# Latest **URL:** https://discuss.elastic.co/latest.md?page=1900 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1901 --- ## [Inconsistent results for the same query on an index with 0 replicas](https://discuss.elastic.co/t/inconsistent-results-for-the-same-query-on-an-index-with-0-replicas/258715)
**Author:** [@Marten](https://discuss.elastic.co/u/Marten)\ **Replies:** 6\ **Last updated:** [January 11, 2021, 4:28pm UTC](https://discuss.elastic.co/t/inconsistent-results-for-the-same-query-on-an-index-with-0-replicas/258715 "2021-01-11T16:28:00Z")
Hi there, I have a problem with inconsistent ranking of the results when submitting the same query multiple times. I'm using ES 5.6.8 on an index with 5 primary shards. I have set the number of replicas from 1 to 0 to… --- ## [Fresh Install if ELK 7.10 floods deprecation log](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259972)
**Author:** [@JSylvia007](https://discuss.elastic.co/u/JSylvia007)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 4:20pm UTC](https://discuss.elastic.co/t/fresh-install-if-elk-7-10-floods-deprecation-log/259972 "2021-01-11T16:20:11Z")
Originally posted here: Fresh Install if ELK 7.10 floods deprecation log and at the recommendation of @DavidTurner creating a new post here... A fresh install of ELK 7.10 fills the deprecation log once Kibana is install… --- ## [Pie chart in vega](https://discuss.elastic.co/t/pie-chart-in-vega/260373)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 8\ **Last updated:** [January 11, 2021, 4:10pm UTC](https://discuss.elastic.co/t/pie-chart-in-vega/260373 "2021-01-11T16:10:09Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "description": "A simple pie chart with labels.", "data": { "values": \[ {"category": "a", "value": 4}, {"category": "a", "value": 4},… --- ## ["is one of" filter when filtering on tooltip Map](https://discuss.elastic.co/t/is-one-of-filter-when-filtering-on-tooltip-map/260617)
**Author:** [@ErikvdVen](https://discuss.elastic.co/u/ErikvdVen)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 3:50pm UTC](https://discuss.elastic.co/t/is-one-of-filter-when-filtering-on-tooltip-map/260617 "2021-01-11T15:50:45Z")
I have a dashboard, containing a Map visualization. I can add different "tooltip fields", so I could set a filter for example, but this only contains a "is" filter. Can I set a "is one of" filter as well? Example of suc… --- ## [Convert key value pair into hash](https://discuss.elastic.co/t/convert-key-value-pair-into-hash/260691)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 3:41pm UTC](https://discuss.elastic.co/t/convert-key-value-pair-into-hash/260691 "2021-01-11T15:41:22Z")
I have a field p1 with the value as partition=root,size=23.28GB,free=15.76GB p1 : partition=root,size=23.28GB,free=15.76GB I want to store this in an array field and the values in a hash, like below. \[partition\]\[root… --- ## [Vega: Collecting data from a visualization data table](https://discuss.elastic.co/t/vega-collecting-data-from-a-visualization-data-table/260724)
**Author:** [@nikita\_zaliven](https://discuss.elastic.co/u/nikita_zaliven)\ **Replies:** 18\ **Last updated:** [January 11, 2021, 3:37pm UTC](https://discuss.elastic.co/t/vega-collecting-data-from-a-visualization-data-table/260724 "2021-01-11T15:37:05Z")
Hello, Using a dashboard, I have one visualization which is a data table. I am trying to figure out if and how it is possible with Vega to load a specific column from the data table in order to use it with another data… --- ## [Issue in import csv functionality with timestamp field contains spaces and kommas](https://discuss.elastic.co/t/issue-in-import-csv-functionality-with-timestamp-field-contains-spaces-and-kommas/260584)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 3:33pm UTC](https://discuss.elastic.co/t/issue-in-import-csv-functionality-with-timestamp-field-contains-spaces-and-kommas/260584 "2021-01-11T15:33:41Z")
Hello, Kibana 7.10.1. Tried to use the import csv functionality and for some reason is the first colomn header replaced by a value with a front and end space.. Seem like a bug? The csv was exported from Excel. Als… --- ## [Reverse proxy using nginx to a specific dashboard](https://discuss.elastic.co/t/reverse-proxy-using-nginx-to-a-specific-dashboard/260580)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 3:14pm UTC](https://discuss.elastic.co/t/reverse-proxy-using-nginx-to-a-specific-dashboard/260580 "2021-01-11T15:14:18Z")
