# Latest **URL:** https://discuss.elastic.co/latest.md?page=1275 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1276 --- ## [Concatenating 3 columns using Computed columns in enhanced table](https://discuss.elastic.co/t/concatenating-3-columns-using-computed-columns-in-enhanced-table/296269)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:47pm UTC](https://discuss.elastic.co/t/concatenating-3-columns-using-computed-columns-in-enhanced-table/296269 "2022-02-06T21:47:18Z")
Hi all, There are 3 fields a,b,c . For every document, only 1 of them will have a value. So I'm trying to concatenate 3 columns , but it is showing null with the string. For example : document 1: a=Hi b= c= When … --- ## [Should I have one Index or Multiple Indexes](https://discuss.elastic.co/t/should-i-have-one-index-or-multiple-indexes/296312)
**Author:** [@Pawan\_Misra](https://discuss.elastic.co/u/Pawan_Misra)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:46pm UTC](https://discuss.elastic.co/t/should-i-have-one-index-or-multiple-indexes/296312 "2022-02-06T21:46:29Z")
We have a scenario where we have data from multiple clients. some figures to note: No of clients - 100 Data/client - 10GB (avg) With the above data, what should be our Indexing strategy? We know that we will need to… --- ## [Use LVM cache for Elasticsearch](https://discuss.elastic.co/t/use-lvm-cache-for-elasticsearch/296326)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 9:45pm UTC](https://discuss.elastic.co/t/use-lvm-cache-for-elasticsearch/296326 "2022-02-06T21:45:46Z")
Hello Everyone, can we use the Elasticseacrh with LVM cache logical volume? Cache logical volume The cache logical volume type uses a small and fast LV to improve the performance of a large and slow LV. It does this … --- ## [Couldn't find any Elasticsearch data](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data/296330)
**Author:** [@mikemiko](https://discuss.elastic.co/u/mikemiko)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 9:44pm UTC](https://discuss.elastic.co/t/couldnt-find-any-elasticsearch-data/296330 "2022-02-06T21:44:55Z")
I deployed an EFK stack on a 3 Node Kubernetes cluster (kind cluster). The Cluster is also running a custom app that I intend to monitor through the stack. All Pods are running. I can access Kibana at: \\ **Author:** [@nsimi](https://discuss.elastic.co/u/nsimi)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 9:44pm UTC](https://discuss.elastic.co/t/can-i-have-two-different-kibana-servers-pointed-at-the-same-elasticsearch-cluster/296339 "2022-02-06T21:44:20Z") Good Morning All, I have an ES cluster running and an instance of Kibana (Lets call this instance A) pointed at that. And because of some involved weird "business reasons" I wanted to know if I could have a separate Kib… --- ## [Creating ilm policies in Java using new java api client](https://discuss.elastic.co/t/creating-ilm-policies-in-java-using-new-java-api-client/296375)
**Author:** [@Nicolas35](https://discuss.elastic.co/u/Nicolas35)\ **Replies:** 0\ **Last updated:** [February 6, 2022, 12:18am UTC](https://discuss.elastic.co/t/creating-ilm-policies-in-java-using-new-java-api-client/296375 "2022-02-06T00:18:43Z")
Hi, I am stuck creating a policy in java using the new java api client. I am using Elasticsearch-java 7.16.2 Here is the faulty code: String json= "{\\"allocate\\" : {\\"number\_of\_replicas\\" : 1}," + "\\"fo… --- ## [ElastisSearch JVM Heap running full](https://discuss.elastic.co/t/elastissearch-jvm-heap-running-full/295928)
**Author:** [@grregm](https://discuss.elastic.co/u/grregm)\ **Replies:** 5\ **Last updated:** [February 6, 2022, 9:00pm UTC](https://discuss.elastic.co/t/elastissearch-jvm-heap-running-full/295928 "2022-02-06T21:00:17Z")
Hey there, We are running a Elasticsearch (7.16.1, Docker inside Kubernetes) cluster which is monitored by a Kibana Stack. After 5-6 days (sometimes sooner) Elasticsearch is running into JVM Heap issues/errors. Is there… --- ## [Threatintel/Misp var.filters type making filebeat service stop!](https://discuss.elastic.co/t/threatintel-misp-var-filters-type-making-filebeat-service-stop/296197)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 6:30pm UTC](https://discuss.elastic.co/t/threatintel-misp-var-filters-type-making-filebeat-service-stop/296197 "2022-02-06T18:30:59Z")
