# Latest **URL:** https://discuss.elastic.co/latest.md?page=1967 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1968 --- ## [Help sorting an average bucket visualization](https://discuss.elastic.co/t/help-sorting-an-average-bucket-visualization/257190)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:39am UTC](https://discuss.elastic.co/t/help-sorting-an-average-bucket-visualization/257190 "2020-12-01T10:39:45Z")
Hello, I am trying to sort results by their "Y axis" value, but I am using an average bucket aggregation and it seems that the sort option I use is bad... Context: I have users (field "penta\_source.keyword") sending a… --- ## [Watcher triggers when it shouldn't](https://discuss.elastic.co/t/watcher-triggers-when-it-shouldnt/256351)
**Author:** [@Jeroen2](https://discuss.elastic.co/u/Jeroen2)\ **Replies:** 3\ **Last updated:** [December 1, 2020, 10:36am UTC](https://discuss.elastic.co/t/watcher-triggers-when-it-shouldnt/256351 "2020-12-01T10:36:09Z")
I've created some watchers to check if all communications are working in our company. This watcher should trigger when there's no hits in the pas hour. The problem is it fires sometimes, when I run the exact same query … --- ## [Not able to sort data in kibana UI](https://discuss.elastic.co/t/not-able-to-sort-data-in-kibana-ui/254102)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 15\ **Last updated:** [December 1, 2020, 10:24am UTC](https://discuss.elastic.co/t/not-able-to-sort-data-in-kibana-ui/254102 "2020-12-01T10:24:11Z")
Hi Team, I am not able to sort data in kibana, Data in kibana UI are jumbled . Is there any way to sort data in Kibana UI? --- ## [Filebeat Cisco ASA Module failing to parse](https://discuss.elastic.co/t/filebeat-cisco-asa-module-failing-to-parse/254304)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 11\ **Last updated:** [December 1, 2020, 10:18am UTC](https://discuss.elastic.co/t/filebeat-cisco-asa-module-failing-to-parse/254304 "2020-12-01T10:18:01Z")
I have a Filebeat 7.9.3 shipper confirmed sending logs using two modules panw and cisco, specifically the ASA feature. I am only seeing entries for the panw module, but I know the cisco logs are there somewhere. After … --- ## [Logstash file read , mode read, sincedb, duplicate events after restart logstash](https://discuss.elastic.co/t/logstash-file-read-mode-read-sincedb-duplicate-events-after-restart-logstash/257126)
**Author:** [@slast](https://discuss.elastic.co/u/slast)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 10:15am UTC](https://discuss.elastic.co/t/logstash-file-read-mode-read-sincedb-duplicate-events-after-restart-logstash/257126 "2020-12-01T10:15:12Z")
Hi Guys Can you help me I have a problem with reading files from logstash. After restarting logstash, it rereads the files again and sends events to Elastic. This folder is mounted from another server /opt/Logstore/… --- ## [Use json and plain text beats from filebeat to output to syslog configured in logstash](https://discuss.elastic.co/t/use-json-and-plain-text-beats-from-filebeat-to-output-to-syslog-configured-in-logstash/257186)
**Author:** [@Arjun\_kochhar](https://discuss.elastic.co/u/Arjun_kochhar)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:13am UTC](https://discuss.elastic.co/t/use-json-and-plain-text-beats-from-filebeat-to-output-to-syslog-configured-in-logstash/257186 "2020-12-01T10:13:05Z")
Hi, Very new to logstash and have a use case that I want to achieve. I have two different filebeat instances that write to same logstash instance. filebeat instance 1 sends json output and also sets field as json, while … --- ## [Divide 2 scripted fields in TSVB](https://discuss.elastic.co/t/divide-2-scripted-fields-in-tsvb/257183)
**Author:** [@SwapnilKshirsagar](https://discuss.elastic.co/u/SwapnilKshirsagar)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 10:00am UTC](https://discuss.elastic.co/t/divide-2-scripted-fields-in-tsvb/257183 "2020-12-01T10:00:07Z")
Hi everyone I'm New to Elastic and Kibana. I am stuck in painless scripting to apply 2 filters on a single index and store them as a 2 different scripted fields. Each scripted field has 2 filters applied on it one is St… --- ## [Plugin is invisible after added security dependency in kibana.json in 7.9.3](https://discuss.elastic.co/t/plugin-is-invisible-after-added-security-dependency-in-kibana-json-in-7-9-3/257017)
