# Latest **URL:** https://discuss.elastic.co/latest.md?page=1847 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1848 --- ## [Sub-queries in KQL Kibana](https://discuss.elastic.co/t/sub-queries-in-kql-kibana/263505)
**Author:** [@Montek\_Singh](https://discuss.elastic.co/u/Montek_Singh)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 11:29pm UTC](https://discuss.elastic.co/t/sub-queries-in-kql-kibana/263505 "2021-02-09T23:29:51Z")
I am using ELK stack to perform some analysis on my data. My index pattern has 2 types of data The ID of the product clicked The ID of the product sold I would like to first find all the IDs sold out and based on that… --- ## [Hour Scripted Field](https://discuss.elastic.co/t/hour-scripted-field/263416)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 10:53pm UTC](https://discuss.elastic.co/t/hour-scripted-field/263416 "2021-02-09T22:53:33Z")
I am trying to create a scripted field that is the hourly value of each document. The ultimate goal is to filter by specific hours of the day for multiple days (hence why I can't just use the date range on the dashboard… --- ## [File storage](https://discuss.elastic.co/t/file-storage/263813)
**Author:** [@Jcroy](https://discuss.elastic.co/u/Jcroy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 10:09pm UTC](https://discuss.elastic.co/t/file-storage/263813 "2021-02-09T22:09:46Z")
Hey everyone, I’m trying figure out the best way to configure a backup solution for 8 nodes. I want to have anything older than 30 days be sent to local file storage. Is the best way to do this to use snapshots? --- ## [Getting bucket size from response](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188)
**Author:** [@araujonelson](https://discuss.elastic.co/u/araujonelson)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:46pm UTC](https://discuss.elastic.co/t/getting-bucket-size-from-response/263188 "2021-02-09T21:46:45Z")
Hello there. Is there any way to get the bucket size (number of buckets) generated from a terms aggregation? I'm using the Java High Level client but couldn't find anything. P.S: What I'm trying to get is the number 3 … --- ## [Logstash Aggregation and IF/Else](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777)
**Author:** [@govind94](https://discuss.elastic.co/u/govind94)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/logstash-aggregation-and-if-else/263777 "2021-02-09T16:57:00Z")
I have SOP named GIS which have 3 jobs and getting 3 events {"jobName":"BIS43683","JobStatus":"COMPLETE","@timestamp":"2020-02-08T23:00:47.958Z","JobSystemStatus":"COMPLETE"} {"jobName":"BIS43595","JobStatus":"COMPLETE… --- ## [Logstash Filter - regez](https://discuss.elastic.co/t/logstash-filter-regez/263806)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 9:33pm UTC](https://discuss.elastic.co/t/logstash-filter-regez/263806 "2021-02-09T21:33:06Z")
Hi, Please help me with the if condition filter in logstash for same KQL querymentioned below. message: \*.url.\* and not \*failover\* Below logstash filter is not working filter{ if (\[message\] != ‘.\\.url\\..’ and \[messa… --- ## [Issue with deserializing MultilineStringGeoShape](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670)
**Author:** [@rckreddy](https://discuss.elastic.co/u/rckreddy)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 9:10pm UTC](https://discuss.elastic.co/t/issue-with-deserializing-multilinestringgeoshape/263670 "2021-02-09T21:10:34Z")
Please see the code below. Results when calling ElasticSearch. "\_source": { "TEST1": 450304485, "TEST2": 1612465007053, "GEOMETRY": { "TYPE": "MultiLineString", "COORDINATES": \[ \[ \[ -83.01273, 39.94391 \], \[ … --- ## [Kibana realm-specific login URL (or another way to pre-select the realm)?](https://discuss.elastic.co/t/kibana-realm-specific-login-url-or-another-way-to-pre-select-the-realm/263533)
