# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1208 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1209 --- ## [Logstash not picking up multiline logs](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823)
**Author:** [@Ayesha](https://discuss.elastic.co/u/Ayesha)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823 "2020-10-06T08:57:24Z")
Hi, I am parsing a log file which has both multiline and singleline logs in it. Here is a sample data 13-08-2020 11:15:41,278 DEBUG \[org.jboss.as.config\] (MSC service thread 1-7) Configured system properties: \[Standa… --- ## [How does elasticsearch store its data \[ multi node architecture \]](https://discuss.elastic.co/t/how-does-elasticsearch-store-its-data-multi-node-architecture/251056)
**Author:** [@Youssef\_Blaada](https://discuss.elastic.co/u/Youssef_Blaada)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 7:58am UTC](https://discuss.elastic.co/t/how-does-elasticsearch-store-its-data-multi-node-architecture/251056 "2020-10-06T07:58:15Z")
Hi all, I'm a newbie in elasticsearch, and i have a question about how does elasticsearch store its data in a multi node architecture, what i know is each node store its data on the specified data path and if we choose … --- ## [Filtering the response into the "Avg Bucket Aggregation"](https://discuss.elastic.co/t/filtering-the-response-into-the-avg-bucket-aggregation/250806)
**Author:** [@Famas](https://discuss.elastic.co/u/Famas)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 6:44am UTC](https://discuss.elastic.co/t/filtering-the-response-into-the-avg-bucket-aggregation/250806 "2020-10-06T06:44:53Z")
Hi all. I'm trying to use "Avg Bucket Aggregation". This is the example given in the help page of Elasticsearch site. POST /\_search { "size": 0, "aggs": { "sales\_per\_month": { "da… --- ## [Elasticsearch 7.9.2 stuck at startip](https://discuss.elastic.co/t/elasticsearch-7-9-2-stuck-at-startip/250592)
**Author:** [@deepansh](https://discuss.elastic.co/u/deepansh)\ **Replies:** 8\ **Last updated:** [October 6, 2020, 5:40am UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-stuck-at-startip/250592 "2020-10-06T05:40:34Z")
I m trying to install elasticsearch 7.9.2 using cloudformation on AWS Ec2. When i run command "service elasticsearch start" in cloudformation cfn-init command it never completes even though elasticsearch has started. s… --- ## [How to use Elasticsearch SQL { XPACK } in Logstash](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 5:29am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995 "2020-10-06T05:29:19Z")
Hello I am using Logstash 7.8.0 with Elasticsearch v7.8.0. I am using Logstash to extract data from ES Index-1 and inserting into ES Index-2. I am not finding a way to use Elasticsearch SQL a part of xpack into Logsta… --- ## [ElasticSearch - How to display an additional field name in "Multi level" aggregation query?](https://discuss.elastic.co/t/elasticsearch-how-to-display-an-additional-field-name-in-multi-level-aggregation-query/251068)
**Author:** [@rifas\_ali\_pbi](https://discuss.elastic.co/u/rifas_ali_pbi)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 5:28am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-display-an-additional-field-name-in-multi-level-aggregation-query/251068 "2020-10-06T05:28:32Z")
--- ## [Create hyperlinks in logstash](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 4\ **Last updated:** [October 6, 2020, 5:05am UTC](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010 "2020-10-06T05:05:21Z")
In my logstash output, I have set up an email output that looks like this (put it for reference, doesn't really matter): # If our honeypot (called cowrie) gets someone, send me an email if \[log\]\[file\]\[path\] =~ "cowrie.… --- ## [Problems with Traefik/Keycloak in front of Kibana](https://discuss.elastic.co/t/problems-with-traefik-keycloak-in-front-of-kibana/250898)
**Author:** [@kodo65](https://discuss.elastic.co/u/kodo65)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 4:58am UTC](https://discuss.elastic.co/t/problems-with-traefik-keycloak-in-front-of-kibana/250898 "2020-10-06T04:58:23Z")
Hi! I want to use Keycloak as a standard way of authenticating users to applications running in our Kubernetes clusters. One of the clusters is running the Elastic ECK component (v1.1.1) and we use the operator to deplo… --- ## [Discoverの検索結果を上限サイズを超えてCSV出力したい](https://discuss.elastic.co/t/discover-csv/251061)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 2:45am UTC](https://discuss.elastic.co/t/discover-csv/251061 "2020-10-06T02:45:41Z")