Hello, I'm using misp threatintel and i tried to filter data by type but filebeat is keep refusing the configuration and only starts if I remove the filters, even when I tried to use the same example proposed by docume… --- ## [How to print multiple text rows with vega](https://discuss.elastic.co/t/how-to-print-multiple-text-rows-with-vega/296085)
**Author:** [@TUKTUK](https://discuss.elastic.co/u/TUKTUK)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 5:47pm UTC](https://discuss.elastic.co/t/how-to-print-multiple-text-rows-with-vega/296085 "2022-02-06T17:47:22Z")
Hi, all I am pretty new to the Vega world inside Kibana and was wondering if there is some easy way to simply print text fields in rows. I know that Vega is not designed to output text, nevertheless, someone knows maybe… --- ## [How to restore snapshot to a different cluster](https://discuss.elastic.co/t/how-to-restore-snapshot-to-a-different-cluster/296182)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 6\ **Last updated:** [February 6, 2022, 2:43pm UTC](https://discuss.elastic.co/t/how-to-restore-snapshot-to-a-different-cluster/296182 "2022-02-06T14:43:02Z")
Hello Guys, I have taken a snapshot of Elasticsearch db in one of the cluster(here Elasticsearch is running as kubernetes pods, 3 pods of Elasticsearch are running) and now I want that snapshot to be restored into a com… --- ## [Script field along with all the other fields using Painless](https://discuss.elastic.co/t/script-field-along-with-all-the-other-fields-using-painless/296384)
**Author:** [@saurab](https://discuss.elastic.co/u/saurab)\ **Replies:** 3\ **Last updated:** [February 6, 2022, 12:10pm UTC](https://discuss.elastic.co/t/script-field-along-with-all-the-other-fields-using-painless/296384 "2022-02-06T12:10:19Z")
I have data indexed as follows: {"index":{"\_id":1}} {"first":"johnny","last":"gaudreau","goals":\[9,27,1\],"born":"1993/08/13"} {"index":{"\_id":2}} {"first":"sean","last":"monohan","goals":\[7,54,26\],"born":"1994/10/12"} W… --- ## [Automatically centre the map around a specified point by dropdown menu](https://discuss.elastic.co/t/automatically-centre-the-map-around-a-specified-point-by-dropdown-menu/296281)
**Author:** [@Angad\_Panesar1](https://discuss.elastic.co/u/Angad_Panesar1)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 7:44pm UTC](https://discuss.elastic.co/t/automatically-centre-the-map-around-a-specified-point-by-dropdown-menu/296281 "2022-02-04T19:44:01Z")
Hi, There is a dropdown menu filter of ID's with each of them having different latitudes and longitudes on the map. Is there any way that I can centre the map around the specified point by clicking on the ID in the dropd… --- ## [Use one ingest pipeline as default\_pipeline for different indexes](https://discuss.elastic.co/t/use-one-ingest-pipeline-as-default-pipeline-for-different-indexes/296266)
**Author:** [@m-cd](https://discuss.elastic.co/u/m-cd)\ **Replies:** 2\ **Last updated:** [February 6, 2022, 9:15am UTC](https://discuss.elastic.co/t/use-one-ingest-pipeline-as-default-pipeline-for-different-indexes/296266 "2022-02-06T09:15:05Z")
Hi All, I'm a little bit new on the ELK world... So sorry for my newbie question... I setup a working ingest pipeline (policy and processors) and it works like a charm on one index as default\_pipeline. I would like t… --- ## [How to organize snmp tables like in nagios](https://discuss.elastic.co/t/how-to-organize-snmp-tables-like-in-nagios/296372)
**Author:** [@Samt1](https://discuss.elastic.co/u/Samt1)\ **Replies:** 1\ **Last updated:** [February 6, 2022, 1:32am UTC](https://discuss.elastic.co/t/how-to-organize-snmp-tables-like-in-nagios/296372 "2022-02-06T01:32:23Z")
Hello. I'm trying to monitor some devices via snmp and logstash. I want to display the information in a table like this (this table is from nagios). Is it possible? I've made some tables on the visualization library, bu… --- ## [Attempt to divide two fields at the aggregate level causing infinity response](https://discuss.elastic.co/t/attempt-to-divide-two-fields-at-the-aggregate-level-causing-infinity-response/296198)
