# Latest **URL:** https://discuss.elastic.co/latest.md?page=1650 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1651 --- ## [Kibana packaging with less files](https://discuss.elastic.co/t/kibana-packaging-with-less-files/274500)
**Author:** [@cedric.dutoit](https://discuss.elastic.co/u/cedric.dutoit)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 1:28pm UTC](https://discuss.elastic.co/t/kibana-packaging-with-less-files/274500 "2021-05-31T13:28:07Z")
Hi, Kibana 7.12.1 is 64150 files. Is it a way to package Kibana so that I can deploy much less files in production ? less node\_modules, or Kibana bundle or... ? I found nothing in the documentation. Thanks for your h… --- ## [Update logstash to specific version](https://discuss.elastic.co/t/update-logstash-to-specific-version/274503)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 12:43pm UTC](https://discuss.elastic.co/t/update-logstash-to-specific-version/274503 "2021-05-31T12:43:06Z")
Hello, I'm upgrading my stack from 7.9.3 to 7.12.1 using yum. For elasticsearch and filebeat I can update for the specific version without any problem using: yum install filebeat-7.12.1 yum install elasticsearch-7.12.… --- ## [Reporting](https://discuss.elastic.co/t/reporting/274501)
**Author:** [@marcio\_lima](https://discuss.elastic.co/u/marcio_lima)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 1:15pm UTC](https://discuss.elastic.co/t/reporting/274501 "2021-05-31T13:15:32Z")
Good Morning! I would like if you could help me with the Available fields, because when I select them, the report comes out without information? If you print without the Available fields, everything will be normal. … --- ## [Using container\_cpu\_usage\_total in Elasticsearch](https://discuss.elastic.co/t/using-container-cpu-usage-total-in-elasticsearch/272844)
**Author:** [@Ronaldo\_Lanhellas](https://discuss.elastic.co/u/Ronaldo_Lanhellas)\ **Replies:** 8\ **Last updated:** [May 31, 2021, 1:03pm UTC](https://discuss.elastic.co/t/using-container-cpu-usage-total-in-elasticsearch/272844 "2021-05-31T13:03:12Z")
I'm collecting metrics from Kubernetes using Prometheus and sending them to ElasticSearch, with Metricbeat Prometheus module. (Federation | Prometheus). So, I have the following field in ElasticSearch Index: prometheus.… --- ## [Exclude lines isn't working with multiline pattern](https://discuss.elastic.co/t/exclude-lines-isnt-working-with-multiline-pattern/274211)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 12:58pm UTC](https://discuss.elastic.co/t/exclude-lines-isnt-working-with-multiline-pattern/274211 "2021-05-31T12:58:56Z")
this is my filebeat.yml exclude\_lines: \['^\[\[:space:\]\]'\] multiline.pattern: '^(3\[01\]|0\[1-9\]|\[12\]\[0-9\])(-?)(1\[0-2\]|0\[1-9\])(-?)(\[0-9\]{4})' multiline.negate: true multiline.match: after i want to exclude the lines… --- ## [Canvas: compare count from two indices](https://discuss.elastic.co/t/canvas-compare-count-from-two-indices/274458)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 12:55pm UTC](https://discuss.elastic.co/t/canvas-compare-count-from-two-indices/274458 "2021-05-31T12:55:41Z")
I'm trying to compare two counts using Canvas. My queries are a straight count of documents from one index: SELECT COUNT(\*) AS c1 FROM index1 And the count of a particular field value in another index: SELECT COUNT(\*… --- ## [Updating an index setting](https://discuss.elastic.co/t/updating-an-index-setting/274126)
**Author:** [@Cesidio\_DiBenedetto](https://discuss.elastic.co/u/Cesidio_DiBenedetto)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 12:50pm UTC](https://discuss.elastic.co/t/updating-an-index-setting/274126 "2021-05-31T12:50:04Z")
Currently I have the following on one of my indexes. ... "analysis": { "filter": { "custom\_edge\_ngram": { "type": "edge\_ngram", "min\_gram": "1", … --- ## [Save index data when index rollover](https://discuss.elastic.co/t/save-index-data-when-index-rollover/274484)
**Author:** [@pablixelastic](https://discuss.elastic.co/u/pablixelastic)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 12:48pm UTC](https://discuss.elastic.co/t/save-index-data-when-index-rollover/274484 "2021-05-31T12:48:39Z")
Hi there! My problem is this: This data is just from 3 days! I'm trying to save my data when i do an index rollover. Is there any configuration to do it? I mean, saving it on a .xls, .txt... or just a simple snapsh… --- ## [Kibana](https://discuss.elastic.co/t/kibana/274478)
