# Latest **URL:** https://discuss.elastic.co/latest.md?page=1731 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1732 --- ## [Winlogbeats path based on date](https://discuss.elastic.co/t/winlogbeats-path-based-on-date/270161)
**Author:** [@witkacy](https://discuss.elastic.co/u/witkacy)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 8:35am UTC](https://discuss.elastic.co/t/winlogbeats-path-based-on-date/270161 "2021-04-15T08:35:04Z")
Hello, Is it possible put result logs to file/folder with name based on actual time? So that for each day I would have separate folder with logs like c:/tmp/20210415/logFile1... c:/tmp/20210416/logFile1... c:/tmp/20… --- ## [Timeouts on shard relocations and overhead on garbage collection](https://discuss.elastic.co/t/timeouts-on-shard-relocations-and-overhead-on-garbage-collection/269996)
**Author:** [@Tony79](https://discuss.elastic.co/u/Tony79)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 8:16am UTC](https://discuss.elastic.co/t/timeouts-on-shard-relocations-and-overhead-on-garbage-collection/269996 "2021-04-15T08:16:26Z")
Hi, In my setup of Elasticsearch cluster version 6.8 i've had big problems with handling the huge amount of indices and shards related to this. We use a frontend application from a third-party vendor so we have very li… --- ## [How to keep \`selected fields\` fixed](https://discuss.elastic.co/t/how-to-keep-selected-fields-fixed/269853)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 8:15am UTC](https://discuss.elastic.co/t/how-to-keep-selected-fields-fixed/269853 "2021-04-15T08:15:50Z")
When you check log items from Kibana, you can fix the items with selected fields. This setting is very useful, but it gets lost when you close your browser. Is there a way to keep this? --- ## [FILEBEAT module Fortinet : Provided Grok expressions do not match field value](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 9\ **Last updated:** [April 15, 2021, 8:12am UTC](https://discuss.elastic.co/t/filebeat-module-fortinet-provided-grok-expressions-do-not-match-field-value/269986 "2021-04-15T08:12:37Z")
Hello, I send fortigate logs via rsylog on /var/log/fortigate\* files. I 've configured filebeat with fortinet module. On kibana, i get this : Provided Grok expressions do not match field value It was working with udp… --- ## [Prevent dashboard from displaying data until value is specified in control?](https://discuss.elastic.co/t/prevent-dashboard-from-displaying-data-until-value-is-specified-in-control/270195)
**Author:** [@GrahamHannington](https://discuss.elastic.co/u/GrahamHannington)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:44am UTC](https://discuss.elastic.co/t/prevent-dashboard-from-displaying-data-until-value-is-specified-in-control/270195 "2021-04-15T07:44:05Z")
I have a control that selects "job name". I'd prefer for the dashboard to "wait" until the user has selected a value from that control. Is that possible in Kibana? --- ## [Top hits does not work with significant text aggregation](https://discuss.elastic.co/t/top-hits-does-not-work-with-significant-text-aggregation/270188)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 7:33am UTC](https://discuss.elastic.co/t/top-hits-does-not-work-with-significant-text-aggregation/270188 "2021-04-15T07:33:20Z")
Is there any workaround for getting the original documents based on the buckets for a significant text aggregation ? The solution outlined here does not work for "significant text" How to get documents from the buckets… --- ## [Must\_not is not excluding results when used in query](https://discuss.elastic.co/t/must-not-is-not-excluding-results-when-used-in-query/270194)
**Author:** [@M\_Gibbs](https://discuss.elastic.co/u/M_Gibbs)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 7:24am UTC](https://discuss.elastic.co/t/must-not-is-not-excluding-results-when-used-in-query/270194 "2021-04-15T07:24:27Z")
Hi all, Having some issues, this is my query below. I'm returning results, but the must\_not section is not succesfully removing results. It's narrowing, to include the word developer. So I'm getting results with web des… --- ## [Query\_string with wildcard](https://discuss.elastic.co/t/query-string-with-wildcard/270061)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 6:57am UTC](https://discuss.elastic.co/t/query-string-with-wildcard/270061 "2021-04-15T06:57:53Z")
