic.co/t/random-time-out-in-cross-cluster-seach-kibana-5-5/100337)

<div class="topic-metadata">

**Author:** [@Azahara](https://discuss.elastic.co/u/Azahara)\
**Replies:** 1\
**Last updated:** [September 13, 2017, 8:44pm UTC](https://discuss.elastic.co/t/random-time-out-in-cross-cluster-seach-kibana-5-5/100337 "2017-09-13T20:44:50Z")

</div>

Hello, I am trying to do a PoC using cross-cluster search in Kibana. My problem is that from time to time (for what I can see is random), I get timeouts in kibana when working with index from a cross-cluster search. S…

---

## [Cannot connect to Kibana through public IP created on GCE](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-public-ip-created-on-gce/100142)

<div class="topic-metadata">

**Author:** [@8-bit](https://discuss.elastic.co/u/8-bit)\
**Replies:** 3\
**Last updated:** [September 13, 2017, 3:58pm UTC](https://discuss.elastic.co/t/cannot-connect-to-kibana-through-public-ip-created-on-gce/100142 "2017-09-13T15:58:26Z")

</div>

Cannot get Kibana's public IP to work from google compute engine. Says the site cannot be reached, though Elasticsearch works through public IP if I change the elasticsearch.yml from localhost to 0.0.0.0 Turned off ngin…

---

## [Change index name in Visualization](https://discuss.elastic.co/t/change-index-name-in-visualization/100394)

<div class="topic-metadata">

**Author:** [@Mandar\_Shinde](https://discuss.elastic.co/u/Mandar_Shinde)\
**Replies:** 6\
**Last updated:** [September 13, 2017, 7:48pm UTC](https://discuss.elastic.co/t/change-index-name-in-visualization/100394 "2017-09-13T19:48:47Z")

</div>

Hi All, Is there a better way to change the index name for a Visualization? Say I have created a Visualization with index name "test1" and now I have update the index name to "test2". One way I found is to go to Setti…

---

## [Will kibana work if i am trying to index a file of 6.5 GB having 3 million records](https://discuss.elastic.co/t/will-kibana-work-if-i-am-trying-to-index-a-file-of-6-5-gb-having-3-million-records/100065)

<div class="topic-metadata">

**Author:** [@sudi\_2611](https://discuss.elastic.co/u/sudi_2611)\
**Replies:** 6\
**Last updated:** [September 13, 2017, 2:21pm UTC](https://discuss.elastic.co/t/will-kibana-work-if-i-am-trying-to-index-a-file-of-6-5-gb-having-3-million-records/100065 "2017-09-13T14:21:30Z")

</div>

Hi Team, Will kibana work if i am trying to index a file of 6.5 GB having 3 million records. When i try to query the data i get 3000ms request timed out error and application status goes down having status as red

---

## [Kibana Date Range Aggregation format](https://discuss.elastic.co/t/kibana-date-range-aggregation-format/100390)

<div class="topic-metadata">

**Author:** [@shashwat](https://discuss.elastic.co/u/shashwat)\
**Replies:** 1\
**Last updated:** [September 13, 2017, 5:02pm UTC](https://discuss.elastic.co/t/kibana-date-range-aggregation-format/100390 "2017-09-13T17:02:11Z")

</div>

Hi, In my parsed log file, I have fields like start\_date = "August 3rd 2017, 16:12:00.000" and end\_date = "August 3rd 2017, 16:18:00.000". I want to use Date range aggregation to draw Kibana graph between two date rang…

---

## [Slurm-plugin CPU utilization](https://discuss.elastic.co/t/slurm-plugin-cpu-utilization/100313)

<div class="topic-metadata">

**Author:** [@christianmatira](https://discuss.elastic.co/u/christianmatira)\
**Replies:** 2\
**Last updated:** [September 13, 2017, 4:02pm UTC](https://discuss.elastic.co/t/slurm-plugin-cpu-utilization/100313 "2017-09-13T16:02:22Z")

</div>

Good day, I am currently trying to create visualizations using the data provided by slurm's elasticsearch plugin. I want to measure the CPUs used by every job completed by the cluster. Just by using the fields timefiel…

---

## [Finding the query in agg\_table.js context](https://discuss.elastic.co/t/finding-the-query-in-agg-table-js-context/99336)

<div class="topic-metadata">

**Author:** [@leofer](https://discuss.elastic.co/u/leofer)\
**Replies:** 7\
**Last updated:** [September 13, 2017, 3:17pm UTC](https://discuss.elastic.co/t/finding-the-query-in-agg-table-js-context/99336 "2017-09-13T15:17:25Z")

</div>

Hi, I’m trying to develop server side query analysis tool, and I’m modifying the src/ui/public/agg\_table/agg\_table.js I was able to add some stuff, but what I would really like to to, is to get the query text (just lik…

---

## [Create a region map based on country code](https://discuss.elastic.co/t/create-a-region-map-based-on-country-code/100338)

<div class="topic-metadata">

**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\
**Replies:** 3\
**Last updated:** [September 13, 2017, 3:09pm UTC](https://discuss.elastic.co/t/create-a-region-map-based-on-country-code/100338 "2017-09-13T15:09:42Z")

