# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1003 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1004 --- ## [Kibana fails to create kibana.pid in /var/run](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247)
**Author:** [@m-b79](https://discuss.elastic.co/u/m-b79)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 8:26am UTC](https://discuss.elastic.co/t/kibana-fails-to-create-kibana-pid-in-var-run/267247 "2021-03-24T08:26:24Z")
Hi, I am a beginner with ELK and since I've updated my Ubuntu 20.04, I have the following problem: When I want to start kibana it fails and when I check the logs it says "\[Error: ENOENT: no such file or directory, open… --- ## [Elasticsearch high cpu load on snapshot creation](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650)
**Author:** [@farmean](https://discuss.elastic.co/u/farmean)\ **Replies:** 6\ **Last updated:** [March 24, 2021, 8:24am UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-load-on-snapshot-creation/265650 "2021-03-24T08:24:13Z")
Hey everyone! We've got some issue that's making us scratch our heads for a while. We have pretty straightforward setup, 13 nodes, 1 index, 1000 shards, 2 replicas for each, a lot of nested document, high write load an… --- ## [How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170)
**Author:** [@Amit\_Singh4](https://discuss.elastic.co/u/Amit_Singh4)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 8:22am UTC](https://discuss.elastic.co/t/how-can-i-add-my-own-html-input-element-like-text-box-text-area-drop-down-save-button-in-my-kibana-dashboard-ui/268170 "2021-03-24T08:22:43Z")
How can I add my own html input element like- Text Box, Text Area, Drop down, Save button in my Kibana dashboard UI. And after clicking on Button (like- Save), I want to save these new html input values into Elasticseac… --- ## [Datetime parsing errors when including locale de-AT](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091)
**Author:** [@philippkahr](https://discuss.elastic.co/u/philippkahr)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 12:21pm UTC](https://discuss.elastic.co/t/datetime-parsing-errors-when-including-locale-de-at/268091 "2021-03-23T12:21:13Z")
Hi, I am at a loss, we have to deal with german encodings of month such as Dezember instead of December, or März instead of March, which also impacts the MMM notation instead of Mar it is Mär. This is an example message… --- ## [Elasticsearch - high load CPU](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165)
**Author:** [@Jefferson\_Ferrari](https://discuss.elastic.co/u/Jefferson_Ferrari)\ **Replies:** 22\ **Last updated:** [March 24, 2021, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-high-load-cpu/268165 "2021-03-24T07:35:28Z")
Hello guys, We have a problem with elasticserach performance. My env is: 3 masters: AWS t3.large VM on premises CPU: 2 Memory: 8GB VM on premises CPU: 2 Memory: 8GB 15 Datas AWS 5 EC2 instance m5.4xlarge 10 VMs… --- ## [Scripted Field not showing Expression Language in Kibana](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 4\ **Last updated:** [March 24, 2021, 7:07am UTC](https://discuss.elastic.co/t/scripted-field-not-showing-expression-language-in-kibana/267945 "2021-03-24T07:07:10Z")
I am not getting expression language in scripted field. I am using kibana 7.11 version. I want to perform sum on two fields but getting error --- ## [My problem about Geo-bounding box query indexed](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597)
**Author:** [@Sakura1996](https://discuss.elastic.co/u/Sakura1996)\ **Replies:** 9\ **Last updated:** [March 24, 2021, 6:42am UTC](https://discuss.elastic.co/t/my-problem-about-geo-bounding-box-query-indexed/267597 "2021-03-24T06:42:31Z")
Hi, I encountered 2 problems when following the doc, ES version is 7.9. As the doc when use type="indexed" option in bounding box query, the geo-point type must have lat and lon indexed, but I want to know how to do i… --- ## [Unable to fetch custom indices data in ECS](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742)
