# Latest **URL:** https://discuss.elastic.co/latest.md?page=798 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 799 --- ## [Kibana is unable to connect to ElasticSearch](https://discuss.elastic.co/t/kibana-is-unable-to-connect-to-elasticsearch/324561)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 6:46pm UTC](https://discuss.elastic.co/t/kibana-is-unable-to-connect-to-elasticsearch/324561 "2023-02-02T18:46:07Z")
I have been using ELK now for about a year and half. I decided it was time to re-install my lab for better troubleshooting of the main environment. Now I am unable to get kibana to open. Both the Elasticsearch and Log… --- ## [Vega with conditionnal coloring depending on filter](https://discuss.elastic.co/t/vega-with-conditionnal-coloring-depending-on-filter/324205)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 6:27pm UTC](https://discuss.elastic.co/t/vega-with-conditionnal-coloring-depending-on-filter/324205 "2023-02-02T18:27:16Z")
Hi there! I'm not an expert in Vega language but I would like to make a visualization which background color would depend on the filter in the dashboard. Let's say I have a Vega with a text and a background color. If a… --- ## [Kibana dashboard](https://discuss.elastic.co/t/kibana-dashboard/324170)
**Author:** [@Swetha.B](https://discuss.elastic.co/u/Swetha.B)\ **Replies:** 2\ **Last updated:** [February 2, 2023, 6:12pm UTC](https://discuss.elastic.co/t/kibana-dashboard/324170 "2023-02-02T18:12:00Z")
We recently started using Kibana dashboard to analyze the logs for our QnAbot. In Kibana discover what is the tag name that represents whether the user has navigated(via clicking on the buttons) through the QnAbot or if… --- ## [How to Import a Kibana Dashboard with Ansible?](https://discuss.elastic.co/t/how-to-import-a-kibana-dashboard-with-ansible/324487)
**Author:** [@silentfilm](https://discuss.elastic.co/u/silentfilm)\ **Replies:** 2\ **Last updated:** [February 2, 2023, 5:56pm UTC](https://discuss.elastic.co/t/how-to-import-a-kibana-dashboard-with-ansible/324487 "2023-02-02T17:56:33Z")
We are upgrading from 7.9.3 to 7.17.8. I see that the method to import Kibana dashboards has changed. I can successfully import a dashboard using curl and using Postman. curl -k -u \:\ -X POST https:… --- ## [Different aggregation count for the same value](https://discuss.elastic.co/t/different-aggregation-count-for-the-same-value/324566)
**Author:** [@mbklein](https://discuss.elastic.co/u/mbklein)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 4:47pm UTC](https://discuss.elastic.co/t/different-aggregation-count-for-the-same-value/324566 "2023-02-02T16:47:22Z")
I don't understand the results I'm seeing. I am asking for two different aggs in the same query. The first is “show me the doc counts for subject.label for these specific values,” and the second is “show me the doc count… --- ## [Filebeat multiline - how to tell filebeat when a message ends while parsing Microsoft Defender ATP logs](https://discuss.elastic.co/t/filebeat-multiline-how-to-tell-filebeat-when-a-message-ends-while-parsing-microsoft-defender-atp-logs/324564)
**Author:** [@Sal\_C](https://discuss.elastic.co/u/Sal_C)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 4:18pm UTC](https://discuss.elastic.co/t/filebeat-multiline-how-to-tell-filebeat-when-a-message-ends-while-parsing-microsoft-defender-atp-logs/324564 "2023-02-02T16:18:13Z")
Hello, I'm trying to integrate Microsoft Defender ATP with Graylog, and I'm pulling in events using the Microsoft API. The output is spread across multiple lines, so I'm using the multiline function within filebeat to p… --- ## [Tags written to .monitoring-es-8-mb by metricbeat is not searchable](https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 4:07pm UTC](https://discuss.elastic.co/t/tags-written-to-monitoring-es-8-mb-by-metricbeat-is-not-searchable/324562 "2023-02-02T16:07:07Z")
The tags added through processors in metricbeat.yml writes to monitoring-es-8-mb index which shows tags field when searched with only index name. Metricbeat.yml config processors: - add\_tags: tags: \[Earth\] … --- ## [Winlogbeat read Windows Event id 4732 but not Member Security ID?](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759)
