# Latest **URL:** https://discuss.elastic.co/latest.md?page=1960 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1961 --- ## [One ES container with n search threads is slower than two containers with n/2 search threads](https://discuss.elastic.co/t/one-es-container-with-n-search-threads-is-slower-than-two-containers-with-n-2-search-threads/256965)
**Author:** [@alexklibisz](https://discuss.elastic.co/u/alexklibisz)\ **Replies:** 18\ **Last updated:** [December 4, 2020, 12:42am UTC](https://discuss.elastic.co/t/one-es-container-with-n-search-threads-is-slower-than-two-containers-with-n-2-search-threads/256965 "2020-12-04T00:42:46Z")
I'm running a benchmark to optimize for search throughput (i.e. queries/second). The query I'm profiling is a custom query in an Elasticsearch plugin. The query is very similar to the Terms Set Query. I tried one setup … --- ## [Consolidating/aggregating ES documents on one ELK stack](https://discuss.elastic.co/t/consolidating-aggregating-es-documents-on-one-elk-stack/257428)
**Author:** [@Asher](https://discuss.elastic.co/u/Asher)\ **Replies:** 8\ **Last updated:** [December 3, 2020, 10:17pm UTC](https://discuss.elastic.co/t/consolidating-aggregating-es-documents-on-one-elk-stack/257428 "2020-12-03T22:17:09Z")
Hi all, I'm trying to solve the following problem: I have data in RDSs (Aurora MySQL), a subset of which I'm going to map to Elasticsearch using the AWS Database Migration Service. Unfortunately, we have full deployment… --- ## [How to Disable SSL Certificate Verification for Logstash-Plugin (installing plugins)](https://discuss.elastic.co/t/how-to-disable-ssl-certificate-verification-for-logstash-plugin-installing-plugins/257590)
**Author:** [@Jeremy\_A](https://discuss.elastic.co/u/Jeremy_A)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 9:44pm UTC](https://discuss.elastic.co/t/how-to-disable-ssl-certificate-verification-for-logstash-plugin-installing-plugins/257590 "2020-12-03T21:44:34Z")
This is more of an information post than a question, because I noticed several unanswered questions along these lines while searching for a solution myself. The problem occurs when trying to use bin/logstash-plugin to i… --- ## [How to read logs from docker containers running in a docker swarm cluster](https://discuss.elastic.co/t/how-to-read-logs-from-docker-containers-running-in-a-docker-swarm-cluster/257564)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 2\ **Last updated:** [December 3, 2020, 9:28pm UTC](https://discuss.elastic.co/t/how-to-read-logs-from-docker-containers-running-in-a-docker-swarm-cluster/257564 "2020-12-03T21:28:33Z")
Hello, I have several java applications that are running as different services in a docker swarm cluster. I would like filebeat to be able to read the logs of the containers and I can see that it has a docker input but … --- ## [Ansible-elasticsearch es\_api\_basic\_auth\_username as 'elastic' user](https://discuss.elastic.co/t/ansible-elasticsearch-es-api-basic-auth-username-as-elastic-user/257150)
**Author:** [@tummulu](https://discuss.elastic.co/u/tummulu)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 8:32pm UTC](https://discuss.elastic.co/t/ansible-elasticsearch-es-api-basic-auth-username-as-elastic-user/257150 "2020-12-03T20:32:37Z")
I am having two issues using this role with es\_api\_basic\_auth\_username as 'elastic', when I run it first time it updates the elastic user password but fails to update the reserved user passwords but Elasticsearch service… --- ## [Cisco Module/Meraki not properly parsing date on all events](https://discuss.elastic.co/t/cisco-module-meraki-not-properly-parsing-date-on-all-events/257584)
**Author:** [@justinainsworth](https://discuss.elastic.co/u/justinainsworth)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 8:29pm UTC](https://discuss.elastic.co/t/cisco-module-meraki-not-properly-parsing-date-on-all-events/257584 "2020-12-03T20:29:49Z")
I've been playing around with the new Meraki fileset in the Cisco module, and have noticed that for some event types, the date is not properly parsed, and i get a @timestamp of '1970-01-01T00:00:03.000Z'. Here is a samp… --- ## [Найти все документы с максимальным значением](https://discuss.elastic.co/t/topic/257513)