Hello, I am a bit green in setting up a reverse proxy using nginx and I was hoping someone would help me with the following: The following is my simple configuration (please suggest more directives if I should include … --- ## [Apply internal controls visualization](https://discuss.elastic.co/t/apply-internal-controls-visualization/260731)
**Author:** [@nikita\_zaliven](https://discuss.elastic.co/u/nikita_zaliven)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 3:13pm UTC](https://discuss.elastic.co/t/apply-internal-controls-visualization/260731 "2021-01-11T15:13:52Z")
Hello, I was wondering if and how it is possible to select a certain field filter, and have it only filter the option fields inside the controls visualization? For example, by selecting field of option 1, fields of opt… --- ## [Logstash io.netty.util.internal.OutOfDirectMemoryError: failed to allocate 16777216 byte(s) of direct memory (used: 12766298444, max: 12771524608)](https://discuss.elastic.co/t/logstash-io-netty-util-internal-outofdirectmemoryerror-failed-to-allocate-16777216-byte-s-of-direct-memory-used-12766298444-max-12771524608/260067)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 6\ **Last updated:** [January 11, 2021, 3:09pm UTC](https://discuss.elastic.co/t/logstash-io-netty-util-internal-outofdirectmemoryerror-failed-to-allocate-16777216-byte-s-of-direct-memory-used-12766298444-max-12771524608/260067 "2021-01-11T15:09:26Z")
Hi All, We are using Logstash 6.3.1 and recently we have been facing issues with getting the log flowing from Filebeat agents. Attaching the configuration and log samples. We have increased the heap memory from 4GB to … --- ## [Dissect filter mapping](https://discuss.elastic.co/t/dissect-filter-mapping/260705)
**Author:** [@ashok9177](https://discuss.elastic.co/u/ashok9177)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 3:08pm UTC](https://discuss.elastic.co/t/dissect-filter-mapping/260705 "2021-01-11T15:08:25Z")
Hi, I want extract only one field after \[HOT\_KV\_LOG\] from the below log message with dissect filter, anyone help me \[HOT\_KV\_LOG\] \[msg\_process\] level\_\_keyword="INFO" type\_\_keyword="MESSAGE\_PROCESSED" e2e\_latency\_\_number… --- ## [How to find sum of unique counts when creating a table using discover?](https://discuss.elastic.co/t/how-to-find-sum-of-unique-counts-when-creating-a-table-using-discover/260545)
**Author:** [@learnkibana](https://discuss.elastic.co/u/learnkibana)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 3:04pm UTC](https://discuss.elastic.co/t/how-to-find-sum-of-unique-counts-when-creating-a-table-using-discover/260545 "2021-01-11T15:04:25Z")
So I created a table using the visualisation console and I managed to get the unique values of the patent IDs. However, I am unable to find the total amount of unique patentIDs. Is there a way I can sum all the 'Unique… --- ## [OpenmapTiles in Vega During Offline Mode](https://discuss.elastic.co/t/openmaptiles-in-vega-during-offline-mode/260477)
**Author:** [@gerardo\_dutan](https://discuss.elastic.co/u/gerardo_dutan)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 2:58pm UTC](https://discuss.elastic.co/t/openmaptiles-in-vega-during-offline-mode/260477 "2021-01-11T14:58:34Z")
Hello, I'm currently deploying the stack in an offline environment and am having issues with generating a map based visualization in vega. I'm using the standard config reference in the vega script to pull up a map, work… --- ## [Unable to revive connection: http://localhost:9200 with Docker](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200-with-docker/260726)
**Author:** [@gcio](https://discuss.elastic.co/u/gcio)\ **Replies:** 9\ **Last updated:** [January 11, 2021, 2:54pm UTC](https://discuss.elastic.co/t/unable-to-revive-connection-http-localhost-9200-with-docker/260726 "2021-01-11T14:54:17Z")
Hi everyone, I'm starting a docker container as follows docker run -d --rm --name ejq-elk -v $PWD:/var/backups -p 5601:5601 sebp/elk:7.10.0 However, this returns a connection error ==\> /var/log/kibana/kibana5.log \<==… --- ## [Endpoint Security agents online but not sending any logs](https://discuss.elastic.co/t/endpoint-security-agents-online-but-not-sending-any-logs/260618)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 2:29pm UTC](https://discuss.elastic.co/t/endpoint-security-agents-online-but-not-sending-any-logs/260618 "2021-01-11T14:29:51Z")
