# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1441 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1442 --- ## [Regex in mutate filter](https://discuss.elastic.co/t/regex-in-mutate-filter/233091)
**Author:** [@priyanshuk](https://discuss.elastic.co/u/priyanshuk)\ **Replies:** 3\ **Last updated:** [May 18, 2020, 10:13pm UTC](https://discuss.elastic.co/t/regex-in-mutate-filter/233091 "2020-05-18T22:13:43Z")
Hi, I need some help with regex in mutate Part of log in message field : "LogError":"30180" - Please note number can vary . in normal regex we can do grouping "LogError":"(\[0-9\]\[0-9\]\*)" and then get the matched regex… --- ## [Kibana migration issues after upgrade to 6.8.6](https://discuss.elastic.co/t/kibana-migration-issues-after-upgrade-to-6-8-6/232047)
**Author:** [@mrcsg](https://discuss.elastic.co/u/mrcsg)\ **Replies:** 5\ **Last updated:** [May 18, 2020, 10:07pm UTC](https://discuss.elastic.co/t/kibana-migration-issues-after-upgrade-to-6-8-6/232047 "2020-05-18T22:07:43Z")
Hi All- I recently upgraded from 5.6 to 6.8.6 and had some issues getting Kibana running. In the end I was able to get it running with deleting all the kibana indexes, deleting aliases to .kibana and then starting fresh… --- ## [(probably) dumb grok question](https://discuss.elastic.co/t/probably-dumb-grok-question/233192)
**Author:** [@Shawn\_Keslar](https://discuss.elastic.co/u/Shawn_Keslar)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 9:46pm UTC](https://discuss.elastic.co/t/probably-dumb-grok-question/233192 "2020-05-18T21:46:54Z")
an example of my data: {"protocol": 6, "recordType": 71, "eventType": 1003, "securityGroupId": 0, "userId": 9999997, "policyRevision": "00000000-0000-0000-0000-00005e5f4ab1", "iocNumber": 0, "userAgent": {"block… --- ## [Logs app: add filter](https://discuss.elastic.co/t/logs-app-add-filter/233190)
**Author:** [@asaf](https://discuss.elastic.co/u/asaf)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 9:41pm UTC](https://discuss.elastic.co/t/logs-app-add-filter/233190 "2020-05-18T21:41:02Z")
In Kibana Logs app, is there a way to add a filter (similarly to the way it's possible to do in the Discover app)? --- ## [Data Mismatch between csv and logstash](https://discuss.elastic.co/t/data-mismatch-between-csv-and-logstash/233001)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 3\ **Last updated:** [May 18, 2020, 9:03pm UTC](https://discuss.elastic.co/t/data-mismatch-between-csv-and-logstash/233001 "2020-05-18T21:03:05Z")
Hello, Need help please. I am pulling data from postgres as csv on a table. The output is one record per data (date based) and the csv file shows, the record count and field values correctly when views in a table forma… --- ## [Pie Chart Creation Assistance](https://discuss.elastic.co/t/pie-chart-creation-assistance/232891)
**Author:** [@Gundam\_Airline](https://discuss.elastic.co/u/Gundam_Airline)\ **Replies:** 2\ **Last updated:** [May 18, 2020, 9:00pm UTC](https://discuss.elastic.co/t/pie-chart-creation-assistance/232891 "2020-05-18T21:00:43Z")
Hi All, I am trying to do the following: Create a Pie Chart that will pull information from the latest documents. The problem is that our application's timestamp is being generated dynamically and there's a couple of s… --- ## [Files skipped in logstash but contained in Sincedb file](https://discuss.elastic.co/t/files-skipped-in-logstash-but-contained-in-sincedb-file/233199)
**Author:** [@aerodynamic](https://discuss.elastic.co/u/aerodynamic)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 8:50pm UTC](https://discuss.elastic.co/t/files-skipped-in-logstash-but-contained-in-sincedb-file/233199 "2020-05-18T20:50:34Z")
Hello, My current setup reads gz files from coolpath and forwards them to elasticsearch. However there are files being left behind in coolpath. input { file { id =\> "my-id" path =\> "/coolpath/\*.gz" mode … --- ## [Conditional file output with overwrite leads to empty file](https://discuss.elastic.co/t/conditional-file-output-with-overwrite-leads-to-empty-file/233198)