**Author:** [@ngrigoriev](https://discuss.elastic.co/u/ngrigoriev)\ **Replies:** 5\ **Last updated:** [February 9, 2021, 9:07pm UTC](https://discuss.elastic.co/t/kibana-realm-specific-login-url-or-another-way-to-pre-select-the-realm/263533 "2021-02-09T21:07:45Z")
Hi! I am trying to define several authc providers/realms in Elastic + Kibana but I do not want my clients to select a realm. Instead, I would like to drive them to a particular one that corresponds to them. Is there a w… --- ## [404 Not found only for filebeat](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 8:05pm UTC](https://discuss.elastic.co/t/404-not-found-only-for-filebeat/258876 "2021-02-09T20:05:09Z")
Hi, We are trying to send our filebeat logs to an elasticsearch cluster but we get this error: 2020-12-16T15:32:37.816+0100 ERROR \[esclientleg\] eslegclient/connection.go:261 error connecting to Elasticsearch a… --- ## [Grok test works - Grok through pipeline doesn't](https://discuss.elastic.co/t/grok-test-works-grok-through-pipeline-doesnt/262867)
**Author:** [@mgevans](https://discuss.elastic.co/u/mgevans)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 8:01pm UTC](https://discuss.elastic.co/t/grok-test-works-grok-through-pipeline-doesnt/262867 "2021-02-09T20:01:28Z")
Hi Folks, I have updated the out-of-the-box Metricbeat IIS module 7.10 pipeline with a slightly different Grok for one of our IIS servers. When I test the Grok it works fine (dev tools and Grok test GUI and Pipeline ed… --- ## [Trying to drop event if mount\_point is /](https://discuss.elastic.co/t/trying-to-drop-event-if-mount-point-is/263798)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [February 9, 2021, 7:32pm UTC](https://discuss.elastic.co/t/trying-to-drop-event-if-mount-point-is/263798 "2021-02-09T19:32:50Z")
I have try all different kind of options but nothing seems to work. anyone has doe this before. how do I do this? processors: - drop\_event.when.equals: system.filesystem.mount\_point: '/' processors: - drop\_event.wh… --- ## [Filebeat HTTP JSON with epochtime](https://discuss.elastic.co/t/filebeat-http-json-with-epochtime/263318)
**Author:** [@seefor](https://discuss.elastic.co/u/seefor)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 7:06pm UTC](https://discuss.elastic.co/t/filebeat-http-json-with-epochtime/263318 "2021-02-09T19:06:21Z")
Can filebeat be configured to pass epoch time every 15 minutes? filebeat.inputs: type: httpjson url: https://api.ipify.org/?format=json&t0=epochtime-15minutes&t1=epochtimenow --- ## [Which is more efficient? KV, Dissect, Split, Grok](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789)
**Author:** [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 6:55pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-kv-dissect-split-grok/263789 "2021-02-09T18:55:38Z")
Hi all, As there are many ways to achive similar goal using logstash filters, would like to discuss and compare between KV, Dissect, Split, and Grok, which is a better way of handling data? Scenario 1: Mapping & Parsi… --- ## [RestHighLevelClient Elastic Search Java Client takes more time for Search Query](https://discuss.elastic.co/t/resthighlevelclient-elastic-search-java-client-takes-more-time-for-search-query/263784)
**Author:** [@nidhi217](https://discuss.elastic.co/u/nidhi217)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 6:32pm UTC](https://discuss.elastic.co/t/resthighlevelclient-elastic-search-java-client-takes-more-time-for-search-query/263784 "2021-02-09T18:32:47Z")
RestHighLevelClient is taking more time for Search Queries and have bad performance.From direct Elastic Search Rest API it is taking less time. How can we optimise the performance for this search request This is the Co… --- ## [Received an event that has a different character encoding than you configured](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 6:32pm UTC](https://discuss.elastic.co/t/received-an-event-that-has-a-different-character-encoding-than-you-configured/263792 "2021-02-09T18:32:01Z")
I have seen several threads related to the same error, but none of them seem to address the issue as we are experiencing it. The messages I get this error for are from ADAudit+ reading logs from an Isilon storage applian… --- ## [Same logstash config file give different result for the same input on different machines](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774)
