# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=806 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 807 --- ## [Json v/s ndjson in Kibana](https://discuss.elastic.co/t/json-v-s-ndjson-in-kibana/285879)
**Author:** [@Rakhi](https://discuss.elastic.co/u/Rakhi)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 8:11pm UTC](https://discuss.elastic.co/t/json-v-s-ndjson-in-kibana/285879 "2021-10-11T20:11:05Z")
In our case the ndjson files are checked into git repository and deployed from there into Kibana. But whenever we make changes to the Kibana dashboards -\> we export the ndjson -\> and manually handpick and then merge the… --- ## [Cumulative running total for field independant of search range](https://discuss.elastic.co/t/cumulative-running-total-for-field-independant-of-search-range/286406)
**Author:** [@d\_s\_9](https://discuss.elastic.co/u/d_s_9)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 7:23pm UTC](https://discuss.elastic.co/t/cumulative-running-total-for-field-independant-of-search-range/286406 "2021-10-11T19:23:55Z")
Hi all, I'm indexing time series documents containing a timestamp as well as an integer value which i want to have a running total for, starting from the first indexed document and adding all of the supplied values of t… --- ## [Error for logstash.conf](https://discuss.elastic.co/t/error-for-logstash-conf/286400)
**Author:** [@Johnny\_Cash\_Cow](https://discuss.elastic.co/u/Johnny_Cash_Cow)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 6:44pm UTC](https://discuss.elastic.co/t/error-for-logstash-conf/286400 "2021-10-11T18:44:47Z")
The only non-commented out line of my logstash.conf is: path.config: "C:/ELK/logstash-7.15.0-windows-x86\_64/logstash-7.15.0/config/logstash-sample.conf" My only non commented out section is of my pipeline.yml: - pip… --- ## [Yet, another Firewall question](https://discuss.elastic.co/t/yet-another-firewall-question/286078)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 6:13pm UTC](https://discuss.elastic.co/t/yet-another-firewall-question/286078 "2021-10-11T18:13:13Z")
I am running Stack 7.13.4 on Windows 10 with McAfee Small Business Security (a Firewall among other things) I have two nodes of Elasticsearch and One of Kibana on this one machine. I have opened TCP/UDP ports 9200, 92… --- ## [User Experience - Javascript errors](https://discuss.elastic.co/t/user-experience-javascript-errors/285656)
**Author:** [@Jugsofbeer](https://discuss.elastic.co/u/Jugsofbeer)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 6:07pm UTC](https://discuss.elastic.co/t/user-experience-javascript-errors/285656 "2021-10-11T18:07:57Z")
Hi, After using the simple javascript library and 6 lines of code to instrument a few test pages, I got the data flowing ... but I havent yet seen javascript console error come through like in the examples. Am i missin… --- ## [Indexing Multipolyon with Elasticearch](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265)
**Author:** [@Faradandy](https://discuss.elastic.co/u/Faradandy)\ **Replies:** 5\ **Last updated:** [October 11, 2021, 5:50pm UTC](https://discuss.elastic.co/t/indexing-multipolyon-with-elasticearch/286265 "2021-10-11T17:50:56Z")
Hi there, I'm using Elasticsearch 7.15 with GDAL 3.3.1 and trying to index the UK Land Registry Dataset. I currently have these data stored in a PSQL table and am trying to use ogr2ogr to create the ES index. I've def… --- ## [Refresh\_interval less than 1 per second?](https://discuss.elastic.co/t/refresh-interval-less-than-1-per-second/286069)
**Author:** [@Vadym](https://discuss.elastic.co/u/Vadym)\ **Replies:** 7\ **Last updated:** [October 11, 2021, 5:46pm UTC](https://discuss.elastic.co/t/refresh-interval-less-than-1-per-second/286069 "2021-10-11T17:46:17Z")
Hi guys, We are syncing data from Couchbase into Elasticsearch via CBES connector and have up to ~550ms delay from CBES inserting data into ES. Afterwards it takes up to 2 seconds for data to become searchable in ES. D… --- ## [Elasticsearch Data Recovery](https://discuss.elastic.co/t/elasticsearch-data-recovery/286009)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 5:33pm UTC](https://discuss.elastic.co/t/elasticsearch-data-recovery/286009 "2021-10-11T17:33:28Z")
