# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1016 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1017 --- ## [So confused on test prep](https://discuss.elastic.co/t/so-confused-on-test-prep/265997)
**Author:** [@jgearheart](https://discuss.elastic.co/u/jgearheart)\ **Replies:** 1\ **Last updated:** [March 4, 2021, 2:42pm UTC](https://discuss.elastic.co/t/so-confused-on-test-prep/265997 "2021-03-04T14:42:19Z")
I completed Elasticsearch Engineer 1. I want to prepare for the exam by practicing in the lab environment. Since I completed the course already I now cannot access the lab. The training team recommended downloading El… --- ## [Event.get(message).bytesize](https://discuss.elastic.co/t/event-get-message-bytesize/267004)
**Author:** [@jchaves506](https://discuss.elastic.co/u/jchaves506)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 6:07pm UTC](https://discuss.elastic.co/t/event-get-message-bytesize/267004 "2021-03-12T18:07:31Z")
Continuing the discussion from How to get entire enriched "event" size (not message size): I'm using metricbeat, and I'm looking to know what's the size of the message, I tried using that but I'm getting: \[ERROR\]\[logst… --- ## [How to export ELK data from Windows server to AWS cloud](https://discuss.elastic.co/t/how-to-export-elk-data-from-windows-server-to-aws-cloud/267110)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 5:07pm UTC](https://discuss.elastic.co/t/how-to-export-elk-data-from-windows-server-to-aws-cloud/267110 "2021-03-12T17:07:47Z")
Hi, We are in the process of migrating our Elastic search from On Prem server to AWS cloud. Could you please help me what could be the best option to export data from On Prem server and import into AWS cloud? --- ## [Kibana after logging with user name and password in going back to login screen](https://discuss.elastic.co/t/kibana-after-logging-with-user-name-and-password-in-going-back-to-login-screen/266641)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 4\ **Last updated:** [March 12, 2021, 4:55pm UTC](https://discuss.elastic.co/t/kibana-after-logging-with-user-name-and-password-in-going-back-to-login-screen/266641 "2021-03-12T16:55:46Z")
Kibana after logging with user name and password in going back to login screen itself After inspecting in console there are no errors Deployed in Azure Kubernetes environment --- ## [Rest High Level Client - 6.8.13 - long reindex api call - timeout](https://discuss.elastic.co/t/rest-high-level-client-6-8-13-long-reindex-api-call-timeout/267106)
**Author:** [@LJRamsey](https://discuss.elastic.co/u/LJRamsey)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 4:06pm UTC](https://discuss.elastic.co/t/rest-high-level-client-6-8-13-long-reindex-api-call-timeout/267106 "2021-03-12T16:06:52Z")
Hello, We are upgrading existing application from TransportClient to RestHighLevelClient in 6.8.13 (part of 5.6 to 6.8 upgrade) and facing some issues regarding reindex api and timeout. We are doing index copy throw re… --- ## [Multi series chart in one Visualization on Kibana 7.11](https://discuss.elastic.co/t/multi-series-chart-in-one-visualization-on-kibana-7-11/266796)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 4\ **Last updated:** [March 12, 2021, 4:07pm UTC](https://discuss.elastic.co/t/multi-series-chart-in-one-visualization-on-kibana-7-11/266796 "2021-03-12T16:07:53Z")
Hi All, Is it possible to create Multi series chart in a single visualization ? i want to implement a graph like below. any ideas or explanations? Thank you . die Original Data is comming from CSV file --- ## [How can I drop the domain from host.name field in logstash?](https://discuss.elastic.co/t/how-can-i-drop-the-domain-from-host-name-field-in-logstash/267031)
**Author:** [@Ishaan](https://discuss.elastic.co/u/Ishaan)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 4:03pm UTC](https://discuss.elastic.co/t/how-can-i-drop-the-domain-from-host-name-field-in-logstash/267031 "2021-03-12T16:03:48Z")
I want to remove domain from host.name field coming from metricbeat. For example: host.name = abcd.xyz.com host.name = abc@xyz.com I want to remove everything after . or @ or any other delimiter to save the value of … --- ## [Capitalize Every Word In String](https://discuss.elastic.co/t/capitalize-every-word-in-string/266997)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 8\ **Last updated:** [March 12, 2021, 3:56pm UTC](https://discuss.elastic.co/t/capitalize-every-word-in-string/266997 "2021-03-12T15:56:27Z")
