# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1246 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1247 --- ## [Filebeat to Logstash to ES](https://discuss.elastic.co/t/filebeat-to-logstash-to-es/247767)
**Author:** [@slash665](https://discuss.elastic.co/u/slash665)\ **Replies:** 15\ **Last updated:** [September 8, 2020, 3:22pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-to-es/247767 "2020-09-08T15:22:15Z")
Hello, I am trying to set up a pipeline from Filebeat to Logstash to ES, following the guide from Elastic with the tutorial logs they provide, and for the love of me I just can't get it to work. This is what I've got i… --- ## [Link a Kibana field to a URL](https://discuss.elastic.co/t/link-a-kibana-field-to-a-url/247392)
**Author:** [@dandcp](https://discuss.elastic.co/u/dandcp)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 3:17pm UTC](https://discuss.elastic.co/t/link-a-kibana-field-to-a-url/247392 "2020-09-08T15:17:37Z")
I have a data table and, for the sake of making this understandable, it has several fields, but the first field is the "name". The "name" in this situation is the name of an application. I want to create the data table… --- ## [TSVB Timeline missing](https://discuss.elastic.co/t/tsvb-timeline-missing/247772)
**Author:** [@isarib](https://discuss.elastic.co/u/isarib)\ **Replies:** 9\ **Last updated:** [September 8, 2020, 2:53pm UTC](https://discuss.elastic.co/t/tsvb-timeline-missing/247772 "2020-09-08T14:53:59Z")
Displaying more than 2 days from the time picker selection will make the timeline go missing on the TSVB visualizations. Is there a fix to this? --- ## [Inconsistent Results/Doc Scores on Query](https://discuss.elastic.co/t/inconsistent-results-doc-scores-on-query/247418)
**Author:** [@Karl\_Kevilus](https://discuss.elastic.co/u/Karl_Kevilus)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 2:09pm UTC](https://discuss.elastic.co/t/inconsistent-results-doc-scores-on-query/247418 "2020-09-08T14:09:34Z")
I'm running the same query back to back on an index and the score and results come back different when I look at explain: { … --- ## [Wrong Kibana timestamp](https://discuss.elastic.co/t/wrong-kibana-timestamp/247174)
**Author:** [@bornatalebi](https://discuss.elastic.co/u/bornatalebi)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 2:07pm UTC](https://discuss.elastic.co/t/wrong-kibana-timestamp/247174 "2020-09-08T14:07:18Z")
Hello, I have a filebeat running on the same node as my ELK (single node cluster) and the timestamp shown in discover tab is +4:30 which is same as my timezone. for example this doc timestamp is : but when i querry… --- ## [Kibana 7.9 - loops back to default space selection](https://discuss.elastic.co/t/kibana-7-9-loops-back-to-default-space-selection/246996)
**Author:** [@Avinash\_D\_Silva](https://discuss.elastic.co/u/Avinash_D_Silva)\ **Replies:** 3\ **Last updated:** [September 8, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-7-9-loops-back-to-default-space-selection/246996 "2020-09-08T14:03:14Z")
I have installed elasticsearch by extracting the latest 7.9 version tar.gz method, I feel this is by the simplest method out there then install kibana using yum install, both are version 7.9 this is the issue: https://… --- ## [How to replace field value when it equals "-"](https://discuss.elastic.co/t/how-to-replace-field-value-when-it-equals/247899)
**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-to-replace-field-value-when-it-equals/247899 "2020-09-08T13:29:51Z")
How to check if fields in "Data" are equal to "-" and if so change them to something else. This is my data (There are multiple cities in this JSON file with the same fields): { "@version" =\> "1", "@timestamp" … --- ## [AMSI support](https://discuss.elastic.co/t/amsi-support/247695)
**Author:** [@WayneJLee](https://discuss.elastic.co/u/WayneJLee)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 1:09pm UTC](https://discuss.elastic.co/t/amsi-support/247695 "2020-09-08T13:09:06Z")
Hi everyone First post here and just wanna say I love what Elastic has done with the SIEM app and now endpoints. However, I've been running some tests and it doesn't seem like the Elastic Endpoint Security Agent curren… --- ## [Elasticsearch CURL Query](https://discuss.elastic.co/t/elasticsearch-curl-query/247537)
