# Latest

**URL:** https://discuss.elastic.co/latest.md?page=1922

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1923

---

## [How to increase the number of values in kibana lens](https://discuss.elastic.co/t/how-to-increase-the-number-of-values-in-kibana-lens/259450)

<div class="topic-metadata">

**Author:** [@sungjin.kim](https://discuss.elastic.co/u/sungjin.kim)\
**Replies:** 2\
**Last updated:** [December 23, 2020, 9:51pm UTC](https://discuss.elastic.co/t/how-to-increase-the-number-of-values-in-kibana-lens/259450 "2020-12-23T21:51:21Z")

</div>

Hi folks, How to increase the number of values in kibana lens? in lens, the maximum of number of values is 20. I'd like to show all of data

---

## [Zeek - Filebeat module and Processors for DNS Lookups](https://discuss.elastic.co/t/zeek-filebeat-module-and-processors-for-dns-lookups/259163)

<div class="topic-metadata">

**Author:** [@thinkagain](https://discuss.elastic.co/u/thinkagain)\
**Replies:** 5\
**Last updated:** [December 23, 2020, 9:30pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-and-processors-for-dns-lookups/259163 "2020-12-23T21:30:56Z")

</div>

hi everyone, I'm trying to get acquainted with the ELK platform and trying to understand how the different modules interact with each other. Besides the (internal) ip addresses I would like the result of a dns lookup i…

---

## [Logstash Failed to load the sqljdbc\_auth.dll cause : no sqljdbc\_auth in java.library.path](https://discuss.elastic.co/t/logstash-failed-to-load-the-sqljdbc-auth-dll-cause-no-sqljdbc-auth-in-java-library-path/259530)

<div class="topic-metadata">

**Author:** [@jjfellers](https://discuss.elastic.co/u/jjfellers)\
**Replies:** 0\
**Last updated:** [December 23, 2020, 9:27pm UTC](https://discuss.elastic.co/t/logstash-failed-to-load-the-sqljdbc-auth-dll-cause-no-sqljdbc-auth-in-java-library-path/259530 "2020-12-23T21:27:58Z")

</div>

I have pasted the required dll in about 20 different places. Always the same error. With the default logstash installation on CentOS, where is the correct place to place the sqljdbc42.jar (version 4.2.8112) and dll? I pl…

---

## [Kibana gets timed out](https://discuss.elastic.co/t/kibana-gets-timed-out/259512)

<div class="topic-metadata">

**Author:** [@john8](https://discuss.elastic.co/u/john8)\
**Replies:** 8\
**Last updated:** [December 23, 2020, 7:10pm UTC](https://discuss.elastic.co/t/kibana-gets-timed-out/259512 "2020-12-23T19:10:22Z")

</div>

I am new to the elk stack I am running kibana in a VM with NAT I am able to ping the virtual machine from the host but when I navigate to http://VMipaddress:9200 it gets timed out. Thanks in advance.

---

## [Pass the url params to my app](https://discuss.elastic.co/t/pass-the-url-params-to-my-app/258401)

<div class="topic-metadata">

**Author:** [@Introverrso](https://discuss.elastic.co/u/Introverrso)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 6:34pm UTC](https://discuss.elastic.co/t/pass-the-url-params-to-my-app/258401 "2020-12-23T18:34:14Z")

</div>

Hi! Can anybody please tell me if it is possible to pass the url parameters to my application if they were specified with the base Kibana url? Smth like we get http://kibana:5601?param1=1&param2=2… then redirecting to …

---

## [Kibana: \["error","elasticsearch","data"\],"pid":35607,"message":"\[status\_exception\]: error while executing search"}](https://discuss.elastic.co/t/kibana-error-elasticsearch-data-pid-35607-message-status-exception-error-while-executing-search/259055)

<div class="topic-metadata">

**Author:** [@Somesh\_ng](https://discuss.elastic.co/u/Somesh_ng)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 6:20pm UTC](https://discuss.elastic.co/t/kibana-error-elasticsearch-data-pid-35607-message-status-exception-error-while-executing-search/259055 "2020-12-23T18:20:51Z")

