# Latest **URL:** https://discuss.elastic.co/latest.md?page=1558 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1559 --- ## [Conditional Coloring on Pie Chart on Canvas](https://discuss.elastic.co/t/conditional-coloring-on-pie-chart-on-canvas/279358)
**Author:** [@Mayank\_Malhotra](https://discuss.elastic.co/u/Mayank_Malhotra)\ **Replies:** 3\ **Last updated:** [July 24, 2021, 3:29pm UTC](https://discuss.elastic.co/t/conditional-coloring-on-pie-chart-on-canvas/279358 "2021-07-24T15:29:19Z")
Hi, I have created a Pie Chart on canvas which consists a field severity which as two values one is ERROR and the other is WARNING. I want to show the part of WARNING in pie-chart as orange and ERROR as red. I Used belo… --- ## [Kibana "server is not ready yet" after enabling Basic Security on Elasticsearch cluster](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-enabling-basic-security-on-elasticsearch-cluster/279415)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 3\ **Last updated:** [July 24, 2021, 3:28pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-enabling-basic-security-on-elasticsearch-cluster/279415 "2021-07-24T15:28:59Z")
I enabled basic security doing step by step everything in the documentation. After i put that code xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security… --- ## [What's the difference between Id's query and Term Query when finding documents by “\_id”?](https://discuss.elastic.co/t/whats-the-difference-between-ids-query-and-term-query-when-finding-documents-by-id/279523)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 2\ **Last updated:** [July 24, 2021, 7:11am UTC](https://discuss.elastic.co/t/whats-the-difference-between-ids-query-and-term-query-when-finding-documents-by-id/279523 "2021-07-24T07:11:39Z")
I want to get document by "\_id", I have 3 choices: GET document by "\_id" GET order/\_doc/001 Use Id's Query, GET order/\_search { "query": { "ids" : { "values" : \["001"\] } } } Though Id's query takes array of Id's but I … --- ## [How to remove %3A and such hash in text while parsing?](https://discuss.elastic.co/t/how-to-remove-3a-and-such-hash-in-text-while-parsing/279421)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 5\ **Last updated:** [July 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/how-to-remove-3a-and-such-hash-in-text-while-parsing/279421 "2021-07-24T05:54:44Z")
Hello, I have a field in my logs: "name+Of+the%3A%C2%AE+field" which sometimes can be like this: "%D9+%81+%D8+%B1+%D8+%A7+%D8" How can I remove extra expressions in logstash filters? The desired output for the first … --- ## [Logstash ConcurrentModificationException: null](https://discuss.elastic.co/t/logstash-concurrentmodificationexception-null/278759)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 10\ **Last updated:** [July 24, 2021, 5:53am UTC](https://discuss.elastic.co/t/logstash-concurrentmodificationexception-null/278759 "2021-07-24T05:53:22Z")
Hi, has anyone encountered this issue? Logstash instances keep restarting after a while with this error: \[2021-07-14T14:35:23,972\]\[FATAL\]\[logstash.runner \] An unexpected error occurred! {:error=\>java.lang.Illeg… --- ## [Show custom geoip fields](https://discuss.elastic.co/t/show-custom-geoip-fields/279266)
**Author:** [@Velon](https://discuss.elastic.co/u/Velon)\ **Replies:** 4\ **Last updated:** [July 24, 2021, 2:19am UTC](https://discuss.elastic.co/t/show-custom-geoip-fields/279266 "2021-07-24T02:19:48Z")
I have add custom fields AcmeCorp.DeptName and AcmeCorp.DeptName whith maxmind\_mmdb, but I can't find it in the last result with logstash geoip plugins, so I'm asking some help ~ Thanks you~ --- ## [How to parse nginx error\_log in Kibana from file?](https://discuss.elastic.co/t/how-to-parse-nginx-error-log-in-kibana-from-file/279460)
**Author:** [@station72](https://discuss.elastic.co/u/station72)\ **Replies:** 1\ **Last updated:** [July 24, 2021, 12:53am UTC](https://discuss.elastic.co/t/how-to-parse-nginx-error-log-in-kibana-from-file/279460 "2021-07-24T00:53:39Z")
Hello! I have an error log file from nginx. I am trying to upload and parse my file with Data Visualizer in Kibana v 7.10.1 Example of my error log 2021/07/21 04:44:36 \[error\] 7#7: \*24864573 foo could not be resolved… --- ## [Position(or numeric ranking) of a item in an aggreagation](https://discuss.elastic.co/t/position-or-numeric-ranking-of-a-item-in-an-aggreagation/279479)
