# Latest **URL:** https://discuss.elastic.co/latest.md?page=818 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 819 --- ## [Eland, when querying an index it will store the whole index in a dataframe?](https://discuss.elastic.co/t/eland-when-querying-an-index-it-will-store-the-whole-index-in-a-dataframe/323340)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 3:33pm UTC](https://discuss.elastic.co/t/eland-when-querying-an-index-it-will-store-the-whole-index-in-a-dataframe/323340 "2023-01-17T15:33:45Z")
Using Eland, When querying an index it will store the whole index in a dataframe? or only the elasticsearch limit 10000 documents? these dataframes are stored in the memory of the server? Any strategy you recomend when… --- ## [KQL syntax with python](https://discuss.elastic.co/t/kql-syntax-with-python/323218)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 2:33pm UTC](https://discuss.elastic.co/t/kql-syntax-with-python/323218 "2023-01-17T14:33:13Z")
I have this idea of using KQL syntax through python or javascript. I have a dashboard named "main" and in that, we have a field called "topic". So, on the dashboard page when I use the KQL syntax and type in the search b… --- ## [How to add specific windows services, applications, webservers for monitoring purpose](https://discuss.elastic.co/t/how-to-add-specific-windows-services-applications-webservers-for-monitoring-purpose/322094)
**Author:** [@rakeshsid01](https://discuss.elastic.co/u/rakeshsid01)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 2:25pm UTC](https://discuss.elastic.co/t/how-to-add-specific-windows-services-applications-webservers-for-monitoring-purpose/322094 "2023-01-17T14:25:41Z")
We have added windows servers or agents in fleet for monitoring checking alerts. We want to add specific services . And we want to alert when it is down how can we achieve this. --- ## [Status of elastic agent dont change updating to Healthy](https://discuss.elastic.co/t/status-of-elastic-agent-dont-change-updating-to-healthy/322706)
**Author:** [@qwerasdf](https://discuss.elastic.co/u/qwerasdf)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 2:19pm UTC](https://discuss.elastic.co/t/status-of-elastic-agent-dont-change-updating-to-healthy/322706 "2023-01-17T14:19:07Z")
I define elastic agent policy with logstash output but when i install agent on assets, status of agents remains on updating but when output set to elasticsearch I dont have any problem and status is Healthy? Please Help… --- ## [Can I create timeline chart in Kibana?](https://discuss.elastic.co/t/can-i-create-timeline-chart-in-kibana/323301)
**Author:** [@Kamil\_BdBelfort](https://discuss.elastic.co/u/Kamil_BdBelfort)\ **Replies:** 3\ **Last updated:** [January 17, 2023, 1:59pm UTC](https://discuss.elastic.co/t/can-i-create-timeline-chart-in-kibana/323301 "2023-01-17T13:59:04Z")
Hi all, I would like to create a timeline chart. I have projects that have start-date and end-date values that I would like to visualize. I've been struggling to find a solution for a while now. My data looks like th… --- ## [Kibana Saved Search autosize on a Dashboard](https://discuss.elastic.co/t/kibana-saved-search-autosize-on-a-dashboard/323266)
**Author:** [@andreatera](https://discuss.elastic.co/u/andreatera)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 1:58pm UTC](https://discuss.elastic.co/t/kibana-saved-search-autosize-on-a-dashboard/323266 "2023-01-17T13:58:34Z")
Hello all, we're using Kibana 7.17.3 with a simple Dashboard having inside a Saved Search. This search frame have not the possibility to autosize its height when you resize the Window of your client browser. Is there … --- ## [Auditbeat data not being indexed](https://discuss.elastic.co/t/auditbeat-data-not-being-indexed/323294)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 2\ **Last updated:** [January 17, 2023, 1:34pm UTC](https://discuss.elastic.co/t/auditbeat-data-not-being-indexed/323294 "2023-01-17T13:34:12Z")
Hello, I can ingest the logs if I set up the output.destination to Elasticsearch but when routing the logs via Logstash I am unable to receive/view them at Elasticsearch (through Kibana) THe following the setup with Lo… --- ## [SMB traffic spike](https://discuss.elastic.co/t/smb-traffic-spike/323318)
