# Latest **URL:** https://discuss.elastic.co/latest.md?page=1192 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1193 --- ## [Data\_stream\_namespace ignored?](https://discuss.elastic.co/t/data-stream-namespace-ignored/301183)
**Author:** [@EvertM](https://discuss.elastic.co/u/EvertM)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 10:51am UTC](https://discuss.elastic.co/t/data-stream-namespace-ignored/301183 "2022-03-31T10:51:49Z")
Hi all, I have the following in output: data\_stream =\> "true" data\_stream\_type =\> "logs" data\_stream\_dataset =\> "synology" data\_stream\_namespace =\> "yournamehere" However, I end up with a datastream named logs-synolog… --- ## [Filebeat Cisco Module and IOS fields not showing up as documented](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857)
**Author:** [@ulysse31](https://discuss.elastic.co/u/ulysse31)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:26am UTC](https://discuss.elastic.co/t/filebeat-cisco-module-and-ios-fields-not-showing-up-as-documented/298857 "2022-03-31T10:26:36Z")
Hi all, I just started the logging of the syslog data sent by my cisco IOS switches into elastic (with filebeat 7.17.0 and Elasticsearch 7.17.0). I setup a filebeat with "usual config" like: ios: enabled: true … --- ## [Custom date selectors / date picker](https://discuss.elastic.co/t/custom-date-selectors-date-picker/300605)
**Author:** [@sg09](https://discuss.elastic.co/u/sg09)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 10:17am UTC](https://discuss.elastic.co/t/custom-date-selectors-date-picker/300605 "2022-03-31T10:17:10Z")
Hi, could you please provide a sample project in codesandbox on how to use custom datetime selector/picker on search-ui ? I'm referring to this post, recommending custom components: Filter search by date in search-ui --- ## [How to get the average between two timestamp](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100)
**Author:** [@Roberto\_Mejri](https://discuss.elastic.co/u/Roberto_Mejri)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:12am UTC](https://discuss.elastic.co/t/how-to-get-the-average-between-two-timestamp/301100 "2022-03-31T10:12:51Z")
HI, (I'm literally new on Kibana). My Team leader asked to me to do the visualize on Kibana with the count... of the log got on Spring microservice. The problem is now I have to display the average between timestamps of … --- ## [Common Suggestion with multiple fields grouped together](https://discuss.elastic.co/t/common-suggestion-with-multiple-fields-grouped-together/300693)
**Author:** [@kabilsharma](https://discuss.elastic.co/u/kabilsharma)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 10:08am UTC](https://discuss.elastic.co/t/common-suggestion-with-multiple-fields-grouped-together/300693 "2022-03-31T10:08:14Z")
Can we have a suggestion object instead of {"suggestion":"dominos"} to be as {"suggestion":"dominos", "category" : "100-1000-0000", "qty" : 10} so the results are grouped by category and pass an amount of matches in … --- ## [Unable to use grok pattern on GREEDYDATA message](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086)
**Author:** [@rahulgupta18](https://discuss.elastic.co/u/rahulgupta18)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 10:04am UTC](https://discuss.elastic.co/t/unable-to-use-grok-pattern-on-greedydata-message/301086 "2022-03-31T10:04:32Z")
Hi, I have this log message - 2022-03-08 04:16:04 \[DEBUG\] Creating linked clone: from Template-CentOS, to CentOS-001122 My logstash config. file is as follows - filter { grok { match =\> { "message" … --- ## [1h difference between rollover time and action time](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 9:07am UTC](https://discuss.elastic.co/t/1h-difference-between-rollover-time-and-action-time/300895 "2022-03-31T09:07:23Z")
Hi, I noticed that despite my indexes are being rolled over at midnight, the "index phase time" and "index action time" are with 2h difference apart, like: { "indices" : { "suricata-ids-2022.03.28-000021" : { … --- ## [Handlebar Helpers in TSVB Markdown](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991)
