# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1160 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1161 --- ## [Kibana](https://discuss.elastic.co/t/kibana/254730)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 9:59pm UTC](https://discuss.elastic.co/t/kibana/254730 "2020-11-09T21:59:35Z")
I have create an index and insert 5 records in kibana problem is that name field is showing in discover but when i make visualisation name field is not in showing in the visualisation field. please help --- ## [Grok debugger works but logstash fails multiple lines](https://discuss.elastic.co/t/grok-debugger-works-but-logstash-fails-multiple-lines/254824)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 9:58pm UTC](https://discuss.elastic.co/t/grok-debugger-works-but-logstash-fails-multiple-lines/254824 "2020-11-09T21:58:25Z")
Hello. I am trying to use the following regex to capture some info from a log entry: (?m)(?\<=responses=)(.\*)(?=extraData) Now it works in the grok debugger: But it fails in logstash: Any idea why that might be t… --- ## [APM visualization in the custom dashboard](https://discuss.elastic.co/t/apm-visualization-in-the-custom-dashboard/254782)
**Author:** [@nagabhushan.tr](https://discuss.elastic.co/u/nagabhushan.tr)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 3:38pm UTC](https://discuss.elastic.co/t/apm-visualization-in-the-custom-dashboard/254782 "2020-11-09T15:38:24Z")
I am looking to see if we can add the existing visualization (waterfall visualization of transaction flow) in our custom dashboard. Our use case involves parsing log data, make use of log correlation and club the filter… --- ## [High load (\>3.0.0), 60% CPU and 30% heap usage](https://discuss.elastic.co/t/high-load-3-0-0-60-cpu-and-30-heap-usage/254278)
**Author:** [@amackenzie](https://discuss.elastic.co/u/amackenzie)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 8:47pm UTC](https://discuss.elastic.co/t/high-load-3-0-0-60-cpu-and-30-heap-usage/254278 "2020-11-09T20:47:35Z")
Hi there, I'm wondering if someone could help me analyse this hot thread output. We have a number of data nodes. All of these data nodes also ingest and index too. We're using ES 5.6 Thank you, Ally --- ## [Elasticsearch Filter Syntax](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 8:43pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-syntax/254793 "2020-11-09T20:43:13Z")
filter { elasticsearch { hosts =\> \["https://10. 0.0.20:9200","https://10. 0.0.21:9200","https://10. 0.0.22:9200","https://10. 0.0.23:9200","https://10. 0.0.24:9200","https://10. 0.0.25:9200","https://10. 0.0.26:9200"\] ca… --- ## [Anybody help me about Regex for parsing stack trace in my Log pattern?](https://discuss.elastic.co/t/anybody-help-me-about-regex-for-parsing-stack-trace-in-my-log-pattern/254790)
**Author:** [@quangdv.6466](https://discuss.elastic.co/u/quangdv.6466)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 6:47pm UTC](https://discuss.elastic.co/t/anybody-help-me-about-regex-for-parsing-stack-trace-in-my-log-pattern/254790 "2020-11-09T18:47:23Z")
This is my log pattern: 2020-10-27 00:02:24.021 \[http-nio-8080-exec-42\] \[|78CDD621831532CBD69F2F3DEF1859DC|-\] DEBUG c.q.u.checkpoint.CheckpointFilter CheckpointFilter.afterRequestProcessing(...) (CheckpointFilter.java:1… --- ## [Need sum Of Value](https://discuss.elastic.co/t/need-sum-of-value/254058)
**Author:** [@errupeshmca](https://discuss.elastic.co/u/errupeshmca)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 6:33pm UTC](https://discuss.elastic.co/t/need-sum-of-value/254058 "2020-11-09T18:33:03Z")
working on calculating Total sales per day, I have two column in table to calculate total sales per day based on total shipped that day. if Total Shipped = 1 and date = today's date. I need sum of total dollar value … --- ## [Foreach for bucket aggregation in watcher not working](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 6:10pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523 "2020-11-09T18:10:58Z")
