# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1523 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1524 --- ## [Bar chart comparing time frames](https://discuss.elastic.co/t/bar-chart-comparing-time-frames/226950)
**Author:** [@Graphity](https://discuss.elastic.co/u/Graphity)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 1:20pm UTC](https://discuss.elastic.co/t/bar-chart-comparing-time-frames/226950 "2020-04-09T13:20:36Z")
Dear fellow users, so, I'm new to Kibana and don't know how to accomplish the following task. I would be very if someone could help me with that. I have a data set of bookings, where each booking has a startTimestamp a… --- ## [Count on Scripted Field](https://discuss.elastic.co/t/count-on-scripted-field/227308)
**Author:** [@nachomartin](https://discuss.elastic.co/u/nachomartin)\ **Replies:** 2\ **Last updated:** [April 9, 2020, 1:15pm UTC](https://discuss.elastic.co/t/count-on-scripted-field/227308 "2020-04-09T13:15:10Z")
Hi there, just starting with this. Is there any way to create a scripted field, that allows you to count and add a condition? For example, I would like to check if a Test failed the last 3 times (using doc\['outcome')\] … --- ## [Installing things on ES startup](https://discuss.elastic.co/t/installing-things-on-es-startup/226913)
**Author:** [@TimWardFS](https://discuss.elastic.co/u/TimWardFS)\ **Replies:** 5\ **Last updated:** [April 9, 2020, 1:14pm UTC](https://discuss.elastic.co/t/installing-things-on-es-startup/226913 "2020-04-09T13:14:22Z")
How to make sure something gets installed into ES on startup? Just right now I'm looking at users and roles, but there are probably other things we want to get in through the HTTP API after ES has started up but before c… --- ## [Markdown link with current filter](https://discuss.elastic.co/t/markdown-link-with-current-filter/226245)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 8\ **Last updated:** [April 9, 2020, 1:06pm UTC](https://discuss.elastic.co/t/markdown-link-with-current-filter/226245 "2020-04-09T13:06:10Z")
hello, Is there an option to implement the following: a user finds an interesting case in Dashboard #1, after filtering to a timeframe of 10 minutes , click on a link (markdown?) to drill down the case in dashboard 2, … --- ## [Minor security vulnerability](https://discuss.elastic.co/t/minor-security-vulnerability/217244)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 12:57pm UTC](https://discuss.elastic.co/t/minor-security-vulnerability/217244 "2020-04-09T12:57:47Z")
There was a minor vulnerability reported with JDK 1.13.0 1 I'm guessing we have to wait till this image is updated to use the newest minor version? --- ## [No X-PACK plugins loaded by default?](https://discuss.elastic.co/t/no-x-pack-plugins-loaded-by-default/224270)
**Author:** [@doctor](https://discuss.elastic.co/u/doctor)\ **Replies:** 2\ **Last updated:** [April 9, 2020, 12:52pm UTC](https://discuss.elastic.co/t/no-x-pack-plugins-loaded-by-default/224270 "2020-04-09T12:52:18Z")
Hey, I read that in ECK, the X-PACK plugins were already loaded. But when I try GET /\_cat/plugins I get nothing. Is this because X-PACK is not in the style of plugins anymore and its already there as core funtionnalit… --- ## [How to create an index\_2 containing Index\_1's aggregations results as fields?](https://discuss.elastic.co/t/how-to-create-an-index-2-containing-index-1s-aggregations-results-as-fields/227110)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 8\ **Last updated:** [April 9, 2020, 11:52am UTC](https://discuss.elastic.co/t/how-to-create-an-index-2-containing-index-1s-aggregations-results-as-fields/227110 "2020-04-09T11:52:14Z")
How to create an index\_2 containing Index\_1's aggregations results as fields ? Is it possible to use a command like this on kibana dev tools ? PUT /index\_2/doc\_aggs\_results\_of\_index1 { field\_aggs1: ... field\_aggs2: … --- ## [Elastic operator all-in-one can read all secrets in all namespaces](https://discuss.elastic.co/t/elastic-operator-all-in-one-can-read-all-secrets-in-all-namespaces/226218)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 11:48am UTC](https://discuss.elastic.co/t/elastic-operator-all-in-one-can-read-all-secrets-in-all-namespaces/226218 "2020-04-09T11:48:37Z")
