# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1210 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1211 --- ## [Need help with Elasticsearch query on Kibana](https://discuss.elastic.co/t/need-help-with-elasticsearch-query-on-kibana/250764)
**Author:** [@Bahar\_Yilmaz](https://discuss.elastic.co/u/Bahar_Yilmaz)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 9:36am UTC](https://discuss.elastic.co/t/need-help-with-elasticsearch-query-on-kibana/250764 "2020-10-05T09:36:26Z")
Hi , I need help with the Elasticsearch query. My query is like this below. GET record/\_search { "\_source": "Climate.Product.ProductCategory.ProductSubcategory.ProductModel.UnitMeasure.ProductModelIllustration.Produ… --- ## [How to apply a histogram aggregation from the set of doc\_counts from a previous aggregation?](https://discuss.elastic.co/t/how-to-apply-a-histogram-aggregation-from-the-set-of-doc-counts-from-a-previous-aggregation/250883)
**Author:** [@pushshift](https://discuss.elastic.co/u/pushshift)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 9:26am UTC](https://discuss.elastic.co/t/how-to-apply-a-histogram-aggregation-from-the-set-of-doc-counts-from-a-previous-aggregation/250883 "2020-10-05T09:26:54Z")
I ran a terms aggregation and got back a bunch of buckets with keys and doc\_counts. I want to treat the doc\_counts from all the buckets returned as the input for a histogram aggregation (treat the doc\_counts as a set). T… --- ## [How to manage multiple namespaces with a single elastic operator](https://discuss.elastic.co/t/how-to-manage-multiple-namespaces-with-a-single-elastic-operator/250188)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 11\ **Last updated:** [October 5, 2020, 9:12am UTC](https://discuss.elastic.co/t/how-to-manage-multiple-namespaces-with-a-single-elastic-operator/250188 "2020-10-05T09:12:56Z")
Hi, I have deployed elastic operator from the quickstart documentation. I have deployed elasticsearch, kibana from the same documentation under the namespace(elastic-system) where I have deployed the elastic operator. N… --- ## [Gradle Build failing with Java 11](https://discuss.elastic.co/t/gradle-build-failing-with-java-11/250862)
**Author:** [@afeesps](https://discuss.elastic.co/u/afeesps)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 9:06am UTC](https://discuss.elastic.co/t/gradle-build-failing-with-java-11/250862 "2020-10-05T09:06:23Z")
Getting an Exception like this while compiling with Gradle ./gradlew :distribution:archives:windows-zip:assemble \*\*Execution failed for task ':x-pack:plugin:moni\*\* \*\*\> java.lang.AssertionError: isSubtype UNKNOWN\*\* OS … --- ## [Elastic Search Installation on server](https://discuss.elastic.co/t/elastic-search-installation-on-server/250940)
**Author:** [@ashley11](https://discuss.elastic.co/u/ashley11)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 8:51am UTC](https://discuss.elastic.co/t/elastic-search-installation-on-server/250940 "2020-10-05T08:51:46Z")
Hi Team, I need to install elastic search in the windows/linux server and to use the kibana and elasticsearch from the local PC. Can I achieve this ? If yes can you please drop some links which explains the same. I'm ne… --- ## [Slow Kibana after update 7.4.2 -\> 7.9.2](https://discuss.elastic.co/t/slow-kibana-after-update-7-4-2-7-9-2/250878)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [October 5, 2020, 7:57am UTC](https://discuss.elastic.co/t/slow-kibana-after-update-7-4-2-7-9-2/250878 "2020-10-05T07:57:31Z")
Loading a dashboard with 5 visualizations takes 4x time with K7.9 than K7.4 (with exactly same indices and resources). ES cluster has 3 nodes, all queries take no more than 1 seconde, but dashboard is loading on 10 seco… --- ## [Explain difference between Kibana "time ellapsed" and query "took"](https://discuss.elastic.co/t/explain-difference-between-kibana-time-ellapsed-and-query-took/250763)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 7:20am UTC](https://discuss.elastic.co/t/explain-difference-between-kibana-time-ellapsed-and-query-took/250763 "2020-10-05T07:20:01Z")
In Kibana dev-console, I see a big difference between ES query took time and Kibana ellapsed time. Why ? --- ## [How to add a sum for all columns in a table view](https://discuss.elastic.co/t/how-to-add-a-sum-for-all-columns-in-a-table-view/250888)