**Author:** [@nicklan](https://discuss.elastic.co/u/nicklan)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 8:46pm UTC](https://discuss.elastic.co/t/conditional-file-output-with-overwrite-leads-to-empty-file/233198 "2020-05-18T20:46:05Z")
I have a file output that is triggered conditionally set up as: output { if \[@metadata\]\[dofile\] { file { path =\> "/tmp/ts.out" codec =\> line { format =\> "%{\[afield\]}"} write\_behavior =\> "overwrit… --- ## [Is it possible to make tables like in Excel?](https://discuss.elastic.co/t/is-it-possible-to-make-tables-like-in-excel/229652)
**Author:** [@Oggy](https://discuss.elastic.co/u/Oggy)\ **Replies:** 8\ **Last updated:** [May 18, 2020, 8:43pm UTC](https://discuss.elastic.co/t/is-it-possible-to-make-tables-like-in-excel/229652 "2020-05-18T20:43:22Z")
What I am interested in is replicating the look and functionality of excel sheets. So I would like a way for me to be able to set some columns do mathematical caculations on other fields, and to be able to simply chose a… --- ## [\[Bug\] Output/Kafka Can't use topics with uppercase letters anymore](https://discuss.elastic.co/t/bug-output-kafka-cant-use-topics-with-uppercase-letters-anymore/233194)
**Author:** [@theoo](https://discuss.elastic.co/u/theoo)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 8:05pm UTC](https://discuss.elastic.co/t/bug-output-kafka-cant-use-topics-with-uppercase-letters-anymore/233194 "2020-05-18T20:05:58Z")
Hi there, I wanted to upgrade my winlogbeat from 7.2.0 to 7.7.0 today but had to realize that the kafka output is broken. In newer versions, the config option topic from output.kafka goes through a constSelectorExpr a… --- ## [Error Visualization Request Timeout](https://discuss.elastic.co/t/error-visualization-request-timeout/233184)
**Author:** [@nzn\_cngz](https://discuss.elastic.co/u/nzn_cngz)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 7:12pm UTC](https://discuss.elastic.co/t/error-visualization-request-timeout/233184 "2020-05-18T19:12:34Z")
Hi all, @Christian\_Dahlqvist @Lukas Olson On cluster fluentbit send log fluentd ant then elasticsearch visualize to Kibana. EFK stack summary topology elastic master(3 node) -Xms 1G -Xmx 8G elastic data(3 node)--\>p… --- ## [Logstash split function](https://discuss.elastic.co/t/logstash-split-function/233164)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 5\ **Last updated:** [May 18, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164 "2020-05-18T19:38:16Z")
Hi, I have this tag fields with value Beige, Black, Blue, boohoo, Brown, cat:dresses, DZZ56895, Green, Grey, New Arrivals, Orange, Pink, Purple, Red, subcat:cocktail:cat:dresses, White, women, Yellow, z\_global\_id:3903… --- ## [Kibana Lucene time query](https://discuss.elastic.co/t/kibana-lucene-time-query/233159)
**Author:** [@Robin020](https://discuss.elastic.co/u/Robin020)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 7:13pm UTC](https://discuss.elastic.co/t/kibana-lucene-time-query/233159 "2020-05-18T19:13:05Z")
Hi, I only want to do a query about the data from the last minute. What is the query syntax for time if you use Canvas --\> Elasticsearch Raw documents --\> Lucene queries? --- ## [How to query dynamic index settings?](https://discuss.elastic.co/t/how-to-query-dynamic-index-settings/233181)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 7:07pm UTC](https://discuss.elastic.co/t/how-to-query-dynamic-index-settings/233181 "2020-05-18T19:07:03Z")
Index Modules page lists all the available settings for an index. How do i query them? For instance, I'd like to know the setting for max\_result\_window. --- ## [MultiMatchQuery useDisMax](https://discuss.elastic.co/t/multimatchquery-usedismax/233172)
**Author:** [@Dave\_Maiman](https://discuss.elastic.co/u/Dave_Maiman)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 6:12pm UTC](https://discuss.elastic.co/t/multimatchquery-usedismax/233172 "2020-05-18T18:12:51Z")
Hello, We are in the process of upgrading to elastic cloud 7.x from 1.6. We have code that creates a MultiMatchQuery as follows: QueryBuilders.multiMatchQuery(searchQuery, ElasticQueryCreator.SEARCH\_FIELDS) … --- ## [Why is my index not growing past 4GB when using fscrawler?](https://discuss.elastic.co/t/why-is-my-index-not-growing-past-4gb-when-using-fscrawler/232838)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 6\ **Last updated:** [May 18, 2020, 5:43pm UTC](https://discuss.elastic.co/t/why-is-my-index-not-growing-past-4gb-when-using-fscrawler/232838 "2020-05-18T17:43:59Z")
