# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1035 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1036 --- ## [Logstash extract a nested json object](https://discuss.elastic.co/t/logstash-extract-a-nested-json-object/265307)
**Author:** [@imsystem](https://discuss.elastic.co/u/imsystem)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 5:51pm UTC](https://discuss.elastic.co/t/logstash-extract-a-nested-json-object/265307 "2021-02-24T17:51:13Z")
Hello! I have input json: { "fields":{ "created\_date":1614158456696703782, "value":"\\u001B\[35m-\\u001B\[0m | \\u001B\[32m2021-02-20T12:48:10.367337+0300\\u001B\[0m | \\u001B\[1mINFO \\u001B\[0m | application.ap… --- ## [Change service type on deployed elasticsearch using helm](https://discuss.elastic.co/t/change-service-type-on-deployed-elasticsearch-using-helm/265384)
**Author:** [@Owen\_P](https://discuss.elastic.co/u/Owen_P)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 5:40pm UTC](https://discuss.elastic.co/t/change-service-type-on-deployed-elasticsearch-using-helm/265384 "2021-02-24T17:40:00Z")
Hi I'm new to this so bear with me. I deployed the elasticsearch helm chart from here https://github.com/elastic/helm-charts/tree/master/elasticsearch but the default service type is ClusterIP but I want to change it to… --- ## [ESSERVER trying to search for xpack plugin class even after disabling xpack security in elasticsearch.yml file](https://discuss.elastic.co/t/esserver-trying-to-search-for-xpack-plugin-class-even-after-disabling-xpack-security-in-elasticsearch-yml-file/265382)
**Author:** [@karthik\_m2](https://discuss.elastic.co/u/karthik_m2)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:35pm UTC](https://discuss.elastic.co/t/esserver-trying-to-search-for-xpack-plugin-class-even-after-disabling-xpack-security-in-elasticsearch-yml-file/265382 "2021-02-24T17:35:41Z")
Hello Everyone, I have an issue with my elastic search server, Even though xpack security is not enabled, elasticsearch JVM is trying load them and throwing error and not allowing to start this server. This below value… --- ## [Explore underlying data require Write permissions to Dashboard](https://discuss.elastic.co/t/explore-underlying-data-require-write-permissions-to-dashboard/264326)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 4\ **Last updated:** [February 24, 2021, 5:35pm UTC](https://discuss.elastic.co/t/explore-underlying-data-require-write-permissions-to-dashboard/264326 "2021-02-24T17:35:10Z")
Hi, Please see this: https://github.com/elastic/kibana/issues/83279. I have also noticed that just now. Is this really a bug? if not, can you please provide guidance how to troubleshoot? Thanks. --- ## [How to disable Kibana Overview page](https://discuss.elastic.co/t/how-to-disable-kibana-overview-page/265371)
**Author:** [@ewolfman](https://discuss.elastic.co/u/ewolfman)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 5:33pm UTC](https://discuss.elastic.co/t/how-to-disable-kibana-overview-page/265371 "2021-02-24T17:33:38Z")
Hi, Is there a way to disable Kibana Overview page? If so, can it be done per Kibana Space? Thanks. --- ## [Elastic agent showing unhealthy with windows system](https://discuss.elastic.co/t/elastic-agent-showing-unhealthy-with-windows-system/265341)
**Author:** [@jaykansagara](https://discuss.elastic.co/u/jaykansagara)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 5:29pm UTC](https://discuss.elastic.co/t/elastic-agent-showing-unhealthy-with-windows-system/265341 "2021-02-24T17:29:14Z")
hi, I have install Elastic Agent 7.11.1 on windows server 2012 and enroll it with Fleet. Agent policy has 2 different integration as bellow: System Endpoint security Elastic agent write the logs in windows server as… --- ## [Forming query with extra quotation marks](https://discuss.elastic.co/t/forming-query-with-extra-quotation-marks/264991)
**Author:** [@Shahsha\_21](https://discuss.elastic.co/u/Shahsha_21)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 5:13pm UTC](https://discuss.elastic.co/t/forming-query-with-extra-quotation-marks/264991 "2021-02-24T17:13:13Z")
I am trying to mimic Kibana's search query via Elasticsearch's query string. For e.g. in Kibana I can search like this with the quotation marks: "ABC" AND "CDE" When I try to create this query string it throws a syntax… --- ## [Finding documents that have a specific number of values](https://discuss.elastic.co/t/finding-documents-that-have-a-specific-number-of-values/265380)