The Elastic operator all-in-one install can read all secrets in all namespaces. Are there plans to make it more secure? --- ## [Dissect json fields in a specific field](https://discuss.elastic.co/t/dissect-json-fields-in-a-specific-field/227301)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 11:28am UTC](https://discuss.elastic.co/t/dissect-json-fields-in-a-specific-field/227301 "2020-04-09T11:28:59Z")
Hi, I would like to know if it is possible to use the json parser to add thes fields result in a chosen field instead of just in the "\_source" field. for example: message = "{'step': 1, 'completed': true}" filter{ … --- ## [Same Grok Filter for two somehow similar logs](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242)
**Author:** [@Ismail\_Zam\_Zam](https://discuss.elastic.co/u/Ismail_Zam_Zam)\ **Replies:** 2\ **Last updated:** [April 9, 2020, 10:51am UTC](https://discuss.elastic.co/t/same-grok-filter-for-two-somehow-similar-logs/227242 "2020-04-09T10:51:15Z")
type=EXECVE msg=audit(1585994474.430:1397): argc=5 a0="script" a1="-q" a2="-c" a3=6563686F2044415441 a4="file\_to\_write" type=EXECVE msg=audit(1585994474.430:1397): argc=2 a0="apt-get" a1="install" I want to parse these… --- ## [Should we be allowed to use http filter to get log data?](https://discuss.elastic.co/t/should-we-be-allowed-to-use-http-filter-to-get-log-data/227298)
**Author:** [@SHINRA](https://discuss.elastic.co/u/SHINRA)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 10:35am UTC](https://discuss.elastic.co/t/should-we-be-allowed-to-use-http-filter-to-get-log-data/227298 "2020-04-09T10:35:37Z")
Problem: We need to dynamically change http request URL to fetch data. I figured that one cannot simply change URL dynamically; instead I found a few ways to go around it: exec input filter with curl and some scriptin… --- ## [How to extract only required content from a logfile and send it to filter parsing in logstash config file](https://discuss.elastic.co/t/how-to-extract-only-required-content-from-a-logfile-and-send-it-to-filter-parsing-in-logstash-config-file/226644)
**Author:** [@poddraj](https://discuss.elastic.co/u/poddraj)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 10:39am UTC](https://discuss.elastic.co/t/how-to-extract-only-required-content-from-a-logfile-and-send-it-to-filter-parsing-in-logstash-config-file/226644 "2020-04-09T10:39:10Z")
Hi All, I am pretty new to Logstash and I have an unstructured C++ log file from which I want to send only selected content of log to kafka topic from logstash. Below is the sample log file, can someone help with the co… --- ## [Optimised Keep Alive Time for Scroll API](https://discuss.elastic.co/t/optimised-keep-alive-time-for-scroll-api/227284)
**Author:** [@Ulpcan](https://discuss.elastic.co/u/Ulpcan)\ **Replies:** 4\ **Last updated:** [April 9, 2020, 10:14am UTC](https://discuss.elastic.co/t/optimised-keep-alive-time-for-scroll-api/227284 "2020-04-09T10:14:12Z")
Hello, I want export my documents using Scroll API or search after request but I can't decide which one should I use. First of all, I have 2 different index. First one is constant, I mean index document size is constan… --- ## [How to add new item inside Array in elastic search?](https://discuss.elastic.co/t/how-to-add-new-item-inside-array-in-elastic-search/227057)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 6\ **Last updated:** [April 9, 2020, 9:54am UTC](https://discuss.elastic.co/t/how-to-add-new-item-inside-array-in-elastic-search/227057 "2020-04-09T09:54:52Z")
Hi Guys, I am new in Elastic Search, I want to add new object inside JArray, How I can achive this? "OrgDetailsLst" : \[ { "EntityId" : 3, "EntityDetailCode" : 0, "EntityName" : "PlantCode", "EntityCode" : "DRES", … --- ## [How to create an index\_2 containing Index\_1's aggregations results?](https://discuss.elastic.co/t/how-to-create-an-index-2-containing-index-1s-aggregations-results/227285)
**Author:** [@oula\_oula](https://discuss.elastic.co/u/oula_oula)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 9:14am UTC](https://discuss.elastic.co/t/how-to-create-an-index-2-containing-index-1s-aggregations-results/227285 "2020-04-09T09:14:28Z")
How to create an index\_2 containing Index\_1's aggregations results as fields ? Is it possible to use a command like this on kibana dev tools ? PUT /index\_2/doc\_aggs\_results\_of\_index1 { field\_aggs1: ... field\_aggs2: … --- ## [Packetbeatの処理能力について](https://discuss.elastic.co/t/packetbeat/227281)
