# Latest **URL:** https://discuss.elastic.co/latest.md?page=822 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 823 --- ## [Color change based on field value instead of count](https://discuss.elastic.co/t/color-change-based-on-field-value-instead-of-count/323117)
**Author:** [@alytkowski](https://discuss.elastic.co/u/alytkowski)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 3:27pm UTC](https://discuss.elastic.co/t/color-change-based-on-field-value-instead-of-count/323117 "2023-01-13T15:27:57Z")
I'm trying to create a visualization, which will allow me to show my data from a community created Beats - Processbeat. It's a monitoring of processes with statuses like "RUNNING" or "STOPPED". Now to the point, below i… --- ## [Index settings in elasticsearch 8+](https://discuss.elastic.co/t/index-settings-in-elasticsearch-8/323027)
**Author:** [@Idorasi\_Paul](https://discuss.elastic.co/u/Idorasi_Paul)\ **Replies:** 3\ **Last updated:** [January 13, 2023, 3:20pm UTC](https://discuss.elastic.co/t/index-settings-in-elasticsearch-8/323027 "2023-01-13T15:20:13Z")
Hello, from what I see, IndexSettings has a field of the same type called index. What is the difference if I set, for example, number\_of\_replicas like: index.number\_of\_replicas: 2 or directly: number\_of\_replicas: 2 ? --- ## [Query bool with must and should](https://discuss.elastic.co/t/query-bool-with-must-and-should/323135)
**Author:** [@sphawk](https://discuss.elastic.co/u/sphawk)\ **Replies:** 6\ **Last updated:** [January 13, 2023, 3:21pm UTC](https://discuss.elastic.co/t/query-bool-with-must-and-should/323135 "2023-01-13T15:21:57Z")
I'm trying to build a bool query. { "query": { "bool" : { "must" : \[ {"term": { "language": "es\_ES" }} \], "should": \[ { … --- ## [\[BUG\] Bug in logs related to Kafka connection](https://discuss.elastic.co/t/bug-bug-in-logs-related-to-kafka-connection/269625)
**Author:** [@dacamposol](https://discuss.elastic.co/u/dacamposol)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 3:10pm UTC](https://discuss.elastic.co/t/bug-bug-in-logs-related-to-kafka-connection/269625 "2023-01-13T15:10:02Z")
Good afternoon everyone, I think that I have found a bug in the logs of Filebeat, version 7.12.0. I have a Kafka machine in a datacenter, let's call it Datacenter A, and I setup the Filebeat in another datacenter, in t… --- ## [No old data in developer tool, but data are present in discover](https://discuss.elastic.co/t/no-old-data-in-developer-tool-but-data-are-present-in-discover/323134)
**Author:** [@vetsolution](https://discuss.elastic.co/u/vetsolution)\ **Replies:** 3\ **Last updated:** [January 13, 2023, 2:34pm UTC](https://discuss.elastic.co/t/no-old-data-in-developer-tool-but-data-are-present-in-discover/323134 "2023-01-13T14:34:55Z")
Modified today Hello, When I use the elastic api, via curl or the developper tool. I cannot got data from some old indice. But if I use the discover feature of Kibana, it can get those data. Moreover, if I go from di… --- ## [Parse Elasticsearch json logs in filebeat](https://discuss.elastic.co/t/parse-elasticsearch-json-logs-in-filebeat/322533)
**Author:** [@qwinkler](https://discuss.elastic.co/u/qwinkler)\ **Replies:** 6\ **Last updated:** [January 13, 2023, 2:20pm UTC](https://discuss.elastic.co/t/parse-elasticsearch-json-logs-in-filebeat/322533 "2023-01-13T14:20:29Z")
Hello. I want to properly collect Elasticsearch logs. I have the following architecture. On the Linux node, I have Docker installed. I configured the Journald logging driver using official documentation (Journald loggin… --- ## [Need to more about store the logs on Hot node instead of warm node](https://discuss.elastic.co/t/need-to-more-about-store-the-logs-on-hot-node-instead-of-warm-node/323131)
**Author:** [@anushyaadam](https://discuss.elastic.co/u/anushyaadam)\ **Replies:** 3\ **Last updated:** [January 13, 2023, 2:16pm UTC](https://discuss.elastic.co/t/need-to-more-about-store-the-logs-on-hot-node-instead-of-warm-node/323131 "2023-01-13T14:16:42Z")
Hello Team, We would like to know about to store the data from Hot node instead of warm node. Normally the process was stored the data from hot node and warm node depends on ILM policies by 7days of retention period. H… --- ## [Searching through a document not knowing the path](https://discuss.elastic.co/t/searching-through-a-document-not-knowing-the-path/323132)
