# Latest **URL:** https://discuss.elastic.co/latest.md?page=1945 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1946 --- ## [Index Patterns Keep Disappearing](https://discuss.elastic.co/t/index-patterns-keep-disappearing/258292)
**Author:** [@valleram](https://discuss.elastic.co/u/valleram)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 5:39pm UTC](https://discuss.elastic.co/t/index-patterns-keep-disappearing/258292 "2020-12-10T17:39:15Z")
Hi All, I'm currently using version 7.8.0, I've indexed some documents into ES, but when I create a n Index Pattern in Kibana, it disappear automatically. Please see below some screenshots of this issue. GET \_cat/indi… --- ## [Kibana Lucene search of an array field](https://discuss.elastic.co/t/kibana-lucene-search-of-an-array-field/258313)
**Author:** [@gaz1](https://discuss.elastic.co/u/gaz1)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:36pm UTC](https://discuss.elastic.co/t/kibana-lucene-search-of-an-array-field/258313 "2020-12-10T17:36:00Z")
Hi there. I have a few docs in an index that go as the following example: ''' "\_index" : "metrics", "\_type" : "\_doc", "\_id" : "5fd1814e8a7b8b0023d747d5", "\_source" : { "socketId" : "hh9WMhPM1z1tD8SyAAdN", "events"… --- ## [Distinct values of one field based on date range](https://discuss.elastic.co/t/distinct-values-of-one-field-based-on-date-range/257176)
**Author:** [@Rohlik](https://discuss.elastic.co/u/Rohlik)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:33pm UTC](https://discuss.elastic.co/t/distinct-values-of-one-field-based-on-date-range/257176 "2020-12-10T17:33:41Z")
Hello community :wave: , I struggling with Elasticsearch query and sadly I cannot get correct response. :unamused: What I want is get unique/disctinct values for specific field in last X minutes. I have something like… --- ## [Required logstash patterns to extract JSON format log](https://discuss.elastic.co/t/required-logstash-patterns-to-extract-json-format-log/255516)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:31pm UTC](https://discuss.elastic.co/t/required-logstash-patterns-to-extract-json-format-log/255516 "2020-12-10T17:31:40Z")
Hi All, Below is the log message which is in JSON format, would like to extract couple of keys from the below log ( say ex: x-forwarded-for, host, etc..). can any please help me to write logstash filters to extract the … --- ## [Export CSV doesn't work v7.9.0](https://discuss.elastic.co/t/export-csv-doesnt-work-v7-9-0/258247)
**Author:** [@111382](https://discuss.elastic.co/u/111382)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:31pm UTC](https://discuss.elastic.co/t/export-csv-doesnt-work-v7-9-0/258247 "2020-12-10T17:31:35Z")
Hi everyone! I hope some of you met the same trouble with csv report generation. I read articles at the forum but didn't get the same case. So I try to export saved search in Kibana 7.9.0 but receive Service Unavailable… --- ## [Exported CSV from search table in dashboard has column values missing](https://discuss.elastic.co/t/exported-csv-from-search-table-in-dashboard-has-column-values-missing/257882)
**Author:** [@xyz2](https://discuss.elastic.co/u/xyz2)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:30pm UTC](https://discuss.elastic.co/t/exported-csv-from-search-table-in-dashboard-has-column-values-missing/257882 "2020-12-10T17:30:23Z")
Hi, I am using 7.8.0 . I have used discover search tables and data tables in kibana dashboards. When I download CSV from the dashboard for a search table, it doesn't contain values for some .keyword columns. When I dow… --- ## [Not able to show field values in Kibana](https://discuss.elastic.co/t/not-able-to-show-field-values-in-kibana/257188)
**Author:** [@marcosvrrs](https://discuss.elastic.co/u/marcosvrrs)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:27pm UTC](https://discuss.elastic.co/t/not-able-to-show-field-values-in-kibana/257188 "2020-12-10T17:27:25Z")
I have JSON documents that I send through a lambda to Elasticsearch and these JSONs have certain fields nested that are flattened in the process, I can see that they are correctly showed in my Index Pattern, like this: … --- ## [Limits of scripted fields](https://discuss.elastic.co/t/limits-of-scripted-fields/258030)
