# Latest **URL:** https://discuss.elastic.co/latest.md?page=1959 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1960 --- ## [Elasticsearch bucket script aggregation in Kibana](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-in-kibana/257026)
**Author:** [@lakshman-battini](https://discuss.elastic.co/u/lakshman-battini)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 9:33am UTC](https://discuss.elastic.co/t/elasticsearch-bucket-script-aggregation-in-kibana/257026 "2020-12-04T09:33:28Z")
I am trying to create the visualization in Kibana, to show the count of orders whose average api time is less than 60 Sec. Below are the sample ES index documents: order\_id time api 1 50.0 /login 1 … --- ## [Does Filebeat Module fortinet support TLS/SSL](https://discuss.elastic.co/t/does-filebeat-module-fortinet-support-tls-ssl/257639)
**Author:** [@AndWe](https://discuss.elastic.co/u/AndWe)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 9:30am UTC](https://discuss.elastic.co/t/does-filebeat-module-fortinet-support-tls-ssl/257639 "2020-12-04T09:30:45Z")
Hi All Does the fortinet module for filebeat support TLS/SSL? According to documentation it doesn't. But for input its using the tcp input. And this input is supporting TLS/SSL. Any chance to implement TLS/SSL for for… --- ## [Canvas Search field with auto suggest](https://discuss.elastic.co/t/canvas-search-field-with-auto-suggest/257366)
**Author:** [@Alfar](https://discuss.elastic.co/u/Alfar)\ **Replies:** 3\ **Last updated:** [December 4, 2020, 9:23am UTC](https://discuss.elastic.co/t/canvas-search-field-with-auto-suggest/257366 "2020-12-04T09:23:18Z")
Hi there, Are there any ways to create a search field with auto suggest in Kibana Canvas.I already tried with drop down filter, but it does not work for search and auto suggest.Thankful for the positive responses --- ## [Logstash / Enrich processor event sample rate](https://discuss.elastic.co/t/logstash-enrich-processor-event-sample-rate/257635)
**Author:** [@fran6ssl](https://discuss.elastic.co/u/fran6ssl)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 9:18am UTC](https://discuss.elastic.co/t/logstash-enrich-processor-event-sample-rate/257635 "2020-12-04T09:18:14Z")
Hi, I have multiple CSVs files with sensors data. Each data file holds the timestamp and the numeric value of the sensor at that time. Each sensor has a different sample rate. For a exemple we have a temperature sensor… --- ## [Rollover exact definition in ILM policy](https://discuss.elastic.co/t/rollover-exact-definition-in-ilm-policy/257542)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 9:14am UTC](https://discuss.elastic.co/t/rollover-exact-definition-in-ilm-policy/257542 "2020-12-04T09:14:47Z")
Hello all ! In the delete phase of the ILM policy, we can delete x days or x hours from rollover. But what is exactly this "rollover" ? : Is it the date when index has been renewed as he reached max size (or documen… --- ## [Highlight and complex search](https://discuss.elastic.co/t/highlight-and-complex-search/257633)
**Author:** [@FABIAN\_HUTIN](https://discuss.elastic.co/u/FABIAN_HUTIN)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 9:10am UTC](https://discuss.elastic.co/t/highlight-and-complex-search/257633 "2020-12-04T09:10:35Z")
Hey guys, Newbie Elastic user here. I'd like to share with you an issue I have while using the highlight feature in a complex search operation. What I want to achieve is to get the list of fields that match my search … --- ## [Mapping is present but field is missing](https://discuss.elastic.co/t/mapping-is-present-but-field-is-missing/257500)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 9:01am UTC](https://discuss.elastic.co/t/mapping-is-present-but-field-is-missing/257500 "2020-12-04T09:01:19Z")
I have field which has mapping. I can verify that using GET /INDEX/\_mapping. However it is not visible in the fields in the search option in (Index pattern page). The field is visible in the Discover as well --- ## [Two Index pattern with different time filter field names](https://discuss.elastic.co/t/two-index-pattern-with-different-time-filter-field-names/257503)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 8:55am UTC](https://discuss.elastic.co/t/two-index-pattern-with-different-time-filter-field-names/257503 "2020-12-04T08:55:19Z")
