# Latest **URL:** https://discuss.elastic.co/latest.md?page=1521 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1522 --- ## [Export Download CSV data from Kibana Visualization to API](https://discuss.elastic.co/t/export-download-csv-data-from-kibana-visualization-to-api/281599)
**Author:** [@chaman17](https://discuss.elastic.co/u/chaman17)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 11:31pm UTC](https://discuss.elastic.co/t/export-download-csv-data-from-kibana-visualization-to-api/281599 "2021-08-17T23:31:28Z")
Hi Team Is there a way to fetch CSV data from kibana visualization using FAST API? I have created a kibana visualization using filters and am able to get the downloaded CSV data from kibana dashboard UI. Now, my requir… --- ## [Percolate query performance optimization](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750)
**Author:** [@jesse\_c](https://discuss.elastic.co/u/jesse_c)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:41pm UTC](https://discuss.elastic.co/t/percolate-query-performance-optimization/281750 "2021-08-17T21:41:58Z")
We're on Elasticsearch 7.9. We have a percolate index that hosts about 120 queries. The index has 5 shards, each of which has two replicas. We started to encounter performance issues after adding around 10 queries that … --- ## [Single master node cluster dies when master node dies](https://discuss.elastic.co/t/single-master-node-cluster-dies-when-master-node-dies/281559)
**Author:** [@iojas](https://discuss.elastic.co/u/iojas)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 11:05pm UTC](https://discuss.elastic.co/t/single-master-node-cluster-dies-when-master-node-dies/281559 "2021-08-17T23:05:41Z")
I am using ECK to deploy an ES cluster. my setup has 1 master node and 3 data nodes. If for some reason master nodes dies it comes back up (thanks to statefulsets in kubernetes), but associates itself with a different cl… --- ## [Logstash always outputting only 9 documents](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 10:19pm UTC](https://discuss.elastic.co/t/logstash-always-outputting-only-9-documents/281751 "2021-08-17T22:19:24Z")
I have a json file with 4K json objects in it. Each object is on its own line. I'm using the file plugin with the multiline codec to have Logstash parse all the objects. I'm also flattening the json objects and then send… --- ## [What happens to unampped fields? What are the performance disadvantage of not mapping a field?](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746)
**Author:** [@Vaibhav\_Singal](https://discuss.elastic.co/u/Vaibhav_Singal)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:59pm UTC](https://discuss.elastic.co/t/what-happens-to-unampped-fields-what-are-the-performance-disadvantage-of-not-mapping-a-field/281746 "2021-08-17T21:59:37Z")
I have an index with dynamic mapping set to false. PUT index\_a { "mappings": { "\_doc": { "dynamic": false, "properties": { "\_doc": { "properties": { "id": { … --- ## [Restore multiple snapshot](https://discuss.elastic.co/t/restore-multiple-snapshot/281686)
**Author:** [@Abhinav\_Shrivastava](https://discuss.elastic.co/u/Abhinav_Shrivastava)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:56pm UTC](https://discuss.elastic.co/t/restore-multiple-snapshot/281686 "2021-08-17T21:56:00Z")
Hi all, We are taking daily snapshots for elasticsearch. I want to restore the snapshot for last 10 days. I don't want to run API for each snapshot. can someone help me to restore last 10 days snapshot in one go ? --- ## [Add nodes or add CPU](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744)
**Author:** [@terrainc](https://discuss.elastic.co/u/terrainc)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 9:08pm UTC](https://discuss.elastic.co/t/add-nodes-or-add-cpu/281744 "2021-08-17T21:08:46Z")
Hi! I have 3 nodes cluster (build on virtual machines 24 cores 72Gb mem each). 120k/s messages. Cpu usage about 75-80% so, probably, I need to add more CPU. Also I want to add more disk space (x2 more). So I have two w… --- ## [Filebeat with syslog input loses millisecond precision](https://discuss.elastic.co/t/filebeat-with-syslog-input-loses-millisecond-precision/281748)