**Author:** [@nrt.krishna](https://discuss.elastic.co/u/nrt.krishna)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 9:49am UTC](https://discuss.elastic.co/t/plugin-is-invisible-after-added-security-dependency-in-kibana-json-in-7-9-3/257017 "2020-12-01T09:49:49Z")
Hi All, I am trying to get current username in my custom plugin which is developed based on 7.9.3. I followed helpful instructions provided here. But when I added "security" as required dependencies in kibana.json my pl… --- ## [Cross cluster replication in different regions in aws elasticsearch](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067)
**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\ **Replies:** 8\ **Last updated:** [December 1, 2020, 9:18am UTC](https://discuss.elastic.co/t/cross-cluster-replication-in-different-regions-in-aws-elasticsearch/257067 "2020-12-01T09:18:42Z")
Hi .. i am migrating to aws managed elasticsearch from self hosted es.. as part of migration facing an issue with backup(snapshot) and restore. we have 2 distinct clusters preferably us-east and us-west , snapshot repos… --- ## [Functional boost on a date field](https://discuss.elastic.co/t/functional-boost-on-a-date-field/257085)
**Author:** [@Damien\_Alexandre](https://discuss.elastic.co/u/Damien_Alexandre)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 9:02am UTC](https://discuss.elastic.co/t/functional-boost-on-a-date-field/257085 "2020-12-01T09:02:17Z")
Hi! I'm trying App Search and I was wondering if there is a workaround to boost documents by "freshness" (the closer the date, the better the score). I see here Relevance Tuning Guide, Weights and Boosts | Elastic App … --- ## [Mongo driver 4.x is not supported on Java](https://discuss.elastic.co/t/mongo-driver-4-x-is-not-supported-on-java/248571)
**Author:** [@marcelo.pio](https://discuss.elastic.co/u/marcelo.pio)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 8:39am UTC](https://discuss.elastic.co/t/mongo-driver-4-x-is-not-supported-on-java/248571 "2020-12-01T08:39:02Z")
Kibana version:7.9 Elasticsearch version:7.9 APM Server version:7.9 APM Agent language and version:Java - 1.18.0 Browser version:Firefox 80.0.1 Original install method (e.g. download page, yum, deb, from source, etc… --- ## [Elasticsearch available on internal and public ip](https://discuss.elastic.co/t/elasticsearch-available-on-internal-and-public-ip/257170)
**Author:** [@Bertram\_van\_de\_Ven](https://discuss.elastic.co/u/Bertram_van_de_Ven)\ **Replies:** 1\ **Last updated:** [December 1, 2020, 8:32am UTC](https://discuss.elastic.co/t/elasticsearch-available-on-internal-and-public-ip/257170 "2020-12-01T08:32:57Z")
We have an ElasticSearch cluster running, it's local (company network) available and everything works. And I also made each node available on an external ip by configuring the network.bind\_host on localhost, local and pu… --- ## [FATAL Error: \[config validation of \[server\].cors\]: expected value of type \[boolean\] but got \[Object\]](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-cors-expected-value-of-type-boolean-but-got-object/254576)
**Author:** [@JonathanDSSOUZA](https://discuss.elastic.co/u/JonathanDSSOUZA)\ **Replies:** 5\ **Last updated:** [December 1, 2020, 7:23am UTC](https://discuss.elastic.co/t/fatal-error-config-validation-of-server-cors-expected-value-of-type-boolean-but-got-object/254576 "2020-12-01T07:23:08Z")
After updating the ELK from version 7.6.1 to 7.9.2, the kibana does not start, presenting the errors: kibana: FATAL Error: \[config validation of \[server\].cors\]: expected value of type \[boolean\] but got \[Object\] {"type… --- ## [Kibana plugin. Is it possible to use joi validation in router?](https://discuss.elastic.co/t/kibana-plugin-is-it-possible-to-use-joi-validation-in-router/255438)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 7:20am UTC](https://discuss.elastic.co/t/kibana-plugin-is-it-possible-to-use-joi-validation-in-router/255438 "2020-12-01T07:20:18Z")
the schema from @kibana/config-schema has too few features --- ## [Problem with ILM](https://discuss.elastic.co/t/problem-with-ilm/255946)