I have one index and I want to visualize my data using two different time filters (i.e. two different fields). Do I need to create two index patterns? Is it even possible to create two index pattern on same index? I tho… --- ## [Node count doesn't match](https://discuss.elastic.co/t/node-count-doesnt-match/257623)
**Author:** [@Nicolaegis](https://discuss.elastic.co/u/Nicolaegis)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 8:33am UTC](https://discuss.elastic.co/t/node-count-doesnt-match/257623 "2020-12-04T08:33:11Z")
Hello, I manage a big Elasticsearch cluster with the following details: Elasticsearch version 5.6.6 Dedicated Master nodes - 3 Data nodes - 56 Total nodes - 59 Data nodes details : baremetal; 31 GB jvm heap; 4 x … --- ## [X-Pack / Elastic - Cannot read security-version string in index .security](https://discuss.elastic.co/t/x-pack-elastic-cannot-read-security-version-string-in-index-security/257595)
**Author:** [@luffy937](https://discuss.elastic.co/u/luffy937)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 8:28am UTC](https://discuss.elastic.co/t/x-pack-elastic-cannot-read-security-version-string-in-index-security/257595 "2020-12-04T08:28:15Z")
Hello All, I'm coming to you because I think I checked all possibilities to correct my issue... I run an Elastic stack in a docker-compose file, the stack run well but I have a lot of error message in my docker-compose… --- ## [DateTime in Human Readable format Kibana](https://discuss.elastic.co/t/datetime-in-human-readable-format-kibana/257618)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 8:18am UTC](https://discuss.elastic.co/t/datetime-in-human-readable-format-kibana/257618 "2020-12-04T08:18:50Z")
Hi Team, I was trying to create a metric visualization to show when was the last time server health is checked Max(DateTime) really doesnot make more sense to user,so i created the scripted field "LastCheckInHumanReada… --- ## [Filebeat ingestion pipeline for ElasticSearch slow logs](https://discuss.elastic.co/t/filebeat-ingestion-pipeline-for-elasticsearch-slow-logs/257133)
**Author:** [@libbkmz](https://discuss.elastic.co/u/libbkmz)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 8:15am UTC](https://discuss.elastic.co/t/filebeat-ingestion-pipeline-for-elasticsearch-slow-logs/257133 "2020-12-04T08:15:28Z")
Hello, I've found and possibly created a bug fix when ElasticSearch ingestion pipelines do not capture data from the regex groups in the grok processor. My setup - ES, Kibana, and Filebeat with version 7.6.2. I have th… --- ## [Connection Reset By Peer IOException](https://discuss.elastic.co/t/connection-reset-by-peer-ioexception/257457)
**Author:** [@surabhi11](https://discuss.elastic.co/u/surabhi11)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 8:06am UTC](https://discuss.elastic.co/t/connection-reset-by-peer-ioexception/257457 "2020-12-04T08:06:04Z")
Hi All, We are getting Connection reset by peer issue with ElasticSearch Rest Client connection. Below issue is faced with both single & multi node cluster setup. Can someone please help in resolving this issue? Than… --- ## [Visualization show date format have day of week in Kibana](https://discuss.elastic.co/t/visualization-show-date-format-have-day-of-week-in-kibana/257301)
**Author:** [@thuhaa](https://discuss.elastic.co/u/thuhaa)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 7:22am UTC](https://discuss.elastic.co/t/visualization-show-date-format-have-day-of-week-in-kibana/257301 "2020-12-04T07:22:33Z")
My index have date time type attribute. I want to create visualize use date histogram aggregation with interval days. It will be show date format like 2020-12-02. But I want to date show format have day of week like 2020… --- ## [Can't do rolling upgrade from 7.6.2 to 7.10.0](https://discuss.elastic.co/t/cant-do-rolling-upgrade-from-7-6-2-to-7-10-0/257549)
**Author:** [@rambling](https://discuss.elastic.co/u/rambling)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 7:07am UTC](https://discuss.elastic.co/t/cant-do-rolling-upgrade-from-7-6-2-to-7-10-0/257549 "2020-12-04T07:07:43Z")
Hello. I was trying to do rolling update data node from 7.6.2 to 7.10.0 on Ubuntu 18.04. I followed the instructions: but after the update Elasticsearch can't start with next outputs: Dec 03 17:15:21 test-es-data-… --- ## [No handler for type \[multi\_field\] declared on field,I am using es 7.9.1](https://discuss.elastic.co/t/no-handler-for-type-multi-field-declared-on-field-i-am-using-es-7-9-1/257570)