I am having latest ES and set a field in mapping to keyword and index: true. I need to use wildcard so this example from your web is perfect match: { "query": { "query\_string" : { "query" : … --- ## [Restart elasticseach master overriding some index template](https://discuss.elastic.co/t/restart-elasticseach-master-overriding-some-index-template/270187)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 6:47am UTC](https://discuss.elastic.co/t/restart-elasticseach-master-overriding-some-index-template/270187 "2021-04-15T06:47:00Z")
We have faced some weird issue. restarting master node overriding alias name in index template. we have an three master and couple of data nodes index\_template before restart master node. "aliases" : { "pmetrics-mobi… --- ## [Metricbeat 7.12 cpu usage always zero](https://discuss.elastic.co/t/metricbeat-7-12-cpu-usage-always-zero/270192)
**Author:** [@Chandler-Bin](https://discuss.elastic.co/u/Chandler-Bin)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/metricbeat-7-12-cpu-usage-always-zero/270192 "2021-04-15T06:43:01Z")
Testing metricbeat 7.12, I got cpu usage always 0. (memory usage is correct). The metricbeat is running on Windows 2019 and CentOS 7.9 . (both are hyper-v VM) Any idea? --- ## [Filebeat error](https://discuss.elastic.co/t/filebeat-error/270189)
**Author:** [@keerthi\_s](https://discuss.elastic.co/u/keerthi_s)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 6:38am UTC](https://discuss.elastic.co/t/filebeat-error/270189 "2021-04-15T06:38:07Z")
filebeat\[18723\]: 2021-04-15T02:02:54.874-0400 ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://xx.xx.xx.xx:9200)): Get "https://xx.xx… --- ## [Generate custom reports for each customer in Kibana Canvas](https://discuss.elastic.co/t/generate-custom-reports-for-each-customer-in-kibana-canvas/270148)
**Author:** [@Eivind\_Vinsand](https://discuss.elastic.co/u/Eivind_Vinsand)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 4:27am UTC](https://discuss.elastic.co/t/generate-custom-reports-for-each-customer-in-kibana-canvas/270148 "2021-04-15T04:27:07Z")
Hi! I have made a report in Kibana Canvas where I have calculated four metrics. Now I want to generate 100 versions of this report, one for each customer. This means I have to recalculate the metrics for each customer i… --- ## [Customized Data Table in Kibana](https://discuss.elastic.co/t/customized-data-table-in-kibana/270122)
**Author:** [@priya\_singh](https://discuss.elastic.co/u/priya_singh)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:20am UTC](https://discuss.elastic.co/t/customized-data-table-in-kibana/270122 "2021-04-15T04:20:49Z")
HI Team , This is Priya here i am new to ELK , Please help me to create the cusomized data table as per my requirement . I have created the data table with lens via visualize library and tried to add the some code as … --- ## [Multi PFsense - howto configure this](https://discuss.elastic.co/t/multi-pfsense-howto-configure-this/270172)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:55am UTC](https://discuss.elastic.co/t/multi-pfsense-howto-configure-this/270172 "2021-04-15T03:55:35Z")
Hi Forum I'm quite new to the ELK solution, but learns every day :slight\_smile: We have a setup with several PF-Sense Routers that I would like get overview over. I have followed this guide : GitHub - patrickjennings/… --- ## [Packetbeat data is reverse](https://discuss.elastic.co/t/packetbeat-data-is-reverse/270171)
**Author:** [@ARDiver86](https://discuss.elastic.co/u/ARDiver86)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:16am UTC](https://discuss.elastic.co/t/packetbeat-data-is-reverse/270171 "2021-04-15T03:16:22Z")
I'm noticing that a lot of data coming in from Packetbeat (if not all) is in reverse as far as traffic direction. For example we have a web server nat through a Fortigate firewall for port 443. Packetbeat is reporting th… --- ## [Возможно ли сделать экспорт/импорт всех темплейтов индексов?](https://discuss.elastic.co/t/topic/270157)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 12:26am UTC](https://discuss.elastic.co/t/topic/270157 "2021-04-15T00:26:09Z")