</div>

Continuing the discussion from Kibana dashboard of "Elastic for Operational Analytics" webinar: I have tried to create a region map using the requestCountry attribute containing the request's country. That attribute hol…

---

## [Kibana webserver error (docker version)](https://discuss.elastic.co/t/kibana-webserver-error-docker-version/100036)

<div class="topic-metadata">

**Author:** [@maor](https://discuss.elastic.co/u/maor)\
**Replies:** 1\
**Last updated:** [September 13, 2017, 10:29am UTC](https://discuss.elastic.co/t/kibana-webserver-error-docker-version/100036 "2017-09-13T10:29:31Z")

</div>

Hey all. First of all, I'd like to thank you for this board. It helped me a lot resolving the errors while deploying ELK. I've gotten into a problem and I can't find it's solution on the internet. I've started filebea…

---

## [Xpack read role](https://discuss.elastic.co/t/xpack-read-role/100246)

<div class="topic-metadata">

**Author:** [@nsivabalan](https://discuss.elastic.co/u/nsivabalan)\
**Replies:** 1\
**Last updated:** [September 13, 2017, 10:02am UTC](https://discuss.elastic.co/t/xpack-read-role/100246 "2017-09-13T10:02:00Z")

</div>

Hi, Which privilages I should give to the role for read the logs in discover option? Following is not working for me. \[image\] Thanks in advance.

---

## [Creating drop-down lists](https://discuss.elastic.co/t/creating-drop-down-lists/100185)

<div class="topic-metadata">

**Author:** [@abhisek](https://discuss.elastic.co/u/abhisek)\
**Replies:** 3\
**Last updated:** [September 13, 2017, 9:59am UTC](https://discuss.elastic.co/t/creating-drop-down-lists/100185 "2017-09-13T09:59:12Z")

</div>

Hi , I am using Kibana v5.5 and I'm thinking to add a drop-down list to filter out the data on basis of selected field. Please let me know, how to achieve this in Kibana.

---

## [Can't connect to Kibana install on sandbox hdp with port forwarding](https://discuss.elastic.co/t/cant-connect-to-kibana-install-on-sandbox-hdp-with-port-forwarding/100308)

<div class="topic-metadata">

**Author:** [@SFinaxys](https://discuss.elastic.co/u/SFinaxys)\
**Replies:** 4\
**Last updated:** [September 13, 2017, 9:34am UTC](https://discuss.elastic.co/t/cant-connect-to-kibana-install-on-sandbox-hdp-with-port-forwarding/100308 "2017-09-13T09:34:37Z")

</div>

Hello everyone, here is my problem. I want to connect locally to Kibana on localhost:5601 with port forwarding, but it doesn't work. Anybody know how to resolve this ? I already try many things such try to access throu…

---

## [Fatal Error after Creating Kibana Plugin](https://discuss.elastic.co/t/fatal-error-after-creating-kibana-plugin/97434)

<div class="topic-metadata">

**Author:** [@FareehaNaaz](https://discuss.elastic.co/u/FareehaNaaz)\
**Replies:** 9\
**Last updated:** [September 13, 2017, 8:38am UTC](https://discuss.elastic.co/t/fatal-error-after-creating-kibana-plugin/97434 "2017-09-13T08:38:15Z")

</div>

Hi, i was Creating my own plugin using "yo kibana-plugin", after ruuning this command i get app.js in "plugin/public/app.js" location and index.html in "plugin/public/templates/index.html" here i did replace my index.h…

---

## [How to add Count in Kibana Hear Map](https://discuss.elastic.co/t/how-to-add-count-in-kibana-hear-map/100275)

<div class="topic-metadata">

**Author:** [@cp\_el](https://discuss.elastic.co/u/cp_el)\
**Replies:** 1\
**Last updated:** [September 13, 2017, 7:53am UTC](https://discuss.elastic.co/t/how-to-add-count-in-kibana-hear-map/100275 "2017-09-13T07:53:05Z")

</div>

I have a heat map for device vs os version and my main aggregation is "count of issue". So I have heat map plotted with above parameters. But now I want to add one more aggregated number in this heat map. Like I just wan…

---

## [Curl command to delete kibana visualizations](https://discuss.elastic.co/t/curl-command-to-delete-kibana-visualizations/100271)

<div class="topic-metadata">

**Author:** [@rajisankar](https://discuss.elastic.co/u/rajisankar)\
**Replies:** 2\
**Last updated:** [September 13, 2017, 3:55am UTC](https://discuss.elastic.co/t/curl-command-to-delete-kibana-visualizations/100271 "2017-09-13T03:55:52Z")

</div>

I am using elastic APIs to add visualizations in kibana. For example, curl -XPUT -H "Content-Type: {application/json}" http://localhost:9200/.kibana/visualization/Network-Bandwidth -d “@file” I am able to add the visua…

