# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=885 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 886 --- ## [How can I see which line of the csv file I am on?](https://discuss.elastic.co/t/how-can-i-see-which-line-of-the-csv-file-i-am-on/278613)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 4\ **Last updated:** [July 14, 2021, 6:39am UTC](https://discuss.elastic.co/t/how-can-i-see-which-line-of-the-csv-file-i-am-on/278613 "2021-07-14T06:39:43Z")
Hello friends, I have a question. When transferring data to elasticsearch with Logstash, can I see which line of the csv file it is in? For example, the field named path shows me which csv file I am in. So, is there a fi… --- ## [Adding Elasticsearch Data Node To Cluster](https://discuss.elastic.co/t/adding-elasticsearch-data-node-to-cluster/278466)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [July 14, 2021, 5:30am UTC](https://discuss.elastic.co/t/adding-elasticsearch-data-node-to-cluster/278466 "2021-07-14T05:30:32Z")
I was using a single node Elastic stack cluster and now adding a data node to my cluster. However, somehow the second node is not reflecting in the Kibana stack monitoring page, even if both elastic nodes are working wit… --- ## [How to update the css and rebuild kibana](https://discuss.elastic.co/t/how-to-update-the-css-and-rebuild-kibana/278476)
**Author:** [@invinciblezz](https://discuss.elastic.co/u/invinciblezz)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 9:40pm UTC](https://discuss.elastic.co/t/how-to-update-the-css-and-rebuild-kibana/278476 "2021-07-13T21:40:34Z")
I want to update the style of dark mode. I updated the css in ./node\_modules/@elastic/eui/dist/eui\_theme\_dark.css but it is not working. What should I do? Thanks! --- ## [ECK - all the nodes leaving the cluster often](https://discuss.elastic.co/t/eck-all-the-nodes-leaving-the-cluster-often/277738)
**Author:** [@Kannappan\_Somu](https://discuss.elastic.co/u/Kannappan_Somu)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 8:35pm UTC](https://discuss.elastic.co/t/eck-all-the-nodes-leaving-the-cluster-often/277738 "2021-07-13T20:35:27Z")
in our eck cluster , all data node and master nodes leaving often with node left messages and follower retry count exceeded. from metrics we could see there is no evidence of system overload or cpu overloaded or heap mem… --- ## [How to use nested JSON fields to search for content and drop it](https://discuss.elastic.co/t/how-to-use-nested-json-fields-to-search-for-content-and-drop-it/278576)
**Author:** [@Alex\_Pilon](https://discuss.elastic.co/u/Alex_Pilon)\ **Replies:** 11\ **Last updated:** [July 13, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-use-nested-json-fields-to-search-for-content-and-drop-it/278576 "2021-07-13T19:13:28Z")
Hi all, Been stuck on this since yesterday, and now I'm at a loss. Basically: Using the Azure EventHub input plugin, I'm ingesting Azure logs from various sources, one of the being Azure SQL Audit logs, which are all i… --- ## [Fewer documents indexed when using custom analyzer (NEST client)](https://discuss.elastic.co/t/fewer-documents-indexed-when-using-custom-analyzer-nest-client/278358)
**Author:** [@Mario\_Klisanic](https://discuss.elastic.co/u/Mario_Klisanic)\ **Replies:** 3\ **Last updated:** [July 13, 2021, 6:18pm UTC](https://discuss.elastic.co/t/fewer-documents-indexed-when-using-custom-analyzer-nest-client/278358 "2021-07-13T18:18:56Z")
Hello everyone, while working on a project of mine (using NEST client for .NET), I realized that the total number of documents indexed is different when using an analyzer from the number of documents indexed without the… --- ## [How to add elasticsearch as a service in background in mac OS](https://discuss.elastic.co/t/how-to-add-elasticsearch-as-a-service-in-background-in-mac-os/278563)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 3:43pm UTC](https://discuss.elastic.co/t/how-to-add-elasticsearch-as-a-service-in-background-in-mac-os/278563 "2021-07-13T15:43:55Z")
Hi all, I installed elasticsearch using tar package in mac OS. To run elasticsearch, i run elasticsearch exe file in terminal. If i close the terminal, elasticsearch service stops. How do i run elasticsearch in backg… --- ## [Logstash record\_last\_run updated on output issue](https://discuss.elastic.co/t/logstash-record-last-run-updated-on-output-issue/278570)
