# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1142 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1143 --- ## [TSVB 차트를 Elasticsearch Query 구문으로 만들기](https://discuss.elastic.co/t/tsvb-elasticsearch-query/256345)
**Author:** [@HyungHo\_Ko](https://discuss.elastic.co/u/HyungHo_Ko)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 10:52am UTC](https://discuss.elastic.co/t/tsvb-elasticsearch-query/256345 "2020-11-23T10:52:25Z")
TSVB 차트를 이용하여 Disk Read 데이터를 차트화하였습니다. 동일한 데이터를 Elasticsearch JSON Query로 작성하려고 합니다. Host 별 결과를 얻고자 작성 중인 코드입니다. 에러는 없지만, 결과를 얻을 수 없는 상태입니다. 어떻게 작성해야할까요? { "size": 0, "query": { "bool": { … --- ## [Give privilege to a user to create index pattern](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 10:44am UTC](https://discuss.elastic.co/t/give-privilege-to-a-user-to-create-index-pattern/256143 "2020-11-23T10:44:04Z")
Hello, How can I give privilege to a user to create index patterns but not having the right to create indices? When I use "manage" privilege then the user has access everywhere. Thank you in advance! /Angelos --- ## [Azure NSG Integration help](https://discuss.elastic.co/t/azure-nsg-integration-help/256342)
**Author:** [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 10:19am UTC](https://discuss.elastic.co/t/azure-nsg-integration-help/256342 "2020-11-23T10:19:45Z")
Hi, I am trying to integrate Azure NSG Logs into Elastic, I have done 80% but there is 1 field is proving a little difficult for me and it has all the important flow information. Each log event contaains 5 flows inform… --- ## [Point Kibana to a Subdomain](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 10:14am UTC](https://discuss.elastic.co/t/point-kibana-to-a-subdomain/256259 "2020-11-23T10:14:39Z")
I am struggling with pointing Kibana to a subdomain. My domain is hosted on cloudflare and I am trying to point Kibana URL to a subdomain. Do I required to make any changes internally on Elasticsearch or Kibana instance… --- ## [Kibana index pattern, matching index, how to match more than 100](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296)
**Author:** [@yt\_h](https://discuss.elastic.co/u/yt_h)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 10:02am UTC](https://discuss.elastic.co/t/kibana-index-pattern-matching-index-how-to-match-more-than-100/256296 "2020-11-23T10:02:49Z")
elasticsearch version: 7.5.1 kibana version: 7.5.1 I have more than 300 indexes. How to use one index pattern to match all of them? When I enter the "pro" index pattern, it shows that 100 indexes are matched, but 300 i… --- ## [How to shutdown logstash when jdbc or es connection failed?](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333)
**Author:** [@zhangyunkun](https://discuss.elastic.co/u/zhangyunkun)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 9:46am UTC](https://discuss.elastic.co/t/how-to-shutdown-logstash-when-jdbc-or-es-connection-failed/256333 "2020-11-23T09:46:01Z")
I found that logstash won't shutdown when jdbc or es connection failed。 It troubles me because I'll never find this mistake unless I take the initiative to see it。 And i tried configue the jdbc plugin setting 'co… --- ## [Need to remove two Node out of three node Elasticsearch clusters](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101)
**Author:** [@SumanUk](https://discuss.elastic.co/u/SumanUk)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 9:13am UTC](https://discuss.elastic.co/t/need-to-remove-two-node-out-of-three-node-elasticsearch-clusters/256101 "2020-11-23T09:13:33Z")
Hi Team, Need guidelines for how to remove two Nodes out of three Node in Elastic Cluster without data loss we have install Elasticsearch in single node but it has connected three node which is early install still it's… --- ## [Aggregate filter plugin](https://discuss.elastic.co/t/aggregate-filter-plugin/255729)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [November 23, 2020, 9:09am UTC](https://discuss.elastic.co/t/aggregate-filter-plugin/255729 "2020-11-23T09:09:25Z")
Hi, i create my aggregate filter plugin but it doesn't start with this error : \[ERROR\]\[logstash.filters.aggregate\] Missing a required setting for the aggregate filter plugin: filter { aggregate { code =\> # SETTING MI… --- ## [Export/Import Saved objects](https://discuss.elastic.co/t/export-import-saved-objects/256148)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 8:36am UTC](https://discuss.elastic.co/t/export-import-saved-objects/256148 "2020-11-23T08:36:27Z")
Hi all. I have 2 elastic installed. one is 7.7 and the second one is 7.8. Trying to export/import saved objects and specifically Visualizations but I got errors as per below when I do export Your file is downloading … --- ## [Sending New Relic Logs to ELK](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311)
**Author:** [@Edwin.v](https://discuss.elastic.co/u/Edwin.v)\ **Replies:** 0\ **Last updated:** [November 23, 2020, 7:10am UTC](https://discuss.elastic.co/t/sending-new-relic-logs-to-elk/256311 "2020-11-23T07:10:13Z")
Hello Everyone, I would like to know if there is a way I can send new relic logs to ELK stack. Any documentation will be really helpful. Thanks. --- ## [Can we store two Elastic search indices in different data directory](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221)
