# Latest **URL:** https://discuss.elastic.co/latest.md?page=1632 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1633 --- ## [Syslog kills process in logstash](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 9\ **Last updated:** [June 9, 2021, 3:58pm UTC](https://discuss.elastic.co/t/syslog-kills-process-in-logstash/275319 "2021-06-09T15:58:33Z")
Hi Guy's! I need your help with this problem, please. Means that, syslog is killing the process in logstash, this means that it stops listening to syslog, I don't know why this is happening, the process stops working f… --- ## [Error using oracle module](https://discuss.elastic.co/t/error-using-oracle-module/275473)
**Author:** [@LagartijaNick](https://discuss.elastic.co/u/LagartijaNick)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:58pm UTC](https://discuss.elastic.co/t/error-using-oracle-module/275473 "2021-06-09T15:58:30Z")
Hi, I'm a newbie. Trying to use filebeat version 7.13.1, I've enabled two modules system and oracle like so: ./filebeat modules enable system oracle. I'm not changing either the system.yml or oracle.yml config files. … --- ## [More than 100 answers on a Dashboard](https://discuss.elastic.co/t/more-than-100-answers-on-a-dashboard/275432)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 3:55pm UTC](https://discuss.elastic.co/t/more-than-100-answers-on-a-dashboard/275432 "2021-06-09T15:55:13Z")
Hello, I'am on v 7.12.0. Some time, I need to have more than 100 values on one widget (for example to extract all executable). It's possible to do it ? Thank you. --- ## [Logstash configuration to globally mutate sub index patterns](https://discuss.elastic.co/t/logstash-configuration-to-globally-mutate-sub-index-patterns/275468)
**Author:** [@es-gabriele](https://discuss.elastic.co/u/es-gabriele)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:40pm UTC](https://discuss.elastic.co/t/logstash-configuration-to-globally-mutate-sub-index-patterns/275468 "2021-06-09T15:40:50Z")
Hello, I have an ELK stack, with some configured index patterns. As part of internal requirements, I need to edit a json object (which is part of that index pattern), globally to "string". As of now, such json object i… --- ## [Creating index on monthly basis](https://discuss.elastic.co/t/creating-index-on-monthly-basis/274762)
**Author:** [@Gourav\_Aggarwal](https://discuss.elastic.co/u/Gourav_Aggarwal)\ **Replies:** 6\ **Last updated:** [June 9, 2021, 3:18pm UTC](https://discuss.elastic.co/t/creating-index-on-monthly-basis/274762 "2021-06-09T15:18:23Z")
Is there any way by which we can create index named \-yyyy.mm on the first day of every month and getting the alias pointed to this newly created index? I learned about date time but that changes the name only wh… --- ## [How to add analyzers for node clients search](https://discuss.elastic.co/t/how-to-add-analyzers-for-node-clients-search/275459)
**Author:** [@thislekan](https://discuss.elastic.co/u/thislekan)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-add-analyzers-for-node-clients-search/275459 "2021-06-09T15:17:47Z")
Hi. This is my first time trying elastic search and I am looking for a way to include an analyzer in my code. I have a bug at work that prevents me from doing a search like this, where the search term is 1:45 am. I want… --- ## [Getting wrong value in bar chart when using a transform index](https://discuss.elastic.co/t/getting-wrong-value-in-bar-chart-when-using-a-transform-index/274739)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 3:15pm UTC](https://discuss.elastic.co/t/getting-wrong-value-in-bar-chart-when-using-a-transform-index/274739 "2021-06-09T15:15:50Z")
Getting incorrect value when I'm creating a bar chart from an index that I have created using Elasticsearch Transform. Basically a group by table from the main table. Below is the bar chart image. And below is the sa… --- ## [Metricbeat logs](https://discuss.elastic.co/t/metricbeat-logs/275439)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 2:56pm UTC](https://discuss.elastic.co/t/metricbeat-logs/275439 "2021-06-09T14:56:12Z")
I've installed Metricbeat and it worked, but when I've made the latest update it is not sending any log to Elasticsearch. I've verified command metricbeat test out and everything is green and I have system module enabled… --- ## [How to create MTTR graph in Kibana dashboard](https://discuss.elastic.co/t/how-to-create-mttr-graph-in-kibana-dashboard/275454)