DIscoverの検索結果30000件程をCSV出力したいです。しかし、CSVの出力サイズでサポートされているのは最大50MBまでと制限があるため、Discover画面から出力しようとすると、その上限に引っかかってしまいます。50MBを超えるCSV出力を実施するためには何かいい方法は無いでしょうか？ --- ## [Enterprise search is working perfectly on local server. How to get internet endpoint?](https://discuss.elastic.co/t/enterprise-search-is-working-perfectly-on-local-server-how-to-get-internet-endpoint/251031)
**Author:** [@sri\_sri](https://discuss.elastic.co/u/sri_sri)\ **Replies:** 2\ **Last updated:** [October 6, 2020, 1:21am UTC](https://discuss.elastic.co/t/enterprise-search-is-working-perfectly-on-local-server-how-to-get-internet-endpoint/251031 "2020-10-06T01:21:21Z")
Today I successfully installed enterprise app search on a Google cloud instance. I tested it on localhost:3002 and working perfectly including indexing & searches through reference UI. But the problem is how can I get t… --- ## [Suricata Redis\>ELK Stack Mapping help please](https://discuss.elastic.co/t/suricata-redis-elk-stack-mapping-help-please/250860)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 12:26am UTC](https://discuss.elastic.co/t/suricata-redis-elk-stack-mapping-help-please/250860 "2020-10-06T00:26:34Z")
I am running Suricata on PFSense and my goal is to create a Network Security Monitoring Dashboard with world map. Likely in Grafana. I use FreeNAS with ELK setup in a FreeBSD jail. My elasticsearch is 7.7.1 and did not… --- ## [Nodes leaving Elastic Search cluster](https://discuss.elastic.co/t/nodes-leaving-elastic-search-cluster/251052)
**Author:** [@praveen4bv](https://discuss.elastic.co/u/praveen4bv)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 9:35pm UTC](https://discuss.elastic.co/t/nodes-leaving-elastic-search-cluster/251052 "2020-10-05T21:35:15Z")
Hi, We have recently migrated to ES 7.6.2 from 6.5.2 and are seeing cluster instability since the upgrade. We see the below behavior from the Elastic Search cluster: Nodes in the cluster leave and join back after som… --- ## [Snapshot elasticsearch with rsync](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033)
**Author:** [@andrezenzen](https://discuss.elastic.co/u/andrezenzen)\ **Replies:** 3\ **Last updated:** [October 5, 2020, 9:06pm UTC](https://discuss.elastic.co/t/snapshot-elasticsearch-with-rsync/251033 "2020-10-05T21:06:59Z")
I have a backup routine set up, and would like to use rsync to make a copy to another server. My question is whether rsync will be able to move without breaking files with the routine enabled. --- ## [Last Valid Value of a Field in Scripted Fields](https://discuss.elastic.co/t/last-valid-value-of-a-field-in-scripted-fields/250918)
**Author:** [@Nastooh](https://discuss.elastic.co/u/Nastooh)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 7:23pm UTC](https://discuss.elastic.co/t/last-valid-value-of-a-field-in-scripted-fields/250918 "2020-10-05T19:23:33Z")
Hi I need to perform math functions on fields with different timestamps. For example, current value of field x, qualified by its size and the last valid value of field y: if(doc\['x'\].size()\>0){ doc\['x'\].value+doc\['y'… --- ## [How to create a Graph](https://discuss.elastic.co/t/how-to-create-a-graph/250607)
**Author:** [@udaybit45](https://discuss.elastic.co/u/udaybit45)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:21pm UTC](https://discuss.elastic.co/t/how-to-create-a-graph/250607 "2020-10-05T19:21:53Z")
Hi All, I'm new to ELK and wanted to create Kibana visualization based on the data as below: I have data in CSV and using ELK i was able to parsed and indexed the logs and i'm using ELK 7.8V I have data as Timestamp a… --- ## [Logstash elasticsearch input using https error](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:18pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041 "2020-10-05T19:18:42Z")
I am able to curl the elasticsearch https but input errors out: \[ffoti@siem-logstash-01 ~\]$ curl -XGET -u elastic:\*\*\*\*\*\*\*\*\* --cacert /etc/logstash/ca.crt --cert /etc/logstash/siem-logstash-01.crt --key /etc/logstash/sie… --- ## [Kibana not showing all data](https://discuss.elastic.co/t/kibana-not-showing-all-data/250525)