**Author:** [@Elnur\_Abbasov](https://discuss.elastic.co/u/Elnur_Abbasov)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 1:22pm UTC](https://discuss.elastic.co/t/smb-traffic-spike/323318 "2023-01-17T13:22:26Z")
Hi, we have Palo Alto logs in our elasticsearch database. I need to do anomaly detection based on SMB traffic. How can I do that ? My first attempt was to set destination.port to 445 or 139, but couldn't find a way to sp… --- ## [Heap usage in versions 6 and 7](https://discuss.elastic.co/t/heap-usage-in-versions-6-and-7/322127)
**Author:** [@casterQ](https://discuss.elastic.co/u/casterQ)\ **Replies:** 5\ **Last updated:** [January 17, 2023, 12:53pm UTC](https://discuss.elastic.co/t/heap-usage-in-versions-6-and-7/322127 "2023-01-17T12:53:56Z")
After upgrading from 6.7.0 to 7.10.2, the amount of data in each data node has decreased, but the heap utilization rate has increased, leading to frequent circuit\_breaking. The 7 version FST has moved to the off heap mem… --- ## [How to send logs to logstash outside the kubernetes cluster](https://discuss.elastic.co/t/how-to-send-logs-to-logstash-outside-the-kubernetes-cluster/323322)
**Author:** [@sulfred](https://discuss.elastic.co/u/sulfred)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 12:38pm UTC](https://discuss.elastic.co/t/how-to-send-logs-to-logstash-outside-the-kubernetes-cluster/323322 "2023-01-17T12:38:50Z")
Hi all, I followed this page to set up a logstash with k8s. I can send logs to this logstash within the k8s cluster from other pods. But, I cannot send logs to the logstash outside the cluster. Here is my settings: … --- ## [I am setting elasticsearch 8.5.3 but getting below error](https://discuss.elastic.co/t/i-am-setting-elasticsearch-8-5-3-but-getting-below-error/323216)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 10\ **Last updated:** [January 17, 2023, 12:35pm UTC](https://discuss.elastic.co/t/i-am-setting-elasticsearch-8-5-3-but-getting-below-error/323216 "2023-01-17T12:35:42Z")
\[2023-01-16T10:41:07,855\]\[ERROR\]\[o.e.i.g.GeoIpDownloader \] \[node-203\] exception during geoip databases update java.net.SocketTimeoutException: Connect timed out at sun.nio.ch.NioSocketImpl.timedFinishConnect(NioSocket… --- ## [Does Elastic env. auto-localize to EFIGS languages based on browser language header?](https://discuss.elastic.co/t/does-elastic-env-auto-localize-to-efigs-languages-based-on-browser-language-header/323072)
**Author:** [@JPT\_Manche](https://discuss.elastic.co/u/JPT_Manche)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 12:04pm UTC](https://discuss.elastic.co/t/does-elastic-env-auto-localize-to-efigs-languages-based-on-browser-language-header/323072 "2023-01-17T12:04:21Z")
Does Elastic environment auto-localize to EFIGS (English, French, Italian, German and Spanish) languages based on browser language header? I’m super new to elastic and I can’t really find this. I want to know if consol… --- ## [Using Power BI conditional formatting](https://discuss.elastic.co/t/using-power-bi-conditional-formatting/323292)
**Author:** [@Likithsai](https://discuss.elastic.co/u/Likithsai)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 11:39am UTC](https://discuss.elastic.co/t/using-power-bi-conditional-formatting/323292 "2023-01-17T11:39:32Z")
Problem: When attempting to use conditional formatting on a card, table, etc. I can right click off the measure or column data involved to select conditional formatting. The process starts and the conditional formatting … --- ## [How to create Gantt chart visualization](https://discuss.elastic.co/t/how-to-create-gantt-chart-visualization/322319)
**Author:** [@Kamil\_BdBelfort](https://discuss.elastic.co/u/Kamil_BdBelfort)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 11:37am UTC](https://discuss.elastic.co/t/how-to-create-gantt-chart-visualization/322319 "2023-01-17T11:37:44Z")
Hi there, I have been looking on previous posts and options in Vega / custom visualization to create Gantt Chart-like visualization for more than a day now. Part of my data are projects, I have start dates, end dates, … --- ## [Can we control file/location where index data is stored in Elasticsearch?](https://discuss.elastic.co/t/can-we-control-file-location-where-index-data-is-stored-in-elasticsearch/322587)
**Author:** [@sundar.s](https://discuss.elastic.co/u/sundar.s)\ **Replies:** 4\ **Last updated:** [January 17, 2023, 11:04am UTC](https://discuss.elastic.co/t/can-we-control-file-location-where-index-data-is-stored-in-elasticsearch/322587 "2023-01-17T11:04:49Z")
Hi, Can we control the file or location where the index data of particular index is stored in Elasticsearch? That is, let say, I have multiple indices in my Elasticsearch indices and one of which is called index1 Can … --- ## [Dashboard: increasing the number of entries shown in "options list" filter controls](https://discuss.elastic.co/t/dashboard-increasing-the-number-of-entries-shown-in-options-list-filter-controls/322751)
