# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1622 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1623 --- ## [Kibana User Session data in query](https://discuss.elastic.co/t/kibana-user-session-data-in-query/219635)
**Author:** [@gkainth](https://discuss.elastic.co/u/gkainth)\ **Replies:** 5\ **Last updated:** [February 18, 2020, 8:51am UTC](https://discuss.elastic.co/t/kibana-user-session-data-in-query/219635 "2020-02-18T08:51:12Z")
I have a question that I’m having trouble finding the answer to elsewhere. I would like to create dashboards that customize the data based on the specific user logged in. To do so, I need to provide the logged-in user’s… --- ## [Query performance issue with the very first one](https://discuss.elastic.co/t/query-performance-issue-with-the-very-first-one/219418)
**Author:** [@Anto89](https://discuss.elastic.co/u/Anto89)\ **Replies:** 5\ **Last updated:** [February 18, 2020, 8:15am UTC](https://discuss.elastic.co/t/query-performance-issue-with-the-very-first-one/219418 "2020-02-18T08:15:47Z")
The first time a query (classic full text query with a filter and a sort) is ran, it takes about 15-20s to get the result. It takes only few milliseconds for the next tries. Could anybody give me some explanations about … --- ## [Useragent filter not working properly](https://discuss.elastic.co/t/useragent-filter-not-working-properly/219731)
**Author:** [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 8:09am UTC](https://discuss.elastic.co/t/useragent-filter-not-working-properly/219731 "2020-02-18T08:09:58Z")
Hi, On my ELK Stack 7.6.0 the useragent logstash filtering not working properly. It doesn't able to get the %{os\_major} and %{os\_minor} when useragent used from windows or linux OS. But if used iOS or Android able to g… --- ## [Check if keyword is in text](https://discuss.elastic.co/t/check-if-keyword-is-in-text/219724)
**Author:** [@rcbfred](https://discuss.elastic.co/u/rcbfred)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 7:24am UTC](https://discuss.elastic.co/t/check-if-keyword-is-in-text/219724 "2020-02-18T07:24:56Z")
So I have about 22,000 Boolean-like Keywords(e.g. ("stock market") ("trading"), ("ecology"|"pollution"), etc.) in an index and I want to query for those documents whose keyword can be found in a certain text. { "ma… --- ## [Heartbeatのインデックス名を任意に指定する方法](https://discuss.elastic.co/t/heartbeat/219557)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 3\ **Last updated:** [February 18, 2020, 7:19am UTC](https://discuss.elastic.co/t/heartbeat/219557 "2020-02-18T07:19:48Z")
heartbeatからElasticsearchに送信したデータを、任意の名前でインデックス登録したいです。 以下の設定をheartbeat.ymlに設定したのですが、デフォルトのheartbeat-7.5.0-2020.02.02-000003のような名前で入ってしまいます。 考えられる原因を教えて頂けないでしょうか #==================== Elasticsearch template setting ===… --- ## [Set order to elasticsearch fields using logstash](https://discuss.elastic.co/t/set-order-to-elasticsearch-fields-using-logstash/219620)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 3:10pm UTC](https://discuss.elastic.co/t/set-order-to-elasticsearch-fields-using-logstash/219620 "2020-02-17T15:10:56Z")
Hi Below is my config i am trying to index the data from MSSQL to Elasticsearch using Logstash but field order is getting changed after getting indexed into elasticsearch. input { jdbc { jdbc\_driver\_library =\> "… --- ## [MAPS in kibana](https://discuss.elastic.co/t/maps-in-kibana/219131)
**Author:** [@vinu89](https://discuss.elastic.co/u/vinu89)\ **Replies:** 8\ **Last updated:** [February 18, 2020, 5:37am UTC](https://discuss.elastic.co/t/maps-in-kibana/219131 "2020-02-18T05:37:58Z")
How to Use the Maps for the index created by us.I checked with the below link https://www.elastic.co/guide/en/kibana/current/maps-getting-started.html but in the above link they have provided on how to work on default … --- ## [Timefieldが一つ前のドキュメントとの差分を取得したい](https://discuss.elastic.co/t/timefield/214542)
