# Latest **URL:** https://discuss.elastic.co/latest.md?page=1930 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1931 --- ## [Search arrays with arrays](https://discuss.elastic.co/t/search-arrays-with-arrays/259132)
**Author:** [@Luca\_Frost](https://discuss.elastic.co/u/Luca_Frost)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 7:07pm UTC](https://discuss.elastic.co/t/search-arrays-with-arrays/259132 "2020-12-18T19:07:32Z")
Hi all, I have an ES index where one of my mappings stores a simple array of named entities pre-set at the point of ingestion. I'm trying to search my index using a given array of entities, to return documents where co… --- ## [Can kibana date/ time picker pick date time based on](https://discuss.elastic.co/t/can-kibana-date-time-picker-pick-date-time-based-on/259131)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 6:42pm UTC](https://discuss.elastic.co/t/can-kibana-date-time-picker-pick-date-time-based-on/259131 "2020-12-18T18:42:34Z")
Can Kibana date/ time picker be configured to pick date/time based on a different timestamp say the timeCreated field as seen below? The purpose is to avoid creating a filter. --- ## [topN graph not aggregating on field](https://discuss.elastic.co/t/topn-graph-not-aggregating-on-field/259044)
**Author:** [@Andythsu](https://discuss.elastic.co/u/Andythsu)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 6:38pm UTC](https://discuss.elastic.co/t/topn-graph-not-aggregating-on-field/259044 "2020-12-18T18:38:38Z")
Hello, I'm on Kibana 6.8.0 and was trying with top N graph. The top N doesn't seem to be aggregating on the field. For example, shows that the red bar sums up to 0, but the time series graph clearly shows that there is… --- ## [Geoip lookup failure while parsing http json data](https://discuss.elastic.co/t/geoip-lookup-failure-while-parsing-http-json-data/259120)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 5:49pm UTC](https://discuss.elastic.co/t/geoip-lookup-failure-while-parsing-http-json-data/259120 "2020-12-18T17:49:56Z")
I am trying to perform Geoip filter while parsing json logs data from clouflare API but it says \_geoip\_lookup\_failure here is my conf file configurations input { http\_poller { urls =\> { test… --- ## [Index duplicate documents with the different routing id](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124)
**Author:** [@Maksym1](https://discuss.elastic.co/u/Maksym1)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 5:46pm UTC](https://discuss.elastic.co/t/index-duplicate-documents-with-the-different-routing-id/259124 "2020-12-18T17:46:22Z")
When I try to index two similar documents (in my case, these are customers) with the same id and a different routing id, I get the first document is created, but the second document is updated. As I know, I can index tw… --- ## [Dereference arrays in painless script field](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382)
**Author:** [@wsalembi](https://discuss.elastic.co/u/wsalembi)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 5:33pm UTC](https://discuss.elastic.co/t/dereference-arrays-in-painless-script-field/258382 "2020-12-18T17:33:30Z")
Given following document { "addresses": \[ {"city": "New York"}, {"city": "Brussels" } \] } Is it possible to dereference the first element in the array using a pain… --- ## [Metricbeat don't get all mounting points for filesystems](https://discuss.elastic.co/t/metricbeat-dont-get-all-mounting-points-for-filesystems/259098)
**Author:** [@Vinicius\_Maia](https://discuss.elastic.co/u/Vinicius_Maia)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 5:31pm UTC](https://discuss.elastic.co/t/metricbeat-dont-get-all-mounting-points-for-filesystems/259098 "2020-12-18T17:31:58Z")
Hello all, I need some help with a problem about my metricbeat setup. I'm trying to monitor my elasticsearch server disks with metricbeat. In the elasticsearch servers I created a LVM and mounted it in /var/lib/elasti… --- ## [Unable to Access the Kibana Lab for Lesson 1.1](https://discuss.elastic.co/t/unable-to-access-the-kibana-lab-for-lesson-1-1/258428)