Hi , I am trying to logging according to user using foreach but it is giving exception "type" : "exception", "reason" : "specified foreach object was null: \[ctx.payload.aggregations.user.buckets.keys\]" } Foreach C… --- ## [Vega-lite invalid spec error](https://discuss.elastic.co/t/vega-lite-invalid-spec-error/254706)
**Author:** [@smruthip](https://discuss.elastic.co/u/smruthip)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 5:26pm UTC](https://discuss.elastic.co/t/vega-lite-invalid-spec-error/254706 "2020-11-09T17:26:59Z")
I am just trying to do a simple count of all container\_id 's for every state in vega-lite and it thorws an error as invalid spec. What am I doing wrong here? { "$schema": "https://vega.github.io/schema/vega-lite/v2.js… --- ## [Grok multiple pattern definitions](https://discuss.elastic.co/t/grok-multiple-pattern-definitions/254797)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 2\ **Last updated:** [November 9, 2020, 5:24pm UTC](https://discuss.elastic.co/t/grok-multiple-pattern-definitions/254797 "2020-11-09T17:24:57Z")
Hello, I am trying to define several patterns to use on logstash.conf. So far I have tried this: grok{ tag\_on\_failure =\> \[\] pattern\_definitions =\> {"text1" =\> "((?\<=responses=)\[a-zA-z \]+(?=,))"} patt… --- ## [Pipeline aborted due to undefined method \`mutex'](https://discuss.elastic.co/t/pipeline-aborted-due-to-undefined-method-mutex/254777)
**Author:** [@lens](https://discuss.elastic.co/u/lens)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 5:16pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-undefined-method-mutex/254777 "2020-11-09T17:16:22Z")
I've recently been running into an error when starting logstash. We have several pipelines configured and all will start up without a problem, except for one (not always the same one and there is not a problem every time… --- ## [Unrecognized VM option 'UseConcMarkSweepGC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/254534)
**Author:** [@seePyou](https://discuss.elastic.co/u/seePyou)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 4:37pm UTC](https://discuss.elastic.co/t/unrecognized-vm-option-useconcmarksweepgc/254534 "2020-11-09T16:37:47Z")
Hello I'm trying to use logstash in Windows 10 but I am stuck at this error: PS C:\\logstash-7.9.3\\bin\> .\\logstash -e 'input {stdin{}} output {stdout{}}' Unrecognized VM option 'UseConcMarkSweepGC' Error: Could not crea… --- ## [Cat api nodes returning stale data?](https://discuss.elastic.co/t/cat-api-nodes-returning-stale-data/254656)
**Author:** [@falkenbt](https://discuss.elastic.co/u/falkenbt)\ **Replies:** 9\ **Last updated:** [November 9, 2020, 4:00pm UTC](https://discuss.elastic.co/t/cat-api-nodes-returning-stale-data/254656 "2020-11-09T16:00:46Z")
ES version: 7.7.1 In our startup/shutdown scripts we call \_cat/nodes in order to get the number of running nodes to decide if we need to change the shard allocation (only the first stop should change it). The script the… --- ## [High CPU usage when log format not matching with filter rule](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728)
**Author:** [@4orty](https://discuss.elastic.co/u/4orty)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 3:57pm UTC](https://discuss.elastic.co/t/high-cpu-usage-when-log-format-not-matching-with-filter-rule/254728 "2020-11-09T15:57:00Z")
CPU utilization increases when data comes in that it does not meet the set rules.(grok pattern) Isn't there a defense logic to this phenomenon, such as preventing data from entering in case of failure of parsing? --- ## [Is there a mecanism to check that the data coming from the source (filebeat) is the same that we have in elastic](https://discuss.elastic.co/t/is-there-a-mecanism-to-check-that-the-data-coming-from-the-source-filebeat-is-the-same-that-we-have-in-elastic/253674)
**Author:** [@soufian.eldouqe](https://discuss.elastic.co/u/soufian.eldouqe)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:46pm UTC](https://discuss.elastic.co/t/is-there-a-mecanism-to-check-that-the-data-coming-from-the-source-filebeat-is-the-same-that-we-have-in-elastic/253674 "2020-11-09T15:46:04Z")
Hello everyone, We are using logstash to parse our application log and index to elastic search. Following is the high level architecture file beat -----\> Logstash ----\> Elastic search ------\> kibana. How can we verify… --- ## [Handle Sepcial char in elasticsearch](https://discuss.elastic.co/t/handle-sepcial-char-in-elasticsearch/254785)