**Author:** [@Kirubanandhan](https://discuss.elastic.co/u/Kirubanandhan)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 9:02am UTC](https://discuss.elastic.co/t/handlebar-helpers-in-tsvb-markdown/300991 "2022-03-31T09:02:35Z")
Hi Team, I want to add some Handlebar helpers like below. So that i can use it in TSVB Markdown. I need to use it for calculate difference between the two count values. @tsullivan @devon.thomson @bhavyarm Help required… --- ## [cURL request not working with CA certificate on Windows](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566)
**Author:** [@Andy0708](https://discuss.elastic.co/u/Andy0708)\ **Replies:** 9\ **Last updated:** [March 31, 2022, 8:52am UTC](https://discuss.elastic.co/t/curl-request-not-working-with-ca-certificate-on-windows/299566 "2022-03-31T08:52:49Z")
Hi, The following command works fine on macOS, but I am unable to get it to work on Windows 10. curl --cacert config\\certs\\http\_ca.crt -u elastic https://localhost:9200 This happens after starting up a fresh cluster o… --- ## [Kibana Donut chart with small inner circle](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977)
**Author:** [@santy1](https://discuss.elastic.co/u/santy1)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 8:39am UTC](https://discuss.elastic.co/t/kibana-donut-chart-with-small-inner-circle/300977 "2022-03-31T08:39:36Z")
Hello Team, I am on ELK v7.17. I have created donut chart to represent some data, using Lens. However, I see that the inner circle is quite small. I read somewhere, that there is an options tab that can be used to chan… --- ## [Logstash output to Kibana](https://discuss.elastic.co/t/logstash-output-to-kibana/300919)
**Author:** [@RomanKau](https://discuss.elastic.co/u/RomanKau)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 8:28am UTC](https://discuss.elastic.co/t/logstash-output-to-kibana/300919 "2022-03-31T08:28:02Z")
Running Windows 10, Logstash 8.1.0, Elasticsearch, kibana and filebeat 8.0.0 all on the same machine. Getting the data from filebeat to kibana works great but the problem is that the whole log is in the field message an… --- ## [Unable to connect to secondary master node, when manually stopping primary master node](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917)
**Author:** [@Dhamodharan](https://discuss.elastic.co/u/Dhamodharan)\ **Replies:** 5\ **Last updated:** [March 31, 2022, 7:32am UTC](https://discuss.elastic.co/t/unable-to-connect-to-secondary-master-node-when-manually-stopping-primary-master-node/300917 "2022-03-31T07:32:53Z")
I got a small project so thought to go with only 2nodes ES cluster and maintain HA. Both nodes are act as Master and data node, i wanted to maintain any 1 node should be up all the time. Both machine having the same conf… --- ## [Install Kibana 7.16 fails with parse mapping](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946)
**Author:** [@Karel\_Cech](https://discuss.elastic.co/u/Karel_Cech)\ **Replies:** 4\ **Last updated:** [March 30, 2022, 9:44pm UTC](https://discuss.elastic.co/t/install-kibana-7-16-fails-with-parse-mapping/300946 "2022-03-30T21:44:14Z")
Hi, we try to install Kibana 7.16.3 in our Openshift environment, but it fails with "Failed to parse mapping \[\_doc\]" : {"type":"log","@timestamp":"2022-03-29T12:09:24+02:00","tags":\["info","savedobjects-service"\],"pid"… --- ## [Group by Count equals value](https://discuss.elastic.co/t/group-by-count-equals-value/301161)
**Author:** [@chivas](https://discuss.elastic.co/u/chivas)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 7:04am UTC](https://discuss.elastic.co/t/group-by-count-equals-value/301161 "2022-03-31T07:04:09Z")
Hello, I am using below query to group by a field and return the count, is there a way to return documents whose doc\_count equals 1 (or less than 2) GET logs-test\*/\_search { "aggs": { "2": { "terms": { … --- ## [How to sort keyword/text fields on aggregation results](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160)
**Author:** [@Shushil\_Shankar](https://discuss.elastic.co/u/Shushil_Shankar)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 5:51am UTC](https://discuss.elastic.co/t/how-to-sort-keyword-text-fields-on-aggregation-results/301160 "2022-03-31T05:51:48Z")
Hi Everyone! I have a aggregation results and I need to sort aggregation data using Elasticsearch.Net. When i'm trying using terms aggregation i'm getting this error "buckets\_path must reference either a number value or… --- ## [Kibana dashboard cannot load metricbeat data](https://discuss.elastic.co/t/kibana-dashboard-cannot-load-metricbeat-data/300933)