**Author:** [@LuigiGalati](https://discuss.elastic.co/u/LuigiGalati)\ **Replies:** 20\ **Last updated:** [February 5, 2022, 11:08pm UTC](https://discuss.elastic.co/t/attempt-to-divide-two-fields-at-the-aggregate-level-causing-infinity-response/296198 "2022-02-05T23:08:45Z")
I am feeding kibana with an HR dataset from peoplesoft. The data is beginning, end and termination counts by fiscal year. There is no timestamped data used. I need to calculate percent turnover which is Terminations/(Ave… --- ## [Query sample of each field in index](https://discuss.elastic.co/t/query-sample-of-each-field-in-index/296370)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 10:11pm UTC](https://discuss.elastic.co/t/query-sample-of-each-field-in-index/296370 "2022-02-05T22:11:41Z")
I am trying to develop data-catalog app this app shows all fields (in flat dict format) its mapping type and sample data for instance this index POST test/\_doc { "@timestamp": "2099-11-15T13:12:00", "message": "GE… --- ## [Java client, which libraries, packages](https://discuss.elastic.co/t/java-client-which-libraries-packages/296366)
**Author:** [@mamueIV](https://discuss.elastic.co/u/mamueIV)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 8:25pm UTC](https://discuss.elastic.co/t/java-client-which-libraries-packages/296366 "2022-02-05T20:25:17Z")
Hi, i try to get started with Elasticsearch development in java. Alas still no javadoc as far as i can see and the source examples are quite confusing. No mention of used libraries, not even package names. For example,… --- ## [Rules Authentication out of working time](https://discuss.elastic.co/t/rules-authentication-out-of-working-time/296364)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 7:54pm UTC](https://discuss.elastic.co/t/rules-authentication-out-of-working-time/296364 "2022-02-05T19:54:57Z")
Hello Every body, I need a rule to detect authentication based on the event id 4624 (Windows authentication) out of working time. do you have any idea about this? Thanks, --- ## [APIKey retains the cluster privileges at the time is was created](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359)
**Author:** [@Roger\_Clark](https://discuss.elastic.co/u/Roger_Clark)\ **Replies:** 2\ **Last updated:** [February 5, 2022, 5:39pm UTC](https://discuss.elastic.co/t/apikey-retains-the-cluster-privileges-at-the-time-is-was-created/296359 "2022-02-05T17:39:20Z")
We were testing out migration to APIKeys for application-level API access and I noticed something strange I can't find documented anywhere, this is under a ELK stack running 7.15.1 I created a new user and role, and for… --- ## [Logstash Listening on port 8080 got struck](https://discuss.elastic.co/t/logstash-listening-on-port-8080-got-struck/296130)
**Author:** [@naveen\_g](https://discuss.elastic.co/u/naveen_g)\ **Replies:** 5\ **Last updated:** [February 5, 2022, 4:32pm UTC](https://discuss.elastic.co/t/logstash-listening-on-port-8080-got-struck/296130 "2022-02-05T16:32:59Z")
Hi Everyone, I'm new to ELK and go-through handful of articles & videos , I setup ELK for our projects. When I do POC on setup ELK & Filebeat in same machine, it was working fine but when we planned to separate ELK to se… --- ## [Deletion of eck-operator pod](https://discuss.elastic.co/t/deletion-of-eck-operator-pod/296360)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [February 5, 2022, 1:37pm UTC](https://discuss.elastic.co/t/deletion-of-eck-operator-pod/296360 "2022-02-05T13:37:38Z")
We are upgrading out istio version. ECK (and the elastic / kibana pods) have istio sidecar injected. For all pods to take the new sidecars, a restart is needed, so that new pods are generated. This is more or less man… --- ## [What to do with query inside filter query](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246)
**Author:** [@JunyaT](https://discuss.elastic.co/u/JunyaT)\ **Replies:** 3\ **Last updated:** [February 5, 2022, 4:26am UTC](https://discuss.elastic.co/t/what-to-do-with-query-inside-filter-query/296246 "2022-02-05T04:26:24Z")
Hi, people from Elasticsearch. I have struggles trying to migrate to Elasticsearch 7.11.1 from very old Elasticsearch 1.3. "The original query" below is used in our codebase to be executed against Elasticsearch 1.3 and… --- ## [Remove Kibana message about overlapping Snapshots](https://discuss.elastic.co/t/remove-kibana-message-about-overlapping-snapshots/296350)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [February 5, 2022, 12:07am UTC](https://discuss.elastic.co/t/remove-kibana-message-about-overlapping-snapshots/296350 "2022-02-05T00:07:42Z")
