# Latest **URL:** https://discuss.elastic.co/latest.md?page=1884 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1885 --- ## [Enhanced Table Visualization](https://discuss.elastic.co/t/enhanced-table-visualization/255004)
**Author:** [@thuhaa](https://discuss.elastic.co/u/thuhaa)\ **Replies:** 11\ **Last updated:** [January 20, 2021, 9:16am UTC](https://discuss.elastic.co/t/enhanced-table-visualization/255004 "2021-01-20T09:16:01Z")
Hi @fbaligand, I'm very thank you for creating Kibana Enhanced Table Plugin. But I wonder why about the order of columns when I used split cols function. Example: The data of datetime field is 2020-11-05, 2020-11-06,… --- ## [Filbeat not publishing logs to logstash](https://discuss.elastic.co/t/filbeat-not-publishing-logs-to-logstash/261578)
**Author:** [@ranjini](https://discuss.elastic.co/u/ranjini)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 9:13am UTC](https://discuss.elastic.co/t/filbeat-not-publishing-logs-to-logstash/261578 "2021-01-20T09:13:06Z")
filebeat logs 2021-01-19T17:07:14.953Z INFO \[publisher\_pipeline\_output\] pipeline/output.go:151 Connection to backoff(async(tcp://logsrv.example-elk.local:5044)) established 2021-01-19T17:07:14.978Z … --- ## [Understand log4j default strategy](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 9:04am UTC](https://discuss.elastic.co/t/understand-log4j-default-strategy/261622 "2021-01-20T09:04:30Z")
Hello all ! I'm not sure about my understanding of the default Elasticsearch log4j strategy : ######## Server JSON ############################ appender.rolling.type = RollingFile appender.rolling.name = rolling appen… --- ## [Create Kibana saved objects API documentation error](https://discuss.elastic.co/t/create-kibana-saved-objects-api-documentation-error/261582)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 9:01am UTC](https://discuss.elastic.co/t/create-kibana-saved-objects-api-documentation-error/261582 "2021-01-20T09:01:25Z")
Hi, It looks like there is a bug in the documentation for Create saved objects API. If you click on the "Copy as cURL" the copied example has a couple of issues: Missing closing quatation marks after "my-pattern" Dup… --- ## [Pipeline processor to convert nested array to documents while reindexing](https://discuss.elastic.co/t/pipeline-processor-to-convert-nested-array-to-documents-while-reindexing/261547)
**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 8:17am UTC](https://discuss.elastic.co/t/pipeline-processor-to-convert-nested-array-to-documents-while-reindexing/261547 "2021-01-20T08:17:33Z")
Hi Team, Need a solution to take data from source index and have an ingest pipeline to extract data from array in each document of source index as individual document to destination index. e.g. main index data: {… --- ## [I/o timeout filebeat when send data to logstash](https://discuss.elastic.co/t/i-o-timeout-filebeat-when-send-data-to-logstash/261412)
**Author:** [@Eti\_Huri](https://discuss.elastic.co/u/Eti_Huri)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 7:49am UTC](https://discuss.elastic.co/t/i-o-timeout-filebeat-when-send-data-to-logstash/261412 "2021-01-20T07:49:27Z")
Hi all:) I have my logstash vm and my application vm, they don't run in the same subnet I am trying send logs from my vm application to logstash vm this is my filebeat.yml filebeat.inputs: - type: log p… --- ## [Random appear io timeout error: \`Unable to reach APM Server(): Read timed out\`](https://discuss.elastic.co/t/random-appear-io-timeout-error-unable-to-reach-apm-server-read-timed-out/261488)
**Author:** [@Ackerr](https://discuss.elastic.co/u/Ackerr)\ **Replies:** 6\ **Last updated:** [January 20, 2021, 7:47am UTC](https://discuss.elastic.co/t/random-appear-io-timeout-error-unable-to-reach-apm-server-read-timed-out/261488 "2021-01-20T07:47:34Z")
Kibana version: 7.10.1 Elasticsearch version: 7.10.1 APM Server version:7.10.1 APM Agent language and version: apm-agent-python 5.10.1 Browser version: Original install method (e.g. download page, yum, deb, from sou… --- ## [Rolling upgrade: How many times should I flush?](https://discuss.elastic.co/t/rolling-upgrade-how-many-times-should-i-flush/260907)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 13\ **Last updated:** [January 20, 2021, 7:42am UTC](https://discuss.elastic.co/t/rolling-upgrade-how-many-times-should-i-flush/260907 "2021-01-20T07:42:42Z")
