# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=772 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 773 --- ## [Sorting case insensitive](https://discuss.elastic.co/t/sorting-case-insensitive/289875)
**Author:** [@Lyes\_Ouchene](https://discuss.elastic.co/u/Lyes_Ouchene)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 11:31pm UTC](https://discuss.elastic.co/t/sorting-case-insensitive/289875 "2021-11-22T23:31:00Z")
Hello, can i add a property to make sorting against a field case insensitive in logstash. Thank you. --- ## [How far back in time does the Elastic Endpoint Security platform grab logs?](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447)
**Author:** [@geekzy](https://discuss.elastic.co/u/geekzy)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 10:32pm UTC](https://discuss.elastic.co/t/how-far-back-in-time-does-the-elastic-endpoint-security-platform-grab-logs/289447 "2021-11-22T22:32:45Z")
We recently deployed elastic agent with endpoint security enabled across an environment and started seeing event logs from months prior to the agent being installed. This is brilliant from a visibility point of view, how… --- ## [Auto kill queries taking more time](https://discuss.elastic.co/t/auto-kill-queries-taking-more-time/289775)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 6\ **Last updated:** [November 22, 2021, 9:02pm UTC](https://discuss.elastic.co/t/auto-kill-queries-taking-more-time/289775 "2021-11-22T21:02:09Z")
We are using 7.3 ES. Due to few bad queries fired by end user, ES CPU/Memory jumps to very high and impacts all others. We want to know any way to stop those long-running queries and return 429 or some status, so the cli… --- ## [Kibana iFrame with NodeJS Reverse proxy](https://discuss.elastic.co/t/kibana-iframe-with-nodejs-reverse-proxy/289363)
**Author:** [@jorisvo2](https://discuss.elastic.co/u/jorisvo2)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 8:45pm UTC](https://discuss.elastic.co/t/kibana-iframe-with-nodejs-reverse-proxy/289363 "2021-11-22T20:45:02Z")
Hi everybody :slight\_smile: I've a quick question for you ! Somebody here have already created a reverse proxy with NodeJS to get an access to Kibana Dashboard without need to be logged ? The only answers on Google is… --- ## [Kibana spaces fail to get status for filebeat agent while setup](https://discuss.elastic.co/t/kibana-spaces-fail-to-get-status-for-filebeat-agent-while-setup/289452)
**Author:** [@Rahul\_Kalshetty](https://discuss.elastic.co/u/Rahul_Kalshetty)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 8:21pm UTC](https://discuss.elastic.co/t/kibana-spaces-fail-to-get-status-for-filebeat-agent-while-setup/289452 "2021-11-22T20:21:17Z")
Im using filebeat to push my logs to Elasticsearch directly. I have configured a kibana space in filebeat.yml but it is giving me error saying Exiting: error connecting to Kibana: fail to get the Kibana version: HTTP GE… --- ## [Error uploading ndjson files to /api/saved\_objects/\_import : returned 406](https://discuss.elastic.co/t/error-uploading-ndjson-files-to-api-saved-objects-import-returned-406/289618)
**Author:** [@lokeshv1989](https://discuss.elastic.co/u/lokeshv1989)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 8:06pm UTC](https://discuss.elastic.co/t/error-uploading-ndjson-files-to-api-saved-objects-import-returned-406/289618 "2021-11-22T20:06:03Z")
Hi, we are trying to build powershell script to import the ndjson (Diskutilization.ndjson) file into Kibana. $upload\_object = $es\_url + “/api/saved\_objects/\_import?overwrite=true” $form = @{ file = Get-Content -Raw -P… --- ## [Logstash JMX input plugin cannot load Cassandra configuration](https://discuss.elastic.co/t/logstash-jmx-input-plugin-cannot-load-cassandra-configuration/289273)
**Author:** [@Erkan\_SIRIN](https://discuss.elastic.co/u/Erkan_SIRIN)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 7:24pm UTC](https://discuss.elastic.co/t/logstash-jmx-input-plugin-cannot-load-cassandra-configuration/289273 "2021-11-22T19:24:20Z")
I am trying to get Cassandra metrics through logstash jmx input. My logstash pipeline conf: /etc/logstash/conf.d/cassandra\_jmx.conf input { jmx { path =\> "/etc/logstash/jmxconf" polling\_frequency =\> 15 … --- ## [Disk capacity for elasticsearch](https://discuss.elastic.co/t/disk-capacity-for-elasticsearch/289816)
