# Latest **URL:** https://discuss.elastic.co/latest.md?page=1974 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1975 --- ## [Persistent queue, drop?](https://discuss.elastic.co/t/persistent-queue-drop/256785)
**Author:** [@diecode](https://discuss.elastic.co/u/diecode)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 2:42pm UTC](https://discuss.elastic.co/t/persistent-queue-drop/256785 "2020-11-26T14:42:59Z")
Hey, I am using persistent queue in my logstash with aggregate filter. I would like drop few incoming syslog message in filter, but when I use drop, then it will not removed from queue, thus my queue reach the maximum l… --- ## [Create copy of visualization that uses a different index as data source?](https://discuss.elastic.co/t/create-copy-of-visualization-that-uses-a-different-index-as-data-source/256382)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 2:23pm UTC](https://discuss.elastic.co/t/create-copy-of-visualization-that-uses-a-different-index-as-data-source/256382 "2020-11-26T14:23:58Z")
I have found that the visualizations (line charts, tables) are tied to its data source, and no easy way to edit it. Often, I have built a complex visualization that I can use for another index as a starting point, but I … --- ## [Detection rule for password spraying attempts](https://discuss.elastic.co/t/detection-rule-for-password-spraying-attempts/256628)
**Author:** [@heading](https://discuss.elastic.co/u/heading)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 2:18pm UTC](https://discuss.elastic.co/t/detection-rule-for-password-spraying-attempts/256628 "2020-11-26T14:18:43Z")
Hi, we have a use case where we want to detect if a host tries to log on to a certain number of different users. With threshold rules we are only able to detect a specific number of login attempts by a host. We cannot e… --- ## [How to create dynamic tree view](https://discuss.elastic.co/t/how-to-create-dynamic-tree-view/253392)
**Author:** [@praveer](https://discuss.elastic.co/u/praveer)\ **Replies:** 10\ **Last updated:** [November 26, 2020, 2:02pm UTC](https://discuss.elastic.co/t/how-to-create-dynamic-tree-view/253392 "2020-11-26T14:02:47Z")
Hi Team, I have created custom plugin in Kibana. In my plugin I have a requirement in which I have to create a dynamic tree view. Which would enable user to add/remove nodes from tree view at runtime. It would also be h… --- ## [No event collected from Sysmon (winlogbeat)](https://discuss.elastic.co/t/no-event-collected-from-sysmon-winlogbeat/256775)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 1:51pm UTC](https://discuss.elastic.co/t/no-event-collected-from-sysmon-winlogbeat/256775 "2020-11-26T13:51:56Z")
Hello, I have installed sysmon in a Windows machine using the command: sysmon.exe -i -accepteula -h md5,sha256,imphash -l -n And then restart winlogbeat. In winlogbeat log everything is working well, and i have logs l… --- ## [Facing data too large exception frequently](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943)
**Author:** [@Divy\_Garg](https://discuss.elastic.co/u/Divy_Garg)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 1:51pm UTC](https://discuss.elastic.co/t/facing-data-too-large-exception-frequently/255943 "2020-11-26T13:51:00Z")
CircuitBreakingException\[\[parent\] Data too large, data for \[internal:index/shard/recovery/start\_recovery\] would be \[7805417954/7.2gb\], which is larger than the limit of \[6941363404/6.4gb\], real usage: \[7805416568/7.2gb\],… --- ## [Filebeat исключить kubernetes namespace](https://discuss.elastic.co/t/filebeat-kubernetes-namespace/256499)
**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\ **Replies:** 2\ **Last updated:** [November 25, 2020, 7:54am UTC](https://discuss.elastic.co/t/filebeat-kubernetes-namespace/256499 "2020-11-25T07:54:12Z")
Filebeat работает как DaemonSet в kubernetes. Пытаюсь исключить некоторые namespace, такие как "kube-system" и "calico-system". ConfigMap: filebeat.yml выглядит следующим образом. Что я делаю не так? С таким конфигом во… --- ## [Elasticsearch 7.10 does not start on MacOS](https://discuss.elastic.co/t/elasticsearch-7-10-does-not-start-on-macos/256740)
