# Latest **URL:** https://discuss.elastic.co/latest.md?page=948 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 949 --- ## [How to Remove old value and replace it with new value in Kibana](https://discuss.elastic.co/t/how-to-remove-old-value-and-replace-it-with-new-value-in-kibana/315522)
**Author:** [@SayliKibana](https://discuss.elastic.co/u/SayliKibana)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 6:29am UTC](https://discuss.elastic.co/t/how-to-remove-old-value-and-replace-it-with-new-value-in-kibana/315522 "2022-09-30T06:29:51Z")
We have an Automation process wherein we process Transaction Input as "ECO Number" and as it get processed ,the output of the ECO Number with Status is displayed on the Kibana Dashboard. According to our process we upda… --- ## [When nod workers have disaster, they don't deploy the terminated pods](https://discuss.elastic.co/t/when-nod-workers-have-disaster-they-dont-deploy-the-terminated-pods/314703)
**Author:** [@farhad\_kh](https://discuss.elastic.co/u/farhad_kh)\ **Replies:** 2\ **Last updated:** [September 28, 2022, 6:08am UTC](https://discuss.elastic.co/t/when-nod-workers-have-disaster-they-dont-deploy-the-terminated-pods/314703 "2022-09-28T06:08:03Z")
I have a cluster with 6 workers I created 3 data nodes and 3 master nodes on them When cluster nodes fail The operator does not create termination pods in other nodes It also has trouble rebuilding Kibana pods Also,… --- ## [Dotnet core WPF application - how to get APM traces](https://discuss.elastic.co/t/dotnet-core-wpf-application-how-to-get-apm-traces/315035)
**Author:** [@SaEd](https://discuss.elastic.co/u/SaEd)\ **Replies:** 5\ **Last updated:** [September 30, 2022, 5:44am UTC](https://discuss.elastic.co/t/dotnet-core-wpf-application-how-to-get-apm-traces/315035 "2022-09-30T05:44:49Z")
Hello all, I have a .net core WPF application (not asp.net core). I'm also using Serilog for logging. From Elastic Stack: Fleet with integrations: APM 8.4.2, Custom Log 1.0.0, System 1.16.2 Also using Elastic-agent 8.… --- ## [Find average aggregation of the top N buckets](https://discuss.elastic.co/t/find-average-aggregation-of-the-top-n-buckets/315515)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 5:43am UTC](https://discuss.elastic.co/t/find-average-aggregation-of-the-top-n-buckets/315515 "2022-09-30T05:43:39Z")
I'm trying to determine the average value of the "count" column for the top 5 documents ordered by "timestamp" (in descending order). Sample Index data: {"index":{}} {"title": "foo", "count": 1, "timestamp":"2022-09-15… --- ## [I tried to upload a log file and a CSV file through the Kibana UI upload file option. But in both cases getting "File structure cannot be determined" error](https://discuss.elastic.co/t/i-tried-to-upload-a-log-file-and-a-csv-file-through-the-kibana-ui-upload-file-option-but-in-both-cases-getting-file-structure-cannot-be-determined-error/314878)
**Author:** [@cadrija](https://discuss.elastic.co/u/cadrija)\ **Replies:** 11\ **Last updated:** [September 30, 2022, 5:23am UTC](https://discuss.elastic.co/t/i-tried-to-upload-a-log-file-and-a-csv-file-through-the-kibana-ui-upload-file-option-but-in-both-cases-getting-file-structure-cannot-be-determined-error/314878 "2022-09-30T05:23:52Z")
I am new to Elastic. I have setup ELK in Ubuntu machine. I tried to upload a log file and a CSV file through the Kibana UI upload file option. But in both cases getting "File structure cannot be determined" error. I h… --- ## [Elasticsearch \[6.8\] small index query response time in seconds](https://discuss.elastic.co/t/elasticsearch-6-8-small-index-query-response-time-in-seconds/315512)
**Author:** [@srivatsa](https://discuss.elastic.co/u/srivatsa)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 4:34am UTC](https://discuss.elastic.co/t/elasticsearch-6-8-small-index-query-response-time-in-seconds/315512 "2022-09-30T04:34:27Z")
Hi folks, Facing an issue involving a small index of the size 378kb taking around 10s for a read query. We had tried increasing the number of replicas assuming it would help with reads but did not see any noticeable dif… --- ## [Ingest Pipeline threads](https://discuss.elastic.co/t/ingest-pipeline-threads/315182)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:57am UTC](https://discuss.elastic.co/t/ingest-pipeline-threads/315182 "2022-09-30T03:57:38Z")
