# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1156 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1157 --- ## [Setting custom index for two data sources in filebeat 7.x](https://discuss.elastic.co/t/setting-custom-index-for-two-data-sources-in-filebeat-7-x/254400)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 5:33pm UTC](https://discuss.elastic.co/t/setting-custom-index-for-two-data-sources-in-filebeat-7-x/254400 "2020-11-11T17:33:57Z")
I am trying to add two index types based on the different log sources in filebeat 7.6.2, i have managed to get custom name running for one of the source however cant seem to find how this can be done for different data s… --- ## [Disabling kibana home](https://discuss.elastic.co/t/disabling-kibana-home/254804)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 5:18pm UTC](https://discuss.elastic.co/t/disabling-kibana-home/254804 "2020-11-11T17:18:11Z")
Hi, Ive created dedicated spaces for users and so far it seems to contain them fine. However, when they click on the Kibana Home button it takes them out of their restricted area and into an area that allows them to sta… --- ## [Kibana audit logs on search term and filters etc](https://discuss.elastic.co/t/kibana-audit-logs-on-search-term-and-filters-etc/254666)
**Author:** [@xdzhou](https://discuss.elastic.co/u/xdzhou)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 5:04pm UTC](https://discuss.elastic.co/t/kibana-audit-logs-on-search-term-and-filters-etc/254666 "2020-11-11T17:04:46Z")
I am wondering is it possible to track user activity of how they are using kibana, not just the security features like logging and logoff, but more of which dashboard they are accessing and more importantly, the filter a… --- ## [Comparison against business units](https://discuss.elastic.co/t/comparison-against-business-units/254945)
**Author:** [@d-ring](https://discuss.elastic.co/u/d-ring)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 4:47pm UTC](https://discuss.elastic.co/t/comparison-against-business-units/254945 "2020-11-11T16:47:04Z")
Good Morning Kibana Wizards, I am trying to build a dashboard that will compare business units of differing sizes equally. As an example users taking security training. HR has 120 users, 100 of which has completed trai… --- ## [Heatmap respect X or Y axis metric, not both](https://discuss.elastic.co/t/heatmap-respect-x-or-y-axis-metric-not-both/254447)
**Author:** [@nunes](https://discuss.elastic.co/u/nunes)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 4:39pm UTC](https://discuss.elastic.co/t/heatmap-respect-x-or-y-axis-metric-not-both/254447 "2020-11-11T16:39:09Z")
Im trying to make a calendar with heatmap vizualization. Sum of field group by week number and week day. And this works when i use histogram aggregate for week day. But i want to use the week days in text (Mon, Tue, Wed… --- ## [Query DSL](https://discuss.elastic.co/t/query-dsl/254615)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 3:43pm UTC](https://discuss.elastic.co/t/query-dsl/254615 "2020-11-11T15:43:48Z")
hii I want to make filter on visualization by query dsl a need to make filter to visualization by last value who entered to one field (name : product name) --- ## [Regex on a string field with number](https://discuss.elastic.co/t/regex-on-a-string-field-with-number/254667)
**Author:** [@sudersank](https://discuss.elastic.co/u/sudersank)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 3:41pm UTC](https://discuss.elastic.co/t/regex-on-a-string-field-with-number/254667 "2020-11-11T15:41:32Z")
I have a timestamp field which will have value as below log\_timestamp : 11/8/2020#17:21:25:635 The log\_timestamp is a string field. How do i use regex to filter values from 11/8/2020#17:21:22:635 To 11/8/2020#17:21:25… --- ## [JSON to fields in Logstash](https://discuss.elastic.co/t/json-to-fields-in-logstash/255016)
**Author:** [@Stevek](https://discuss.elastic.co/u/Stevek)\ **Replies:** 6\ **Last updated:** [November 11, 2020, 3:29pm UTC](https://discuss.elastic.co/t/json-to-fields-in-logstash/255016 "2020-11-11T15:29:53Z")
Hello, I am struggling to obtain fields with values from simple JSON file using logstash. Currently putting the output to file so I see if it looks okay, but I always receive errors for each line. JSON : { "cpuLoad":… --- ## [Increase insert and search rate in elastic search](https://discuss.elastic.co/t/increase-insert-and-search-rate-in-elastic-search/254963)