**Author:** [@Vivek\_Sagar](https://discuss.elastic.co/u/Vivek_Sagar)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 6:20am UTC](https://discuss.elastic.co/t/can-we-store-two-elastic-search-indices-in-different-data-directory/256221 "2020-11-23T06:20:06Z")
Can we have multiple indices in different data paths in elastic search? In my application, I want to separate index to keep sensitive data in dm-crypted volume and others on non encrypted volume. So separate indices for … --- ## [Kibana NoShardsAvailable Exception](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080)
**Author:** [@tamilarasanbravo](https://discuss.elastic.co/u/tamilarasanbravo)\ **Replies:** 2\ **Last updated:** [November 23, 2020, 6:13am UTC](https://discuss.elastic.co/t/kibana-noshardsavailable-exception/256080 "2020-11-23T06:13:07Z")
Hi Team, I have been using Kibana to visualize and the last few days it is throwing error :NoShardsAvailableException, please find the snap below. Note : Ignore the index name Please note that I ran few queries to u… --- ## [Page not Found /management/kibana/settings](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255)
**Author:** [@zbioe](https://discuss.elastic.co/u/zbioe)\ **Replies:** 4\ **Last updated:** [November 23, 2020, 4:01am UTC](https://discuss.elastic.co/t/page-not-found-management-kibana-settings/256255 "2020-11-23T04:01:30Z")
When i go to Visualize in elasticsearch, i see this message. When i click in the link, who sees like: https://kibana.example.com.com/app/visualize#/management/kibana/settings I go to this error page Someone can h… --- ## [Filebeat Office 365 Failed getting a token](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:58am UTC](https://discuss.elastic.co/t/filebeat-office-365-failed-getting-a-token/256264 "2020-11-23T00:58:53Z")
Hello, Configured the Filebet o365 module. Everything worked fine for some time, but last night things stopped working. The last event sent was: When I restart Filebeat, things start working again. Anyone an idea wh… --- ## [Index Lifecycle Policies vs Rollup Jobs](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [November 23, 2020, 12:14am UTC](https://discuss.elastic.co/t/index-lifecycle-policies-vs-rollup-jobs/256290 "2020-11-23T00:14:28Z")
Hello, Can someone explain the main differences between Index Lifecycle Policies vs Rollup Jobs? Thank you! --- ## [Kibana add wrong duplicate values](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 11:55pm UTC](https://discuss.elastic.co/t/kibana-add-wrong-duplicate-values/256256 "2020-11-22T23:55:27Z")
Hi, This is a sample from discovery section in kibana. It happens only some times that values are duplicate. The exact log in Grok Debugger looks fine. Whys this is happening? I've added this line to logstash but not… --- ## [Kibana Dev Tools: can the commands in console be saved?](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263)
**Author:** [@smlbiobot](https://discuss.elastic.co/u/smlbiobot)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 10:59pm UTC](https://discuss.elastic.co/t/kibana-dev-tools-can-the-commands-in-console-be-saved/256263 "2020-11-22T22:59:39Z")
Right now, the commands in the Kibana Dev Tools console appears to be tied to the browser. If you change computers or use a different browser session, it is gone completely. It is probably implemented this way because t… --- ## [Group\_concat aggragation](https://discuss.elastic.co/t/group-concat-aggragation/256285)
**Author:** [@chupacabra](https://discuss.elastic.co/u/chupacabra)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 9:15pm UTC](https://discuss.elastic.co/t/group-concat-aggragation/256285 "2020-11-22T21:15:40Z")
Hello everybody. I am new to elasticsearch and I would like to create a group\_concat aggregation. But I don't know how. Can someone help me please. The example data: POST /example\_measures/\_bulk {"index":{"\_id"… --- ## [Set custom @timestamp from fields not working](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [November 22, 2020, 5:31pm UTC](https://discuss.elastic.co/t/set-custom-timestamp-from-fields-not-working/256262 "2020-11-22T17:31:48Z")
Hello all, i need help setting @timestamp from fields, why date plugin is not parsing my custom fill\_date correctly? mutate { add\_field =\> { "fill\_date" =\> "%{FillDate} %{FillTime}" } } date { timezone =\> "UCT… --- ## [Перестал работать мониторинг кластера](https://discuss.elastic.co/t/topic/255451)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 9\ **Last updated:** [November 22, 2020, 4:21pm UTC](https://discuss.elastic.co/t/topic/255451 "2020-11-22T16:21:53Z")
Добрый день. Несколько дней назад заметил что в кластере перестали отображаться данные. Появляется стандартное окно При попытке включить self monitoring говорит что данных нет При этом индексы существуют Я уже … --- ## [Got response code '400' contacting Elasticsearch](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 2:35pm UTC](https://discuss.elastic.co/t/got-response-code-400-contacting-elasticsearch/256276 "2020-11-22T14:35:08Z")
