# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=796 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 797 --- ## [How to learn index with most queries?](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 7:27am UTC](https://discuss.elastic.co/t/how-to-learn-index-with-most-queries/287407 "2021-10-22T07:27:21Z")
Hello dear friends, I would like to ask you a question that has been on my mind before. This question is: I wonder if we can find which indexes get the most queries. So I have more than one index and these indexes are us… --- ## [Add "time" chart on kibana](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271)
**Author:** [@christbiz86](https://discuss.elastic.co/u/christbiz86)\ **Replies:** 6\ **Last updated:** [October 22, 2021, 6:31am UTC](https://discuss.elastic.co/t/add-time-chart-on-kibana/287271 "2021-10-22T06:31:24Z")
hi all, i want adding time chart like the screenshot. kibana only show the "document" field ony. i've add the index pattern and it doesn't work. any help please! my kibana currently --- ## [別indexデータとの差分出力](https://discuss.elastic.co/t/index/287249)
**Author:** [@yuta.yokoyama](https://discuss.elastic.co/u/yuta.yokoyama)\ **Replies:** 2\ **Last updated:** [October 22, 2021, 6:10am UTC](https://discuss.elastic.co/t/index/287249 "2021-10-22T06:10:13Z")
お世話になっております。 現在予定のデータを「p\_test」、実績のデータを「r\_test」というindexに登録しています。 予実の差を知りたいのですが、当日の「p\_test」の数から「r\_test」の数を引いた値を取得してVisualizeに表示する方法はないでしょうか。 --- ## [Data path configuration in source code (7.15) running in local machine](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397)
**Author:** [@vnaveed](https://discuss.elastic.co/u/vnaveed)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 5:45am UTC](https://discuss.elastic.co/t/data-path-configuration-in-source-code-7-15-running-in-local-machine/287397 "2021-10-22T05:45:44Z")
Hi.. Am running the Elasticsearch source code (7.15) in my window machine, May I know in which file I have to change the path to store my data permanently Since each time I restart the machine build folder gets reset. I… --- ## [Clearing the concept of Translog](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 4\ **Last updated:** [October 22, 2021, 5:32am UTC](https://discuss.elastic.co/t/clearing-the-concept-of-translog/287374 "2021-10-22T05:32:24Z")
In translog documentation it is said that All index and delete operations are written to the translog after being processed by the internal Lucene index but before they are acknowledged So i am not understanding what… --- ## [Save all message event to array in ruby filter](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381)
**Author:** [@Hertz\_Drive](https://discuss.elastic.co/u/Hertz_Drive)\ **Replies:** 0\ **Last updated:** [October 22, 2021, 3:51am UTC](https://discuss.elastic.co/t/save-all-message-event-to-array-in-ruby-filter/287381 "2021-10-22T03:51:44Z")
I need save event to array. print (event) %{host} %{message} I need print message in event. Thank you. --- ## [Rules failing due to field mapping errors](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981)
**Author:** [@PD98](https://discuss.elastic.co/u/PD98)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 3:49am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981 "2021-10-22T03:49:17Z")
Hi, I have enabled elastic security and activated the rules. I am using auditbeat to collect audit data and send it to logstash which then indexes it in elasticsearch. I am not performing any mutation on the logs via lo… --- ## [Add a new field with a specifically formatted timestamp from @timestamp](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373)
**Author:** [@trwillis](https://discuss.elastic.co/u/trwillis)\ **Replies:** 1\ **Last updated:** [October 22, 2021, 12:25am UTC](https://discuss.elastic.co/t/add-a-new-field-with-a-specifically-formatted-timestamp-from-timestamp/287373 "2021-10-22T00:25:17Z")
I want to take the value from @timestamp, format it like "yyyy MM dd HH:mm:ss" and prepend it to the message field. Input data is syslog in json format. --- ## [Conditional Sort Using Two Fields](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352)
**Author:** [@cruzmoan](https://discuss.elastic.co/u/cruzmoan)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:40pm UTC](https://discuss.elastic.co/t/conditional-sort-using-two-fields/287352 "2021-10-21T18:40:11Z")
We have a document that has the following fields: field1 field2 valueType We want to include both fields in the sort. We do NOT want to sort field1, then field2. We want the sort to use both fields at the same sort… --- ## [Локализация Kibana](https://discuss.elastic.co/t/kibana/287369)
**Author:** [@Vladislavpomililo](https://discuss.elastic.co/u/Vladislavpomililo)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 9:15pm UTC](https://discuss.elastic.co/t/kibana/287369 "2021-10-21T21:15:51Z")
Подскажите, пожалуйста, есть ли возможность локализовать плагин kibana wazuh? --- ## [Quotes are not converted correctly](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994)
**Author:** [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 7:15pm UTC](https://discuss.elastic.co/t/quotes-are-not-converted-correctly/286994 "2021-10-21T19:15:53Z")
Dear all =) When creating Create Rule over the API, and want to search for host:"10.250.11.11", then I run into problems. This is invalid JSON: "esQuery": '{ "query": { "query\_string": { "query": "host:"10.250.11.11" … --- ## [RSpec: Testing Aggregate Filters](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345)