**Author:** [@Sherrie](https://discuss.elastic.co/u/Sherrie)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 3:29pm UTC](https://discuss.elastic.co/t/increase-insert-and-search-rate-in-elastic-search/254963 "2020-11-11T15:29:10Z")
Hi, We are using a JAVA API to insert 100k records from a kafka topic to elastic search endpoints to a particular index. The insert rate for 100k records takes upto 30 minutes. Whereas the same 100k records can be inser… --- ## [Logstash In Windowsn not Pushing logs to kibana](https://discuss.elastic.co/t/logstash-in-windowsn-not-pushing-logs-to-kibana/255091)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 3:26pm UTC](https://discuss.elastic.co/t/logstash-in-windowsn-not-pushing-logs-to-kibana/255091 "2020-11-11T15:26:36Z")
Hi guys, I wanted to install logstash in windows 2019 server as my server is in AWS and my ES domain is also in AWS. Im directly using logsatsh to transfer logs to ES end point. This is my logstash.conf file i… --- ## [API Key is getting generate when we are creating any Alerts using Webhook](https://discuss.elastic.co/t/api-key-is-getting-generate-when-we-are-creating-any-alerts-using-webhook/255085)
**Author:** [@shahidraza](https://discuss.elastic.co/u/shahidraza)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 2:30pm UTC](https://discuss.elastic.co/t/api-key-is-getting-generate-when-we-are-creating-any-alerts-using-webhook/255085 "2020-11-11T14:30:36Z")
Hi Team, I have integrated Webhook to send alerts on Interlink and BigPanda. I am able to forward the alerts but whenever I am creating a new alert and passing payload body which contains one unique API key(API Keys fro… --- ## [Kibana delete field from index pattern](https://discuss.elastic.co/t/kibana-delete-field-from-index-pattern/255043)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 2:23pm UTC](https://discuss.elastic.co/t/kibana-delete-field-from-index-pattern/255043 "2020-11-11T14:23:52Z")
Hi, I made a typo mistake in logstash and it caused a field with a wrong name (ts\_duration). I've deleted the data from elasticsearch and now data is in correct field (duration). I did some search and I've found out t… --- ## [Kibana 7.9 - Customizatios not reflecting on the browser](https://discuss.elastic.co/t/kibana-7-9-customizatios-not-reflecting-on-the-browser/254348)
**Author:** [@RichaSinha08](https://discuss.elastic.co/u/RichaSinha08)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 2:17pm UTC](https://discuss.elastic.co/t/kibana-7-9-customizatios-not-reflecting-on-the-browser/254348 "2020-11-11T14:17:36Z")
Hello, When I make customizations in Kibana 7.9.2 code, though they are reflecting in the optimize/bundles but not on the browser(localhost:5601) Earlier I had successfully done customizations for Kibana 7.4. Do I hav… --- ## [Customizable axis labels in TSVB Time Series Visualization](https://discuss.elastic.co/t/customizable-axis-labels-in-tsvb-time-series-visualization/254708)
**Author:** [@akash\_keswani](https://discuss.elastic.co/u/akash_keswani)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:56pm UTC](https://discuss.elastic.co/t/customizable-axis-labels-in-tsvb-time-series-visualization/254708 "2020-11-11T13:56:05Z")
Hi, Can anyone help me on how can we customize axis labels in TSVB Time Series Visualization - e.g. instead of 'per x weeks ' as a x-axis label, I'd really like the ability to relabel it to what i want. --- ## [Action unauthorized for user](https://discuss.elastic.co/t/action-unauthorized-for-user/255065)
**Author:** [@Samir\_Said](https://discuss.elastic.co/u/Samir_Said)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 1:50pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065 "2020-11-11T13:50:41Z")
I have created a user using: Stack Management / Users and added roles: kibana\_admin, kibana\_system however, the user got error when tried to run queury: { "error" : { "root\_cause" : \[ { "type" : "… --- ## [Parsing netflow (XML) logs, problems with encoding](https://discuss.elastic.co/t/parsing-netflow-xml-logs-problems-with-encoding/255073)