**Author:** [@chauhann2](https://discuss.elastic.co/u/chauhann2)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 2:49pm UTC](https://discuss.elastic.co/t/how-to-create-mttr-graph-in-kibana-dashboard/275454 "2021-06-09T14:49:04Z")
I need help on below for Kibana dashboard MTTR based on ticket created and resolve in kibana dashboard. SLA failure based on ticket due date and resolve date Kibana version is 5.6.2. --- ## [Can't parse haproxy logs without IP address in Grok](https://discuss.elastic.co/t/cant-parse-haproxy-logs-without-ip-address-in-grok/273654)
**Author:** [@maar](https://discuss.elastic.co/u/maar)\ **Replies:** 7\ **Last updated:** [June 9, 2021, 2:35pm UTC](https://discuss.elastic.co/t/cant-parse-haproxy-logs-without-ip-address-in-grok/273654 "2021-06-09T14:35:40Z")
Grok is parsing successfully when Haproxy gives a log - from var/log/haproxy.log - similar to: May 21 08:25:56 ha haproxy\[5089\]: 12.3.45.67:89012 \[21/May/2021:08:25:56.055\] www-https~ wss/wssnode website.domain.com 1/1/… --- ## [Problem with German charater ß](https://discuss.elastic.co/t/problem-with-german-charater-ss/275450)
**Author:** [@Stefan\_F1](https://discuss.elastic.co/u/Stefan_F1)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 2:08pm UTC](https://discuss.elastic.co/t/problem-with-german-charater-ss/275450 "2021-06-09T14:08:35Z")
Hi, I added a document to my index with the name abcß. Then I tried to read the data with a query over postman: {"query":"SELECT \*, id FROM sapalink\_fi WHERE name = 'abcß' and (repository='rfHN5c3RlbXwxfFNGfC8=') AND (… --- ## [Error while sending oracle data from logstash - elastic](https://discuss.elastic.co/t/error-while-sending-oracle-data-from-logstash-elastic/275447)
**Author:** [@Rahul\_Choubey](https://discuss.elastic.co/u/Rahul_Choubey)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 1:51pm UTC](https://discuss.elastic.co/t/error-while-sending-oracle-data-from-logstash-elastic/275447 "2021-06-09T13:51:07Z")
I am facing below issue while streaming message from logstash to kiabana: \[2021-06-09T10:15:01,047\]\[INFO \]\[logstash.inputs.jdbc\]\[main\] (0.067667s) SELECT \* FROM GV$ACTIVE\_SESSION\_HISTORY WHERE SAMPLE\_TIME \> TIMESTAMP '2… --- ## [Migration from Elastic Cloud to Elastic on Docker](https://discuss.elastic.co/t/migration-from-elastic-cloud-to-elastic-on-docker/275132)
**Author:** [@Danigrail](https://discuss.elastic.co/u/Danigrail)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 1:41pm UTC](https://discuss.elastic.co/t/migration-from-elastic-cloud-to-elastic-on-docker/275132 "2021-06-09T13:41:15Z")
Hi community, im using ES on my Docker, i try to migrate data from my other Elasticsearch on Cloud, i tried to aim to my Elasticsearch ID but on Dev Tools doesn't work. I restarted container also, and added to the white… --- ## [How use complex params in java](https://discuss.elastic.co/t/how-use-complex-params-in-java/275446)
**Author:** [@saberfate](https://discuss.elastic.co/u/saberfate)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 1:39pm UTC](https://discuss.elastic.co/t/how-use-complex-params-in-java/275446 "2021-06-09T13:39:43Z")
Hi, I'm using painless to do some complex json replacement. In REST call, I can use params like below "params": { "doc": \[{"b": "value3", "b1": "value33"}, {"d": "value44", "array1": \["abc", "123"\]}\], "total": … --- ## [How to set default value while using env in elasticsearch.yml config file?](https://discuss.elastic.co/t/how-to-set-default-value-while-using-env-in-elasticsearch-yml-config-file/275440)
**Author:** [@kamolhasan](https://discuss.elastic.co/u/kamolhasan)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 1:12pm UTC](https://discuss.elastic.co/t/how-to-set-default-value-while-using-env-in-elasticsearch-yml-config-file/275440 "2021-06-09T13:12:31Z")
I'm using environment variable in config file (ie. elasticsearch.yml) to configure node roles. For example: elasticsearch.yml: node.roles: '${NODE\_ROLES}' When, I set NODE\_ROLES="master", NODE\_ROLES="ml, remote\_clus… --- ## [Rally dump existing cluster data while 429 occur](https://discuss.elastic.co/t/rally-dump-existing-cluster-data-while-429-occur/275385)