**Author:** [@BoKu](https://discuss.elastic.co/u/BoKu)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 7:10am UTC](https://discuss.elastic.co/t/problem-with-ilm/255946 "2020-12-01T07:10:48Z")
Hello, i have a problem understanding ILM with index alias on an custom created index. I have an custom index oracle-logs, which is feeded by logstash (which gets the documents from filebeat), it then sends the document… --- ## [Data node constantly dropping out of the cluster](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163)
**Author:** [@RusseL](https://discuss.elastic.co/u/RusseL)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 7:05am UTC](https://discuss.elastic.co/t/data-node-constantly-dropping-out-of-the-cluster/257163 "2020-12-01T07:05:04Z")
The data node is constantly falling from the cluster, I don't understand why.Can you please help me? I'm too new to find out why myself. I shared it all here --- ## [Metricbeat using more than expected memory](https://discuss.elastic.co/t/metricbeat-using-more-than-expected-memory/257144)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:47am UTC](https://discuss.elastic.co/t/metricbeat-using-more-than-expected-memory/257144 "2020-12-01T06:47:39Z")
I want to use metricbeat to track logstash and have followed the instructions here:https://www.elastic.co/guide/en/logstash/current/monitoring-with-metricbeat.html. Everything worked but metricbeat is using 1.3gb of ram … --- ## [How to build Elasticsearch from source without xpack](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299)
**Author:** [@kayshu](https://discuss.elastic.co/u/kayshu)\ **Replies:** 6\ **Last updated:** [December 1, 2020, 6:13am UTC](https://discuss.elastic.co/t/how-to-build-elasticsearch-from-source-without-xpack/256299 "2020-12-01T06:13:04Z")
Hi, i am trying to build a non-snapshot build of elasticsearch from source using gradle assemble -Dbuild.snapshot=false But I am getting the following exception Property license.key must be set for release build I th… --- ## [How to add a field if the string matches a word in message](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804)
**Author:** [@Guhan\_S](https://discuss.elastic.co/u/Guhan_S)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 6:10am UTC](https://discuss.elastic.co/t/how-to-add-a-field-if-the-string-matches-a-word-in-message/255804 "2020-12-01T06:10:40Z")
{"level":30,"time":1605686969640,"pid":1,"hostname":"ip-100-91-70-500","name":"ZA-dev", this is my sample logs, here i am trying to achieve, if level:30 in message it has to create info log-level, i tired filter { … --- ## [How to collect the network information (data) through metricbeat from windows OS](https://discuss.elastic.co/t/how-to-collect-the-network-information-data-through-metricbeat-from-windows-os/256754)
**Author:** [@naveen\_reddy](https://discuss.elastic.co/u/naveen_reddy)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 6:00am UTC](https://discuss.elastic.co/t/how-to-collect-the-network-information-data-through-metricbeat-from-windows-os/256754 "2020-12-01T06:00:09Z")
i am not able to collect the process and network related information from metric beats can one help me please... --- ## [Mapping field as geo\_point](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108)
**Author:** [@blitzcrg](https://discuss.elastic.co/u/blitzcrg)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:26am UTC](https://discuss.elastic.co/t/mapping-field-as-geo-point/257108 "2020-12-01T05:26:23Z")
I am having some issues with the logstash geoip plugin that I think stem from a lack of understanding with respect to how the elasticsearch output plugin and index mappings interact. Specifically, I need to ensure that s… --- ## [Cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148)
**Author:** [@wfeng888](https://discuss.elastic.co/u/wfeng888)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/257148 "2020-12-01T04:03:07Z")
I have a cluster with two nodes , version es5.4.3. About 26 shards unassigned after machine down. I get these message GET /\_cluster/allocation/explain { "index": "dcvs\_nonmotorvehicle", "shard": 3, "primary":… --- ## [Use of URL template](https://discuss.elastic.co/t/use-of-url-template/256641)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 5:12am UTC](https://discuss.elastic.co/t/use-of-url-template/256641 "2020-12-01T05:12:20Z")