</div>

I'm getting below error while trying to search data from the kibana dashboard. Attaching the UI screenshot. { "request": {}, "response": {}, "body": { "statusCode": 400, "error": "Bad Request", "…

---

## [Unusual timestamp data that needs fixing](https://discuss.elastic.co/t/unusual-timestamp-data-that-needs-fixing/259209)

<div class="topic-metadata">

**Author:** [@dan.mackie](https://discuss.elastic.co/u/dan.mackie)\
**Replies:** 0\
**Last updated:** [December 20, 2020, 11:54pm UTC](https://discuss.elastic.co/t/unusual-timestamp-data-that-needs-fixing/259209 "2020-12-20T23:54:19Z")

</div>

Hello all, Elastic 7.9.2 Kibana 7.9.2 I have an index that has somehow ended up with a date 20000 years in the future. I thought at first that the @timestamp field had simply been misinterpreted as text by elastic, w…

---

## [Logstash parse object](https://discuss.elastic.co/t/logstash-parse-object/259513)

<div class="topic-metadata">

**Author:** [@bbwolf](https://discuss.elastic.co/u/bbwolf)\
**Replies:** 4\
**Last updated:** [December 23, 2020, 6:13pm UTC](https://discuss.elastic.co/t/logstash-parse-object/259513 "2020-12-23T18:13:52Z")

</div>

Hello, I have in a field which I need to split thé next values FieldA : "\[{" FieldA1" :"A", "FieldA2" :"B"}{"FieldA1" :"C", "FieldA2" :"D"\]}" I wan't to split FieldA as two documents {" FieldA1" :"A", "FieldA2" :"B"}…

---

## [Creating watcher script if particular value ina field occurs more than five times in five minutes interval of time](https://discuss.elastic.co/t/creating-watcher-script-if-particular-value-ina-field-occurs-more-than-five-times-in-five-minutes-interval-of-time/259375)

<div class="topic-metadata">

**Author:** [@sangatamilan](https://discuss.elastic.co/u/sangatamilan)\
**Replies:** 0\
**Last updated:** [December 22, 2020, 11:16am UTC](https://discuss.elastic.co/t/creating-watcher-script-if-particular-value-ina-field-occurs-more-than-five-times-in-five-minutes-interval-of-time/259375 "2020-12-22T11:16:57Z")

</div>

Hi can anyone help how can we create a watcher script for the below requirement I having a field called "log\_message" contaning the below message Failed to load TermRecord for TermID=\*\*\*\*\*\* here the terminal id can be…

---

## [ERROR: Something went wrong when installing logstash-input-websocket,](https://discuss.elastic.co/t/error-something-went-wrong-when-installing-logstash-input-websocket/259518)

<div class="topic-metadata">

**Author:** [@srigayathri](https://discuss.elastic.co/u/srigayathri)\
**Replies:** 0\
**Last updated:** [December 23, 2020, 6:02pm UTC](https://discuss.elastic.co/t/error-something-went-wrong-when-installing-logstash-input-websocket/259518 "2020-12-23T18:02:04Z")

</div>

Trying to install the logstash-input-websocket plugin in a corporate environment and been receiving the following error. Could anyone please help me out. WARNING: A maven settings file already exist at C:\\Users\\\<userna…

---

## [Winlogbeat not dropping multicast traffic using drop\_event.when.or](https://discuss.elastic.co/t/winlogbeat-not-dropping-multicast-traffic-using-drop-event-when-or/259428)

<div class="topic-metadata">

**Author:** [@jtillman2020](https://discuss.elastic.co/u/jtillman2020)\
**Replies:** 6\
**Last updated:** [December 23, 2020, 5:58pm UTC](https://discuss.elastic.co/t/winlogbeat-not-dropping-multicast-traffic-using-drop-event-when-or/259428 "2020-12-23T17:58:40Z")

</div>

Using drop\_event.when.or I've attempted to exclude multicast traffic logs from being sent over as well as logs containing the keyword "zabbix". However, I am still receiving these events. winlogbeat.event\_logs: - name…