**Author:** [@Dave\_E](https://discuss.elastic.co/u/Dave_E)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 3:37pm UTC](https://discuss.elastic.co/t/unable-to-access-the-kibana-lab-for-lesson-1-1/258428 "2020-12-11T15:37:08Z")
Hello, I’m trying to log into Kibana for training and accomplish Lab: Introduction to Kibana, Lab 1.1 I got Strigo VM to show as ready. I copied the Public DNS address and pasted it into a new tab to get the lab instr… --- ## [Unable to include runtime log data in 'mutate' filter plugin](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 5:18pm UTC](https://discuss.elastic.co/t/unable-to-include-runtime-log-data-in-mutate-filter-plugin/259125 "2020-12-18T17:18:34Z")
I am trying to fetch cloudflare log data via API and want add a new field such as actor.email in index. My end goal is to add a new field in index having data in meaningful sentence like A user someone@email.com(actor.… --- ## [Own function in search template](https://discuss.elastic.co/t/own-function-in-search-template/259126)
**Author:** [@sundarcse1216](https://discuss.elastic.co/u/sundarcse1216)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:56pm UTC](https://discuss.elastic.co/t/own-function-in-search-template/259126 "2020-12-18T16:56:59Z")
I need to write my own function inside the search template like toJson ............. "functions": \[ { "filter": { "terms": { "empId": {{#my\_own\_function}}PARAM\_VALUE{{/my\_own\_function}} } … --- ## [Elasticsearch Closing Index after removing read-only index block followed by Restart](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 4\ **Last updated:** [December 18, 2020, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-closing-index-after-removing-read-only-index-block-followed-by-restart/259065 "2020-12-18T16:40:02Z")
Hi, We are on Elasticsearch 6.0 and we need help on the following scenario: Index A is in "Open" state Elasticsearch crossed flood\_stage watermark, Index A got read-only index block Resolve flood\_stage watermark, Remo… --- ## [Viewing the docker image Dockerfiles?](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123)
**Author:** [@BigAl](https://discuss.elastic.co/u/BigAl)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 4:31pm UTC](https://discuss.elastic.co/t/viewing-the-docker-image-dockerfiles/259123 "2020-12-18T16:31:27Z")
Hi, Is there a way to view the Dockerfiles that generate the docker images that we pull from elastic.co downloads. for example: https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss- Thanks! --- ## [Elastic Endgame Fundamentals](https://discuss.elastic.co/t/elastic-endgame-fundamentals/258939)
**Author:** [@PASONI](https://discuss.elastic.co/u/PASONI)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 4:24pm UTC](https://discuss.elastic.co/t/elastic-endgame-fundamentals/258939 "2020-12-18T16:24:40Z")
I have one doubt regarding Elastic Endgame Fundamentals Course. While doing the course in Lab 1 where I have to deploy the sensor, I am not getting the desired output. I tried everything to resolve the error but it is no… --- ## [TSVB showing old field values in KQL query](https://discuss.elastic.co/t/tsvb-showing-old-field-values-in-kql-query/258548)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 3:56pm UTC](https://discuss.elastic.co/t/tsvb-showing-old-field-values-in-kql-query/258548 "2020-12-18T15:56:49Z")
hi all, in TSVB visualization , under "DATA", "Query string" , group by filter ....when i put a filter using KQL , it shows/pop-up field values which are not a part of current index pattern.....but field values of some… --- ## [Pie chart into Kibana dashboard](https://discuss.elastic.co/t/pie-chart-into-kibana-dashboard/259114)
**Author:** [@alex92360](https://discuss.elastic.co/u/alex92360)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 3:42pm UTC](https://discuss.elastic.co/t/pie-chart-into-kibana-dashboard/259114 "2020-12-18T15:42:57Z")
Hello all, i'm trying to do a pie chart in Kibana dashboard based on some data i have. I don't understand if i am missing something or is Kibana that just works differently. Let's say i have the following data (n docs) … --- ## [Kibana Service won't start after 7.8 -\> 7.10 Upgrade](https://discuss.elastic.co/t/kibana-service-wont-start-after-7-8-7-10-upgrade/258866)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 9\ **Last updated:** [December 18, 2020, 3:40pm UTC](https://discuss.elastic.co/t/kibana-service-wont-start-after-7-8-7-10-upgrade/258866 "2020-12-18T15:40:18Z")
