# Latest **URL:** https://discuss.elastic.co/latest.md?page=1362 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1363 --- ## [Logstash bytes plugin behaving weirdly](https://discuss.elastic.co/t/logstash-bytes-plugin-behaving-weirdly/290947)
**Author:** [@tkauffmann](https://discuss.elastic.co/u/tkauffmann)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 9:39am UTC](https://discuss.elastic.co/t/logstash-bytes-plugin-behaving-weirdly/290947 "2021-12-04T09:39:44Z")
Hi, I am trying to use the "Bytes" plugin (Bytes filter plugin | Logstash Reference \[8.0\] | Elastic) to transform fields in the form "1 GB" to their bytes value. I use the following syntax : bytes { sour… --- ## [Upgrading java with elasticsearch](https://discuss.elastic.co/t/upgrading-java-with-elasticsearch/290946)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [December 4, 2021, 9:36am UTC](https://discuss.elastic.co/t/upgrading-java-with-elasticsearch/290946 "2021-12-04T09:36:54Z")
Hi, I've upgraded Elasticsearch from 7.13 to 7.15 successfully using: sudo apt-get update && sudo apt-get install elasticsearch But in the upgrade steps listed in elastic documentation, number 4 ( Java High Level REST… --- ## [Queries on keyword field are extremely slow](https://discuss.elastic.co/t/queries-on-keyword-field-are-extremely-slow/290833)
**Author:** [@Mujo](https://discuss.elastic.co/u/Mujo)\ **Replies:** 4\ **Last updated:** [December 4, 2021, 8:52am UTC](https://discuss.elastic.co/t/queries-on-keyword-field-are-extremely-slow/290833 "2021-12-04T08:52:25Z")
I use Elasticsearch for text search. Sentences used for indexing are first split into words and then each word is attached with its corresponding POS tag as below: Raw sentence: word1 word2 word3 word4. Sentence for i… --- ## [Can't run Kibana after installing on Archlinux (Failed to fetch)](https://discuss.elastic.co/t/cant-run-kibana-after-installing-on-archlinux-failed-to-fetch/290240)
**Author:** [@gachistyakov](https://discuss.elastic.co/u/gachistyakov)\ **Replies:** 2\ **Last updated:** [December 4, 2021, 8:03am UTC](https://discuss.elastic.co/t/cant-run-kibana-after-installing-on-archlinux-failed-to-fetch/290240 "2021-12-04T08:03:33Z")
I have installed Elasticsearch as stated in the resource https://wiki.archlinux.org/title/Elasticsearch. After that I had the store "/usr/share/Elasticsearch/config/Elasticsearch.keystore" created, so I didn’t recreate i… --- ## [Dec 4th, 2021: \[it\] Trucchi e consigli avanzati per Lens](https://discuss.elastic.co/t/dec-4th-2021-it-trucchi-e-consigli-avanzati-per-lens/290689)
**Author:** [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-4th-2021-it-trucchi-e-consigli-avanzati-per-lens/290689 "2021-12-04T08:00:26Z")
Questo articolo è disponibile anche in inglese. Lens è uno strumento relativamente nuovo in Kibana, rilasciato in versione stabile meno di un anno fa come strumento universale per visualizzazioni, ma ha già attratto mol… --- ## [Dec 4th, 2021: \[en\] Advanced trick and tips in Lens](https://discuss.elastic.co/t/dec-4th-2021-en-advanced-trick-and-tips-in-lens/289935)
**Author:** [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 8:00am UTC](https://discuss.elastic.co/t/dec-4th-2021-en-advanced-trick-and-tips-in-lens/289935 "2021-12-04T08:00:26Z")
This article is also available in Italian. Lens is a relatively new tool in Kibana, which went GA less than a year ago as universal visualization editor, and already gained some interest for its advanced features minor … --- ## [How to use x-pack with python to enable wildcard](https://discuss.elastic.co/t/how-to-use-x-pack-with-python-to-enable-wildcard/290941)
**Author:** [@Mujo](https://discuss.elastic.co/u/Mujo)\ **Replies:** 1\ **Last updated:** [December 4, 2021, 7:29am UTC](https://discuss.elastic.co/t/how-to-use-x-pack-with-python-to-enable-wildcard/290941 "2021-12-04T07:29:29Z")
I need to set "type" : "wildcard" in mappings. I have learnt that wildcard is added as a new feature to Elasticsearch 7.9. However, I need to use x-pack in order to use this feature. There are limited documents for le… --- ## [Troubleshooting Metricbeat StatsD Module and Custom Metrics](https://discuss.elastic.co/t/troubleshooting-metricbeat-statsd-module-and-custom-metrics/290938)