**Author:** [@gelgoog99](https://discuss.elastic.co/u/gelgoog99)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 8:55am UTC](https://discuss.elastic.co/t/packetbeat/227281 "2020-04-09T08:55:36Z")
packetbeatですが、どれくらいのトラフィックを処理できるものなのでしょうか。 10Mbps なのか 100 なのか、それとももっといけるのか。 ただこのフォーラムをみていると、あまりさばけないという話も以前ありました。 環境によって異なるとは思いますが、こういった構成でこれくらいのトラフィックを捌いている、みたいな実績等あれば教えていただけないでしょうか。 --- ## [Logrotate delete old files](https://discuss.elastic.co/t/logrotate-delete-old-files/227279)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 8:43am UTC](https://discuss.elastic.co/t/logrotate-delete-old-files/227279 "2020-04-09T08:43:57Z")
Hi, I am using elasticsearch 7.5.2. Elasticsearch is rotating its logs each day by default. How can I configure elasticsearch to keep only the last 7 days for example? What is best practice? If possible I don't want t… --- ## [ES5 -\> ES6 -\> ES7, Snapshot Restore, Reindex, Index Size increase](https://discuss.elastic.co/t/es5-es6-es7-snapshot-restore-reindex-index-size-increase/227263)
**Author:** [@thoro\_cf](https://discuss.elastic.co/u/thoro_cf)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 8:28am UTC](https://discuss.elastic.co/t/es5-es6-es7-snapshot-restore-reindex-index-size-increase/227263 "2020-04-09T08:28:07Z")
Hi, so I'm migrating ES5 to ES7 by loading indices in ES6, then reindexing them, doing a snapshot, and then loading the snapshot in ES7 and doing another reindex. I have noticed that the index size varies dramatically. … --- ## [Best Approach for Processing Search Queries through Stored Database](https://discuss.elastic.co/t/best-approach-for-processing-search-queries-through-stored-database/227268)
**Author:** [@Prajakta\_Memane](https://discuss.elastic.co/u/Prajakta_Memane)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 7:49am UTC](https://discuss.elastic.co/t/best-approach-for-processing-search-queries-through-stored-database/227268 "2020-04-09T07:49:00Z")
If I am not using real time data for querying and processing my search results , For Example i have 2 3 files (csv or excel or json) which contains millions of records . Now i want to search my input query result with my… --- ## [Host.name fill problem](https://discuss.elastic.co/t/host-name-fill-problem/222668)
**Author:** [@janszo](https://discuss.elastic.co/u/janszo)\ **Replies:** 4\ **Last updated:** [March 10, 2020, 2:10pm UTC](https://discuss.elastic.co/t/host-name-fill-problem/222668 "2020-03-10T14:10:41Z")
I need some help. I read a lot about kibana, elasticsearch and logstash, but I'm get stucked. We've 2 vm's with ubuntu 18.04. on of them is the kibana with elasticsearch (1st) the other is a rsyslog collector (2nd). The… --- ## [Visualization without relationship](https://discuss.elastic.co/t/visualization-without-relationship/226725)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [April 9, 2020, 7:33am UTC](https://discuss.elastic.co/t/visualization-without-relationship/226725 "2020-04-09T07:33:08Z")
Hi, can I search somehow (interface/api) visualizations, that are NOT related to any dashboard? thanks --- ## [Advanced JSON input option in Datatable is not supporting aggregation](https://discuss.elastic.co/t/advanced-json-input-option-in-datatable-is-not-supporting-aggregation/227088)
**Author:** [@RamyaGowda](https://discuss.elastic.co/u/RamyaGowda)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 7:25am UTC](https://discuss.elastic.co/t/advanced-json-input-option-in-datatable-is-not-supporting-aggregation/227088 "2020-04-09T07:25:20Z")
Hello Team, I am trying to take a percentage value using two fields in data table visualization , though Data tables doesn't support bucket script or Math ,i am trying to write my aggregation query inside Advanced opti… --- ## [Date extract in elastic is showing as String Type and NOT Date](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075)