**Author:** [@spawnrider](https://discuss.elastic.co/u/spawnrider)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 5:10pm UTC](https://discuss.elastic.co/t/logstash-record-last-run-updated-on-output-issue/278570 "2021-07-13T17:10:21Z")
Hi, Why Logstash (JDBC input plugin) is recording the "Record Last Run" timestamp in the metadata file even if there is an issue on the output ? I had an connection issue (due to network) to the Elasticsearch instance … --- ## [Kibana visualization to calculate percentage](https://discuss.elastic.co/t/kibana-visualization-to-calculate-percentage/278553)
**Author:** [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 4:44pm UTC](https://discuss.elastic.co/t/kibana-visualization-to-calculate-percentage/278553 "2021-07-13T16:44:44Z")
All, I am trying to calculate percentage based on hits with filter query for example index=test and status=disconnected - disconnected\_hits index=test total\_hits percentage = disconnected\_hits/total\_hits \* 100 f… --- ## [Incident management with ServiceNow and Elasticsearch](https://discuss.elastic.co/t/incident-management-with-servicenow-and-elasticsearch/278579)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 4:39pm UTC](https://discuss.elastic.co/t/incident-management-with-servicenow-and-elasticsearch/278579 "2021-07-13T16:39:40Z")
I have followed part 1 and part 2 Everything works great. Only minor issue is its creating duplicate incidents. If i put throttle period then if some other app has status down , it wont trigger an incident :frowning: if… --- ## [Kibana Data table with different relative dates per row](https://discuss.elastic.co/t/kibana-data-table-with-different-relative-dates-per-row/278560)
**Author:** [@Ivan\_Doronin](https://discuss.elastic.co/u/Ivan_Doronin)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 4:32pm UTC](https://discuss.elastic.co/t/kibana-data-table-with-different-relative-dates-per-row/278560 "2021-07-13T16:32:26Z")
I have logs of user logins. I need to build a table where I can see login activity of starting the first time he/she logged in, and each column would be another day( 2nd, 3rd) It would look something like this Issue… --- ## [Can I change the elastic built-in user password?](https://discuss.elastic.co/t/can-i-change-the-elastic-built-in-user-password/278573)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 4:00pm UTC](https://discuss.elastic.co/t/can-i-change-the-elastic-built-in-user-password/278573 "2021-07-13T16:00:38Z")
Hi, I was wandering if I can change the password of the elastic user. after its set trough bin/elasticsearch-setup-passwords ? Thanks. --- ## [Grokparsefailure when %{TIMESTAMP\_ISO8601} pattern is in the first position parser](https://discuss.elastic.co/t/grokparsefailure-when-timestamp-iso8601-pattern-is-in-the-first-position-parser/278308)
**Author:** [@Adixon\_Diaz](https://discuss.elastic.co/u/Adixon_Diaz)\ **Replies:** 5\ **Last updated:** [July 13, 2021, 3:38pm UTC](https://discuss.elastic.co/t/grokparsefailure-when-timestamp-iso8601-pattern-is-in-the-first-position-parser/278308 "2021-07-13T15:38:25Z")
Hi Elastic Team, I have a issue when in my grok filter y put first the pattern %{TIMESTAMP\_ISO8601}. I share a example: With %{TIMESTAMP\_ISO8601} at first position: grok Debugger: I got \[1\] "\_grokparsefailure" … --- ## [Using CCR For Cluster Migration](https://discuss.elastic.co/t/using-ccr-for-cluster-migration/278441)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/using-ccr-for-cluster-migration/278441 "2021-07-13T15:13:21Z")
I am looking at standing up a new Elasticsearch cluster and migrating from our current single node. What's the best way for moving our existing data, about 10TB to the new cluster? Would CCR facilitate the move best? I… --- ## [Can somebody tell me what is in this log?](https://discuss.elastic.co/t/can-somebody-tell-me-what-is-in-this-log/278547)