Добрый день! Я могу загрузить все темплейты вот так: GET \_template но есть ли возможность потом все разом их импортировать в другой кластер? Есть ли такая возможность, по аналогии с экспортом/импортом объектов кибаны… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/270120)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 11:23pm UTC](https://discuss.elastic.co/t/multiple-pipelines/270120 "2021-04-14T23:23:41Z")
here only the first pipelines that logstash execute and the second is not, here both pipelines listen on the same port so can somebody helps me for running the 2 pipelines regards --- ## [How to create a single document with fields from multi documents](https://discuss.elastic.co/t/how-to-create-a-single-document-with-fields-from-multi-documents/270141)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 11:29pm UTC](https://discuss.elastic.co/t/how-to-create-a-single-document-with-fields-from-multi-documents/270141 "2021-04-14T23:29:48Z")
Hi, I have 4 documents with the below fields {sessionid :1, callid:0001, service: 001} {sessionid :1, state:login, city: hyderabad} {sessionid :1, state:login, service:002} {sessionid :1, state:logout, handset: mobi… --- ## [Multiple roots and Ambiguous error in vega tree layout](https://discuss.elastic.co/t/multiple-roots-and-ambiguous-error-in-vega-tree-layout/270132)
**Author:** [@Ashvin\_Bhutekar](https://discuss.elastic.co/u/Ashvin_Bhutekar)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 4:51pm UTC](https://discuss.elastic.co/t/multiple-roots-and-ambiguous-error-in-vega-tree-layout/270132 "2021-04-14T16:51:45Z")
I am creating vega tree flow using dynamic data from the index pattern. As I am using 'URL' and 'nexturl' field in the index pattern which gets repeated many times (One child referring to many parents). Tree layout is c… --- ## [Logstash jdbc - unnable to connect to database - plugin restart](https://discuss.elastic.co/t/logstash-jdbc-unnable-to-connect-to-database-plugin-restart/269959)
**Author:** [@g34ncarlo](https://discuss.elastic.co/u/g34ncarlo)\ **Replies:** 3\ **Last updated:** [April 14, 2021, 10:26pm UTC](https://discuss.elastic.co/t/logstash-jdbc-unnable-to-connect-to-database-plugin-restart/269959 "2021-04-14T22:26:24Z")
We're running Logstash with jdbc plugin as a Kubernetes cron job. Due to some network problem, eventually it cannot connect to database: \[ERROR\]\[logstash.inputs.jdbc \] Unable to connect to database. Tried 1 times {:… --- ## [SIEM Detection rule reload](https://discuss.elastic.co/t/siem-detection-rule-reload/270045)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 10:07pm UTC](https://discuss.elastic.co/t/siem-detection-rule-reload/270045 "2021-04-14T22:07:21Z")
Due to a rather nasty upgrade that resulted in a bugs. One of which is every SIEM rule no longer works each one has a different reason so going 1 by 1 isn't really an option. Is it possible to wipe and reload all rules … --- ## [Dynamic mapping strict to true](https://discuss.elastic.co/t/dynamic-mapping-strict-to-true/269912)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [April 14, 2021, 9:41pm UTC](https://discuss.elastic.co/t/dynamic-mapping-strict-to-true/269912 "2021-04-14T21:41:30Z")
I have a index template that I define with strict dynamic mapping. Now I would like to add a field I have remove template, recreated with dynamic=true but it still gives me error on adding field 'error': {'type': 'stri… --- ## [Kibana 7.12 Discover: Document JSON view displays nested values separately and unsorted](https://discuss.elastic.co/t/kibana-7-12-discover-document-json-view-displays-nested-values-separately-and-unsorted/270110)