**Author:** [@sanyoja\_sagare](https://discuss.elastic.co/u/sanyoja_sagare)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 6:19am UTC](https://discuss.elastic.co/t/no-handler-for-type-multi-field-declared-on-field-i-am-using-es-7-9-1/257570 "2020-12-04T06:19:48Z")
No handler for type \[multi\_field\] declared on the field, I am using es 7.9.1 --- ## [Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"input\\", \\"filter\\", \\"output\\" at line 1, column 1 (byte 1)](https://discuss.elastic.co/t/expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/257612)
**Author:** [@ZoolYe](https://discuss.elastic.co/u/ZoolYe)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:09am UTC](https://discuss.elastic.co/t/expected-one-of-t-r-n-input-filter-output-at-line-1-column-1-byte-1/257612 "2020-12-04T06:09:10Z")
docker pull docker.elastic.co/logstash/logstash:7.10.0 docker run --name=logstash-7.10 -v /xxx/logstash.yml:/usr/share/logstash/config/logstash.yml -v /xxx/logstash.conf:/usr/share/logstash/pipeline/logstash.conf -d doc… --- ## [Elasticsearch Reads](https://discuss.elastic.co/t/elasticsearch-reads/257613)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 6:15am UTC](https://discuss.elastic.co/t/elasticsearch-reads/257613 "2020-12-04T06:15:21Z")
Is there a setting in elasticsearch such that reads should be routed to replicas only and if replica isn't available then only it should be directed to primary? I know we have a option \_replica\_first in request body bu… --- ## [Logstash websocket input](https://discuss.elastic.co/t/logstash-websocket-input/257610)
**Author:** [@wpitt13](https://discuss.elastic.co/u/wpitt13)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/logstash-websocket-input/257610 "2020-12-04T05:27:10Z")
Does the Logstash 'websocket' input plugin support authorization using Bearer tokens? I've tried multiple different syntaxes with no luck. --- ## [Duplicate events even after introducing fingerprint](https://discuss.elastic.co/t/duplicate-events-even-after-introducing-fingerprint/256355)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 4\ **Last updated:** [December 4, 2020, 4:53am UTC](https://discuss.elastic.co/t/duplicate-events-even-after-introducing-fingerprint/256355 "2020-12-04T04:53:33Z")
Hello All , We have a weird issue in ELK . We have introduced fingerprint in logstash , But still we can see the duplicates in Kibana. Kindly help how can we improve this . input { beats { port =\> 5044 tags =\> \["… --- ## [Applying platinum license in Kubernetes](https://discuss.elastic.co/t/applying-platinum-license-in-kubernetes/257554)
**Author:** [@ngilmore](https://discuss.elastic.co/u/ngilmore)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:51am UTC](https://discuss.elastic.co/t/applying-platinum-license-in-kubernetes/257554 "2020-12-04T04:51:19Z")
Hello, I am trying to apply the platinum license in code versus adding it through Kibana. How is this done? I know the standard of setting up the trial license first is - xpack.license.self\_generated.type: trial I wa… --- ## [Field not match error with default apache access logs](https://discuss.elastic.co/t/field-not-match-error-with-default-apache-access-logs/257608)
**Author:** [@ravindra2](https://discuss.elastic.co/u/ravindra2)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:46am UTC](https://discuss.elastic.co/t/field-not-match-error-with-default-apache-access-logs/257608 "2020-12-04T04:46:14Z")
Hi, I am using file-beat default apache access pipeline. And I am facing field not match error while parsing my log events. and for same logs it is parsing correctly in kibana dev console while passing my log data wi… --- ## [Achieving resilience for logstash database pipeline](https://discuss.elastic.co/t/achieving-resilience-for-logstash-database-pipeline/257607)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:41am UTC](https://discuss.elastic.co/t/achieving-resilience-for-logstash-database-pipeline/257607 "2020-12-04T04:41:13Z")
Hello Team, I am new to docker and just wanted to understand if i can achieve this, I have 3 node cluster and i am running logstash on one node , if that node goes down i want to start logstash on second node with last… --- ## [Accessing the logstash\_sqlite in logstash-input-mongodb plugin](https://discuss.elastic.co/t/accessing-the-logstash-sqlite-in-logstash-input-mongodb-plugin/257606)