**Author:** [@Vladimir](https://discuss.elastic.co/u/Vladimir)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 2:58pm UTC](https://discuss.elastic.co/t/can-somebody-tell-me-what-is-in-this-log/278547 "2021-07-13T14:58:51Z")
I can not start Elastic although I can do it few days before. root@vmi503579:~# journalctl -ex Jul 13 15:27:55 vmi503579.contaboserver.net kernel: \[ 884825\] 33 884825 59113 6477 241664 686 0… --- ## [Get metrics for pods that no longer exist](https://discuss.elastic.co/t/get-metrics-for-pods-that-no-longer-exist/278558)
**Author:** [@George\_Guliman](https://discuss.elastic.co/u/George_Guliman)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/get-metrics-for-pods-that-no-longer-exist/278558 "2021-07-13T14:56:16Z")
Hello, Can someone recommend me a method to get metrics for CPU and memory for pods that no longer exist. The reason for which they no longer exist doesn't really matter, they could have been evicted, delete by someone,… --- ## [Problem with Top N in TSVB](https://discuss.elastic.co/t/problem-with-top-n-in-tsvb/278433)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 3\ **Last updated:** [July 13, 2021, 2:25pm UTC](https://discuss.elastic.co/t/problem-with-top-n-in-tsvb/278433 "2021-07-13T14:25:07Z")
Hi everyone, i have two problems with the top N function in the TSVB. Problem1: If I use "Group by" Terms and i set the value of Top to for example 50, but i only have 30 different terms, than the TopN function doesn't… --- ## [How can i combine the information of two indexes with kibana lens?](https://discuss.elastic.co/t/how-can-i-combine-the-information-of-two-indexes-with-kibana-lens/278242)
**Author:** [@alprde](https://discuss.elastic.co/u/alprde)\ **Replies:** 6\ **Last updated:** [July 13, 2021, 1:57pm UTC](https://discuss.elastic.co/t/how-can-i-combine-the-information-of-two-indexes-with-kibana-lens/278242 "2021-07-13T13:57:47Z")
I have two indexes named market place and stalls. How many stalls in which market place? How can I show this with kibana lens? marketplace fields: id name stalls fields: id stall\_no marketplace\_id --- ## [Aggregate filter plugin session duration](https://discuss.elastic.co/t/aggregate-filter-plugin-session-duration/278099)
**Author:** [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)\ **Replies:** 13\ **Last updated:** [July 13, 2021, 1:51pm UTC](https://discuss.elastic.co/t/aggregate-filter-plugin-session-duration/278099 "2021-07-13T13:51:28Z")
Hello, Reviewing ways to calculate session duration and using transforms I was able to calculate session duration by finding the min and max time between timestamps. This is fine except in cases where there is no uniqu… --- ## [Filter for parsing Forticlient, Fortiweb, Fortisandbox, Fortimail](https://discuss.elastic.co/t/filter-for-parsing-forticlient-fortiweb-fortisandbox-fortimail/278549)
**Author:** [@Aleksei](https://discuss.elastic.co/u/Aleksei)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:47pm UTC](https://discuss.elastic.co/t/filter-for-parsing-forticlient-fortiweb-fortisandbox-fortimail/278549 "2021-07-13T13:47:34Z")
Hello everyone. Who ever integration to Elastic Fortinet production - Forticlient AV, FortiWeb, Fortisandbox, Fortimail ? --- ## [Cases as Metrics](https://discuss.elastic.co/t/cases-as-metrics/278545)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 1:20pm UTC](https://discuss.elastic.co/t/cases-as-metrics/278545 "2021-07-13T13:20:07Z")
Hi All, I was wondering if anyone has any ideas for how to use cases within Elastic security for gathering/reporting metrics? I'm looking for collecting metrics like, mean time to detection, mean time to mitigation, me… --- ## [Multiple kubernetes cluster in kibana](https://discuss.elastic.co/t/multiple-kubernetes-cluster-in-kibana/277973)
**Author:** [@milena\_uehara](https://discuss.elastic.co/u/milena_uehara)\ **Replies:** 2\ **Last updated:** [July 13, 2021, 1:05pm UTC](https://discuss.elastic.co/t/multiple-kubernetes-cluster-in-kibana/277973 "2021-07-13T13:05:56Z")
Is it possible to have multiple k8s cluster in kibana? For example, dev cluster, stg cluster and prod cluster? The cluster is in AWS EKS. --- ## [CEF codec outputting multiple CEF logs into single CEF l](https://discuss.elastic.co/t/cef-codec-outputting-multiple-cef-logs-into-single-cef-l/278477)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 4\ **Last updated:** [July 13, 2021, 12:35pm UTC](https://discuss.elastic.co/t/cef-codec-outputting-multiple-cef-logs-into-single-cef-l/278477 "2021-07-13T12:35:13Z")