**Author:** [@Shivesh\_Srivastava](https://discuss.elastic.co/u/Shivesh_Srivastava)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 3:46pm UTC](https://discuss.elastic.co/t/handle-sepcial-char-in-elasticsearch/254785 "2020-11-09T15:46:04Z")
My Elasticsearch version is 6.8.3 and I am trying to fetch data against the Lucene query which contains filter value as \\\\\\\\\*\\\\abc$ I have some code, which handles the special characters and the above filter value is c… --- ## [Multiple Logstash instances as Kafka inputs](https://discuss.elastic.co/t/multiple-logstash-instances-as-kafka-inputs/254784)
**Author:** [@Fran\_Raknic](https://discuss.elastic.co/u/Fran_Raknic)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 3:44pm UTC](https://discuss.elastic.co/t/multiple-logstash-instances-as-kafka-inputs/254784 "2020-11-09T15:44:24Z")
I am having trouble in making multiple Logstash instances read from a single Kafka topic. The Logstash instances are all on the same server, together with Kafka and Zookeeper. When I check the topic with kafka-console-c… --- ## [Pipeline aborted due to EOF in aggregate maps file](https://discuss.elastic.co/t/pipeline-aborted-due-to-eof-in-aggregate-maps-file/254783)
**Author:** [@lens](https://discuss.elastic.co/u/lens)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 3:42pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-eof-in-aggregate-maps-file/254783 "2020-11-09T15:42:49Z")
We have had several cases recently of logstash not being able to restart all of its configured pipelines. We are using the aggregation filter and it should write out any aggregation maps that are in-progress when logsta… --- ## [SIEM rule not working for custom query](https://discuss.elastic.co/t/siem-rule-not-working-for-custom-query/253895)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:38pm UTC](https://discuss.elastic.co/t/siem-rule-not-working-for-custom-query/253895 "2020-11-09T15:38:49Z")
HI, I'm trying to create a simple rule that checks host.name field: But no signal is generating. here is my index mapping. I can see events in timeline using the same query. --- ## [Elasticsearch cluster](https://discuss.elastic.co/t/elasticsearch-cluster/252379)
**Author:** [@bognad](https://discuss.elastic.co/u/bognad)\ **Replies:** 6\ **Last updated:** [November 9, 2020, 3:32pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster/252379 "2020-11-09T15:32:46Z")
Good day! I am having difficulty to create 2 nodes cluster, each nodes has different "cluster.uuid". Why? How add node to cluster? Node A cluster.name: "elk-cluster" network.host: 0.0.0.0 node.name: primary cluster… --- ## [Indices gone after upgrade (7.8.0 to 7.9.1)](https://discuss.elastic.co/t/indices-gone-after-upgrade-7-8-0-to-7-9-1/254149)
**Author:** [@rcz](https://discuss.elastic.co/u/rcz)\ **Replies:** 5\ **Last updated:** [November 9, 2020, 3:05pm UTC](https://discuss.elastic.co/t/indices-gone-after-upgrade-7-8-0-to-7-9-1/254149 "2020-11-09T15:05:55Z")
Hello, I'm in a bit of a pickle. A lot of my indices are gone after an upgrade. I have a Logstash pumping in data into an alias. The alias still pointed to the same index name after upgrading, but the old data was gon… --- ## [Need help on "sum by group" aggregations on simple doc structure](https://discuss.elastic.co/t/need-help-on-sum-by-group-aggregations-on-simple-doc-structure/254672)
**Author:** [@ElasBon](https://discuss.elastic.co/u/ElasBon)\ **Replies:** 4\ **Last updated:** [November 9, 2020, 2:46pm UTC](https://discuss.elastic.co/t/need-help-on-sum-by-group-aggregations-on-simple-doc-structure/254672 "2020-11-09T14:46:56Z")
I'm using es 7.8.1, my data are pojo records like this: { "timestamp": "2020-11-07 08:00:00", "lineId": 532, "sn": "A2600101000005DF", "upBytes": 5927, "dlBytes": 13706 } … --- ## [TSVB derivative returns 0 if previous interval was 0](https://discuss.elastic.co/t/tsvb-derivative-returns-0-if-previous-interval-was-0/252809)