**Author:** [@Leleka](https://discuss.elastic.co/u/Leleka)\ **Replies:** 5\ **Last updated:** [December 3, 2020, 6:41pm UTC](https://discuss.elastic.co/t/topic/257513 "2020-12-03T18:41:00Z")
У меня есть такая структура БД в эластике: \[ { "Number": 250, "Date": 1606996816 }, { "Number": 251, "Date": 1606997816 }, { "Number": 251, "Date": 160… --- ## [How to create bar chart with time intervals x axis in kibana?](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 6:15pm UTC](https://discuss.elastic.co/t/how-to-create-bar-chart-with-time-intervals-x-axis-in-kibana/257359 "2020-12-03T18:15:57Z")
how to create bar chart with time intervals x axis in kibana? Can be with JSON or grok. --- ## [Upgraded beats (7.10) still writing to old version indices](https://discuss.elastic.co/t/upgraded-beats-7-10-still-writing-to-old-version-indices/257405)
**Author:** [@rgeisman](https://discuss.elastic.co/u/rgeisman)\ **Replies:** 9\ **Last updated:** [December 3, 2020, 6:12pm UTC](https://discuss.elastic.co/t/upgraded-beats-7-10-still-writing-to-old-version-indices/257405 "2020-12-03T18:12:03Z")
Hello all. A maddening problem. We upgraded our cluster to 7.10 (ES, Logstash, Metricbeat, Auditbeat, Filebeat). Since we use Logstash I manually loaded each index template for the beats and default dashboards, then I … --- ## [Error Metricbeats in Kibana](https://discuss.elastic.co/t/error-metricbeats-in-kibana/256402)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 2\ **Last updated:** [December 3, 2020, 6:10pm UTC](https://discuss.elastic.co/t/error-metricbeats-in-kibana/256402 "2020-12-03T18:10:34Z")
\[exception\] Security must be explicitly enabled when using a \[basic\] license. Enable security by setting \[xpack.security.enabled\] to \[true\] in the elasticsearch.yml file and restart the node.: Check the Elasticsearch Mon… --- ## [Indexing JSON throws MapperParsingException](https://discuss.elastic.co/t/indexing-json-throws-mapperparsingexception/257563)
**Author:** [@hKerma](https://discuss.elastic.co/u/hKerma)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 6:06pm UTC](https://discuss.elastic.co/t/indexing-json-throws-mapperparsingexception/257563 "2020-12-03T18:06:09Z")
Hi everyone, I created that topic, thinking I had a Logstash issue, but it seems like it's an Elasticsearch indexing issue. Let me recap : I'm trying to parse and index k8s audit logs, which are valid JSONs, with Logst… --- ## [Indexing error "Index -1 out of bounds for length 0"](https://discuss.elastic.co/t/indexing-error-index-1-out-of-bounds-for-length-0/257379)
**Author:** [@hKerma](https://discuss.elastic.co/u/hKerma)\ **Replies:** 9\ **Last updated:** [December 3, 2020, 5:51pm UTC](https://discuss.elastic.co/t/indexing-error-index-1-out-of-bounds-for-length-0/257379 "2020-12-03T17:51:55Z")
Hi everyone, I want to use ELK stack to analyze some Kubernetes audit logs. They're sent to the Logstash webhook as JSON. Here's my config file : input{ http { port =\> 8888 codec =\> "json" type =\> "json" } }… --- ## [Find the unique transactions between passed and failed logs](https://discuss.elastic.co/t/find-the-unique-transactions-between-passed-and-failed-logs/257556)
**Author:** [@kartikr9107](https://discuss.elastic.co/u/kartikr9107)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 5:44pm UTC](https://discuss.elastic.co/t/find-the-unique-transactions-between-passed-and-failed-logs/257556 "2020-12-03T17:44:04Z")
I've created a visualization to show metrics like Total requests, Unique Tests(unique count of test field), Tests failed (Sum bucket with filter for failed tests unique count), Test passed(Sum bucket with filter for pass… --- ## [APM queue is full (output Kafka)](https://discuss.elastic.co/t/apm-queue-is-full-output-kafka/257382)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 4\ **Last updated:** [December 3, 2020, 5:33pm UTC](https://discuss.elastic.co/t/apm-queue-is-full-output-kafka/257382 "2020-12-03T17:33:10Z")
Hi, What can I do if the APM server (7.9.2) continuously logs 503 errors (queue is full)? I checked the tuning options but for many reasons my output isn't Elasticsearch but Kafka and I couldn't find any pointer that wo… --- ## [Upload csv file without timestamp to kibana with ML fails](https://discuss.elastic.co/t/upload-csv-file-without-timestamp-to-kibana-with-ml-fails/257376)