**Author:** [@JohnPhilip](https://discuss.elastic.co/u/JohnPhilip)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 1:06pm UTC](https://discuss.elastic.co/t/rally-dump-existing-cluster-data-while-429-occur/275385 "2021-06-09T13:06:54Z")
when I try to create a track from data in an existing cluster, I found that error occurred like following Extracting documents for index \[compress\_ratio\_ac... 1650000/50000001 docs \[3.3% done\]\[ERROR\] Cannot create-t… --- ## [Number of documents in Dev tools is different from number of document in Discover](https://discuss.elastic.co/t/number-of-documents-in-dev-tools-is-different-from-number-of-document-in-discover/274917)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 8\ **Last updated:** [June 9, 2021, 12:31pm UTC](https://discuss.elastic.co/t/number-of-documents-in-dev-tools-is-different-from-number-of-document-in-discover/274917 "2021-06-09T12:31:09Z")
I am using ELK 7.9.3 and I have an index which contain more then 2M documents, I used reindex API to have a sample using the following command: POST /\_reindex?wait\_for\_completion=false { "max\_docs": 1000, "source":… --- ## [Is there are max number of operators in a query?](https://discuss.elastic.co/t/is-there-are-max-number-of-operators-in-a-query/275291)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/is-there-are-max-number-of-operators-in-a-query/275291 "2021-06-09T12:27:53Z")
Dear all =) Ideally would I like to make a search query that contains approx 100 OR operators and 1 AND NOT like so (logLevel:error OR logLevel:fatal) AND NOT (searchString1 OR searchString2 OR searchString3 OR ... O… --- ## [Icon in Kibana](https://discuss.elastic.co/t/icon-in-kibana/275306)
**Author:** [@mostpha456](https://discuss.elastic.co/u/mostpha456)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 12:23pm UTC](https://discuss.elastic.co/t/icon-in-kibana/275306 "2021-06-09T12:23:08Z")
Hello, I want to know if it is possible to create a visualisation in kibana with a custom icon. For exemple, i have a field X and i want to put an icon depending on the value of the field in data table. Is that possib… --- ## [Elastic user password not working](https://discuss.elastic.co/t/elastic-user-password-not-working/275342)
**Author:** [@redamberfish](https://discuss.elastic.co/u/redamberfish)\ **Replies:** 5\ **Last updated:** [June 9, 2021, 12:07pm UTC](https://discuss.elastic.co/t/elastic-user-password-not-working/275342 "2021-06-09T12:07:23Z")
Hello, Similar to Sudo password for elastic user, I am trying to complete the lab for Observability Fundamentals, but I need to use "sudo" to download and install packages. It keeps telling me the password is incorrect,… --- ## [How to index custom json with C# object using NEST](https://discuss.elastic.co/t/how-to-index-custom-json-with-c-object-using-nest/275431)
**Author:** [@Lilan\_Silva](https://discuss.elastic.co/u/Lilan_Silva)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 11:56am UTC](https://discuss.elastic.co/t/how-to-index-custom-json-with-c-object-using-nest/275431 "2021-06-09T11:56:55Z")
I am new to elastic search and we need to migrate from mongodb to elastic. we used public class Book { \[BsonId\] public string Id { get; set; } public string ApplicationId { get; set; } … --- ## [RUM Agent is missing on APM](https://discuss.elastic.co/t/rum-agent-is-missing-on-apm/273832)
**Author:** [@Hamunaptroid](https://discuss.elastic.co/u/Hamunaptroid)\ **Replies:** 3\ **Last updated:** [June 9, 2021, 11:39am UTC](https://discuss.elastic.co/t/rum-agent-is-missing-on-apm/273832 "2021-06-09T11:39:41Z")
Hello, I have issue with RUM agent running on our front end servers. It is missing on APM (Kibana \> APM \> services). It was working at first, but when I checked APM after some time, all services with rum-js agents were … --- ## [Get value from ctx.payload.results](https://discuss.elastic.co/t/get-value-from-ctx-payload-results/275423)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 1\ **Last updated:** [June 9, 2021, 11:32am UTC](https://discuss.elastic.co/t/get-value-from-ctx-payload-results/275423 "2021-06-09T11:32:25Z")