**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 7:09pm UTC](https://discuss.elastic.co/t/kibana-not-showing-all-data/250525 "2020-10-05T19:09:56Z")
Hi guys , recently i injected a 1,7 GB file in elasticsearch using logstash, so when i check the index management i find 9782102 and when i try to make a metric visualization it gives me 9007610 document any idea w… --- ## [Elasticsearch 7.9.2 elasticsearch.keystore](https://discuss.elastic.co/t/elasticsearch-7-9-2-elasticsearch-keystore/251037)
**Author:** [@deepansh](https://discuss.elastic.co/u/deepansh)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 6:24pm UTC](https://discuss.elastic.co/t/elasticsearch-7-9-2-elasticsearch-keystore/251037 "2020-10-05T18:24:16Z")
Is Elasticsearch 7.9.2 elasticsearch.keystore necessary and should have password? --- ## [Elastic Search Killed on start up!](https://discuss.elastic.co/t/elastic-search-killed-on-start-up/250737)
**Author:** [@aatif26](https://discuss.elastic.co/u/aatif26)\ **Replies:** 9\ **Last updated:** [October 5, 2020, 6:14pm UTC](https://discuss.elastic.co/t/elastic-search-killed-on-start-up/250737 "2020-10-05T18:14:55Z")
I just installed elasticsearch 7.9.2 in my centos 7.8.2003. Whenever I run ./bin/elasticsearch it just returns "killed" along with a bunch of warnings. I have referred this for installation. I have 2GB installed memor… --- ## [Transfer Kibana discoveries, reports , queries from Old Kibana Server to New Kibana Server](https://discuss.elastic.co/t/transfer-kibana-discoveries-reports-queries-from-old-kibana-server-to-new-kibana-server/250389)
**Author:** [@tyrone](https://discuss.elastic.co/u/tyrone)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 5:55pm UTC](https://discuss.elastic.co/t/transfer-kibana-discoveries-reports-queries-from-old-kibana-server-to-new-kibana-server/250389 "2020-10-05T17:55:35Z")
We have just finished building a new ELK environment. How to I transfer all the settings from my old Kibana server to my new Kibana server to include reports, discoveries, visualizations etc? --- ## [Possibility of sorting and filtering the bucket keys as part of Term aggregation in Bar graph?](https://discuss.elastic.co/t/possibility-of-sorting-and-filtering-the-bucket-keys-as-part-of-term-aggregation-in-bar-graph/250154)
**Author:** [@parallelthought](https://discuss.elastic.co/u/parallelthought)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:49pm UTC](https://discuss.elastic.co/t/possibility-of-sorting-and-filtering-the-bucket-keys-as-part-of-term-aggregation-in-bar-graph/250154 "2020-10-05T17:49:01Z")
I'm trying to visualize a particular usecase described below, I'm unable to figure our if such a way is possible on Kibana (Timelion or Vertical graph). Appreciate any help/suggestion Usecase: Every ES doc contains a us… --- ## [Is there a way to get " count of records, with Status = 'closed' of previous month DIVIDED BY count of records, with status = 'New' of current month"](https://discuss.elastic.co/t/is-there-a-way-to-get-count-of-records-with-status-closed-of-previous-month-divided-by-count-of-records-with-status-new-of-current-month/250163)
**Author:** [@Pooja](https://discuss.elastic.co/u/Pooja)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:46pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-count-of-records-with-status-closed-of-previous-month-divided-by-count-of-records-with-status-new-of-current-month/250163 "2020-10-05T17:46:31Z")
I would like to get the following value to be populated on my dashboard. (Count of records, whose status: 'Closed', month : @timestamp - 1month) / (Count of records, whose status: 'New', month: @timestamp) --- ## [Custom domain using Nginx proxy in kubernetes](https://discuss.elastic.co/t/custom-domain-using-nginx-proxy-in-kubernetes/250483)
**Author:** [@ajaykumars](https://discuss.elastic.co/u/ajaykumars)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:28pm UTC](https://discuss.elastic.co/t/custom-domain-using-nginx-proxy-in-kubernetes/250483 "2020-10-05T17:28:18Z")
Hi, Since using https://12312jsdjsfavhjdf.elastic.com is a pain point for our customers. So to have a custom domain like https://kibana.domain.com I have an Nginx proxy in front of the elastic cloud so our custom domai… --- ## [Not able filter out values in controls typr visualization](https://discuss.elastic.co/t/not-able-filter-out-values-in-controls-typr-visualization/250664)