Hi, We had an incident where all master nodes failed. After they were auto-replaced the old data nodes did not reconnect to the master due to state mismatch. While we were able to clear down the state so the nodes could… --- ## [Logstash- Create different logfiles for different pipeline](https://discuss.elastic.co/t/logstash-create-different-logfiles-for-different-pipeline/286370)
**Author:** [@praffuln](https://discuss.elastic.co/u/praffuln)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 5:14pm UTC](https://discuss.elastic.co/t/logstash-create-different-logfiles-for-different-pipeline/286370 "2021-10-11T17:14:52Z")
Hi, I am using logstash log4j2.properties configuration for log controlling e.g. log rotation, log preservation, controlling file name for logging, location of logs etc. Based on below discussion I used to configure lo… --- ## [DNS filter, how to save IP to a separate field](https://discuss.elastic.co/t/dns-filter-how-to-save-ip-to-a-separate-field/286391)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 5:06pm UTC](https://discuss.elastic.co/t/dns-filter-how-to-save-ip-to-a-separate-field/286391 "2021-10-11T17:06:28Z")
Hi, I'm using the DNS filter in my Logstash conf and I would like to store the IP address that the filter is resolving to a separate field. I tried using the add\_field parameter but its not working. I end up storing the… --- ## [Timestamp ISSUE](https://discuss.elastic.co/t/timestamp-issue/286170)
**Author:** [@frank\_rib](https://discuss.elastic.co/u/frank_rib)\ **Replies:** 3\ **Last updated:** [October 11, 2021, 4:54pm UTC](https://discuss.elastic.co/t/timestamp-issue/286170 "2021-10-11T16:54:01Z")
Hello every body, I have a stand allone architecture. Logs are sent from syslog\_ng server to logstash - \> Elasticsearch -\> kibana. I have a probleme with the timestamp as the capture below shows The logs are received … --- ## [Terms query routing optimization](https://discuss.elastic.co/t/terms-query-routing-optimization/286390)
**Author:** [@Ragav\_Kb](https://discuss.elastic.co/u/Ragav_Kb)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 4:21pm UTC](https://discuss.elastic.co/t/terms-query-routing-optimization/286390 "2021-10-11T16:21:39Z")
My search is going to look something as below. For most cases the number of items in userId is expected to be between 100 to 200 atmost, although on some cases it may go up to 1000. Is there anything to consider in gene… --- ## [Search\_phase\_execution\_exception](https://discuss.elastic.co/t/search-phase-execution-exception/286336)
**Author:** [@prashanth\_sri](https://discuss.elastic.co/u/prashanth_sri)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 3:27pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception/286336 "2021-10-11T15:27:07Z")
hi all , i have 15 nodes in my Elasticsearch cluster, and each shards have 10GB , currently we have (1 shard+2 replicas ) ,we are using 6.18 elastic version , we are try ing to access data from api , but when i am runni… --- ## [How to read local0 files in unix using filebeat](https://discuss.elastic.co/t/how-to-read-local0-files-in-unix-using-filebeat/286181)
**Author:** [@muralikrishna](https://discuss.elastic.co/u/muralikrishna)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 3:02pm UTC](https://discuss.elastic.co/t/how-to-read-local0-files-in-unix-using-filebeat/286181 "2021-10-11T15:02:28Z")
Hello Everyone, I have some applications writing the logs to local0.info & local4.info file in UNIX servers. I have to read the log content from above files using filebeat.yml and send the same to Logstash. We can't r… --- ## [How to move nested key value to root level and then rename elements root name?](https://discuss.elastic.co/t/how-to-move-nested-key-value-to-root-level-and-then-rename-elements-root-name/286059)
**Author:** [@mguttula](https://discuss.elastic.co/u/mguttula)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 3:01pm UTC](https://discuss.elastic.co/t/how-to-move-nested-key-value-to-root-level-and-then-rename-elements-root-name/286059 "2021-10-11T15:01:26Z")
How to move nested key value to root level and then rename elements root name I have 4 core cpu and below is a sample of details for 2 cpu core from the source. { "\_source": { "cpu\_usage": { "sys/host-info/… --- ## [Observability Technology Preview - Feedback](https://discuss.elastic.co/t/observability-technology-preview-feedback/286062)
