# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=889 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 890 --- ## [Advice on optimal number of indices](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227)
**Author:** [@jratliff](https://discuss.elastic.co/u/jratliff)\ **Replies:** 1\ **Last updated:** [July 9, 2021, 12:59am UTC](https://discuss.elastic.co/t/advice-on-optimal-number-of-indices/278227 "2021-07-09T00:59:51Z")
I am working on a system to store network flow records in Elasticsearch. There are too many documents to keep for long periods (~35 million per hour). We wrote a tool to aggregate these into fewer documents (~8 million … --- ## [How to enable geo\_point or geo\_shape in csv data to linestring](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120)
**Author:** [@yuhw1](https://discuss.elastic.co/u/yuhw1)\ **Replies:** 2\ **Last updated:** [July 9, 2021, 12:07am UTC](https://discuss.elastic.co/t/how-to-enable-geo-point-or-geo-shape-in-csv-data-to-linestring/278120 "2021-07-09T00:07:22Z")
I am trying to draw a line by extracting the location and timestamp data from the geo\_point or geo\_shape index where the csv file is uploaded. But it keeps failing, and the aggregations are not applied. So, I am asking i… --- ## [More Like This (MLT) query among only documents with a given field value?](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225)
**Author:** [@aacitelli](https://discuss.elastic.co/u/aacitelli)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 11:01pm UTC](https://discuss.elastic.co/t/more-like-this-mlt-query-among-only-documents-with-a-given-field-value/278225 "2021-07-08T23:01:27Z")
I have a bunch (millions, but ideally scalable to billions/trillions) of documents in an ElasticSearch 7.13.0 index, and I am successfully performing MLT queries on them. Each document has an id, a text field, and a "clu… --- ## [Can't create new Kibana visualizations after upgrade to 7.13](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 10:00pm UTC](https://discuss.elastic.co/t/cant-create-new-kibana-visualizations-after-upgrade-to-7-13/278202 "2021-07-08T22:00:11Z")
Unfortunately I still run into issues after this upgrade: creating any kind of new visualization fails with an "Application not found" error. This is the basic license and I was trying to create a basic bar chart. It see… --- ## [Space/permission controls for "Add data" button](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187)
**Author:** [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 8:11pm UTC](https://discuss.elastic.co/t/space-permission-controls-for-add-data-button/278187 "2021-07-08T20:11:24Z")
Is there a permission to remove/hide the button shown in the screenshot? I've tried trial and error but no luck. --- ## [High CPU usages in Elastic Node](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 7:53pm UTC](https://discuss.elastic.co/t/high-cpu-usages-in-elastic-node/277996 "2021-07-08T19:53:48Z")
High CPU usages in Elastic Node In a development setting, I have both ElasticSearch, Kibana and MetricBeat running on the same server. The CPU resources are so high that I couldn’t remote onto the server. It is only wh… --- ## [Yarn kbn bootstrap fails](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 27\ **Last updated:** [July 8, 2021, 7:14pm UTC](https://discuss.elastic.co/t/yarn-kbn-bootstrap-fails/275337 "2021-07-08T19:14:17Z")
Hello everyone, I have been trying to run yarn kbn bootstrap but it keeps giving me following errors. E:\\Kibana-development\\kibana\>yarn kbn bootstrap --force-install yarn run v1.22.10 $ node scripts/kbn bootstrap --for… --- ## [How do I change a symbol on the kibana panel, as per the condition](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/how-do-i-change-a-symbol-on-the-kibana-panel-as-per-the-condition/278077 "2021-07-08T18:08:50Z")
How do I change a symbol on the kibana panel, as per the condition. example, I wanted to show that when something had a value above 10, I would place an image, and if it was less than 10, another image. It would be poss… --- ## [\[kibana 7.13\]can not support the --allow-root when using the kibana-keystore](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207)
