# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=817 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 818 --- ## [Hyperlink or drilldown for a metric in Table Visualisation](https://discuss.elastic.co/t/hyperlink-or-drilldown-for-a-metric-in-table-visualisation/285001)
**Author:** [@Anuj\_Zope](https://discuss.elastic.co/u/Anuj_Zope)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 6:45am UTC](https://discuss.elastic.co/t/hyperlink-or-drilldown-for-a-metric-in-table-visualisation/285001 "2021-09-28T06:45:12Z")
Hi! I am using Kibana 7.10.2. So I am making a dashboard with tickets data. For certain tables, the last column is the 'Count of Tickets'. What I need it that for every table I make with this column, I want to make the… --- ## [How to invite a user, not able to find the link](https://discuss.elastic.co/t/how-to-invite-a-user-not-able-to-find-the-link/285201)
**Author:** [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Replies:** 3\ **Last updated:** [September 28, 2021, 6:39am UTC](https://discuss.elastic.co/t/how-to-invite-a-user-not-able-to-find-the-link/285201 "2021-09-28T06:39:27Z")
Hi, Like to request one of my friend to join the forum, I am not able to find the link to add him can you please share the link with me --- ## [Enrich fields in new index from other index present in kibana using logstash](https://discuss.elastic.co/t/enrich-fields-in-new-index-from-other-index-present-in-kibana-using-logstash/284397)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 1:16pm UTC](https://discuss.elastic.co/t/enrich-fields-in-new-index-from-other-index-present-in-kibana-using-logstash/284397 "2021-09-27T13:16:48Z")
Hi , I am using logstash to create a new index from csv file which is having the index name-"therapy" Another index is "participation" already present in kibana with other fields. Both participation and therapy index … --- ## [差分集計のグラフ化方法](https://discuss.elastic.co/t/topic/285204)
**Author:** [@yuta.yokoyama](https://discuss.elastic.co/u/yuta.yokoyama)\ **Replies:** 4\ **Last updated:** [September 28, 2021, 12:32am UTC](https://discuss.elastic.co/t/topic/285204 "2021-09-28T00:32:28Z")
初めまして。 初歩的な質問かもしれませんが、 以下のようなJsonで登録し、エラーコード事に StartTimeとEndTime差分合計値をグラフ化したいと考えていますが、 Kibanaで差分の合計を指定する方法がわかりません。 どうすればよいでしょうか。 { "errorCode": "ERR0001", "Time": { "StartTime": "2021/06/29 00:59:57", "EndTim… --- ## [Decommissioning a node using cluster.routing.allocation.exclude.\_name](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [September 28, 2021, 12:16am UTC](https://discuss.elastic.co/t/decommissioning-a-node-using-cluster-routing-allocation-exclude-name/284946 "2021-09-28T00:16:27Z")
Why doesn't the primary shard switched away from the node being decommissioned? When I use cluster.routing.allocation.exclude.\_name to exclude a node from participating the cluster (and be removed eventually), I noticed… --- ## [Can i tronsform alert or event to IDMEF(Intrusion Detection Message Exchange Format)](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287)
**Author:** [@bonus4u\_space](https://discuss.elastic.co/u/bonus4u_space)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 10:44pm UTC](https://discuss.elastic.co/t/can-i-tronsform-alert-or-event-to-idmef-intrusion-detection-message-exchange-format/285287 "2021-09-27T22:44:17Z")
i want to normalize alerts from wireshark json format to the idmef standard format .any idea? --- ## [Single character column width in table view](https://discuss.elastic.co/t/single-character-column-width-in-table-view/285290)
**Author:** [@Chris\_Stone](https://discuss.elastic.co/u/Chris_Stone)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 11:22pm UTC](https://discuss.elastic.co/t/single-character-column-width-in-table-view/285290 "2021-09-27T23:22:33Z")
After upgrading to 7.15 from 7.13, I see that many records in Discovery have a width of 1 character for the "field" column in table view. The json view looks fine. I see the issue in both the "classic" and updated views.… --- ## [\[request query.pattern\]: expected value of type \[string\] but got \[undefined\]](https://discuss.elastic.co/t/request-query-pattern-expected-value-of-type-string-but-got-undefined/284953)