**Author:** [@Jeremy\_Gillick](https://discuss.elastic.co/u/Jeremy_Gillick)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 1:28am UTC](https://discuss.elastic.co/t/troubleshooting-metricbeat-statsd-module-and-custom-metrics/290938 "2021-12-04T01:28:57Z")
I installed the Metricbeat StatsD module a few days ago and it's reporting data on the machine it's installed on, but not reporting any custom metrics I send to it. For example: echo "test.metric:1|c" | nc -u -w0 \ **Author:** [@icious](https://discuss.elastic.co/u/icious)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 1:44am UTC](https://discuss.elastic.co/t/can-i-apply-fleet-managed-processors-after-elasticsearch-ingest-node-pipelines/290939 "2021-12-04T01:44:10Z") Hi all, I'm trying to apply reverse DNS lookup to the logs received from my Sophos firewall using the "DNS" processor of filebeat, but so far I didn't have any luck with that using the Sophos fleet-managed integration. … --- ## [Kibana 7.5.1 Web Error: Private is not a function in bundles/commons.bundle.js](https://discuss.elastic.co/t/kibana-7-5-1-web-error-private-is-not-a-function-in-bundles-commons-bundle-js/289712)
**Author:** [@thanhlam](https://discuss.elastic.co/u/thanhlam)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 9:42pm UTC](https://discuss.elastic.co/t/kibana-7-5-1-web-error-private-is-not-a-function-in-bundles-commons-bundle-js/289712 "2021-12-03T21:42:32Z")
Hello, I just wonder if anyone here have seen following problem after installing a plugin to kibana, version 7.5.1. If I removed the plugin then everything worked fine. After installing the plugin, kibana started fine … --- ## [Best way to use Ingest Attachment Plugin](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884)
**Author:** [@sp7980](https://discuss.elastic.co/u/sp7980)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 9:31pm UTC](https://discuss.elastic.co/t/best-way-to-use-ingest-attachment-plugin/290884 "2021-12-03T21:31:39Z")
I am trying to setup ES for indexing document content for full text search. The document types that will be indexed are .docx and pdf. Looks like ingest attachment plugin is to be used for this purpose and I've had a re… --- ## [Elasticsearch Engineering Observability - Where is the terminal screen to do SSH?](https://discuss.elastic.co/t/elasticsearch-engineering-observability-where-is-the-terminal-screen-to-do-ssh/290907)
**Author:** [@Brendanluvsdata](https://discuss.elastic.co/u/Brendanluvsdata)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 8:57pm UTC](https://discuss.elastic.co/t/elasticsearch-engineering-observability-where-is-the-terminal-screen-to-do-ssh/290907 "2021-12-03T20:57:14Z")
The lab just casually tells you to SSH into the SQL database, but it doesn't tell you where the terminal screen is located in the lab. Can anyone help? --- ## [Push logstash aggregate map as fields in final event](https://discuss.elastic.co/t/push-logstash-aggregate-map-as-fields-in-final-event/290929)
**Author:** [@Joe\_Martin](https://discuss.elastic.co/u/Joe_Martin)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 8:39pm UTC](https://discuss.elastic.co/t/push-logstash-aggregate-map-as-fields-in-final-event/290929 "2021-12-03T20:39:54Z")
I am trying to use an aggregate filter to pull fields from several different but related logs into one "summary" log. There is a clear end\_of\_task event and I would like to "push"/add all of the fields in the map into t… --- ## [Updated "hardware" recommendations?](https://discuss.elastic.co/t/updated-hardware-recommendations/290930)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 8:34pm UTC](https://discuss.elastic.co/t/updated-hardware-recommendations/290930 "2021-12-03T20:34:51Z")
Just wondering if there is an updated doc similar to the very helpful 2.3 guide It summarized memory, disk, and network configuration information and is probably still relevant but I can't find a modern version of the … --- ## [Watcher daily trigger](https://discuss.elastic.co/t/watcher-daily-trigger/290927)
**Author:** [@shreya\_Das](https://discuss.elastic.co/u/shreya_Das)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 6:44pm UTC](https://discuss.elastic.co/t/watcher-daily-trigger/290927 "2021-12-03T18:44:02Z")
I have created a advanced watcher alert to check a particular log message that excecutes daily. It triggers everyday at 8PM. I want to know when the watcher is triggered is it gonna consider only that days log or previou… --- ## [Osquery Manager Feedback](https://discuss.elastic.co/t/osquery-manager-feedback/290825)