My Cluster: 3x CentOS 7 Elasticsearch 7.10 Logstash 7.10 Kibana 7.10 Filebeat 7.10 So i just upgraded my Cluster to version 7.10 Everything works fine (even Elasticsearch after messing with jvm.options a bit), but… --- ## [Metricbeat AWS Module Issues](https://discuss.elastic.co/t/metricbeat-aws-module-issues/257976)
**Author:** [@Ganesh999](https://discuss.elastic.co/u/Ganesh999)\ **Replies:** 7\ **Last updated:** [December 18, 2020, 3:08pm UTC](https://discuss.elastic.co/t/metricbeat-aws-module-issues/257976 "2020-12-18T15:08:44Z")
Hi All, Have been trying to use the aws module in metrcibeat and have included all the related credentials required for authentication but it fails and gives the following error But the same credentials when used in… --- ## [Fleet AWS Integration Error - CloudTrail logs not searchable](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987)
**Author:** [@matt\_t1](https://discuss.elastic.co/u/matt_t1)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 2:41pm UTC](https://discuss.elastic.co/t/fleet-aws-integration-error-cloudtrail-logs-not-searchable/258987 "2020-12-18T14:41:39Z")
AWS integration version 0.3.12 uses an ingestion node pipeline to set the event.ingested field to the ingestion timestamp. There is no mapping for this field in the index template so it defaults to keyword type, which b… --- ## [Painless - check if a log contains a certain field](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718)
**Author:** [@yaelg](https://discuss.elastic.co/u/yaelg)\ **Replies:** 1\ **Last updated:** [December 18, 2020, 2:39pm UTC](https://discuss.elastic.co/t/painless-check-if-a-log-contains-a-certain-field/258718 "2020-12-18T14:39:55Z")
Hey everyone, I have the following fields in my logs: "module": String "audit": {"action": String, "user": String} "audit" does not appear in all logs. I wanted to create a visualization of tag-cloud which would show… --- ## [Logstash 7.10 is ignoring custom index template](https://discuss.elastic.co/t/logstash-7-10-is-ignoring-custom-index-template/258615)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 26\ **Last updated:** [December 18, 2020, 2:35pm UTC](https://discuss.elastic.co/t/logstash-7-10-is-ignoring-custom-index-template/258615 "2020-12-18T14:35:56Z")
Hi, This is a fresh installation of ELK 7.10.0. I am trying to configure Logstash to process .csv files and index into ES. I created a config file and a custom index template. It looks like the .csv are being processed,… --- ## [Elasticsearch input plugin: range query doesn't match any document](https://discuss.elastic.co/t/elasticsearch-input-plugin-range-query-doesnt-match-any-document/259097)
**Author:** [@Mathias\_Bazin](https://discuss.elastic.co/u/Mathias_Bazin)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-range-query-doesnt-match-any-document/259097 "2020-12-18T12:04:26Z")
Hello, I'm having trouble collecting data periodically from an elasticsearch index. My input config is quite simple input { elasticsearch { hosts =\> "${ELASTICSEARCH\_URL\_INPUT}" index =\> 'logcentral\_pn' d… --- ## [Kibana 7.10.1 Login Logo](https://discuss.elastic.co/t/kibana-7-10-1-login-logo/259076)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 2:06pm UTC](https://discuss.elastic.co/t/kibana-7-10-1-login-logo/259076 "2020-12-18T14:06:58Z")
Hi guys , i downloaded the latest version of ELK and i followed the steps that @ManuelF described in this thread https://discuss.elastic.co/t/custom-logo-kibana-7-10-0-guide/257686 , i changed the loading logo but i co… --- ## [APM transaction timeline without spans](https://discuss.elastic.co/t/apm-transaction-timeline-without-spans/258299)