**Author:** [@Praveen\_V](https://discuss.elastic.co/u/Praveen_V)\ **Replies:** 3\ **Last updated:** [April 9, 2020, 7:14am UTC](https://discuss.elastic.co/t/date-extract-in-elastic-is-showing-as-string-type-and-not-date/227075 "2020-04-09T07:14:20Z")
Extract is working fine , however this is still represented as String rather than Date.. Any help here would be much appreciated Sample data : 2020-04-06 05:16:36: test again curl -X PUT "localhost:9200/\_ingest/pipeli… --- ## [Watcher alert telegram count fields](https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247)
**Author:** [@Silver](https://discuss.elastic.co/u/Silver)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247 "2020-04-09T06:14:15Z")
The watcher script should be able to calculate the total.hits for each user and show the count based on it. Right now my query is flooding with too many duplicate entries. "trigger": { "schedule": { "interva… --- ## [Error has occured trying to edit kibana-logs-ui-default-default-log-entry-categories-count ml job model memory limit](https://discuss.elastic.co/t/error-has-occured-trying-to-edit-kibana-logs-ui-default-default-log-entry-categories-count-ml-job-model-memory-limit/224264)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 18\ **Last updated:** [April 9, 2020, 6:45am UTC](https://discuss.elastic.co/t/error-has-occured-trying-to-edit-kibana-logs-ui-default-default-log-entry-categories-count-ml-job-model-memory-limit/224264 "2020-04-09T06:45:35Z")
Hello, It seems I hit hard limit for the memory ml model of 'kibana-logs-ui-default-default-log-entry-categories-count' So I stopped the datafeed, closed the job, edit the job and try to edit the Model memory limit f… --- ## [Find a visualize by its name](https://discuss.elastic.co/t/find-a-visualize-by-its-name/227179)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 2\ **Last updated:** [April 9, 2020, 6:29am UTC](https://discuss.elastic.co/t/find-a-visualize-by-its-name/227179 "2020-04-09T06:29:21Z")
Hi, i don't understand how the search field working in Visualize screen. My Visu is named "abc good job" i've trying some syntaxes : "abc good job" ==\> good result "abc" ==\> KO ! "abc good \*" ==\> KO ! "abc good ?o… --- ## [Question about some details for Query Phase](https://discuss.elastic.co/t/question-about-some-details-for-query-phase/227232)
**Author:** [@Hyunsoo\_Shim](https://discuss.elastic.co/u/Hyunsoo_Shim)\ **Replies:** 3\ **Last updated:** [April 9, 2020, 5:46am UTC](https://discuss.elastic.co/t/question-about-some-details-for-query-phase/227232 "2020-04-09T05:46:25Z")
Dear All, Could you let me know how to process "Query Phase" exactly when an index has replicas? For all I know, The coordinating node sends Query to every shard for Query Phase. I want to understand the exact meaning… --- ## [An REST API which can Filter Based on field](https://discuss.elastic.co/t/an-rest-api-which-can-filter-based-on-field/227058)
**Author:** [@nikhilmahipathi555](https://discuss.elastic.co/u/nikhilmahipathi555)\ **Replies:** 3\ **Last updated:** [April 9, 2020, 5:42am UTC](https://discuss.elastic.co/t/an-rest-api-which-can-filter-based-on-field/227058 "2020-04-09T05:42:03Z")
Hi, I need a Search API that can filter based on a field value in the response body. e.g: I need to filter based on TYPE value { "took": 12, "responses": \[ { "took": 12, "t… --- ## [Transform creating field as keyword instead of text](https://discuss.elastic.co/t/transform-creating-field-as-keyword-instead-of-text/227183)
**Author:** [@kernsb](https://discuss.elastic.co/u/kernsb)\ **Replies:** 1\ **Last updated:** [April 9, 2020, 5:27am UTC](https://discuss.elastic.co/t/transform-creating-field-as-keyword-instead-of-text/227183 "2020-04-09T05:27:11Z")
So I have created two Transforms that have a common field of "computer\_name", but when creating them one maps the field as text, with a sub keyword field, while the other marks the top field as keyword. I have created a… --- ## [Match phrase prefix query not working as expected](https://discuss.elastic.co/t/match-phrase-prefix-query-not-working-as-expected/227233)
**Author:** [@oneoneonepig](https://discuss.elastic.co/u/oneoneonepig)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 5:15am UTC](https://discuss.elastic.co/t/match-phrase-prefix-query-not-working-as-expected/227233 "2020-04-09T05:15:56Z")
According to the documents: Match phrase prefix query Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1522) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1524)