**Author:** [@dgieselaar](https://discuss.elastic.co/u/dgieselaar)\ **Replies:** 2\ **Last updated:** [October 11, 2021, 2:50pm UTC](https://discuss.elastic.co/t/observability-technology-preview-feedback/286062 "2021-10-11T14:50:42Z")
Got any feedback about the Alerting functionality that was demo'ed during ElasticOn's Observability Technology Preview? Feel free to leave your thoughts here. --- ## [Label leader lines on pie charts](https://discuss.elastic.co/t/label-leader-lines-on-pie-charts/286365)
**Author:** [@Mathias\_Christian\_Cl](https://discuss.elastic.co/u/Mathias_Christian_Cl)\ **Replies:** 6\ **Last updated:** [October 11, 2021, 2:24pm UTC](https://discuss.elastic.co/t/label-leader-lines-on-pie-charts/286365 "2021-10-11T14:24:35Z")
Hi, I am using Elastic 7.14 and I am trying to create a pie chart which also shows lines from the pie chart to the percentage values. If one slice of the pie is large enough, it is okay to display the value, but if not … --- ## [How to install elastic/kibana/logstash in custom path?](https://discuss.elastic.co/t/how-to-install-elastic-kibana-logstash-in-custom-path/286366)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 12:52pm UTC](https://discuss.elastic.co/t/how-to-install-elastic-kibana-logstash-in-custom-path/286366 "2021-10-11T12:52:41Z")
I need to install Elasticsearch in /opt/elasticsearch, kibana and logstash like this. And then autostart via systemctl. So, I tried like this Install Elasticsearch with RPM | Elasticsearch Reference \[6.2\] | Elastic I e… --- ## [7.15.0 kibana rpm hash mismatch](https://discuss.elastic.co/t/7-15-0-kibana-rpm-hash-mismatch/286237)
**Author:** [@mtaormina](https://discuss.elastic.co/u/mtaormina)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 2:12pm UTC](https://discuss.elastic.co/t/7-15-0-kibana-rpm-hash-mismatch/286237 "2021-10-11T14:12:32Z")
I'm getting a hash mismatch on the 64-bit RPM download for kibana 7.15.0 at https://artifacts.elastic.co/downloads/kibana/kibana-7.15.0-x86\_64.rpm. The SHA512 file says: 1de33aa9a653837d41afe52517e66ae5cc68866020e797939e… --- ## [Kibana visualizations - Apply operations on value returned by a metric](https://discuss.elastic.co/t/kibana-visualizations-apply-operations-on-value-returned-by-a-metric/286356)
**Author:** [@aza-zil](https://discuss.elastic.co/u/aza-zil)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 1:48pm UTC](https://discuss.elastic.co/t/kibana-visualizations-apply-operations-on-value-returned-by-a-metric/286356 "2021-10-11T13:48:41Z")
I have a visualization where I have a metric field that contains the sum of durations (in millisecond), I want to show it in (hh:mm:ss) form, is that possible? --- ## [Details/Insights on how switching the index behind an alias works](https://discuss.elastic.co/t/details-insights-on-how-switching-the-index-behind-an-alias-works/286146)
**Author:** [@Nexonus](https://discuss.elastic.co/u/Nexonus)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 12:42pm UTC](https://discuss.elastic.co/t/details-insights-on-how-switching-the-index-behind-an-alias-works/286146 "2021-10-11T12:42:44Z")
I would like to get some insight information about how an alias switch works. Our scenario We observed a scenario in our cluster (only 3 nodes) where we did an alias switch and still queried the old data from the old in… --- ## [How to test the result of a query and take an action based on that result?](https://discuss.elastic.co/t/how-to-test-the-result-of-a-query-and-take-an-action-based-on-that-result/286362)
**Author:** [@mfilipelopes](https://discuss.elastic.co/u/mfilipelopes)\ **Replies:** 0\ **Last updated:** [October 11, 2021, 11:47am UTC](https://discuss.elastic.co/t/how-to-test-the-result-of-a-query-and-take-an-action-based-on-that-result/286362 "2021-10-11T11:47:58Z")
Hi. Is there a way to test the result of a query and take an action based on that result? I need to do the following: For new coming documents, make a search on a index X to see if that document already exists and if … --- ## [Size mapper plugin - how to see it in Kibana?](https://discuss.elastic.co/t/size-mapper-plugin-how-to-see-it-in-kibana/286247)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 11:19am UTC](https://discuss.elastic.co/t/size-mapper-plugin-how-to-see-it-in-kibana/286247 "2021-10-11T11:19:39Z")