**Author:** [@hansbrah7](https://discuss.elastic.co/u/hansbrah7)\ **Replies:** 2\ **Last updated:** [February 2, 2023, 3:06pm UTC](https://discuss.elastic.co/t/winlogbeat-read-windows-event-id-4732-but-not-member-security-id/322759 "2023-02-02T15:06:32Z")
We have noticed that the Winlogbeat agent will read and ship up the event id 4732 (User added to local Security Group) but we noticed that it is missing the Member Security ID (which is the user that is getting added). … --- ## [Common points in two geo\_bounding\_box](https://discuss.elastic.co/t/common-points-in-two-geo-bounding-box/324387)
**Author:** [@maya\_khan](https://discuss.elastic.co/u/maya_khan)\ **Replies:** 10\ **Last updated:** [February 2, 2023, 7:00am UTC](https://discuss.elastic.co/t/common-points-in-two-geo-bounding-box/324387 "2023-02-02T07:00:17Z")
I have two geo\_bounding\_box within these two shapes many points exist. i want only those points that are common in both geo\_bounding\_box. { "bool":{ "should":\[ { "geo\_bounding\_box":{ "geo\_coords":{ "top\_left": { … --- ## [Query in rated requests should not contain aggregations](https://discuss.elastic.co/t/query-in-rated-requests-should-not-contain-aggregations/324559)
**Author:** [@ocastaneda](https://discuss.elastic.co/u/ocastaneda)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 2:51pm UTC](https://discuss.elastic.co/t/query-in-rated-requests-should-not-contain-aggregations/324559 "2023-02-02T14:51:07Z")
Hello! Our search team is considering diversifying search results with diversified\_sampler aggregation and child top\_hits aggregation. I noticed that aggregations don’t work with the ranking evaluation API. Anyone got s… --- ## [Rollover for Daily indices in Elasticsearch](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558)
**Author:** [@Veysel\_yuksel](https://discuss.elastic.co/u/Veysel_yuksel)\ **Replies:** 2\ **Last updated:** [February 2, 2023, 2:42pm UTC](https://discuss.elastic.co/t/rollover-for-daily-indices-in-elasticsearch/324558 "2023-02-02T14:42:25Z")
Hello, I am trying to implement rollover mechanism to my environments. Let me explain as is and to be design; Log data stores in syslog-%{+YYYY.MM.dd} indices right now. I keep data for 3 days. No rollover - No warm or… --- ## [Restoring indices from S3 repository](https://discuss.elastic.co/t/restoring-indices-from-s3-repository/324464)
**Author:** [@iyin](https://discuss.elastic.co/u/iyin)\ **Replies:** 3\ **Last updated:** [February 2, 2023, 2:20pm UTC](https://discuss.elastic.co/t/restoring-indices-from-s3-repository/324464 "2023-02-02T14:20:21Z")
Hi, I took a snapshot of an elastic cluster (version 7.17.8) and saved it on an Amazon S3 repository before the cluster was deleted. Although, I am able to see the backup files in the s3 bucket, I have been unable to re… --- ## [\[Feature request\] Support to index only some of the fields of the entire document](https://discuss.elastic.co/t/feature-request-support-to-index-only-some-of-the-fields-of-the-entire-document/324547)
**Author:** [@lnaie](https://discuss.elastic.co/u/lnaie)\ **Replies:** 3\ **Last updated:** [February 2, 2023, 1:56pm UTC](https://discuss.elastic.co/t/feature-request-support-to-index-only-some-of-the-fields-of-the-entire-document/324547 "2023-02-02T13:56:01Z")
Hello, We need to save in the engine the whole document because later on it will be returned to the client, but for the sake of search relevance we want to index only a couple of properties/fields from the entire docume… --- ## [Fleet server data stream is not populating data](https://discuss.elastic.co/t/fleet-server-data-stream-is-not-populating-data/324554)
**Author:** [@Kosala\_Randika\_Paran](https://discuss.elastic.co/u/Kosala_Randika_Paran)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 1:49pm UTC](https://discuss.elastic.co/t/fleet-server-data-stream-is-not-populating-data/324554 "2023-02-02T13:49:43Z")
Hi, We have configured fleet server and enrolled elastic agents to that but we can not see any data in Data Stream tab, anyone has an idea what was the issue? --- ## [How to fix retention log and how to manage data retention time in Elasticsearch](https://discuss.elastic.co/t/how-to-fix-retention-log-and-how-to-manage-data-retention-time-in-elasticsearch/324323)