**Author:** [@ewitkop](https://discuss.elastic.co/u/ewitkop)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 10:58pm UTC](https://discuss.elastic.co/t/request-query-pattern-expected-value-of-type-string-but-got-undefined/284953 "2021-09-27T22:58:48Z")
I cannot seem to create an index pattern. There are over 600 fields and I cannot tell which one Kibana has an issue with. I have Kibana logging to stdout. And I can't get a idea of which field it has an issue with. Any … --- ## [GrokPraseFailure - JSON log - Success on Grokdebugger](https://discuss.elastic.co/t/grokprasefailure-json-log-success-on-grokdebugger/285282)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 10:48pm UTC](https://discuss.elastic.co/t/grokprasefailure-json-log-success-on-grokdebugger/285282 "2021-09-27T22:48:15Z")
I am facing issues while trying to parse this log. I have tried multiple options but nothing seems to work. No error message in the logs, except for this \_grokprasefailure tag in the records. Can you please help with wha… --- ## [\_grokparsefailure - Success in Grok Debugger - Log with Double quotes JSON](https://discuss.elastic.co/t/grokparsefailure-success-in-grok-debugger-log-with-double-quotes-json/285012)
**Author:** [@Athul\_Devkar](https://discuss.elastic.co/u/Athul_Devkar)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 9:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-success-in-grok-debugger-log-with-double-quotes-json/285012 "2021-09-27T21:14:42Z")
I am facing issues while trying to parse this log. I have tried multiple options but nothing seems to work. No error message in the logs, except for this tag in the records. Can you please help with what I am missing her… --- ## [Separate Indexes Per Log File From Two Different Servers (Filebeat -\> Logstash - \> Elastic -\> Kibana)](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262)
**Author:** [@kingmilo](https://discuss.elastic.co/u/kingmilo)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 8:50pm UTC](https://discuss.elastic.co/t/separate-indexes-per-log-file-from-two-different-servers-filebeat-logstash-elastic-kibana/285262 "2021-09-27T20:50:28Z")
I have two servers configured with Filebeat to send logs to Logstash which is working properly. I would now like to view each of those logs separately under their respective indexes within Kibana Discover but I am strugg… --- ## [Logstash S3 Output plugin](https://discuss.elastic.co/t/logstash-s3-output-plugin/285276)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 7:58pm UTC](https://discuss.elastic.co/t/logstash-s3-output-plugin/285276 "2021-09-27T19:58:25Z")
Hey all, Trying to send messages to S3 USING Logstash SQS as inout, but getting message in this format %{host} %{message} Also not able to see added filed in the logs. --- ## [Commenataries in kibana](https://discuss.elastic.co/t/commenataries-in-kibana/285198)
**Author:** [@ippo](https://discuss.elastic.co/u/ippo)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 6:47pm UTC](https://discuss.elastic.co/t/commenataries-in-kibana/285198 "2021-09-27T18:47:44Z")
Hello guys i wanted to ask you if there is a way to add commentaries in a column to an enhanced table in kibana or if you think there is a way to implement this idea. any idea could help :pray: --- ## [Configurable visualization](https://discuss.elastic.co/t/configurable-visualization/284990)
**Author:** [@PaulBuciuman](https://discuss.elastic.co/u/PaulBuciuman)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 5:33pm UTC](https://discuss.elastic.co/t/configurable-visualization/284990 "2021-09-27T17:33:04Z")
I'm create a simple visualization that shows using a treemap, top 20 request times from an API. But I want that 20 to be configurable outside the settings page, similar to the way I can customize the time range. Is this … --- ## [ElasticSearch crashing - Magento 2.4.3](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228)