**Author:** [@Kevin\_Bourne](https://discuss.elastic.co/u/Kevin_Bourne)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 5:12pm UTC](https://discuss.elastic.co/t/finding-documents-that-have-a-specific-number-of-values/265380 "2021-02-24T17:12:17Z")
Let's say I have a mapping like this where there is a nested field within another nested field: "myIndex": { "properties": { "id": { "type": "keyword" }, "stuff": { "t… --- ## [How to trigger a webhook with KQL?](https://discuss.elastic.co/t/how-to-trigger-a-webhook-with-kql/264717)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [February 24, 2021, 4:29pm UTC](https://discuss.elastic.co/t/how-to-trigger-a-webhook-with-kql/264717 "2021-02-24T16:29:55Z")
Dear all =) I would like to create an alert that triggers a webhook each time host:10.10.10.10 is found in the log stream example\_test. When I click on " Stack Management" and then "Create Alert" I get presented with t… --- ## [Logstash error - Failed to decode CEF payload. Generating failure event with payload in message field](https://discuss.elastic.co/t/logstash-error-failed-to-decode-cef-payload-generating-failure-event-with-payload-in-message-field/265365)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 4:38pm UTC](https://discuss.elastic.co/t/logstash-error-failed-to-decode-cef-payload-generating-failure-event-with-payload-in-message-field/265365 "2021-02-24T16:38:36Z")
I configued the syslog.conf file to get the traffic to elasticsearch(installed in same server). Syslog data traffic is coming as CEF format to logstash. syslog.conf file as bellow: input { tcp { port =\> 5514 type =\>… --- ## [What is the ElasticMachine GitHub Bot?](https://discuss.elastic.co/t/what-is-the-elasticmachine-github-bot/265098)
**Author:** [@alex-treebeard](https://discuss.elastic.co/u/alex-treebeard)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 4:16pm UTC](https://discuss.elastic.co/t/what-is-the-elasticmachine-github-bot/265098 "2021-02-24T16:16:12Z")
Hey folks, I've been researching tools for monitoring flaky tests and noticed some pretty neat activity with elasticmachine. By the looks of it this bot does a ton of operational work for elastic.co, and is closed sour… --- ## [UTC vs EST log events in Kibana](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921)
**Author:** [@Yuri\_Sibirski](https://discuss.elastic.co/u/Yuri_Sibirski)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 4:09pm UTC](https://discuss.elastic.co/t/utc-vs-est-log-events-in-kibana/264921 "2021-02-24T16:09:45Z")
Hi there. I was not able to find a solution for my problem that is why I am creating this post. My problem is that we are sending logs to elasticsearch from linux nodes using either UTC or EST as their timezones. For EST… --- ## [Convert string in strict\_date\_time (yyyy-MM-dd'T'HH:mm:ss.SSSZZ) to @timestamp](https://discuss.elastic.co/t/convert-string-in-strict-date-time-yyyy-mm-ddthhss-ssszz-to-timestamp/265150)
**Author:** [@manulearns](https://discuss.elastic.co/u/manulearns)\ **Replies:** 10\ **Last updated:** [February 24, 2021, 4:02pm UTC](https://discuss.elastic.co/t/convert-string-in-strict-date-time-yyyy-mm-ddthhss-ssszz-to-timestamp/265150 "2021-02-24T16:02:12Z")
Hi, I'am trying to convert a string in strict\_date\_time format 2021-02-19T23:02:57.277+05:30 to @timestamp. date { match =\> \[ "timeStampString" , "yyyy-MM-dd'T'HH:mm:ss.SSSZZ" \] target =\> "logTimestamp3" } Throwin… --- ## [Deduce filters from search string](https://discuss.elastic.co/t/deduce-filters-from-search-string/265353)
**Author:** [@Christian87](https://discuss.elastic.co/u/Christian87)\ **Replies:** 4\ **Last updated:** [February 24, 2021, 3:15pm UTC](https://discuss.elastic.co/t/deduce-filters-from-search-string/265353 "2021-02-24T15:15:40Z")
Hi, let's say I store a catalogue of household appliances in Elasticsearch. Documents in my index can represent dish washers, washing machines, freezers and similar devices. Dish washers have a text field "type" which … --- ## [Remote Elasticsearch Cluster monitoring through Metricbeat not disabling metricset](https://discuss.elastic.co/t/remote-elasticsearch-cluster-monitoring-through-metricbeat-not-disabling-metricset/264964)
**Author:** [@silversonic](https://discuss.elastic.co/u/silversonic)\ **Replies:** 0\ **Last updated:** [February 20, 2021, 11:31pm UTC](https://discuss.elastic.co/t/remote-elasticsearch-cluster-monitoring-through-metricbeat-not-disabling-metricset/264964 "2021-02-20T23:31:11Z")
Hello, Scratching my head on this one. I'm setting up remote elasticsearch monitoring for a production cluster and sending metrics to a second elasticsearch cluster to handle observing the production cluster. Everythi… --- ## [Let Logstash handle multi-pipeline performance?](https://discuss.elastic.co/t/let-logstash-handle-multi-pipeline-performance/265177)