**Author:** [@Kapila](https://discuss.elastic.co/u/Kapila)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 4:25pm UTC](https://discuss.elastic.co/t/disk-capacity-for-elasticsearch/289816 "2021-11-22T16:25:37Z")
I want to ship my application log files into Elasticsearch and trying to come-up with a capacity plan for Elasticsearch. Let's say if I have 1 GB log file, how much disk space I need for Elasticsearch to store log conte… --- ## [Filebeat \> logstash "Invalid FieldReference" in the log](https://discuss.elastic.co/t/filebeat-logstash-invalid-fieldreference-in-the-log/289747)
**Author:** [@gyurgyalag](https://discuss.elastic.co/u/gyurgyalag)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-logstash-invalid-fieldreference-in-the-log/289747 "2021-11-22T14:47:38Z")
seems there are similare topics to this without answer 1 and one suggests there is no solution 2 But I ask anyway maybe somebody can help. This is the error: ^\[\[Alogstash | \[2021-11-20T16:57:20,868\]\[INFO \]\[org.log… --- ## ["Unable to save document" while indexing document](https://discuss.elastic.co/t/unable-to-save-document-while-indexing-document/289809)
**Author:** [@Subhasis\_Dash](https://discuss.elastic.co/u/Subhasis_Dash)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 2:37pm UTC](https://discuss.elastic.co/t/unable-to-save-document-while-indexing-document/289809 "2021-11-22T14:37:55Z")
HI, Using app search and Elasticsearch version 7.10 A few ids have got corrupted while indexing appsearch, now when i am trying to index them even v through Postman i get \[ { "id": "123456a2-e619-43f9-98c2… --- ## [Elasticsearch remove fields](https://discuss.elastic.co/t/elasticsearch-remove-fields/289442)
**Author:** [@hellotty](https://discuss.elastic.co/u/hellotty)\ **Replies:** 12\ **Last updated:** [November 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/elasticsearch-remove-fields/289442 "2021-11-22T14:27:22Z")
Hello! i'm using: elasticsearch 7.13.2 kibana 7.12.1 I am trying to remove index pattern fields in kibana -\> dev tools using the following command POST /mdaemon\_test\_array\_2\_step-2021.11.16\_test\_reindex/\_update\_by\_… --- ## [Elasticsearch plugin-install don't use the proper Java version](https://discuss.elastic.co/t/elasticsearch-plugin-install-dont-use-the-proper-java-version/289269)
**Author:** [@Jeremy\_Gachet](https://discuss.elastic.co/u/Jeremy_Gachet)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 12:50pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-install-dont-use-the-proper-java-version/289269 "2021-11-22T12:50:28Z")
Hello, I try to install the OpenNlp plugin on my local machine with the command bin/elasticsearch-plugin install https://github.com/spinscale/elasticsearch-ingest-opennlp/releases/download/7.15.2.1/ingest-opennlp-7.15.… --- ## [Few questions on running elasticsearch with free license](https://discuss.elastic.co/t/few-questions-on-running-elasticsearch-with-free-license/289801)
**Author:** [@prat1](https://discuss.elastic.co/u/prat1)\ **Replies:** 2\ **Last updated:** [November 22, 2021, 12:08pm UTC](https://discuss.elastic.co/t/few-questions-on-running-elasticsearch-with-free-license/289801 "2021-11-22T12:08:40Z")
Hi Team, Is there any limit on the number of GB of logs per day, say in filebeat processing of GBs of data or in logstash ingestion or any limit on elasticsearch storage of GBs of data in free license of Elasticsearch? … --- ## [How can I turn off the security warning popup in kibana Discover UI](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560)
**Author:** [@wabrit](https://discuss.elastic.co/u/wabrit)\ **Replies:** 2\ **Last updated:** [November 22, 2021, 11:44am UTC](https://discuss.elastic.co/t/how-can-i-turn-off-the-security-warning-popup-in-kibana-discover-ui/289560 "2021-11-22T11:44:14Z")
I'm running es/kibana 7.15.1 with security disabled in es, but the kibana discovery screen is unusable because of the constant appearance of these popups: Is there any way to turn them off? --- ## [Tuning search results for Kibana](https://discuss.elastic.co/t/tuning-search-results-for-kibana/288623)
**Author:** [@amcgrawRVA](https://discuss.elastic.co/u/amcgrawRVA)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 11:14am UTC](https://discuss.elastic.co/t/tuning-search-results-for-kibana/288623 "2021-11-22T11:14:50Z")
I am a non-coder musicologist using Elastic to search and visualize a large music-related dataset. I would like to tune search on my full text fields. Tuning search is straightforward in app search and in the dev tools c… --- ## [Filebeat -\> logstash -\> elastic](https://discuss.elastic.co/t/filebeat-logstash-elastic/289469)
