# Latest **URL:** https://discuss.elastic.co/latest.md?page=1456 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1457 --- ## [How to concatenate two fields in logstash?](https://discuss.elastic.co/t/how-to-concatenate-two-fields-in-logstash/285455)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 12:13pm UTC](https://discuss.elastic.co/t/how-to-concatenate-two-fields-in-logstash/285455 "2021-09-29T12:13:35Z")
I have json format data. I want to concatenate firstName and LastName. I have tried by using mutate filter filter{ mutate { add\_field =\> { "Full Name" =\> "%{FirstName}%{LastName}" } … --- ## [Searching user favorited documents](https://discuss.elastic.co/t/searching-user-favorited-documents/284880)
**Author:** [@vortextangent](https://discuss.elastic.co/u/vortextangent)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 11:59am UTC](https://discuss.elastic.co/t/searching-user-favorited-documents/284880 "2021-09-29T11:59:13Z")
Hello, I’m looking into app searches ability to search user favorites. It looks like the only supported way would be to pass the document ids in as a filter with the query (limit 1024 ids). I know I can do multiple quer… --- ## [Want to exclude lines in file having "etluser" keyword](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850)
**Author:** [@Amit\_Johari](https://discuss.elastic.co/u/Amit_Johari)\ **Replies:** 9\ **Last updated:** [September 29, 2021, 11:55am UTC](https://discuss.elastic.co/t/want-to-exclude-lines-in-file-having-etluser-keyword/284850 "2021-09-29T11:55:49Z")
hello team, we want to exclude lines in file having "etluser" keyword. we added this in yml file . Is this correct way to achieve the goal or any other way ? exclude\_lines: \['etluser'\] we have multiple filepath added … --- ## [Can you record parameters from a function call during tracing?](https://discuss.elastic.co/t/can-you-record-parameters-from-a-function-call-during-tracing/285438)
**Author:** [@c64zottel](https://discuss.elastic.co/u/c64zottel)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 11:42am UTC](https://discuss.elastic.co/t/can-you-record-parameters-from-a-function-call-during-tracing/285438 "2021-09-29T11:42:32Z")
We can define functions to be measured during there call with: trace\_methods. If I have a function: String doStuff(int bankID); Is it possible to record bankID in tracing information? AppDynamics offers Information Po… --- ## [Is Fleet server able to run synthetic monitoring?](https://discuss.elastic.co/t/is-fleet-server-able-to-run-synthetic-monitoring/285268)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 11:40am UTC](https://discuss.elastic.co/t/is-fleet-server-able-to-run-synthetic-monitoring/285268 "2021-09-29T11:40:39Z")
Hey there, I am trying to use the Fleet server to test the synthetic monitoring feature. Using a Docker-compose I am running a single instance for Elasticsearch Kibana Fleet server I would like to know what is the m… --- ## [How many people visit my dashboard?](https://discuss.elastic.co/t/how-many-people-visit-my-dashboard/285466)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 11:33am UTC](https://discuss.elastic.co/t/how-many-people-visit-my-dashboard/285466 "2021-09-29T11:33:02Z")
Hello! i want to create a visualization with the number of visit to my dashboard. how can i know how many people visit my dashboard? thanks in advanced! --- ## [Drop event by field type](https://discuss.elastic.co/t/drop-event-by-field-type/285327)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 11:26am UTC](https://discuss.elastic.co/t/drop-event-by-field-type/285327 "2021-09-29T11:26:18Z")
How to drop the indexing event if the field is not integer ? in the below example i had used 123 it works . if i use abc that event should drop. POST \_ingest/pipeline/\_simulate { "docs": \[ { "\_source": { … --- ## [Single node consuming more disk space](https://discuss.elastic.co/t/single-node-consuming-more-disk-space/285250)
**Author:** [@purushothamkdr143](https://discuss.elastic.co/u/purushothamkdr143)\ **Replies:** 6\ **Last updated:** [September 29, 2021, 11:24am UTC](https://discuss.elastic.co/t/single-node-consuming-more-disk-space/285250 "2021-09-29T11:24:59Z")
Hi All, I have setup Elasticsearch cluster using eck operator. details as follows. master nodes: 3 data nodes: 9 only single data node is consuming more disk space although it has less number of shards than the other… --- ## [Logstash Pipeline events emits and received](https://discuss.elastic.co/t/logstash-pipeline-events-emits-and-received/285465)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 11:20am UTC](https://discuss.elastic.co/t/logstash-pipeline-events-emits-and-received/285465 "2021-09-29T11:20:43Z")
