# Latest **URL:** https://discuss.elastic.co/latest.md?page=1707 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1708 --- ## [Kibana filter issues on embedded dashboards](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898)
**Author:** [@a.deharo](https://discuss.elastic.co/u/a.deharo)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 1:16pm UTC](https://discuss.elastic.co/t/kibana-filter-issues-on-embedded-dashboards/268898 "2021-04-28T13:16:35Z")
Hi everyone, I recently upgraded my Elastic stack version from v7.11.2 to v7.12.0, and I'm starting to see some weird behavior on both filters and controls visualizations on embedded dashboards from Kibana. I guess the … --- ## [Try to add a new field with timestamp in logstash](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512)
**Author:** [@David\_Barat](https://discuss.elastic.co/u/David_Barat)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 12:52pm UTC](https://discuss.elastic.co/t/try-to-add-a-new-field-with-timestamp-in-logstash/271512 "2021-04-28T12:52:39Z")
Hi everyone, I am pretty new in ELK world and I would like to parse csv file with logstash. I have tried to add a time field with timestamp (YYYY MM DD format), but I think there is an issue in the format I have made … --- ## [\[Bug\] Visualizations: Data table with image](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427)
**Author:** [@cceyda](https://discuss.elastic.co/u/cceyda)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 12:48pm UTC](https://discuss.elastic.co/t/bug-visualizations-data-table-with-image/271427 "2021-04-28T12:48:51Z")
I opened an issue : \[Bug\] Visualizations: Data table image weirdness · Issue #98257 · elastic/kibana · GitHub but no one replied so posting here too Kibana version: 7.12.0 Elasticsearch version: 7.12.0 Server OS vers… --- ## [Received plaintext http traffic on an https channel, closing connection](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection/271380)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 12:32pm UTC](https://discuss.elastic.co/t/received-plaintext-http-traffic-on-an-https-channel-closing-connection/271380 "2021-04-28T12:32:58Z")
I have deployed ECK (using helm) on my k8s cluster and i am attempting to install elasticsearch following the docs. Deploy an Elasticsearch cluster | Elastic Cloud on Kubernetes \[2.10\] | Elastic I have externally expose… --- ## [Query for anomaly explorer visualization](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:42am UTC](https://discuss.elastic.co/t/query-for-anomaly-explorer-visualization/270784 "2021-04-28T11:42:17Z")
Hi Im trying to emulate the anomaly explorer in a vega visualization, at first I think that a top hit agreggation will get me similar results, like this query: POST /.ml-anomalies-\*/\_search { "size": 0, "aggs": { … --- ## [UI\_actions\_explorer as a Plugin](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258)
**Author:** [@Noobmaster](https://discuss.elastic.co/u/Noobmaster)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 11:39am UTC](https://discuss.elastic.co/t/ui-actions-explorer-as-a-plugin/271258 "2021-04-28T11:39:35Z")
Hi. I am new to ELK. Can anyone tell me how can I use certain part of the actions in UI\_actions\_explorer examples as a plugin. Example: I want to create a datagrid of 3\*3 data . And I want to have edit option as sho… --- ## [\[ElasticAPM\] Alternative to "enabled\_environments" with ruby apm agent](https://discuss.elastic.co/t/elasticapm-alternative-to-enabled-environments-with-ruby-apm-agent/271498)
**Author:** [@mar-ro](https://discuss.elastic.co/u/mar-ro)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 11:30am UTC](https://discuss.elastic.co/t/elasticapm-alternative-to-enabled-environments-with-ruby-apm-agent/271498 "2021-04-28T11:30:13Z")
If you are asking about a problem you are experiencing, please use the following template, as it will help us help you. If you have a different problem, please delete all of this text :slight\_smile: TIP 1: select at lea… --- ## [ES index goes read-only without the node reaching the disk watermark](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502)