**Author:** [@sshota](https://discuss.elastic.co/u/sshota)\ **Replies:** 2\ **Last updated:** [February 18, 2020, 4:42am UTC](https://discuss.elastic.co/t/timefield/214542 "2020-02-18T04:42:22Z")
お世話になります。 あるフィールドにおいて、同一index内のtimefieldが一つ前のドキュメントとの差分を計算して取得したいのですが、そのようなことは可能でしょうか。 scripted field を使用して計算することなどを模索してみたのですが、同一ドキュメント内で異なるフィールドの差分などは取れそうでしたが、別ドキュメントの同じフィールドの差分は取れそうにありませんでした。 やりたいことのイメージ たとえば下記のようなデ… --- ## [Is there a way to ingest logs from Azure Log Analytics workspace to Logstash?](https://discuss.elastic.co/t/is-there-a-way-to-ingest-logs-from-azure-log-analytics-workspace-to-logstash/219698)
**Author:** [@iniyan.g](https://discuss.elastic.co/u/iniyan.g)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 4:06am UTC](https://discuss.elastic.co/t/is-there-a-way-to-ingest-logs-from-azure-log-analytics-workspace-to-logstash/219698 "2020-02-18T04:06:06Z")
Hi Team We are working on to develop a central monitoring solution using ELK stack. AWS and Azure are the common platform where we are planning to ingest event logs from various services to logstash for parsing and visu… --- ## [How many Elasticsearch node can add in one logstash server](https://discuss.elastic.co/t/how-many-elasticsearch-node-can-add-in-one-logstash-server/219685)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 11:51pm UTC](https://discuss.elastic.co/t/how-many-elasticsearch-node-can-add-in-one-logstash-server/219685 "2020-02-17T23:51:25Z")
In one logstash server how many elasticsearch nodes can add for only log checking purpose? --- ## [Elastic failing on Ubuntu 18 on AWS](https://discuss.elastic.co/t/elastic-failing-on-ubuntu-18-on-aws/219531)
**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Replies:** 11\ **Last updated:** [February 17, 2020, 10:10pm UTC](https://discuss.elastic.co/t/elastic-failing-on-ubuntu-18-on-aws/219531 "2020-02-17T22:10:32Z")
I've installed Elastic 7.5 on a t3a.small instance via AWS as part of a rebuild of an existing PHP application, also using Elastic on the same type of instance, although this would be Elastic 6.2 or something in the 6.x … --- ## [How to map fields from Oracle table to Index fields in Logstash?](https://discuss.elastic.co/t/how-to-map-fields-from-oracle-table-to-index-fields-in-logstash/219675)
**Author:** [@fefontana](https://discuss.elastic.co/u/fefontana)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 9:52pm UTC](https://discuss.elastic.co/t/how-to-map-fields-from-oracle-table-to-index-fields-in-logstash/219675 "2020-02-17T21:52:25Z")
Hello, It is not clear for me how to tell Logstash which field from my Oracle table corresponds to specific field of my predefined Elasticsearch index. For example, I have the following SQL configured in the .conf file … --- ## [Hosts table : host.name (alias of beat.name) used instead of agent.hostname](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088)
**Author:** [@Georgios\_Gkinis](https://discuss.elastic.co/u/Georgios_Gkinis)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 8:10pm UTC](https://discuss.elastic.co/t/hosts-table-host-name-alias-of-beat-name-used-instead-of-agent-hostname/219088 "2020-02-17T20:10:19Z")
I am using beats to forward metrics and logs to Elasticsearch. In the configuration of each beat I have setup its name manually : name: "${COMPUTERNAME}-filebeat-applications" When I go to SIEM -\> Hosts -\> table All H… --- ## [What is the best OS to install ELK](https://discuss.elastic.co/t/what-is-the-best-os-to-install-elk/219659)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 8:06pm UTC](https://discuss.elastic.co/t/what-is-the-best-os-to-install-elk/219659 "2020-02-17T20:06:56Z")
i have two servers (with similar CPU, RAM and storage but diffrent OS) one with unix and the other with microsoft Windows, i want to know what is the suitable OS fot installing ELK in terms of performance and security t… --- ## [Using 3 servers for ELK installation](https://discuss.elastic.co/t/using-3-servers-for-elk-installation/219657)
**Author:** [@snambu5878](https://discuss.elastic.co/u/snambu5878)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/using-3-servers-for-elk-installation/219657 "2020-02-17T19:10:44Z")
Hi Everyone, We have a requirement to analyse and visualize 10 TB of data using ELK and we currently have 3 physical servers(RHEL based) to perform this task. Please suggest the best and different ways to install elasti… --- ## [Как c помощью grok сделать конкатенацию строк лога с наименованием файла (и преобразовать в дату)](https://discuss.elastic.co/t/c-grok/219575)