**Author:** [@sandbender](https://discuss.elastic.co/u/sandbender)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 6:25pm UTC](https://discuss.elastic.co/t/kibana-7-12-discover-document-json-view-displays-nested-values-separately-and-unsorted/270110 "2021-04-14T18:25:25Z")
Hello, After upgrading to Kibana v7.12.0, in Discover, fields of documents displayed in JSON view are unsorted and not visibly collected in the objects they are stored in. That's a pain in the ass when trying to grasp t… --- ## [Events Per Second Visualization](https://discuss.elastic.co/t/events-per-second-visualization/270129)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 5:59pm UTC](https://discuss.elastic.co/t/events-per-second-visualization/270129 "2021-04-14T17:59:10Z")
I'm trying to create a metric for events per second, but not really sure how to do it. I saw one example that seems to get close, but when I manually do the math, it's a little off. The visualization configuration belo… --- ## [Full logstash queue](https://discuss.elastic.co/t/full-logstash-queue/270136)
**Author:** [@d4nnyx](https://discuss.elastic.co/u/d4nnyx)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 5:38pm UTC](https://discuss.elastic.co/t/full-logstash-queue/270136 "2021-04-14T17:38:48Z")
Hello there, since Im running our Elastic Stack, I have a problem with persistent queues, which time to time gets full from unknown reason. Elasticsearch setup: 3 master nodes 12 data nodes 32CPU 32GB RAM avg index … --- ## [Terms Lookup on Ip fields and the too\_many\_clauses: maxClauseCount issue](https://discuss.elastic.co/t/terms-lookup-on-ip-fields-and-the-too-many-clauses-maxclausecount-issue/270130)
**Author:** [@Giovanni\_Bismondo](https://discuss.elastic.co/u/Giovanni_Bismondo)\ **Replies:** 0\ **Last updated:** [April 14, 2021, 4:17pm UTC](https://discuss.elastic.co/t/terms-lookup-on-ip-fields-and-the-too-many-clauses-maxclausecount-issue/270130 "2021-04-14T16:17:31Z")
Hi, I'm trying to make a query with Terms Lookup to filter an index by ip addresses included in an array (of another document in another index). I get the too\_many\_clauses: maxClauseCount issue, but I found in question… --- ## [Merge message with aggregate filter](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115)
**Author:** [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Replies:** 9\ **Last updated:** [April 14, 2021, 3:14pm UTC](https://discuss.elastic.co/t/merge-message-with-aggregate-filter/269115 "2021-04-14T15:14:14Z")
Hi, I am trying to merge 2 log lines with the aggregate filter and after a week browsing the internet and this forum I still cannot get this working. Below you have 2 loglines with an identifier ExchangeId. What I wan… --- ## [Unable to load more than 30000 fields into index pattern](https://discuss.elastic.co/t/unable-to-load-more-than-30000-fields-into-index-pattern/270088)
**Author:** [@TomasK](https://discuss.elastic.co/u/TomasK)\ **Replies:** 2\ **Last updated:** [April 14, 2021, 3:02pm UTC](https://discuss.elastic.co/t/unable-to-load-more-than-30000-fields-into-index-pattern/270088 "2021-04-14T15:02:48Z")
Hi everybody! I have index pattern let's say myindex\_\* which includes many other indexes like: myindex\_client1\_\* myindex\_client2\_\* myindex\_client3\_\* myindex\_client4\_\* etc... the indexes like myindex\_clientN\_\* have ab… --- ## [Usage of Winlogbeat on Linux / Parse plaintext windows events files](https://discuss.elastic.co/t/usage-of-winlogbeat-on-linux-parse-plaintext-windows-events-files/270113)
**Author:** [@GeorgeGkinis](https://discuss.elastic.co/u/GeorgeGkinis)\ **Replies:** 1\ **Last updated:** [April 14, 2021, 2:52pm UTC](https://discuss.elastic.co/t/usage-of-winlogbeat-on-linux-parse-plaintext-windows-events-files/270113 "2021-04-14T14:52:13Z")
We have the need to run winlogbeat on Linux. I see that there are no precompiled binaries for Linux which is somewhat understandable. In our usecase winlog events are transported via syslog to a linux VM. There parsin… --- ## [Logstash Event Size](https://discuss.elastic.co/t/logstash-event-size/269972)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [April 14, 2021, 2:43pm UTC](https://discuss.elastic.co/t/logstash-event-size/269972 "2021-04-14T14:43:58Z")
Hi, Can anyone tell me how I can get the size of an entire event using the ruby filter please? Thx D [Previous page](https://discuss.elastic.co/latest.md?page=1730) [Next page](https://discuss.elastic.co/latest.md?page=1732)