# Latest **URL:** https://discuss.elastic.co/latest.md?page=1982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1983 --- ## [Converting null SQL values](https://discuss.elastic.co/t/converting-null-sql-values/255452)
**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 5:01pm UTC](https://discuss.elastic.co/t/converting-null-sql-values/255452 "2020-11-23T17:01:48Z")
Hello When an SQL query return null, how can I convert it to 0? Thank you --- ## [URL Links from Index Patterns Redirect to Port 5601](https://discuss.elastic.co/t/url-links-from-index-patterns-redirect-to-port-5601/256156)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 4:45pm UTC](https://discuss.elastic.co/t/url-links-from-index-patterns-redirect-to-port-5601/256156 "2020-11-23T16:45:04Z")
Good morning! We just recently spun up a second Kibana instance and threw both behind a load-balancer for HA. We previously accessed Kibana via https://kb1.contoso.com:5601, but now with the second server of https://kb2… --- ## [ES 7.3 - restarting data node doesn't rejoin cluster](https://discuss.elastic.co/t/es-7-3-restarting-data-node-doesnt-rejoin-cluster/256286)
**Author:** [@charlatan](https://discuss.elastic.co/u/charlatan)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 4:42pm UTC](https://discuss.elastic.co/t/es-7-3-restarting-data-node-doesnt-rejoin-cluster/256286 "2020-11-23T16:42:00Z")
We have the following cluster: 3 x ES 7.3 on CentOS 7.8 VMs, "master eligible" + coordinating nodes 15 x ES 7.3 on CentOS 7.8 physical nodes, data-only 1 x ES 7.3 on CentOS 7.8 VM, running on the Kibana node purely to… --- ## [How to put two groks for IIS Logs?](https://discuss.elastic.co/t/how-to-put-two-groks-for-iis-logs/256111)
**Author:** [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 4:38pm UTC](https://discuss.elastic.co/t/how-to-put-two-groks-for-iis-logs/256111 "2020-11-23T16:38:05Z")
\ true match =\> \["message", "%{TIMESTAMP\_ISO8601:log\_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:request}(?:%{URIPARAM:requestparam})? - %{NUMBER:port} - %{IPORHOST:clienthost} %{NOTSP… --- ## [Could not create ml job based on rollup job index](https://discuss.elastic.co/t/could-not-create-ml-job-based-on-rollup-job-index/256135)
**Author:** [@nujabness](https://discuss.elastic.co/u/nujabness)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 4:22pm UTC](https://discuss.elastic.co/t/could-not-create-ml-job-based-on-rollup-job-index/256135 "2020-11-23T16:22:34Z")
Hi, Im using Elasticsearch Service in cloud version 7.9.2. Im trying to create a machine learning job based on an index created from a rollup job that counts the number of requests per webservice. I first create a rol… --- ## [Ноды вылетают из кластера 7.9.1 и другие проблемы](https://discuss.elastic.co/t/7-9-1/256304)
**Author:** [@ThreatInter](https://discuss.elastic.co/u/ThreatInter)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 4:19pm UTC](https://discuss.elastic.co/t/7-9-1/256304 "2020-11-23T16:19:42Z")
Здравствуйте, имеем следующую проблему: ноды могут периодически вылетать из кластера \[2020-11-19T09:00:37,415\]\[INFO \]\[o.e.c.s.MasterService \] \[h1-es03\] node-left\[{h1-es02}{qgmMV2UbT-ScN9uRr6YM8g}{klj1K8UMRHGtYpYozIuq… --- ## [Vega Beeswarm](https://discuss.elastic.co/t/vega-beeswarm/256280)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 4:16pm UTC](https://discuss.elastic.co/t/vega-beeswarm/256280 "2020-11-23T16:16:47Z")
I am trying to use the Beeswarm chart in Vega visualisation, but I am unable to get data points to display. When I get to the "marks": \[ {\* "name": "nodes",\* "data": "people.",\* element should this be the nam… --- ## [Перестали идти логи от winlogbeat](https://discuss.elastic.co/t/winlogbeat/256103)
**Author:** [@Kosh](https://discuss.elastic.co/u/Kosh)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 4:16pm UTC](https://discuss.elastic.co/t/winlogbeat/256103 "2020-11-23T16:16:38Z")
Всем привет, подскажите пожалуйста новичку удалил из "Index Management" индексы(winlogbeat-\*) которые прилетали от виндовых машин, и всё больше они там не появляются, как вернуть всё назад? прилагаю скрин чтобы было по… --- ## [Kibana arm64 packages missing in Debian repo](https://discuss.elastic.co/t/kibana-arm64-packages-missing-in-debian-repo/256275)