**Author:** [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:54am UTC](https://discuss.elastic.co/t/unable-to-fetch-custom-indices-data-in-ecs/267742 "2021-03-24T05:54:21Z")
If i add my custom indices in data sources on elastic security then how should i map field in ecs --- ## [Create debian package from source](https://discuss.elastic.co/t/create-debian-package-from-source/268097)
**Author:** [@maxlavr](https://discuss.elastic.co/u/maxlavr)\ **Replies:** 2\ **Last updated:** [March 24, 2021, 5:04am UTC](https://discuss.elastic.co/t/create-debian-package-from-source/268097 "2021-03-24T05:04:28Z")
Hello everyone. My name is Max and my profession is DevOps. I'm working in company which use Elastic Stack. New security standards for our product require building your software from source code and creating deb packages… --- ## [How to fuzzy search a subset of the result?](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164)
**Author:** [@nshimiye.tech](https://discuss.elastic.co/u/nshimiye.tech)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 4:34am UTC](https://discuss.elastic.co/t/how-to-fuzzy-search-a-subset-of-the-result/268164 "2021-03-24T04:34:54Z")
I have a need to search through collapsed results, is this possible? Something like this { "query": { "match\_all": {} }, "sort": { "createdTime": "desc" }, "collapse": { "field": "name.raw", "query"… --- ## [Issue with date field in CSV plugin](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 7\ **Last updated:** [March 24, 2021, 4:26am UTC](https://discuss.elastic.co/t/issue-with-date-field-in-csv-plugin/268047 "2021-03-24T04:26:41Z")
Hi All, I'm trying to ingest data into elasticsearch using csv plugin, data is going smooth for one or two days then all of a sudden there is a wired entry which will get updated with some random date and year. I'm … --- ## [Cluster status turn yellow everyday morning 8:00](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036)
**Author:** [@KeithTt](https://discuss.elastic.co/u/KeithTt)\ **Replies:** 17\ **Last updated:** [March 24, 2021, 3:10am UTC](https://discuss.elastic.co/t/cluster-status-turn-yellow-everyday-morning-8-00/268036 "2021-03-24T03:10:29Z")
ES version: 6.3.0 I get the pending tasks and thread pool status, here is the info: { "tasks": \[ { "insert\_order": 327314, "priority": "URGENT", "source": "create-index \[… --- ## [Filter for When Log changes Slightly](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152)
**Author:** [@rmoss25](https://discuss.elastic.co/u/rmoss25)\ **Replies:** 1\ **Last updated:** [March 24, 2021, 2:40am UTC](https://discuss.elastic.co/t/filter-for-when-log-changes-slightly/268152 "2021-03-24T02:40:27Z")
HI, How do you create a grok pattern that can handle the log changing every now and then so I have a filter written that works but every so often the last field of an almost identical log is empty and the existing filt… --- ## [🎉 Elastic Stack 7.12.0 released](https://discuss.elastic.co/t/elastic-stack-7-12-0-released/268153)
**Author:** [@elyssaemrich](https://discuss.elastic.co/u/elyssaemrich)\ **Replies:** 0\ **Last updated:** [March 24, 2021, 1:30am UTC](https://discuss.elastic.co/t/elastic-stack-7-12-0-released/268153 "2021-03-24T01:30:43Z")
:tada: Elastic Stack 7.12.0 released Elastic 7.12 is available now on Elastic Cloud — the only hosted Elasticsearch offering to include all of the new features in this latest release. You can also download the Elastic… --- ## [Indexing documents with different data types for a same field](https://discuss.elastic.co/t/indexing-documents-with-different-data-types-for-a-same-field/268086)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 1\ **Last updated:** [March 23, 2021, 11:31pm UTC](https://discuss.elastic.co/t/indexing-documents-with-different-data-types-for-a-same-field/268086 "2021-03-23T23:31:00Z")
I am using kafka connect elasticsearch sink to index data from kafka to elasticsearch index. The problem which I am facing is for particular event a field value is coming as text and for some event it's coming as object.… --- ## [Issue with Signals in ELK7.8](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [March 23, 2021, 11:02pm UTC](https://discuss.elastic.co/t/issue-with-signals-in-elk7-8/266699 "2021-03-23T23:02:33Z")