**Author:** [@Juanfri](https://discuss.elastic.co/u/Juanfri)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 5:26pm UTC](https://discuss.elastic.co/t/limits-of-scripted-fields/258030 "2020-12-10T17:26:04Z")
Hi! First of all, sorry for my bad english. I need some help in order to understand if I can use scripted fields for my purpose. I want to calculate a field by a multiplication with other fields. However, I must know … --- ## [Create Watcher from Service gone](https://discuss.elastic.co/t/create-watcher-from-service-gone/258259)
**Author:** [@webjoel](https://discuss.elastic.co/u/webjoel)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 11:15am UTC](https://discuss.elastic.co/t/create-watcher-from-service-gone/258259 "2020-12-10T11:15:27Z")
I'm updated version Elastic Cloud from 7.8 to 7.9.3 and option the Create Watcher from Service (APM \> Services \> my-service \> Transactions) is gone. Has feature removed? --- ## [Rally](https://discuss.elastic.co/t/rally/255661)
**Author:** [@ahmedloai](https://discuss.elastic.co/u/ahmedloai)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 5:20pm UTC](https://discuss.elastic.co/t/rally/255661 "2020-12-10T17:20:25Z")
Hello I am using rally as a Benchmarking tool for elastic. I have actually 2 issues: Index-name: is there a way to change or add prefix for the indices created during a race? I tried index\_settings but it does not w… --- ## [Kafka input plugin](https://discuss.elastic.co/t/kafka-input-plugin/258303)
**Author:** [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:17pm UTC](https://discuss.elastic.co/t/kafka-input-plugin/258303 "2020-12-10T17:17:54Z")
The documentation does not really make sense when it comes to poll\_timeout\_ms and fetch\_max\_wait\_ms. According to the documentation: fetch\_max\_wait\_ms has a default value of 500ms poll\_timeout\_ms has a default value o… --- ## [Keep data synchronize with Indices](https://discuss.elastic.co/t/keep-data-synchronize-with-indices/258257)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 2\ **Last updated:** [December 10, 2020, 5:12pm UTC](https://discuss.elastic.co/t/keep-data-synchronize-with-indices/258257 "2020-12-10T17:12:01Z")
I'm using Elasticsearch 7.9.0. and using ingress to process and enrich data. I want to share data in indices Elasticsearch with another app. This app have api to collect data. Have any way to keep sync data in indices … --- ## [Kibana json input](https://discuss.elastic.co/t/kibana-json-input/258246)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 5:09pm UTC](https://discuss.elastic.co/t/kibana-json-input/258246 "2020-12-10T17:09:51Z")
I want to utilize the advance section (json input )in visualization.How we can write the query to modify the visualization.Any help or information on this will be highly appreciated. --- ## [Queuing tasks and snapshot operation not working](https://discuss.elastic.co/t/queuing-tasks-and-snapshot-operation-not-working/258286)
**Author:** [@afonsoavr](https://discuss.elastic.co/u/afonsoavr)\ **Replies:** 8\ **Last updated:** [December 10, 2020, 5:02pm UTC](https://discuss.elastic.co/t/queuing-tasks-and-snapshot-operation-not-working/258286 "2020-12-10T17:02:17Z")
Hi, I has the cluster elasticsearch with 6 data nodes and 3 master. When execute the snapshot I receive the error "process\_cluster\_event\_timeout\_exception". I look in my cluster "/\_cat/pending\_tasks" it has 69 tasks w… --- ## [Auditbeat: Prefix syscall arguments value with '0x' so that they can be handled by "convert" processor](https://discuss.elastic.co/t/auditbeat-prefix-syscall-arguments-value-with-0x-so-that-they-can-be-handled-by-convert-processor/258308)
**Author:** [@docteur\_saoul](https://discuss.elastic.co/u/docteur_saoul)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 5:00pm UTC](https://discuss.elastic.co/t/auditbeat-prefix-syscall-arguments-value-with-0x-so-that-they-can-be-handled-by-convert-processor/258308 "2020-12-10T17:00:58Z")
Hi, I'm looking for a way to add the traced process metadata for ptrace events on linux. This could be done using the add\_process\_metadata and the PID (second argument of ptrace syscall). However, auditd.data.aX fields … --- ## [Elastic Cloud APM server - "queue is full"](https://discuss.elastic.co/t/elastic-cloud-apm-server-queue-is-full/258145)