Trying to capitalize each word in a fields value. I initially tried the titleize function of Ruby, but that didn't work...I guess because it's not part of Ruby internals or something like that? ruby { code =\> 'ev… --- ## [Applying modified css](https://discuss.elastic.co/t/applying-modified-css/267101)
**Author:** [@hayzjd836](https://discuss.elastic.co/u/hayzjd836)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 3:55pm UTC](https://discuss.elastic.co/t/applying-modified-css/267101 "2021-03-12T15:55:40Z")
Hello! I'm using version 7.11 of kibana I want to hide the elastic logo on the top left of kibana. So I modified the css file of kibana. (/usr/share/kibana/node\_modules/@kbn/ui-shared-deps/target/kbn-ui-shared-deps.v7… --- ## [How do I properly configure input to Logstash for a rewritable file?](https://discuss.elastic.co/t/how-do-i-properly-configure-input-to-logstash-for-a-rewritable-file/267089)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 3:54pm UTC](https://discuss.elastic.co/t/how-do-i-properly-configure-input-to-logstash-for-a-rewritable-file/267089 "2021-03-12T15:54:32Z")
Hi all! I have csv file, It is overwritten every 5 minutes. I have already configured input, filter,output. But in the current configuration I only get new lines from the file in the index. But I need to have all the… --- ## [Logstash input with filtered output](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951)
**Author:** [@djehuty](https://discuss.elastic.co/u/djehuty)\ **Replies:** 8\ **Last updated:** [March 12, 2021, 3:48pm UTC](https://discuss.elastic.co/t/logstash-input-with-filtered-output/266951 "2021-03-12T15:48:18Z")
I need to divide Winlogbeat input and push it to two separate indices when a beat has a particular event ID. I used an if statement but the indices seems to have the same data. This is my pipeline configuration: i… --- ## [If(filter,output) Else(filter,output)](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097)
**Author:** [@aannee](https://discuss.elastic.co/u/aannee)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 3:25pm UTC](https://discuss.elastic.co/t/if-filter-output-else-filter-output/267097 "2021-03-12T15:25:47Z")
Hi Elastic Team, Is this possible in logstash? input { } if "test" in \[mesasge\] { filter {} output {} } else { filter {} output {} } Thank you! --- ## [Can you tune the split\_on\_case\_change setting on the word delimiter token filter?](https://discuss.elastic.co/t/can-you-tune-the-split-on-case-change-setting-on-the-word-delimiter-token-filter/267102)
**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 3:20pm UTC](https://discuss.elastic.co/t/can-you-tune-the-split-on-case-change-setting-on-the-word-delimiter-token-filter/267102 "2021-03-12T15:20:00Z")
I have a love-hate relationship with split\_on\_case\_change My problem is that only certain words make sense to split on case change. For example, I'd like to treat TypedArray as Typed, Array. But I don't want to split up… --- ## [Can I add ingest pipelines to Elasticsearch with a config file as with Logstash?](https://discuss.elastic.co/t/can-i-add-ingest-pipelines-to-elasticsearch-with-a-config-file-as-with-logstash/267098)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 3:10pm UTC](https://discuss.elastic.co/t/can-i-add-ingest-pipelines-to-elasticsearch-with-a-config-file-as-with-logstash/267098 "2021-03-12T15:10:17Z")
Pretty basic question regarding ingest pipelines. I've used Logstash in the past and used pipeline files to create the grok pipelines. I do not see how to do this with Elasticsearch ingest pipelines. I have only been abl… --- ## [Find sequences in time series data](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965)
**Author:** [@markdturner](https://discuss.elastic.co/u/markdturner)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 1:43pm UTC](https://discuss.elastic.co/t/find-sequences-in-time-series-data/266965 "2021-03-12T13:43:36Z")
Hi, I'm trying to find example queries for returning sequences of events in a time series. My dataset is rainfall values at 10-minute intervals, and I want to find all storm events. A storm event would be considered con… --- ## [Rest client library documentation doesn't warn about removal of DeleteIndexResponse class, as well as change of method signature of delete()](https://discuss.elastic.co/t/rest-client-library-documentation-doesnt-warn-about-removal-of-deleteindexresponse-class-as-well-as-change-of-method-signature-of-delete/267091)