**Author:** [@leelax22](https://discuss.elastic.co/u/leelax22)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 5:48am UTC](https://discuss.elastic.co/t/kibana-dashboard-cannot-load-metricbeat-data/300933 "2022-03-31T05:48:03Z")
I am testing to monitor aks using ELK stack and beat. The installation is completed with version 8.1.0, and it is confirmed that data is well accumulated in Kibana through the metricbeat-\* index. Because I did not conn… --- ## [Is access to Elasticsearch / Elastic Cloud restricted for Belarus?](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784)
**Author:** [@Sleepy\_Panda](https://discuss.elastic.co/u/Sleepy_Panda)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 5:37am UTC](https://discuss.elastic.co/t/is-access-to-elasticsearch-elastic-cloud-restricted-for-belarus/300784 "2022-03-31T05:37:03Z")
Is access to Elasticsearch restricted for Belarus? I can't pull the Docker image: docker pull docker.elastic.co/elasticsearch/elasticsearch:8.1.1 leads to The Amazon CloudFront distribution is configured to block acces… --- ## [Mapping Not showing in Discover](https://discuss.elastic.co/t/mapping-not-showing-in-discover/300452)
**Author:** [@merlin\_nunez1](https://discuss.elastic.co/u/merlin_nunez1)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:27am UTC](https://discuss.elastic.co/t/mapping-not-showing-in-discover/300452 "2022-03-31T05:27:56Z")
After upgrading our cluster from version 7.15 to 7.17, the discover module stopped showing all fields for our .net application logs. We index all our .net application logs to indices named ui, and the mapping shows ther… --- ## [Issue with non functionality: toogle column in table \[Kibana 8.1.1\]](https://discuss.elastic.co/t/issue-with-non-functionality-toogle-column-in-table-kibana-8-1-1/301123)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:21am UTC](https://discuss.elastic.co/t/issue-with-non-functionality-toogle-column-in-table-kibana-8-1-1/301123 "2022-03-31T05:21:31Z")
Hi Please fix functionality for legacy view in this version of kibana for making " toogle column in table" Now it doesn't work. --- ## [Kibana Discover 10,000 documents download limit](https://discuss.elastic.co/t/kibana-discover-10-000-documents-download-limit/300555)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 6\ **Last updated:** [March 31, 2022, 5:19am UTC](https://discuss.elastic.co/t/kibana-discover-10-000-documents-download-limit/300555 "2022-03-31T05:19:21Z")
I want to save a search and download 100,000 documents from discover page. But I'm able to download only 10,000 documents. How to increase this limit in discover...I checked in advanced settings...But it is not changin… --- ## [Intergation of elastic with a service desk app](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055)
**Author:** [@Vinay\_Menon1](https://discuss.elastic.co/u/Vinay_Menon1)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 5:14am UTC](https://discuss.elastic.co/t/intergation-of-elastic-with-a-service-desk-app/301055 "2022-03-31T05:14:05Z")
Hi Team, I have a query not sure if anyone can help in this We have an in house created ticketing system which one of the developers created this we plan to integrate with elastic. We have multiple client regions & on… --- ## [Ssl\_verification\_mode in http\_poller input plugin "An exception happened when converging configuration"](https://discuss.elastic.co/t/ssl-verification-mode-in-http-poller-input-plugin-an-exception-happened-when-converging-configuration/300924)
**Author:** [@Syed\_Saqlain\_Hussain](https://discuss.elastic.co/u/Syed_Saqlain_Hussain)\ **Replies:** 4\ **Last updated:** [March 31, 2022, 3:48am UTC](https://discuss.elastic.co/t/ssl-verification-mode-in-http-poller-input-plugin-an-exception-happened-when-converging-configuration/300924 "2022-03-31T03:48:41Z")
I have this configuration file using http\_poller input plugin. input { http\_poller { urls =\> { myurl2 =\> { # Supports all options supported by ruby's Manticore HTTP client method =\> get … --- ## [Elasticsearch change CA and http and transport Certificate](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078)