**Author:** [@UXabre](https://discuss.elastic.co/u/UXabre)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 6:02pm UTC](https://discuss.elastic.co/t/rspec-testing-aggregate-filters/287345 "2021-10-21T18:02:56Z")
I'm trying to unittest a filter that utilizes aggregate filter. In my sample, I'm dropping all messages and wait for the timeout to occur instead. I'd like to retrieve this async message somehow and verify if the conten… --- ## [Detection Alerts only show documents from .siem-signals-default index](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338)
**Author:** [@michel.beaudry](https://discuss.elastic.co/u/michel.beaudry)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 4:54pm UTC](https://discuss.elastic.co/t/detection-alerts-only-show-documents-from-siem-signals-default-index/287338 "2021-10-21T16:54:32Z")
In Kibana-\>Security-\>Detections the Trend panel only show alerts from .siem-signals-default index. Upon clicking on Inspect it shows following: Furthermore, clicking on the (i) next to index pattern says that the pat… --- ## [Jdbc\_streaming and mutate](https://discuss.elastic.co/t/jdbc-streaming-and-mutate/287319)
**Author:** [@Roberto\_B](https://discuss.elastic.co/u/Roberto_B)\ **Replies:** 4\ **Last updated:** [October 21, 2021, 4:21pm UTC](https://discuss.elastic.co/t/jdbc-streaming-and-mutate/287319 "2021-10-21T16:21:24Z")
Hi Friends, I use a jdbc\_streaming filter in order to enrich data. This filter produces an array with only 1 document inside. How can I pop out this document in another field? I tried without success with ruby code. J… --- ## [SHA256 or MD5 in Logstash cipher filter plugin algorithm](https://discuss.elastic.co/t/sha256-or-md5-in-logstash-cipher-filter-plugin-algorithm/287328)
**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 4:13pm UTC](https://discuss.elastic.co/t/sha256-or-md5-in-logstash-cipher-filter-plugin-algorithm/287328 "2021-10-21T16:13:27Z")
Hi! I'm using cipher filter plugin in my Logstash configuration and the only example I saw until now for the algorithm is aes-256-cbc and I'd like to use md5 or sha256. How is it possible? Here is my configuration belo… --- ## [Matching rule with indicator match error parsing date field](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 3:16pm UTC](https://discuss.elastic.co/t/matching-rule-with-indicator-match-error-parsing-date-field/287171 "2021-10-21T15:16:01Z")
I create a index that contain all domain that i want to query to according to ecs. Now i create a rule that will match any domain query from dns index but it give me this errror: An error occurred during rule execution… --- ## [Elastic operator not creating elasticsearch in Openshift 3.11](https://discuss.elastic.co/t/elastic-operator-not-creating-elasticsearch-in-openshift-3-11/286847)
**Author:** [@Jasper9041](https://discuss.elastic.co/u/Jasper9041)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 3:12pm UTC](https://discuss.elastic.co/t/elastic-operator-not-creating-elasticsearch-in-openshift-3-11/286847 "2021-10-21T15:12:05Z")
Hi, I'm trying to use the Elastic operator to deploy an Elasticsearch instance in a Openshift 3.11 (minishift) cluster. It doesn't seem to work... The creation of Elasticsearch is failing. I see the following k8s events… --- ## [Uptime alert on HA heartbeat deployments](https://discuss.elastic.co/t/uptime-alert-on-ha-heartbeat-deployments/287138)
**Author:** [@mojohoho](https://discuss.elastic.co/u/mojohoho)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 2:27pm UTC](https://discuss.elastic.co/t/uptime-alert-on-ha-heartbeat-deployments/287138 "2021-10-21T14:27:04Z")
Having Heartbeat deployed to multiple hosts, I would like to be alerted only when a monitor (e.g. ICMP probe on "example.org") fails on all of them. For example, on the /app/uptime page, the panel on the bottom ("Monito… --- ## [FSCrawler get a path error while running as a service](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 2:26pm UTC](https://discuss.elastic.co/t/fscrawler-get-a-path-error-while-running-as-a-service/287320 "2021-10-21T14:26:53Z")
I have a working implementation of fscrawler. However, it is running on command prompt. I have tried to implement it as a service but i keep getting an error. my url looks like this url: "\\\\\\\\data-backup\\\\2020" The er… --- ## [RSS feed into ELK. Can we do it with Filebeat?](https://discuss.elastic.co/t/rss-feed-into-elk-can-we-do-it-with-filebeat/287310)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 1\ **Last updated:** [October 21, 2021, 2:12pm UTC](https://discuss.elastic.co/t/rss-feed-into-elk-can-we-do-it-with-filebeat/287310 "2021-10-21T14:12:02Z")
Hey there! Can we ingest RSS feeds into Filebeat? I found a module for Logstash but given my environment would be better doing it with Filebeat. Any experience? Much appreciated! --- ## [Learning Modules that \*do not\* require cloud access?](https://discuss.elastic.co/t/learning-modules-that-do-not-require-cloud-access/287209)
