# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1571 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1572 --- ## [Cannot set Color Rules in TSVB](https://discuss.elastic.co/t/cannot-set-color-rules-in-tsvb/223433)
**Author:** [@Jack\_Phan](https://discuss.elastic.co/u/Jack_Phan)\ **Replies:** 2\ **Last updated:** [March 16, 2020, 3:15am UTC](https://discuss.elastic.co/t/cannot-set-color-rules-in-tsvb/223433 "2020-03-16T03:15:23Z")
I cannot click the button to set the color for a threshold in TSVB. This is when I clicked into the dropdown button: And this is what happened when I chose \>= greater than or equal option. The option was not shown… --- ## [Kibana not ready yet 7.6.1 fighting with this from last 6 days](https://discuss.elastic.co/t/kibana-not-ready-yet-7-6-1-fighting-with-this-from-last-6-days/223674)
**Author:** [@eakam](https://discuss.elastic.co/u/eakam)\ **Replies:** 1\ **Last updated:** [March 16, 2020, 12:51am UTC](https://discuss.elastic.co/t/kibana-not-ready-yet-7-6-1-fighting-with-this-from-last-6-days/223674 "2020-03-16T00:51:59Z")
hlo sir, elasticsearch, kibana , wazuh api, wazuh manager , file beat all running well but in browser kibana server is not ready yet to solves this problem i m already install the full ubuntu now i m using 18.04 ubun… --- ## [Kibana -\> Infrastructure -\> Metrics -\>\> Host Metadata](https://discuss.elastic.co/t/kibana-infrastructure-metrics-host-metadata/223197)
**Author:** [@northmilo](https://discuss.elastic.co/u/northmilo)\ **Replies:** 3\ **Last updated:** [March 15, 2020, 11:46pm UTC](https://discuss.elastic.co/t/kibana-infrastructure-metrics-host-metadata/223197 "2020-03-15T23:46:39Z")
Hi, I am a bit confused since on my Kibana -\> Infrastructure -\> Metrics -\>\> Host Metadata seems to be Hostname, Operating System, Kernel Version displayed properly and on the same setup on the other monitored host there … --- ## [Dashboard -\> Editing -\> OPTIONS -\> Customize panel](https://discuss.elastic.co/t/dashboard-editing-options-customize-panel/223402)
**Author:** [@northmilo](https://discuss.elastic.co/u/northmilo)\ **Replies:** 3\ **Last updated:** [March 15, 2020, 11:21pm UTC](https://discuss.elastic.co/t/dashboard-editing-options-customize-panel/223402 "2020-03-15T23:21:08Z")
Hi, I am having strange behavior when editing Customize panel -\> Panel title. Anytime I go Dashboard -\> Editing -\> OPTIONS -\> Customize panel I am not eble to edit Panel title by the first time. To edit the title I have… --- ## [Pipeline virtual address from Filbeat event field](https://discuss.elastic.co/t/pipeline-virtual-address-from-filbeat-event-field/223665)
**Author:** [@sjne](https://discuss.elastic.co/u/sjne)\ **Replies:** 1\ **Last updated:** [March 15, 2020, 11:16pm UTC](https://discuss.elastic.co/t/pipeline-virtual-address-from-filbeat-event-field/223665 "2020-03-15T23:16:44Z")
Is it possible to get the pipeline-to-pipeline virtual address by accessing event fields? Sort of like this: Filebeat config filebeat.inputs: - type: log enabled: true fields: { instance\_id: "first" } paths: … --- ## [How to index customized windows application logs to elatsicsearch using fluentd](https://discuss.elastic.co/t/how-to-index-customized-windows-application-logs-to-elatsicsearch-using-fluentd/223667)
**Author:** [@muralikri32](https://discuss.elastic.co/u/muralikri32)\ **Replies:** 0\ **Last updated:** [March 15, 2020, 9:31pm UTC](https://discuss.elastic.co/t/how-to-index-customized-windows-application-logs-to-elatsicsearch-using-fluentd/223667 "2020-03-15T21:31:04Z")
Hi, I have configured Fluentd on windows server (WIN 2012) and trying to tail customized application logs (which is present in C:/opt/td-agent/application.log) to elastic search. Each time when i configure and start the… --- ## [Filebeat doesnt send event.dataset and event.module](https://discuss.elastic.co/t/filebeat-doesnt-send-event-dataset-and-event-module/223662)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 0\ **Last updated:** [March 15, 2020, 7:26pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-event-dataset-and-event-module/223662 "2020-03-15T19:26:55Z")
Hi , I'm new with logstash and filebeat so I was loosing my mind trying to understand why logstash doesn't use filter and I figured out that filebeat doesn't send event.dataset and event.module fields , how can I f… --- ## [Log-stash not showing output in stdout](https://discuss.elastic.co/t/log-stash-not-showing-output-in-stdout/223610)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 7\ **Last updated:** [March 15, 2020, 7:17pm UTC](https://discuss.elastic.co/t/log-stash-not-showing-output-in-stdout/223610 "2020-03-15T19:17:49Z")