**Author:** [@miklin](https://discuss.elastic.co/u/miklin)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 12:41pm UTC](https://discuss.elastic.co/t/kibana/274478 "2021-05-31T12:41:12Z")
Hi, may I know if there's any tool in Kibana that can help me to find out which variable can distinguish abnormal traffic? The example below shows the daily traffic is around 10k, but it rose to 40k since May 28th. Afte… --- ## [Enable "basic" ES features on local ES rpm installation](https://discuss.elastic.co/t/enable-basic-es-features-on-local-es-rpm-installation/274469)
**Author:** [@eliase](https://discuss.elastic.co/u/eliase)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 12:38pm UTC](https://discuss.elastic.co/t/enable-basic-es-features-on-local-es-rpm-installation/274469 "2021-05-31T12:38:30Z")
Hi, I installed elasticsearch via the rpm repository. However, it is unclear to me what steps I need to take to switch from the OSS to the " Basic - free and open" version as advertised here. (I want to use the dense v… --- ## [How to disable Kibana security warning message](https://discuss.elastic.co/t/how-to-disable-kibana-security-warning-message/274421)
**Author:** [@csaltos](https://discuss.elastic.co/u/csaltos)\ **Replies:** 11\ **Last updated:** [May 31, 2021, 12:38pm UTC](https://discuss.elastic.co/t/how-to-disable-kibana-security-warning-message/274421 "2021-05-31T12:38:11Z")
Kibana shows this message: Elasticsearch built-in security features are not enabled. Without authentication, your cluster could be accessible to anyone. See https://www.elastic.co/guide/en/elasticsearch/reference/7.13/s… --- ## [Fleet AWS Cloudtrail integration stops working after upgrading elastic agent to 7.12.0](https://discuss.elastic.co/t/fleet-aws-cloudtrail-integration-stops-working-after-upgrading-elastic-agent-to-7-12-0/269120)
**Author:** [@nugroho-expereo](https://discuss.elastic.co/u/nugroho-expereo)\ **Replies:** 10\ **Last updated:** [May 31, 2021, 12:05pm UTC](https://discuss.elastic.co/t/fleet-aws-cloudtrail-integration-stops-working-after-upgrading-elastic-agent-to-7-12-0/269120 "2021-05-31T12:05:22Z")
Hi all, We have a working AWS CloudTrail integration with Elastic agent 7.10.1. After upgrading to 7.12 the cloud trail data stops working without any error in the log. I have tried to enabled debug level on agent but … --- ## [Detection rule kquery will not trigger but the query match](https://discuss.elastic.co/t/detection-rule-kquery-will-not-trigger-but-the-query-match/273085)
**Author:** [@leon3](https://discuss.elastic.co/u/leon3)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 12:03pm UTC](https://discuss.elastic.co/t/detection-rule-kquery-will-not-trigger-but-the-query-match/273085 "2021-05-31T12:03:54Z")
Hi I have a weird issue when use kquery in detection rules. I use a simple query to match a field and triggering action for that but the rule will not be triggered while its query is matching in the specified interval. … --- ## [Is the any way to present in dashboart visualization based on two indices?](https://discuss.elastic.co/t/is-the-any-way-to-present-in-dashboart-visualization-based-on-two-indices/274488)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 11:55am UTC](https://discuss.elastic.co/t/is-the-any-way-to-present-in-dashboart-visualization-based-on-two-indices/274488 "2021-05-31T11:55:03Z")
Hi, I'd like to build a dashboard with visualizations. In first index I have sales details. Let say: product, sale\_value, quantity, sale\_date. In other index I have: purchase\_price, price\_date In visualization I'd l… --- ## [Multiple time-based charts in a dashboard: TSVB or Lens?](https://discuss.elastic.co/t/multiple-time-based-charts-in-a-dashboard-tsvb-or-lens/274480)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 11:44am UTC](https://discuss.elastic.co/t/multiple-time-based-charts-in-a-dashboard-tsvb-or-lens/274480 "2021-05-31T11:44:32Z")
My vote (possibly ill-informed, hence this topic): Make 'em all TSVB. My reason (just the one): when you mouse over a TSVB viz, a red line appears in every TSVB viz in the dashboard, showing that same point in time. You… --- ## [Control Panel: Size option](https://discuss.elastic.co/t/control-panel-size-option/274034)