**Author:** [@harry\_010](https://discuss.elastic.co/u/harry_010)\ **Replies:** 6\ **Last updated:** [July 8, 2021, 6:08pm UTC](https://discuss.elastic.co/t/kibana-7-13-can-not-support-the-allow-root-when-using-the-kibana-keystore/278207 "2021-07-08T18:08:26Z")
when I used the following command to create the Keystore, I got the following error. /usr/share/kibana/bin/kibana-keystore create --allow-root kibana.keystore located in the data folder is deprecated. Future versions … --- ## [Observability engineer training](https://discuss.elastic.co/t/observability-engineer-training/277845)
**Author:** [@sabualrub](https://discuss.elastic.co/u/sabualrub)\ **Replies:** 2\ **Last updated:** [July 8, 2021, 4:36pm UTC](https://discuss.elastic.co/t/observability-engineer-training/277845 "2021-07-08T16:36:30Z")
I have a problem with the training. In the lab instructions, there is a link to open kibana and practice the lab but when I click on it, it opens a page that tells that can't reach this page. I tried to use different br… --- ## [Create a table showing two "sibling" elements](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112)
**Author:** [@rgahan5c](https://discuss.elastic.co/u/rgahan5c)\ **Replies:** 7\ **Last updated:** [July 8, 2021, 3:33pm UTC](https://discuss.elastic.co/t/create-a-table-showing-two-sibling-elements/278112 "2021-07-08T15:33:34Z")
I have data that is in the form: { user\_email: "test@example.com", number\_of\_emails\_sent: 100, ... } I would like to display it in a table like: User Email Number of Emails Sent test@examp… --- ## [How to create several roles at once](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203)
**Author:** [@mcosta](https://discuss.elastic.co/u/mcosta)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-create-several-roles-at-once/278203 "2021-07-08T15:12:34Z")
Hi all, Is there a way to create several roles at once using POST /\_security/role/ API? If so, can someone plz give an example? The ideia here is to first use GET /\_security/role/, remove all reserved roles and then u… --- ## [No option for managing index patterns after Kibana Upgrade](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201)
**Author:** [@Toumal](https://discuss.elastic.co/u/Toumal)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 2:55pm UTC](https://discuss.elastic.co/t/no-option-for-managing-index-patterns-after-kibana-upgrade/278201 "2021-07-08T14:55:31Z")
I've recently upgraded to the latest Kibana version (7.13) and now I don't see any option to manage index patterns. Any hints what I can do here? I have quite a few dashboards set up and simply starting over is not r… --- ## ["allocate\_explanation" : "allocation temporarily throttled"](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 0\ **Last updated:** [June 23, 2021, 1:21am UTC](https://discuss.elastic.co/t/allocate-explanation-allocation-temporarily-throttled/276709 "2021-06-23T01:21:10Z")
Hello World! Per Cluster Allocation Explain API | Elasticsearch Guide \[6.8\] | Elastic - I ran and got following: GET /\_cluster/allocation/explain "node\_decision" : "throttled", "deciders" : \[ { … --- ## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/277844)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 7\ **Last updated:** [July 8, 2021, 2:17pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/277844 "2021-07-08T14:17:09Z")
Hi There, I have recently enabled SSL for my elastic instance using out company provided SSL certificate. The elasticsearch is running fine and i can query it using https url. However when I open Kibana it says "Kibana … --- ## [Elasticsearch 7.13](https://discuss.elastic.co/t/elasticsearch-7-13/278193)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-13/278193 "2021-07-08T14:01:05Z")
Hello Expert, I have installed ELK stack on rhel and Power BI on window 10. But by which ways I can do the connectivity ? is there any plugin through which it can be connected. --- ## [Get grouped results along with siblings not matching the filter criteria](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003)