**Author:** [@Cyril\_Guiet](https://discuss.elastic.co/u/Cyril_Guiet)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 12:19pm UTC](https://discuss.elastic.co/t/elasticsearch-curl-query/247537 "2020-09-08T12:19:52Z")
Hi all ! I'm trying to merge multiple search query in ES but the result had no enough informations to match searched objects with results. How can I do that ? Thanks :slight\_smile: query sample: curl -X GET "localho… --- ## [Elastic Agent with ECK deployed stack - Fleet Manager problems](https://discuss.elastic.co/t/elastic-agent-with-eck-deployed-stack-fleet-manager-problems/246814)
**Author:** [@aguida79](https://discuss.elastic.co/u/aguida79)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 11:54am UTC](https://discuss.elastic.co/t/elastic-agent-with-eck-deployed-stack-fleet-manager-problems/246814 "2020-09-08T11:54:41Z")
Hi, I'm trying to test the new Elastic Agent on a ECK deployed stack with security enabled, so Elastic Agent ca work with it. My yaml files: elasticsearch.yaml apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elastic… --- ## [How to check whether user authorized or not when onChange of route event in kibana 7.8 OSS version](https://discuss.elastic.co/t/how-to-check-whether-user-authorized-or-not-when-onchange-of-route-event-in-kibana-7-8-oss-version/247265)
**Author:** [@Jayanth\_Mogadampalli](https://discuss.elastic.co/u/Jayanth_Mogadampalli)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 11:45am UTC](https://discuss.elastic.co/t/how-to-check-whether-user-authorized-or-not-when-onchange-of-route-event-in-kibana-7-8-oss-version/247265 "2020-09-08T11:45:23Z")
Right now, I am using elastic/kibana 7.8 OSS version code I am trying to implement authentication using Google auth by developing a plugin. Now for protecting routes, how to listen to route changes in kibana from a plu… --- ## [Field boost changes in ElasticSearch version7.6.2](https://discuss.elastic.co/t/field-boost-changes-in-elasticsearch-version7-6-2/247882)
**Author:** [@Barkha\_Jain](https://discuss.elastic.co/u/Barkha_Jain)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 11:39am UTC](https://discuss.elastic.co/t/field-boost-changes-in-elasticsearch-version7-6-2/247882 "2020-09-08T11:39:49Z")
We recently moved to ElasticSearch version 7.6.2 from version 6.2.3 The search query that we use has field boosts applied in different match queries. I was looking into the changes related to scoring of docs in the new … --- ## [Logstash is restarting automatucally with high CPU usage](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617)
**Author:** [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\ **Replies:** 5\ **Last updated:** [September 8, 2020, 10:39am UTC](https://discuss.elastic.co/t/logstash-is-restarting-automatucally-with-high-cpu-usage/246617 "2020-09-08T10:39:50Z")
Hi, i am trying to run logstash using the below command. sudo systemctl start logstash.service From below logs we can see that logstash service is started than it is stopped and restarted again. \[2020-08-27T11:56:24… --- ## [Match nested and search another value inside with more data](https://discuss.elastic.co/t/match-nested-and-search-another-value-inside-with-more-data/246743)
**Author:** [@pkly](https://discuss.elastic.co/u/pkly)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 10:07am UTC](https://discuss.elastic.co/t/match-nested-and-search-another-value-inside-with-more-data/246743 "2020-09-08T10:07:46Z")
Hi, sorry if you get this question a lot but I don't think my queries are working the way I'd expect them to. I have a nested object (let's call it tags) that looks like this: \[{"index":"en", "data": "tag\_1"}, {"index"… --- ## [Build logstash deb-package manually from source](https://discuss.elastic.co/t/build-logstash-deb-package-manually-from-source/247867)
**Author:** [@Maxim\_Lavrovichev](https://discuss.elastic.co/u/Maxim_Lavrovichev)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 10:03am UTC](https://discuss.elastic.co/t/build-logstash-deb-package-manually-from-source/247867 "2020-09-08T10:03:07Z")
Hello, I need to build a deb-package from source code of logstash (https://artifacts.elastic.co/downloads/logstash/logstash-oss-6.7.2.tar.gz). Have you any official instructions for packaging and actual debian scripts(d… --- ## [Optimal configuration of the ES cluster](https://discuss.elastic.co/t/optimal-configuration-of-the-es-cluster/247825)