How can I use context.panel.filters to open another dashboard in Kibana using URL drill-down in a new tab as new tab support is not available for dashboard drill down in kibana 7.10. Thanks in Advance. --- ## [ElasticAPM, trace class&method name with zero code change setup on .net programming](https://discuss.elastic.co/t/elasticapm-trace-class-method-name-with-zero-code-change-setup-on-net-programming/257015)
**Author:** [@JulietCeaser](https://discuss.elastic.co/u/JulietCeaser)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 3:03am UTC](https://discuss.elastic.co/t/elasticapm-trace-class-method-name-with-zero-code-change-setup-on-net-programming/257015 "2020-12-01T03:03:40Z")
In Elastic APM, I want to trace class name, method name, etc in transactions with Zero code change setup on .NET Core. Is it possible? If possible, could you guide me reference link or tell me how to set up. Kibana ve… --- ## [How to rename some fields by using regex statement](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031)
**Author:** [@xrubick](https://discuss.elastic.co/u/xrubick)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 2:45am UTC](https://discuss.elastic.co/t/how-to-rename-some-fields-by-using-regex-statement/257031 "2020-12-01T02:45:04Z")
this's my logstash output: "prometheus" =\> { "metrics" =\> { "container\_cpu\_load\_average\_10s" =\> 0, "container\_cpu\_user\_seconds\_total" =\> 18.15, "container\_cpu\_syst… --- ## [Reindex from a remote cluster](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922)
**Author:** [@twang](https://discuss.elastic.co/u/twang)\ **Replies:** 4\ **Last updated:** [December 1, 2020, 1:44am UTC](https://discuss.elastic.co/t/reindex-from-a-remote-cluster/256922 "2020-12-01T01:44:44Z")
Hi, I am trying to copy my index from one source to another source from a remote cluster. to follow this link I got an error: my cluster is not on reindex.remote.whitelist. I were using - Elasticsearch (Self-Manage… --- ## [Looking for suggestions about mapping](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140)
**Author:** [@MassimoIvaldi](https://discuss.elastic.co/u/MassimoIvaldi)\ **Replies:** 0\ **Last updated:** [December 1, 2020, 12:54am UTC](https://discuss.elastic.co/t/looking-for-suggestions-about-mapping/257140 "2020-12-01T00:54:27Z")
Hello, I am an Italian developer, newbye of Elasticsearch, actually in training. I would experiment as exercice a parser of articles in some French newspaper in order to analyze the text usin Natural Language Processin… --- ## [インデックス、マッピング定義の作成エラー](https://discuss.elastic.co/t/topic/256987)
**Author:** [@miya2](https://discuss.elastic.co/u/miya2)\ **Replies:** 2\ **Last updated:** [December 1, 2020, 1:04am UTC](https://discuss.elastic.co/t/topic/256987 "2020-12-01T01:04:20Z")
以下のマッピング定義を使用したインデックスの作成で エラーが発生しており色々調べてはいるのですが解決せず、 回答頂けますと幸いです。 ElasticsearchのVersion7.5.0を使用しています。 ・mapping.json { "mappings" : { "text" : { "properties" : { "text1" : { "… --- ## [Grok filter does not work pipeline creation error, while its parsing with no issue on grok parser](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037)
**Author:** [@amitnirmal01](https://discuss.elastic.co/u/amitnirmal01)\ **Replies:** 1\ **Last updated:** [November 30, 2020, 11:48pm UTC](https://discuss.elastic.co/t/grok-filter-does-not-work-pipeline-creation-error-while-its-parsing-with-no-issue-on-grok-parser/257037 "2020-11-30T23:48:52Z")
\`\`\`%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel}.\*\\\[%{THREADNAME:thread}.\*IdamAuthHandler.\*\\\].\* - \\\[carrier:%{GREEDYDATA:carrier}\\\]. \*\\\[product:%{ANYDATA:product}\\\].\*\\\[version:%{ANYDATA:version}\].\*\\\[call:%{ANYDATA:… --- ## [Kibana dashboard not showing 'message' field](https://discuss.elastic.co/t/kibana-dashboard-not-showing-message-field/257127)
**Author:** [@renansph](https://discuss.elastic.co/u/renansph)\ **Replies:** 4\ **Last updated:** [November 30, 2020, 11:07pm UTC](https://discuss.elastic.co/t/kibana-dashboard-not-showing-message-field/257127 "2020-11-30T23:07:00Z")
Hi. I'm trying to add the 'message' field to a 'Data Table' in Kibana but i can't see the field. In the built-in dashboard from Postgresql filebeat i can see the field without problem: But when i try to build a new… [Previous page](https://discuss.elastic.co/latest.md?page=1966) [Next page](https://discuss.elastic.co/latest.md?page=1968)