**Author:** [@Federico\_Martinez](https://discuss.elastic.co/u/Federico_Martinez)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 1:21pm UTC](https://discuss.elastic.co/t/get-grouped-results-along-with-siblings-not-matching-the-filter-criteria/278003 "2021-07-08T13:21:00Z")
Hi, is it possible to query elastic for documents matching a filter criteria, grouped by a field and also get any sibling documents not matching the filter criteria? By siblings I mean documents having the same value on… --- ## [Kibana custome timestamp and @timeestamp are different](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561)
**Author:** [@mrunalini](https://discuss.elastic.co/u/mrunalini)\ **Replies:** 22\ **Last updated:** [July 8, 2021, 1:14pm UTC](https://discuss.elastic.co/t/kibana-custome-timestamp-and-timeestamp-are-different/277561 "2021-07-08T13:14:00Z")
Hi Team, I am using below xml/xpath statement to convert my string timestamp to date type timestamp in logstash input - 2021-06-30-20:11:23 xpath - xpath =\>\[ "concat(substring(/AdMsg/AdLels/AuditLevel/TS/text(), 1,10)… --- ## [Changing Time Format](https://discuss.elastic.co/t/changing-time-format/278115)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 12:53pm UTC](https://discuss.elastic.co/t/changing-time-format/278115 "2021-07-08T12:53:25Z")
I have a filter that is reading 2 fields (STARTTIME and ENDTIME) from a CSV file and then changing to deviceCustomString1 and deviceCustomString2 and I need to change the time layout. I am trying to change the time form… --- ## [Unable to send email alert using email connector in kibana](https://discuss.elastic.co/t/unable-to-send-email-alert-using-email-connector-in-kibana/278059)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 5\ **Last updated:** [July 8, 2021, 12:15pm UTC](https://discuss.elastic.co/t/unable-to-send-email-alert-using-email-connector-in-kibana/278059 "2021-07-08T12:15:39Z")
Hi Community, After enable TLS connection between kibana and Elasticsearch ,I'm unable to send email alert using email connector. When send test mail, the result is "Error upgrading connection with STARTTLS: 454 4.7.0 … --- ## [This version of the JDBC driver is only compatible with Elasticsearch version 7.13 or newer; attempting to connect to a server version 7.4.2](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135)
**Author:** [@MinwooKim](https://discuss.elastic.co/u/MinwooKim)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 11:31am UTC](https://discuss.elastic.co/t/this-version-of-the-jdbc-driver-is-only-compatible-with-elasticsearch-version-7-13-or-newer-attempting-to-connect-to-a-server-version-7-4-2/278135 "2021-07-08T11:31:43Z")
Hello, I am trying to put my elasticsearch in database views, using intellij's Datagrip. this is where I got the jdbc driver source. meanwhile, my elastic search server has 7.4.2 version. Isn't 7.4.2 newer than 7.1… --- ## [Is it necessary to delete a PIT?](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752)
**Author:** [@zhiyazw](https://discuss.elastic.co/u/zhiyazw)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 10:33am UTC](https://discuss.elastic.co/t/is-it-necessary-to-delete-a-pit/277752 "2021-07-08T10:33:17Z")
In search after section, ELasticsearch said, "When you’re finished, you should delete your PIT". Is this necessary? Does a PIT get deleted automatically after timeout? Just as "Scroll" does. It's not easy to find a goo… --- ## [Multi value field different scoring for terms and terms\_set queries](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172)
**Author:** [@zordark](https://discuss.elastic.co/u/zordark)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 10:24am UTC](https://discuss.elastic.co/t/multi-value-field-different-scoring-for-terms-and-terms-set-queries/278172 "2021-07-08T10:24:28Z")
Good day, I have small question regarding scoring. I'm using example from documentation (Terms query). If I query documents by multiple values with 'terms', like: GET my-index-000001/\_search?pretty { "query": { … --- ## [Splitting csv files send to elasticsearch via logstash http input](https://discuss.elastic.co/t/splitting-csv-files-send-to-elasticsearch-via-logstash-http-input/278144)