**Author:** [@111291](https://discuss.elastic.co/u/111291)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 6:56pm UTC](https://discuss.elastic.co/t/c-grok/219575 "2020-02-17T18:56:25Z")
Добрый день! Использую связку Filebeat, elasticsearch, kibana. Забираю логи из технологического журнала 1с. Логи хранятся в файлах со следующим названием "20021318.log", маска: "ггммддчч". В самом файле каждая строка на… --- ## [Watcher & logging](https://discuss.elastic.co/t/watcher-logging/219468)
**Author:** [@StefanoM](https://discuss.elastic.co/u/StefanoM)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 6:33pm UTC](https://discuss.elastic.co/t/watcher-logging/219468 "2020-02-17T18:33:04Z")
Hi there, we have the possibility to define watches in Kibana. One action is logging. My question: Where / in which log does this log event get written to? Thanks guys! --- ## [Logstash Connection Reset by Peer](https://discuss.elastic.co/t/logstash-connection-reset-by-peer/217690)
**Author:** [@kitedj](https://discuss.elastic.co/u/kitedj)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 6:32pm UTC](https://discuss.elastic.co/t/logstash-connection-reset-by-peer/217690 "2020-02-17T18:32:07Z")
Hello, I'm trying to debug a warning message I'm getting in my Logstash logs for my Winlogbeat filter. I've tried adding the setting client\_inactivity\_timeout =\> 0 to my Logstash input filter like I read in similar issue… --- ## [Operator Upgrade causes nodes to be restarted](https://discuss.elastic.co/t/operator-upgrade-causes-nodes-to-be-restarted/219640)
**Author:** [@acondrat](https://discuss.elastic.co/u/acondrat)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 6:16pm UTC](https://discuss.elastic.co/t/operator-upgrade-causes-nodes-to-be-restarted/219640 "2020-02-17T18:16:30Z")
Hello, I noticed that upgrading the operator causes all the nodes in the cluster to be restarted. Perhaps it is because it changes the common.k8s.elastic.co/controller-version annotation on the Elasticsearch object. Th… --- ## [Aggregation of data from "many to many" relational database tables](https://discuss.elastic.co/t/aggregation-of-data-from-many-to-many-relational-database-tables/219665)
**Author:** [@tales-info](https://discuss.elastic.co/u/tales-info)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 5:56pm UTC](https://discuss.elastic.co/t/aggregation-of-data-from-many-to-many-relational-database-tables/219665 "2020-02-17T17:56:16Z")
I have the following data from "many to many" tables in a relational database: Data in Relational Database ======================================================================= Table User user max\_formation 1… --- ## [Organize Weekly Bar Graph by correct day order](https://discuss.elastic.co/t/organize-weekly-bar-graph-by-correct-day-order/216932)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 3\ **Last updated:** [February 17, 2020, 5:19pm UTC](https://discuss.elastic.co/t/organize-weekly-bar-graph-by-correct-day-order/216932 "2020-02-17T17:19:37Z")
Hi, I currently created a weekly bar graph with the following scripted field : LocalDateTime.ofInstant(Instant.ofEpochMilli(doc\['xxx'\].value.millis),ZoneId.of('Asia/Tokyo')).getDayOfWeek() and the graph looks somethin… --- ## [Dudas de Novato](https://discuss.elastic.co/t/dudas-de-novato/219663)
**Author:** [@ronsalas](https://discuss.elastic.co/u/ronsalas)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 5:18pm UTC](https://discuss.elastic.co/t/dudas-de-novato/219663 "2020-02-17T17:18:40Z")
Buenos dias, Soy nuevo con el tema de elastic y tengo las siguientes dudas: para notificar alertas de infraestructura en elastic es necesario pagar el licenciamiento para tener watcher o existe alguna otra integracio… --- ## [Parquet Format Output to S3](https://discuss.elastic.co/t/parquet-format-output-to-s3/216273)
**Author:** [@stranjer](https://discuss.elastic.co/u/stranjer)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 5:08pm UTC](https://discuss.elastic.co/t/parquet-format-output-to-s3/216273 "2020-02-17T17:08:30Z")
Is there a way to have Logstash output to an S3 bucket in Parquet format, preferably using Snappy compression? I see there is an Avro codec but not Parquet one, and a Webhdfs output plugin that allows Snappy compression… --- ## [Access integer array via doc without sorting?](https://discuss.elastic.co/t/access-integer-array-via-doc-without-sorting/219499)