If I follow the steps in the Rolling Upgrade docs in the order they're written, it seems to suggest performing a flush for every node I upgrade in my cluster. Is this really necessary, or would performing the flush once… --- ## [Log stash not loading exact number of records in elasticsearch and on every hit results are changing](https://discuss.elastic.co/t/log-stash-not-loading-exact-number-of-records-in-elasticsearch-and-on-every-hit-results-are-changing/261266)
**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 7:07am UTC](https://discuss.elastic.co/t/log-stash-not-loading-exact-number-of-records-in-elasticsearch-and-on-every-hit-results-are-changing/261266 "2021-01-20T07:07:05Z")
Problem statement : Logstash is not loading all records from Database to elasticsearch correctly and everytime I hit same api gets different results (However sometimes correct but changes on every hit and shows only subs… --- ## [Creating Kibana watcher if two field values has been occured more than 2 times in a given interval of time](https://discuss.elastic.co/t/creating-kibana-watcher-if-two-field-values-has-been-occured-more-than-2-times-in-a-given-interval-of-time/260826)
**Author:** [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Replies:** 3\ **Last updated:** [January 20, 2021, 5:17am UTC](https://discuss.elastic.co/t/creating-kibana-watcher-if-two-field-values-has-been-occured-more-than-2-times-in-a-given-interval-of-time/260826 "2021-01-20T05:17:38Z")
Hi , Can anyone please help me on this scenario to create an alert I am having a log events like the following \<#\> 20200806 17:04:23.261 280018000 EV.WRN \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1 \] Failed … --- ## [Metricbeat prometheus module collector metricset escaping](https://discuss.elastic.co/t/metricbeat-prometheus-module-collector-metricset-escaping/261100)
**Author:** [@4orty](https://discuss.elastic.co/u/4orty)\ **Replies:** 4\ **Last updated:** [January 20, 2021, 5:09am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-collector-metricset-escaping/261100 "2021-01-20T05:09:29Z")
Hi, i'm using metricbeat 7.10.1 and i want to get data with prometheus module(golang prometheus client) and send data to kafka output. Here's my yaml file. metricbeat.yml: |- metricbeat.autodiscover: provid… --- ## [Unable to create primary shard in hot-1 and replica shard in hot-2](https://discuss.elastic.co/t/unable-to-create-primary-shard-in-hot-1-and-replica-shard-in-hot-2/261606)
**Author:** [@aris\_lawrence](https://discuss.elastic.co/u/aris_lawrence)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 4:45am UTC](https://discuss.elastic.co/t/unable-to-create-primary-shard-in-hot-1-and-replica-shard-in-hot-2/261606 "2021-01-20T04:45:17Z")
Elasticsearch version 7.7.1 We have the following setup in our elastic environment. 3 master only 2 ingest only 2 hot nodes (hot-1-p1 and hot-2-p1) 2 warm nodes (warm-1-p1 and warm-2-p1) 1 cold node (cold-p1) mast… --- ## [Get total no. of buckets using composite aggregation](https://discuss.elastic.co/t/get-total-no-of-buckets-using-composite-aggregation/261607)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 0\ **Last updated:** [January 20, 2021, 1:25am UTC](https://discuss.elastic.co/t/get-total-no-of-buckets-using-composite-aggregation/261607 "2021-01-20T01:25:37Z")
Is there a way to get total no. of buckets using composite aggregation. I see there's a question asked almost 2 years ago https://discuss.elastic.co/t/composite-aggregation-buckets-total-count/137156/2. Has this changed?… --- ## [How to search with analyzed text](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509)
**Author:** [@Myang\_G](https://discuss.elastic.co/u/Myang_G)\ **Replies:** 2\ **Last updated:** [January 20, 2021, 1:19am UTC](https://discuss.elastic.co/t/how-to-search-with-analyzed-text/261509 "2021-01-20T01:19:35Z")
Hi. I'd like to know if there's a way to use analyzed text when querying. The specific requirement is to search for a matched string in 'term' field && the document's 'term\_length' field should be less than equal to t… --- ## [Metricbeat/K8s: "error getting group status: open /proc/\/cgroup"](https://discuss.elastic.co/t/metricbeat-k8s-error-getting-group-status-open-proc-pid-cgroup/255371)