**Author:** [@reynavan](https://discuss.elastic.co/u/reynavan)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 7:19am UTC](https://discuss.elastic.co/t/splitting-csv-files-send-to-elasticsearch-via-logstash-http-input/278144 "2021-07-08T07:19:45Z")
Hello! I am new to ELK stack and I'm looking for some advice. I have 3 different types of csv's files which are generated every day, I'm sending them to IP address where logstash is configured, than i want to visualize … --- ## [Missing authentication credentials for REST request \[/\_cluster/health?pretty\] In minimal security set up](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162)
**Author:** [@Mamol27](https://discuss.elastic.co/u/Mamol27)\ **Replies:** 0\ **Last updated:** [July 8, 2021, 9:36am UTC](https://discuss.elastic.co/t/missing-authentication-credentials-for-rest-request-cluster-health-pretty-in-minimal-security-set-up/278162 "2021-07-08T09:36:57Z")
Hi! I'm trying to set up basic security on elastic cluster. my elasticsearch.yml: cluster.name: ELK-CLUSTER node.name: $HOSTNAME node.master: true node.data: false node.ingest: false network.host: 0.0.0.0 http.port: … --- ## [Logstash can't write logs in the path](https://discuss.elastic.co/t/logstash-cant-write-logs-in-the-path/278155)
**Author:** [@Andrea\_Colangelo](https://discuss.elastic.co/u/Andrea_Colangelo)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 9:25am UTC](https://discuss.elastic.co/t/logstash-cant-write-logs-in-the-path/278155 "2021-07-08T09:25:04Z")
Hi, i am having an error on logstash when i start it. that's my log: Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will like… --- ## [Logstash uses current year for timestamp without year and shows events with future dates](https://discuss.elastic.co/t/logstash-uses-current-year-for-timestamp-without-year-and-shows-events-with-future-dates/277877)
**Author:** [@theirfan](https://discuss.elastic.co/u/theirfan)\ **Replies:** 4\ **Last updated:** [July 8, 2021, 8:26am UTC](https://discuss.elastic.co/t/logstash-uses-current-year-for-timestamp-without-year-and-shows-events-with-future-dates/277877 "2021-07-08T08:26:53Z")
Hi Community !! I have logs wherein there's no year mentioned, and while parsing, logstash adds current year and makes the event appear in future dates. i checked on forums for a similar issue but unfortunately, there … --- ## [Deploying New Elastic Cluster and Migrate Live Logs](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 8\ **Last updated:** [July 8, 2021, 8:22am UTC](https://discuss.elastic.co/t/deploying-new-elastic-cluster-and-migrate-live-logs/278092 "2021-07-08T08:22:48Z")
Hi folks, I have following use case: I want to install a new 7.13.2 Elasticsearch cluster on some brand new VMs and migrate the indices and global cluster state from 7.6.2 cluster into it. The challenge is: there are … --- ## [Show fields by eventID](https://discuss.elastic.co/t/show-fields-by-eventid/278149)
**Author:** [@Arethusa](https://discuss.elastic.co/u/Arethusa)\ **Replies:** 1\ **Last updated:** [July 8, 2021, 8:14am UTC](https://discuss.elastic.co/t/show-fields-by-eventid/278149 "2021-07-08T08:14:11Z")
Hello, I'm on Kibana V 7.12.0 I have lot of Fields on Kibana : "Kibana\> Index Patterns" (1500+). I this case the logs are from Windows (nxlog). I have a field with windows event ID (5447 for example). Is it possibl… --- ## [Kibana lens](https://discuss.elastic.co/t/kibana-lens/277807)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 3\ **Last updated:** [July 8, 2021, 7:39am UTC](https://discuss.elastic.co/t/kibana-lens/277807 "2021-07-08T07:39:56Z")
Hello Expert, Is there any possibility that to do changes in the tool tip... in lens it shows all the values which is correspondence to the data. But i need just focused like in TSVB Thanks [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=888) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=890)