**Author:** [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 11:00am UTC](https://discuss.elastic.co/t/dashboard-increasing-the-number-of-entries-shown-in-options-list-filter-controls/322751 "2023-01-17T11:00:19Z")
Hi, We are using filtering controls in our dashboards, specifically "Options List". We've noticed that the max number of entries shown in the dropdown is 10. Is there a way to increase this value ? The following topi… --- ## [Count the number of documents that contain two values in one field](https://discuss.elastic.co/t/count-the-number-of-documents-that-contain-two-values-in-one-field/323140)
**Author:** [@steve10](https://discuss.elastic.co/u/steve10)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 2:10pm UTC](https://discuss.elastic.co/t/count-the-number-of-documents-that-contain-two-values-in-one-field/323140 "2023-01-13T14:10:15Z")
Hi, I have a number of documents like this in Elastic Search database: Document 1: { “Id”: 6000, “customerName”: GT, “customerValue”: 10 } Document 2: { “Id”: 6001, “customerName”: MX, “customerValue”: 10 } Documen… --- ## [Same query convert string to int gives different result for nested fields](https://discuss.elastic.co/t/same-query-convert-string-to-int-gives-different-result-for-nested-fields/322598)
**Author:** [@Kanwardeep\_Singh](https://discuss.elastic.co/u/Kanwardeep_Singh)\ **Replies:** 0\ **Last updated:** [January 6, 2023, 7:13am UTC](https://discuss.elastic.co/t/same-query-convert-string-to-int-gives-different-result-for-nested-fields/322598 "2023-01-06T07:13:54Z")
I created new index and copy mapping from old index but After elasticdump running same query convert string to int gives different result for nested fields. --- ## [How to get network drop details in packetbeat dashboard?](https://discuss.elastic.co/t/how-to-get-network-drop-details-in-packetbeat-dashboard/323311)
**Author:** [@jisha](https://discuss.elastic.co/u/jisha)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 10:09am UTC](https://discuss.elastic.co/t/how-to-get-network-drop-details-in-packetbeat-dashboard/323311 "2023-01-17T10:09:41Z")
Hi, How to check if the network got failed/dropped in packetbeat dashboard? please help me Thanks jp --- ## [How to restrict search to selected fields when using q param](https://discuss.elastic.co/t/how-to-restrict-search-to-selected-fields-when-using-q-param/323263)
**Author:** [@nn14](https://discuss.elastic.co/u/nn14)\ **Replies:** 3\ **Last updated:** [January 17, 2023, 9:58am UTC](https://discuss.elastic.co/t/how-to-restrict-search-to-selected-fields-when-using-q-param/323263 "2023-01-17T09:58:26Z")
Hi team, Our users generally use q param to search people. E.g. q="Matthew North" or just q="North". This results in our ES searching across all our 100+ fields defined in the schema and chances are it returns even thos… --- ## [How to optimize elasticsearch query dsl to improve the query performance？](https://discuss.elastic.co/t/how-to-optimize-elasticsearch-query-dsl-to-improve-the-query-performance/323213)
**Author:** [@yeoman](https://discuss.elastic.co/u/yeoman)\ **Replies:** 8\ **Last updated:** [January 17, 2023, 9:53am UTC](https://discuss.elastic.co/t/how-to-optimize-elasticsearch-query-dsl-to-improve-the-query-performance/323213 "2023-01-17T09:53:16Z")
Dear elasticsearch technology experts,I have a elasticsearch index which size is almost 18Gb,and the amount of documents is about 400000.There are 3 nodes in the elasticserch cluster,and each nodes server is 2Cpu 4Gb mem… --- ## [Elastic APM(8.5.0) - error querying cluster\_uuid](https://discuss.elastic.co/t/elastic-apm-8-5-0-error-querying-cluster-uuid/323097)
**Author:** [@ragur](https://discuss.elastic.co/u/ragur)\ **Replies:** 7\ **Last updated:** [January 17, 2023, 9:32am UTC](https://discuss.elastic.co/t/elastic-apm-8-5-0-error-querying-cluster-uuid/323097 "2023-01-17T09:32:41Z")
Kibana version: 8.5.0 Elasticsearch version: 8.5.0 APM Server version: 8.5.0 APM Agent language and version: Java, 1.35.0 Browser version: Chrome, 105.0.5195.102 Original install method (e.g. download page, yum, deb… --- ## [Elasticsearch kubernetes deployment](https://discuss.elastic.co/t/elasticsearch-kubernetes-deployment/323306)