---

## [Search across all fields on Kibana](https://discuss.elastic.co/t/search-across-all-fields-on-kibana/259499)

<div class="topic-metadata">

**Author:** [@Finley](https://discuss.elastic.co/u/Finley)\
**Replies:** 5\
**Last updated:** [December 23, 2020, 5:25pm UTC](https://discuss.elastic.co/t/search-across-all-fields-on-kibana/259499 "2020-12-23T17:25:00Z")

</div>

Hi, I'm sorry to ask this question but I didn't find anything on google on on the forum concerning this. I would like to search, on kibana, on all fields with a simple value. For example, in Discover, into the KQL bar…

---

## [Can a filter created from Kibana Canvas be applied to saved visualizations created from Kibana Visualisations?](https://discuss.elastic.co/t/can-a-filter-created-from-kibana-canvas-be-applied-to-saved-visualizations-created-from-kibana-visualisations/258396)

<div class="topic-metadata">

**Author:** [@Sandeep\_Bhargava\_Vem](https://discuss.elastic.co/u/Sandeep_Bhargava_Vem)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 5:24pm UTC](https://discuss.elastic.co/t/can-a-filter-created-from-kibana-canvas-be-applied-to-saved-visualizations-created-from-kibana-visualisations/258396 "2020-12-23T17:24:43Z")

</div>

I have a few visualizations that I have created using Kibana Visualize panel. I now have built a Canvas workpad and have added these visualizations to the workpad. What I want to do now is, create a filter using Add Ele…

---

## [How bars charts ordering works?](https://discuss.elastic.co/t/how-bars-charts-ordering-works/259269)

<div class="topic-metadata">

**Author:** [@Baptiste\_Orsoni](https://discuss.elastic.co/u/Baptiste_Orsoni)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 5:20pm UTC](https://discuss.elastic.co/t/how-bars-charts-ordering-works/259269 "2020-12-23T17:20:57Z")

</div>

Hello everyone, I would like to understand how does bars charts are working with the ordering of the values we input because I have this example which doesn't seems logic to me: For the client RTENOT I have 11,178 hi…

---

## [Life Cycle Policies: Alias for rollover index](https://discuss.elastic.co/t/life-cycle-policies-alias-for-rollover-index/259390)

<div class="topic-metadata">

**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\
**Replies:** 0\
**Last updated:** [December 22, 2020, 1:55pm UTC](https://discuss.elastic.co/t/life-cycle-policies-alias-for-rollover-index/259390 "2020-12-22T13:55:12Z")

</div>

Kibana version : 7.10.0 Elasticsearch version : 7.10.0 Filebeat version : 7.10.0 Logstash version : 7.10.0 Good day, I'm trying to set up a lifecycle management for my indices. Therefore I created two index template…

---

## [Removed field mapping is still shown in index](https://discuss.elastic.co/t/removed-field-mapping-is-still-shown-in-index/259511)

<div class="topic-metadata">

**Author:** [@raghavendra186](https://discuss.elastic.co/u/raghavendra186)\
**Replies:** 0\
**Last updated:** [December 23, 2020, 4:39pm UTC](https://discuss.elastic.co/t/removed-field-mapping-is-still-shown-in-index/259511 "2020-12-23T16:39:21Z")

</div>

Hi, I faced error saying "could not index to elastic limit of 9k exceeded". i planned to reduce unwanted fields using remove\_field in logstash. my incoming json gets 9k fields. i have applied mutate filter in logstash t…

---

## [Health check failed](https://discuss.elastic.co/t/health-check-failed/259430)

<div class="topic-metadata">

**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\
**Replies:** 5\
**Last updated:** [December 23, 2020, 4:31pm UTC](https://discuss.elastic.co/t/health-check-failed/259430 "2020-12-23T16:31:33Z")

</div>

I am trying to install Elasticserver in Linux, after I ran the server I am facing the below issue. Can you please help me to resolve this? \[2020-12-22T00:02:31,363\]\[ERROR\]\[o.e.m.f.FsHealthService \] \[GTHYJDEV01.pneus.to…