In logstash, the pipeline.workers setting determines how many threads to run to process the filter and output. Do we have similar settings for elasticsearch ingest pipeline? It seems to work single-threaded and the more… --- ## [Does IndexRequest trigger ingest phase for a document already in the index?](https://discuss.elastic.co/t/does-indexrequest-trigger-ingest-phase-for-a-document-already-in-the-index/315215)
**Author:** [@fifthist](https://discuss.elastic.co/u/fifthist)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:53am UTC](https://discuss.elastic.co/t/does-indexrequest-trigger-ingest-phase-for-a-document-already-in-the-index/315215 "2022-09-30T03:53:02Z")
When using index mode, does IndexRequest trigger the ingest phase for a document already stored in an index? I'd like to use an ingest pipeline on an index, and I want to use the set processor even for documents that al… --- ## [Is this ES config valid & how to address cluster](https://discuss.elastic.co/t/is-this-es-config-valid-how-to-address-cluster/315262)
**Author:** [@Bitdoctor](https://discuss.elastic.co/u/Bitdoctor)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:52am UTC](https://discuss.elastic.co/t/is-this-es-config-valid-how-to-address-cluster/315262 "2022-09-30T03:52:21Z")
Even though there are amazing communities like this, it's still difficult to find good answers on some things. We have 1 x Kibana, 1 x LogStash, 3 x ES Cluster nodes. Is this a valid architecture; or do we have to have 1… --- ## [Banzai Cloud Fluentd filter is not working](https://discuss.elastic.co/t/banzai-cloud-fluentd-filter-is-not-working/315444)
**Author:** [@buulq90](https://discuss.elastic.co/u/buulq90)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:41am UTC](https://discuss.elastic.co/t/banzai-cloud-fluentd-filter-is-not-working/315444 "2022-09-30T03:41:07Z")
Hi all, I'm trying to remove some field on Fluentd by using plugin record\_transformer but it does not works. I'm trying to delete 2 fields: "\_id" & "\_index". Below is my configuration file: apiVersion: logging.banzaic… --- ## [How to force mapper\_parsing\_exception? from ElasticSearch to prevent accepting different types for a specific field](https://discuss.elastic.co/t/how-to-force-mapper-parsing-exception-from-elasticsearch-to-prevent-accepting-different-types-for-a-specific-field/315485)
**Author:** [@Saeedeh\_Moghimi](https://discuss.elastic.co/u/Saeedeh_Moghimi)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:38am UTC](https://discuss.elastic.co/t/how-to-force-mapper-parsing-exception-from-elasticsearch-to-prevent-accepting-different-types-for-a-specific-field/315485 "2022-09-30T03:38:52Z")
I have a production index with a date type field, which causes the error of Field \[tagSet.items.value\] of type \[text\] does not support custom formats in Kibana. I've created another index for test and whenever I want t… --- ## [JSON Plugin - Ignore Field](https://discuss.elastic.co/t/json-plugin-ignore-field/315510)
**Author:** [@QuestBevan](https://discuss.elastic.co/u/QuestBevan)\ **Replies:** 1\ **Last updated:** [September 30, 2022, 3:37am UTC](https://discuss.elastic.co/t/json-plugin-ignore-field/315510 "2022-09-30T03:37:20Z")
Hi All, Need some advise. I am currently using filebeat, to send logs to Elasticsearch via Logstash. Filebeat -\> Logstash -\> Elasticsearch Log files are in JSON, and these JSON documents are being expanded as expecte… --- ## [New Elasticsearch client - Search response cannot be serialized because of null value on sort fields](https://discuss.elastic.co/t/new-elasticsearch-client-search-response-cannot-be-serialized-because-of-null-value-on-sort-fields/315326)
**Author:** [@ALX\_DM](https://discuss.elastic.co/u/ALX_DM)\ **Replies:** 9\ **Last updated:** [September 30, 2022, 1:31am UTC](https://discuss.elastic.co/t/new-elasticsearch-client-search-response-cannot-be-serialized-because-of-null-value-on-sort-fields/315326 "2022-09-30T01:31:28Z")
I am migrating elasticsearch from old to new elasticsearch java client. I encounter this problem wherein I issue a request query, then the response has null values. The code below is how I request: SearchRequest r… --- ## [Seperate fleet management cluster - integrations, management,](https://discuss.elastic.co/t/seperate-fleet-management-cluster-integrations-management/315507)
**Author:** [@vbohata](https://discuss.elastic.co/u/vbohata)\ **Replies:** 0\ **Last updated:** [September 30, 2022, 12:41am UTC](https://discuss.elastic.co/t/seperate-fleet-management-cluster-integrations-management/315507 "2022-09-30T00:41:10Z")
I checked the documentation and using the logstash outputs it is not possible to use separate fleet managed agents with logstash output to different clusters. But what about the integrations? Lets imagine for big deplo… --- ## [Filebeat not ingesting json based log files to elastic search](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482)