**Author:** [@hzarrabi](https://discuss.elastic.co/u/hzarrabi)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 7:00am UTC](https://discuss.elastic.co/t/how-to-add-a-sum-for-all-columns-in-a-table-view/250888 "2020-10-05T07:00:13Z")
Hi all, I need to add a table view in my kibana dashboard with a sum for all columns like Excel. (see the picture. Is there any idea. Best Regards Hamid --- ## [How i can determine the difference of two fields(ROWS) in kibana](https://discuss.elastic.co/t/how-i-can-determine-the-difference-of-two-fields-rows-in-kibana/250922)
**Author:** [@Raja\_Kushwah](https://discuss.elastic.co/u/Raja_Kushwah)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:43am UTC](https://discuss.elastic.co/t/how-i-can-determine-the-difference-of-two-fields-rows-in-kibana/250922 "2020-10-05T06:43:33Z")
Please find the attached screenshot.!! I am trying to create a new filed name -- 'msec different' and its value will be '0' when the event name is a start and 2nd value will be the difference of \[2nd 'msecs' value - 3… --- ## [Config Logstash with https to Elasticsearch cluster](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:43am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606 "2020-10-05T06:43:20Z")
Error Logs in Logstash \[2020-09-23T12:24:31,929\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"https://palelasticsearch01mgt:9200/", :erro… --- ## [Logstash logs isn't like according to its date when see in kibana?](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924 "2020-10-05T06:22:48Z")
i'm using logstash v7.9.2. i have logs which are day wise like log-2020.10.03, log-2020.10.04, log-2020.10.05 it mixed up everything .i want to separate logs in separate index (daywise log). but i seeing logs of 3r… --- ## [Get Openshift Metrices via metricbeat in elasticsearch](https://discuss.elastic.co/t/get-openshift-metrices-via-metricbeat-in-elasticsearch/246958)
**Author:** [@Harshi1](https://discuss.elastic.co/u/Harshi1)\ **Replies:** 19\ **Last updated:** [October 5, 2020, 6:18am UTC](https://discuss.elastic.co/t/get-openshift-metrices-via-metricbeat-in-elasticsearch/246958 "2020-10-05T06:18:35Z")
Kibana version : 7.7.0 Elasticsearch version : 7.7.0 Metricbeat version : 7.7 Browser version : Chrome 84.0 Original install method (e.g. download page, yum, deb, from source, etc.) and version : RPM from download pa… --- ## [Urgent: Date Histogram showing 2 dates for single date on X axis when we selected absolute date in calander in Kibana](https://discuss.elastic.co/t/urgent-date-histogram-showing-2-dates-for-single-date-on-x-axis-when-we-selected-absolute-date-in-calander-in-kibana/250916)
**Author:** [@Prashanth1](https://discuss.elastic.co/u/Prashanth1)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:10am UTC](https://discuss.elastic.co/t/urgent-date-histogram-showing-2-dates-for-single-date-on-x-axis-when-we-selected-absolute-date-in-calander-in-kibana/250916 "2020-10-05T06:10:07Z")
Hi All, I am new to ELK stack so I couldn't able to resolve this. Could any one help me to resolve this issue. My problem is that when I have selected date from September 25th to 28th it should only one date on X-axis b… --- ## [Elasticsearch and ARM processors (Allwinner H6)](https://discuss.elastic.co/t/elasticsearch-and-arm-processors-allwinner-h6/250926)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 5:29am UTC](https://discuss.elastic.co/t/elasticsearch-and-arm-processors-allwinner-h6/250926 "2020-10-05T05:29:05Z")
Hi, I have a question about Elasticsearch on platforms with ARM processors. I want to test Elasticsearch on the latest version of Orange Pi 4. I'm thinking about: Orange Pi 4 4GB DDR4 with Rockchip RK3399 Dual-core C… --- ## [Query Nested Array](https://discuss.elastic.co/t/query-nested-array/250921)
**Author:** [@arinjay97](https://discuss.elastic.co/u/arinjay97)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 4:42am UTC](https://discuss.elastic.co/t/query-nested-array/250921 "2020-10-05T04:42:37Z")
I have an object that I want to index into an Elasticsearch index. Some of the fields inside the object have a nested array of JSON objects inside them. For example: "history":\[ {"color":"w","from":"g2","to":"g4","fla… --- ## [Elasticsearch Mapping to ECS](https://discuss.elastic.co/t/elasticsearch-mapping-to-ecs/250913)