config -\> my config file logstash -f "C:\\busapps\\drsb\\gbl0\\logstash\\7.0.0\\bin\\pipelines\\logstash.conf" above is my command below is the output : \[2020-03-14T10:43:12,670\]\[WARN \]\[logstash.config.source.multilocal… --- ## [Passing to output index field but getting \[@metadata\]\[index\]](https://discuss.elastic.co/t/passing-to-output-index-field-but-getting-metadata-index/223650)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 9\ **Last updated:** [March 15, 2020, 5:50pm UTC](https://discuss.elastic.co/t/passing-to-output-index-field-but-getting-metadata-index/223650 "2020-03-15T17:50:12Z")
Hi , i'm creating index name dynamically but when I'm passing the field to output i'm getting the variable name (\[@metadata\]\[index\]): mutate { add\_field =\> { "\[@metadata\]\[index\_prefix\]" =\> "system-secure" } } outpu… --- ## [Fatal error in thread exiting](https://discuss.elastic.co/t/fatal-error-in-thread-exiting/223614)
**Author:** [@kangning1](https://discuss.elastic.co/u/kangning1)\ **Replies:** 3\ **Last updated:** [March 15, 2020, 10:53am UTC](https://discuss.elastic.co/t/fatal-error-in-thread-exiting/223614 "2020-03-15T10:53:24Z")
hi: I received an error. When es imported the data, it reported an error and exited, and the cluster stuck. Elasticsearch runs on kubernetes, using the glusterfs store. Cluster information： sh-4.2$ curl 127.0.0.1:920… --- ## [High-Cardinality Aggregation Alternate Approaches (2 million buckets)](https://discuss.elastic.co/t/high-cardinality-aggregation-alternate-approaches-2-million-buckets/222814)
**Author:** [@khickey](https://discuss.elastic.co/u/khickey)\ **Replies:** 10\ **Last updated:** [March 15, 2020, 9:11am UTC](https://discuss.elastic.co/t/high-cardinality-aggregation-alternate-approaches-2-million-buckets/222814 "2020-03-15T09:11:49Z")
Requirement: calculate a sum aggregate on a high-cardinality field of 2M unique values, order the results by the sum, and return the top 10 (or pages of 10 each). We are moving some of our materialized-view based data s… --- ## [Can we use basic licensed APM and Kibana in production?](https://discuss.elastic.co/t/can-we-use-basic-licensed-apm-and-kibana-in-production/223643)
**Author:** [@dhai](https://discuss.elastic.co/u/dhai)\ **Replies:** 1\ **Last updated:** [March 15, 2020, 8:27am UTC](https://discuss.elastic.co/t/can-we-use-basic-licensed-apm-and-kibana-in-production/223643 "2020-03-15T08:27:13Z")
Is there a license file for Basic License like Elastic License in github? --- ## [Order or Sort Serial\_diff Agg result](https://discuss.elastic.co/t/order-or-sort-serial-diff-agg-result/223647)
**Author:** [@ad1982](https://discuss.elastic.co/u/ad1982)\ **Replies:** 0\ **Last updated:** [March 15, 2020, 7:31am UTC](https://discuss.elastic.co/t/order-or-sort-serial-diff-agg-result/223647 "2020-03-15T07:31:15Z")
I am trying to sort the result of a serial\_diff agg. and struggling with that. Below is the code ET db/\_search { "size": 0, "query": { "bool": { "must": \[ { … --- ## [Aggregate return negative value for min timestamp](https://discuss.elastic.co/t/aggregate-return-negative-value-for-min-timestamp/223157)
**Author:** [@Ameed\_Ashour](https://discuss.elastic.co/u/Ameed_Ashour)\ **Replies:** 2\ **Last updated:** [March 15, 2020, 7:30am UTC](https://discuss.elastic.co/t/aggregate-return-negative-value-for-min-timestamp/223157 "2020-03-15T07:30:41Z")
Hi, I am working with ES Version: 6.2.1, I tried to get the minimum and maximum timestamp to use it for Kibana, POST/ :9200/{Index\_name}/\_search { "size": 0, "aggregations": { "minimum\_date": { "min": { "field":… --- ## [Elasticsearch + Analyzer + English dataset + French query](https://discuss.elastic.co/t/elasticsearch-analyzer-english-dataset-french-query/222432)
**Author:** [@Yassine\_Nifa](https://discuss.elastic.co/u/Yassine_Nifa)\ **Replies:** 5\ **Last updated:** [March 15, 2020, 3:32am UTC](https://discuss.elastic.co/t/elasticsearch-analyzer-english-dataset-french-query/222432 "2020-03-15T03:32:35Z")
Hey guys ! I created an attribute with "annotated\_text" to be able to recognize some entities "headline": {"type": "annotated\_text", "analyzer":"analyzer\_shingle"} Now I can for example look for "Turkey" and it return… --- ## [Some confusion about rebalance and allocation](https://discuss.elastic.co/t/some-confusion-about-rebalance-and-allocation/223622)