**Author:** [@PhracturedBlue](https://discuss.elastic.co/u/PhracturedBlue)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 4:43pm UTC](https://discuss.elastic.co/t/access-integer-array-via-doc-without-sorting/219499 "2020-02-17T16:43:56Z")
I was trying to do some scripting on the new 'histogram' datatype that comes with 7.6, but histograms don't support scripting. I thought I might be able to use arrays instead, but have not had any luck because arrays ar… --- ## [APM UI query bar broken](https://discuss.elastic.co/t/apm-ui-query-bar-broken/219595)
**Author:** [@heydo](https://discuss.elastic.co/u/heydo)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 4:20pm UTC](https://discuss.elastic.co/t/apm-ui-query-bar-broken/219595 "2020-02-17T16:20:19Z")
Kibana version: 7.5.1 Elasticsearch version: 7.5.1 APM Server version: 7.5.1 APM Agent language and version: Java Agent on version 1.12.0 Is there anything special in your setup? All services run on docker Descripti… --- ## [Export data](https://discuss.elastic.co/t/export-data/219184)
**Author:** [@jof300](https://discuss.elastic.co/u/jof300)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 4:10pm UTC](https://discuss.elastic.co/t/export-data/219184 "2020-02-17T16:10:51Z")
Hi, We have a cluster of 7 nodes which is growing up fastly. We want to find a way to "archive" some logs that we must keep (legal inquiries) for several years. I would like to know if there is a solution / command / w… --- ## [Elastic APM Angular Rum - 0.4.1 - Sourcemap publish to APM](https://discuss.elastic.co/t/elastic-apm-angular-rum-0-4-1-sourcemap-publish-to-apm/219415)
**Author:** [@sureshkumargarlapati](https://discuss.elastic.co/u/sureshkumargarlapati)\ **Replies:** 3\ **Last updated:** [February 17, 2020, 3:42pm UTC](https://discuss.elastic.co/t/elastic-apm-angular-rum-0-4-1-sourcemap-publish-to-apm/219415 "2020-02-17T15:42:27Z")
How do we publish source maps from angular project? --- ## [Possible Feature Request - Context (surrounding docs) based on non-timestamp fields](https://discuss.elastic.co/t/possible-feature-request-context-surrounding-docs-based-on-non-timestamp-fields/219355)
**Author:** [@aidofitz](https://discuss.elastic.co/u/aidofitz)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 3:40pm UTC](https://discuss.elastic.co/t/possible-feature-request-context-surrounding-docs-based-on-non-timestamp-fields/219355 "2020-02-17T15:40:59Z")
Hi all, I'll describe what I'd like to achieve, and appreciate your views on if it makes sense! We're using ELK for log aggregation and analysis. We ingest multiple log files in real time from multiple servers. One of … --- ## [Grok expression with if for Elasticseach](https://discuss.elastic.co/t/grok-expression-with-if-for-elasticseach/219623)
**Author:** [@Cuju](https://discuss.elastic.co/u/Cuju)\ **Replies:** 7\ **Last updated:** [February 17, 2020, 3:38pm UTC](https://discuss.elastic.co/t/grok-expression-with-if-for-elasticseach/219623 "2020-02-17T15:38:44Z")
Hello, I would like to know if there is a possibility to make the if condition within a grok for Logstash, but for Elasticsearch ? I don't use Logstash but Filebeat Regards. --- ## [Does multiline codec expects log message into a field called \ field for processing?](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636)
**Author:** [@Febin\_Stephen](https://discuss.elastic.co/u/Febin_Stephen)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 3:32pm UTC](https://discuss.elastic.co/t/does-multiline-codec-expects-log-message-into-a-field-called-message-field-for-processing/219636 "2020-02-17T15:32:32Z")
We collect logs from journald default location where docker containers puts logs through stderr/stdout. default field name for log message is "log". If i want to use multi codec plugin inside logstash does it expect log … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1621) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1623)