**Author:** [@alaine](https://discuss.elastic.co/u/alaine)\ **Replies:** 5\ **Last updated:** [November 22, 2021, 10:47am UTC](https://discuss.elastic.co/t/filebeat-logstash-elastic/289469 "2021-11-22T10:47:27Z")
I was using logstash to forward filebeat info (zeek and suricata) to the elastic cluster I manage. Filebeat is 7.12.0 and logstash and elastic are version 7.13.4. It was working without a problem until yesterday. I am n… --- ## [Order by dynamically by a field in bar chart](https://discuss.elastic.co/t/order-by-dynamically-by-a-field-in-bar-chart/289579)
**Author:** [@vikramdayma](https://discuss.elastic.co/u/vikramdayma)\ **Replies:** 3\ **Last updated:** [November 22, 2021, 10:42am UTC](https://discuss.elastic.co/t/order-by-dynamically-by-a-field-in-bar-chart/289579 "2021-11-22T10:42:22Z")
Hi, I Plot a bar chart in kibana visualization and I am showing multiple bar for multiple fields value in x-axis. I want to add filter and set order on chart based on any filed. Chat image is below. Any filter opti… --- ## [Error creating runner from config: 1 error: string value is not set accessing 'perfmon.queries.0.counters.1.name'](https://discuss.elastic.co/t/error-creating-runner-from-config-1-error-string-value-is-not-set-accessing-perfmon-queries-0-counters-1-name/289195)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 3\ **Last updated:** [November 22, 2021, 10:37am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-1-error-string-value-is-not-set-accessing-perfmon-queries-0-counters-1-name/289195 "2021-11-22T10:37:05Z")
Anyone able to decode the error "Error creating runner from config: 1 error: string value is not set accessing 'perfmon.queries.0.counters.1.name'" and explain what its trying to tell me? I have copied the example perfm… --- ## [Kibana 7.15.2 Security Update](https://discuss.elastic.co/t/kibana-7-15-2-security-update/289788)
**Author:** [@Ilya\_Moskalev](https://discuss.elastic.co/u/Ilya_Moskalev)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 9:24am UTC](https://discuss.elastic.co/t/kibana-7-15-2-security-update/289788 "2021-11-22T09:24:52Z")
Hello everyone! Tell me plz my kibana is affected by this vulnerability if it works on HTTPS and hosted on Linux security engineers want me to update kibana, but I do not want to recklessly update. --- ## [JDBC logging duplicate row](https://discuss.elastic.co/t/jdbc-logging-duplicate-row/289297)
**Author:** [@LinhNT1](https://discuss.elastic.co/u/LinhNT1)\ **Replies:** 3\ **Last updated:** [November 22, 2021, 8:46am UTC](https://discuss.elastic.co/t/jdbc-logging-duplicate-row/289297 "2021-11-22T08:46:02Z")
Hi there, I have a logtash with JDBC input like below jdbc { jdbc\_driver\_library =\> "${LOGSTASH\_JDBC\_DRIVER\_JAR\_LOCATION}" jdbc\_driver\_class =\> "${LOGSTASH\_JDBC\_DRIVER}" jdbc\_connection\_string =\>… --- ## [How to point out kibana to multiple elasticsearch cluster](https://discuss.elastic.co/t/how-to-point-out-kibana-to-multiple-elasticsearch-cluster/289780)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 8:31am UTC](https://discuss.elastic.co/t/how-to-point-out-kibana-to-multiple-elasticsearch-cluster/289780 "2021-11-22T08:31:57Z")
Hello team, We have 5 different kibana cluster with 5 different URL. We need one kibana URL like http://kibana.com/ and we need to change kibana URL like http://kibana.com/cluster1 http://kibana.com/cluster2 http://… --- ## [How to install custom plugin from s3 locations in Kubernetes Elasticsearch(ECK)?](https://discuss.elastic.co/t/how-to-install-custom-plugin-from-s3-locations-in-kubernetes-elasticsearch-eck/289781)
**Author:** [@manu\_john](https://discuss.elastic.co/u/manu_john)\ **Replies:** 0\ **Last updated:** [November 22, 2021, 8:11am UTC](https://discuss.elastic.co/t/how-to-install-custom-plugin-from-s3-locations-in-kubernetes-elasticsearch-eck/289781 "2021-11-22T08:11:52Z")
How to install a custom plugin from s3 locations in Kubernetes Elasticsearch(ECK)? --- ## [Elastic SIEM Network Map Layers Issues](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782)