**Author:** [@qttv](https://discuss.elastic.co/u/qttv)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 11:34am UTC](https://discuss.elastic.co/t/control-panel-size-option/274034 "2021-05-31T11:34:04Z")
Hi, i'm creating a Dashboard in Kibana in wich i want to insert some control panels. In the options of these control there is the voice "Size" wich limitate the number of items shown in the control panel. I just want to … --- ## [Upgrade elasticsearch version from 7.10 to 7.13 error](https://discuss.elastic.co/t/upgrade-elasticsearch-version-from-7-10-to-7-13-error/274459)
**Author:** [@AlexM566](https://discuss.elastic.co/u/AlexM566)\ **Replies:** 6\ **Last updated:** [May 31, 2021, 11:22am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-version-from-7-10-to-7-13-error/274459 "2021-05-31T11:22:05Z")
Hey guys, I am trying to update the version of elasticsearch to 7.13 from 7.10 and I am following the instructions from Rolling upgrades | Elasticsearch Guide \[7.13\] | Elastic but in the final when i procced with the i… --- ## [Extract the message from an Alert FileBeat](https://discuss.elastic.co/t/extract-the-message-from-an-alert-filebeat/274475)
**Author:** [@Michael\_Dylan\_McAloo](https://discuss.elastic.co/u/Michael_Dylan_McAloo)\ **Replies:** 4\ **Last updated:** [May 31, 2021, 11:17am UTC](https://discuss.elastic.co/t/extract-the-message-from-an-alert-filebeat/274475 "2021-05-31T11:17:15Z")
I need help because I don't know how to select only the part of the message where it says "NMAP ping sweep Scan". 05/28-10:30:30:52.840974 \[\*\*\] \[1:10000004:1\] "NMAP ping sweep Scan" \[\*\*\] \[Priority: 0\] {TCP} I got this: … --- ## [Support for PKCS#5 v2.0 in LogStash](https://discuss.elastic.co/t/support-for-pkcs-5-v2-0-in-logstash/274487)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 11:03am UTC](https://discuss.elastic.co/t/support-for-pkcs-5-v2-0-in-logstash/274487 "2021-05-31T11:03:00Z")
Hi all, We are currently migrating our Elastic Stack from RHEL 7 to RHEL 8 which also upgrades openssl from 1.0.2k to 1.1.1g At first we could not figure out why LogStash was not able to start our pipeline containing a… --- ## [How Sliced Scan Works in the background?](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274486)
**Author:** [@arkash20](https://discuss.elastic.co/u/arkash20)\ **Replies:** 0\ **Last updated:** [May 31, 2021, 10:53am UTC](https://discuss.elastic.co/t/how-sliced-scan-works-in-the-background/274486 "2021-05-31T10:53:21Z")
Hi, I used scan method to retrieve data from a huge indice we have (200M records), using multiprocessing. For that I used sliced scan and set it to 6 slices, as the number of my shards. Now here comes the theory questi… --- ## [Logstash "if" condition not working as expected](https://discuss.elastic.co/t/logstash-if-condition-not-working-as-expected/274483)
**Author:** [@suryarao67](https://discuss.elastic.co/u/suryarao67)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 10:51am UTC](https://discuss.elastic.co/t/logstash-if-condition-not-working-as-expected/274483 "2021-05-31T10:51:35Z")
Below is my input message to logstash { "object2": "", "headers": { "request\_path": "/", "request\_method": "POST", "http\_accept": "\*/\*", "content\_type": "application/json; charset=utf-8", "http\_version": "HT… --- ## [Search API error Elasticsearch](https://discuss.elastic.co/t/search-api-error-elasticsearch/274349)
**Author:** [@Jose\_Angel\_Morena\_Si](https://discuss.elastic.co/u/Jose_Angel_Morena_Si)\ **Replies:** 11\ **Last updated:** [May 31, 2021, 10:15am UTC](https://discuss.elastic.co/t/search-api-error-elasticsearch/274349 "2021-05-31T10:15:56Z")
Hello there, When I use python elasticsearch module to query for documents, there seems to be something strange going on: elasticsearch module: version 7.11.2 elasticsearch cluster: version 7.11.2 The following query: … --- ## [German compound words in an e-commerce search](https://discuss.elastic.co/t/german-compound-words-in-an-e-commerce-search/270280)
**Author:** [@thaarbach](https://discuss.elastic.co/u/thaarbach)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 9:59am UTC](https://discuss.elastic.co/t/german-compound-words-in-an-e-commerce-search/270280 "2021-05-31T09:59:27Z")
Hi elastic! We are developing an e-commerce application and have been using elasticsearch 2.0 since 2014. We are prevented from upgrading by a problem that we simply cannot solve with the current ES version. The german… --- ## [ECK on AWS EKS: Persisting a volumeClaimTemplates](https://discuss.elastic.co/t/eck-on-aws-eks-persisting-a-volumeclaimtemplates/273950)