**Author:** [@Mosa](https://discuss.elastic.co/u/Mosa)\ **Replies:** 6\ **Last updated:** [February 2, 2023, 1:44pm UTC](https://discuss.elastic.co/t/how-to-fix-retention-log-and-how-to-manage-data-retention-time-in-elasticsearch/324323 "2023-02-02T13:44:29Z")
Hi Team, I've configured my retention log in my Elasticsearch and I hope managing my data retention time. But no thing is changed after 3 days in my configuration just to test it. And no data is deleted too after 3 days… --- ## [Hardware Specifications for Storage Types](https://discuss.elastic.co/t/hardware-specifications-for-storage-types/324553)
**Author:** [@federica.forti](https://discuss.elastic.co/u/federica.forti)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 1:44pm UTC](https://discuss.elastic.co/t/hardware-specifications-for-storage-types/324553 "2023-02-02T13:44:21Z")
Hi, we have choose the type of storage to associate to an Elasticsearch cluster. In particular, we wonder if there is any indication of the minimum characteristics that a certain type of storage must have; for example … --- ## [RBAC on multiple project RUM data](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688)
**Author:** [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)\ **Replies:** 8\ **Last updated:** [February 2, 2023, 12:36pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688 "2023-02-02T12:36:20Z")
Hello Team, We have formed observability setup receiving data from multiple projects with basic license. and all projects data going to common index of APM & RUM. Elasticsearch - 8.4.3 Kibana - 8.4.3 APM - 8.4.3 We … --- ## [Filter and Count on a field](https://discuss.elastic.co/t/filter-and-count-on-a-field/324546)
**Author:** [@mayur](https://discuss.elastic.co/u/mayur)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 12:31pm UTC](https://discuss.elastic.co/t/filter-and-count-on-a-field/324546 "2023-02-02T12:31:45Z")
I am trying to calculate Recall from a field, which is populated with two values, TP and FN. Recall formula is Count(TP) / (Count(TP) + Count(FN)). How to achieve this opensearch? --- ## [Anyway to load custom javascript files before loading kibana UI in the browser?](https://discuss.elastic.co/t/anyway-to-load-custom-javascript-files-before-loading-kibana-ui-in-the-browser/324483)
**Author:** [@Joe\_Kuan](https://discuss.elastic.co/u/Joe_Kuan)\ **Replies:** 3\ **Last updated:** [February 2, 2023, 12:01pm UTC](https://discuss.elastic.co/t/anyway-to-load-custom-javascript-files-before-loading-kibana-ui-in-the-browser/324483 "2023-02-02T12:01:55Z")
Is there any configurations or method to load custom javascript files before any plugin startup? Thanks Joe --- ## [Reingenst CSV to change field names](https://discuss.elastic.co/t/reingenst-csv-to-change-field-names/324219)
**Author:** [@momoaux](https://discuss.elastic.co/u/momoaux)\ **Replies:** 3\ **Last updated:** [February 2, 2023, 11:18am UTC](https://discuss.elastic.co/t/reingenst-csv-to-change-field-names/324219 "2023-02-02T11:18:44Z")
Hello, I'm new to ELK stack. I have a lot of CSV files which share some common columns. But all have different names for their columns. Example: File 1: Name, Type, Code File 2: TP, NM, CD File 3: Co,Ty,Na My code… --- ## [VEGA developer](https://discuss.elastic.co/t/vega-developer/324525)
**Author:** [@m-cd](https://discuss.elastic.co/u/m-cd)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 10:29am UTC](https://discuss.elastic.co/t/vega-developer/324525 "2023-02-02T10:29:04Z")
Hello, I'm not totally sure if I can ask help here... So sorry if I'm doing mistakes here. I'm searching for a vega developer to hire for some visualisations (3-4 visualisations) to create using vega scripting. Does … --- ## [Sample data required](https://discuss.elastic.co/t/sample-data-required/324522)
**Author:** [@NS\_Midhun](https://discuss.elastic.co/u/NS_Midhun)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 10:12am UTC](https://discuss.elastic.co/t/sample-data-required/324522 "2023-02-02T10:12:26Z")
I need sample data (GB's) in json format to upload in opensearch. Please suggest --- ## [Term query not working where type is "text"](https://discuss.elastic.co/t/term-query-not-working-where-type-is-text/324422)
**Author:** [@shebbi](https://discuss.elastic.co/u/shebbi)\ **Replies:** 6\ **Last updated:** [February 2, 2023, 10:05am UTC](https://discuss.elastic.co/t/term-query-not-working-where-type-is-text/324422 "2023-02-02T10:05:08Z")
Hi Team, We are using ES 7.16.2 version and below is the query which we have generated using Java apis, Please let us know why it is not working or are we doing something wrong? Query: - { "bool" : { "must" : \[ … --- ## [HTTP error 401 in : 401 Unauthorized","service.name":"metricbeat"](https://discuss.elastic.co/t/http-error-401-in-401-unauthorized-service-name-metricbeat/323923)