**Author:** [@captbrando](https://discuss.elastic.co/u/captbrando)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 4:06pm UTC](https://discuss.elastic.co/t/kibana-arm64-packages-missing-in-debian-repo/256275 "2020-11-23T16:06:58Z")
Hi there! I was able to download the arm64 Kibana package from here, but unlike all the other ELK stack components, the Kibana .deb is missing in the repository. Can you add the Kibana .deb to the repo? Thanks --- ## [Aggregation filter error](https://discuss.elastic.co/t/aggregation-filter-error/256372)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 3:51pm UTC](https://discuss.elastic.co/t/aggregation-filter-error/256372 "2020-11-23T15:51:01Z")
Hi, i have this problem on aggregation filter : String can't be coerced into Integer , this is the log message : \[2020-11-23T15:55:13,479\]\[ERROR\]\[logstash.filters.aggregate\]\[main\]\[13ac83016d9f4ef50e52f1df4fd7eba1bf205… --- ## [Help with Logstash filter and private geoip data](https://discuss.elastic.co/t/help-with-logstash-filter-and-private-geoip-data/256007)
**Author:** [@ccofer](https://discuss.elastic.co/u/ccofer)\ **Replies:** 8\ **Last updated:** [November 23, 2020, 3:46pm UTC](https://discuss.elastic.co/t/help-with-logstash-filter-and-private-geoip-data/256007 "2020-11-23T15:46:17Z")
I realize I should have a better understanding of elastic, indexes, mappings, logstash and beats before coming here asking for help, but I really need to put this behind me. I have spent days searching and reading about … --- ## [Logstash failed to create template on target server](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232)
**Author:** [@amralieg](https://discuss.elastic.co/u/amralieg)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 2:17pm UTC](https://discuss.elastic.co/t/logstash-failed-to-create-template-on-target-server/256232 "2020-11-23T14:17:46Z")
Hi, I have the following logstash configuration, and when I run it it gives me the error. the input server is hosted on elastic cloud v7.9 and the output server is hosted on AWS elasticsearch v7.8, any clue how to solve… --- ## [Unable to parse field in Kibana](https://discuss.elastic.co/t/unable-to-parse-field-in-kibana/255851)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 3:33pm UTC](https://discuss.elastic.co/t/unable-to-parse-field-in-kibana/255851 "2020-11-23T15:33:59Z")
Hi Team, I am gathering JSON formats to logstash and then parsing it to elasticsearch. In that process, there is a key which has array brackets to it. The key gets saved in Elasticsearch as unknown field9Already tried… --- ## [7.10 and UseConcMarkSweepGC](https://discuss.elastic.co/t/7-10-and-useconcmarksweepgc/256153)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 3:30pm UTC](https://discuss.elastic.co/t/7-10-and-useconcmarksweepgc/256153 "2020-11-23T15:30:54Z")
Just upgraded to 7.10 and when restarting I get, "Unrecognized VM option 'UseConcMarkSweepGC". Is this to do with options.jvm? --- ## [Logstash datetime filter if else](https://discuss.elastic.co/t/logstash-datetime-filter-if-else/254430)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 7\ **Last updated:** [November 23, 2020, 3:22pm UTC](https://discuss.elastic.co/t/logstash-datetime-filter-if-else/254430 "2020-11-23T15:22:18Z")
Hi Team, This is regarding the Logstash Input filter. Sometimes the application from which I receive the data(Via logstash http) sends the value in one dateformat(ISO) and at times in another(UNIX). Is there anyway I … --- ## [CSV Ingest Column 1 = Time, Row 1 = Device](https://discuss.elastic.co/t/csv-ingest-column-1-time-row-1-device/256180)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 3:06pm UTC](https://discuss.elastic.co/t/csv-ingest-column-1-time-row-1-device/256180 "2020-11-23T15:06:51Z")
I have a CSV to import that has been formatted for use in Excel. As a result, and necessary for it to open in Excel, it has not only been chopped into several files (which I can handle) but it has also been formatted su… --- ## [ECS mappings for asset tracking and port scanning output](https://discuss.elastic.co/t/ecs-mappings-for-asset-tracking-and-port-scanning-output/256162)