**Author:** [@chaserb](https://discuss.elastic.co/u/chaserb)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-with-syslog-input-loses-millisecond-precision/281748 "2021-08-17T20:26:55Z")
Hello, I have filebeat 7.12.0 on Debian 10 with two log inputs and one syslog input all going to the same index in an elasticsearch output. For the log inputs, I'm seeing @timestamp values in the index with millisecond … --- ## [Can I get BM25 score as part of script field?](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747)
**Author:** [@12minutes](https://discuss.elastic.co/u/12minutes)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 7:59pm UTC](https://discuss.elastic.co/t/can-i-get-bm25-score-as-part-of-script-field/281747 "2021-08-17T19:59:30Z")
The default score will be calculated in a different way. Just wondering is there any easy way to get default bm25 score as part of script function/script field? --- ## [Not able to edit alert in kibana 7.14 "Transaction error rate threshold"](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501)
**Author:** [@prashant.j.singh](https://discuss.elastic.co/u/prashant.j.singh)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 7:53pm UTC](https://discuss.elastic.co/t/not-able-to-edit-alert-in-kibana-7-14-transaction-error-rate-threshold/281501 "2021-08-17T19:53:54Z")
I have upgrade kibana 7.13 to 7.14 but I am not able to edit or change threshold value and time for kibana alert " Transaction error rate threshold" kibana version : 7.14 please find attachment for screen shot. --- ## [Change indices.memory.index\_buffer\_size on a working elasticsearch cluster](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 6:43pm UTC](https://discuss.elastic.co/t/change-indices-memory-index-buffer-size-on-a-working-elasticsearch-cluster/281737 "2021-08-17T18:43:42Z")
Hi, Is there any way to change indices.memory.index\_buffer\_size on a working elasticsearch cluster? Is that possible through an API? Thank you in advance. --- ## [Fleet-server and filebeats in one elastic-agent](https://discuss.elastic.co/t/fleet-server-and-filebeats-in-one-elastic-agent/281355)
**Author:** [@tkarczewski](https://discuss.elastic.co/u/tkarczewski)\ **Replies:** 11\ **Last updated:** [August 17, 2021, 6:42pm UTC](https://discuss.elastic.co/t/fleet-server-and-filebeats-in-one-elastic-agent/281355 "2021-08-17T18:42:39Z")
Hi, How to use one elastic-agent on host where elastic stack is deployed to be as fleet server and filebeat collecting udp syslog messages? I red that elastic agent can be use for fleet server and data collection simult… --- ## [Filebeat input types log and filestream metadata for file path/name differ](https://discuss.elastic.co/t/filebeat-input-types-log-and-filestream-metadata-for-file-path-name-differ/281713)
**Author:** [@Michael\_Savettiere](https://discuss.elastic.co/u/Michael_Savettiere)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-input-types-log-and-filestream-metadata-for-file-path-name-differ/281713 "2021-08-17T15:21:41Z")
I have been using beats input type log, but with the 7.14.0 release I noticed that the filestream input type is supposed to be an improvement to the log input type. I noticed that the event meta data differs between the … --- ## [Is the feature route change time live now?](https://discuss.elastic.co/t/is-the-feature-route-change-time-live-now/281697)
**Author:** [@piyush.sarin](https://discuss.elastic.co/u/piyush.sarin)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 5:58pm UTC](https://discuss.elastic.co/t/is-the-feature-route-change-time-live-now/281697 "2021-08-17T17:58:26Z")
The feature mentioned at the end of the URL Performing Real User Monitoring (RUM) with Elastic APM | Elastic Blog is live now? "Hopefully this blog made it clear that instrumenting your applications with Elastic RUM is … --- ## [Esrally failing with \[ERROR\] Cannot race. Error in race control (NotFoundError(404, 'Not Found', 'Not Found'))](https://discuss.elastic.co/t/esrally-failing-with-error-cannot-race-error-in-race-control-notfounderror-404-not-found-not-found/281731)
**Author:** [@sadhana.durge](https://discuss.elastic.co/u/sadhana.durge)\ **Replies:** 3\ **Last updated:** [August 17, 2021, 5:54pm UTC](https://discuss.elastic.co/t/esrally-failing-with-error-cannot-race-error-in-race-control-notfounderror-404-not-found-not-found/281731 "2021-08-17T17:54:35Z")
Trying to run esrally race --track=pmc --target-hosts=\*\*\*\*\*\*\*.kb.us-west1.gcp.cloud.es.io:9243 --p ipeline=benchmark-only --client-options="timeout:60,use\_ssl:true,verify\_certs:true,basic\_auth\_user:'elastic',basic \_aut… --- ## [Flask error handling removes error transactions from APM](https://discuss.elastic.co/t/flask-error-handling-removes-error-transactions-from-apm/281725)