**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\ **Replies:** 1\ **Last updated:** [July 24, 2021, 12:24am UTC](https://discuss.elastic.co/t/position-or-numeric-ranking-of-a-item-in-an-aggreagation/279479 "2021-07-24T00:24:29Z")
Hi! I have this problem. Suppose I have an index to store products sales. And I want to define a visualization (potentially a table) with the following information: Product Name, ranking in number of units sold, rank… --- ## [Reflect changes made on one dashboard on one space to be reflected on the dashboard on another space](https://discuss.elastic.co/t/reflect-changes-made-on-one-dashboard-on-one-space-to-be-reflected-on-the-dashboard-on-another-space/279469)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 1\ **Last updated:** [July 24, 2021, 12:14am UTC](https://discuss.elastic.co/t/reflect-changes-made-on-one-dashboard-on-one-space-to-be-reflected-on-the-dashboard-on-another-space/279469 "2021-07-24T00:14:27Z")
Hello, I have two spaces on kibana, one for admin user and one for the rest of the users (with limited privileges) . I had a couple of dashboards on the admin space that were exported to the user space , and was wonderi… --- ## [Perfomance optimization for nested aggregations](https://discuss.elastic.co/t/perfomance-optimization-for-nested-aggregations/279518)
**Author:** [@treasures78](https://discuss.elastic.co/u/treasures78)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 11:45pm UTC](https://discuss.elastic.co/t/perfomance-optimization-for-nested-aggregations/279518 "2021-07-23T23:45:41Z")
Hi, please help me figure out, is there any way to optimize this request? At the moment, the request is being executed for about 30-40 seconds. The index stores information about the call history. The query builds a re… --- ## [Observability Engineer Lab 3.3 - Empty Columns](https://discuss.elastic.co/t/observability-engineer-lab-3-3-empty-columns/279130)
**Author:** [@TonyY](https://discuss.elastic.co/u/TonyY)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 11:51pm UTC](https://discuss.elastic.co/t/observability-engineer-lab-3-3-empty-columns/279130 "2021-07-23T23:51:51Z")
Hi, I'm working on the Oberservability Engineer lab. In Task 3.3 the lab document shows a column "event.dataset" which is filled with "mysql.error". In my environment this column is empty. In the next step I'm asked to… --- ## [Can't generate .csv report](https://discuss.elastic.co/t/cant-generate-csv-report/279465)
**Author:** [@bnk](https://discuss.elastic.co/u/bnk)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:45pm UTC](https://discuss.elastic.co/t/cant-generate-csv-report/279465 "2021-07-23T23:45:24Z")
Hi, I'm unable to generate .csv report. I ran Reporting diagnosis. It verdict: "Everything looks good for reporting to function." Maybe someone has any ideas what is wrong? Regards Ema --- ## [Can Kibana Visualise Data in Cold/Frozen Tier?](https://discuss.elastic.co/t/can-kibana-visualise-data-in-cold-frozen-tier/279453)
**Author:** [@peteryann](https://discuss.elastic.co/u/peteryann)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:40pm UTC](https://discuss.elastic.co/t/can-kibana-visualise-data-in-cold-frozen-tier/279453 "2021-07-23T23:40:02Z")
I understand data in the cold/frozen tiers are still searchable by Elasticsearch. Can Kibana visualisations visualise data that span indices across multiple tiers (e.g. warm/cold/frozen)? Is this transparent to the Kiban… --- ## [\[error\]\[data\]\[elasticsearch\] \[version\_conflict\_engine\_exception\]: \[search-telemetry:search-telemetry\]: version conflict, required seqNo \[14477\], primary term \[48\]. current document has seqNo \[14478\] and primary term \[48\]](https://discuss.elastic.co/t/error-data-elasticsearch-version-conflict-engine-exception-search-telemetry-search-telemetry-version-conflict-required-seqno-14477-primary-term-48-current-document-has-seqno-14478-and-primary-term-48/279447)
**Author:** [@hardik.rapidops](https://discuss.elastic.co/u/hardik.rapidops)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:29pm UTC](https://discuss.elastic.co/t/error-data-elasticsearch-version-conflict-engine-exception-search-telemetry-search-telemetry-version-conflict-required-seqno-14477-primary-term-48-current-document-has-seqno-14478-and-primary-term-48/279447 "2021-07-23T23:29:30Z")
I am using kibana 7.10.2 and I can see the following error in logs. Is there any way to fix it? server log \[06:30:40.197\] \[error\]\[data\]\[elasticsearch\] \[version\_conflict\_engine\_exception\]: \[search-telemetry:search-t… --- ## [Filebeat and apache logs](https://discuss.elastic.co/t/filebeat-and-apache-logs/279473)