**Author:** [@Aryaman\_Gupta](https://discuss.elastic.co/u/Aryaman_Gupta)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 6:13pm UTC](https://discuss.elastic.co/t/same-logstash-config-file-give-different-result-for-the-same-input-on-different-machines/263774 "2021-02-09T18:13:57Z")
Hi I have created one logstash conf file but I am running the same config file on two machine, one is mac and other is ubbuntu. For the same input data on my mac I am getting the correct output where as in ubuntu I am g… --- ## [Packetbeat is not sending data to elasticsearch](https://discuss.elastic.co/t/packetbeat-is-not-sending-data-to-elasticsearch/263790)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:50pm UTC](https://discuss.elastic.co/t/packetbeat-is-not-sending-data-to-elasticsearch/263790 "2021-02-09T17:50:15Z")
Hi Guys, I have installed Packetbeat in many servers and it works fine in all of them but i tried use packetbeat in a F5 Load Balancer and it is not working. Packetbeat is not sending http requests (over 10110 port) to… --- ## [Logastash container went down - we did not monitor it](https://discuss.elastic.co/t/logastash-container-went-down-we-did-not-monitor-it/263771)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:48pm UTC](https://discuss.elastic.co/t/logastash-container-went-down-we-did-not-monitor-it/263771 "2021-02-09T17:48:44Z")
Hi there, I had the case that the logstash container (7.8.1) just stopped working and we did not nominitor it. What I would have liked: in the momen it crashed docker should have restarted it from the scratch. Question… --- ## [Do not update sql\_last\_value when an Elastic error is encountered](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788)
**Author:** [@KSmith](https://discuss.elastic.co/u/KSmith)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:46pm UTC](https://discuss.elastic.co/t/do-not-update-sql-last-value-when-an-elastic-error-is-encountered/263788 "2021-02-09T17:46:26Z")
input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/jdbc/${PG\_DRIVER}" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_connection\_string =\> "jdbc:postgresql://${DATABASE\_HOST}… --- ## [Color in vega map visualization](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 6\ **Last updated:** [February 9, 2021, 5:44pm UTC](https://discuss.elastic.co/t/color-in-vega-map-visualization/263565 "2021-02-09T17:44:28Z")
{ "$schema": "https://vega.github.io/schema/vega/v5.json", "description": "A choropleth map depicting U.S. unemployment rates by county in 2009.", "width": 960, "height": 500, "autosize": "none", "data": \[ … --- ## [Logstash/Filebeat is periodically hanging (unresponsive)](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 5:39pm UTC](https://discuss.elastic.co/t/logstash-filebeat-is-periodically-hanging-unresponsive/263199 "2021-02-09T17:39:17Z")
Hi, We are using filebeat as a deamonset on kubernetes nodes to collect all application logs and sending them to logstash and then to elasticsearch. we observe that logs stops working/hangs periodically from some speci… --- ## [TSVB Metric color based on text field and numeric value](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570)
**Author:** [@Chenlrv](https://discuss.elastic.co/u/Chenlrv)\ **Replies:** 1\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/tsvb-metric-color-based-on-text-field-and-numeric-value/263570 "2021-02-09T17:18:36Z")
Hi, I created a TSVB Metric widget that it's purpose is to function as a traffic light - should be red when there's an error in the system, yellow if there's a warning, and green if all is ok. The problem is, I can't… --- ## [Kibana service not running](https://discuss.elastic.co/t/kibana-service-not-running/263470)