Hello, While elasticsearch can now take multiple snapshots at the same time, If you configure a snapshot policy with the same time in Kibana, it will show the following message: Two or more policies have the same sche… --- ## [Runtime field error](https://discuss.elastic.co/t/runtime-field-error/296234)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 3\ **Last updated:** [February 4, 2022, 10:45pm UTC](https://discuss.elastic.co/t/runtime-field-error/296234 "2022-02-04T22:45:36Z")
Hello, I'm attempting to create a runtime field that parses values from a field based on a regex. I have a field event\_trigger that contains some various strings. I'm looking to find all values which contain giy2 and … --- ## [How to dynamically recognize points via HTTPS ingestion?](https://discuss.elastic.co/t/how-to-dynamically-recognize-points-via-https-ingestion/296346)
**Author:** [@HC\_LW](https://discuss.elastic.co/u/HC_LW)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 10:03pm UTC](https://discuss.elastic.co/t/how-to-dynamically-recognize-points-via-https-ingestion/296346 "2022-02-04T22:03:46Z")
We are sending https requests to ingest data. How can the request be formatted so that Elastic dynamically maps the 'geo\_point' field as type:point and not text or number? Thank you! curl -X POST "https://in-https.URL" … --- ## [Elasticsearch Ability to write to Memory](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586)
**Author:** [@Mohammad\_Etemad](https://discuss.elastic.co/u/Mohammad_Etemad)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 9:07pm UTC](https://discuss.elastic.co/t/elasticsearch-ability-to-write-to-memory/295586 "2022-02-04T21:07:00Z")
Hello I was wondering if its possible to have Elasticsearch write docs to memory and have them roll. The use case is that we have a lot of data on a specific index being written and the writes to disk are using lots of … --- ## [Kibana service account not working for v8 upgrade deprecation note](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 4\ **Last updated:** [February 4, 2022, 9:05pm UTC](https://discuss.elastic.co/t/kibana-service-account-not-working-for-v8-upgrade-deprecation-note/296125 "2022-02-04T21:05:19Z")
We recently moved our stack to 7.17 and are working through some of the warnings in the 8.0 upgrade assistant to be ready for the new version in the future. When changing Kibana to use Elasticsearch.serviceAccountToken i… --- ## [Enterprisesearch takes all CPU while Elasticsearch is quiet, and searches thow timeout](https://discuss.elastic.co/t/enterprisesearch-takes-all-cpu-while-elasticsearch-is-quiet-and-searches-thow-timeout/290388)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 2\ **Last updated:** [February 4, 2022, 9:01pm UTC](https://discuss.elastic.co/t/enterprisesearch-takes-all-cpu-while-elasticsearch-is-quiet-and-searches-thow-timeout/290388 "2022-02-04T21:01:36Z")
Hello, I have a single node docker configuration with enterprise search and Elasticsearch, both 7.15.1. When my user quantity grows, my searches begin to return timeout every time (I see 60" response times on avg), and e… --- ## [Workplace Search ServiceNow Connector](https://discuss.elastic.co/t/workplace-search-servicenow-connector/296340)
**Author:** [@ymoriarty](https://discuss.elastic.co/u/ymoriarty)\ **Replies:** 1\ **Last updated:** [February 4, 2022, 8:34pm UTC](https://discuss.elastic.co/t/workplace-search-servicenow-connector/296340 "2022-02-04T20:34:01Z")
This doc Connecting ServiceNow | Workplace Search Guide \[7.17\] | Elastic says the ServiceNow connector indexes "items". What is meant by items? What category of data is this? I use ServiceNow and do not have a type of… --- ## [Namespace Option in Slack Connector](https://discuss.elastic.co/t/namespace-option-in-slack-connector/295292)
**Author:** [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Replies:** 5\ **Last updated:** [February 4, 2022, 7:59pm UTC](https://discuss.elastic.co/t/namespace-option-in-slack-connector/295292 "2022-02-04T19:59:25Z")
Is it possible to add the namespace information in the slack connector? i.e Rule {{context.rule.name}} with severity {{context.rule.severity}} generated {{state.signals\_count}} alerts in the {{context.data\_stream.names… [Previous page](https://discuss.elastic.co/latest.md?page=1274) [Next page](https://discuss.elastic.co/latest.md?page=1276)