**Author:** [@th-ink](https://discuss.elastic.co/u/th-ink)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:49pm UTC](https://discuss.elastic.co/t/parsing-netflow-xml-logs-problems-with-encoding/255073 "2020-11-11T13:49:26Z")
Hi all, I have some netflow logs in .xml that I need to parse with logstash. All is well until I reach payload field, which has differnet char set (?) and logstash crashes. This is the error message returned: Error pa… --- ## [Kibana is stock on “Kibana server is not ready yet”](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021)
**Author:** [@hadi\_farzipour](https://discuss.elastic.co/u/hadi_farzipour)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-is-stock-on-kibana-server-is-not-ready-yet/255021 "2020-11-11T13:49:10Z")
Hi everyone After installing Inhanced-Table plugin, my Kibana is stock on following message "Kibana server is not ready yet" However after some minutes it completely became out of reach and I face with "Unable to co… --- ## [Display bytes per second in Line viz](https://discuss.elastic.co/t/display-bytes-per-second-in-line-viz/254004)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:40pm UTC](https://discuss.elastic.co/t/display-bytes-per-second-in-line-viz/254004 "2020-11-11T13:40:21Z")
Hello, with the lockdown, I'm currently working on a dashboard to sum up the throughput on our remote connection systems. I've created a custom script as such : { "script" : "doc\['Bytes'\].value / 60" } and forced the… --- ## [Best practice to delete old Snapshots on Elasticsearch 2.4](https://discuss.elastic.co/t/best-practice-to-delete-old-snapshots-on-elasticsearch-2-4/255063)
**Author:** [@Silas-91](https://discuss.elastic.co/u/Silas-91)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 1:28pm UTC](https://discuss.elastic.co/t/best-practice-to-delete-old-snapshots-on-elasticsearch-2-4/255063 "2020-11-11T13:28:54Z")
Hi all, does anyone know the best way to delete the old snapshots at elasticsearch 2.4. And what will happen if I delete a snapshot from 5 days ago? These are incremental snapshots. How do they behave when restoring? T… --- ## [Data stream rollover exceeded max\_size](https://discuss.elastic.co/t/data-stream-rollover-exceeded-max-size/255069)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:25pm UTC](https://discuss.elastic.co/t/data-stream-rollover-exceeded-max-size/255069 "2020-11-11T13:25:16Z")
hi i defined "test-log" data stream,add the ilm as follow "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_size": "10mb" }, "set\_priority": { "p… --- ## [Restore de cluster](https://discuss.elastic.co/t/restore-de-cluster/253599)
**Author:** [@ormenese](https://discuss.elastic.co/u/ormenese)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 1:15pm UTC](https://discuss.elastic.co/t/restore-de-cluster/253599 "2020-11-11T13:15:49Z")
Boa tarde pessoal. Estou migrando meu cluster de ambiente. Já fiz todas as instalações necessárias e a cópia dos arquivos físicos dos snapshots do cluster a ser migrado, para dentro do cluster novo. Preciso que o rest… --- ## [2 hit observed in kibana whreas I ingest only once using logstash](https://discuss.elastic.co/t/2-hit-observed-in-kibana-whreas-i-ingest-only-once-using-logstash/255064)
**Author:** [@Sivajanani](https://discuss.elastic.co/u/Sivajanani)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 1:02pm UTC](https://discuss.elastic.co/t/2-hit-observed-in-kibana-whreas-i-ingest-only-once-using-logstash/255064 "2020-11-11T13:02:41Z")
I have my logstash config file as below, input{ file { type =\> "json" path =\> "D:/a-json.json" start\_position =\> "beginning" sincedb\_path =\> "NUL" mode =\> "read" file\_completed\_action =\> "log" file\_comple… --- ## [Elasticsearch S3 repository creation - Reload secure settings](https://discuss.elastic.co/t/elasticsearch-s3-repository-creation-reload-secure-settings/255035)