So I am trying to index about 2.5TB of data using fscrawler that is about 3 million files.. I have 40GB of ram of which I have set aside 20GB heap for fscrawler for maximum throughput. C:\\Elastic\\fscrawler-MAR15\\bin\>fsc… --- ## [Query to get and Sort based on Most occurrence of a field value](https://discuss.elastic.co/t/query-to-get-and-sort-based-on-most-occurrence-of-a-field-value/233004)
**Author:** [@KVN\_REDDY](https://discuss.elastic.co/u/KVN_REDDY)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 5:28pm UTC](https://discuss.elastic.co/t/query-to-get-and-sort-based-on-most-occurrence-of-a-field-value/233004 "2020-05-18T17:28:23Z")
Hi, I am working on Recommendation engine where trying to retrieve the purchase data, I need to sort the data based on most occurrence means in order index productId is one of the field. For ex : o111, prod111, o222,… --- ## [How to calculate count of particular fields in data table in Kibana?](https://discuss.elastic.co/t/how-to-calculate-count-of-particular-fields-in-data-table-in-kibana/233014)
**Author:** [@Jaishree\_Pal](https://discuss.elastic.co/u/Jaishree_Pal)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 5:16pm UTC](https://discuss.elastic.co/t/how-to-calculate-count-of-particular-fields-in-data-table-in-kibana/233014 "2020-05-18T17:16:10Z")
Hi guys, I want to add some columns like pass/fail/total in my data table, but I don't know how to calculate the count of results and display them on data table. For example, my records have following fields: Version, … --- ## [False positive on SIEM rule SSH to the Internet](https://discuss.elastic.co/t/false-positive-on-siem-rule-ssh-to-the-internet/233070)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [May 18, 2020, 5:10pm UTC](https://discuss.elastic.co/t/false-positive-on-siem-rule-ssh-to-the-internet/233070 "2020-05-18T17:10:41Z")
Hello, This is the query for the "SSH to the Internet" Rule: network.transport: tcp and destination.port:22 and ( network.direction: outbound or ( source.ip: (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16) … --- ## [Intégrer des visualisations/dashboards de Kibana dans une application](https://discuss.elastic.co/t/integrer-des-visualisations-dashboards-de-kibana-dans-une-application/233006)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 5:06pm UTC](https://discuss.elastic.co/t/integrer-des-visualisations-dashboards-de-kibana-dans-une-application/233006 "2020-05-18T17:06:20Z")
Bonjour, je cherche à intégrer Kibana dans l'application, tout d'abord de la visualisation. Cependant, la solution avec l'iframe me convient pas (car il faut recharger l'iframe à chaque modification de paramètre). J'aim… --- ## [How exactly does max\_query\_terms works in a MLT query](https://discuss.elastic.co/t/how-exactly-does-max-query-terms-works-in-a-mlt-query/233098)
**Author:** [@lok63](https://discuss.elastic.co/u/lok63)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-exactly-does-max-query-terms-works-in-a-mlt-query/233098 "2020-05-18T16:54:59Z")
As the official documentation states, max\_query\_terms is the MAX number of query terms that will be selected. I would like to know how this works. For example if I set max\_query\_terms = 6, then using the explain paramet… --- ## [Change url param name from 'q' to 'k'?](https://discuss.elastic.co/t/change-url-param-name-from-q-to-k/233149)
**Author:** [@bwknow](https://discuss.elastic.co/u/bwknow)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:36pm UTC](https://discuss.elastic.co/t/change-url-param-name-from-q-to-k/233149 "2020-05-18T16:36:12Z")
I need to change q var name to k in the url request string. Is this possible? ie. ?q=xyz =\> ?k=xyz --- ## [While using 30 days time filter](https://discuss.elastic.co/t/while-using-30-days-time-filter/232908)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:31pm UTC](https://discuss.elastic.co/t/while-using-30-days-time-filter/232908 "2020-05-18T16:31:46Z")