**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\ **Replies:** 2\ **Last updated:** [March 15, 2020, 12:49am UTC](https://discuss.elastic.co/t/some-confusion-about-rebalance-and-allocation/223622 "2020-03-15T00:49:54Z")
I'm got confuse about cluster.routing.allocation.enable and cluster.routing.rebalance.enable (1)if I set cluster.routing.allocation.enable = none cluster.routing.rebalance.enable = all still no rebalance will happen? … --- ## [Boolean fields are not indexed after upgrade to 6.8.7 from 5.6.16](https://discuss.elastic.co/t/boolean-fields-are-not-indexed-after-upgrade-to-6-8-7-from-5-6-16/223534)
**Author:** [@santhoshpt](https://discuss.elastic.co/u/santhoshpt)\ **Replies:** 1\ **Last updated:** [March 14, 2020, 9:13pm UTC](https://discuss.elastic.co/t/boolean-fields-are-not-indexed-after-upgrade-to-6-8-7-from-5-6-16/223534 "2020-03-14T21:13:11Z")
I'm trying to upgrade the org.elasticsearch:elasticsearch to 6.8.7 from 5.6.16 as part of spring boot upgrade. When trying to create index with static mappings, I have noticed no information is stored for the boolean fi… --- ## [Elasticsearch filter document ids with same field values count](https://discuss.elastic.co/t/elasticsearch-filter-document-ids-with-same-field-values-count/223635)
**Author:** [@Iwave\_Nice](https://discuss.elastic.co/u/Iwave_Nice)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 8:05pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-document-ids-with-same-field-values-count/223635 "2020-03-14T20:05:58Z")
I need to return ids of documents that have the same myField value repeated \[range\] times. i.e. I have clientName field and want to find ids of all documents where clientName = 'John' but only if this name is found in 2-… --- ## [Pipeline-to-pipeline with single input and output](https://discuss.elastic.co/t/pipeline-to-pipeline-with-single-input-and-output/223631)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 6:45pm UTC](https://discuss.elastic.co/t/pipeline-to-pipeline-with-single-input-and-output/223631 "2020-03-14T18:45:25Z")
Hi , I'm trying to configure logstash with pipelines configuration logstash pipelines: input --\> conf files with different log types (system,security, auditing ...) --\> output but it doesn't work(without errors ) ,… --- ## [How to set path.data and pidfile per conf file in Logstash Service](https://discuss.elastic.co/t/how-to-set-path-data-and-pidfile-per-conf-file-in-logstash-service/223630)
**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 6:24pm UTC](https://discuss.elastic.co/t/how-to-set-path-data-and-pidfile-per-conf-file-in-logstash-service/223630 "2020-03-14T18:24:02Z")
I am running logstash as a service using systemctl. Running logstash with systemctl runs the conf files in conf.d directory. First, How do I set path.data for each conf file in conf.d directory? Second, how to set pid… --- ## [Curl: (7) Failed to connect to localhost port 5601: Connection refused](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-localhost-port-5601-connection-refused/223605)
**Author:** [@merve](https://discuss.elastic.co/u/merve)\ **Replies:** 1\ **Last updated:** [March 14, 2020, 3:07pm UTC](https://discuss.elastic.co/t/curl-7-failed-to-connect-to-localhost-port-5601-connection-refused/223605 "2020-03-14T15:07:38Z")
Hello everyone. I have a problem with kibana. curl localhost:5601 does not work i couldn't connect with browser. when i try this commands sudo -i service kibana start sudo -i service kibana stop sudo service kibana … --- ## [Aggregate only working when timeout = 0](https://discuss.elastic.co/t/aggregate-only-working-when-timeout-0/223617)
**Author:** [@karlm](https://discuss.elastic.co/u/karlm)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 1:41pm UTC](https://discuss.elastic.co/t/aggregate-only-working-when-timeout-0/223617 "2020-03-14T13:41:21Z")
I have an Elasticsearch input that collects list of fails that have not been handled. Then aggregate the false count and output the count to an index. It only works when the timeout = 0, if i change the timeout to anyth… --- ## [\[ILM Policy\] Best compromise between size and max age](https://discuss.elastic.co/t/ilm-policy-best-compromise-between-size-and-max-age/223299)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 5\ **Last updated:** [March 14, 2020, 1:40pm UTC](https://discuss.elastic.co/t/ilm-policy-best-compromise-between-size-and-max-age/223299 "2020-03-14T13:40:54Z")