Hi, I am setting up a logstash pipeline to get data from sql db. I executed it and monitored it after pipeline completion on kibana server. I saw Events Received and Events Emitted. Both values are different. I did… --- ## [Logstash dropping a lot of logs](https://discuss.elastic.co/t/logstash-dropping-a-lot-of-logs/285429)
**Author:** [@Parthib\_Dutta](https://discuss.elastic.co/u/Parthib_Dutta)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 11:12am UTC](https://discuss.elastic.co/t/logstash-dropping-a-lot-of-logs/285429 "2021-09-29T11:12:44Z")
I have this current setup where Filebeat is reading Lumen logs and forwarding them to Logstash . And Logstash is parsing one of those field in log lines as JSON . I am only seeing partial outputs in my Kibana dashboard a… --- ## [Metricbeat duplicated data in elastic cloud](https://discuss.elastic.co/t/metricbeat-duplicated-data-in-elastic-cloud/283895)
**Author:** [@Misagh](https://discuss.elastic.co/u/Misagh)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 10:54am UTC](https://discuss.elastic.co/t/metricbeat-duplicated-data-in-elastic-cloud/283895 "2021-09-29T10:54:32Z")
Hi there, I am using metricbeat to collect metrics from AWS cloudwatch and insert them into the elastic cloud environment. it works fine but there is an issue that I couldn't solve. there are duplicated data for one nam… --- ## [Inconsistency in parsing timestamps for search\_after](https://discuss.elastic.co/t/inconsistency-in-parsing-timestamps-for-search-after/285463)
**Author:** [@muchawiec](https://discuss.elastic.co/u/muchawiec)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:33am UTC](https://discuss.elastic.co/t/inconsistency-in-parsing-timestamps-for-search-after/285463 "2021-09-29T10:33:00Z")
Hello, I've been fighting with pagination using search\_after for dates that might be undefined. When I sort in ascending order and the date is undefined I receive in sort property value 9223372036854775807, which I can… --- ## [Set Kibana bar chart bucket order according a metric field](https://discuss.elastic.co/t/set-kibana-bar-chart-bucket-order-according-a-metric-field/285440)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 10:17am UTC](https://discuss.elastic.co/t/set-kibana-bar-chart-bucket-order-according-a-metric-field/285440 "2021-09-29T10:17:47Z")
Hi, I created Bucket bar chart with multiple metric fields. Now I want to sort order descending to a metric field. But I only want to filter this bucket basis of one field. Here is an image I want to descending or… --- ## [Limit the number of pages on kibana datatable visualization](https://discuss.elastic.co/t/limit-the-number-of-pages-on-kibana-datatable-visualization/285031)
**Author:** [@Srikanth\_V](https://discuss.elastic.co/u/Srikanth_V)\ **Replies:** 7\ **Last updated:** [September 29, 2021, 10:11am UTC](https://discuss.elastic.co/t/limit-the-number-of-pages-on-kibana-datatable-visualization/285031 "2021-09-29T10:11:49Z")
Hello people, I'm currently using the kibana dashboard and showing them in my application using iframe. Currently the data table has 100 pages with 10 rows being displayed on each page. Is there is a way to limit the nu… --- ## [Filebeat does not send container logs to elastic cloud](https://discuss.elastic.co/t/filebeat-does-not-send-container-logs-to-elastic-cloud/285461)
**Author:** [@Sharadha\_Krishna](https://discuss.elastic.co/u/Sharadha_Krishna)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 10:10am UTC](https://discuss.elastic.co/t/filebeat-does-not-send-container-logs-to-elastic-cloud/285461 "2021-09-29T10:10:45Z")
Hi, I have set up log collection from docker containers running on EC2 machines to elastic cloud using file beat. But I don't find the logs on kibana. Note: I have setup my own indexes and ILM and templates. I also fin… --- ## [Discover is not showing any data when used date field other than @timestamps](https://discuss.elastic.co/t/discover-is-not-showing-any-data-when-used-date-field-other-than-timestamps/285270)