**Author:** [@srcarter](https://discuss.elastic.co/u/srcarter)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:18pm UTC](https://discuss.elastic.co/t/kibana-service-not-running/263470 "2021-02-09T17:18:19Z")
Hi there, I recently had our IT build me a new computer that I am dedicating for a simple elasticsearch/kibana machine. I had previously built my own machine for the same purpose and was successful, that machine was ru… --- ## [Kibana console code 44 trying to get \_souce timestamp](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649)
**Author:** [@Chris6](https://discuss.elastic.co/u/Chris6)\ **Replies:** 0\ **Last updated:** [February 8, 2021, 7:10pm UTC](https://discuss.elastic.co/t/kibana-console-code-44-trying-to-get-souce-timestamp/263649 "2021-02-08T19:10:44Z")
I am getting: unexpected character (',' (code 44)): was expecting a colon to seperate field name and value\\n at \[Source: org.elasticsearch.transport. netty4.ByteBufStreamInput@249c1586; line: 3, column:28\]" I am using … --- ## [Index ".async\_search" size growing fast](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788)
**Author:** [@parallelism](https://discuss.elastic.co/u/parallelism)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 5:04pm UTC](https://discuss.elastic.co/t/index-async-search-size-growing-fast/261788 "2021-02-09T17:04:17Z")
Hello everyone, On a Elasticsearch and Kibana cluster that is monitoring another Elasticsearch cluster, we found that the size of the ".async\_search" index on the monitoring cluster is growing fast (about 2GB in only on… --- ## [Time Duration difference calculation in Logstash](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599)
**Author:** [@Rebin](https://discuss.elastic.co/u/Rebin)\ **Replies:** 7\ **Last updated:** [February 9, 2021, 5:01pm UTC](https://discuss.elastic.co/t/time-duration-difference-calculation-in-logstash/263599 "2021-02-09T17:01:43Z")
Hi All, i'm trying to calculate the time difference between 2 dates. I'm capturing the data through jdbc Input "opentime" : "2020-11-01T11:42:59.000Z", "resolvedtime" : "2020-11-02T22:38:37.000Z", Code filter { date… --- ## [Uninstall Filebeat on Ubuntu](https://discuss.elastic.co/t/uninstall-filebeat-on-ubuntu/263746)
**Author:** [@Liora](https://discuss.elastic.co/u/Liora)\ **Replies:** 4\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/uninstall-filebeat-on-ubuntu/263746 "2021-02-09T16:57:57Z")
Hi Team, please how can i uninstall Filebeat from my Ubuntu Server? Thank you for the reply --- ## [Not able to use insert sql query in jdbc\_streaming filter](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725)
**Author:** [@Melvin\_Shaju](https://discuss.elastic.co/u/Melvin_Shaju)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:57pm UTC](https://discuss.elastic.co/t/not-able-to-use-insert-sql-query-in-jdbc-streaming-filter/263725 "2021-02-09T16:57:37Z")
When I tried to insert some in local mysql using jdbc\_streaming filter, it is showing following error. But no error is shown for select statements. Ruby-0-Thread-12@\[main\]\>worker6: :1\] jdbcstreaming - Exception when exe… --- ## [Split FQDN](https://discuss.elastic.co/t/split-fqdn/263773)
**Author:** [@Dan\_L](https://discuss.elastic.co/u/Dan_L)\ **Replies:** 2\ **Last updated:** [February 9, 2021, 4:54pm UTC](https://discuss.elastic.co/t/split-fqdn/263773 "2021-02-09T16:54:53Z")
I'm trying to split an FQDN to get the base server name. Currently, the FQDN is stored in "server", so I'd like to split "server" on "." and get the name. Additionally, sometimes the server may not be the FQDN, so it'd … --- ## [Filebeat K8S pod keeps restarting and Logs stop getting to Kibana](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476)
**Author:** [@yimengael](https://discuss.elastic.co/u/yimengael)\ **Replies:** 3\ **Last updated:** [February 9, 2021, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-k8s-pod-keeps-restarting-and-logs-stop-getting-to-kibana/263476 "2021-02-09T16:41:37Z")
Hello, I have configured Filebeat on my Kubernetes cluster and it is running in a kubernetes pod. Sometimes I noticed that Filebeat stopped collecting logs and the pods where filebeat is installed keeps restarting. I i… [Previous page](https://discuss.elastic.co/latest.md?page=1846) [Next page](https://discuss.elastic.co/latest.md?page=1848)