**Author:** [@christophe\_spielmann](https://discuss.elastic.co/u/christophe_spielmann)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 5:02pm UTC](https://discuss.elastic.co/t/upload-csv-file-without-timestamp-to-kibana-with-ml-fails/257376 "2020-12-03T17:02:24Z")
Hello, in the data visualizer of the Machine learning, we used to have a feature to upload a csv. there is blog about that https://www.elastic.co/blog/importing-csv-and-log-data-into-elasticsearch-with-file-data-visual… --- ## [Add value to blank field](https://discuss.elastic.co/t/add-value-to-blank-field/257286)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 6\ **Last updated:** [December 3, 2020, 4:56pm UTC](https://discuss.elastic.co/t/add-value-to-blank-field/257286 "2020-12-03T16:56:44Z")
Hi, I am running with an issue, I have a shipment date column which is having a blank value until your order is not shipped, so if the order is not shipped (you can say it's pending now) i want to add a value to that f… --- ## [No logs found for filebeat](https://discuss.elastic.co/t/no-logs-found-for-filebeat/257519)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 8\ **Last updated:** [December 3, 2020, 4:55pm UTC](https://discuss.elastic.co/t/no-logs-found-for-filebeat/257519 "2020-12-03T16:55:08Z")
Hello, I am using filebeat 7.10 on Debian machine and I configured it to send data to /var/log/filebeat : logging.level: info logging.to\_file: true logging.files: path: /var/log/filebeat name: filebeat keepfiles… --- ## [Cosine Similarity Script Search does not work](https://discuss.elastic.co/t/cosine-similarity-script-search-does-not-work/257550)
**Author:** [@gustav\_z](https://discuss.elastic.co/u/gustav_z)\ **Replies:** 0\ **Last updated:** [December 3, 2020, 4:37pm UTC](https://discuss.elastic.co/t/cosine-similarity-script-search-does-not-work/257550 "2020-12-03T16:37:54Z")
Similar to these un-answered and closed topics: https://discuss.elastic.co/t/cosine-similarity-not-working-in-elastic-search/209702 https://discuss.elastic.co/t/elasticsearch-search-error/232784 I am seeing the same E… --- ## [Getting aws internal ip when using dns plugin i want to see actual dns name like abc.test.com](https://discuss.elastic.co/t/getting-aws-internal-ip-when-using-dns-plugin-i-want-to-see-actual-dns-name-like-abc-test-com/257455)
**Author:** [@sujeetjha](https://discuss.elastic.co/u/sujeetjha)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 4:35pm UTC](https://discuss.elastic.co/t/getting-aws-internal-ip-when-using-dns-plugin-i-want-to-see-actual-dns-name-like-abc-test-com/257455 "2020-12-03T16:35:46Z")
Getting AWS internal IP (ip-11-11-11-11-amazon.com) when using DNS plugin I want to see actual DNS name like abc.test.com.. what should I do plz suggest... here is my code below # Beats -\> Logstash -\> Elasticsearch pip… --- ## [How can I create a sequence diagram using Vega or Vega-lite?](https://discuss.elastic.co/t/how-can-i-create-a-sequence-diagram-using-vega-or-vega-lite/257502)
**Author:** [@shalintha](https://discuss.elastic.co/u/shalintha)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 4:35pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-sequence-diagram-using-vega-or-vega-lite/257502 "2020-12-03T16:35:39Z")
I want to create a Sequence diagram using Vega visualize for my Kibana Dashboard. Is there a way to create Sequence diagram using Vega or Vega-lite (or using D3js)? --- ## [ML query](https://discuss.elastic.co/t/ml-query/257418)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 4:26pm UTC](https://discuss.elastic.co/t/ml-query/257418 "2020-12-03T16:26:14Z")
Is it possible to do an ML job that says If event.code: 4264 and 4265 within 30 minutes ? --- ## [How to change date format in logstash?](https://discuss.elastic.co/t/how-to-change-date-format-in-logstash/257532)
**Author:** [@reillye](https://discuss.elastic.co/u/reillye)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 4:16pm UTC](https://discuss.elastic.co/t/how-to-change-date-format-in-logstash/257532 "2020-12-03T16:16:29Z")
My raw data comes in epoch format e.g. 430201865. I can parse this to UNIX using the date filter in logstash like so date { match =\> \["time", "UNIX"\] target =\> "timestamp" remove\_field =\> \["time"\] } This produces… --- ## [How to make the "Discover" tab data to Table view](https://discuss.elastic.co/t/how-to-make-the-discover-tab-data-to-table-view/257001)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 12\ **Last updated:** [December 3, 2020, 4:14pm UTC](https://discuss.elastic.co/t/how-to-make-the-discover-tab-data-to-table-view/257001 "2020-12-03T16:14:43Z")