**Author:** [@snicoll](https://discuss.elastic.co/u/snicoll)\ **Replies:** 7\ **Last updated:** [November 26, 2020, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-7-10-does-not-start-on-macos/256740 "2020-11-26T13:17:49Z")
I am very confused. I've downloaded the latest ELK stack to make a test on my machine. I am on MacOS 10.15.7 and Java 11 Here's what I did: Unzip the tar somewhere in my home directory cd to the elasticsearch invoke b… --- ## [S3 buckets data format unknown](https://discuss.elastic.co/t/s3-buckets-data-format-unknown/256773)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 1:05pm UTC](https://discuss.elastic.co/t/s3-buckets-data-format-unknown/256773 "2020-11-26T13:05:13Z")
HI, I've 50K+ documents of unknown log format that can't be segregated until someone manually open and read the document content. Is there any way to take all documents data in input and make it parse them? What should … --- ## [Index deleted, want to restore from backup](https://discuss.elastic.co/t/index-deleted-want-to-restore-from-backup/256770)
**Author:** [@Arbind\_Bhagat](https://discuss.elastic.co/u/Arbind_Bhagat)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 12:34pm UTC](https://discuss.elastic.co/t/index-deleted-want-to-restore-from-backup/256770 "2020-11-26T12:34:50Z")
All of my index have been deleted. So, I don't see them in Kibana. Of course, all the corresponding data has also been deleted. However, I do have the backup of the disk that contains all the files and folders. In this… --- ## [ILM and max size with logstash ELK 7.10.0](https://discuss.elastic.co/t/ilm-and-max-size-with-logstash-elk-7-10-0/256764)
**Author:** [@fredbcode](https://discuss.elastic.co/u/fredbcode)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 12:15pm UTC](https://discuss.elastic.co/t/ilm-and-max-size-with-logstash-elk-7-10-0/256764 "2020-11-26T12:15:18Z")
Hello I am using ELK stack 7.10.0 and I have an issue with ilm and max\_size { "indices" : { "logstash\_netflow-2020.11.26" : { "index" : "logstash\_netflow-2020.11.26", "managed" : t… --- ## [Kibana error 500 when viewing metrics](https://discuss.elastic.co/t/kibana-error-500-when-viewing-metrics/256429)
**Author:** [@daq](https://discuss.elastic.co/u/daq)\ **Replies:** 0\ **Last updated:** [November 24, 2020, 1:59am UTC](https://discuss.elastic.co/t/kibana-error-500-when-viewing-metrics/256429 "2020-11-24T01:59:26Z")
I'm having a problem viewing metrics in Kibana. My issue seems identical to this bug report. except the workaround there doesn't solve the problem for me. Every time I open metrics tab I get the following error: \[illeg… --- ## [Kibana alerting not matching wildcard AND condition](https://discuss.elastic.co/t/kibana-alerting-not-matching-wildcard-and-condition/256580)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 11:33am UTC](https://discuss.elastic.co/t/kibana-alerting-not-matching-wildcard-and-condition/256580 "2020-11-26T11:33:31Z")
Hi, trying to determine why a field isn't matching wildcard searches in our log data in Kibana alerting. We're on the elastic cloud stack, v7.9.2. We need to add an AND condition for this particular log search and with … --- ## [Trying to implement pie chart logic](https://discuss.elastic.co/t/trying-to-implement-pie-chart-logic/256459)
**Author:** [@michaelacc](https://discuss.elastic.co/u/michaelacc)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 11:29am UTC](https://discuss.elastic.co/t/trying-to-implement-pie-chart-logic/256459 "2020-11-26T11:29:34Z")
Hello Everyone! I'm a new user of ELK stack, its looking really powerful and a bit challenging, however I would like to ask you about one thing related to kibana visualizations. I'm currently trying to implement a visua… --- ## [Access to different data source in vega-lite](https://discuss.elastic.co/t/access-to-different-data-source-in-vega-lite/256075)
**Author:** [@shin1](https://discuss.elastic.co/u/shin1)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 11:19am UTC](https://discuss.elastic.co/t/access-to-different-data-source-in-vega-lite/256075 "2020-11-26T11:19:50Z")
Hi, Is it possible to access fields in different data source from encoding object in vega-lite? Many thanks in advance, Cheers, Shin --- ## [Timelion Visualization dropdown to edit comparison](https://discuss.elastic.co/t/timelion-visualization-dropdown-to-edit-comparison/255303)