**Author:** [@colttt](https://discuss.elastic.co/u/colttt)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 11:26pm UTC](https://discuss.elastic.co/t/filebeat-and-apache-logs/279473 "2021-07-23T23:26:32Z")
Hello, we use filebeat to ship the logs from server to graylog. I saw that filebeat has an apache module, I try that but it looks like that it doesn't work. It looks like that it doesn't parse and add extra fields. I cha… --- ## [How to set auto-generated \_id to json field(csv column) in logstash file](https://discuss.elastic.co/t/how-to-set-auto-generated-id-to-json-field-csv-column-in-logstash-file/279482)
**Author:** [@Ashutosh2808](https://discuss.elastic.co/u/Ashutosh2808)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 10:19pm UTC](https://discuss.elastic.co/t/how-to-set-auto-generated-id-to-json-field-csv-column-in-logstash-file/279482 "2021-07-23T22:19:51Z")
I've csv columns as below in logstash conf file: filter{ csv { columns =\> \["ResolutionId","IssueId"\] separator =\> "," skip\_header =\> "true" } mu… --- ## [Trying to create role for some applications and got error](https://discuss.elastic.co/t/trying-to-create-role-for-some-applications-and-got-error/279365)
**Author:** [@gelfandbein](https://discuss.elastic.co/u/gelfandbein)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 9:17pm UTC](https://discuss.elastic.co/t/trying-to-create-role-for-some-applications-and-got-error/279365 "2021-07-23T21:17:37Z")
Hello! I try to create some basic roles for some application what connecting to ES 6.8.15, but stuck on simple query: curl -XGET http://localhost:9200/images/\_search -u server:password output: { "error" : { "ro… --- ## [Logstash Grok - Extract field if field exists & deleting character](https://discuss.elastic.co/t/logstash-grok-extract-field-if-field-exists-deleting-character/279492)
**Author:** [@gringorion](https://discuss.elastic.co/u/gringorion)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 7:13pm UTC](https://discuss.elastic.co/t/logstash-grok-extract-field-if-field-exists-deleting-character/279492 "2021-07-23T19:13:38Z")
Hello Guys, My case is simple, but can't find the perfect response. I need to extract the field: user@domain into 2 fields. This step is OK: %{WORD:user}%{NOTSPACE:domain}? gives: { "user": "user", "domain": "@… --- ## [Filebeat sending all the lines in a log file as one single entries instead of different entries](https://discuss.elastic.co/t/filebeat-sending-all-the-lines-in-a-log-file-as-one-single-entries-instead-of-different-entries/278816)
**Author:** [@Patr123](https://discuss.elastic.co/u/Patr123)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 6:48pm UTC](https://discuss.elastic.co/t/filebeat-sending-all-the-lines-in-a-log-file-as-one-single-entries-instead-of-different-entries/278816 "2021-07-23T18:48:19Z")
I have installed filebeat on a server to ingest the stderr logs for tomcat instance. When I am trying to send those logs to my logstash instance its sending as one event instead of multiple events. How can I fix that? M… --- ## [How to load json data into another json data structure](https://discuss.elastic.co/t/how-to-load-json-data-into-another-json-data-structure/279512)
**Author:** [@venkataraman](https://discuss.elastic.co/u/venkataraman)\ **Replies:** 1\ **Last updated:** [July 23, 2021, 6:33pm UTC](https://discuss.elastic.co/t/how-to-load-json-data-into-another-json-data-structure/279512 "2021-07-23T18:33:00Z")
Hello Everyone, I just need a help in loading data in a nested json format. I have a output something like this in the below format { "product" : "IPS" "Product\_Country" : "EMEA" "Tracking\_ID": "2335454523" "Start… --- ## [Geoip-info fail on auditbeat, filebeat and packetbeack](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 6:28pm UTC](https://discuss.elastic.co/t/geoip-info-fail-on-auditbeat-filebeat-and-packetbeack/279497 "2021-07-23T18:28:38Z")
Hello everyone o/ I followed this tutorial and after restarting the beats (it's the same steps for all beats) I can't receive any geoip-info fields. Do I need more configs on .yml files? --- ## [Logstash aggregate field and increase count](https://discuss.elastic.co/t/logstash-aggregate-field-and-increase-count/279454)
**Author:** [@Hamza\_El\_Aouane](https://discuss.elastic.co/u/Hamza_El_Aouane)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 6:10pm UTC](https://discuss.elastic.co/t/logstash-aggregate-field-and-increase-count/279454 "2021-07-23T18:10:49Z")
Hello everyone. I am again here. I would like to start thanking every single one one of you for this amazing community. Those days I was testing elasticsearch and logstash and I am just falling in love with how many th… --- ## [Change Timezone for a particular field "calldate"](https://discuss.elastic.co/t/change-timezone-for-a-particular-field-calldate/279493)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 3\ **Last updated:** [July 23, 2021, 5:58pm UTC](https://discuss.elastic.co/t/change-timezone-for-a-particular-field-calldate/279493 "2021-07-23T17:58:38Z")