**Author:** [@Polala](https://discuss.elastic.co/u/Polala)\ **Replies:** 2\ **Last updated:** [January 13, 2023, 1:59pm UTC](https://discuss.elastic.co/t/searching-through-a-document-not-knowing-the-path/323132 "2023-01-13T13:59:03Z")
I want to search through a document and get data for Steven and all his children (so in this example James). Is there a way to do it not knowing the path for Steven - so it should be children.children.name - but what if… --- ## [Related to Logstash](https://discuss.elastic.co/t/related-to-logstash/323137)
**Author:** [@anik-27](https://discuss.elastic.co/u/anik-27)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 1:51pm UTC](https://discuss.elastic.co/t/related-to-logstash/323137 "2023-01-13T13:51:19Z")
Hello friends I want to fetch some metrics data from the Vrops(VMware) api that includes following steps - Make a post request with login credentials to get the authentication token Use that authentication token with … --- ## [Search by newly added wildcard field to existing index](https://discuss.elastic.co/t/search-by-newly-added-wildcard-field-to-existing-index/323122)
**Author:** [@bkelastic](https://discuss.elastic.co/u/bkelastic)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 1:43pm UTC](https://discuss.elastic.co/t/search-by-newly-added-wildcard-field-to-existing-index/323122 "2023-01-13T13:43:16Z")
I have in mappings "fooField": { "type": "double" } I want to search by this field using wildcard query, so I added wildcard multifield "fooField": { "type": "double", "fields": {… --- ## [GROK pattern](https://discuss.elastic.co/t/grok-pattern/322443)
**Author:** [@Hamunaptroid](https://discuss.elastic.co/u/Hamunaptroid)\ **Replies:** 9\ **Last updated:** [January 13, 2023, 11:39am UTC](https://discuss.elastic.co/t/grok-pattern/322443 "2023-01-13T11:39:49Z")
Hello, I have trouble with writing GROK pattern for system logs. My goal is to parse logs in form "systemctl -o verbose" which looks like this Wed 2022-10-12 09:08:42.759756 \_TRANSPORT=kernel SYSLOG\_IDENTIFIER=… --- ## [Kibana - Table without time](https://discuss.elastic.co/t/kibana-table-without-time/323112)
**Author:** [@Chloe\_Boissavy](https://discuss.elastic.co/u/Chloe_Boissavy)\ **Replies:** 6\ **Last updated:** [January 13, 2023, 1:09pm UTC](https://discuss.elastic.co/t/kibana-table-without-time/323112 "2023-01-13T13:09:47Z")
Hello, I have Kibana 8.3.3. I have firewall data so data with IP address. In the same indices, I have list of IP address. I would like to create a table with IP address from firewall (src IP) and compare it with the … --- ## [\[apm\]\[help\]APM Server Wont start and fetch indices](https://discuss.elastic.co/t/apm-help-apm-server-wont-start-and-fetch-indices/323086)
**Author:** [@atharvaunde](https://discuss.elastic.co/u/atharvaunde)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 12:53pm UTC](https://discuss.elastic.co/t/apm-help-apm-server-wont-start-and-fetch-indices/323086 "2023-01-13T12:53:31Z")
Hello Team, I just downloaded tar file for apm server (arm64) and extracted on the host where ES and Kibana is installed. the output of output test is as following ubuntu@ip-10-0-3-189:~/apm-server-8.6.0-linux-arm64$ .… --- ## [Generate apm secret token](https://discuss.elastic.co/t/generate-apm-secret-token/322808)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 4\ **Last updated:** [January 13, 2023, 12:30pm UTC](https://discuss.elastic.co/t/generate-apm-secret-token/322808 "2023-01-13T12:30:35Z")
Hi, I am trying to set up an apm server and was wondering if anyone knows how to generate a secret token for authentication as I need it. thanks and best regards --- ## [UNASSIGNED ALLOCATION\_FAILED](https://discuss.elastic.co/t/unassigned-allocation-failed/323128)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 12:28pm UTC](https://discuss.elastic.co/t/unassigned-allocation-failed/323128 "2023-01-13T12:28:27Z")
What can we do in below case? { "note" : "No shard was specified in the explain API request, so this response explains a randomly chosen unassigned shard. There may be other unassigned shards in this cluster which can… --- ## [Wrong timestamp in Alerting new elastic](https://discuss.elastic.co/t/wrong-timestamp-in-alerting-new-elastic/321286)
**Author:** [@diegomarting](https://discuss.elastic.co/u/diegomarting)\ **Replies:** 2\ **Last updated:** [December 16, 2022, 1:35pm UTC](https://discuss.elastic.co/t/wrong-timestamp-in-alerting-new-elastic/321286 "2022-12-16T13:35:07Z")
Hello, I am migrating some alerts to te new version of Elastic Stack. I created the rules and the actions to send a message to a Google Webhook when an error log is ingested, but when I formatted the message with the mu… --- ## [KQL Syntax](https://discuss.elastic.co/t/kql-syntax/323031)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 5\ **Last updated:** [January 13, 2023, 12:03pm UTC](https://discuss.elastic.co/t/kql-syntax/323031 "2023-01-13T12:03:47Z")