**Author:** [@imperial.slipper](https://discuss.elastic.co/u/imperial.slipper)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:45pm UTC](https://discuss.elastic.co/t/ecs-mappings-for-asset-tracking-and-port-scanning-output/256162 "2020-11-23T14:45:15Z")
Hey chaps, I'm currently working on an application that will generate asset tracking and scanning data, and one of the outputs I'm building will use the ECS standard where possible. There are broadly two kind of events… --- ## [Can't change the X-axis Label while using filters aggregation on Kibana \[possible duplication\]](https://discuss.elastic.co/t/cant-change-the-x-axis-label-while-using-filters-aggregation-on-kibana-possible-duplication/256252)
**Author:** [@Mohammadreza\_Niknam](https://discuss.elastic.co/u/Mohammadreza_Niknam)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:42pm UTC](https://discuss.elastic.co/t/cant-change-the-x-axis-label-while-using-filters-aggregation-on-kibana-possible-duplication/256252 "2020-11-23T14:42:39Z")
Hello all, I'm currently working with Kibana 7.6.2 and in visualization, while I'm using filters aggregation, there is no custom Label field. After a quick search, I realized there's a bug and it was reported here: … --- ## [Logstash \[ERROR\]\[logstash.agent \] Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction, :message=\>"Could not execute action: PipelineAction::Create\, action\_result: false", :backtrace=\>nil}](https://discuss.elastic.co/t/logstash-error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/256348)
**Author:** [@salma\_widiarti](https://discuss.elastic.co/u/salma_widiarti)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 2:39pm UTC](https://discuss.elastic.co/t/logstash-error-logstash-agent-failed-to-execute-action-id-main-action-type-logstash-failedaction-message-could-not-execute-action-pipelineaction-create-main-action-result-false-backtrace-nil/256348 "2020-11-23T14:39:31Z")
Hi all, i am trying file configuration logstash like this input { http\_poller { urls =\> { users =\> { method =\> get user =\> "user" password =\> "pass… --- ## [Logstash not listening on port](https://discuss.elastic.co/t/logstash-not-listening-on-port/255356)
**Author:** [@droidus](https://discuss.elastic.co/u/droidus)\ **Replies:** 10\ **Last updated:** [November 23, 2020, 2:31pm UTC](https://discuss.elastic.co/t/logstash-not-listening-on-port/255356 "2020-11-23T14:31:01Z")
I noticed that nothing is listening on port 5044 on my ELK server. Logstash is running. Is there some configuration I missed somewhere to have it running/listening on that port? Here are the last few lines from my log … --- ## [Can't move ES indexes to another disk](https://discuss.elastic.co/t/cant-move-es-indexes-to-another-disk/256165)
**Author:** [@sourcedump](https://discuss.elastic.co/u/sourcedump)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 2:19pm UTC](https://discuss.elastic.co/t/cant-move-es-indexes-to-another-disk/256165 "2020-11-23T14:19:19Z")
Hello everyone! I have an ES 6.1.3 installation that works perfectly, but now the disk where the indexes are stored (we can call it 'Disk A' with path '/data-ephemeral') is full and we can't make it larger. So I've dec… --- ## [Add filter in a dashboard proposes a wrong list of fields](https://discuss.elastic.co/t/add-filter-in-a-dashboard-proposes-a-wrong-list-of-fields/256327)
**Author:** [@pchanas](https://discuss.elastic.co/u/pchanas)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 2:12pm UTC](https://discuss.elastic.co/t/add-filter-in-a-dashboard-proposes-a-wrong-list-of-fields/256327 "2020-11-23T14:12:40Z")
When I try to add manually a filter in a dashboard (using add filter on top of the page), the list of available fields belongs to the default index and not on indexes used in the visualisations of the DB... (no viz is po… --- ## [Packetbeat not sending the data to kafka multi node](https://discuss.elastic.co/t/packetbeat-not-sending-the-data-to-kafka-multi-node/256364)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 2:03pm UTC](https://discuss.elastic.co/t/packetbeat-not-sending-the-data-to-kafka-multi-node/256364 "2020-11-23T14:03:53Z")