Hi. I'm using logstash jdbc to pull data from a mysql database. So far so good. This is part of the configuration file: input { jdbc { jdbc\_driver\_library =\> "/usr/share/java/mysql-connector-j… --- ## [How to update elasticsearch.yml if I am using Elastic cloud through API](https://discuss.elastic.co/t/how-to-update-elasticsearch-yml-if-i-am-using-elastic-cloud-through-api/279505)
**Author:** [@idelix](https://discuss.elastic.co/u/idelix)\ **Replies:** 5\ **Last updated:** [July 23, 2021, 5:30pm UTC](https://discuss.elastic.co/t/how-to-update-elasticsearch-yml-if-i-am-using-elastic-cloud-through-api/279505 "2021-07-23T17:30:05Z")
Hello, I'm trying to update elasticsearch.yml and kibana.yml in elastic cloud through API but I cannot find any reference. Basically I need to be able to configure it fully through API as it will be done by ci/cd pipel… --- ## [Condition in metricbeat](https://discuss.elastic.co/t/condition-in-metricbeat/279425)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [July 23, 2021, 2:52pm UTC](https://discuss.elastic.co/t/condition-in-metricbeat/279425 "2021-07-23T14:52:33Z")
Trying to setup condition in system.yml file for dropping some event when condition meet what I want to do it if this conditions meet drop the event. ( cond1 OR cond2 OR cond3 ) AND ( cond4 OR cond5 ) for example her… --- ## [Are the shingles in the search-as-you-type field type \*words\* or \*letters\*?](https://discuss.elastic.co/t/are-the-shingles-in-the-search-as-you-type-field-type-words-or-letters/279463)
**Author:** [@Markus\_Jevring](https://discuss.elastic.co/u/Markus_Jevring)\ **Replies:** 2\ **Last updated:** [July 23, 2021, 12:24pm UTC](https://discuss.elastic.co/t/are-the-shingles-in-the-search-as-you-type-field-type-words-or-letters/279463 "2021-07-23T12:24:03Z")
I assumed they were letters, but I can't get the field to behave the way I want (which is to have it support infix searches, like searching for "ethylpre" should match "methylprednisolone"). --- ## [How update ILM for exist indexes after changes steps ILM policy?](https://discuss.elastic.co/t/how-update-ilm-for-exist-indexes-after-changes-steps-ilm-policy/279471)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 10:54am UTC](https://discuss.elastic.co/t/how-update-ilm-for-exist-indexes-after-changes-steps-ilm-policy/279471 "2021-07-23T10:54:28Z")
Hi! I Use ELK 7.13.3. I was updated my cluster from 7.9.3 for fixet bug with datastream deliting. I have datastream which storing 7/14/30/60 days. I was change ILM policy and removed rollover step. Now I have only delet… --- ## [Logstash URL parameter as tags](https://discuss.elastic.co/t/logstash-url-parameter-as-tags/279285)
**Author:** [@juanmav](https://discuss.elastic.co/u/juanmav)\ **Replies:** 7\ **Last updated:** [July 23, 2021, 9:22am UTC](https://discuss.elastic.co/t/logstash-url-parameter-as-tags/279285 "2021-07-23T09:22:28Z")
Hi all, I have this working configuration that receives logs from heroku and process then using grok and add a couple of tags from enviroments vars. input { http { port =\> "${PORT}" tags =\> \["${TAG}… --- ## [Failure load balance](https://discuss.elastic.co/t/failure-load-balance/279373)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 4\ **Last updated:** [July 23, 2021, 9:16am UTC](https://discuss.elastic.co/t/failure-load-balance/279373 "2021-07-23T09:16:10Z")
Hi all, New, RHEL based, 5-node elasticsearch cluster installed here (ver 7.13.3). Elasticsearch clients are Logstash and some In-house applications. My main concern is node failure. I know that logstash would load b… --- ## [How to lower the score of documents that match a specific field and value using ElasticSearch DSL C#](https://discuss.elastic.co/t/how-to-lower-the-score-of-documents-that-match-a-specific-field-and-value-using-elasticsearch-dsl-c/279459)
**Author:** [@Jay2](https://discuss.elastic.co/u/Jay2)\ **Replies:** 0\ **Last updated:** [July 23, 2021, 8:48am UTC](https://discuss.elastic.co/t/how-to-lower-the-score-of-documents-that-match-a-specific-field-and-value-using-elasticsearch-dsl-c/279459 "2021-07-23T08:48:41Z")
When I carry out a search I look for documents with a lang code of 'en' and 'gen', im trying to ensure that the 'en' ones appear before the 'gen' ones do. So after looking around, I found this Boosting that might fit the… [Previous page](https://discuss.elastic.co/latest.md?page=1557) [Next page](https://discuss.elastic.co/latest.md?page=1559)