**Author:** [@Tanex](https://discuss.elastic.co/u/Tanex)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-repository-creation-reload-secure-settings/255035 "2020-11-11T13:01:54Z")
Hi All, I am using elasticsearch docker . The elasticsearch version Version: 6.2.1 I set my s3 credentials in elasticsearch-keystore . Now, i want to reload the secure settings. But i am getting the below errors. Plea… --- ## [How to add date format in \_delete\_by\_query](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 15\ **Last updated:** [November 11, 2020, 12:56pm UTC](https://discuss.elastic.co/t/how-to-add-date-format-in-delete-by-query/254600 "2020-11-11T12:56:30Z")
Hello Team Could you please help me how to add a format while performing operation of "\_delete\_by\_query" on Index were condition of deletion is based on range --\> on a field having type as "epoch" and i can pass the da… --- ## [Fetching data from 3 index based on one unique field](https://discuss.elastic.co/t/fetching-data-from-3-index-based-on-one-unique-field/255047)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [November 11, 2020, 12:48pm UTC](https://discuss.elastic.co/t/fetching-data-from-3-index-based-on-one-unique-field/255047 "2020-11-11T12:48:00Z")
Hi All, I have a requirement where I have three indexes In my first index there are three fields (id,name,age) In my second index, there are three fields(id, experience,company code) In my third index , there are thre… --- ## [What happens to copy\_to field when one of the origins values modified/deleted](https://discuss.elastic.co/t/what-happens-to-copy-to-field-when-one-of-the-origins-values-modified-deleted/255060)
**Author:** [@jac1241](https://discuss.elastic.co/u/jac1241)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:44pm UTC](https://discuss.elastic.co/t/what-happens-to-copy-to-field-when-one-of-the-origins-values-modified-deleted/255060 "2020-11-11T12:44:58Z")
Hello, I didn't find any reference in docs for this question. I want to use copy\_to to copy multiple fields to a signle field, when one of the original fields might be modified. For example: I have 2 fields: user\_ta… --- ## [Lab 4.4 Multi Cluster Set Ups Elasticsearch Engineer II](https://discuss.elastic.co/t/lab-4-4-multi-cluster-set-ups-elasticsearch-engineer-ii/255040)
**Author:** [@hicks](https://discuss.elastic.co/u/hicks)\ **Replies:** 1\ **Last updated:** [November 11, 2020, 12:34pm UTC](https://discuss.elastic.co/t/lab-4-4-multi-cluster-set-ups-elasticsearch-engineer-ii/255040 "2020-11-11T12:34:36Z")
Hi I’m in the lab for Elasticsearch Engineer II module 4.4 Multi cluster set ups I’m trying to run the curl command, I've tried it on server6 and the other servers too: curl -X POST "http://server6:9200/\_licence/start… --- ## [Logstash idles out after a duration](https://discuss.elastic.co/t/logstash-idles-out-after-a-duration/255057)
**Author:** [@vyas.radhakrishnan](https://discuss.elastic.co/u/vyas.radhakrishnan)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:28pm UTC](https://discuss.elastic.co/t/logstash-idles-out-after-a-duration/255057 "2020-11-11T12:28:27Z")
We have a logstash pipeline . Input is a kafka topic , output is elastic search. If the topic does not receive any messages for hours , we observe a delay in processing the next message from topic when it comes. The log… --- ## [Logstash DLQ commit\_offsets =\> true seems to be ignored?](https://discuss.elastic.co/t/logstash-dlq-commit-offsets-true-seems-to-be-ignored/255053)
**Author:** [@BBQigniter](https://discuss.elastic.co/u/BBQigniter)\ **Replies:** 0\ **Last updated:** [November 11, 2020, 12:18pm UTC](https://discuss.elastic.co/t/logstash-dlq-commit-offsets-true-seems-to-be-ignored/255053 "2020-11-11T12:18:41Z")
I'm now playing around with the dead letter queue feature of Logstash. First I tried around with commit\_offsets =\> false to be able to set up everything and as expected the DLQ events were ingested after each restart of … --- ## [KQL filter if more values](https://discuss.elastic.co/t/kql-filter-if-more-values/254961)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [November 11, 2020, 12:12pm UTC](https://discuss.elastic.co/t/kql-filter-if-more-values/254961 "2020-11-11T12:12:50Z")
Hi, Looking to query a field such as process.args:"atbroker.exe" but would only want a hit if there is more in process.args than just atbroker.exe Is this possible? Thanks Phil [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1155) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1157)