**Author:** [@Matish\_Bhuyan](https://discuss.elastic.co/u/Matish_Bhuyan)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:13pm UTC](https://discuss.elastic.co/t/not-able-filter-out-values-in-controls-typr-visualization/250664 "2020-10-05T17:13:27Z")
Hi All, This is my controls visualization values, Where i need to filter out the "Box management" "DOCUMENT\_CREATION" "ENTITLEMENT\_CREATION" "QUANTITATIVE\_COUNTERS\_PUBLISHING" and "Box Management" and display only… --- ## [How to display a field value in Kibana without using any aggregation](https://discuss.elastic.co/t/how-to-display-a-field-value-in-kibana-without-using-any-aggregation/250676)
**Author:** [@MG555](https://discuss.elastic.co/u/MG555)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:07pm UTC](https://discuss.elastic.co/t/how-to-display-a-field-value-in-kibana-without-using-any-aggregation/250676 "2020-10-05T17:07:29Z")
Hi, My requirement is i'm getting a field value that contains integer numbers that shows currently running functions in my environment. I want to create a graph to display the field value as it is without using any aggr… --- ## [Kibana visualization query very slow compared to console](https://discuss.elastic.co/t/kibana-visualization-query-very-slow-compared-to-console/250714)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:06pm UTC](https://discuss.elastic.co/t/kibana-visualization-query-very-slow-compared-to-console/250714 "2020-10-05T17:06:58Z")
Using Kibana 7.9.0, with ES 7.9.0. Running a visualization with date historgram and terms aggregation, the query takes 1800ms according Kibana inspect panel, but the same ES query takes only 20 ms when running on the co… --- ## [Dynamic mapping error - Unable to create dynamic object](https://discuss.elastic.co/t/dynamic-mapping-error-unable-to-create-dynamic-object/250755)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 5\ **Last updated:** [October 5, 2020, 5:06pm UTC](https://discuss.elastic.co/t/dynamic-mapping-error-unable-to-create-dynamic-object/250755 "2020-10-05T17:06:30Z")
Hi, We are trying to migrate from 5.5.2. to 6.8.12 version.Below is the sample of my mapping. I have set my mapping to dynamic:strict and only one object I would want to introduce dynamically so setting it to true. Thi… --- ## [How to read the failed and success messages from log file into Kibana](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730)
**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:03pm UTC](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730 "2020-10-05T17:03:15Z")
Hi, I want read the the log files bases on timestamp along with the Success messages and failed messages. here is my path (Log Files) C:\\Users\\skkoganti\\Documents\\log Sample: EDI Log-2020-08-04.txt Time|Application|M… --- ## [Can we add tooltip in the line chart? Show additional fields of the data being used?](https://discuss.elastic.co/t/can-we-add-tooltip-in-the-line-chart-show-additional-fields-of-the-data-being-used/250734)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:01pm UTC](https://discuss.elastic.co/t/can-we-add-tooltip-in-the-line-chart-show-additional-fields-of-the-data-being-used/250734 "2020-10-05T17:01:35Z")
I have a line chart , which is created using Time Count Speed I wish to add additional fields to the chart like say name of the device to the chart on hover. If so , Could you please tell me how --- ## [How 'old' are the documents?](https://discuss.elastic.co/t/how-old-are-the-documents/250766)
**Author:** [@Artur\_Trindade](https://discuss.elastic.co/u/Artur_Trindade)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 4:57pm UTC](https://discuss.elastic.co/t/how-old-are-the-documents/250766 "2020-10-05T16:57:12Z")
Hello, I have need to create a plot that shows how long the documents exists in the index My first idea would be creating a scripted field that computes something like now()-timestamp How can this be performed in kiba… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1207) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1209)