**Author:** [@Aitor](https://discuss.elastic.co/u/Aitor)\ **Replies:** 2\ **Last updated:** [December 3, 2021, 6:09pm UTC](https://discuss.elastic.co/t/osquery-manager-feedback/290825 "2021-12-03T18:09:13Z")
Hi there, I have installed osquery manager and I am not able to do live queries from the fleet elastic cloud instance (v 7.15.2). I always get the message: "2 agents have responded, no osquery data has been reported" wh… --- ## [Suggested pipline for rsyslog](https://discuss.elastic.co/t/suggested-pipline-for-rsyslog/290919)
**Author:** [@aqwserf](https://discuss.elastic.co/u/aqwserf)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 5:03pm UTC](https://discuss.elastic.co/t/suggested-pipline-for-rsyslog/290919 "2021-12-03T17:03:40Z")
Hi everyone ! Quite new user to the ELK stack, and after reading a lot of docs/threads, I'd like some suggestions about my current situation. I have a couple of SOHO router running Openwrt, a Proxmox server and a VPS. … --- ## [Logstash CSV output generation](https://discuss.elastic.co/t/logstash-csv-output-generation/290285)
**Author:** [@elk\_chaser](https://discuss.elastic.co/u/elk_chaser)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 5:03pm UTC](https://discuss.elastic.co/t/logstash-csv-output-generation/290285 "2021-12-03T17:03:03Z")
I have a logstash csv output report generation config, that I run as a separate logstash instance as and when it is required. I have many csv report to be generated and for each, I have one config file. Everytime I run t… --- ## [Google Cloud Kubernetes Elastic Interal LoadBalancer](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 4:53pm UTC](https://discuss.elastic.co/t/google-cloud-kubernetes-elastic-interal-loadbalancer/290787 "2021-12-03T16:53:53Z")
Hello, I have a GCP project with /28 VPC(nodes network) the main network peered with another Shared VPC project that maintains connectivity with all other resources. So far I have deployed elasticserach and kibana using… --- ## [Partial substring search that contains whitespaces or special chars like file contains "1 - document" doesnt work](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 4:49pm UTC](https://discuss.elastic.co/t/partial-substring-search-that-contains-whitespaces-or-special-chars-like-file-contains-1-document-doesnt-work/290883 "2021-12-03T16:49:06Z")
We have an application that store and query data in Elasticsearch. We have a problem when searching for partial substrings that contains a word with special chats like "notepad++.exe" or "/folder1/file1.txt" or "new text… --- ## [Point in time snapshot (PIT id), original query required when paging?](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097)
**Author:** [@tamis-laan](https://discuss.elastic.co/u/tamis-laan)\ **Replies:** 5\ **Last updated:** [December 3, 2021, 4:45pm UTC](https://discuss.elastic.co/t/point-in-time-snapshot-pit-id-original-query-required-when-paging/290097 "2021-12-03T16:45:53Z")
I implemented pagination inside an API using point in time snapshots for efficiency. In the first request a PIT is generated and in subsequent requests the PIT is being supplied with the request. What I would like to do… --- ## [Need to build visualization like how much time user stay on web page](https://discuss.elastic.co/t/need-to-build-visualization-like-how-much-time-user-stay-on-web-page/290759)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 4:25pm UTC](https://discuss.elastic.co/t/need-to-build-visualization-like-how-much-time-user-stay-on-web-page/290759 "2021-12-03T16:25:06Z")
Hello All, We have apache logs. We need to build visualization like how much time user stay on web page? Is this possible to determine above information by using below logs? How? 222.105.82.235 - - \[16/Nov/2021:10:04:… --- ## [LogStash with distributor pattern, relay pipelines problem](https://discuss.elastic.co/t/logstash-with-distributor-pattern-relay-pipelines-problem/290880)
**Author:** [@djehuty](https://discuss.elastic.co/u/djehuty)\ **Replies:** 7\ **Last updated:** [December 3, 2021, 4:12pm UTC](https://discuss.elastic.co/t/logstash-with-distributor-pattern-relay-pipelines-problem/290880 "2021-12-03T16:12:49Z")
Hi everyone, i recently changed my LogStash configuration from multiple pipelines input to 3 pipelines, relaying on another local pipelines with distributor. Now, i've tried to send and udp json to the udp pipeline, wi… --- ## [Not able to search or aggregate values from a field included lately in the mapping](https://discuss.elastic.co/t/not-able-to-search-or-aggregate-values-from-a-field-included-lately-in-the-mapping/290836)