**Author:** [@bagafoot](https://discuss.elastic.co/u/bagafoot)\ **Replies:** 8\ **Last updated:** [February 2, 2023, 9:59am UTC](https://discuss.elastic.co/t/http-error-401-in-401-unauthorized-service-name-metricbeat/323923 "2023-02-02T09:59:55Z")
The metric beats service status showing that connection estabilished to elasticsearch but I get this errors metricbeats.yml path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.template.settings: inde… --- ## [Sliced search not returning all hits](https://discuss.elastic.co/t/sliced-search-not-returning-all-hits/324513)
**Author:** [@jkruger](https://discuss.elastic.co/u/jkruger)\ **Replies:** 0\ **Last updated:** [February 2, 2023, 8:30am UTC](https://discuss.elastic.co/t/sliced-search-not-returning-all-hits/324513 "2023-02-02T08:30:38Z")
Hello, I am a new Elastic user, and I already ran into an issue. I am trying to extract all logs from a certain index. In order to deal with large indices I want to implement pagination using search\_after and PiTs (Poin… --- ## [Data Table limit of values](https://discuss.elastic.co/t/data-table-limit-of-values/324474)
**Author:** [@Brian\_Fernandez](https://discuss.elastic.co/u/Brian_Fernandez)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 7:23am UTC](https://discuss.elastic.co/t/data-table-limit-of-values/324474 "2023-02-02T07:23:02Z")
Hi guys! I would like to know if there is anything i can do to expand the 100 rows value in a Data Table. Depending on the information you like to show, 100 rows are very few. Can you help me please? v 7.12.0 --- ## ["Load more" instead of paging on search result page?](https://discuss.elastic.co/t/load-more-instead-of-paging-on-search-result-page/324412)
**Author:** [@samuel-m](https://discuss.elastic.co/u/samuel-m)\ **Replies:** 5\ **Last updated:** [February 2, 2023, 7:02am UTC](https://discuss.elastic.co/t/load-more-instead-of-paging-on-search-result-page/324412 "2023-02-02T07:02:20Z")
Hi everyone! Im using the search-ui library together with app search to build my first search result page. So far I looove it! :heart\_eyes: However, my customer has decided he does not want a traditional paging, but ra… --- ## [How to read logs with permanent \[NULL\]-characters at the end of file?](https://discuss.elastic.co/t/how-to-read-logs-with-permanent-null-characters-at-the-end-of-file/324408)
**Author:** [@Evgenii\_X](https://discuss.elastic.co/u/Evgenii_X)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 6:46am UTC](https://discuss.elastic.co/t/how-to-read-logs-with-permanent-null-characters-at-the-end-of-file/324408 "2023-02-02T06:46:37Z")
We need to collect MT4 logs (MetaTrader 4 trading platform). Log-saving "Feature" in MT4 is implemented according to the following algorithm: When creating a log file (or adding new logs to the current one), the platfo… --- ## [Winlogbeat I am getting error when winlogbeat is 7.5 and elastic is 8.5.3](https://discuss.elastic.co/t/winlogbeat-i-am-getting-error-when-winlogbeat-is-7-5-and-elastic-is-8-5-3/324500)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 1\ **Last updated:** [February 2, 2023, 6:02am UTC](https://discuss.elastic.co/t/winlogbeat-i-am-getting-error-when-winlogbeat-is-7-5-and-elastic-is-8-5-3/324500 "2023-02-02T06:02:50Z")
I am getting error when winlogbeat is 7.5 and elastic is 8.5.3 and kibana is also 8.5.3 if winlogbeat is 7.5 and elastic and kibana also 7.5 it is working fine ERROR pipeline/output.go:100 Failed to connect to backoff(… --- ## [Filebeat still shows old version even if service is a later version](https://discuss.elastic.co/t/filebeat-still-shows-old-version-even-if-service-is-a-later-version/322410)
**Author:** [@Azkiel19](https://discuss.elastic.co/u/Azkiel19)\ **Replies:** 5\ **Last updated:** [February 2, 2023, 5:56am UTC](https://discuss.elastic.co/t/filebeat-still-shows-old-version-even-if-service-is-a-later-version/322410 "2023-02-02T05:56:32Z")
Hi, Checking into Elastic - the beat version still shows as 5.6.5 even though the service we have running is already at 6.8.13 and confirmed it is still sending logs real time. Already tried restarting the filebeat ser… [Previous page](https://discuss.elastic.co/latest.md?page=797) [Next page](https://discuss.elastic.co/latest.md?page=799)