Does anybody know how to use dev tools? Because I'm thinking about updating the filter of a dashboard directly through python and I don't know how to do it. So, I am thinking of using KQL syntax. 2 questions I have is: d… --- ## [Filebeat-\>Kafka-\>Logstash-\>Elasticsearch fails for system.auth: "Provided Grok expressions do not match field value"](https://discuss.elastic.co/t/filebeat-kafka-logstash-elasticsearch-fails-for-system-auth-provided-grok-expressions-do-not-match-field-value/323068)
**Author:** [@brsolomon](https://discuss.elastic.co/u/brsolomon)\ **Replies:** 11\ **Last updated:** [January 13, 2023, 11:46am UTC](https://discuss.elastic.co/t/filebeat-kafka-logstash-elasticsearch-fails-for-system-auth-provided-grok-expressions-do-not-match-field-value/323068 "2023-01-13T11:46:31Z")
The ingest scenario below perplexingly fails for the Filebeat system module with the auth fileset with Provided Grok expressions do not match field value. It doesn't matter what the event is from /var/log/secure; every s… --- ## [Where does Elasticsearch store/read logs](https://discuss.elastic.co/t/where-does-elasticsearch-store-read-logs/323119)
**Author:** [@Ibicf](https://discuss.elastic.co/u/Ibicf)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 11:36am UTC](https://discuss.elastic.co/t/where-does-elasticsearch-store-read-logs/323119 "2023-01-13T11:36:41Z")
Greetings for eveyone! I'm newbie to Elasticsearch as much as in programming in general and I don't understand some things. I have a little Django-project for practise and I install Elasticsearch into project. I'm also… --- ## [Elasticsearch - check if the parameter is not empty](https://discuss.elastic.co/t/elasticsearch-check-if-the-parameter-is-not-empty/323096)
**Author:** [@Java2avaj](https://discuss.elastic.co/u/Java2avaj)\ **Replies:** 3\ **Last updated:** [January 13, 2023, 11:29am UTC](https://discuss.elastic.co/t/elasticsearch-check-if-the-parameter-is-not-empty/323096 "2023-01-13T11:29:58Z")
In SQL, we can perform the following in the where clause: SELECT \* FROM tbl WHERE :parameter \<\> '' OR :parameter is not null Is this possible in Elasticsearch to check if the input parameter/value is not null or empty?… --- ## [Kibana index data binding in the Vega Tree graph is difficult](https://discuss.elastic.co/t/kibana-index-data-binding-in-the-vega-tree-graph-is-difficult/323103)
**Author:** [@Dimple.P](https://discuss.elastic.co/u/Dimple.P)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 11:23am UTC](https://discuss.elastic.co/t/kibana-index-data-binding-in-the-vega-tree-graph-is-difficult/323103 "2023-01-13T11:23:33Z")
Static data was successfully connected to the Vega-V5 tree graph, however when I attempted to attach Kibana index data, it failed. Is it feasible to link the index data from Kibana to the Vega Tree graph? Eg: my\_index \[… --- ## [How to contact Elastic Team because of a license?](https://discuss.elastic.co/t/how-to-contact-elastic-team-because-of-a-license/323116)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 1\ **Last updated:** [January 13, 2023, 10:45am UTC](https://discuss.elastic.co/t/how-to-contact-elastic-team-because-of-a-license/323116 "2023-01-13T10:45:08Z")
Hello, I don't know if this is the correct topic, anyway, I'm trying to contact Elastic since beginning of December. First using the form that is available on their site, then trying to call to Sales team on Europe, and… --- ## [How to Hide the Zero records using JSON Input in Metric Dashboard](https://discuss.elastic.co/t/how-to-hide-the-zero-records-using-json-input-in-metric-dashboard/323013)
**Author:** [@Maruthappan\_Muthu](https://discuss.elastic.co/u/Maruthappan_Muthu)\ **Replies:** 5\ **Last updated:** [January 13, 2023, 10:21am UTC](https://discuss.elastic.co/t/how-to-hide-the-zero-records-using-json-input-in-metric-dashboard/323013 "2023-01-13T10:21:12Z")
My document gets the data on irregular interval.The field name is Ex.,SensexValue. There can be multiple values on the field (SensexValue) in every interval, with different timestamp(milliseconds) and some interval the f… --- ## [Logstash input imap plugin with attachment not decoding](https://discuss.elastic.co/t/logstash-input-imap-plugin-with-attachment-not-decoding/323113)