Using local instance of Logstash 7.10. with output to Cloud services made an horror hours to me as it is 'pretty bad not telling a thing' issue, however: If your Logstash starts properly and connects to a cloud; If you… --- ## [Elasticsearch 7.9.3 upgrade - GC issues](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257)
**Author:** [@Lior\_Yakobov](https://discuss.elastic.co/u/Lior_Yakobov)\ **Replies:** 3\ **Last updated:** [November 22, 2020, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-3-upgrade-gc-issues/256257 "2020-11-22T14:34:02Z")
Hello, I have started the upgrade process to Elasticsearch-7.9.3 and I see that although I was using CMS GC before, and G1GC configurations are commented out, the instance starts and logs indicates that G1GC is used. W… --- ## [How to get a scripted field value as metric in heatmap](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707)
**Author:** [@preeti1211](https://discuss.elastic.co/u/preeti1211)\ **Replies:** 4\ **Last updated:** [November 22, 2020, 12:21pm UTC](https://discuss.elastic.co/t/how-to-get-a-scripted-field-value-as-metric-in-heatmap/255707 "2020-11-22T12:21:20Z")
My scenario - On heatmap, I want y axis to be defined in three rows, one for each environment(dev,test,val) and x axis should correspond to latest 10 builds for each environment. Each cell in a heatmap represents a uni… --- ## [Dynamic color changing text box based on Pipeline Build Status](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443)
**Author:** [@sachin1112](https://discuss.elastic.co/u/sachin1112)\ **Replies:** 22\ **Last updated:** [November 22, 2020, 12:20pm UTC](https://discuss.elastic.co/t/dynamic-color-changing-text-box-based-on-pipeline-build-status/254443 "2020-11-22T12:20:20Z")
Hello , I am trying to create a textbox whose background color will change based on the status of the latest build. I need this visualization on Dashboard rather than on canvas. Thanks, Sachin --- ## [Elastic Stack 7.9.3 on Raspberry Pi 4](https://discuss.elastic.co/t/elastic-stack-7-9-3-on-raspberry-pi-4/254450)
**Author:** [@jamesgarside](https://discuss.elastic.co/u/jamesgarside)\ **Replies:** 2\ **Last updated:** [November 22, 2020, 11:41am UTC](https://discuss.elastic.co/t/elastic-stack-7-9-3-on-raspberry-pi-4/254450 "2020-11-22T11:41:14Z")
Hello all, I have just successfully deployed the Elastic Stack to a Raspberry Pi 4 Ubuntu20.04 environment. Obviously Elasticsearch is supported so that was a breeze, the tricky part was Kibana as it doesn't have an of… --- ## [Enrich SIEM Data](https://discuss.elastic.co/t/enrich-siem-data/255749)
**Author:** [@austinsonger](https://discuss.elastic.co/u/austinsonger)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 8:10am UTC](https://discuss.elastic.co/t/enrich-siem-data/255749 "2020-11-22T08:10:55Z")
How to enrich SIEM data with Threat Intelligence? SIEM data can be overwhelming, how to implement Threat Intelligence feed like OTX Alienvault or other Intel feeds? --- ## [Logstash S3 Input Error](https://discuss.elastic.co/t/logstash-s3-input-error/256250)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 1\ **Last updated:** [November 22, 2020, 7:22am UTC](https://discuss.elastic.co/t/logstash-s3-input-error/256250 "2020-11-22T07:22:39Z")
Hi All, I am getting this error while running logstash with S3 input plugin. Is there anything wrong with my config. include\_object\_properties=\>false\> Error: Net::OpenTimeout Exception: Seahorse::Client::Networkin… --- ## [How to use S3 Input Plugin with assume role\_arn](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 0\ **Last updated:** [November 22, 2020, 1:52am UTC](https://discuss.elastic.co/t/how-to-use-s3-input-plugin-with-assume-role-arn/256248 "2020-11-22T01:52:08Z")
Hi, I am trying to find a way to use the S3 input plugin to ingest AWS Cloudtrail data. I have the config working but the way I am doing doesn't seem to be streamlined. So this is how I am able to make it work till now. … --- ## [Add parameter "include\_type\_name":true in index settings block](https://discuss.elastic.co/t/add-parameter-include-type-name-true-in-index-settings-block/256078)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 1\ **Last updated:** [November 20, 2020, 6:52pm UTC](https://discuss.elastic.co/t/add-parameter-include-type-name-true-in-index-settings-block/256078 "2020-11-20T18:52:07Z")
In ES version 7.9.3, the include\_type\_name is defaulted to false, need to make it true, Need to pass include\_type\_name=true in request URL Is there is another way without passing in the request url --- ## [Elasticsearch: "high" CPU usage every 6 minutes for one minute](https://discuss.elastic.co/t/elasticsearch-high-cpu-usage-every-6-minutes-for-one-minute/256235)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 2\ **Last updated:** [November 21, 2020, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-usage-every-6-minutes-for-one-minute/256235 "2020-11-21T20:03:43Z")
Hi, I'm running ELK Stack 7.10.0 (elasticsearch, filebeat, kibana, logstash) on the same server. And since two days elasticsearch is doing something every 6 minutes for one minute. The CPU usage is not high, but it's li… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1141) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1143)