**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 2:41pm UTC](https://discuss.elastic.co/t/tsvb-derivative-returns-0-if-previous-interval-was-0/252809 "2020-11-09T14:41:30Z")
This dataset has values recorded on a Monday to Friday, and no data at weekends. The graph plots data per day/24 hours. I've plotted a cumulative sum (blue line) and the value changes each weekday; as there is no data r… --- ## [Logstash pipelines does not take filter](https://discuss.elastic.co/t/logstash-pipelines-does-not-take-filter/254769)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 2:34pm UTC](https://discuss.elastic.co/t/logstash-pipelines-does-not-take-filter/254769 "2020-11-09T14:34:48Z")
Hi, i have filebeat configured to send jboss log on Logstash. On logstash i have input.conf which gets me logs from filebeat, an output.conf to send log on elasticsearch and a jboss-filter.conf to parse the log. I see… --- ## [How to show year only in X-axis, Kibana using date histogram?](https://discuss.elastic.co/t/how-to-show-year-only-in-x-axis-kibana-using-date-histogram/254649)
**Author:** [@Mike\_Storm](https://discuss.elastic.co/u/Mike_Storm)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 2:20pm UTC](https://discuss.elastic.co/t/how-to-show-year-only-in-x-axis-kibana-using-date-histogram/254649 "2020-11-09T14:20:50Z")
how can I display the year only on a date histogram, I would like to display the years, but it seems i have intervals, please see below screenshot however I tried Terms aggregation here's the result, I want to achie… --- ## [Kibana development mode, yarn installation](https://discuss.elastic.co/t/kibana-development-mode-yarn-installation/254753)
**Author:** [@omerf](https://discuss.elastic.co/u/omerf)\ **Replies:** 1\ **Last updated:** [November 9, 2020, 2:14pm UTC](https://discuss.elastic.co/t/kibana-development-mode-yarn-installation/254753 "2020-11-09T14:14:57Z")
Hi, Last week I worked fine on the kibana dev, and now having trouble running " o yarn es snapshot --license trial " --- ## [Boolean similarity - is there a way to remove duplicates](https://discuss.elastic.co/t/boolean-similarity-is-there-a-way-to-remove-duplicates/253809)
**Author:** [@Miljenko\_Norsic](https://discuss.elastic.co/u/Miljenko_Norsic)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 1:42pm UTC](https://discuss.elastic.co/t/boolean-similarity-is-there-a-way-to-remove-duplicates/253809 "2020-11-09T13:42:26Z")
Given the following index: { "mappings": { "properties": { "field1": { "type": "text", "analyzer": "whitespace", "similarity": "boolean" }, "field… --- ## [Add Clock to Ops Dashboard](https://discuss.elastic.co/t/add-clock-to-ops-dashboard/254684)
**Author:** [@Brandon\_Wagoner](https://discuss.elastic.co/u/Brandon_Wagoner)\ **Replies:** 3\ **Last updated:** [November 9, 2020, 1:52pm UTC](https://discuss.elastic.co/t/add-clock-to-ops-dashboard/254684 "2020-11-09T13:52:21Z")
Is there a way to add a clock or several clocks (multiple time zones) to a kibana dashboard for display in an operations center? --- ## [Grok regex too long](https://discuss.elastic.co/t/grok-regex-too-long/254763)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 0\ **Last updated:** [November 9, 2020, 1:40pm UTC](https://discuss.elastic.co/t/grok-regex-too-long/254763 "2020-11-09T13:40:02Z")
Hello there. I am trying to apply a really long regex to a field in a log. I keep getting an error and logstash doesn't even start. The regex is made up of several smaller regexes connected with |, like this: pattern\_de… --- ## [SIEM Signals not triggering](https://discuss.elastic.co/t/siem-signals-not-triggering/254151)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 10\ **Last updated:** [November 9, 2020, 12:50pm UTC](https://discuss.elastic.co/t/siem-signals-not-triggering/254151 "2020-11-09T12:50:07Z")
SIEM signals are not triggering even after the events are generated. But same KQL query used in signal is working fine in discover tab. Please help me to resolve this issue. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1159) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1161)