Hey Everyone, I am having an issue when I output to a syslog sever using the CEF codec from the logs we receive from Filbeat. The logs contain mulitple individual CEF longs into one log, so sometimes you can get 3 diff… --- ## [Status bar is out of an order(how to set missing value of sum)](https://discuss.elastic.co/t/status-bar-is-out-of-an-order-how-to-set-missing-value-of-sum/278396)
**Author:** [@paigekim](https://discuss.elastic.co/u/paigekim)\ **Replies:** 5\ **Last updated:** [July 13, 2021, 12:03pm UTC](https://discuss.elastic.co/t/status-bar-is-out-of-an-order-how-to-set-missing-value-of-sum/278396 "2021-07-13T12:03:27Z")
Hello, I am currently using Kibana to analayze our revenues using stacked bars each months per year. There is a minor issue that I would like to fix but had a hard time how to do. For example, the values start from Marc… --- ## [Logstash line codec not visible](https://discuss.elastic.co/t/logstash-line-codec-not-visible/278529)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 11:35am UTC](https://discuss.elastic.co/t/logstash-line-codec-not-visible/278529 "2021-07-13T11:35:26Z")
Not real where to go from where. I can see the codec: C:\\logstash-7.11.0\\bin\>logstash-plugin list Using JAVA\_HOME defined java: C:\\Program Files\\Java\\jdk-14.0.1 WARNING, using JAVA\_HOME while Logstash distribution comes… --- ## [Windowsアプリケーションログをlogstashで解析する方法](https://discuss.elastic.co/t/windows-logstash/278527)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 11:18am UTC](https://discuss.elastic.co/t/windows-logstash/278527 "2021-07-13T11:18:10Z")
以下のようなWindowsアプリケーションログをlogstashで1つのドキュメントとして取り込みたいです。 ログの名前: Application ソース: Microsoft-Windows-Security-SPP 日付: 2021/06/28 12:53:18 イベント ID: 16394 タスクのカテゴリ: なし レベル: 情報… --- ## [Logstash "Duplicate field 'match'](https://discuss.elastic.co/t/logstash-duplicate-field-match/278524)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 10:42am UTC](https://discuss.elastic.co/t/logstash-duplicate-field-match/278524 "2021-07-13T10:42:39Z")
Hi all I am using following input in logstash conf file to checking matching of a field. input { elasticsearch { hosts =\> \["http://localhost:9200/"\] index =\> "log\*" query =\> '{ "query": { "bool" : { … --- ## [How to prevent duplicate and has null value documents with fingerprint](https://discuss.elastic.co/t/how-to-prevent-duplicate-and-has-null-value-documents-with-fingerprint/278150)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 16\ **Last updated:** [July 13, 2021, 10:33am UTC](https://discuss.elastic.co/t/how-to-prevent-duplicate-and-has-null-value-documents-with-fingerprint/278150 "2021-07-13T10:33:20Z")
my csv file =\> name,surname,age,email,phone Harry,Potter,18,NULL,NULL Harry,Potter,NULL,harrypotter@gmail.com,+955555555 Harry,Potter,NULL,harrypotter@gmail.com,NULL Harry,Potter,NULL,NULL,+955555555 When I want to dete… --- ## [Add own snapshot repository in elastic.co](https://discuss.elastic.co/t/add-own-snapshot-repository-in-elastic-co/278519)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 1\ **Last updated:** [July 13, 2021, 10:28am UTC](https://discuss.elastic.co/t/add-own-snapshot-repository-in-elastic-co/278519 "2021-07-13T10:28:16Z")
I am using a managed/hosted ES cluster in elastic.co I want to register a GCS repository using my own bucket. I suppose at some point in time throughout the registration process, I will have to pass the json document h… --- ## [Collapsed results participating in sorting](https://discuss.elastic.co/t/collapsed-results-participating-in-sorting/278512)
**Author:** [@Markos\_Fragkakis](https://discuss.elastic.co/u/Markos_Fragkakis)\ **Replies:** 0\ **Last updated:** [July 13, 2021, 9:28am UTC](https://discuss.elastic.co/t/collapsed-results-participating-in-sorting/278512 "2021-07-13T09:28:32Z")
I am using Elasticsearch and I want to group our results by a specific field, returning only the most recent document per group. When scoring and sorting, I want the documents I am not returning (the ones that are older)… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=884) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=886)