**Author:** [@anjuls](https://discuss.elastic.co/u/anjuls)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 9:58am UTC](https://discuss.elastic.co/t/logstash-input-imap-plugin-with-attachment-not-decoding/323113 "2023-01-13T09:58:03Z")
Hi, I am trying to fetch emails with attachments from Office 365 using logstash and putting them on Kafka topic. During the process, I got to understand the logstash-imap-input plugin is unable to process it. When the a… --- ## [How to check details of version\_conflicts when wait\_for\_completion=false in update\_by\_query?](https://discuss.elastic.co/t/how-to-check-details-of-version-conflicts-when-wait-for-completion-false-in-update-by-query/323110)
**Author:** [@bkelastic](https://discuss.elastic.co/u/bkelastic)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 9:40am UTC](https://discuss.elastic.co/t/how-to-check-details-of-version-conflicts-when-wait-for-completion-false-in-update-by-query/323110 "2023-01-13T09:40:30Z")
After executing \_update\_by\_query?conflicts=proceed&wait\_for\_completion=false I want to check details so I call GET \_tasks?detailed=true&actions=\*byquery and I receive response with number of "version\_conflicts" : {n… --- ## [Filtering by date field (other than the timestamp) in Kibana dashboard](https://discuss.elastic.co/t/filtering-by-date-field-other-than-the-timestamp-in-kibana-dashboard/322989)
**Author:** [@SaraAlshamsi](https://discuss.elastic.co/u/SaraAlshamsi)\ **Replies:** 3\ **Last updated:** [January 13, 2023, 8:56am UTC](https://discuss.elastic.co/t/filtering-by-date-field-other-than-the-timestamp-in-kibana-dashboard/322989 "2023-01-13T08:56:35Z")
Hello everyone, I have an index with several fields and more than 1 time field. For examle: Field names: "end\_date", "name", "sequence" & "start\_date". The mapping: { "check\_date\_filter": { "mappings": { … --- ## [How to know which element in the array is chosen by the fuzzysearch](https://discuss.elastic.co/t/how-to-know-which-element-in-the-array-is-chosen-by-the-fuzzysearch/323105)
**Author:** [@Heckler\_GlobalOperat](https://discuss.elastic.co/u/Heckler_GlobalOperat)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 8:30am UTC](https://discuss.elastic.co/t/how-to-know-which-element-in-the-array-is-chosen-by-the-fuzzysearch/323105 "2023-01-13T08:30:59Z")
Hello, I have a tricky case and want to consult the experts here. We store our user info in Elasticsearch, an user may have different name aliases, all stored in a "names" array like below "names" : \[ { … --- ## [Last\_terminated\_reason metric is not collected](https://discuss.elastic.co/t/last-terminated-reason-metric-is-not-collected/323101)
**Author:** [@hyungsun\_lim](https://discuss.elastic.co/u/hyungsun_lim)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 8:03am UTC](https://discuss.elastic.co/t/last-terminated-reason-metric-is-not-collected/323101 "2023-01-13T08:03:47Z")
I want to collect 'kubernetes.container.status.last\_terminated\_reason' metric in document (Kubernetes fields | Metricbeat Reference \[8.6\] | Elastic) So i use metricbeat(v7.10.1) to collect k8s event data. metricbeat.co… --- ## [Kibana visualization error after restoring the snapshot](https://discuss.elastic.co/t/kibana-visualization-error-after-restoring-the-snapshot/317265)
**Author:** [@not\_correct](https://discuss.elastic.co/u/not_correct)\ **Replies:** 2\ **Last updated:** [October 23, 2022, 7:34pm UTC](https://discuss.elastic.co/t/kibana-visualization-error-after-restoring-the-snapshot/317265 "2022-10-23T19:34:12Z")
Hi, I have restored ElaticSearch snapsot that been managed by another person, I get the followng error when it comes to kibana dashboards Text fields are not optimised for operations that require per-document field da… --- ## [Elasticsearch Urdu Analyzer plug-in](https://discuss.elastic.co/t/elasticsearch-urdu-analyzer-plug-in/323088)
**Author:** [@Armeen\_Ashraf\_Khan\_F](https://discuss.elastic.co/u/Armeen_Ashraf_Khan_F)\ **Replies:** 0\ **Last updated:** [January 13, 2023, 6:32am UTC](https://discuss.elastic.co/t/elasticsearch-urdu-analyzer-plug-in/323088 "2023-01-13T06:32:50Z")
I am a Data Science Masters student doing thesis in Information Retrieval for my native language Urdu. Urdu is like Arabic in textual form. Currently, Urdu Analyzer has not been created in elasticsearch and I want to cre… [Previous page](https://discuss.elastic.co/latest.md?page=821) [Next page](https://discuss.elastic.co/latest.md?page=823)