**Author:** [@Bence\_Ver](https://discuss.elastic.co/u/Bence_Ver)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 11:24am UTC](https://discuss.elastic.co/t/es-index-goes-read-only-without-the-node-reaching-the-disk-watermark/271502 "2021-04-28T11:24:30Z")
We are running an ELK cluster (v7.11.2) in kubernetes, and we noticed that the cluster went read-only without the underlying node reaching the disk watermark. We don't see any trace of error in the ES logs, and neither a… --- ## [Editing date time filed in json filter output](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 10:52am UTC](https://discuss.elastic.co/t/editing-date-time-filed-in-json-filter-output/271136 "2021-04-28T10:52:27Z")
Hi all I am using filebeat 7.8 which sends log to logstash 7.8. Each line of log is as following: {"req": { "service": ser1,"re\_date": "2020-09-10T09:14:38.479"}} and my logstash filter is as following: inpu… --- ## [Is there a way in Kibana to group, aggregate and report frequently occurring exceptions and errors?](https://discuss.elastic.co/t/is-there-a-way-in-kibana-to-group-aggregate-and-report-frequently-occurring-exceptions-and-errors/269243)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 10:43am UTC](https://discuss.elastic.co/t/is-there-a-way-in-kibana-to-group-aggregate-and-report-frequently-occurring-exceptions-and-errors/269243 "2021-04-28T10:43:19Z")
Hello Experts, We have application and web logs. We would like to group group, aggregate and report frequently occurring exceptions and errors using API. How to get report errors with their frequency of occurrence? E… --- ## [Elasticsearch 7.12 cluster 3 node installation](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 10:37am UTC](https://discuss.elastic.co/t/elasticsearch-7-12-cluster-3-node-installation/271480 "2021-04-28T10:37:49Z")
Hi all, I tried to setup 3 Elasticsearch nodes with configuration below file /etc/hosts (on 3 nodes) elasticsearch.yml NODE 1 (master-1) cluster.name: es-cluster node.name: "master-1" node.master: true node.d… --- ## [Esrally test results, I want to see the test results about the query, thank you](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496)
**Author:** [@rui.chen](https://discuss.elastic.co/u/rui.chen)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 10:19am UTC](https://discuss.elastic.co/t/esrally-test-results-i-want-to-see-the-test-results-about-the-query-thank-you/271496 "2021-04-28T10:19:29Z")
this is test command esrally race --track=geonames --challenge=append-no-conflicts --offline --pipeline=benchmark-only --target-hosts=172.31.1.21:9200,172.31.1.30:9200,172.31.1.249:9200 test result | … --- ## [Filebeat Setup error: error loading index pattern: returned 408 to import file](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/271400)
**Author:** [@radu990](https://discuss.elastic.co/u/radu990)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 9:25am UTC](https://discuss.elastic.co/t/filebeat-setup-error-error-loading-index-pattern-returned-408-to-import-file/271400 "2021-04-28T09:25:21Z")
While running filebeat setup, I'm getting the following error: PS C:\\Program Files\\Filebeat\> .\\filebeat.exe setup Overwriting ILM policy is disabled. Set \`setup.ilm.overwrite: true\` for enabling. Index setup finished. … --- ## [Can we use aggregate filter to get the total no of times an IP appears in the logs?](https://discuss.elastic.co/t/can-we-use-aggregate-filter-to-get-the-total-no-of-times-an-ip-appears-in-the-logs/271486)
**Author:** [@Shreesh\_Narayanan](https://discuss.elastic.co/u/Shreesh_Narayanan)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 9:02am UTC](https://discuss.elastic.co/t/can-we-use-aggregate-filter-to-get-the-total-no-of-times-an-ip-appears-in-the-logs/271486 "2021-04-28T09:02:37Z")
I have a requirement , where an IP or hostname appears frequently in logs , can we use aggregate filter to get this count of IP /Hostnames ? --- ## [Multiply 2 variables in Datatable](https://discuss.elastic.co/t/multiply-2-variables-in-datatable/271341)