**Author:** [@nico127](https://discuss.elastic.co/u/nico127)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 3:08pm UTC](https://discuss.elastic.co/t/let-logstash-handle-multi-pipeline-performance/265177 "2021-02-24T15:08:00Z")
In the case of multi-pipeline, I understand that the canonical way to handle performance is to manually configure each pipeline, e.g. to use N pipeline workers, or to have a batch size of M. is it possible to let Logsta… --- ## [Difference between top hit and max in kibana visualization aggregation](https://discuss.elastic.co/t/difference-between-top-hit-and-max-in-kibana-visualization-aggregation/265309)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 3:00pm UTC](https://discuss.elastic.co/t/difference-between-top-hit-and-max-in-kibana-visualization-aggregation/265309 "2021-02-24T15:00:04Z")
Hi all, I am trying to find the difference between top hit aggregation and max aggregation in kibana. They both are supposed to give maximum value of a group. I went through threads, but could not find anything relate… --- ## [Two indexes how to filter with different name fields](https://discuss.elastic.co/t/two-indexes-how-to-filter-with-different-name-fields/265095)
**Author:** [@Lorenzo\_Allori](https://discuss.elastic.co/u/Lorenzo_Allori)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 8:27am UTC](https://discuss.elastic.co/t/two-indexes-how-to-filter-with-different-name-fields/265095 "2021-02-24T08:27:33Z")
Hi there! I have two different indexes that have different fields name which are actually the same thing: For example: Index 1 has: IPV4\_SRC\_ADDR : "75.72.214.200" Index 2 has: source.addr: "75.72.214.200" I cannot … --- ## [\[Bug\] Enterprise Search dashboard url pending](https://discuss.elastic.co/t/bug-enterprise-search-dashboard-url-pending/265281)
**Author:** [@s97712](https://discuss.elastic.co/u/s97712)\ **Replies:** 6\ **Last updated:** [February 24, 2021, 2:43pm UTC](https://discuss.elastic.co/t/bug-enterprise-search-dashboard-url-pending/265281 "2021-02-24T14:43:22Z")
same as https://discuss.elastic.co/t/bug-app-search-dashboard-fails-to-load-after-restarting-the-server/206237 \[2021-02-24T06:47:17.713+00:00\]\[1602\]\[2522\]\[app-server\]\[INFO\]: \[ca4b3fd5-d181-4c13-86ea-cebced39a3b5\] S… --- ## [Logstash configuration | Elimination of if loops in checking values at nested JSON keys](https://discuss.elastic.co/t/logstash-configuration-elimination-of-if-loops-in-checking-values-at-nested-json-keys/265139)
**Author:** [@pkrahul236](https://discuss.elastic.co/u/pkrahul236)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 2:38pm UTC](https://discuss.elastic.co/t/logstash-configuration-elimination-of-if-loops-in-checking-values-at-nested-json-keys/265139 "2021-02-24T14:38:29Z")
Hello Community Users, I am seeking help regarding writing a better logstash configuration file. I am dealing with nested array JSON which looks something like this. { "data": { "content": { "payload": \[ … --- ## [Change format of labels in a visualization X axis chart](https://discuss.elastic.co/t/change-format-of-labels-in-a-visualization-x-axis-chart/265131)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 3\ **Last updated:** [February 24, 2021, 2:37pm UTC](https://discuss.elastic.co/t/change-format-of-labels-in-a-visualization-x-axis-chart/265131 "2021-02-24T14:37:59Z")
Hello, I'd like to know if it is possible to change the format of the labels at the chart axis in visualizations. An image with an example is attached. --- ## [Legend Color](https://discuss.elastic.co/t/legend-color/265310)
**Author:** [@NourBM](https://discuss.elastic.co/u/NourBM)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 2:35pm UTC](https://discuss.elastic.co/t/legend-color/265310 "2021-02-24T14:35:21Z")
Hi , Is there any way where i can make the color for up= Green and down= RED, instead of default colors provided by Kibana as shown below. and also when you click on down area then Graph shows GREEN which should be RED f… --- ## [How to automatically stop logstash process instance after its read the doc](https://discuss.elastic.co/t/how-to-automatically-stop-logstash-process-instance-after-its-read-the-doc/265343)