**Author:** [@nagabhushan.tr](https://discuss.elastic.co/u/nagabhushan.tr)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 11:08am UTC](https://discuss.elastic.co/t/timelion-visualization-dropdown-to-edit-comparison/255303 "2020-11-26T11:08:49Z")
Hi, We are building interactive visualization to compare the sales data over timelion, ask is to compare the sales today to yesterday(this duration should be customizable), which i am able to achieve by having a offset … --- ## [Cluster is not available and http request failed, but request by transport client worked well](https://discuss.elastic.co/t/cluster-is-not-available-and-http-request-failed-but-request-by-transport-client-worked-well/256722)
**Author:** [@fanwang](https://discuss.elastic.co/u/fanwang)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 10:51am UTC](https://discuss.elastic.co/t/cluster-is-not-available-and-http-request-failed-but-request-by-transport-client-worked-well/256722 "2020-11-26T10:51:56Z")
Elasticsearch version V5.6.12 JVM version JDK 1.8 OS version CentOS7.6 Description of the problem including expected versus actual behavior : In a cluster with 3 master nodes, minuimum\_master\_nodes is 2. Kill 2 o… --- ## [Timestamps for archived event logs are overwritten with current time](https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756)
**Author:** [@p1k4chu](https://discuss.elastic.co/u/p1k4chu)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 10:46am UTC](https://discuss.elastic.co/t/timestamps-for-archived-event-logs-are-overwritten-with-current-time/256756 "2020-11-26T10:46:46Z")
I've used the latest winlogbeat to ingest an archived evtx (sample taken from: GitHub - sbousseaden/EVTX-ATTACK-SAMPLES: Windows Events Attack Samples). The timestamp I see in Kibana when ingested via Logstash (without a… --- ## [Syncronize vega-lite timestamp with kibana chart's timestamp](https://discuss.elastic.co/t/syncronize-vega-lite-timestamp-with-kibana-charts-timestamp/256082)
**Author:** [@shin1](https://discuss.elastic.co/u/shin1)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 10:33am UTC](https://discuss.elastic.co/t/syncronize-vega-lite-timestamp-with-kibana-charts-timestamp/256082 "2020-11-26T10:33:01Z")
Hi Experts, I'm writing a scatter plots in vega-lite now and it's on a dashboard contining many kibana charts. One of the charts on the doashboard changes every 1 second and I would like the other charts to synchronize… --- ## [Dynamically changing the graphical dashboard](https://discuss.elastic.co/t/dynamically-changing-the-graphical-dashboard/256487)
**Author:** [@All](https://discuss.elastic.co/u/All)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 10:21am UTC](https://discuss.elastic.co/t/dynamically-changing-the-graphical-dashboard/256487 "2020-11-26T10:21:11Z")
Hey everyone, is it possible to dynamically change the appearance of the dashboard, e.g. if some data is missing the graph or table is not shown? Thanks for reading and I am also very thankful for any comment! --- ## [Attachments on ELK](https://discuss.elastic.co/t/attachments-on-elk/256717)
**Author:** [@AChopra](https://discuss.elastic.co/u/AChopra)\ **Replies:** 4\ **Last updated:** [November 26, 2020, 10:07am UTC](https://discuss.elastic.co/t/attachments-on-elk/256717 "2020-11-26T10:07:35Z")
Hello, I have some attachments which need to be ingested into elastic. There are of varying types i.e PDF, TXT, CSV, XLS, DOC, MSG (Outlook emails). As far as I could find out , I got to know that I can use Ingest Att… --- ## [Reindexing does not resolve conflict](https://discuss.elastic.co/t/reindexing-does-not-resolve-conflict/256745)
**Author:** [@eliwap](https://discuss.elastic.co/u/eliwap)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 9:33am UTC](https://discuss.elastic.co/t/reindexing-does-not-resolve-conflict/256745 "2020-11-26T09:33:01Z")
Recently we upgraded our stack to elasticsearch-7.9.2 from 6.8. I had to reindex to resolve several mapping conflicts. However reindexing did not resolve all of them. How do I fix the following conflicts filebeat - rea… --- ## [Проблемы с Dashboard ELK 7.10.0 (WinlogBeat Dashboard ECS)](https://discuss.elastic.co/t/dashboard-elk-7-10-0-winlogbeat-dashboard-ecs/256735)