**Author:** [@Fabio\_Batalha](https://discuss.elastic.co/u/Fabio_Batalha)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 4:12pm UTC](https://discuss.elastic.co/t/not-able-to-search-or-aggregate-values-from-a-field-included-lately-in-the-mapping/290836 "2021-12-03T16:12:02Z")
Hello there! I have a field (log\_file\_name) in my index that was not included in the mapping since de index was created. All records have the field but no mapping was defined to it. My mapping is configured as dynamic =… --- ## [SIEM rule action: Send raw json \`context.alerts\` to webhook](https://discuss.elastic.co/t/siem-rule-action-send-raw-json-context-alerts-to-webhook/290698)
**Author:** [@peter6](https://discuss.elastic.co/u/peter6)\ **Replies:** 1\ **Last updated:** [December 3, 2021, 4:09pm UTC](https://discuss.elastic.co/t/siem-rule-action-send-raw-json-context-alerts-to-webhook/290698 "2021-12-03T16:09:13Z")
I'm trying to get the raw json content of context.alerts pushed to my webhook for further analysis. Something like {{#toJson}}\[{{context.alerts}}\]{{/toJson}} Received content is either empty or escaped \\". Please help… --- ## [Graph scale on Kibana Dashboard](https://discuss.elastic.co/t/graph-scale-on-kibana-dashboard/290766)
**Author:** [@sunny3794.ad](https://discuss.elastic.co/u/sunny3794.ad)\ **Replies:** 5\ **Last updated:** [December 3, 2021, 3:58pm UTC](https://discuss.elastic.co/t/graph-scale-on-kibana-dashboard/290766 "2021-12-03T15:58:54Z")
Is there any way to change the graph scale on Kibana Dashboards to logarithmic? I have tried searching for it but couldn't find any option to bring about this change. I read somewhere that this feature was added to Kiban… --- ## [Error logging container json files with filebeat](https://discuss.elastic.co/t/error-logging-container-json-files-with-filebeat/290912)
**Author:** [@Guillaume84](https://discuss.elastic.co/u/Guillaume84)\ **Replies:** 0\ **Last updated:** [December 3, 2021, 3:48pm UTC](https://discuss.elastic.co/t/error-logging-container-json-files-with-filebeat/290912 "2021-12-03T15:48:11Z")
Hello, I am struggling for days on parsing a simple airflow json file from a k8s container Log format: {"asctime": "2021-12-02 17:04:34,450", "filename": "standard\_task\_runner.py", "lineno": 77, "levelname": "INFO", "… --- ## [Error restoring state from URL Cannot read properties of null (reading 'length')](https://discuss.elastic.co/t/error-restoring-state-from-url-cannot-read-properties-of-null-reading-length/290823)
**Author:** [@RobertC1](https://discuss.elastic.co/u/RobertC1)\ **Replies:** 3\ **Last updated:** [December 3, 2021, 3:32pm UTC](https://discuss.elastic.co/t/error-restoring-state-from-url-cannot-read-properties-of-null-reading-length/290823 "2021-12-03T15:32:39Z")
Hi! Please, when I switch from one dashboard to anothe I get the error Error restoring state from URL Cannot read properties of null (reading 'length'). I need help Thanks --- ## [Pie chart from time range](https://discuss.elastic.co/t/pie-chart-from-time-range/290545)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 4\ **Last updated:** [December 3, 2021, 2:48pm UTC](https://discuss.elastic.co/t/pie-chart-from-time-range/290545 "2021-12-03T14:48:21Z")
Hi, I have this kind of log to monitor the availability of my application: Status,Start,End Unavailable,17-03-2020 12:10:32,17-03-2020 12:14:32 Available,17-03-2020 12:15:32,26-03-2020 12:31:25 Unavailable,26-03-2020 1… --- ## [Kibana Filter aggregation: how to handle field names (and/or values) with spaces?](https://discuss.elastic.co/t/kibana-filter-aggregation-how-to-handle-field-names-and-or-values-with-spaces/289069)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 2\ **Last updated:** [December 3, 2021, 2:47pm UTC](https://discuss.elastic.co/t/kibana-filter-aggregation-how-to-handle-field-names-and-or-values-with-spaces/289069 "2021-12-03T14:47:10Z")
I'm having some trouble (with Kibana 6.7) in finding the correct way to handle this situation: field name: "Closure Code" possible field values: \["False Positive", "Automatically Closed", "Closed by change", ... \] I n… [Previous page](https://discuss.elastic.co/latest.md?page=1361) [Next page](https://discuss.elastic.co/latest.md?page=1363)