**Author:** [@fmaginga](https://discuss.elastic.co/u/fmaginga)\ **Replies:** 0\ **Last updated:** [November 22, 2021, 8:14am UTC](https://discuss.elastic.co/t/elastic-siem-network-map-layers-issues/289782 "2021-11-22T08:14:41Z")
Hello, I have been experiencing some issues with Elastic SIEM Network Map Layers. I have configured only indices corporatepfw-ecs-\* from which the SIEM app collects events. See the image below. However, In the SIEM \>… --- ## [Logstsash is running pipelines in parallel](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614)
**Author:** [@rodri.gz](https://discuss.elastic.co/u/rodri.gz)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 8:15am UTC](https://discuss.elastic.co/t/logstsash-is-running-pipelines-in-parallel/289614 "2021-11-22T08:15:38Z")
Hello! I have a divided pipeline that generates 2 indices that enrich each other. I would like to know how I can make it do one etl first and when it finishes the other. my logstash filter wich enrichs has this filter… --- ## [Delete file in ruby filter logstash](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671)
**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\ **Replies:** 6\ **Last updated:** [November 22, 2021, 4:28am UTC](https://discuss.elastic.co/t/delete-file-in-ruby-filter-logstash/289671 "2021-11-22T04:28:53Z")
my code in ruby filter def register(params) print "heello ruby come in" end def filter(event) Dir.glob('/home/hz/COM.txt').each { |file| File.chmod(0777, file) File.delete(file) print(file) } #return… --- ## [Ignore\_malformed broken for geo\_shape](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771)
**Author:** [@corndog](https://discuss.elastic.co/u/corndog)\ **Replies:** 4\ **Last updated:** [November 22, 2021, 3:48am UTC](https://discuss.elastic.co/t/ignore-malformed-broken-for-geo-shape/289771 "2021-11-22T03:48:49Z")
I have set mappings for my index as such: "geometry": { "type": "geo\_shape", "ignore\_malformed": true } When I Bulk POST documents, 1 fails due to malformed geometry. I have set the "ignore\_malformed" parameter… --- ## [Watcher alert email action is not working](https://discuss.elastic.co/t/watcher-alert-email-action-is-not-working/289737)
**Author:** [@George\_Lee](https://discuss.elastic.co/u/George_Lee)\ **Replies:** 6\ **Last updated:** [November 22, 2021, 3:19am UTC](https://discuss.elastic.co/t/watcher-alert-email-action-is-not-working/289737 "2021-11-22T03:19:27Z")
Deal all, ECK version 1.7.1 Elasticsearch version 7.10.1 My Elasticsearch configuration is apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasticsearch metadata: name: elastic005 namespace: elastic-system spec… --- ## [Fetch 1M records using aggregation in a single call](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399)
**Author:** [@Sreejith\_Ms](https://discuss.elastic.co/u/Sreejith_Ms)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:20am UTC](https://discuss.elastic.co/t/fetch-1m-records-using-aggregation-in-a-single-call/289399 "2021-11-22T00:20:57Z")
We have to create some reports based on nearly 100M data and its requires aggregation and the result will be nearly 5M records. So, Can I use Elasticsearch for this report generation and fetch up to 5M records in a sing… --- ## [Changing Unique Key of Elastic Search Index (Id column)](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582)
**Author:** [@amey\_kulkarni](https://discuss.elastic.co/u/amey_kulkarni)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:12am UTC](https://discuss.elastic.co/t/changing-unique-key-of-elastic-search-index-id-column/289582 "2021-11-22T00:12:05Z")
We have a requirement to set value of id column (unique key) of an index to values coming from data (values of couple of columns from data). Id column value is set for each document by default. We want to override it wi… --- ## [Kibana space port based](https://discuss.elastic.co/t/kibana-space-port-based/289690)
**Author:** [@franckfct](https://discuss.elastic.co/u/franckfct)\ **Replies:** 1\ **Last updated:** [November 22, 2021, 12:06am UTC](https://discuss.elastic.co/t/kibana-space-port-based/289690 "2021-11-22T00:06:33Z")
Hi, Is it possible to specify a port per space For example: http://url:5601/ =\> Default space http://url:5602/ =\> IT space http://url:5603/ =\> HR space etc ... In Kibana or maybe in the web server Thanks [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=771) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=773)