**Author:** [@bn1980](https://discuss.elastic.co/u/bn1980)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 1:37am UTC](https://discuss.elastic.co/t/elasticsearch-mapping-to-ecs/250913 "2020-10-05T01:37:40Z")
I have logstash creating a daily index index =\> "logstash-suricata-%{+YYYY.MM.dd}" In order to create a mapping i am using a template which is assigned in logstash config template =\> "/usr/local/etc/logstash/suricat… --- ## [How to increase elasticsearch disk space](https://discuss.elastic.co/t/how-to-increase-elasticsearch-disk-space/250132)
**Author:** [@hourtest](https://discuss.elastic.co/u/hourtest)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 2:22am UTC](https://discuss.elastic.co/t/how-to-increase-elasticsearch-disk-space/250132 "2020-10-05T02:22:42Z")
Not enough capacity I want to increase capacity maybe 50gb to 500gb how should I do --- ## [How to get additional information added by filebeat in the output of logstash](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903)
**Author:** [@linhonghui](https://discuss.elastic.co/u/linhonghui)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 12:54am UTC](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903 "2020-10-05T00:54:30Z")
Hi I added additional information by fields option in filebeat configuration to identify application name, 'app\_id', such as, filebeat.inputs: - type: log enabled: true fields: app\_id: crawler\_164 ...... output… --- ## [Replay Data after deletion of Indices](https://discuss.elastic.co/t/replay-data-after-deletion-of-indices/250873)
**Author:** [@Cybirius](https://discuss.elastic.co/u/Cybirius)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 12:21am UTC](https://discuss.elastic.co/t/replay-data-after-deletion-of-indices/250873 "2020-10-05T00:21:53Z")
We recently had two servers go down due to hardware failure. When we added the two servers back to the environment the indices stored on the nodes did not automatically update with the indices that were replicated on ot… --- ## [Recommended JVM settings?](https://discuss.elastic.co/t/recommended-jvm-settings/250891)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 4, 2020, 5:50pm UTC](https://discuss.elastic.co/t/recommended-jvm-settings/250891 "2020-10-04T17:50:48Z")
this is the settings I gave logstash: -Xms2g -Xmx4g The machine has 8 cores and 24 GB of ram. My problem is that I've only added about 10-15 machines with audit&filebeat and all the cores are over 80% and some reach … --- ## [Wrong timestamp suricata module](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [October 4, 2020, 4:34pm UTC](https://discuss.elastic.co/t/wrong-timestamp-suricata-module/250876 "2020-10-04T16:34:22Z")
Hi. I+m having a problem with my suricata logs on kibana. My server and kibana are configured with the time Europe/Lisbon. The eve.json logs are in the correct timestamp. But when i move to kibana, the logs are shown in … --- ## [Refusing to connect to Elasticsearch-Node with expired certificate](https://discuss.elastic.co/t/refusing-to-connect-to-elasticsearch-node-with-expired-certificate/250820)
**Author:** [@Guerteltier](https://discuss.elastic.co/u/Guerteltier)\ **Replies:** 1\ **Last updated:** [October 4, 2020, 4:00pm UTC](https://discuss.elastic.co/t/refusing-to-connect-to-elasticsearch-node-with-expired-certificate/250820 "2020-10-04T16:00:01Z")
Error: Enterprise Search is unable to connect to Elasticsearch. Ensure a healthy Elasticsearch cluster is running at https://127.0.0.1:9200 for user elastic. But I can confirm that everything is fine: \[root@v220191183… --- ## [Remove LogLevel and Logger from message in logstash?](https://discuss.elastic.co/t/remove-loglevel-and-logger-from-message-in-logstash/250896)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 11:29am UTC](https://discuss.elastic.co/t/remove-loglevel-and-logger-from-message-in-logstash/250896 "2020-10-04T11:29:53Z")