**Author:** [@rknd](https://discuss.elastic.co/u/rknd)\ **Replies:** 1\ **Last updated:** [February 24, 2021, 2:33pm UTC](https://discuss.elastic.co/t/how-to-automatically-stop-logstash-process-instance-after-its-read-the-doc/265343 "2021-02-24T14:33:47Z")
I want to ask that, below is my code. With the below code logstash reads the file until its end. Then it is stops reading but process is still alive. I want that process stops when it finishes the reading. How can i do t… --- ## [Setting index.mapper.dynamic was removed after version 6.0.0](https://discuss.elastic.co/t/setting-index-mapper-dynamic-was-removed-after-version-6-0-0/265356)
**Author:** [@jmaitrehenry](https://discuss.elastic.co/u/jmaitrehenry)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 2:15pm UTC](https://discuss.elastic.co/t/setting-index-mapper-dynamic-was-removed-after-version-6-0-0/265356 "2021-02-24T14:15:57Z")
Hi, I have a trouble after trying to update an index mapping with ES 7.4 and 7.9: PUT /myindex/\_mapping { "properties": { "doc": { "properties": { "transaction": { "properties": { … --- ## [Kibana RAM allocation](https://discuss.elastic.co/t/kibana-ram-allocation/265286)
**Author:** [@Farid\_N](https://discuss.elastic.co/u/Farid_N)\ **Replies:** 8\ **Last updated:** [February 24, 2021, 2:05pm UTC](https://discuss.elastic.co/t/kibana-ram-allocation/265286 "2021-02-24T14:05:19Z")
Hi there Despite of 8G RAM, my Kibana uses only 1G of RAM... How can I allocate more RAM to Kibana? What should I write in kibana.yml to determine more RAM for Kibana? --- ## [Kibana SAML iframe request canceled and redirect to the kibana page](https://discuss.elastic.co/t/kibana-saml-iframe-request-canceled-and-redirect-to-the-kibana-page/265315)
**Author:** [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 2:03pm UTC](https://discuss.elastic.co/t/kibana-saml-iframe-request-canceled-and-redirect-to-the-kibana-page/265315 "2021-02-24T14:03:16Z")
Hi, I have an issue with a Kibana(v6.8) SAML integration with Oracle OAM stack. Kibana dashboards and visualizations are used as an iframe in another application. Now when I login also via SAML in that application I s… --- ## [Index Dimensioning and Optimization (across the Cluster)](https://discuss.elastic.co/t/index-dimensioning-and-optimization-across-the-cluster/265041)
**Author:** [@wissam](https://discuss.elastic.co/u/wissam)\ **Replies:** 5\ **Last updated:** [February 24, 2021, 2:00pm UTC](https://discuss.elastic.co/t/index-dimensioning-and-optimization-across-the-cluster/265041 "2021-02-24T14:00:12Z")
Hello, We have an Elasticsearch (v7.5.3) cluster with 4 nodes (each is a VM with 16 CPUs, 32 GB of RAM and JVM heap size of 16GB) and all configured as data nodes. Our main index has around 110M records (~70 GB) that w… --- ## [Cannot connect to the Elasticsearch cluster](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/265348)
**Author:** [@Jeremy\_Colmenarez](https://discuss.elastic.co/u/Jeremy_Colmenarez)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:57pm UTC](https://discuss.elastic.co/t/cannot-connect-to-the-elasticsearch-cluster/265348 "2021-02-24T13:57:12Z")
Hi everyone, im new at Elastic and i have this problem, when i open web appear this message: im loged in the linux but i dont find in which path is located the logs path required so i can start to make the troubleshoo… --- ## [Elastic security fields data not showing in Timeline](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 2\ **Last updated:** [February 24, 2021, 1:40pm UTC](https://discuss.elastic.co/t/elastic-security-fields-data-not-showing-in-timeline/264235 "2021-02-24T13:40:55Z")
Hi Team, We are not able to see proper data in timeline of elastic security module. issue 1: Summary not showing the correct data of detection rule Issue 2: Some field values are not showing in the timeline window… --- ## [Difference between snowball stemmer and regular stemmer](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346)
**Author:** [@tomsquest](https://discuss.elastic.co/u/tomsquest)\ **Replies:** 0\ **Last updated:** [February 24, 2021, 1:35pm UTC](https://discuss.elastic.co/t/difference-between-snowball-stemmer-and-regular-stemmer/265346 "2021-02-24T13:35:28Z")
Hi, Elasticsearch (and Lucene ?) has two stemmer token filters: the snowball one and the regular one. It seems in my tests that the regular stemmer is under the hood the snowball stemmer. It this really the case ? Fo… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1034) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1036)