**Author:** [@Hrafnahnef](https://discuss.elastic.co/u/Hrafnahnef)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 1:21pm UTC](https://discuss.elastic.co/t/rest-client-library-documentation-doesnt-warn-about-removal-of-deleteindexresponse-class-as-well-as-change-of-method-signature-of-delete/267091 "2021-03-12T13:21:38Z")
Hi! Forgive me, if I'm posting this to the wrong place. I'd like to report a bug in the documentation for the 6.4, 6.5 and all subsequent versions of the documentation for the elasticsearch rest clients. The documenta… --- ## [Is it recommended to run es aggregations during api calls, how expensive can it be?](https://discuss.elastic.co/t/is-it-recommended-to-run-es-aggregations-during-api-calls-how-expensive-can-it-be/267084)
**Author:** [@manish\_kakoti](https://discuss.elastic.co/u/manish_kakoti)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 1:11pm UTC](https://discuss.elastic.co/t/is-it-recommended-to-run-es-aggregations-during-api-calls-how-expensive-can-it-be/267084 "2021-03-12T13:11:38Z")
there are couple of scenarios that i wanted to discuss: If we run aggregations (on large data sets) during REST API calls? How expensive it is experienced to be? If we store pre-aggregated data(which runs during in… --- ## [Customize dashboard \[Filebeat Nginx\] Overview ECS to point to fbeat-\* instead of filebeat-\* pattern](https://discuss.elastic.co/t/customize-dashboard-filebeat-nginx-overview-ecs-to-point-to-fbeat-instead-of-filebeat-pattern/266906)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 12:41pm UTC](https://discuss.elastic.co/t/customize-dashboard-filebeat-nginx-overview-ecs-to-point-to-fbeat-instead-of-filebeat-pattern/266906 "2021-03-12T12:41:57Z")
Dear experts, could you please tell me the way to customize the amazing dashboards like Filebeat Nginx ECS ones to point to a different index pattern ? By default, it looks like that these dashboards do collect data fr… --- ## [Logstash-tcp-input having unrecoverable error when logstash is used in systemd](https://discuss.elastic.co/t/logstash-tcp-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/267079)
**Author:** [@Arvind\_Ks](https://discuss.elastic.co/u/Arvind_Ks)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 11:53am UTC](https://discuss.elastic.co/t/logstash-tcp-input-having-unrecoverable-error-when-logstash-is-used-in-systemd/267079 "2021-03-12T11:53:53Z")
Hi Team, I am trying to use tcp plugin in logstash. When i run the config file related to this using logstash cli command , i am able to start it without any issues. However when i try starting it as a systemd service i… --- ## [Custom formatting for boolean fields](https://discuss.elastic.co/t/custom-formatting-for-boolean-fields/266949)
**Author:** [@bg.andrew](https://discuss.elastic.co/u/bg.andrew)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 10:49am UTC](https://discuss.elastic.co/t/custom-formatting-for-boolean-fields/266949 "2021-03-12T10:49:54Z")
Hi, should be quite a simple question. I'm using kibana with elasticsearch service in AWS. Does anybody knows what is the best way to customise the look of a boolean field values in kibana? The client wants to see those … --- ## [Docker logstash in ECS receives SIGTERM after ~5 min](https://discuss.elastic.co/t/docker-logstash-in-ecs-receives-sigterm-after-5-min/267012)
**Author:** [@tiberiu89](https://discuss.elastic.co/u/tiberiu89)\ **Replies:** 3\ **Last updated:** [March 12, 2021, 10:06am UTC](https://discuss.elastic.co/t/docker-logstash-in-ecs-receives-sigterm-after-5-min/267012 "2021-03-12T10:06:06Z")
Well, the title says it all, I have logstash container deployed in ECS, with a hard memory limit if 1.5GB, pipeline config is already tested locally so I'm fairly sure that's not the problem. I'm sending container logs … --- ## [Increase the precision\_threshold in TSVB](https://discuss.elastic.co/t/increase-the-precision-threshold-in-tsvb/267070)
**Author:** [@zevodku](https://discuss.elastic.co/u/zevodku)\ **Replies:** 1\ **Last updated:** [March 12, 2021, 9:53am UTC](https://discuss.elastic.co/t/increase-the-precision-threshold-in-tsvb/267070 "2021-03-12T09:53:18Z")
Hi, I cannot find a way to increase the precision\_threshold in TSVB when using cardinality agg. How can I do that ? Thanks --- ## [PUT mappings API overriding the exsisting mappings](https://discuss.elastic.co/t/put-mappings-api-overriding-the-exsisting-mappings/267055)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 8:23am UTC](https://discuss.elastic.co/t/put-mappings-api-overriding-the-exsisting-mappings/267055 "2021-03-12T08:23:06Z")