**Author:** [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:46am UTC](https://discuss.elastic.co/t/discover-is-not-showing-any-data-when-used-date-field-other-than-timestamps/285270 "2021-09-29T09:46:57Z")
Hi, I am loading offline logs into ELK and I am using my logDate field instead of the @timestamp field while creating the index pattern in Kibana. My field appears in the list of fields with the @timestamp but when i u… --- ## [Where Condition in \_SQL](https://discuss.elastic.co/t/where-condition-in-sql/285427)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 9:10am UTC](https://discuss.elastic.co/t/where-condition-in-sql/285427 "2021-09-29T09:10:40Z")
Hello Team I am using Elasticsearch version 7.8.0 I am in need of \_SQL ... curl -X POST "localhost:9200/\_sql?format=txt&pretty" -H 'Content-Type: application/json' -d' { "query": "SELECT count(\*) FROM \\"my-index-000… --- ## [Authentication of \[kibana\_system\] was terminated by realm \[reserved\] - failed to authenticate user \[kibana\_system\]](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/285399)
**Author:** [@dominique.bejean](https://discuss.elastic.co/u/dominique.bejean)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 9:03am UTC](https://discuss.elastic.co/t/authentication-of-kibana-system-was-terminated-by-realm-reserved-failed-to-authenticate-user-kibana-system/285399 "2021-09-29T09:03:16Z")
Hi, I am testing elsatistack 7.14.1 security in a docker-compose stack by following this documentation From the Kibana server, the following resquest works perfectly # curl --user kibana\_system:xxxxxxxxxxxxxxxxxxxxx … --- ## [Can I create a query with multiple filter?](https://discuss.elastic.co/t/can-i-create-a-query-with-multiple-filter/285452)
**Author:** [@psyapathy](https://discuss.elastic.co/u/psyapathy)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 9:02am UTC](https://discuss.elastic.co/t/can-i-create-a-query-with-multiple-filter/285452 "2021-09-29T09:02:44Z")
Hi all! Can I create a query with multiple filter? In my documents i have 2 fields: switch-host and port I want get result with multiple filter. Like: switch-host = host1 and ports = port1,port2,port3 switch-host = … --- ## [About Elastic Cluster status erro](https://discuss.elastic.co/t/about-elastic-cluster-status-erro/285450)
**Author:** [@zekaifeng](https://discuss.elastic.co/u/zekaifeng)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 8:50am UTC](https://discuss.elastic.co/t/about-elastic-cluster-status-erro/285450 "2021-09-29T08:50:39Z")
Elasticsearch version is 7.3.1. Due to the frequent data cleaning of the index in the early morning, memory fusions occur frequently in multiple nodes. At this time, another index is performing a bulk operation, and the… --- ## [TSVB hide empty time intervals](https://discuss.elastic.co/t/tsvb-hide-empty-time-intervals/284721)
**Author:** [@Janujc](https://discuss.elastic.co/u/Janujc)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/tsvb-hide-empty-time-intervals/284721 "2021-09-29T08:40:55Z")
Hello, I'm wondering if it is possible to hide days (time interval units) when no event was happened in TSVB. I am interested in showing daily events, but when this extends to a longer time period it is very easy to get … --- ## [Does Azure metricbeat module use Consumption API version 2019-10-01](https://discuss.elastic.co/t/does-azure-metricbeat-module-use-consumption-api-version-2019-10-01/285371)
**Author:** [@adhiraj-g](https://discuss.elastic.co/u/adhiraj-g)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 8:40am UTC](https://discuss.elastic.co/t/does-azure-metricbeat-module-use-consumption-api-version-2019-10-01/285371 "2021-09-29T08:40:44Z")
Hi @MarianaD / @Kaiyan\_Sheng You had mentioned regarding raising an issue for Azure SDK with 2019-10-01 consumption API version. This was the link shared: Provide 2019-10-01 version of consumption APIs · Issue #12452 ·… --- ## [Child transaction starts before parent transaction](https://discuss.elastic.co/t/child-transaction-starts-before-parent-transaction/285380)