**Author:** [@sharbich](https://discuss.elastic.co/u/sharbich)\ **Replies:** 1\ **Last updated:** [March 31, 2022, 3:23am UTC](https://discuss.elastic.co/t/elasticsearch-change-ca-and-http-and-transport-certificate/301078 "2022-03-31T03:23:56Z")
Hi there, i have my own self-signed CA. I would like to use this Root CA for Elasticsearch and create new http and transport certificates via my Root CA and activate them in Elasticsearch. Do I have to consider somethi… --- ## [Starting Elasticsearch 8.0.1 in Docker](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997)
**Author:** [@SwampyFox](https://discuss.elastic.co/u/SwampyFox)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 2:51am UTC](https://discuss.elastic.co/t/starting-elasticsearch-8-0-1-in-docker/298997 "2022-03-31T02:51:08Z")
I am running the following docker run command docker run --name es01 --net elastic -p 9200:9200 -v /home/cbryan/Elasticsearch.yml:/usr/share/Elasticsearch/config/Elasticsearch.yml -it docker.elastic.co/elasticsearch/ela… --- ## [When mounting \`elasticsearch.yml\`, docker displays \`Device or resource busy\`](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 3\ **Last updated:** [March 31, 2022, 2:49am UTC](https://discuss.elastic.co/t/when-mounting-elasticsearch-yml-docker-displays-device-or-resource-busy/300981 "2022-03-31T02:49:12Z")
I tried to mount elasticsearch.yml and kibana.yml inside docker-compose.yml. For kibana, it is very smooth, but for Elasticsearch, an exception is thrown and the corresponding service is aborted, which confuses me. The … --- ## [Netflow sends larger documents than others](https://discuss.elastic.co/t/netflow-sends-larger-documents-than-others/301152)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 0\ **Last updated:** [March 31, 2022, 12:58am UTC](https://discuss.elastic.co/t/netflow-sends-larger-documents-than-others/301152 "2022-03-31T00:58:51Z")
good morning I have a question and I have a filebeat running that is sending me netflow to my Elasticsearch, but I have noticed that there are more documents in some times than others, why does it look like this? i.e. ne… --- ## [How to understand logstash pipeline-to-pipeline patterns?](https://discuss.elastic.co/t/how-to-understand-logstash-pipeline-to-pipeline-patterns/301044)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [March 31, 2022, 12:50am UTC](https://discuss.elastic.co/t/how-to-understand-logstash-pipeline-to-pipeline-patterns/301044 "2022-03-31T00:50:15Z")
Currently I use logstash to operate pipeline.yml, the contents are as follows, according to my understanding, a line of pipeline.id should be a thread, it should be independent, but recently I found that there is a probl… --- ## [Metricbeat - system.memory.actual.used.pct](https://discuss.elastic.co/t/metricbeat-system-memory-actual-used-pct/301035)
**Author:** [@Matt.Wash](https://discuss.elastic.co/u/Matt.Wash)\ **Replies:** 2\ **Last updated:** [March 30, 2022, 11:59pm UTC](https://discuss.elastic.co/t/metricbeat-system-memory-actual-used-pct/301035 "2022-03-30T23:59:07Z")
Hi, When i try to find the root cause of a crash using metricbeat field system.memory.actual.used.pct, my dashboard appears to change the values when i filter by host.name for the machine that crashed. Before I filter b… --- ## [Missing authentication credentials for REST request](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/301144)
**Author:** [@Kishan\_Kini](https://discuss.elastic.co/u/Kishan_Kini)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:52pm UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request/301144 "2022-03-30T23:52:13Z")
\[ERROR\]\[Elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. security\_exception: \[security\_exception\] Reason: missing authentication credentials for REST request \[/\_nodes?filter\_path=no… --- ## [After a while the logs stop](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030)
**Author:** [@Arraso26](https://discuss.elastic.co/u/Arraso26)\ **Replies:** 1\ **Last updated:** [March 30, 2022, 11:49pm UTC](https://discuss.elastic.co/t/after-a-while-the-logs-stop/301030 "2022-03-30T23:49:48Z")
Hello, my problem for half an hour the logs arrive perfect but after about 30 minutes or so the logs stop arriving and I get all the time the log shown below or one very similar and the rest of the logs do not arrive, I … [Previous page](https://discuss.elastic.co/latest.md?page=1191) [Next page](https://discuss.elastic.co/latest.md?page=1193)