I am going to try that again, since there where already some topics about it: I have installed: Mapper Size Plugin | Elasticsearch Plugins and Integrations \[7.15\] | Elastic on my 7.13.2 cluster and I have created a new … --- ## [RFC-5424 log parsing](https://discuss.elastic.co/t/rfc-5424-log-parsing/286129)
**Author:** [@Sunflower](https://discuss.elastic.co/u/Sunflower)\ **Replies:** 6\ **Last updated:** [October 11, 2021, 10:59am UTC](https://discuss.elastic.co/t/rfc-5424-log-parsing/286129 "2021-10-11T10:59:10Z")
Hi, I have logs that I'm sending to Logstash from SentinelOne in an RFC-5424 format(this is the way they called it) that I wasn't sure how to handle. I began by dividing the fields using Grok and now my issue is how to… --- ## [Measure web page load times](https://discuss.elastic.co/t/measure-web-page-load-times/286232)
**Author:** [@Xabi](https://discuss.elastic.co/u/Xabi)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 9:57am UTC](https://discuss.elastic.co/t/measure-web-page-load-times/286232 "2021-10-11T09:57:45Z")
Hi, I have a heartbeat agent monitoring some web: type: http urls: \["http://myweb.com"\] schedule: "@every 60s" id: MyId name: MyName and with kibana I monitor the media of "monitor.duration.us" . Is this the bes… --- ## [Whether the sub-metrics page of the service can be more friendly?](https://discuss.elastic.co/t/whether-the-sub-metrics-page-of-the-service-can-be-more-friendly/286291)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 0\ **Last updated:** [October 9, 2021, 2:17am UTC](https://discuss.elastic.co/t/whether-the-sub-metrics-page-of-the-service-can-be-more-friendly/286291 "2021-10-09T02:17:02Z")
Whether it is possible to add memory.total, memory used by service, and cpu and cpu.total used by service on the page. My services are all running on containers. I am not sure about the actual memory and CPU capacity of… --- ## [Conditional coloring Kibana canvas](https://discuss.elastic.co/t/conditional-coloring-kibana-canvas/286037)
**Author:** [@Kadhem](https://discuss.elastic.co/u/Kadhem)\ **Replies:** 4\ **Last updated:** [October 11, 2021, 8:56am UTC](https://discuss.elastic.co/t/conditional-coloring-kibana-canvas/286037 "2021-10-11T08:56:39Z")
Hi, I'm want to change the color of the bars here depending on the value of "Primary channel " . i may have 12 values in "Primary channel" . the graph is displayed in real time so the color changing must be updated ( i… --- ## [Best way to index hierarchical types](https://discuss.elastic.co/t/best-way-to-index-hierarchical-types/286242)
**Author:** [@lovrodoe](https://discuss.elastic.co/u/lovrodoe)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 8:03am UTC](https://discuss.elastic.co/t/best-way-to-index-hierarchical-types/286242 "2021-10-11T08:03:22Z")
Let's say I have hierarchical types such as in example below: base\_type child\_type1 child\_type3 child\_type2 child\_type1 and child\_type2 inherit metadata properties from base\_type. child\_type3 has all pr… --- ## [Indexing strategy for hierarchical types](https://discuss.elastic.co/t/indexing-strategy-for-hierarchical-types/286343)
**Author:** [@lovrodoe](https://discuss.elastic.co/u/lovrodoe)\ **Replies:** 1\ **Last updated:** [October 11, 2021, 7:58am UTC](https://discuss.elastic.co/t/indexing-strategy-for-hierarchical-types/286343 "2021-10-11T07:58:09Z")
Hello, I wrote a post on Friday (here) and since I didn't get a reply, I'll give it another go with a different question. Just a quick summary (check my previous post for a more detailed explanation): Currently on Elas… --- ## [Why can't metric UI use apm metric data?](https://discuss.elastic.co/t/why-cant-metric-ui-use-apm-metric-data/286290)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 7\ **Last updated:** [October 11, 2021, 3:51am UTC](https://discuss.elastic.co/t/why-cant-metric-ui-use-apm-metric-data/286290 "2021-10-11T03:51:58Z")
I did not deploy metricbeat. I saw that the apm agent collects some basic indicators (CPU, memory) of the system, I set the Metrics indices to "apm-\*-metric-\*", but the page did not show the results. Is there something w… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=805) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=807)