**Author:** [@pmono](https://discuss.elastic.co/u/pmono)\ **Replies:** 24\ **Last updated:** [September 27, 2021, 4:42pm UTC](https://discuss.elastic.co/t/elasticsearch-crashing-magento-2-4-3/284228 "2021-09-27T16:42:39Z")
We're having issues with Elasticsearch crashing from time to time. It also sometimes spikes up RAM + CPU and server becomes unresponsive. We have left most of the settings as is, but had to add more RAM to JVM heap (48G… --- ## [How to migrate data from db oracle to ES use Logstash?](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248)
**Author:** [@NinhNM](https://discuss.elastic.co/u/NinhNM)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 4:37pm UTC](https://discuss.elastic.co/t/how-to-migrate-data-from-db-oracle-to-es-use-logstash/285248 "2021-09-27T16:37:28Z")
I have around 1 millions record in db oracle and I want migrate to ES. Logstash: input { jdbc { jdbc\_driver\_library =\> "/Users/ninhnguyen/Desktop/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.Ora… --- ## [Creating choropleth maps using only geo locations](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995)
**Author:** [@Daniil\_Naumov](https://discuss.elastic.co/u/Daniil_Naumov)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 4:29pm UTC](https://discuss.elastic.co/t/creating-choropleth-maps-using-only-geo-locations/284995 "2021-09-27T16:29:19Z")
How can I visualise requests on choropleth map if I have only location data in logs? --- ## [Unable to load Kibana UI from Internet Exlporer](https://discuss.elastic.co/t/unable-to-load-kibana-ui-from-internet-exlporer/284118)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 5\ **Last updated:** [September 27, 2021, 3:49pm UTC](https://discuss.elastic.co/t/unable-to-load-kibana-ui-from-internet-exlporer/284118 "2021-09-27T15:49:50Z")
I have completed installing Kibana, Logstash and ElasticStack all versions 7.13.4 (In that order) in the production environment. Each portion of the stack is installed on it's own Red Hat Enterprise 8 server, and Elasti… --- ## [Can I create a Data table which aggregates a top hit per ID?](https://discuss.elastic.co/t/can-i-create-a-data-table-which-aggregates-a-top-hit-per-id/285089)
**Author:** [@Joao\_Silva](https://discuss.elastic.co/u/Joao_Silva)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:58pm UTC](https://discuss.elastic.co/t/can-i-create-a-data-table-which-aggregates-a-top-hit-per-id/285089 "2021-09-27T14:58:21Z")
Imagine that I have documents with the fields ID, ValueA, ValueB and that my index for each ID, let's say from 1 to 50 have some random values for A and B. Is it possible to build a visualization with 50 rows, one per I… --- ## [Detecting DNS Exfiltration](https://discuss.elastic.co/t/detecting-dns-exfiltration/285239)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 2:47pm UTC](https://discuss.elastic.co/t/detecting-dns-exfiltration/285239 "2021-09-27T14:47:56Z")
Hello, we ingest dns logs into Elasticsearch. the format is domain -\> whole domain -\> deeper.cdn.example.com domain1 -\> com domain2 -\> example domain3 -\> cdn domain4 -\> deeper Now we want to create a siem detecti… --- ## [How to calculate the average count with term](https://discuss.elastic.co/t/how-to-calculate-the-average-count-with-term/284879)
**Author:** [@forst](https://discuss.elastic.co/u/forst)\ **Replies:** 7\ **Last updated:** [September 27, 2021, 2:31pm UTC](https://discuss.elastic.co/t/how-to-calculate-the-average-count-with-term/284879 "2021-09-27T14:31:44Z")
I am looking to make a heatmap type visualization, I wanted to put the time on x-axis and the team (name) on y-axis. a team has a number of different jobs I wanted to put the average count with : count total / count j… --- ## [ECK Update Secret for Kibana.yml fails](https://discuss.elastic.co/t/eck-update-secret-for-kibana-yml-fails/285082)
**Author:** [@bwheatley](https://discuss.elastic.co/u/bwheatley)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 2:19pm UTC](https://discuss.elastic.co/t/eck-update-secret-for-kibana-yml-fails/285082 "2021-09-27T14:19:35Z")
Good Morning, This is hopefully me being stupid and missing something easy. If someone can point me in the right direction I would appreciate it. I'm trying to update the secret quickstart-kb-config so i can update my … --- ## [Elastic Stack Mapping Error](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871)