Hello Elasticians ! While testing ILM policy feature, I've just figured that the delete phase is relative to the rollover time, not the index creation time (source) Let's say I have the following ILM policy : { "im… --- ## [Urgent: Looking for advice on selecting proper Elasticsearch service type with OPTIMIZED Configuration](https://discuss.elastic.co/t/urgent-looking-for-advice-on-selecting-proper-elasticsearch-service-type-with-optimized-configuration/223492)
**Author:** [@ashik.rajbhandari](https://discuss.elastic.co/u/ashik.rajbhandari)\ **Replies:** 3\ **Last updated:** [March 14, 2020, 1:10pm UTC](https://discuss.elastic.co/t/urgent-looking-for-advice-on-selecting-proper-elasticsearch-service-type-with-optimized-configuration/223492 "2020-03-14T13:10:54Z")
We have been trying to move to Elasticsearch implementation from core Lucene and have stumbled into a couple of situations. Before asking questions relating to our complex situations, we would like to share detail inform… --- ## [Security must be explicitly enabled when using a \[basic\] license](https://discuss.elastic.co/t/security-must-be-explicitly-enabled-when-using-a-basic-license/222602)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [March 14, 2020, 12:50pm UTC](https://discuss.elastic.co/t/security-must-be-explicitly-enabled-when-using-a-basic-license/222602 "2020-03-14T12:50:24Z")
Hi , when I'm trying to open a Kibana I get :slight\_smile: Security must be explicitly enabled when using a \[basic\] license. Enable security by setting \[xpack.security.enabled\] ..... but when I set xpack.security.enab… --- ## [Where are Keystore and Truststore: How can Spark communicate with ECK by using SSL](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029)
**Author:** [@YaSe](https://discuss.elastic.co/u/YaSe)\ **Replies:** 4\ **Last updated:** [March 14, 2020, 12:38pm UTC](https://discuss.elastic.co/t/where-are-keystore-and-truststore-how-can-spark-communicate-with-eck-by-using-ssl/223029 "2020-03-14T12:38:40Z")
Hello, I followed this link to install ECK and now I want to use Spark with ECK by using SSL. I read the following documentation. However for the following configuration I don't know where to find the keystore and trust… --- ## [Push json key value with ELK](https://discuss.elastic.co/t/push-json-key-value-with-elk/223112)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 13\ **Last updated:** [March 14, 2020, 12:33pm UTC](https://discuss.elastic.co/t/push-json-key-value-with-elk/223112 "2020-03-14T12:33:33Z")
I have a lot of json like this that every day have different data: \[{ "date": "2020-02-24 21:00:00", "country": "US", "men": 101, "women": 26, "childreni": 127, }\] I tried to push this into elasticsearch but n… --- ## [UpdateByQuery API Response returns wrong status](https://discuss.elastic.co/t/updatebyquery-api-response-returns-wrong-status/223611)
**Author:** [@Om\_S\_Patel](https://discuss.elastic.co/u/Om_S_Patel)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 11:16am UTC](https://discuss.elastic.co/t/updatebyquery-api-response-returns-wrong-status/223611 "2020-03-14T11:16:41Z")
I am facing issue with UpdateByQuery API while trying to update a document which doesn’t exist in Elasticsearch Problem description Step 1 - We are creating one index for each day like test\_index-2020.03.11, test\_index… --- ## [Log stash filters log message - need help](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 5\ **Last updated:** [March 14, 2020, 11:10am UTC](https://discuss.elastic.co/t/log-stash-filters-log-message-need-help/222076 "2020-03-14T11:10:21Z")
Below are the log stash fields Log stash error : \[2020-03-02T16:48:48,354\]\[WARN \]\[logstash.filters.json \] Error parsing json {:source=\>"message", :raw=\>"WITH CORRESPONDING LINE(S)", "HoldReason": "Invoice pric… --- ## [Updating Elastic license](https://discuss.elastic.co/t/updating-elastic-license/223530)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [March 14, 2020, 10:22am UTC](https://discuss.elastic.co/t/updating-elastic-license/223530 "2020-03-14T10:22:31Z")
Hi, I got a licence key (alphanumeric sequence), but checking the documentation it requires a json file to update the license, I was wandering if you can update the license with this key that I got....or do I need some o… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1570) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1572)