# Latest **URL:** https://discuss.elastic.co/latest.md?page=1214 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1215 --- ## [Ingest vs Data](https://discuss.elastic.co/t/ingest-vs-data/299662)
**Author:** [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 3:57pm UTC](https://discuss.elastic.co/t/ingest-vs-data/299662 "2022-03-16T15:57:55Z")
I have read the Node Roles documentation, but am still unclear on the difference between the ingest and data roles. In particular, if a node has the data role but not the ingest role, does that mean that incoming data (e… --- ## [Labels / characters / texts are not visible properly for Legend Position in Kibana Dashboard](https://discuss.elastic.co/t/labels-characters-texts-are-not-visible-properly-for-legend-position-in-kibana-dashboard/299686)
**Author:** [@hitnalli\_praveen](https://discuss.elastic.co/u/hitnalli_praveen)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 3:19pm UTC](https://discuss.elastic.co/t/labels-characters-texts-are-not-visible-properly-for-legend-position-in-kibana-dashboard/299686 "2022-03-16T15:19:33Z")
I've setup a Visualization with few Required fields for the different systems with Split Series in Kibana. (for e.g. systems are numbered like SU01, SU02 ... SU013) and each system is installed with different Software (S… --- ## [Logstash date filter plugin adds \_dateparsefailure tag on event data from JDBC](https://discuss.elastic.co/t/logstash-date-filter-plugin-adds-dateparsefailure-tag-on-event-data-from-jdbc/299855)
**Author:** [@nilei](https://discuss.elastic.co/u/nilei)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 3:18pm UTC](https://discuss.elastic.co/t/logstash-date-filter-plugin-adds-dateparsefailure-tag-on-event-data-from-jdbc/299855 "2022-03-16T15:18:47Z")
Dear all, I fetch data from a MySQL database via the JDBC input plugin. Here is an excerpt from the SQL result: +---------------------------+--------------------------+ | History.Created.DateValue | History.Number.KeyV… --- ## [How to set min\_doc\_count for bucket in Lens visualization?](https://discuss.elastic.co/t/how-to-set-min-doc-count-for-bucket-in-lens-visualization/298519)
**Author:** [@jakn](https://discuss.elastic.co/u/jakn)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 3:05pm UTC](https://discuss.elastic.co/t/how-to-set-min-doc-count-for-bucket-in-lens-visualization/298519 "2022-03-16T15:05:26Z")
I need to create a Formula Metric in a Lens visualization on some terms/top value buckets. I only want to calculate the metric for buckets with at least 10 records. How do I ensure that? I know that in the aggregation-… --- ## [Need help with Kibana Visual](https://discuss.elastic.co/t/need-help-with-kibana-visual/298224)
**Author:** [@mohitspacee](https://discuss.elastic.co/u/mohitspacee)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 2:50pm UTC](https://discuss.elastic.co/t/need-help-with-kibana-visual/298224 "2022-03-16T14:50:41Z")
Hello! I am trying to set up a simple Kibana line chart with these conditions - I'm trying to set up a Power vs Timestamp chart. In elastic, I have the metrics Current and Voltage. I'll calculate the Power from that. P… --- ## [Best compression codec](https://discuss.elastic.co/t/best-compression-codec/299869)
**Author:** [@Rollup\_eval](https://discuss.elastic.co/u/Rollup_eval)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 2:47pm UTC](https://discuss.elastic.co/t/best-compression-codec/299869 "2022-03-16T14:47:36Z")
Hello, I'm using Elasticsearch 7.10.2. I have created a new index with index.codec: best\_compression in its settings. Is the best\_compression for this new index taken on account during hot phase ? (or only during the… --- ## [Filebeat Modules for Syslog-ng files not creating index](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767)
**Author:** [@sevtech](https://discuss.elastic.co/u/sevtech)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 2:25pm UTC](https://discuss.elastic.co/t/filebeat-modules-for-syslog-ng-files-not-creating-index/299767 "2022-03-16T14:25:20Z")
I have a Syslog-NG server that has been upgraded from 7.4 to 8.0.1 via YUM on CentOS. I am new to ELK. I have mostly switch syslog data and Palo Alto FW syslog data on the Syslog -NG server. When I set the filebeat co… --- ## [\[Kibana\]Data from Multiple Tables MySQL](https://discuss.elastic.co/t/kibana-data-from-multiple-tables-mysql/299867)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 2:23pm UTC](https://discuss.elastic.co/t/kibana-data-from-multiple-tables-mysql/299867 "2022-03-16T14:23:49Z")