**Author:** [@NightWalker](https://discuss.elastic.co/u/NightWalker)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 9:24am UTC](https://discuss.elastic.co/t/multiply-2-variables-in-datatable/271341 "2021-04-28T09:24:57Z")
Hi, I'm trying to do something pretty simple but have a hard time to get it work. I've an global variable {custom\_price} and want to multiply it with each column value. I've tried every combination which came in my min… --- ## [Index pattern creation fails in 7.9.2](https://discuss.elastic.co/t/index-pattern-creation-fails-in-7-9-2/271367)
**Author:** [@Lieven\_Merckx](https://discuss.elastic.co/u/Lieven_Merckx)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:56am UTC](https://discuss.elastic.co/t/index-pattern-creation-fails-in-7-9-2/271367 "2021-04-28T08:56:07Z")
When we installed Elastic and Kibana on ou Kubernetes environment we have the recurrent issue that on a restart the index-pattern creation fails. It's an old issue that doesn't get solved in the latest release of Elastic… --- ## [Version conflict while restarting cluster node](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484)
**Author:** [@thomasixo](https://discuss.elastic.co/u/thomasixo)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:44am UTC](https://discuss.elastic.co/t/version-conflict-while-restarting-cluster-node/271484 "2021-04-28T08:44:20Z")
Hi, i have an elasticsearch cluster with 4 nodes. I have a datastream with the name "log\_data", which have configured 2 shards and 1 replica. I have a test script, which creates in an endless loop new documents to thi… --- ## [Ilm in elstic cloud does not move the indexes from hot nodes to warm nodes](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 3\ **Last updated:** [April 28, 2021, 8:50am UTC](https://discuss.elastic.co/t/ilm-in-elstic-cloud-does-not-move-the-indexes-from-hot-nodes-to-warm-nodes/271076 "2021-04-28T08:50:28Z")
Hello, I have set ilm rules to move hot indexes to warm indexes and move them into warm node. Now all my indexes are located on the hot nodes and eate up all my disk while the warm node are free and not doing anything h… --- ## [Avoid index ballooning by updates and deletes](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 6\ **Last updated:** [April 28, 2021, 8:43am UTC](https://discuss.elastic.co/t/avoid-index-ballooning-by-updates-and-deletes/271233 "2021-04-28T08:43:48Z")
Hi, I'm struggling with having an index that has some fields that are frequently updated and documents that are deleted. I want to avoid ballooning the index for obvious reasons. I tried to go with freezing the index a… --- ## [Send log filebeat, auditbeat, and winlogbeat](https://discuss.elastic.co/t/send-log-filebeat-auditbeat-and-winlogbeat/271226)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 8\ **Last updated:** [April 28, 2021, 8:42am UTC](https://discuss.elastic.co/t/send-log-filebeat-auditbeat-and-winlogbeat/271226 "2021-04-28T08:42:50Z")
hi guys, since i setting my elk stack with elastic security. and now they have ssl/tls and https but my beats family can't send log again. help me how to config beats so they can send log again. --- ## [Filebeat exclude\_lines is not working on Openshift](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407)
**Author:** [@Ferdous\_Khan](https://discuss.elastic.co/u/Ferdous_Khan)\ **Replies:** 1\ **Last updated:** [April 28, 2021, 8:37am UTC](https://discuss.elastic.co/t/filebeat-exclude-lines-is-not-working-on-openshift/271407 "2021-04-28T08:37:43Z")
Hello, We have this Filebeat (v7.1) configuration on OpenShift Pod that only excludes lines that have 'ACPI' in it: - type: log paths: - /var/log/kern.log enabled: true exclude\_lines: \['AC… --- ## [Create a rule to detect number of beats](https://discuss.elastic.co/t/create-a-rule-to-detect-number-of-beats/270366)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:37am UTC](https://discuss.elastic.co/t/create-a-rule-to-detect-number-of-beats/270366 "2021-04-28T08:37:15Z")
Hello, I would like to create a new rule to detect if one of my beats stop sending data to my Cluster (one rule for each beat). For example I have installed packetbeat in 5 machines, and then the rule will verify each … --- ## [Import dashboard with new ID using API?](https://discuss.elastic.co/t/import-dashboard-with-new-id-using-api/271448)