**Author:** [@tesla](https://discuss.elastic.co/u/tesla)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 8:16am UTC](https://discuss.elastic.co/t/dashboard-elk-7-10-0-winlogbeat-dashboard-ecs/256735 "2020-11-26T08:16:28Z")
Добрый День всем участникам. При установке и настройке Dashboard и принятия логов с Winlogbeat 7.10.0, не создаётся Dashboard (WinlogBeat Dashboard ECS ), а все сваливается в кучу. Winlogbeat Security\] Group Management… --- ## [Default index template is it reale?](https://discuss.elastic.co/t/default-index-template-is-it-reale/256658)
**Author:** [@zakabluk](https://discuss.elastic.co/u/zakabluk)\ **Replies:** 0\ **Last updated:** [November 25, 2020, 12:35pm UTC](https://discuss.elastic.co/t/default-index-template-is-it-reale/256658 "2020-11-25T12:35:46Z")
I want create some index template which will use all new indexes which will create logstash and that doesn't have exactly template for his. Example: I have templates: pattern: log1-\* + ilm1 + priority 200 pattern: lo… --- ## [Is it possible to show videos in Canvas?](https://discuss.elastic.co/t/is-it-possible-to-show-videos-in-canvas/256675)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 8:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-show-videos-in-canvas/256675 "2020-11-26T08:57:41Z")
Hello, So is it possible to show videos in Canvas? (Youtube link) If yes, how would I do that? If no, could this functionality be added? Grtz Willem --- ## [Display the most frequent words in tagcloud chart in kibana](https://discuss.elastic.co/t/display-the-most-frequent-words-in-tagcloud-chart-in-kibana/252561)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 8:54am UTC](https://discuss.elastic.co/t/display-the-most-frequent-words-in-tagcloud-chart-in-kibana/252561 "2020-11-26T08:54:42Z")
hello, i have text data indexed on elasticsearch, and i want to display the words that are frequently cited in this data in tagcloud format, how i can do this on kibana thank you very much --- ## [Integration of Kibana dashboard in angular application](https://discuss.elastic.co/t/integration-of-kibana-dashboard-in-angular-application/256729)
**Author:** [@sam189](https://discuss.elastic.co/u/sam189)\ **Replies:** 2\ **Last updated:** [November 26, 2020, 8:40am UTC](https://discuss.elastic.co/t/integration-of-kibana-dashboard-in-angular-application/256729 "2020-11-26T08:40:50Z")
Hi, When i am trying to integrate kibana dashboard inside my angular application via iframe it is giving me below error. Refused to execute inline script because it violates the following Content Security Policy direct… --- ## [Missing elastic-agent.yml](https://discuss.elastic.co/t/missing-elastic-agent-yml/256739)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [November 26, 2020, 8:33am UTC](https://discuss.elastic.co/t/missing-elastic-agent-yml/256739 "2020-11-26T08:33:31Z")
Hi, For installing Elastic Agent it is recommended now to use the tarball (Linux) version instead of the deb version. So I did on my Ubuntu server. But when running the install command to enroll to Fleet I am getting t… --- ## [Kibana plugin or custom app](https://discuss.elastic.co/t/kibana-plugin-or-custom-app/256648)
**Author:** [@jnc943](https://discuss.elastic.co/u/jnc943)\ **Replies:** 3\ **Last updated:** [November 26, 2020, 8:26am UTC](https://discuss.elastic.co/t/kibana-plugin-or-custom-app/256648 "2020-11-26T08:26:35Z")
I would like to automate some current troubleshooting workflows that are done manually. Essentially, I would like to be able to run a query, extract some fields/information which can then be passed down to subsequent que… --- ## [Unable to find any unassigned shards to explain](https://discuss.elastic.co/t/unable-to-find-any-unassigned-shards-to-explain/256733)
**Author:** [@devdatta\_mulgund](https://discuss.elastic.co/u/devdatta_mulgund)\ **Replies:** 1\ **Last updated:** [November 26, 2020, 8:01am UTC](https://discuss.elastic.co/t/unable-to-find-any-unassigned-shards-to-explain/256733 "2020-11-26T08:01:34Z")
I am facing this error in Elasticsearch. Can someone help with this? Below is the output for Elasticsearch APIs: curl localhost:9200/\_cluster/health output: {"cluster\_name":"docker-cluster","status":"green","timed\_ou… [Previous page](https://discuss.elastic.co/latest.md?page=1973) [Next page](https://discuss.elastic.co/latest.md?page=1975)