Packetbeat version 7.9 and kafka version is 2.5 #----------------------------- Kafka output -------------------------------- output.kafka: hosts: \["kafka1:9092","kafka2:9092","kafka3:9092"\] topic: "packetbeat" … --- ## [Scripted Field URL](https://discuss.elastic.co/t/scripted-field-url/256360)
**Author:** [@nagabhushan.tr](https://discuss.elastic.co/u/nagabhushan.tr)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 1:34pm UTC](https://discuss.elastic.co/t/scripted-field-url/256360 "2020-11-23T13:34:26Z")
I have a scripted field (URL type) which i use to navigate to APM on kibana from a dashboard. Is there a way i can capture time range from dashboard and pass it to scripted field, so when i navigate to APM, selected dash… --- ## [Adding indices to New Spaces - not able to](https://discuss.elastic.co/t/adding-indices-to-new-spaces-not-able-to/256014)
**Author:** [@lnxjenn](https://discuss.elastic.co/u/lnxjenn)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 1:28pm UTC](https://discuss.elastic.co/t/adding-indices-to-new-spaces-not-able-to/256014 "2020-11-23T13:28:16Z")
I am creating new spaces for grouping our users together with their appropriate feeds. But I cannot see the feeds within the new space, when i try to add them into the Index Patterns. Now, as a user in the default space… --- ## [How to specify the salesforce Host for Salesforce input plugin](https://discuss.elastic.co/t/how-to-specify-the-salesforce-host-for-salesforce-input-plugin/255119)
**Author:** [@brendanlynch](https://discuss.elastic.co/u/brendanlynch)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 1:14pm UTC](https://discuss.elastic.co/t/how-to-specify-the-salesforce-host-for-salesforce-input-plugin/255119 "2020-11-23T13:14:55Z")
How do you control the Salesforce HOST/URL that you want to connect to? All I see in the input fields is a boolean switch that says it will use 'test.salesforce.com'. --- ## [Filebeat - Netflow - Add flows set id to document](https://discuss.elastic.co/t/filebeat-netflow-add-flows-set-id-to-document/256357)
**Author:** [@rvd](https://discuss.elastic.co/u/rvd)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-netflow-add-flows-set-id-to-document/256357 "2020-11-23T13:02:53Z")
Hi I'm using FILEBEAT as IPFIX decoder . I would like to add automatically the flow set id coming from IPFIX template ID to the produced document in ELS. Is there a way to do that ? thx RV --- ## [Too many dynamic script compilations with stored script](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-with-stored-script/256354)
**Author:** [@cwinkler](https://discuss.elastic.co/u/cwinkler)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 12:46pm UTC](https://discuss.elastic.co/t/too-many-dynamic-script-compilations-with-stored-script/256354 "2020-11-23T12:46:50Z")
With Elasticsearch 7.10 we are getting the following error when using a stored script. ElasticsearchException\[Elasticsearch exception \[type=general\_script\_exception, reason=Failed to compile stored script \[updateMessage… --- ## [What does max\_docs do in context of \_delete\_by\_query](https://discuss.elastic.co/t/what-does-max-docs-do-in-context-of-delete-by-query/256317)
**Author:** [@vangogh94](https://discuss.elastic.co/u/vangogh94)\ **Replies:** 3\ **Last updated:** [November 23, 2020, 10:53am UTC](https://discuss.elastic.co/t/what-does-max-docs-do-in-context-of-delete-by-query/256317 "2020-11-23T10:53:41Z")
Hi, Looking at the documentation for \_delete\_by\_query API, there is a parameter called "max\_docs". From what i see it was added to documentation in 7.3. This same parameter is shown on \_reindex API documentation and ha… --- ## [TSVB 차트를 Elasticsearch Query 구문으로 만들기](https://discuss.elastic.co/t/tsvb-elasticsearch-query/256345)
**Author:** [@HyungHo\_Ko](https://discuss.elastic.co/u/HyungHo_Ko)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 10:52am UTC](https://discuss.elastic.co/t/tsvb-elasticsearch-query/256345 "2020-11-23T10:52:25Z")
TSVB 차트를 이용하여 Disk Read 데이터를 차트화하였습니다. 동일한 데이터를 Elasticsearch JSON Query로 작성하려고 합니다. Host 별 결과를 얻고자 작성 중인 코드입니다. 에러는 없지만, 결과를 얻을 수 없는 상태입니다. 어떻게 작성해야할까요? { "size": 0, "query": { "bool": { … [Previous page](https://discuss.elastic.co/latest.md?page=1981) [Next page](https://discuss.elastic.co/latest.md?page=1983)