I'm trying to extract the results from the payload to display in a message for a watcher The value is in "payload": { "results": \[ { "value": 1644, "key": "foo" … --- ## [Dashboard Panel not show data when change indices](https://discuss.elastic.co/t/dashboard-panel-not-show-data-when-change-indices/275393)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 6\ **Last updated:** [June 9, 2021, 11:21am UTC](https://discuss.elastic.co/t/dashboard-panel-not-show-data-when-change-indices/275393 "2021-06-09T11:21:02Z")
Hi community, My dashboard panel show blank page when I delete old indice and create new one. I'm also not able to edit panels. The new indice is still received document and I can create new panel with visualization. B… --- ## [How many Filebeat containers can connect to an ES node?](https://discuss.elastic.co/t/how-many-filebeat-containers-can-connect-to-an-es-node/275323)
**Author:** [@valhalla](https://discuss.elastic.co/u/valhalla)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 10:56am UTC](https://discuss.elastic.co/t/how-many-filebeat-containers-can-connect-to-an-es-node/275323 "2021-06-09T10:56:31Z")
Hello, Would like to know if there is a limitation on the number of different filebeat containers that can save data into one ES node? Which is the actual Filebeat number that one can have in order to ship data to ES? … --- ## [JVM heap recommandation](https://discuss.elastic.co/t/jvm-heap-recommandation/275416)
**Author:** [@rebug](https://discuss.elastic.co/u/rebug)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 10:07am UTC](https://discuss.elastic.co/t/jvm-heap-recommandation/275416 "2021-06-09T10:07:30Z")
Hi, I would like to know what is you recommendation for the JVM heap size of a elastic node ? I run the elastic stack on docker, I will have approximatively 200 indices (200 shards) of 25gb. --- ## [Reindexing was in progress on master node but after rebooting cluster it is halted](https://discuss.elastic.co/t/reindexing-was-in-progress-on-master-node-but-after-rebooting-cluster-it-is-halted/275413)
**Author:** [@krish0608](https://discuss.elastic.co/u/krish0608)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 10:01am UTC](https://discuss.elastic.co/t/reindexing-was-in-progress-on-master-node-but-after-rebooting-cluster-it-is-halted/275413 "2021-06-09T10:01:12Z")
Reindexing was in progress on master node but after rebooting cluster it is halted. We have 3 master nodes and multiple data nodes and we have rebooted all one by one. Everything is up and running but reindexing is not … --- ## [Problems migrating vega charts from 7.2 to 7.10](https://discuss.elastic.co/t/problems-migrating-vega-charts-from-7-2-to-7-10/275273)
**Author:** [@diegoag97](https://discuss.elastic.co/u/diegoag97)\ **Replies:** 2\ **Last updated:** [June 9, 2021, 9:46am UTC](https://discuss.elastic.co/t/problems-migrating-vega-charts-from-7-2-to-7-10/275273 "2021-06-09T09:46:56Z")
Hi, I was migrating via export/import some charts from the version 7.2 to a new 7.10.2 version. Unfortunately, after migrating the data and the charts, the vega charts don´t render and don´t show any data. Given that veg… --- ## [Multi field search criteria results to include all input or either words](https://discuss.elastic.co/t/multi-field-search-criteria-results-to-include-all-input-or-either-words/275408)
**Author:** [@Mithoon](https://discuss.elastic.co/u/Mithoon)\ **Replies:** 0\ **Last updated:** [June 9, 2021, 8:58am UTC](https://discuss.elastic.co/t/multi-field-search-criteria-results-to-include-all-input-or-either-words/275408 "2021-06-09T08:58:48Z")
Currently using Elastic Search for inventory search feature implementation and trying to build query logic. Search requirements: User shall be able to search for words in ProductName, BrandName and description fields … --- ## [Metric count mismatch in production setup 7.9.0](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 4\ **Last updated:** [June 9, 2021, 9:04am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390 "2021-06-09T09:04:28Z")
Hi, I have a standalone setup of ELK stack version 7.12.1. in windows machine. I have ingested examination data from csv file to kibana using logstash. Using this data I had to show total students count. I did this usin… [Previous page](https://discuss.elastic.co/latest.md?page=1631) [Next page](https://discuss.elastic.co/latest.md?page=1633)