**Author:** [@vinnar](https://discuss.elastic.co/u/vinnar)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 9:45am UTC](https://discuss.elastic.co/t/eck-on-aws-eks-persisting-a-volumeclaimtemplates/273950 "2021-05-31T09:45:54Z")
I have an ECK 1.3.1 deployed in AWS EKS. In my elastic.yml I have specified a volumeClaimTemplates to use a storageClass that was created using another deployment file. # StorageClass definition apiVersion: storage.k8s… --- ## [Kibana. Long text fields are not displayed](https://discuss.elastic.co/t/kibana-long-text-fields-are-not-displayed/273346)
**Author:** [@yeryomenkom](https://discuss.elastic.co/u/yeryomenkom)\ **Replies:** 3\ **Last updated:** [May 31, 2021, 9:26am UTC](https://discuss.elastic.co/t/kibana-long-text-fields-are-not-displayed/273346 "2021-05-31T09:26:08Z")
Hi! I am observing strange behaviour when some text fields are displayed in "Discover" section and some are not. I store in this field java exception stacktraces. "exception" field from this record is displayed normally… --- ## [Master node missing path.data](https://discuss.elastic.co/t/master-node-missing-path-data/274338)
**Author:** [@Juri\_P](https://discuss.elastic.co/u/Juri_P)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 9:23am UTC](https://discuss.elastic.co/t/master-node-missing-path-data/274338 "2021-05-31T09:23:18Z")
I have an ELK cluster, with two elasticsearch nodes, one with roles master, data and ingest, and the other with only data and ingest. There's also a script making backups each night to a shared disk on another server. I … --- ## [Winlogbeat Sysmon Configuration Registry fields seems to map the wrong value of the registry](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 9:17am UTC](https://discuss.elastic.co/t/winlogbeat-sysmon-configuration-registry-fields-seems-to-map-the-wrong-value-of-the-registry/273733 "2021-05-31T09:17:43Z")
Hello, Just noticed something weird with Sysmon configuration in 7.11 (registry events) As you can see, the actual value of the registry key is in winlog.event\_data.Details while imho this should be in registry.valu… --- ## [Enterprise Search (App Search) - Using Kibana for engine's content analysis](https://discuss.elastic.co/t/enterprise-search-app-search-using-kibana-for-engines-content-analysis/274169)
**Author:** [@SanderP](https://discuss.elastic.co/u/SanderP)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 9:15am UTC](https://discuss.elastic.co/t/enterprise-search-app-search-using-kibana-for-engines-content-analysis/274169 "2021-05-31T09:15:30Z")
HI, With a small workaround I know it is possible to get details from the Engines of appsearch shown and visualized within Kibana. This is done by putting a index pattern on the involved system indexes. What would be th… --- ## [Is there any way we can use list of vectors to store in ElasticSearch and what are the corresponding changes required in ES query for calculating cosine similarity](https://discuss.elastic.co/t/is-there-any-way-we-can-use-list-of-vectors-to-store-in-elasticsearch-and-what-are-the-corresponding-changes-required-in-es-query-for-calculating-cosine-similarity/273888)
**Author:** [@SagarPalyal](https://discuss.elastic.co/u/SagarPalyal)\ **Replies:** 1\ **Last updated:** [May 31, 2021, 9:00am UTC](https://discuss.elastic.co/t/is-there-any-way-we-can-use-list-of-vectors-to-store-in-elasticsearch-and-what-are-the-corresponding-changes-required-in-es-query-for-calculating-cosine-similarity/273888 "2021-05-31T09:00:28Z")
Provided I am able to create single dense vector field and calculate cosine similarity using the ElasticSearch query mentioned in official documentation. Still not getting how to create list of dense vectors and apply co… --- ## [Calculating packet loss](https://discuss.elastic.co/t/calculating-packet-loss/274364)
**Author:** [@svenvg93](https://discuss.elastic.co/u/svenvg93)\ **Replies:** 2\ **Last updated:** [May 31, 2021, 8:43am UTC](https://discuss.elastic.co/t/calculating-packet-loss/274364 "2021-05-31T08:43:45Z")
Hello everyone, i'm very new to ELK stack. I am running a home lab for testing. I’m using heartbeat to monitor endpoints availability by ping. Is there a way to calculate the percentage of packet loss. Can’t seem to fi… [Previous page](https://discuss.elastic.co/latest.md?page=1649) [Next page](https://discuss.elastic.co/latest.md?page=1651)