Hello, I hope this message finds you healthy and safe. I am trying to gather logs through Elastic Endpoint Security. I can see the agents online and heartbeats with payload: \`\` { "endpoint-security": { "@timestamp"… --- ## [Duplicate winlogbeat index patterns](https://discuss.elastic.co/t/duplicate-winlogbeat-index-patterns/260620)
**Author:** [@craign30](https://discuss.elastic.co/u/craign30)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 2:14pm UTC](https://discuss.elastic.co/t/duplicate-winlogbeat-index-patterns/260620 "2021-01-11T14:14:48Z")
I'm running Elastic, Kibana, and Winlogbeat 7.8 on a single server with Winlogbeat on my clients, as well. Everything is currently working properly, but I noticed duplicate winlogbeat-\* index patterns in Kibana. The de… --- ## [Aggregation problem with timeseries - terms / sum](https://discuss.elastic.co/t/aggregation-problem-with-timeseries-terms-sum/260729)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 2:08pm UTC](https://discuss.elastic.co/t/aggregation-problem-with-timeseries-terms-sum/260729 "2021-01-11T14:08:13Z")
Hi, I'm collecting metrics of my cluster via prometheus and metricbeat. Documents received are timeseries. That's mean I have multiple document for the same timestamp. Each 10s I have a list of all index with their con… --- ## [Does Line panel support the Filter Ratio metric aggregation?](https://discuss.elastic.co/t/does-line-panel-support-the-filter-ratio-metric-aggregation/260585)
**Author:** [@larrya](https://discuss.elastic.co/u/larrya)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 2:06pm UTC](https://discuss.elastic.co/t/does-line-panel-support-the-filter-ratio-metric-aggregation/260585 "2021-01-11T14:06:30Z")
I like the format of the Line visualization better than the TSVB visualization because the overall style of the Line panel is more appealing. However, the Line panel does not support the Filter Ratio metric aggregation, … --- ## [High cpu usage 100% on elastic search servers](https://discuss.elastic.co/t/high-cpu-usage-100-on-elastic-search-servers/260442)
**Author:** [@ghl1l0](https://discuss.elastic.co/u/ghl1l0)\ **Replies:** 5\ **Last updated:** [January 11, 2021, 1:41pm UTC](https://discuss.elastic.co/t/high-cpu-usage-100-on-elastic-search-servers/260442 "2021-01-11T13:41:12Z")
Hello, I've a problem with elastic search that it use100% of CPU; with ES 7.9.3.: 3 nodes. 6 CPU(s) -Xms8g -Xmx8g Kibana run slowly and nodes states is yellow ! Thanks for helping Regards, Rali --- ## [My ELK Cluster is slow indexing Why? Please Help](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542)
**Author:** [@HKN\_MZ](https://discuss.elastic.co/u/HKN_MZ)\ **Replies:** 5\ **Last updated:** [January 11, 2021, 1:39pm UTC](https://discuss.elastic.co/t/my-elk-cluster-is-slow-indexing-why-please-help/260542 "2021-01-11T13:39:34Z")
I am trying to send data to Elasticsearch, but elasticsearch indexing is soo slow. Some usefull outputs on below. GET \_/nodes/hot\_threads?pretty is the output; GET \_cluster/stats is the output; --- ## [Filebeat Azure module](https://discuss.elastic.co/t/filebeat-azure-module/256771)
**Author:** [@Marco0101](https://discuss.elastic.co/u/Marco0101)\ **Replies:** 1\ **Last updated:** [January 11, 2021, 1:05pm UTC](https://discuss.elastic.co/t/filebeat-azure-module/256771 "2021-01-11T13:05:41Z")
Hi, i would like to know if the activitylogs - auditlogs can only be used for Azure AD audit events or that it is also possible to use it for keyvault audit logging also. Because we built an eventhub and pass the keyvaul… --- ## [Kibana training](https://discuss.elastic.co/t/kibana-training/260710)
**Author:** [@klokkie](https://discuss.elastic.co/u/klokkie)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:56pm UTC](https://discuss.elastic.co/t/kibana-training/260710 "2021-01-11T12:56:39Z")
Hi I am doing the kibana training and I am working on chapter 4.2. Data Analysis with Kibana (On-Demand) ID: E-Z1GD4 I see since jan. 8/9 no data is coming in for the apachelogs indices. Could you check whats wrong h… --- ## [Painless script error](https://discuss.elastic.co/t/painless-script-error/260709)
**Author:** [@Andreas\_Amundsen](https://discuss.elastic.co/u/Andreas_Amundsen)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:45pm UTC](https://discuss.elastic.co/t/painless-script-error/260709 "2021-01-11T12:45:54Z")
Hi, I'm trying to create a scripted field with the simple painless-code bellow. Math.round((doc\['CRC\_OK'\].value / doc\['NR\_UWs'\].value)\*100)/100.0 Everything seems to be working when I preview the code: When I open the… --- ## [Make use of http.request.headers.Origin in kibana visualization](https://discuss.elastic.co/t/make-use-of-http-request-headers-origin-in-kibana-visualization/260671)