**Author:** [@davidshaw2018](https://discuss.elastic.co/u/davidshaw2018)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 5:44pm UTC](https://discuss.elastic.co/t/flask-error-handling-removes-error-transactions-from-apm/281725 "2021-08-17T17:44:13Z")
Kibana version: 7.11.1 Elasticsearch version: 7.11.1 APM Server version: 7.11.0 APM Agent language and version: Python 6.3.3 Description of the problem including expected versus actual behavior. Please include screen… --- ## [Run in Docker with TLS enabled - does not successfully launch, fix found](https://discuss.elastic.co/t/run-in-docker-with-tls-enabled-does-not-successfully-launch-fix-found/281728)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 4:55pm UTC](https://discuss.elastic.co/t/run-in-docker-with-tls-enabled-does-not-successfully-launch-fix-found/281728 "2021-08-17T16:55:49Z")
Hope this helps someone, or me when I forget! I was running this on Docker Desktop, on Win 11 Part II, Run in Docker with TLS enabled Step 3 worked normally Step 4 \`docker-compose -f elastic-docker-tls.yml up -d C… --- ## [Get task ids after executing search query](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719)
**Author:** [@NLSVTN](https://discuss.elastic.co/u/NLSVTN)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:46pm UTC](https://discuss.elastic.co/t/get-task-ids-after-executing-search-query/281719 "2021-08-17T16:46:37Z")
I need to give a user an ability to terminate a query initiated by Elasticsearch-DSL or Elasticsearch-py. I know how to get a list of tasks running on the server but I can't just terminate all of them since there is a ch… --- ## [Logstash forwarding MSFT Server logs into Azure](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708)
**Author:** [@JBHuber](https://discuss.elastic.co/u/JBHuber)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:45pm UTC](https://discuss.elastic.co/t/logstash-forwarding-msft-server-logs-into-azure/281708 "2021-08-17T16:45:54Z")
Hoping someone here has tried to do this same thing. We are using Logstash as a forwarder of linux & windows logs into MSFT Azure Sentinel. We do segregate (or TAG) the logs as "windows" and "linux". Linux is fine and … --- ## [Changing / Modifying / Customizing Visualize Library](https://discuss.elastic.co/t/changing-modifying-customizing-visualize-library/281115)
**Author:** [@bailarch](https://discuss.elastic.co/u/bailarch)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 4:02pm UTC](https://discuss.elastic.co/t/changing-modifying-customizing-visualize-library/281115 "2021-08-17T16:02:17Z")
Hello everyone, I would like to create a set of dataset from Visualize Library since some of the templates that I see can be more powerful than Lens / Dashboard since you can set infinite about of data/values to show - … --- ## [Enable memory tracking in php apm](https://discuss.elastic.co/t/enable-memory-tracking-in-php-apm/281715)
**Author:** [@Thomas\_Thorburn](https://discuss.elastic.co/u/Thomas_Thorburn)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 3:32pm UTC](https://discuss.elastic.co/t/enable-memory-tracking-in-php-apm/281715 "2021-08-17T15:32:52Z")
Hi all, I am trying to track down an elusive memory leak caused by php apm that I am having some trouble reproducing anywhere else besides our companies dev environment. I saw in the code that there is capabilities for … --- ## [Elasticsearch pods are not ready when xpack.security.enabled is configured](https://discuss.elastic.co/t/elasticsearch-pods-are-not-ready-when-xpack-security-enabled-is-configured/281709)
**Author:** [@etrpchevska](https://discuss.elastic.co/u/etrpchevska)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/elasticsearch-pods-are-not-ready-when-xpack-security-enabled-is-configured/281709 "2021-08-17T14:58:56Z")
Hello, I am trying to enable minimal and then basic security on our Elasticsearch cluster following these guidelines: This is the Elasticsearch config file: elasticsearch.yml: | cluster.name: dev-observability … --- ## [AppSearch: Error during document insert. "There was a decoding error. Please ensure your request is valid."](https://discuss.elastic.co/t/appsearch-error-during-document-insert-there-was-a-decoding-error-please-ensure-your-request-is-valid/279783)