Hi, Right now the default looks of the discover mode is not in table view, just wondering is there a setting to change the documents show in a table view, instead of document per document ? --- ## [Logstash Input Plugin Development with File Input Plugin](https://discuss.elastic.co/t/logstash-input-plugin-development-with-file-input-plugin/257486)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 4:07pm UTC](https://discuss.elastic.co/t/logstash-input-plugin-development-with-file-input-plugin/257486 "2020-12-03T16:07:20Z")
Hello, I would like to ask, if its possible to pass file input plugin output in a new\_input\_plugin. I mean like output of the file input plugin, will be the input of another input plugin. As an example, Read logs from… --- ## [How to create visualisation in kibana for stickiness(Ratio of DAU/MAU)](https://discuss.elastic.co/t/how-to-create-visualisation-in-kibana-for-stickiness-ratio-of-dau-mau/257340)
**Author:** [@dharanesh](https://discuss.elastic.co/u/dharanesh)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 3:59pm UTC](https://discuss.elastic.co/t/how-to-create-visualisation-in-kibana-for-stickiness-ratio-of-dau-mau/257340 "2020-12-03T15:59:34Z")
Hi, i am new to kibana, i created separate visualisation for DAU and MAU now i want to create another chats which shows Ratio of DAU and MAU, how to do this in kibana , is it possible to create charts for this in kibana. … --- ## [Kibana preserve custom time from dasboard to Discover](https://discuss.elastic.co/t/kibana-preserve-custom-time-from-dasboard-to-discover/257284)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 1\ **Last updated:** [December 3, 2020, 3:55pm UTC](https://discuss.elastic.co/t/kibana-preserve-custom-time-from-dasboard-to-discover/257284 "2020-12-03T15:55:28Z")
How to preserve chosen time in Kibana Dashboard by clicking on link to Discover panel? I need to view documents from specific time according to peaks in graphs in Dashboard. Therefore my chosen time is within 3-4 min ti… --- ## [Logstah reading from elastic daily based index name](https://discuss.elastic.co/t/logstah-reading-from-elastic-daily-based-index-name/257278)
**Author:** [@lecko](https://discuss.elastic.co/u/lecko)\ **Replies:** 4\ **Last updated:** [December 3, 2020, 3:45pm UTC](https://discuss.elastic.co/t/logstah-reading-from-elastic-daily-based-index-name/257278 "2020-12-03T15:45:47Z")
Hello, I am new to logstash.I I want to get data out of elasticsearch and filter it and send it to some third party sw. With help of examples and docs the first draft seems to work. But the elasticsearch index name i… --- ## [Kibana requesting too many doc values](https://discuss.elastic.co/t/kibana-requesting-too-many-doc-values/147760)
**Author:** [@mightyguava](https://discuss.elastic.co/u/mightyguava)\ **Replies:** 4\ **Last updated:** [December 3, 2020, 3:40pm UTC](https://discuss.elastic.co/t/kibana-requesting-too-many-doc-values/147760 "2020-12-03T15:40:07Z")
We have an elasticsearch cluster that indexes some events that flow through our system for debugging use. These events have pretty widely varying formats, so they end up generating a lot of different fields. Kibana maps … --- ## [Logstash with multiple input and output](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524)
**Author:** [@ck\_7](https://discuss.elastic.co/u/ck_7)\ **Replies:** 4\ **Last updated:** [December 3, 2020, 3:18pm UTC](https://discuss.elastic.co/t/logstash-with-multiple-input-and-output/257524 "2020-12-03T15:18:56Z")
Help me to understand the below logstash config. Trying to configure multiples input and output but index shows only one. Here my config: There is no Error: logstash runs but no index name for the storage. only network… --- ## [Is it possible to combine two datatable from multiple essql filters](https://discuss.elastic.co/t/is-it-possible-to-combine-two-datatable-from-multiple-essql-filters/257290)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 3\ **Last updated:** [December 3, 2020, 3:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-combine-two-datatable-from-multiple-essql-filters/257290 "2020-12-03T15:23:32Z")
Hi, I have a data source like below: - TYPE VALUE A 123 A 234 B 890 A 789 B 085 I need to pull the latest record for each type i.e. there will be two rows in the resu… [Previous page](https://discuss.elastic.co/latest.md?page=1959) [Next page](https://discuss.elastic.co/latest.md?page=1961)