---

## [How to handle watermark.low](https://discuss.elastic.co/t/how-to-handle-watermark-low/258955)

<div class="topic-metadata">

**Author:** [@Kxn7](https://discuss.elastic.co/u/Kxn7)\
**Replies:** 3\
**Last updated:** [December 23, 2020, 4:02pm UTC](https://discuss.elastic.co/t/how-to-handle-watermark-low/258955 "2020-12-23T16:02:13Z")

</div>

Hi, We recently had the case that multiple nodes of our ElasticSearch cluster running version 7.3.2 reached the low watermark threshold. We immediately added some nodes to counteract the increase in disk usage and made…

---

## [How this elasticsearch input plugin works in logstash?](https://discuss.elastic.co/t/how-this-elasticsearch-input-plugin-works-in-logstash/259371)

<div class="topic-metadata">

**Author:** [@deshpas](https://discuss.elastic.co/u/deshpas)\
**Replies:** 3\
**Last updated:** [December 23, 2020, 3:58pm UTC](https://discuss.elastic.co/t/how-this-elasticsearch-input-plugin-works-in-logstash/259371 "2020-12-23T15:58:51Z")

</div>

I am trying to transfer data from one AWS ES cluster to another AWS ES cluster and in this case, i am going to use the schedule option to pull the data from input every time. I would like to understand how this elastic…

---

## [Fixed time instead of time range](https://discuss.elastic.co/t/fixed-time-instead-of-time-range/259474)

<div class="topic-metadata">

**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 3:56pm UTC](https://discuss.elastic.co/t/fixed-time-instead-of-time-range/259474 "2020-12-23T15:56:01Z")

</div>

Hi. I create visualize metric, I want to Fix the time for this visualize metric and show the all count index. Somehow if I created a dashboard and I use this visualize metic in the dashboard and when I change the time ra…

---

## [Connect kibana with Other application](https://discuss.elastic.co/t/connect-kibana-with-other-application/259475)

<div class="topic-metadata">

**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 3:55pm UTC](https://discuss.elastic.co/t/connect-kibana-with-other-application/259475 "2020-12-23T15:55:20Z")

</div>

Hi, I want to show kibana dashboard in my application and also I don't want my user to enter credentials, with the application credentials the user can able to access kibana. can some one give me a method or a way to s…

---

## [External Ruby, more than one value in a hash](https://discuss.elastic.co/t/external-ruby-more-than-one-value-in-a-hash/259434)

<div class="topic-metadata">

**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Replies:** 3\
**Last updated:** [December 23, 2020, 3:53pm UTC](https://discuss.elastic.co/t/external-ruby-more-than-one-value-in-a-hash/259434 "2020-12-23T15:53:13Z")

</div>

I have been using this external ruby code to add data to the documents, when a document has a planet\_name equal to the key in the hash add the value to a field in the document def register(params) end def filter(event) …

---

## [Duplicate log entries](https://discuss.elastic.co/t/duplicate-log-entries/259394)

<div class="topic-metadata">

**Author:** [@leandro.borges](https://discuss.elastic.co/u/leandro.borges)\
**Replies:** 17\
**Last updated:** [December 23, 2020, 3:52pm UTC](https://discuss.elastic.co/t/duplicate-log-entries/259394 "2020-12-23T15:52:32Z")

</div>

Hi, We are facing some issues with elasticsearch. We are having lots of duplicate log entries like below. Inside logstash.yml there is only a file in path.config that we use: path.config: "/etc/logstash/pipeline.global.…

---

## [How to generate a pie chart from geo\_points within a geo\_shape in ELK?](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312)

<div class="topic-metadata">

**Author:** [@MichaelLevy](https://discuss.elastic.co/u/MichaelLevy)\
**Replies:** 7\
**Last updated:** [December 23, 2020, 3:33pm UTC](https://discuss.elastic.co/t/how-to-generate-a-pie-chart-from-geo-points-within-a-geo-shape-in-elk/258312 "2020-12-23T15:33:54Z")

</div>

Hello everyone! I have created a map by importing GEOJSON data in KIBANA. The data is indexed as geo\_shape and it contains the World's territorial waters area. It represents a layer in my map. I have then added another …

---

## [Issue unzipping Kibana 7.10 installation file (kibana-7.10.0-windows-x86\_64.zip)](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332)