Hello, I have created an index template, where I am defining an "ignore\_above" mapping parameter for a "keyword" field type. Now I want to update the mappings and want to add a new parameter "eager\_global\_ordinals" for… --- ## [Logstash Filter](https://discuss.elastic.co/t/logstash-filter/266182)
**Author:** [@Anu6006](https://discuss.elastic.co/u/Anu6006)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:21am UTC](https://discuss.elastic.co/t/logstash-filter/266182 "2021-03-12T08:21:31Z")
Hi Team, I'm trying to get NSG Flow logs through Azure Blob Storage (logstash-input-azureblob (0.9.12)). But the filtering part is not working properly and showing the errors \_jsonparsefailure, \_split\_type\_failure, \_da… --- ## [Check whether a field has mapping store=true](https://discuss.elastic.co/t/check-whether-a-field-has-mapping-store-true/264792)
**Author:** [@Nishikant\_Tayade](https://discuss.elastic.co/u/Nishikant_Tayade)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:15am UTC](https://discuss.elastic.co/t/check-whether-a-field-has-mapping-store-true/264792 "2021-03-12T08:15:42Z")
I am trying out the following use case: I want only the fields from index template, or index mapping, for which mapping property store=true, though I can get the mapping and parse it and check for the criteria or can u… --- ## [Unable to index data as casesensitive using jdbc input in logstash](https://discuss.elastic.co/t/unable-to-index-data-as-casesensitive-using-jdbc-input-in-logstash/266820)
**Author:** [@Sammeta\_David\_Raju](https://discuss.elastic.co/u/Sammeta_David_Raju)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 8:10am UTC](https://discuss.elastic.co/t/unable-to-index-data-as-casesensitive-using-jdbc-input-in-logstash/266820 "2021-03-12T08:10:51Z")
\`Unable to index data as case-sensitive using jdbc input in logstash\` even after using lowercase\_column\_names =\> false --- ## [Ilm index not migrating](https://discuss.elastic.co/t/ilm-index-not-migrating/267039)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 6:24am UTC](https://discuss.elastic.co/t/ilm-index-not-migrating/267039 "2021-03-12T06:24:32Z")
Hi, i have a index eligible to move to w"message": "\[ryvscale54\_raw\_session\_20210306\] lifecycle abc\_20210306": { "index": "abc\_20210306", "managed": true, "policy": "ilm-uniq-com", "lifecycle\_date\_millis": 161499459084… --- ## [Load is not distributed evenly between cpus](https://discuss.elastic.co/t/load-is-not-distributed-evenly-between-cpus/267040)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [March 12, 2021, 6:29am UTC](https://discuss.elastic.co/t/load-is-not-distributed-evenly-between-cpus/267040 "2021-03-12T06:29:17Z")
We're operating an Elastic Stack on kubernetes on a single host(Centos 7). The host has 2x Intel E5-2640 v4 @ 2.40GHz. The processes are supposedly working with all cores but the load is mainly on the first cpu. Most of … --- ## [How to test EUI changes in Kibana(7.10.x) during development?](https://discuss.elastic.co/t/how-to-test-eui-changes-in-kibana-7-10-x-during-development/266114)
**Author:** [@hardik.rapidops](https://discuss.elastic.co/u/hardik.rapidops)\ **Replies:** 6\ **Last updated:** [March 12, 2021, 6:18am UTC](https://discuss.elastic.co/t/how-to-test-eui-changes-in-kibana-7-10-x-during-development/266114 "2021-03-12T06:18:36Z")
I want to integrate eui with my local kibana, Is there any way to integrate eui with link e.g @elastic/eui": "link:\ in package.json in kibana 7.10.x version ? I have tried it. It's not working. Can anyon… --- ## [Kibana Plugin Link](https://discuss.elastic.co/t/kibana-plugin-link/266884)
**Author:** [@hayzjd836](https://discuss.elastic.co/u/hayzjd836)\ **Replies:** 2\ **Last updated:** [March 12, 2021, 5:45am UTC](https://discuss.elastic.co/t/kibana-plugin-link/266884 "2021-03-12T05:45:42Z")
Hello I'm trying to get access to my own dashboard from the sidebar. For example, if there's a "my\_dashboard" in the sidebar and you click on it, you can go to the "app/dashboard/...". So I created the plug-in accordi… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1015) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1017)