Good morning, I've several tables assets (hostname, idos,oss, lastview) rules( idrule,idos,value) compliance(idrule,idos,date,valueserver) and i wanna make / visualice tables like this Assets OSSS Date1 Date2 Date3… --- ## [Canvas Expression Syntax NewLine & Comments](https://discuss.elastic.co/t/canvas-expression-syntax-newline-comments/299796)
**Author:** [@GoncaloCarvalho](https://discuss.elastic.co/u/GoncaloCarvalho)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 1:59pm UTC](https://discuss.elastic.co/t/canvas-expression-syntax-newline-comments/299796 "2022-03-16T13:59:34Z")
Greetings, I need help with two specific features, would greatly appreciate any help you could hand me. I'm setting up a canvas Workpad and I wanted to add some sort of documentation through comments in my code, so oth… --- ## [CEF Logging not indexing field "event.original:"](https://discuss.elastic.co/t/cef-logging-not-indexing-field-event-original/299756)
**Author:** [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\ **Replies:** 4\ **Last updated:** [March 16, 2022, 1:57pm UTC](https://discuss.elastic.co/t/cef-logging-not-indexing-field-event-original/299756 "2022-03-16T13:57:04Z")
I have customer who ingests logs with CEF filebeat module. There is this field:"event.original:" and it does not index so it is not searchable. They ingest barracuda logs in this way. But I have trouble on setting up ba… --- ## [How to generate /Fetch report in pdf or excel for APM logs, transection data from Kibana](https://discuss.elastic.co/t/how-to-generate-fetch-report-in-pdf-or-excel-for-apm-logs-transection-data-from-kibana/299865)
**Author:** [@Sharma3007](https://discuss.elastic.co/u/Sharma3007)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:56pm UTC](https://discuss.elastic.co/t/how-to-generate-fetch-report-in-pdf-or-excel-for-apm-logs-transection-data-from-kibana/299865 "2022-03-16T13:56:17Z")
Hi Team, We are successfully able to configure APM transection log in Kibana & we are able to see all the APM logs related information on Kibana. But our requirement is to export all those logs in one excel or pdf rep… --- ## [Elasticsearch SQL sub query: IN query not supported yet](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864)
**Author:** [@tg295](https://discuss.elastic.co/u/tg295)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-sql-sub-query-in-query-not-supported-yet/299864 "2022-03-16T13:42:14Z")
I'm trying to learn to learn how to use Elasticsearch SQL for use in the Kibana canvas. What I would like to do is aggregate sales by some metric over country and date, but filter those results so i'm looking at two spe… --- ## [Sql query cannot be cancelled and long running](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070)
**Author:** [@Sathish\_smart](https://discuss.elastic.co/u/Sathish_smart)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 1:39pm UTC](https://discuss.elastic.co/t/sql-query-cannot-be-cancelled-and-long-running/299070 "2022-03-16T13:39:35Z")
I am unable to cancel the Elasticsearch sql query which is long running and I would like to know whether there is any option to make 'cancellable' true in the sql API. { "completed": false, "task": { "node": "5yiolpw… --- ## [Unable to load beats input plugin after installing it locally](https://discuss.elastic.co/t/unable-to-load-beats-input-plugin-after-installing-it-locally/299863)
**Author:** [@Nikhitha](https://discuss.elastic.co/u/Nikhitha)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:32pm UTC](https://discuss.elastic.co/t/unable-to-load-beats-input-plugin-after-installing-it-locally/299863 "2022-03-16T13:32:07Z")
After installing beats input plugin after dowloadong from github and generating .gem file, it appears when listed the plugins in logstash, but when ran any configuration file on beats, it says pluginLoading error. Can s… --- ## [Data Stream Backing Index Naming](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861)