<div class="topic-metadata">

**Author:** [@eugenevk](https://discuss.elastic.co/u/eugenevk)\
**Replies:** 1\
**Last updated:** [December 23, 2020, 3:28pm UTC](https://discuss.elastic.co/t/issue-unzipping-kibana-7-10-installation-file-kibana-7-10-0-windows-x86-64-zip/257332 "2020-12-23T15:28:09Z")

</div>

Hi, I get an error message when unzipping kibana-7.10.0-windows-x86\_64.zip. Towards the end of the extraction process I get the error message Skipping file: unable to create a sensible filename out of "C:\\Users\\...\\add\_…

---

## [Can you configure linger.ms in the kafka output?](https://discuss.elastic.co/t/can-you-configure-linger-ms-in-the-kafka-output/259501)

<div class="topic-metadata">

**Author:** [@shayrybak](https://discuss.elastic.co/u/shayrybak)\
**Replies:** 0\
**Last updated:** [December 23, 2020, 3:17pm UTC](https://discuss.elastic.co/t/can-you-configure-linger-ms-in-the-kafka-output/259501 "2020-12-23T15:17:38Z")

</div>

Hi, I've been running filebeat to send log files to kafka for processing, I've noticed that filebeat is lingering before sending the kafka batch for about 1 second. I'm assuming that is the default value in Sarama, howe…

---

## [Filebeat - How to disable "kube-system" namespace logs?](https://discuss.elastic.co/t/filebeat-how-to-disable-kube-system-namespace-logs/259313)

<div class="topic-metadata">

**Author:** [@David\_Fachini](https://discuss.elastic.co/u/David_Fachini)\
**Replies:** 5\
**Last updated:** [December 23, 2020, 3:15pm UTC](https://discuss.elastic.co/t/filebeat-how-to-disable-kube-system-namespace-logs/259313 "2020-12-23T15:15:42Z")

</div>

Hello, I am using Elasticsearch + Filebeat and Kibana. I have two namespaces "datastore" and "logging". I would like only to collect logs from those and avoid to harvest log from "kube-system". Checking in kibana I am a…

---

## [Timestamp not mapping with event time](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976)

<div class="topic-metadata">

**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Replies:** 6\
**Last updated:** [December 23, 2020, 3:00pm UTC](https://discuss.elastic.co/t/timestamp-not-mapping-with-event-time/258976 "2020-12-23T15:00:20Z")

</div>

My logs are exported in csv format and uploaded. The first column name called "Event Time" has following format event time followed by rest of the comma separated columns - "2020/11/10 00:00:00 CET" I am not able to ma…

---

## [Radar - how to create the radar chart](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728)

<div class="topic-metadata">

**Author:** [@gcastro](https://discuss.elastic.co/u/gcastro)\
**Replies:** 4\
**Last updated:** [December 22, 2020, 2:53pm UTC](https://discuss.elastic.co/t/radar-how-to-create-the-radar-chart/258728 "2020-12-22T14:53:47Z")

</div>

Hello it seems you cannot do in native mode the radar graph in the new Kibana version. Has anyone managed to do it ? how ? thanks a lot for your replies regards gregory

---

## [Logstashのlogstash-input-s3利用時のログ欠損](https://discuss.elastic.co/t/logstash-logstash-input-s3/258695)

<div class="topic-metadata">

**Author:** [@Branzino](https://discuss.elastic.co/u/Branzino)\
**Replies:** 4\
**Last updated:** [December 23, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-logstash-input-s3/258695 "2020-12-23T14:37:55Z")

</div>

【環境構成】 複数サーバから同じフォーマットのログをFilebeat利用してLogstash経由（logstash-output-s3）でAWS上のS3バケットに集約して、さらにLogstash（logstash-input-s3）を利用してログをElasticsearchへ転送しています。 【問い合わせ内容】 上記構成において、S3バケットまでログは欠損せずに保管されますが、後続の処理においてログ欠損が発生しています。 収集対…

[Previous page](https://discuss.elastic.co/latest.md?page=1921)

[Next page](https://discuss.elastic.co/latest.md?page=1923)