---

## [Inverted curves in Kibana/timelion](https://discuss.elastic.co/t/inverted-curves-in-kibana-timelion/99985)

<div class="topic-metadata">

**Author:** [@rajisankar](https://discuss.elastic.co/u/rajisankar)\
**Replies:** 2\
**Last updated:** [September 13, 2017, 1:27am UTC](https://discuss.elastic.co/t/inverted-curves-in-kibana-timelion/99985 "2017-09-13T01:27:51Z")

</div>

Is there a way to create inverted curves in Kibana/timelion visualization like the one shown below? \[16 PM\] For example, displaying 2 metrics on the same visualization, one on the positive axis and one inverted on the …

---

## [Cumulative Sum regardless of time interval](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval/96677)

<div class="topic-metadata">

**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\
**Replies:** 18\
**Last updated:** [September 12, 2017, 9:12pm UTC](https://discuss.elastic.co/t/cumulative-sum-regardless-of-time-interval/96677 "2017-09-12T21:12:03Z")

</div>

I’ve created a line chart that plots the cumulative sum of unique terms over time. I’d like this to work with a daily time interval. What I expect is for the sum to be calculated from the values at the beginning of the …

---

## [How to configure kibana to see data from winlogbeat](https://discuss.elastic.co/t/how-to-configure-kibana-to-see-data-from-winlogbeat/100234)

<div class="topic-metadata">

**Author:** [@yolena.mora](https://discuss.elastic.co/u/yolena.mora)\
**Replies:** 9\
**Last updated:** [September 12, 2017, 8:37pm UTC](https://discuss.elastic.co/t/how-to-configure-kibana-to-see-data-from-winlogbeat/100234 "2017-09-12T20:37:55Z")

</div>

Hi! I need your help as possible you can! I just want to see the data from winlogbeat but I'm using logstash to filter the data to sending to Elasticsearch and finally see it in kibana, but this is what happens when I o…

---

## [Field "document\_type" sent via filebeat as "type" field to ES is ananlyzed](https://discuss.elastic.co/t/field-document-type-sent-via-filebeat-as-type-field-to-es-is-ananlyzed/100245)

<div class="topic-metadata">

**Author:** [@vijay.sangha](https://discuss.elastic.co/u/vijay.sangha)\
**Replies:** 4\
**Last updated:** [September 12, 2017, 5:42pm UTC](https://discuss.elastic.co/t/field-document-type-sent-via-filebeat-as-type-field-to-es-is-ananlyzed/100245 "2017-09-12T17:42:04Z")

</div>

I am using Filebeat 5.3--\>Logstash 5.3--\>Elasticserach 5.3. While sending my documents using filebeat I am using document\_type to tag a log file type as below :-1: input\_type: log paths: /my/log/location/server.log …

---

## [How to create line visualization from log firewall automatically](https://discuss.elastic.co/t/how-to-create-line-visualization-from-log-firewall-automatically/100239)

<div class="topic-metadata">

**Author:** [@baharudin\_yusuf](https://discuss.elastic.co/u/baharudin_yusuf)\
**Replies:** 5\
**Last updated:** [September 12, 2017, 5:25pm UTC](https://discuss.elastic.co/t/how-to-create-line-visualization-from-log-firewall-automatically/100239 "2017-09-12T17:25:03Z")

</div>

how to make line visualization of log firewall automatically with csv data format? I want to show the ip address is connected or disconnected at any time, suppose x is the clock and y is the ip address. of the many ip ad…

---

## [Metricbeat dashboard + visualization error - Saved "field" parameter is now invalid. Please select a new field](https://discuss.elastic.co/t/metricbeat-dashboard-visualization-error-saved-field-parameter-is-now-invalid-please-select-a-new-field/100162)

<div class="topic-metadata">

**Author:** [@vramakrishnan](https://discuss.elastic.co/u/vramakrishnan)\
**Replies:** 5\
**Last updated:** [September 12, 2017, 3:58pm UTC](https://discuss.elastic.co/t/metricbeat-dashboard-visualization-error-saved-field-parameter-is-now-invalid-please-select-a-new-field/100162 "2017-09-12T15:58:54Z")

</div>

I have metricbeat setup on my MAC and metrics are uploaded to ES. I have also run the metric beat setup to configure dashboards. ES: 5.4.1 Kibana: 5.4.1 Metricbeat: 7.0.0-alpha1 metric beat index in created yellow o…

---

## [Minimum\_should\_match is not working](https://discuss.elastic.co/t/minimum-should-match-is-not-working/100068)

<div class="topic-metadata">

**Author:** [@kanchan](https://discuss.elastic.co/u/kanchan)\
**Replies:** 3\
**Last updated:** [September 12, 2017, 3:58pm UTC](https://discuss.elastic.co/t/minimum-should-match-is-not-working/100068 "2017-09-12T15:58:45Z")

</div>

Hi, I have used minimum\_should\_match as 10% or 80% both are giving same result.there is no difference in output.Please let me know why minimum\_should\_match is not working. GET /hist\_latest/\_search { "query": { "bool…

[Previous page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=922)

[Next page](https://discuss.elastic.co/c/elastic-stack/kibana/7.md?page=924)