**Author:** [@Slavik\_Muzychyshyn](https://discuss.elastic.co/u/Slavik_Muzychyshyn)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 8:11am UTC](https://discuss.elastic.co/t/child-transaction-starts-before-parent-transaction/285380 "2021-09-29T08:11:08Z")
We need to measure the latency of the request The request passes through 2 microservices The business task is to measure the time of processing on each microservice and also measure the time of network between microse… --- ## [JVM automatic heap sizing set too low (version 7.14.1)](https://discuss.elastic.co/t/jvm-automatic-heap-sizing-set-too-low-version-7-14-1/285447)
**Author:** [@simone-smith](https://discuss.elastic.co/u/simone-smith)\ **Replies:** 0\ **Last updated:** [September 29, 2021, 8:07am UTC](https://discuss.elastic.co/t/jvm-automatic-heap-sizing-set-too-low-version-7-14-1/285447 "2021-09-29T08:07:37Z")
I'm running a cluster on version 7.14.1 with the bundled JDK: ubuntu@JaneMisme:/$ /usr/share/elasticsearch/jdk/bin/java -version openjdk version "16.0.2" 2021-07-20 OpenJDK Runtime Environment Temurin-16.0.2+7 (build 16… --- ## [Convert single node to Clustered Nodes](https://discuss.elastic.co/t/convert-single-node-to-clustered-nodes/285432)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 5\ **Last updated:** [September 29, 2021, 7:48am UTC](https://discuss.elastic.co/t/convert-single-node-to-clustered-nodes/285432 "2021-09-29T07:48:23Z")
I have a single node Elasticsearch instance. It had default Elasticsearch yml configuration as below. It has one index with some data. # ======================== Elasticsearch Configuration ========================= # #… --- ## [Queue is full](https://discuss.elastic.co/t/queue-is-full/284471)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 4\ **Last updated:** [September 29, 2021, 6:54am UTC](https://discuss.elastic.co/t/queue-is-full/284471 "2021-09-29T06:54:52Z")
Elastic Cloud: 7.14 I have a lot of services that connects to APM and now I have only this message of error: {"accepted":0,"errors":\[{"message":"queue is full"}\]} First of all I want review the messages that we send, … --- ## [ELK security 401](https://discuss.elastic.co/t/elk-security-401/285424)
**Author:** [@gmhafiz](https://discuss.elastic.co/u/gmhafiz)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 6:04am UTC](https://discuss.elastic.co/t/elk-security-401/285424 "2021-09-29T06:04:36Z")
I wanted to try out Alerting in Kibana so security needs to be enabled. However, both logstash and kibana isn't able to log into Elasticsearch ELK version: 7.10.1 docker-compose.log.yml version: '3.4' services: el… --- ## [Kibana rules de-duplication behavior](https://discuss.elastic.co/t/kibana-rules-de-duplication-behavior/285168)
**Author:** [@Tkachleo](https://discuss.elastic.co/u/Tkachleo)\ **Replies:** 2\ **Last updated:** [September 29, 2021, 4:53am UTC](https://discuss.elastic.co/t/kibana-rules-de-duplication-behavior/285168 "2021-09-29T04:53:44Z")
Hi, I'm experiencing an issue with the behavior of Kibana Rules. I have Metricbeat writing different metrics to Elasticsearch every 10 seconds. I want to create rules using Elasticsearch Query over the values that are… --- ## [Installing elasticsearch 7.12 , facing java.security.cert.CertificateException error while setting password/installation](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062)
**Author:** [@Neha\_goswami](https://discuss.elastic.co/u/Neha_goswami)\ **Replies:** 1\ **Last updated:** [September 29, 2021, 1:24am UTC](https://discuss.elastic.co/t/installing-elasticsearch-7-12-facing-java-security-cert-certificateexception-error-while-setting-password-installation/285062 "2021-09-29T01:24:00Z")
I am setting Elasticsearch 7.12 cluster for the first time and i see below errors: There seems to be some xpack setup issue: \`$ bin/Elasticsearch-setup-passwords interactive warning: usage of JAVA\_HOME is deprecated, … --- ## [Trouble dissecting characters from a word in a string](https://discuss.elastic.co/t/trouble-dissecting-characters-from-a-word-in-a-string/284924)
**Author:** [@elasticperson](https://discuss.elastic.co/u/elasticperson)\ **Replies:** 3\ **Last updated:** [September 29, 2021, 1:06am UTC](https://discuss.elastic.co/t/trouble-dissecting-characters-from-a-word-in-a-string/284924 "2021-09-29T01:06:45Z")
Example strings: thing: xabc123def.testing thing: xghi456jkl.testing Given: String will always begin with x there will be 3 alpha characters there will be 3 numeric characters it may or may not have additional chara… [Previous page](https://discuss.elastic.co/latest.md?page=1455) [Next page](https://discuss.elastic.co/latest.md?page=1457)