**Author:** [@dayajamal](https://discuss.elastic.co/u/dayajamal)\ **Replies:** 9\ **Last updated:** [September 27, 2021, 2:15pm UTC](https://discuss.elastic.co/t/elastic-stack-mapping-error/284871 "2021-09-27T14:15:13Z")
Hello, this my second time posting here with a hope to find a solution this time. I'm working on the Elastic Stack. I'm sending logs from Filebeat through Logstash to Elasticsearch. My logs get structured in Logstash, no… --- ## [Logstash not processing syslog data (logs not arriving in Elastic)](https://discuss.elastic.co/t/logstash-not-processing-syslog-data-logs-not-arriving-in-elastic/285177)
**Author:** [@hazenvs](https://discuss.elastic.co/u/hazenvs)\ **Replies:** 0\ **Last updated:** [September 26, 2021, 8:53pm UTC](https://discuss.elastic.co/t/logstash-not-processing-syslog-data-logs-not-arriving-in-elastic/285177 "2021-09-26T20:53:48Z")
Logstash is up and running: \[root@node1 logstash\]# systemctl status logstash.service ● logstash.service - logstash Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled) Active: ac… --- ## [How many hosts I can list in logstash output](https://discuss.elastic.co/t/how-many-hosts-i-can-list-in-logstash-output/285093)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [September 27, 2021, 1:00pm UTC](https://discuss.elastic.co/t/how-many-hosts-i-can-list-in-logstash-output/285093 "2021-09-27T13:00:04Z")
how many hosts I can list in output section of host part? can I use wildcard? something like this? hosts =\> \["host\_123\*"\] --- ## [Upgrade Elasticsearch from 7.8.1 to 7.14.2](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217)
**Author:** [@Pete\_Watcharawit](https://discuss.elastic.co/u/Pete_Watcharawit)\ **Replies:** 4\ **Last updated:** [September 27, 2021, 10:33am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-from-7-8-1-to-7-14-2/285217 "2021-09-27T10:33:23Z")
Hello, I am having two issues with the upgrade from 7.8.1 to 7.14.2 I downloaded the tar.gz file for 7.14.2 and launched the Elasticsearch instance by running /bin/Elasticsearch. The instance updates existing indices a… --- ## [Node Stats API in 7.15 broken?](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212)
**Author:** [@oliver](https://discuss.elastic.co/u/oliver)\ **Replies:** 2\ **Last updated:** [September 27, 2021, 10:12am UTC](https://discuss.elastic.co/t/node-stats-api-in-7-15-broken/285212 "2021-09-27T10:12:22Z")
Hello! In #75433 you added a shard count structure to the Node Stats API. That results in a new JSON key named shards. However, if you run the Node Stats API with level=shards, you already have a JSON key named shards. … --- ## [How to update values present in particular field for every docs in index using DSL query](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [September 27, 2021, 9:02am UTC](https://discuss.elastic.co/t/how-to-update-values-present-in-particular-field-for-every-docs-in-index-using-dsl-query/284885 "2021-09-27T09:02:57Z")
Hi, I want to update a particular field in the index. Index contains 100 docs. I want to update field "name" with "condition\_system" in every doc where "Condition System" is present. GET part\_ther/\_search { "\_… --- ## [Logstash DLQ Metrics](https://discuss.elastic.co/t/logstash-dlq-metrics/285207)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [September 27, 2021, 8:54am UTC](https://discuss.elastic.co/t/logstash-dlq-metrics/285207 "2021-09-27T08:54:05Z")
Hi, Are there dead-letter-queue metrics collected by xpack? I don't see any but would have expected to find something. Thx D --- ## [Issue after install Logstash on Mac OS](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 3\ **Last updated:** [September 27, 2021, 9:09am UTC](https://discuss.elastic.co/t/issue-after-install-logstash-on-mac-os/284028 "2021-09-27T09:09:08Z")
Hi I've met some problem within run Logstash on Mac also I've have followed by all commands and at least try to up Logstash instance by (logstash -f /usr/local/etc/logstash/logstash.conf --path.settings=/usr/local/etc/lo… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=816) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=818)