**Author:** [@thomaslundstrom](https://discuss.elastic.co/u/thomaslundstrom)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 4:55pm UTC](https://discuss.elastic.co/t/elastic-cloud-apm-server-queue-is-full/258145 "2020-12-10T16:55:40Z")
APM Server version: Elastic Cloud - deployment version 7.9.2. APM Agent language and version: APM python agent, version 5.9.0 python 3.7. Description of the problem including expected versus actual behavior. Please … --- ## [Elasticsearch issue](https://discuss.elastic.co/t/elasticsearch-issue/258182)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 6\ **Last updated:** [December 10, 2020, 4:46pm UTC](https://discuss.elastic.co/t/elasticsearch-issue/258182 "2020-12-10T16:46:24Z")
Hello there, I am using ELK 7.9.2 and I see following issue with elasticsearch and kibana. \*\*Elasticsearch\*\* \[2020-12-09T15:13:39,596\]\[WARN \]\[o.e.c.r.a.AllocationService\] \[master\] \[.kibana\_1\]\[0\] marking unavailable sh… --- ## [Can I hide legend from visualization?](https://discuss.elastic.co/t/can-i-hide-legend-from-visualization/258298)
**Author:** [@jhagen92](https://discuss.elastic.co/u/jhagen92)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 4:32pm UTC](https://discuss.elastic.co/t/can-i-hide-legend-from-visualization/258298 "2020-12-10T16:32:13Z")
Is there way to hide or remove legend from visualization? I am working on vertical bar.. --- ## [Problème connection filebeat](https://discuss.elastic.co/t/probleme-connection-filebeat/257870)
**Author:** [@f.boer](https://discuss.elastic.co/u/f.boer)\ **Replies:** 8\ **Last updated:** [December 10, 2020, 4:29pm UTC](https://discuss.elastic.co/t/probleme-connection-filebeat/257870 "2020-12-10T16:29:49Z")
bonjour je viens d'installer une version 7.10 d'elasticsearch pour pouvoir récupérer et stocker mes logs de firewall fortinet. Après recherche, il s'avère qu'il existe un module filebeat tout pret pour cela. j'ai instal… --- ## [Why collect the same log when I set different port?](https://discuss.elastic.co/t/why-collect-the-same-log-when-i-set-different-port/258211)
**Author:** [@111418](https://discuss.elastic.co/u/111418)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 4:29pm UTC](https://discuss.elastic.co/t/why-collect-the-same-log-when-i-set-different-port/258211 "2020-12-10T16:29:08Z")
I have two conf file in /etc/logstash/conf.d/. One is named "nas\_ftp.conf" and include below setting:\`\`\` input { tcp { port =\> 10515 } } filter { } output { elasticsearch { hosts … --- ## [Vega: Access nested fields of a JSON file](https://discuss.elastic.co/t/vega-access-nested-fields-of-a-json-file/258277)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 9\ **Last updated:** [December 10, 2020, 4:19pm UTC](https://discuss.elastic.co/t/vega-access-nested-fields-of-a-json-file/258277 "2020-12-10T16:19:49Z")
Consider the below response for an Elasticsearch query. "aggregations" : { "terms" : { "doc\_count\_error\_upper\_bound" : 0, "sum\_other\_doc\_count" : 0, "buckets" : \[ { "key" : "1", … --- ## [Vega: Field collapsing and inner hits not working for Vega visualization](https://discuss.elastic.co/t/vega-field-collapsing-and-inner-hits-not-working-for-vega-visualization/258233)
**Author:** [@ege](https://discuss.elastic.co/u/ege)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 4:06pm UTC](https://discuss.elastic.co/t/vega-field-collapsing-and-inner-hits-not-working-for-vega-visualization/258233 "2020-12-10T16:06:39Z")
Hi, I have an index with two fields; ID and Status. Each ID will have 3 statuses; start, pending and end, which are included in the same index. What I want to achieve is to get the last status for each ID from the index… --- ## [Limited time period in Canvas](https://discuss.elastic.co/t/limited-time-period-in-canvas/257219)
**Author:** [@axfla](https://discuss.elastic.co/u/axfla)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/limited-time-period-in-canvas/257219 "2020-12-10T15:30:25Z")
Hi, I am trying to make line graphs in Canvas based on an Elasticsearch SQL query. When I use the "preview data" button, the data is here. If I use data from the last 14 days, it works. But for some reason, if I try to … --- ## [Programmatically backup existing index pattern](https://discuss.elastic.co/t/programmatically-backup-existing-index-pattern/258058)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 1\ **Last updated:** [December 10, 2020, 3:28pm UTC](https://discuss.elastic.co/t/programmatically-backup-existing-index-pattern/258058 "2020-12-10T15:28:47Z")