**Author:** [@valecavallaro](https://discuss.elastic.co/u/valecavallaro)\ **Replies:** 1\ **Last updated:** [December 14, 2020, 5:30pm UTC](https://discuss.elastic.co/t/apm-transaction-timeline-without-spans/258299 "2020-12-14T17:30:33Z")
Hello there! We have set up ruby APM integration with a Rails application, and we are having an issue that I can't find why it's happening. Kibana version: 7.3.0 Elasticsearch version: 7.3.0 APM Server version: 7.3.… --- ## [Filter search by date in search-ui](https://discuss.elastic.co/t/filter-search-by-date-in-search-ui/258929)
**Author:** [@ismarslomic](https://discuss.elastic.co/u/ismarslomic)\ **Replies:** 8\ **Last updated:** [December 18, 2020, 1:53pm UTC](https://discuss.elastic.co/t/filter-search-by-date-in-search-ui/258929 "2020-12-18T13:53:16Z")
My documents have a date field with name published\_timestamp. I would like to provide user possibility to filter search results on specific date (excluding time), for example 2020-12-17. My thought was to add an date in… --- ## [Avoid user to edit kibana visualization fields](https://discuss.elastic.co/t/avoid-user-to-edit-kibana-visualization-fields/259102)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 1:40pm UTC](https://discuss.elastic.co/t/avoid-user-to-edit-kibana-visualization-fields/259102 "2020-12-18T13:40:41Z")
Hi All, I have created a separate user for my end customer, and have restricted his usage to view only Kibana visualization. I have used a filter(Consumer = Mobile). so that he will not be able to view data of any other… --- ## [Using multi\_match from the start of fields](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110)
**Author:** [@rmbutler83](https://discuss.elastic.co/u/rmbutler83)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:36pm UTC](https://discuss.elastic.co/t/using-multi-match-from-the-start-of-fields/259110 "2020-12-18T13:36:04Z")
Hi, I'm trying to search for drug names in my datastore, { "index": "drugs", "body": { "size": 20, "query": { "bool": { "must": \[ { "term": { "RouteOfAdmini… --- ## [Can't filebeat use multiple input/output config files in one instance?](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095)
**Author:** [@iooi](https://discuss.elastic.co/u/iooi)\ **Replies:** 2\ **Last updated:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/cant-filebeat-use-multiple-input-output-config-files-in-one-instance/259095 "2020-12-18T13:33:30Z")
Want to deploy filebeat with 3 log definations together. Send to different output targets. --- apiVersion: apps/v1 kind: DaemonSet metadata: name: filebeat labels: k8s-app: filebeat spec: selector: matchLa… --- ## [Alerting and actions](https://discuss.elastic.co/t/alerting-and-actions/259109)
**Author:** [@Rafal\_Radziejewski](https://discuss.elastic.co/u/Rafal_Radziejewski)\ **Replies:** 0\ **Last updated:** [December 18, 2020, 1:33pm UTC](https://discuss.elastic.co/t/alerting-and-actions/259109 "2020-12-18T13:33:21Z")
Hello i am using version 7.9.3 of a stack i am wondering why after enabling security and setting 40 characters long key i am still unable to see alering and security tab ? Any ideas ? Regards, RR --- ## [How to use if else in logstash output](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793)
**Author:** [@lokeshbabloo](https://discuss.elastic.co/u/lokeshbabloo)\ **Replies:** 6\ **Last updated:** [December 18, 2020, 1:16pm UTC](https://discuss.elastic.co/t/how-to-use-if-else-in-logstash-output/256793 "2020-12-18T13:16:00Z")
Hi i need a help in constructing the logstash output i am having two log files like this, one is \<#\> 20200806 17:04:23.261 280018000 EV.INF \[ MVINB-LSL2.T1G1\_WEBSVR1 main.main TSP1.T1G1\_WEBSVR1 … --- ## [Relational data](https://discuss.elastic.co/t/relational-data/259082)
**Author:** [@Jean-Marc\_Autexier](https://discuss.elastic.co/u/Jean-Marc_Autexier)\ **Replies:** 3\ **Last updated:** [December 18, 2020, 12:34pm UTC](https://discuss.elastic.co/t/relational-data/259082 "2020-12-18T12:34:44Z")
Hi, I think we all know the limits of elastic when having relational data.... There are things you can solve (using de-normalization, nested, parent-child, lookups) but sometimes your uses cases require query time join… [Previous page](https://discuss.elastic.co/latest.md?page=1929) [Next page](https://discuss.elastic.co/latest.md?page=1931)