**Author:** [@omer](https://discuss.elastic.co/u/omer)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 1:24pm UTC](https://discuss.elastic.co/t/data-stream-backing-index-naming/299861 "2022-03-16T13:24:26Z")
Hi, I am using data stream to index my log records. In documentation, it is said that the backing index is named using the following convention: .ds-\[data-stream\]-\[yyyy.MM.dd\]-\[generation\] but in my case, time segment… --- ## [Discovery 8.1](https://discuss.elastic.co/t/discovery-8-1/299789)
**Author:** [@Vurijano\_Pinas](https://discuss.elastic.co/u/Vurijano_Pinas)\ **Replies:** 5\ **Last updated:** [March 16, 2022, 1:03pm UTC](https://discuss.elastic.co/t/discovery-8-1/299789 "2022-03-16T13:03:35Z")
Hi, so i installing 8.1 and struggeling to get my node active after editting the config file. Now i cannot find any good guide to help me to the process. I would like to know howto install multi-node whitout having my n… --- ## [Logstash Geoip plugin](https://discuss.elastic.co/t/logstash-geoip-plugin/299044)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 10\ **Last updated:** [March 16, 2022, 12:55pm UTC](https://discuss.elastic.co/t/logstash-geoip-plugin/299044 "2022-03-16T12:55:53Z")
Hi Im using Logstash Geoip Plugin as below geoip { source =\> "sourceIP" target =\> "geoIP" add\_field =\> { "countryCode" =\> "%{\[geoIP\]\[country\_code2\]}" } } But at… --- ## [ConnectException using REST client in Java](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853)
**Author:** [@Chaitanya\_Varanasi](https://discuss.elastic.co/u/Chaitanya_Varanasi)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 12:20pm UTC](https://discuss.elastic.co/t/connectexception-using-rest-client-in-java/299853 "2022-03-16T12:20:24Z")
RestClient is initialised well, but while trying to use the high level client , getting the following error java.net.ConnectException: null at org.apache.http.nio.pool.RouteSpecificPool.timeout(RouteSpecificPool… --- ## [S3 input dont delete/backup files after processing](https://discuss.elastic.co/t/s3-input-dont-delete-backup-files-after-processing/299187)
**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\ **Replies:** 2\ **Last updated:** [March 16, 2022, 11:21am UTC](https://discuss.elastic.co/t/s3-input-dont-delete-backup-files-after-processing/299187 "2022-03-16T11:21:00Z")
Hello. Trouble with setting S3 input plugin with private S3 like AWS Minio. Logstash version OSS 7.16, 7.17, 8.0, 8.1. Logstash normally read object and send to output, but backup or delete is not working. Object stay… --- ## [Query DSL count distinct](https://discuss.elastic.co/t/query-dsl-count-distinct/299751)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 15\ **Last updated:** [March 16, 2022, 11:09am UTC](https://discuss.elastic.co/t/query-dsl-count-distinct/299751 "2022-03-16T11:09:35Z")
Hi, I am looking for precise count results for index with over 70 millions documents. Equal to this: SQL: select count(distinct column) from table; I already tried Terms-aggregation, composite-aggregation, cardinality… --- ## [How to update a field with null using NEST and the Update API](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 11:06am UTC](https://discuss.elastic.co/t/how-to-update-a-field-with-null-using-nest-and-the-update-api/299390 "2022-03-16T11:06:35Z")
We are using the NEST library with Elasticsearch versions 7.14. Lets say we have assigned a field Greeting with a value of "hello World". The filed is mapped as a Keyword type and Not Indexed. If you update that docum… --- ## [Metricbeat kibana no stable](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091)
**Author:** [@gerardgorrion](https://discuss.elastic.co/u/gerardgorrion)\ **Replies:** 3\ **Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/metricbeat-kibana-no-stable/299091 "2022-03-16T10:48:51Z")
We are triying to deploy metricbeat to monitor kibana in eck with stack monitoring. The problem is, the monitoring is not working fine: Kibana stack monitoring: Last 15 min of a single kibana node (continous monitor… --- ## [Use per field analyzer wrapper in elasticsearch](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:48am UTC](https://discuss.elastic.co/t/use-per-field-analyzer-wrapper-in-elasticsearch/299850 "2022-03-16T10:48:50Z")