**Author:** [@jwhitehead](https://discuss.elastic.co/u/jwhitehead)\ **Replies:** 9\ **Last updated:** [January 20, 2021, 1:17am UTC](https://discuss.elastic.co/t/metricbeat-k8s-error-getting-group-status-open-proc-pid-cgroup/255371 "2021-01-20T01:17:18Z")
Running Metricbeat on AKS v1.16.3, seeing the following error in logs: instance/metrics.go:285 error getting group status: open /proc/\/cgroup: no such file or directory" I'm new to beats and, after several hours o… --- ## [Failed to parse date field, date\_time\_parse\_exception](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492)
**Author:** [@yulaika](https://discuss.elastic.co/u/yulaika)\ **Replies:** 6\ **Last updated:** [January 20, 2021, 1:02am UTC](https://discuss.elastic.co/t/failed-to-parse-date-field-date-time-parse-exception/261492 "2021-01-20T01:02:59Z")
Here is my configuration: "\[log\]\[timestamp\]" =\> "%{\[yearinlog\]}-%{\[monthinlog\]}-%{\[dateinlog\]} %{\[hourinlog\]}:%{\[minuteinlog\]}:%{\[secondinlog\]}" } } date { match =\> \[ "\[log\]\[timestamp\]", "yyyy-MM-dd HH:mm:ss.SSS00… --- ## [\_update\_by\_query column.column](https://discuss.elastic.co/t/update-by-query-column-column/261605)
**Author:** [@jcornejo](https://discuss.elastic.co/u/jcornejo)\ **Replies:** 5\ **Last updated:** [January 20, 2021, 12:41am UTC](https://discuss.elastic.co/t/update-by-query-column-column/261605 "2021-01-20T00:41:12Z")
I have this example mapping. I need to update the field "shirt.color" mapping { "shirts" : { "mappings" : { "properties" : { "shirt" : { "properties" : { "brand" : { "type" : "keyword" }, "color" : { "… --- ## [Elasticsearch Engineer 1 - Lab 1.1 no route to host](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-1-no-route-to-host/261601)
**Author:** [@Stef\_Nestor](https://discuss.elastic.co/u/Stef_Nestor)\ **Replies:** 1\ **Last updated:** [January 20, 2021, 12:05am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-1-lab-1-1-no-route-to-host/261601 "2021-01-20T00:05:46Z")
Hi Elastic! I'm having trouble w/the beginning of Elastic Engineer I ondemand training 's Lab 1.1. The steps request However, upon attempting, I cannot ssh into server1 & when attempting to ping get a Destination Hos… --- ## [Is that possible to replace @timestamp during parse data via Filebeat](https://discuss.elastic.co/t/is-that-possible-to-replace-timestamp-during-parse-data-via-filebeat/261500)
**Author:** [@GL\_Choong](https://discuss.elastic.co/u/GL_Choong)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:57pm UTC](https://discuss.elastic.co/t/is-that-possible-to-replace-timestamp-during-parse-data-via-filebeat/261500 "2021-01-19T23:57:03Z")
Would like to get advise from all expert. Currently I\`m working on a project. But having issue on @Timestamp that generated by Kibana is event\_timestamp which expected the timestamp grab from log which example as below … --- ## [Datestamp to @timestamp](https://discuss.elastic.co/t/datestamp-to-timestamp/261604)
**Author:** [@cyberd](https://discuss.elastic.co/u/cyberd)\ **Replies:** 2\ **Last updated:** [January 19, 2021, 11:21pm UTC](https://discuss.elastic.co/t/datestamp-to-timestamp/261604 "2021-01-19T23:21:34Z")
Hi, So i need to parse this date format from my log: 01/19/21-15:00:26.308390 to the @timestamp so i can filter it in Kibana. So far it looks like this: match =\> { "message" =\> "%{DATESTAMP:mystamp} date { m… --- ## [Canvas showing error instead of 0](https://discuss.elastic.co/t/canvas-showing-error-instead-of-0/261068)
**Author:** [@AClerk](https://discuss.elastic.co/u/AClerk)\ **Replies:** 8\ **Last updated:** [January 19, 2021, 11:21pm UTC](https://discuss.elastic.co/t/canvas-showing-error-instead-of-0/261068 "2021-01-19T23:21:03Z")
Hello, I have a query that returns 0 records. The query is also using a filter of "The last 12 hours". I have 0 documents in the index, for the past 2 weeks, so the query is querying NULL(?). SELECT COUNT(DISTINCT uu… --- ## [INITIALIZING shard with REALLOCATED\_REPLICA reason](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590)
**Author:** [@cmusser](https://discuss.elastic.co/u/cmusser)\ **Replies:** 1\ **Last updated:** [January 19, 2021, 11:03pm UTC](https://discuss.elastic.co/t/initializing-shard-with-reallocated-replica-reason/261590 "2021-01-19T23:03:33Z")
Hi, Our 5 node cluster (this is ES 7.10.1 on Ubuntu 18.04) went yellow last night and when we investigated it this morning, there is shard in the INITIALIZING state, with a "reason" of REALLOCATED\_REPLICA. The shard see… --- ## [No master node reported](https://discuss.elastic.co/t/no-master-node-reported/261367)