**Author:** [@Ayyappan](https://discuss.elastic.co/u/Ayyappan)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 9:30am UTC](https://discuss.elastic.co/t/elasticsearch-kubernetes-deployment/323306 "2023-01-17T09:30:56Z")
is it possible to restore the data from the cache once its cleared/overwritten? --- ## [Logstash conf script language](https://discuss.elastic.co/t/logstash-conf-script-language/323305)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 9:30am UTC](https://discuss.elastic.co/t/logstash-conf-script-language/323305 "2023-01-17T09:30:56Z")
Hi all, I have installed logstash 8.4.0. with my ES. I have created logstash .conf file to create data pipelines. I use below .conf format input { ... } filter{ .... } output{ ... } I just want to know is above sc… --- ## [Vegalite - Filter Flatten Data](https://discuss.elastic.co/t/vegalite-filter-flatten-data/323123)
**Author:** [@Siva\_Kumar\_Menta](https://discuss.elastic.co/u/Siva_Kumar_Menta)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 9:21am UTC](https://discuss.elastic.co/t/vegalite-filter-flatten-data/323123 "2023-01-17T09:21:09Z")
Hi All, I have data in Elasticsearch index "testdata" with few fields in array format. While trying to apply filter on flattened data @ line #18 as {"filter":"ms \> 1"} getting error. Syntax wise it looks fine but not su… --- ## [Occasionally missing data when making both gt + lte queries with a single isoformatted date](https://discuss.elastic.co/t/occasionally-missing-data-when-making-both-gt-lte-queries-with-a-single-isoformatted-date/323284)
**Author:** [@jsun-m](https://discuss.elastic.co/u/jsun-m)\ **Replies:** 9\ **Last updated:** [January 17, 2023, 8:45am UTC](https://discuss.elastic.co/t/occasionally-missing-data-when-making-both-gt-lte-queries-with-a-single-isoformatted-date/323284 "2023-01-17T08:45:34Z")
Use case: I'm trying to build a realtime logging client that allows the user to search old logs as well as see new logs come in realtime. So far everything mostly functions as expected except when the first queries are … --- ## [Need to know the cost of ELK product without support in all categories](https://discuss.elastic.co/t/need-to-know-the-cost-of-elk-product-without-support-in-all-categories/323302)
**Author:** [@Abj\_Ins](https://discuss.elastic.co/u/Abj_Ins)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 9:02am UTC](https://discuss.elastic.co/t/need-to-know-the-cost-of-elk-product-without-support-in-all-categories/323302 "2023-01-17T09:02:50Z")
Hi Team, Need to know the cost of ELK product without support. --- ## [Adding new sink to Beats](https://discuss.elastic.co/t/adding-new-sink-to-beats/323295)
**Author:** [@ag-ramachandran](https://discuss.elastic.co/u/ag-ramachandran)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 8:56am UTC](https://discuss.elastic.co/t/adding-new-sink-to-beats/323295 "2023-01-17T08:56:41Z")
Support for additional datastores: Azure Data Explorer We have requirements for integration of filebeat to a timeseries database called Azure Data Explorer. Roughly ran through the existing modules, this would be along … --- ## [Filestream parsers multiline pattern parse all file in one hit althoutgh I test my pattern in The Go Playground](https://discuss.elastic.co/t/filestream-parsers-multiline-pattern-parse-all-file-in-one-hit-althoutgh-i-test-my-pattern-in-the-go-playground/323179)
**Author:** [@fouadelnahal](https://discuss.elastic.co/u/fouadelnahal)\ **Replies:** 5\ **Last updated:** [January 17, 2023, 8:30am UTC](https://discuss.elastic.co/t/filestream-parsers-multiline-pattern-parse-all-file-in-one-hit-althoutgh-i-test-my-pattern-in-the-go-playground/323179 "2023-01-17T08:30:10Z")
Here is the parser in filestream input parsers: - multiline: type: pattern pattern: '^DEBUG|INFO|ERROR' negate: true match: after # flush\_pattern: '^\\s\*$' and this is the log… --- ## [How to use elasticsearch 8.x ingest-attachment with Python](https://discuss.elastic.co/t/how-to-use-elasticsearch-8-x-ingest-attachment-with-python/323286)
**Author:** [@garami](https://discuss.elastic.co/u/garami)\ **Replies:** 2\ **Last updated:** [January 17, 2023, 7:45am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-8-x-ingest-attachment-with-python/323286 "2023-01-17T07:45:34Z")
I am trying to read a pdf from python and send it to elasticsearch. I tried to use ingest-attachment to help with that, but I don't know how. When I followed the official documentation, it worked. However, there doesn… [Previous page](https://discuss.elastic.co/latest.md?page=817) [Next page](https://discuss.elastic.co/latest.md?page=819)