**Author:** [@paarbour](https://discuss.elastic.co/u/paarbour)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 10:34pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482 "2022-09-29T22:34:08Z")
I have Elasticsearch and Kibana working, that was the easy part. I can ingest files directly from Kibana, no problems they get parsed and handled without issue. I am now trying to configure filebeat to pull in files fr… --- ## [Min\_score doesnt apply to aggregates](https://discuss.elastic.co/t/min-score-doesnt-apply-to-aggregates/315503)
**Author:** [@reisner](https://discuss.elastic.co/u/reisner)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 9:37pm UTC](https://discuss.elastic.co/t/min-score-doesnt-apply-to-aggregates/315503 "2022-09-29T21:37:06Z")
Hi there, I'm seeing some weird behaviour trying to fix an issue with a query. I was originally running this query: GET /coe\_td\_council\_report\_files\_test/\_search { "size": 0, "min\_score": 2.9, "query": { "b… --- ## [Combine normal and nested fields with query\_string](https://discuss.elastic.co/t/combine-normal-and-nested-fields-with-query-string/315502)
**Author:** [@Antonio\_Antovski](https://discuss.elastic.co/u/Antonio_Antovski)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 8:54pm UTC](https://discuss.elastic.co/t/combine-normal-and-nested-fields-with-query-string/315502 "2022-09-29T20:54:18Z")
I have a document which contains both normal and nested fields. I'm trying to find all the documents that contain all the words from a regex query in any of the fields of interest. Since I'm using a regex query and tryin… --- ## [Kibana is not coming up](https://discuss.elastic.co/t/kibana-is-not-coming-up/315263)
**Author:** [@DineshGarimella](https://discuss.elastic.co/u/DineshGarimella)\ **Replies:** 9\ **Last updated:** [September 29, 2022, 8:28pm UTC](https://discuss.elastic.co/t/kibana-is-not-coming-up/315263 "2022-09-29T20:28:57Z")
{"type":"log","@timestamp":"2022-09-27T11:07:06Z","tags":\["status","plugin:kibana@6.4.0","info"\],"pid":153778,"state":"green","message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","pr… --- ## [Create rules error](https://discuss.elastic.co/t/create-rules-error/314993)
**Author:** [@zhixiang\_hao](https://discuss.elastic.co/u/zhixiang_hao)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 8:24pm UTC](https://discuss.elastic.co/t/create-rules-error/314993 "2022-09-29T20:24:44Z")
There is no problem in the test on the platform, and the alarm can be reported normally, but an error is reported when I create a rule --- ## [My Elasticsearch wont start after java update](https://discuss.elastic.co/t/my-elasticsearch-wont-start-after-java-update/315454)
**Author:** [@Joe\_Li](https://discuss.elastic.co/u/Joe_Li)\ **Replies:** 4\ **Last updated:** [September 29, 2022, 6:13pm UTC](https://discuss.elastic.co/t/my-elasticsearch-wont-start-after-java-update/315454 "2022-09-29T18:13:28Z")
getting the below error and not sure where to start... can anyone assist? \[root@bh3elklpv01 jli\]# sudo systemctl status elasticsearch.service ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/sy… --- ## [\[logstash.filters.xml Error parsing xml with XmlSimple {:source=\>"message" , :exception=\>#\ **Author:** [@erwin339](https://discuss.elastic.co/u/erwin339)\ **Replies:** 0\ **Last updated:** [September 29, 2022, 2:48pm UTC](https://discuss.elastic.co/t/logstash-filters-xml-error-parsing-xml-with-xmlsimple-source-message-exception-rexml-no-close-tag-for-log4j-event-log4j-message-and-truncated/315472 "2022-09-29T14:48:19Z") This log is giving me problems: Note: my log is much longer but you exceed the character limit that allows me to upload here. Just delete things from the log that are repeated as messages. The message exceeds 1000 lines… --- ## [Hide Exit Full Screen button](https://discuss.elastic.co/t/hide-exit-full-screen-button/315435)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 3:16pm UTC](https://discuss.elastic.co/t/hide-exit-full-screen-button/315435 "2022-09-29T15:16:48Z")
Hello! I want to put a dashboard on a room screen in fullscreen. i got this with: &\_a=(fullScreenMode:!t) But the exit button remains, I would like to know if this can be hidden somehow. Thanks in advance! --- ## [Integration with nginx stubstatus doesn't work](https://discuss.elastic.co/t/integration-with-nginx-stubstatus-doesnt-work/315402)