**Author:** [@Jorge\_Mario\_Montes\_R](https://discuss.elastic.co/u/Jorge_Mario_Montes_R)\ **Replies:** 6\ **Last updated:** [January 19, 2021, 10:38pm UTC](https://discuss.elastic.co/t/no-master-node-reported/261367 "2021-01-19T22:38:13Z")
This is on a cluster on cloud.elastic.co After reducing memory form the master node, I'm unable to get it back running. Logs show: master\_not\_discovered\_exception Tried to reapply the last successful configuration, bu… --- ## [Is it possible to convert input to a scaled float with the covert processor of an ingest node?](https://discuss.elastic.co/t/is-it-possible-to-convert-input-to-a-scaled-float-with-the-covert-processor-of-an-ingest-node/261598)
**Author:** [@kristall](https://discuss.elastic.co/u/kristall)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 10:28pm UTC](https://discuss.elastic.co/t/is-it-possible-to-convert-input-to-a-scaled-float-with-the-covert-processor-of-an-ingest-node/261598 "2021-01-19T22:28:17Z")
is it possible to scale a float while converting? --- ## [Elasticsearch 7.7 - all shards failed and task cancelled with channel closed](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184)
**Author:** [@jamesp](https://discuss.elastic.co/u/jamesp)\ **Replies:** 5\ **Last updated:** [January 19, 2021, 7:57pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-all-shards-failed-and-task-cancelled-with-channel-closed/261184 "2021-01-19T19:57:24Z")
Hello all, I set up a 3 node cluster using the included JRE on Windows 2016 servers with 12 GB RAM (java min/max 6GB) which seemed to be running fine without a lot of traffic. After hooking it up to a search GUI I start… --- ## [Elastic Contributor Program: How to contribute code](https://discuss.elastic.co/t/elastic-contributor-program-how-to-contribute-code/261584)
**Author:** [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-contributor-program-how-to-contribute-code/261584 "2021-01-19T19:31:12Z")
If you are planning to submit code content for the Elastic Contributor Program but don't know how — I created the resources below to help you with this :partying\_face: :page\_facing\_up: Blog : https://www.elastic.co/bl… --- ## [Circuit Breaking Exception](https://discuss.elastic.co/t/circuit-breaking-exception/259405)
**Author:** [@gorek](https://discuss.elastic.co/u/gorek)\ **Replies:** 10\ **Last updated:** [January 19, 2021, 7:06pm UTC](https://discuss.elastic.co/t/circuit-breaking-exception/259405 "2021-01-19T19:06:20Z")
Hello, we using Elasticsearch for a while and we current have few hundred indices with about 120 millions documents in each index. From some days we often see warnings in elasticsearch logs: org.elasticsearch.common.b… --- ## [Cross Cluster Search horizontal scaling](https://discuss.elastic.co/t/cross-cluster-search-horizontal-scaling/261218)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 7\ **Last updated:** [January 19, 2021, 7:02pm UTC](https://discuss.elastic.co/t/cross-cluster-search-horizontal-scaling/261218 "2021-01-19T19:02:16Z")
We have cross cluster search running as a separate cluster with two nodes, and cross cluster search is connected to multiple remote clusters. We have an issue with cross cluster search that all search quires are getting… --- ## [Edit Hardware Profile in Elasticsearch Instance](https://discuss.elastic.co/t/edit-hardware-profile-in-elasticsearch-instance/261562)
**Author:** [@antony\_kavin](https://discuss.elastic.co/u/antony_kavin)\ **Replies:** 3\ **Last updated:** [January 19, 2021, 6:46pm UTC](https://discuss.elastic.co/t/edit-hardware-profile-in-elasticsearch-instance/261562 "2021-01-19T18:46:33Z")
Hi, Is it possible to edit the Hardware Profile Configuration? I would like to change my Hardware Profile from I/O Optimized to Memory Optimized. Is that possible? Thanks, Antony. --- ## [Logstash battle scars - metricbeat config and duplicate output](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581)
**Author:** [@Declan\_at\_rm](https://discuss.elastic.co/u/Declan_at_rm)\ **Replies:** 0\ **Last updated:** [January 19, 2021, 6:14pm UTC](https://discuss.elastic.co/t/logstash-battle-scars-metricbeat-config-and-duplicate-output/261581 "2021-01-19T18:14:47Z")
Not so much a question but just wanted to share some things to look out for. I should start by saying that overall by experience of ELK is good and I'm certainly sticking with it. Just wanted to share a few details of … [Previous page](https://discuss.elastic.co/latest.md?page=1883) [Next page](https://discuss.elastic.co/latest.md?page=1885)