I have 2 index patterns that are named exactly the same. One of them must be deleted to reduce confusion. When I get the json of them (through dev tools), I can see slight differences between them. I want to back them up… --- ## [How to downgrade elasticsearch single node from 7.9.2 to 7.9.1 with out any data loss](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-single-node-from-7-9-2-to-7-9-1-with-out-any-data-loss/258207)
**Author:** [@Vinay\_Kumar2](https://discuss.elastic.co/u/Vinay_Kumar2)\ **Replies:** 9\ **Last updated:** [December 10, 2020, 3:21pm UTC](https://discuss.elastic.co/t/how-to-downgrade-elasticsearch-single-node-from-7-9-2-to-7-9-1-with-out-any-data-loss/258207 "2020-12-10T15:21:22Z")
We are planning to downgrade elasticsearch 7.9.2 to 7.9.1. Please let us know how it will works with out any data loss along with the details. --- ## [Fleet Data Stream empty but only in default space](https://discuss.elastic.co/t/fleet-data-stream-empty-but-only-in-default-space/257902)
**Author:** [@danielhofer](https://discuss.elastic.co/u/danielhofer)\ **Replies:** 3\ **Last updated:** [December 10, 2020, 3:18pm UTC](https://discuss.elastic.co/t/fleet-data-stream-empty-but-only-in-default-space/257902 "2020-12-10T15:18:18Z")
Testing fleet and like it so much but only the default space shows data on the data stream view. Tried some rolles and user-settings but had no chance to get the data shown in other spaces. --- ## [API limited search results](https://discuss.elastic.co/t/api-limited-search-results/258300)
**Author:** [@hohooss](https://discuss.elastic.co/u/hohooss)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 3:18pm UTC](https://discuss.elastic.co/t/api-limited-search-results/258300 "2020-12-10T15:18:13Z")
Hello, I trying to do an elasticsearch API call that will retrieve results more than 200,000 hits, as it was confirmed by Kibana GUI search, but I always get the following message, i.e. 10000 hits: "took": 102, "ti… --- ## [Running filebeat modules alongside a custom pipeline](https://discuss.elastic.co/t/running-filebeat-modules-alongside-a-custom-pipeline/258272)
**Author:** [@pbatley](https://discuss.elastic.co/u/pbatley)\ **Replies:** 4\ **Last updated:** [December 10, 2020, 3:16pm UTC](https://discuss.elastic.co/t/running-filebeat-modules-alongside-a-custom-pipeline/258272 "2020-12-10T15:16:39Z")
I am completely new to Elastic so apologies if this is trivial. I have managed to set up the ELK stack (self managed, all on same host machine) and have got filebeat's apache module enable sending logs to logstash. I us… --- ## [Multi field search with wildcard expression in query](https://discuss.elastic.co/t/multi-field-search-with-wildcard-expression-in-query/258001)
**Author:** [@sreedhar1](https://discuss.elastic.co/u/sreedhar1)\ **Replies:** 5\ **Last updated:** [December 10, 2020, 3:12pm UTC](https://discuss.elastic.co/t/multi-field-search-with-wildcard-expression-in-query/258001 "2020-12-10T15:12:04Z")
Expecting text "abc" search against field1 or field2 to get the results. what is wrong in below query? s =\> s .Query(q =\> q .DisMax(d =\> d .Queries(q1 =\> q1 .Wildcard(w =\> w .Field(f =\> f.field1).Value("abc\*") .F… --- ## [Elasticsearch - update existing documents in different index](https://discuss.elastic.co/t/elasticsearch-update-existing-documents-in-different-index/258295)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 0\ **Last updated:** [December 10, 2020, 3:05pm UTC](https://discuss.elastic.co/t/elasticsearch-update-existing-documents-in-different-index/258295 "2020-12-10T15:05:16Z")
Here is my data set ticket\_id: T100 ticket\_status: open ticket\_updated\_date: 20201201T10:10:22 ticket\_id: T101 ticket\_status: open ticket\_updated\_date: 20201201T11:10:22 ticket\_id: T101 ticket\_status: closed ticket\_up… [Previous page](https://discuss.elastic.co/latest.md?page=1944) [Next page](https://discuss.elastic.co/latest.md?page=1946)