**Author:** [@IliaIsakhin](https://discuss.elastic.co/u/IliaIsakhin)\ **Replies:** 7\ **Last updated:** [September 8, 2020, 9:36am UTC](https://discuss.elastic.co/t/optimal-configuration-of-the-es-cluster/247825 "2020-09-08T09:36:40Z")
Hello! My ES 7.8.0 cluster contains 5 nodes with 120 GB heap memory and 32 CPU in it. Also, I have pretty large index with 6.6kk docs and, according to \_cat/indices/ API, with store.size 59.8gb and pri.store.size 30.1gb… --- ## [Increased heap usage after updating from 7.2.0 =\> 7.8.0](https://discuss.elastic.co/t/increased-heap-usage-after-updating-from-7-2-0-7-8-0/247510)
**Author:** [@7ca884569f2642e2c488](https://discuss.elastic.co/u/7ca884569f2642e2c488)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:53am UTC](https://discuss.elastic.co/t/increased-heap-usage-after-updating-from-7-2-0-7-8-0/247510 "2020-09-08T08:53:31Z")
We updated our elastic (5 servers, two nodes each) from 7.2.0 to 7.8.0 and noticed that from this moment some new errors of type CircuitBreakingException started to occure and heap size can touch now 90-100% of available… --- ## [Can't see data from rollup index on visualizations](https://discuss.elastic.co/t/cant-see-data-from-rollup-index-on-visualizations/247060)
**Author:** [@Danylo](https://discuss.elastic.co/u/Danylo)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 8:41am UTC](https://discuss.elastic.co/t/cant-see-data-from-rollup-index-on-visualizations/247060 "2020-09-08T08:41:48Z")
Hi. I have elastic and kibana 7.8.0. I created few rollup jobs for get my old data more smaller and that jobs seems to b working in correct way. I can see this data on Discover page, but once I go to create any visualiza… --- ## [Query String with Fuzzy search using ~ operator](https://discuss.elastic.co/t/query-string-with-fuzzy-search-using-operator/247844)
**Author:** [@learning21](https://discuss.elastic.co/u/learning21)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 8:20am UTC](https://discuss.elastic.co/t/query-string-with-fuzzy-search-using-operator/247844 "2020-09-08T08:20:08Z")
Hi, I am referring to this and am able to perform a fuzzy search with query\_string in kibana. In kibana "salry~" is being searched and it returns results with "salary" due to ~ operator for fuzziness. GET help/\_se… --- ## [Multiple lines and more than one scale in one graph. How?](https://discuss.elastic.co/t/multiple-lines-and-more-than-one-scale-in-one-graph-how/247828)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 7:34am UTC](https://discuss.elastic.co/t/multiple-lines-and-more-than-one-scale-in-one-graph-how/247828 "2020-09-08T07:34:39Z")
Hi, is it possible with Kibana to achieve a chart like this: Requirements: Multiple lines of different sources More than one Y-Scale Is it possible to display data from different indices in one chart? Thanks de… --- ## [Keep order of xml in Logstash](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831)
**Author:** [@\_Louw](https://discuss.elastic.co/u/_Louw)\ **Replies:** 0\ **Last updated:** [September 8, 2020, 7:25am UTC](https://discuss.elastic.co/t/keep-order-of-xml-in-logstash/247831 "2020-09-08T07:25:03Z")
I am parsing XML-input in Logstash, and I need to keep the sorting of it, as it is relevant. Example xml: \ \ \ \ **Author:** [@amanjain](https://discuss.elastic.co/u/amanjain)\ **Replies:** 11\ **Last updated:** [September 8, 2020, 7:23am UTC](https://discuss.elastic.co/t/eck-elasticsearch-is-unavailable-and-stuck-during-upgrade-process/247314 "2020-09-08T07:23:56Z") Hello I have installed the elasticsearch cluster using ECK with (master = 3, client=2, data=40) config: indices.queries.cache.size: 20% the cluster was in Ready and Green state. Then I changed cache size to 21… --- ## [Authentications tab shows "All values returned zero"](https://discuss.elastic.co/t/authentications-tab-shows-all-values-returned-zero/240784)
**Author:** [@xhidalgo](https://discuss.elastic.co/u/xhidalgo)\ **Replies:** 14\ **Last updated:** [September 8, 2020, 6:22am UTC](https://discuss.elastic.co/t/authentications-tab-shows-all-values-returned-zero/240784 "2020-09-08T06:22:22Z")
Hi, I'm using Elastic Cloud, I have two different deployments. One in version 7.6.2 and Elastic SIEM it's working properly and one in 7.8.0 In this last version 7.8.0 , SIEM Module don't show authentications even when… --- ## [How to prevent shards of new index from assigning on only a few nodes and spread it?](https://discuss.elastic.co/t/how-to-prevent-shards-of-new-index-from-assigning-on-only-a-few-nodes-and-spread-it/247816)