Can I able to reove loglevel and logger from message. I want to create fields level and logger and store into it and then remove from message so it will easy to filterize log in kibana. Is this possible? How ? --- ## [Copy Field from a new processed document to an old Document](https://discuss.elastic.co/t/copy-field-from-a-new-processed-document-to-an-old-document/250897)
**Author:** [@Tensoue](https://discuss.elastic.co/u/Tensoue)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 11:42am UTC](https://discuss.elastic.co/t/copy-field-from-a-new-processed-document-to-an-old-document/250897 "2020-10-04T11:42:49Z")
Hi all, I am trying to copy field from a new document received in logstash to an old one exists in the elasticsearch server. For example: There are 2 events, lets call them event1 and event2 event1{name: "xyz",lastna… --- ## [Logstash pipeline](https://discuss.elastic.co/t/logstash-pipeline/250799)
**Author:** [@KRISHNAPRASAD\_HG](https://discuss.elastic.co/u/KRISHNAPRASAD_HG)\ **Replies:** 3\ **Last updated:** [October 4, 2020, 10:32am UTC](https://discuss.elastic.co/t/logstash-pipeline/250799 "2020-10-04T10:32:05Z")
Below is my pipelines.yml file but the configs not picked by logstash! Anything wrong here? pipeline.id: step1 pipeline.workers: 1 path.config: "D:/logstash-7.8.1/config/step1.conf" pipeline.id: step2 pipeline.worker… --- ## [Help needed in making a query for elastic search](https://discuss.elastic.co/t/help-needed-in-making-a-query-for-elastic-search/250477)
**Author:** [@vishalYadav](https://discuss.elastic.co/u/vishalYadav)\ **Replies:** 8\ **Last updated:** [October 4, 2020, 8:20am UTC](https://discuss.elastic.co/t/help-needed-in-making-a-query-for-elastic-search/250477 "2020-10-04T08:20:26Z")
Hey,I am working on a index which has 300 fieds in it.Now there is a requirement where i have to make 2 field irrelevent for searching in that index.As of now i am using \*.\* to search . i studied somewhere we can mak… --- ## [Audit Events for Elasticsearch](https://discuss.elastic.co/t/audit-events-for-elasticsearch/250885)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 6:06am UTC](https://discuss.elastic.co/t/audit-events-for-elasticsearch/250885 "2020-10-04T06:06:43Z")
Hello, Can someone explain me what is the difference between the Elasticsearch Audit Events and Kibana audit Events. I observed that my elasticsearch audit event file is much larger its is like 18 GB or much more than … --- ## [3 ESXi virtual machines, versus 3 dockers on a single ESXi virtual machine](https://discuss.elastic.co/t/3-esxi-virtual-machines-versus-3-dockers-on-a-single-esxi-virtual-machine/250884)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [October 4, 2020, 4:04am UTC](https://discuss.elastic.co/t/3-esxi-virtual-machines-versus-3-dockers-on-a-single-esxi-virtual-machine/250884 "2020-10-04T04:04:25Z")
Currently I have 3 nodes on docker on the same virtual machine , the size of a monthly indexing is 200GB, a colleague recently install APM on elastic producing an index of 135GB so now monthly indexing is 335GB, we where… --- ## [Cannot open data from 5.x in 6.x : Mappings](https://discuss.elastic.co/t/cannot-open-data-from-5-x-in-6-x-mappings/250346)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 12\ **Last updated:** [October 3, 2020, 3:40pm UTC](https://discuss.elastic.co/t/cannot-open-data-from-5-x-in-6-x-mappings/250346 "2020-10-03T15:40:51Z")
I've created a routine that updates ES clients from 5.x to 6.x and finally 7.x Somehow some clients cannot be updated. Loading existing data in 6.8 fails. Appearently some mappings are causing this. But there are not… --- ## [Elasticsearch pod stuck in CrashLoopBackOff](https://discuss.elastic.co/t/elasticsearch-pod-stuck-in-crashloopbackoff/250752)
**Author:** [@mr-davidc](https://discuss.elastic.co/u/mr-davidc)\ **Replies:** 4\ **Last updated:** [October 3, 2020, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-pod-stuck-in-crashloopbackoff/250752 "2020-10-03T15:31:01Z")
Hi all, So to outline the problem, there is a StatefulSet which specifies ES 7.4 as the container image for a set of 3 pods. 2/3 of these pods are running perfectly fine on version 7.4 however the last of the pods has s… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1209) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1211)