**Author:** [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Replies:** 4\ **Last updated:** [April 28, 2021, 8:33am UTC](https://discuss.elastic.co/t/import-dashboard-with-new-id-using-api/271448 "2021-04-28T08:33:13Z")
Hi, I want to automatically add dashboards to a space. My dashboard are all the same except for a filter and the title. I was thinking about using the import API and have a script change the filter and title values but… --- ## [Reindex from 2.x to elastic 5.x](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333)
**Author:** [@lmrc](https://discuss.elastic.co/u/lmrc)\ **Replies:** 2\ **Last updated:** [April 28, 2021, 8:24am UTC](https://discuss.elastic.co/t/reindex-from-2-x-to-elastic-5-x/271333 "2021-04-28T08:24:36Z")
Good morning everyone, I am trying to upgrade elasticsearch with graylog to the newest version. Currently I have the elasticsearch indexes in version 1.7, I can read them from elasticsearch 2.x but I need to reindex to … --- ## [Is GCE Discovery still a thing?](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 8:06am UTC](https://discuss.elastic.co/t/is-gce-discovery-still-a-thing/271363 "2021-04-28T08:06:37Z")
Hi there, currently I'm investigating if it was sensible to enable the GCE-discovery in Elasticsearch. According to this (older) thread, there are some hints about documentation and possibly implementation being outdat… --- ## [Unable setup password for 3 nodes cluster](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 8:04am UTC](https://discuss.elastic.co/t/unable-setup-password-for-3-nodes-cluster/271481 "2021-04-28T08:04:44Z")
I use podman to deploy 3 nodes cluster in 3 machines. version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.name=es01 … --- ## [Tooltip on image or shape - canvas](https://discuss.elastic.co/t/tooltip-on-image-or-shape-canvas/271247)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 7\ **Last updated:** [April 28, 2021, 7:48am UTC](https://discuss.elastic.co/t/tooltip-on-image-or-shape-canvas/271247 "2021-04-28T07:48:45Z")
Hello, is it possible to add the tooltip (HTML title attribute) to an image or canvas shape? If so, how? Thank you --- ## [I want to import aws cloudtrail eventTime through logstash](https://discuss.elastic.co/t/i-want-to-import-aws-cloudtrail-eventtime-through-logstash/271479)
**Author:** [@loanshark](https://discuss.elastic.co/u/loanshark)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 7:47am UTC](https://discuss.elastic.co/t/i-want-to-import-aws-cloudtrail-eventtime-through-logstash/271479 "2021-04-28T07:47:57Z")
I want to import aws cloudtrail eventTime through logstash. Works well but fails to get eventTime. my logstash.conf input { s3 { bucket =\> "xxxxx" prefix =\> "xxxxx" sincedb\_path =\> "/etc/logstash/sincedb/… --- ## [Completed handshake with but follow up connection failed](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353)
**Author:** [@overbid](https://discuss.elastic.co/u/overbid)\ **Replies:** 3\ **Last updated:** [April 27, 2021, 11:15am UTC](https://discuss.elastic.co/t/completed-handshake-with-but-follow-up-connection-failed/271353 "2021-04-27T11:15:57Z")
I'm trying to install via podman compose in 3 machines on AWS EC2 version: "3" services: es01: image: docker.elastic.co/elasticsearch/elasticsearch:7.12.0 container\_name: es01 environment: - node.nam… --- ## [Conditional with chinese character in ingest issue](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 0\ **Last updated:** [April 28, 2021, 7:40am UTC](https://discuss.elastic.co/t/conditional-with-chinese-character-in-ingest-issue/271475 "2021-04-28T07:40:02Z")
Elasticsearch 7.12, filebeat get log message then send to elasticsearch. messages with keyword '上报请求信息' include json data, I created ingest with condition try to get these json data, the following is my ingest content. … [Previous page](https://discuss.elastic.co/latest.md?page=1706) [Next page](https://discuss.elastic.co/latest.md?page=1708)