While using a index pattern in kibana and Use 30 day filter Kibana gives request to elasticsearch failed. Request to Elasticsearch failed: {"error":{}} How to solve this problem --- ## [Is there good Kibana dashboard for web access log?](https://discuss.elastic.co/t/is-there-good-kibana-dashboard-for-web-access-log/232900)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:30pm UTC](https://discuss.elastic.co/t/is-there-good-kibana-dashboard-for-web-access-log/232900 "2020-05-18T16:30:13Z")
I'm collecting Nginx access logs from few websites. Looks like Kibana has Nginx dashboard, but it's for metrics. Is there any web analytics dashboard for web access logs? I see the screenshot of dashboard called "\[Log… --- ## [Обновление кластера ELK 7.3.2 до версии 7.7.0](https://discuss.elastic.co/t/elk-7-3-2-7-7-0/232857)
**Author:** [@111229](https://discuss.elastic.co/u/111229)\ **Replies:** 1\ **Last updated:** [May 18, 2020, 4:29pm UTC](https://discuss.elastic.co/t/elk-7-3-2-7-7-0/232857 "2020-05-18T16:29:31Z")
Коллеги, добрый день! Мы хотели бы произвести обновление нашего кластера (3 мастер ноды, 11 дата-нод, 1 нода координации, 2 логстэжа) с версии 7.3.2 до последний версии 7.7.0. Вопросов несколько. Есть ли риски потери… --- ## [Use Index templalte in logstash](https://discuss.elastic.co/t/use-index-templalte-in-logstash/232865)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 2\ **Last updated:** [May 18, 2020, 4:28pm UTC](https://discuss.elastic.co/t/use-index-templalte-in-logstash/232865 "2020-05-18T16:28:07Z")
Hi, I have create a new index template. I want to reference my new template in logstash configuration. Following is my configuration file input { jdbc { jdbc\_driver\_library =\> "/usr/share/java/mysql.jar" jdbc… --- ## [Rollover: from Hot to Warm nodes - limit per 'max\_concurrent\_file\_chunks' and/or 'max\_bytes\_per\_sec'?](https://discuss.elastic.co/t/rollover-from-hot-to-warm-nodes-limit-per-max-concurrent-file-chunks-and-or-max-bytes-per-sec/232998)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 5\ **Last updated:** [May 18, 2020, 4:18pm UTC](https://discuss.elastic.co/t/rollover-from-hot-to-warm-nodes-limit-per-max-concurrent-file-chunks-and-or-max-bytes-per-sec/232998 "2020-05-18T16:18:25Z")
I have hot phase indexes on certain elasticsearch nodes. Is it possible to set the index rollover data transmission rate on data flow: hot nodes =\> warm nodes? I mean, 'max\_concurrent\_file\_chunks' and/or 'max\_bytes\_per… --- ## [\[ANNOUNCEMENT\] Elasticsearch analysis lemmagen plugin update](https://discuss.elastic.co/t/announcement-elasticsearch-analysis-lemmagen-plugin-update/120707)
**Author:** [@vhyza](https://discuss.elastic.co/u/vhyza)\ **Replies:** 2\ **Last updated:** [May 18, 2020, 4:15pm UTC](https://discuss.elastic.co/t/announcement-elasticsearch-analysis-lemmagen-plugin-update/120707 "2020-05-18T16:15:52Z")
Hi, back in 2013 I wrote plugin which provides jLemmaGen lematizer with some prebuilt lexicons as elasticsearch token filter. As it turned out, lexicon license was very restrictive. The plugin was usable only for non-co… --- ## [Colonnes do not creat in elastic](https://discuss.elastic.co/t/colonnes-do-not-creat-in-elastic/233119)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 1:47pm UTC](https://discuss.elastic.co/t/colonnes-do-not-creat-in-elastic/233119 "2020-05-18T13:47:11Z")
I use logsth and filebeat for ingestion in elastic my conf logstash is input { beats { port =\> "5044" } } filter { if "fraicheur\_devgroupe" in \[tags\] { csv{ separator =\> ";" columns =\> \["NM\_APPLIC\_DECIS", "NM\_SO… --- ## [How to create Markdown widget visualization dynamically using kibana 7.7](https://discuss.elastic.co/t/how-to-create-markdown-widget-visualization-dynamically-using-kibana-7-7/233145)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 0\ **Last updated:** [May 18, 2020, 3:50pm UTC](https://discuss.elastic.co/t/how-to-create-markdown-widget-visualization-dynamically-using-kibana-7-7/233145 "2020-05-18T15:50:08Z")
Hi. I want to render data dynamically using TSVB markdown. I am using control visualization, where i am selecting one host name, according to the host name, it will check the status and render the data through markd… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1440) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1442)