**Author:** [@Venkatesh\_Kumar](https://discuss.elastic.co/u/Venkatesh_Kumar)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:39pm UTC](https://discuss.elastic.co/t/make-use-of-http-request-headers-origin-in-kibana-visualization/260671 "2021-01-11T12:39:12Z")
I need to add http.request.headers.Origin in visualization lens for chart preparation. Those fields are not available for filtering. Any leads on this is much appreciated !!! Thanks --- ## [How to search string containing hypen?](https://discuss.elastic.co/t/how-to-search-string-containing-hypen/260713)
**Author:** [@Sahil\_Kumar](https://discuss.elastic.co/u/Sahil_Kumar)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 12:08pm UTC](https://discuss.elastic.co/t/how-to-search-string-containing-hypen/260713 "2021-01-11T12:08:42Z")
Hi, I want to index text that contains hyphens, for example MiddleEaton-Byers but I am unable to because with the regular expression \*{seachparams}\* the results are not coming? Below is the query string: "query": { "q… --- ## [Curl: (52) Empty reply from server When trying to restart cluster ( given user/password )](https://discuss.elastic.co/t/curl-52-empty-reply-from-server-when-trying-to-restart-cluster-given-user-password/260717)
**Author:** [@umen](https://discuss.elastic.co/u/umen)\ **Replies:** 0\ **Last updated:** [January 11, 2021, 12:19pm UTC](https://discuss.elastic.co/t/curl-52-empty-reply-from-server-when-trying-to-restart-cluster-given-user-password/260717 "2021-01-11T12:19:22Z")
i try to restart the cluster with the put command as stated in the docs: curl -u "elastic:xxxxxxxxx" -k -X PUT "localhost:9200/\_cluster/settings?pretty" -H 'Content-Type: application/json' -d' { "persistent": { … --- ## [How to add lookup fields to kibana visualization?](https://discuss.elastic.co/t/how-to-add-lookup-fields-to-kibana-visualization/260662)
**Author:** [@Rithwik\_Pat](https://discuss.elastic.co/u/Rithwik_Pat)\ **Replies:** 3\ **Last updated:** [January 11, 2021, 12:17pm UTC](https://discuss.elastic.co/t/how-to-add-lookup-fields-to-kibana-visualization/260662 "2021-01-11T12:17:02Z")
Say I am using lens to find all product ids in an index with a certain criteria and display in a table. Then I want to lookup the product id in another index to get the product name. So finally the result is a table that… --- ## [About creation of kibana\_N+1 index](https://discuss.elastic.co/t/about-creation-of-kibana-n-1-index/260414)
**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\ **Replies:** 4\ **Last updated:** [January 11, 2021, 12:12pm UTC](https://discuss.elastic.co/t/about-creation-of-kibana-n-1-index/260414 "2021-01-11T12:12:26Z")
Hi, When does kibana\_N+1 index gets created? Can kibana\_N+1 gets created if there are more than 1 replicas of kibana running. Is it possible that kibana index migration process get initiated between same elk version u… --- ## [Building plugin in Kibana 7.8.0](https://discuss.elastic.co/t/building-plugin-in-kibana-7-8-0/259981)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 11\ **Last updated:** [January 11, 2021, 12:08pm UTC](https://discuss.elastic.co/t/building-plugin-in-kibana-7-8-0/259981 "2021-01-11T12:08:46Z")
I've built my own plugin in Kibana 7.8.0. I'm now trying to do a yarn build command to build the plugin so I can install it on our dev server. I created the plugin using the node scripts/generate-plugin command. However,… --- ## [Logstash crashing, user error with pipeline and SSL certs configuration](https://discuss.elastic.co/t/logstash-crashing-user-error-with-pipeline-and-ssl-certs-configuration/260612)
**Author:** [@Eden\_Corbin](https://discuss.elastic.co/u/Eden_Corbin)\ **Replies:** 2\ **Last updated:** [January 11, 2021, 12:03pm UTC](https://discuss.elastic.co/t/logstash-crashing-user-error-with-pipeline-and-ssl-certs-configuration/260612 "2021-01-11T12:03:55Z")
I'm struggling a bit getting certs in place for just logstash and filebeat. My goal is to secure log trasnport between VPS instances and my logstash server. Although I'm testing with everything on the same server at the … [Previous page](https://discuss.elastic.co/latest.md?page=1899) [Next page](https://discuss.elastic.co/latest.md?page=1901)