**Author:** [@Mark3](https://discuss.elastic.co/u/Mark3)\ **Replies:** 5\ **Last updated:** [October 21, 2021, 2:03pm UTC](https://discuss.elastic.co/t/learning-modules-that-do-not-require-cloud-access/287209 "2021-10-21T14:03:49Z")
Hi, looking for some help, I can extend my Cloud access by 7 days but if possible would like to leave that towards the end of my learning slot, does anyone know which of these modules do not require Cloud access? Thanks… --- ## [Elasticsearch is not starting](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276)
**Author:** [@mangeshs](https://discuss.elastic.co/u/mangeshs)\ **Replies:** 5\ **Last updated:** [October 21, 2021, 1:42pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-starting/287276 "2021-10-21T13:42:32Z")
I want to start Elasticsearch on linux system and give command like below at bin path ./elasticsearch OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed… --- ## [Kibana dashboard feature](https://discuss.elastic.co/t/kibana-dashboard-feature/287128)
**Author:** [@SRIGURU\_VEL](https://discuss.elastic.co/u/SRIGURU_VEL)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 1:27pm UTC](https://discuss.elastic.co/t/kibana-dashboard-feature/287128 "2021-10-21T13:27:06Z")
Hi Experts, During one of the training session with one customer. User came up with the query that - can we put security on the dashboard so it is not deleted. Scenario- Because we will have multiple dashboards for Wi… --- ## [Use converted timestamp from csv like index sufix](https://discuss.elastic.co/t/use-converted-timestamp-from-csv-like-index-sufix/287308)
**Author:** [@Alexey\_Nikolaev](https://discuss.elastic.co/u/Alexey_Nikolaev)\ **Replies:** 4\ **Last updated:** [October 21, 2021, 12:13pm UTC](https://discuss.elastic.co/t/use-converted-timestamp-from-csv-like-index-sufix/287308 "2021-10-21T12:13:14Z")
Hello! I have a lot of CISCO CDR files, about 500k. Its logs from clustef of CISCO CUCM, and I want to put it to indexes with name CUCM-CDR-{mm-yyyy}. Date I want to get from field named "dateTimeDisconnect". Can you he… --- ## [Matching documents with empty symbol in the end using regexp](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023)
**Author:** [@111343](https://discuss.elastic.co/u/111343)\ **Replies:** 3\ **Last updated:** [October 21, 2021, 12:11pm UTC](https://discuss.elastic.co/t/matching-documents-with-empty-symbol-in-the-end-using-regexp/287023 "2021-10-21T12:11:47Z")
Hi I have an Elasticsearch document that can have various forms of the string "creative=". Logs that have good format look like "creative=xxx", and logs that have bad format look like "creative=". Example of bad log: h… --- ## [Capturing maximum unique count per second for each day](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314)
**Author:** [@jevans78](https://discuss.elastic.co/u/jevans78)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 12:07pm UTC](https://discuss.elastic.co/t/capturing-maximum-unique-count-per-second-for-each-day/287314 "2021-10-21T12:07:21Z")
Hi, I'm trying to get a representation of the number of unique events per second over a 3 month period. Default configuration auto-scales this to No. of events per 12 hours. Is there an easy way that I can display the … --- ## [Is Logstash beats input with multiline codec allowed or not?](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230)
**Author:** [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 11:55am UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230 "2021-10-21T11:55:33Z")
I know some of this might have been asked here before but Documentation and logs express differently. I want to fetch logs from AWS Cloudwatch. For that, i'm using filebeat's input. This input is not doing any kind of m… --- ## [Issue with number of values being displayed for vertical and horizontal bars in kibana](https://discuss.elastic.co/t/issue-with-number-of-values-being-displayed-for-vertical-and-horizontal-bars-in-kibana/286222)
**Author:** [@revati-chawla](https://discuss.elastic.co/u/revati-chawla)\ **Replies:** 7\ **Last updated:** [October 21, 2021, 11:51am UTC](https://discuss.elastic.co/t/issue-with-number-of-values-being-displayed-for-vertical-and-horizontal-bars-in-kibana/286222 "2021-10-21T11:51:57Z")
Hello, We are facing issues while visualising using vertical bars where the number of values being displayed on the x-axis are exceeding the limit defined in the size parameter. Version: 7.14.2 PFB a screenshot for yo… --- ## [Logstash Handling Filter Errors](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309)
**Author:** [@maltewhiite](https://discuss.elastic.co/u/maltewhiite)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 11:31am UTC](https://discuss.elastic.co/t/logstash-handling-filter-errors/287309 "2021-10-21T11:31:20Z")
I want to handle errors in my Logstash Filter. How do I do that? And more importantly, where is the documentation? I can see there is Documentation here for Elastic Pipeline Error Handling: Is there something similar… --- ## [Reindex API changed \_version of docs](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [October 21, 2021, 11:19am UTC](https://discuss.elastic.co/t/reindex-api-changed-version-of-docs/287305 "2021-10-21T11:19:17Z")
Dears, Why reindex API does not copy original doc \_version to new index? Is there any trick to force it? query: GET test/\_search?version=true { "query": { "match\_all": {} } } result: { "took" : 1, "timed\_ou… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=795) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=797)