**Author:** [@Durga\_AK](https://discuss.elastic.co/u/Durga_AK)\ **Replies:** 0\ **Last updated:** [December 4, 2020, 4:41am UTC](https://discuss.elastic.co/t/accessing-the-logstash-sqlite-in-logstash-input-mongodb-plugin/257606 "2020-12-04T04:41:06Z")
Hello, Im using the logstash-input-mongodb plugin to ingest data into Elastic Search from MongoDB, using logstash. I would like to know if the logstash\_sqlite can be accessed to know what in the latest \_id and also if t… --- ## [How to filter field with count in datatable](https://discuss.elastic.co/t/how-to-filter-field-with-count-in-datatable/257462)
**Author:** [@tungpzostar](https://discuss.elastic.co/u/tungpzostar)\ **Replies:** 2\ **Last updated:** [December 4, 2020, 4:25am UTC](https://discuss.elastic.co/t/how-to-filter-field-with-count-in-datatable/257462 "2020-12-04T04:25:47Z")
I have field state which has 2 values "BEGIN" and "END", I want to show count when state is "BEGIN" so I've tried { "query": { "match\_phrase": { "state": "BEGIN" } } } but nothing works, any idea how … --- ## [Setup SSO with Azure](https://discuss.elastic.co/t/setup-sso-with-azure/257591)
**Author:** [@Ej\_Eric\_H](https://discuss.elastic.co/u/Ej_Eric_H)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 4:18am UTC](https://discuss.elastic.co/t/setup-sso-with-azure/257591 "2020-12-04T04:18:31Z")
Hello, I am trying to setup SSO on elastic cloud using the instructions below. How do i complete the "create a role Mapping" step? I am new to this program, sorry if this is basic knowledge. Is the API the only way? If… --- ## [Heartbeat-Elastic unable to get data](https://discuss.elastic.co/t/heartbeat-elastic-unable-to-get-data/256463)
**Author:** [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\ **Replies:** 13\ **Last updated:** [December 4, 2020, 2:22am UTC](https://discuss.elastic.co/t/heartbeat-elastic-unable-to-get-data/256463 "2020-12-04T02:22:23Z")
Hi I have upgraded my Heartbeat-elastic to 7.9.1. But later on all the data are not coming in. Below are the ELSK version I am having: Kibana - 7.7.0 Filebeat - 7.7.0 Logstash - 7.9.1 Please advise how can I debug a… --- ## [ES snapshot fails on Azure - even though repository is fine and working](https://discuss.elastic.co/t/es-snapshot-fails-on-azure-even-though-repository-is-fine-and-working/257393)
**Author:** [@spdoes](https://discuss.elastic.co/u/spdoes)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 2:02am UTC](https://discuss.elastic.co/t/es-snapshot-fails-on-azure-even-though-repository-is-fine-and-working/257393 "2020-12-04T02:02:32Z")
Verification status says connected I already did clean up When I try to list the repo in DevTools (in Kibana), it gives me timeout All directories and files permission are fine (I am comparing to another worki… --- ## [Simultaneous Filebeats to handle high load](https://discuss.elastic.co/t/simultaneous-filebeats-to-handle-high-load/257498)
**Author:** [@talsh87](https://discuss.elastic.co/u/talsh87)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 1:59am UTC](https://discuss.elastic.co/t/simultaneous-filebeats-to-handle-high-load/257498 "2020-12-04T01:59:10Z")
I'd like to leverage Filebeat so it'd fetch our o365\\azure\\aws logs using the various modules. I'd like to understand how would it handle with very high volumes? Any way to maintain a cluster of Filebeat clusters? Did… --- ## [Kibana Elasticsearch does not recognize repository snapshots created for retrieval](https://discuss.elastic.co/t/kibana-elasticsearch-does-not-recognize-repository-snapshots-created-for-retrieval/257518)
**Author:** [@Nacho\_Revilla](https://discuss.elastic.co/u/Nacho_Revilla)\ **Replies:** 1\ **Last updated:** [December 4, 2020, 1:53am UTC](https://discuss.elastic.co/t/kibana-elasticsearch-does-not-recognize-repository-snapshots-created-for-retrieval/257518 "2020-12-04T01:53:38Z")
Hello everybody, I have a problem when recovering a snapshot from kibana, apparently it does not recognize the repository for its recovery. somebody could help me? Thanks a lot [Previous page](https://discuss.elastic.co/latest.md?page=1958) [Next page](https://discuss.elastic.co/latest.md?page=1960)