**Author:** [@mbrimmer83](https://discuss.elastic.co/u/mbrimmer83)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:58pm UTC](https://discuss.elastic.co/t/appsearch-error-during-document-insert-there-was-a-decoding-error-please-ensure-your-request-is-valid/279783 "2021-08-17T14:58:37Z")
Error Message: "There was a decoding error. Please ensure your request is valid." I am receiving an error while inserting document. I am within the limit and this is occurring randomly during a large insert process wher… --- ## [XML filter - processing of an array of values](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601)
**Author:** [@Robo](https://discuss.elastic.co/u/Robo)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:55pm UTC](https://discuss.elastic.co/t/xml-filter-processing-of-an-array-of-values/281601 "2021-08-17T14:55:23Z")
We're processing some xml events using the xml filter. The filter setup it's quite simple: filter { xml { source =\> "message" target =\> "xml" } } This filter generates two fields with an array of v… --- ## ["This event cannot be analyzed since it has incompatible field mappings" On my own log](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319)
**Author:** [@nberens](https://discuss.elastic.co/u/nberens)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:43pm UTC](https://discuss.elastic.co/t/this-event-cannot-be-analyzed-since-it-has-incompatible-field-mappings-on-my-own-log/280319 "2021-08-17T14:43:56Z")
Hello, i am currently integrating our watchguard vpn logs into our Elasticsearch siem. I basically build a logstash rule that takes its Syslog output and mapps it onto ECS. While everthing now works as expected, i no… --- ## [Filter out the same event and send to different outputs](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:40pm UTC](https://discuss.elastic.co/t/filter-out-the-same-event-and-send-to-different-outputs/281611 "2021-08-17T14:40:24Z")
What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output. That is the general questi… --- ## [Compare float value generated from Glok Pattern](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 4\ **Last updated:** [August 17, 2021, 2:38pm UTC](https://discuss.elastic.co/t/compare-float-value-generated-from-glok-pattern/281616 "2021-08-17T14:38:26Z")
Dear All, I am trying to compare 2 float fields, which are created from Grok patterns match. But this is crashing the pipeline. Not able to figure out what is missing here! Kindly help. if \[message\] =~ "Customer Type … --- ## [Pipelines.yml failed to read with Pipeline to Pipeline model](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 2\ **Last updated:** [August 17, 2021, 2:32pm UTC](https://discuss.elastic.co/t/pipelines-yml-failed-to-read-with-pipeline-to-pipeline-model/281659 "2021-08-17T14:32:44Z")
I had previously multiple pipelines and i added Pipeline to Pipeline model in my pipelines.yml But since then i get this error: ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.… --- ## [Unable to remove "timestamp" field (not "@timestamp"!)](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654)
**Author:** [@jze1](https://discuss.elastic.co/u/jze1)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:25pm UTC](https://discuss.elastic.co/t/unable-to-remove-timestamp-field-not-timestamp/281654 "2021-08-17T14:25:18Z")
I am seeing the error below in logstash log. So I'm trying to parse the string further but after that mutate { remove\_field =\> \[ "timestamp" \] } does NOTHING. WTF? "error"=\>{"type"=\>"mapper\_parsing\_exception", "reason"… --- ## [Double Scripted Field gets fetched as string when filtering in a Dashboard](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357)
**Author:** [@DavidBrosIvent](https://discuss.elastic.co/u/DavidBrosIvent)\ **Replies:** 1\ **Last updated:** [August 17, 2021, 2:24pm UTC](https://discuss.elastic.co/t/double-scripted-field-gets-fetched-as-string-when-filtering-in-a-dashboard/281357 "2021-08-17T14:24:13Z")
Hey guys, I have a scripted field which returns a percentage value based on 2 keys in my documents. The scripted field is set to return 0 when the keys return a NaN value due to one of them being missing. The script an… [Previous page](https://discuss.elastic.co/latest.md?page=1520) [Next page](https://discuss.elastic.co/latest.md?page=1522)