I am creating an Elasticsearch plugin where I am writing code for tokenizer and analyzer in java. There is a case scenario where I have to use the multi fields to analyze something. There are some examples available to u… --- ## [Login loop and error 401 on /api/licensing/info](https://discuss.elastic.co/t/login-loop-and-error-401-on-api-licensing-info/298933)
**Author:** [@ETspielberg](https://discuss.elastic.co/u/ETspielberg)\ **Replies:** 1\ **Last updated:** [March 16, 2022, 10:44am UTC](https://discuss.elastic.co/t/login-loop-and-error-401-on-api-licensing-info/298933 "2022-03-16T10:44:53Z")
Hi everyone, I have a strange problem with kibana, which I cannot figure out. It is similar to a number of topics here (e.g. https://discuss.elastic.co/t/http-error-401-on-api-licensing-info/281542, https://discuss.elas… --- ## [The fastest way to export to Text](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:23am UTC](https://discuss.elastic.co/t/the-fastest-way-to-export-to-text/299849 "2022-03-16T10:23:24Z")
Hi. I want to create a function to export logs stored in Elasticsearch to Text using Java APIs. Currently, I have used the Scroll API to implement it, but I want it to be more than twice as fast. Is the Scroll API the… --- ## [Failed to restore the incdices](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 10:16am UTC](https://discuss.elastic.co/t/failed-to-restore-the-incdices/299848 "2022-03-16T10:16:29Z")
we are unable to restore some indices and get json\_parse\_exception. repo is in S3 bucket. curl -u user:passwd - H 'Content-Type: application/json' -XPOST https://\:9200/\_snapshot/\/\/\_res… --- ## [Premature file delete when file\_completed\_action is set to "delete"](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845)
**Author:** [@pinehk](https://discuss.elastic.co/u/pinehk)\ **Replies:** 0\ **Last updated:** [March 16, 2022, 9:12am UTC](https://discuss.elastic.co/t/premature-file-delete-when-file-completed-action-is-set-to-delete/299845 "2022-03-16T09:12:01Z")
Hi, The files i needed to push to Elasticsearch for indexing are all "completed" files. To avoid duplicated document I'm trying the file\_completed\_action switch. Setting a document ID is not an option as my data files a… --- ## [Relationship between Elasticsearch and Nagios](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844)
**Author:** [@nour41\_nour41](https://discuss.elastic.co/u/nour41_nour41)\ **Replies:** 6\ **Last updated:** [March 16, 2022, 10:04am UTC](https://discuss.elastic.co/t/relationship-between-elasticsearch-and-nagios/299844 "2022-03-16T10:04:35Z")
relationship between Elasticsearch and Nagios and communication . thanks --- ## [Unable to upgrade elasticsearch from 6.8.1 to 7.16.3](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697)
**Author:** [@karthik\_s4](https://discuss.elastic.co/u/karthik_s4)\ **Replies:** 13\ **Last updated:** [March 16, 2022, 9:54am UTC](https://discuss.elastic.co/t/unable-to-upgrade-elasticsearch-from-6-8-1-to-7-16-3/299697 "2022-03-16T09:54:18Z")
Hi, Unable to upgrade Elasticsearch to 7.16.3 from 6.81 in our elastic cluster with 4 nodes. getting below messages in log file with this. please help. \[2022-03-12T17:04:36,236\]\[INFO \]\[o.e.x.m.e.l.LocalExporter\] \[10.4.… --- ## [Kibana lens visualization is very slow](https://discuss.elastic.co/t/kibana-lens-visualization-is-very-slow/299198)
**Author:** [@notgurev](https://discuss.elastic.co/u/notgurev)\ **Replies:** 10\ **Last updated:** [March 16, 2022, 9:45am UTC](https://discuss.elastic.co/t/kibana-lens-visualization-is-very-slow/299198 "2022-03-16T09:45:25Z")
I have a cluster consisting of 1 hot (40 cores, 2 SSDs) and 2 cold nodes. I use a data stream to index a lot of data into 50gb one-shard indices with rollover, ILM, etc. Data is also sorted by @timestamp (asc) -- so I be… [Previous page](https://discuss.elastic.co/latest.md?page=1213) [Next page](https://discuss.elastic.co/latest.md?page=1215)