**Author:** [@odelacruzc](https://discuss.elastic.co/u/odelacruzc)\ **Replies:** 5\ **Last updated:** [September 29, 2022, 5:43pm UTC](https://discuss.elastic.co/t/integration-with-nginx-stubstatus-doesnt-work/315402 "2022-09-29T17:43:31Z")
I work with nginx integration and elastic agent so, I configured host by default http://127.0.0.1:80, but my instance nginx is https, so kibana observability logs give me the follow error: "Error fetching data for metri… --- ## [Engine Name is already Taken (second occurrence)](https://discuss.elastic.co/t/engine-name-is-already-taken-second-occurrence/313412)
**Author:** [@Rav\_Panchalingam](https://discuss.elastic.co/u/Rav_Panchalingam)\ **Replies:** 4\ **Last updated:** [September 29, 2022, 5:03pm UTC](https://discuss.elastic.co/t/engine-name-is-already-taken-second-occurrence/313412 "2022-09-29T17:03:31Z")
I previously posted about this in June Engine Name is already Taken - Elastic Enterprise Search - Discuss the Elastic Stack where @Artem\_Shelkovnikov was helpful in resolving the issue Everything has been working great… --- ## [Filtered Log messages show up as empty fields in Kibana](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315400)
**Author:** [@Chma](https://discuss.elastic.co/u/Chma)\ **Replies:** 7\ **Last updated:** [September 29, 2022, 5:01pm UTC](https://discuss.elastic.co/t/filtered-log-messages-show-up-as-empty-fields-in-kibana/315400 "2022-09-29T17:01:49Z")
I have filtered my log message using grok. But when I check Kibana, I find the new fields on the left side of the page, but they are empty. I am also getting the \_grokparsefailure tag. Here's an example of my log messag… --- ## [Cannot add more than 10 columns in kibana table](https://discuss.elastic.co/t/cannot-add-more-than-10-columns-in-kibana-table/315442)
**Author:** [@Pierre\_Abi\_Chedid](https://discuss.elastic.co/u/Pierre_Abi_Chedid)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 3:04pm UTC](https://discuss.elastic.co/t/cannot-add-more-than-10-columns-in-kibana-table/315442 "2022-09-29T15:04:27Z")
Hello, I seem to have a problem when trying to add more than 10 columns in my kibana visualization I get the following error: Any idea on how to resolve the problem? --- ## [Document count by index name](https://discuss.elastic.co/t/document-count-by-index-name/315477)
**Author:** [@S-elk](https://discuss.elastic.co/u/S-elk)\ **Replies:** 1\ **Last updated:** [September 29, 2022, 4:57pm UTC](https://discuss.elastic.co/t/document-count-by-index-name/315477 "2022-09-29T16:57:49Z")
Hello! Im trying to get the document count by index but I have only been able to get a total count or the count per index of a few. attempts: GET \*/\_search { "size": 0, "aggs": { "indices": { "terms": { … --- ## [Logstash logs](https://discuss.elastic.co/t/logstash-logs/314911)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 2\ **Last updated:** [September 29, 2022, 4:39pm UTC](https://discuss.elastic.co/t/logstash-logs/314911 "2022-09-29T16:39:23Z")
Hi, I have installed logstash 7.16.3 with default settings in logstash.yml and log4j2.properties. My understanding is that with this configuration each log type, for example, logstash-plain.log should not be able to ex… --- ## [Save a variable for use in processors or how to drop later events in a series?](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406)
**Author:** [@opoplawski](https://discuss.elastic.co/u/opoplawski)\ **Replies:** 3\ **Last updated:** [September 29, 2022, 4:30pm UTC](https://discuss.elastic.co/t/save-a-variable-for-use-in-processors-or-how-to-drop-later-events-in-a-series/315406 "2022-09-29T16:30:17Z")
Is it possible to save state in a variable for use in a processor? I'd like to do something like: - save\_variable: name: id value: winlog.event\_data.ScriptBlockId when: regexp: winl… --- ## [Elastic APM intake/v2/rum/events requests cancelled](https://discuss.elastic.co/t/elastic-apm-intake-v2-rum-events-requests-cancelled/315137)
**Author:** [@bluestar](https://discuss.elastic.co/u/bluestar)\ **Replies:** 5\ **Last updated:** [September 29, 2022, 4:23pm UTC](https://discuss.elastic.co/t/elastic-apm-intake-v2-rum-events-requests-cancelled/315137 "2022-09-29T16:23:03Z")
I have elastic apm setup for an angular 13 application (using npm package @elastic/apm-rum). I can see https://\*\*\*.com/intake/v2/rum/events request going responding 202 and being cancelled after 10 secs. In chrome conso… [Previous page](https://discuss.elastic.co/latest.md?page=947) [Next page](https://discuss.elastic.co/latest.md?page=949)