**Author:** [@Lee\_Sun\_Ro](https://discuss.elastic.co/u/Lee_Sun_Ro)\ **Replies:** 6\ **Last updated:** [September 8, 2020, 5:52am UTC](https://discuss.elastic.co/t/how-to-prevent-shards-of-new-index-from-assigning-on-only-a-few-nodes-and-spread-it/247816 "2020-09-08T05:52:01Z")
When a new daily index is created, shards tend to be allocated only to a few nodes with sufficient capacity. It occurs rejected operation because these nodes take every incoming request. I want to prevent shards from… --- ## [Logs duplication](https://discuss.elastic.co/t/logs-duplication/247795)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 5:12am UTC](https://discuss.elastic.co/t/logs-duplication/247795 "2020-09-08T05:12:42Z")
Hello everyone! Suddenly, the elastic began to double logs. Each log falls into its own index and the duplicate falls into the unkown\_messages index. It seems that this started after adding new indexes, but rolling back… --- ## [java.lang.ClassCastException: org.elasticsearch.search.aggregations.bucket.terms.ParsedStringTerms cannot be cast to org.elasticsearch.search.aggregations.bucket.terms.StringTerms](https://discuss.elastic.co/t/java-lang-classcastexception-org-elasticsearch-search-aggregations-bucket-terms-parsedstringterms-cannot-be-cast-to-org-elasticsearch-search-aggregations-bucket-terms-stringterms/247615)
**Author:** [@elastic78](https://discuss.elastic.co/u/elastic78)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 5:12am UTC](https://discuss.elastic.co/t/java-lang-classcastexception-org-elasticsearch-search-aggregations-bucket-terms-parsedstringterms-cannot-be-cast-to-org-elasticsearch-search-aggregations-bucket-terms-stringterms/247615 "2020-09-08T05:12:30Z")
I am trying to get aggregations using GROUP By of an attributename and getting the below error. StringTerms strAggs = response.getAggregations().get(TermsAggregation.AGGREGATION\_PREFIX + attributeName); java.lang.Class… --- ## [Limit of total fields \[1000\] in index exceeded and nested json](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247716)
**Author:** [@Luca\_P](https://discuss.elastic.co/u/Luca_P)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 4:58am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-exceeded-and-nested-json/247716 "2020-09-08T04:58:38Z")
Hi All, I need some help to avoid the well known 'Limit of total fields \[1000\] in index exceeded' problem. I don't consider to raise the default in the settings above 1000. The culprit seems to be a field with a json v… --- ## [Search API of elasticsearch not working](https://discuss.elastic.co/t/search-api-of-elasticsearch-not-working/247748)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 4:45am UTC](https://discuss.elastic.co/t/search-api-of-elasticsearch-not-working/247748 "2020-09-08T04:45:06Z")
Hi All, I am trying to use elasticsearch from SOAP ui. DELETE and POST are working fine, however, GET is throwing error. Can someone please suggest POST http://ip:9200/test\_token/\_doc/TestService { "ServiceName" : … --- ## [Comparison of two different fields in two indexes](https://discuss.elastic.co/t/comparison-of-two-different-fields-in-two-indexes/246605)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 2\ **Last updated:** [September 8, 2020, 4:43am UTC](https://discuss.elastic.co/t/comparison-of-two-different-fields-in-two-indexes/246605 "2020-09-08T04:43:50Z")
Hi All, We have a scenario where we need to check whether this account number exists in both the indexes , is there a way or query to check the same. --- ## [Is there anyother auth method for SSO in Elasticsearch other than X-Pack](https://discuss.elastic.co/t/is-there-anyother-auth-method-for-sso-in-elasticsearch-other-than-x-pack/247169)
**Author:** [@Keerthi](https://discuss.elastic.co/u/Keerthi)\ **Replies:** 1\ **Last updated:** [September 8, 2020, 4:32am UTC](https://discuss.elastic.co/t/is-there-anyother-auth-method-for-sso-in-elasticsearch-other-than-x-pack/247169 "2020-09-08T04:32:26Z")
I Need help in setting up SSO for Elasticsearch [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1245) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1247)