Hi, I have 200 rule signals running. There are 80 Elastic default rules and 120 custom rules. Last response of most of the rules are showing succeeded but last run is 6 days ago and more. There is no error message. Pl… --- ## [Documentation Suggestion | Secure communication with Logstash](https://discuss.elastic.co/t/documentation-suggestion-secure-communication-with-logstash/268146)
**Author:** [@lorenzop](https://discuss.elastic.co/u/lorenzop)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 10:11pm UTC](https://discuss.elastic.co/t/documentation-suggestion-secure-communication-with-logstash/268146 "2021-03-23T22:11:39Z")
In this guide, specifically the section for configuring Logstash to receive secure communications using an SSL certificate, we experienced difficulty getting this setup and were actually only able to get the server to … --- ## [Logstash Beats Input remote: undefined on SSL Errors](https://discuss.elastic.co/t/logstash-beats-input-remote-undefined-on-ssl-errors/268144)
**Author:** [@lorenzop](https://discuss.elastic.co/u/lorenzop)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 10:05pm UTC](https://discuss.elastic.co/t/logstash-beats-input-remote-undefined-on-ssl-errors/268144 "2021-03-23T22:05:50Z")
Wanted to bring conversation over to the discussion forum and see if anyone here might have experience with solving this problem. --- ## [Logstash an suricata](https://discuss.elastic.co/t/logstash-an-suricata/268133)
**Author:** [@lumi](https://discuss.elastic.co/u/lumi)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 9:05pm UTC](https://discuss.elastic.co/t/logstash-an-suricata/268133 "2021-03-23T21:05:01Z")
Hello I am getting Suricata Messages from Qradar which i need so save in a file. The suricata module on filebeat will add it to the elasticsearch. i have the following problem: This is what logstash writes into the f… --- ## [Logstash - do not starts when jdbc filter fails connection](https://discuss.elastic.co/t/logstash-do-not-starts-when-jdbc-filter-fails-connection/267545)
**Author:** [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)\ **Replies:** 6\ **Last updated:** [March 23, 2021, 8:59pm UTC](https://discuss.elastic.co/t/logstash-do-not-starts-when-jdbc-filter-fails-connection/267545 "2021-03-23T20:59:04Z")
Hi I've created a logstash input filter: filter { jdbc\_static { loaders =\> \[ { id =\> "remote-ipsservers" query =\> "select address, display\_name from host\_list'" … --- ## [Sum aggs returning scientific value](https://discuss.elastic.co/t/sum-aggs-returning-scientific-value/267861)
**Author:** [@leela\_kumili](https://discuss.elastic.co/u/leela_kumili)\ **Replies:** 6\ **Last updated:** [March 23, 2021, 8:57pm UTC](https://discuss.elastic.co/t/sum-aggs-returning-scientific-value/267861 "2021-03-23T20:57:44Z")
Sum aggs gives scientific value as result as shown below. Expected value 11111108.6789 Actual value : 1.1111108625E7 Index Mapping { "sample-tx" : { "mappings" : { "properties" : { "Id" : { … --- ## [Aggregation only on hits returned](https://discuss.elastic.co/t/aggregation-only-on-hits-returned/268131)
**Author:** [@sidnei\_de\_souza](https://discuss.elastic.co/u/sidnei_de_souza)\ **Replies:** 4\ **Last updated:** [March 23, 2021, 8:53pm UTC](https://discuss.elastic.co/t/aggregation-only-on-hits-returned/268131 "2021-03-23T20:53:00Z")
First question here, new on Elasticsearch. Is it possible to do an aggregation on the hits returned on a search? I mean, if there are 8000 docs that match my query but I limit the size to 200, is it possible to do an ag… --- ## [How to define time range in custom query rule in elasticsiem?](https://discuss.elastic.co/t/how-to-define-time-range-in-custom-query-rule-in-elasticsiem/267521)
**Author:** [@siginigin](https://discuss.elastic.co/u/siginigin)\ **Replies:** 5\ **Last updated:** [March 23, 2021, 8:41pm UTC](https://discuss.elastic.co/t/how-to-define-time-range-in-custom-query-rule-in-elasticsiem/267521 "2021-03-23T20:41:37Z")
Hi, I'm trying to create rule which should fire on admin activity when time of event is from 22:00 till 5:00. I tried this query: user.group.name :\*admin\* and ((@timestamp \>= "00:00:00" and @timestamp \<= "05:00:00" ) … --- ## [Scripted Field params.\_interval](https://discuss.elastic.co/t/scripted-field-params-interval/268113)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 3\ **Last updated:** [March 23, 2021, 6:35pm UTC](https://discuss.elastic.co/t/scripted-field-params-interval/268113 "2021-03-23T18:35:30Z")
Here's my current code for a scripted field: if (doc\['ifHCInOctets'\].size() != 0) { doc\['ifHCInOctets'\].value \* 8 / 60 } This part of my code: 8 / 60 } needs to be 8 / $interval } just like in TSVB with params.\_interva… --- ## [Kibana Status Code : 302](https://discuss.elastic.co/t/kibana-status-code-302/266048)
**Author:** [@vansh](https://discuss.elastic.co/u/vansh)\ **Replies:** 35\ **Last updated:** [March 23, 2021, 6:19pm UTC](https://discuss.elastic.co/t/kibana-status-code-302/266048 "2021-03-23T18:19:09Z")
Hi, I have installed Elasticsearch and Kibana on my server(calling it myserver). but i am unable to access Kibana through browser, it keeps saying This site can’t be reached myserver refused to connect. while browsing… --- ## [Kibana- Request/Connections](https://discuss.elastic.co/t/kibana-request-connections/267520)
**Author:** [@leemase004](https://discuss.elastic.co/u/leemase004)\ **Replies:** 7\ **Last updated:** [March 23, 2021, 5:59pm UTC](https://discuss.elastic.co/t/kibana-request-connections/267520 "2021-03-23T17:59:35Z")
When you go to Stack Monitoring you can click on the Kibana tab to get additional metrics. There will be a "Request" and a "Connections" tally in the Overview tab 1a) I am wondering how are these officially counted? I… --- ## [Elastic Stack 7.12.0 and 6.8.15 Security Update](https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [March 23, 2021, 5:40pm UTC](https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125 "2021-03-23T17:40:24Z")
Elasticsearch Suggester & Profile API information disclosure flaw (ESA-2021-06) A document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The… --- ## [Parse a comma separate value that contains a comma in it](https://discuss.elastic.co/t/parse-a-comma-separate-value-that-contains-a-comma-in-it/268026)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 5\ **Last updated:** [March 23, 2021, 4:52pm UTC](https://discuss.elastic.co/t/parse-a-comma-separate-value-that-contains-a-comma-in-it/268026 "2021-03-23T16:52:53Z")
Evening All, I am trying to parse out a log entry that is comma separated, but if the SOMEUSER field exists will have a comma in it as well that should be ignored. The fields that exist in some fashion are SOMEUSER, SO… --- ## [How to get hits count as a filed value](https://discuss.elastic.co/t/how-to-get-hits-count-as-a-filed-value/268078)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 4\ **Last updated:** [March 23, 2021, 4:27pm UTC](https://discuss.elastic.co/t/how-to-get-hits-count-as-a-filed-value/268078 "2021-03-23T16:27:33Z")
Hello Experts, When i search a query it gives total hits count in the kibana, How to get the same count as a filed which i want to use to Triger the mail. It would be great if someone helps Regards, Suresh --- ## [ECK 1.4.1 dry run is not working](https://discuss.elastic.co/t/eck-1-4-1-dry-run-is-not-working/268021)
**Author:** [@Mike\_Eklund](https://discuss.elastic.co/u/Mike_Eklund)\ **Replies:** 5\ **Last updated:** [March 23, 2021, 4:20pm UTC](https://discuss.elastic.co/t/eck-1-4-1-dry-run-is-not-working/268021 "2021-03-23T16:20:32Z")
ECK dry run is not working giving: Error from server (BadRequest): admission webhook "elastic-es-validation-v1.k8s.elastic.co" does not support dry run ES version is 7.9.3. kubernetes version is v1.18.16 Side effects… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1002) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1004)