# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=906 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 907 --- ## [Time difference](https://discuss.elastic.co/t/time-difference/276300)
**Author:** [@Cgr\_EQ](https://discuss.elastic.co/u/Cgr_EQ)\ **Replies:** 2\ **Last updated:** [June 23, 2021, 4:10am UTC](https://discuss.elastic.co/t/time-difference/276300 "2021-06-23T04:10:07Z")
I have 2 documents and each document fields are as follow: Timestamp / ID / Field 2021-06-15 12:00:00 / 1 / Start (doc1) 2021-06-15 12… --- ## [I want to ask about elasticsearch and Ubuntu](https://discuss.elastic.co/t/i-want-to-ask-about-elasticsearch-and-ubuntu/276716)
**Author:** [@an\_dinh](https://discuss.elastic.co/u/an_dinh)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 3:46am UTC](https://discuss.elastic.co/t/i-want-to-ask-about-elasticsearch-and-ubuntu/276716 "2021-06-23T03:46:24Z")
When I setup Elasticsearch on Ubuntu, I made a mistake when putting 7.11.2 to: echo "deb https://artifacts.elastic.co/packages/7.11.2/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.11.2.list so now, wh… --- ## [Is it okay to make 7 nodes of cluster in one machine(server)?](https://discuss.elastic.co/t/is-it-okay-to-make-7-nodes-of-cluster-in-one-machine-server/276614)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 10\ **Last updated:** [June 23, 2021, 3:23am UTC](https://discuss.elastic.co/t/is-it-okay-to-make-7-nodes-of-cluster-in-one-machine-server/276614 "2021-06-23T03:23:58Z")
Hello. I am running ELK and this has only one node of cluster on server.(ELK version is 6.8) The indices size per a day is about below 100GB but it's gonna increase. So I need to divide nodes to master node and data no… --- ## [Kibana dashboards to monitoring used size in GB](https://discuss.elastic.co/t/kibana-dashboards-to-monitoring-used-size-in-gb/276626)
**Author:** [@gneves](https://discuss.elastic.co/u/gneves)\ **Replies:** 1\ **Last updated:** [June 23, 2021, 12:04am UTC](https://discuss.elastic.co/t/kibana-dashboards-to-monitoring-used-size-in-gb/276626 "2021-06-23T00:04:40Z")
Hello guys, After a long research i couldnt find what is a requirement for my project. So, i'm using Elastic Siem, essentially with ELK + Filebeat, AuditBeat, WinLogBeat, MetricBeat, Heartbeat etc... And i have a requ… --- ## [Drop field based on pattern](https://discuss.elastic.co/t/drop-field-based-on-pattern/276443)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 9:49pm UTC](https://discuss.elastic.co/t/drop-field-based-on-pattern/276443 "2021-06-22T21:49:51Z")
Hi, I have some field names that begin with the string "sub" that I want Logstash to drop. Can I do something like: if \[sub\*\] { drop {} } --- ## [KIbana pods getting created than given replica count](https://discuss.elastic.co/t/kibana-pods-getting-created-than-given-replica-count/276601)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 8:43pm UTC](https://discuss.elastic.co/t/kibana-pods-getting-created-than-given-replica-count/276601 "2021-06-22T20:43:55Z")
We had deployed eck(1.3.0) in a GKE cluster with 2 data-ingest and 3 master pods and 1 kibana pod(7.9.0). We had given 1 replica count for kibana configuration and deployed. But may kibana pods are getting created and t… --- ## [Logstash error : no implicit conversion of nil into Integer](https://discuss.elastic.co/t/logstash-error-no-implicit-conversion-of-nil-into-integer/276688)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 8:40pm UTC](https://discuss.elastic.co/t/logstash-error-no-implicit-conversion-of-nil-into-integer/276688 "2021-06-22T20:40:14Z")
Hello, elastic people, I have been making a filter in logstash of a conditional to analyze the status of a team according to the metrics, I tried it, but I get the following error, I need help with this please: \[ERROR\] … --- ## [Logstash: формирование @timestamp, используя имя файла лога и данные самого лога (ч. 2)](https://discuss.elastic.co/t/logstash-timestamp-2/276144)
**Author:** [@lkfmasd](https://discuss.elastic.co/u/lkfmasd)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 7:06pm UTC](https://discuss.elastic.co/t/logstash-timestamp-2/276144 "2021-06-22T19:06:35Z")
Добрый день. Продолжение темы: Logstash: формирование @timestamp, используя имя файла лога и данные самого лога. Продублирую задачу: На текущий момент поле @timestamp формируется, исходя из даты, когда данные были пер… --- ## [How to customize navbar logo in 7.12.1](https://discuss.elastic.co/t/how-to-customize-navbar-logo-in-7-12-1/276170)
**Author:** [@Kanishk\_Madan](https://discuss.elastic.co/u/Kanishk_Madan)\ **Replies:** 7\ **Last updated:** [June 22, 2021, 6:47pm UTC](https://discuss.elastic.co/t/how-to-customize-navbar-logo-in-7-12-1/276170 "2021-06-22T18:47:38Z")
hello community i want to change the navbar logo that is elastic how can I do it in 7.12.1. --- ## [Error Provisioning Index Pattern](https://discuss.elastic.co/t/error-provisioning-index-pattern/276172)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 6\ **Last updated:** [June 22, 2021, 6:42pm UTC](https://discuss.elastic.co/t/error-provisioning-index-pattern/276172 "2021-06-22T18:42:03Z")
Hi, I'm trying to create an index pattern from the following json file: { "index\_pattern": { "id": "\" "version": "0.1" "title": "test-\*", "timeFieldName": "@timestamp", "fieldFormats":… --- ## [Beep actiontype](https://discuss.elastic.co/t/beep-actiontype/273851)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 6:39pm UTC](https://discuss.elastic.co/t/beep-actiontype/273851 "2021-06-22T18:39:03Z")
I have added a new actionType to my kibana source. I register it in both server and client side my action id is : .beep at this moment i log a message in file. but i want to play a beep sound in my kibana. how can… --- ## [Unble to convert to date string field](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661)
**Author:** [@casquero](https://discuss.elastic.co/u/casquero)\ **Replies:** 10\ **Last updated:** [June 22, 2021, 6:30pm UTC](https://discuss.elastic.co/t/unble-to-convert-to-date-string-field/276661 "2021-06-22T18:30:09Z")
I've tried to create a new field as date but always appears as string in Kibana, I've done the following: mutate { add\_field =\> { "timestampTest" =\> "%{localisodate}" } } date { match =\> \["timest… --- ## [Generate Event in Kibana when clicking at the table row in Dashboard?](https://discuss.elastic.co/t/generate-event-in-kibana-when-clicking-at-the-table-row-in-dashboard/273929)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 6:18pm UTC](https://discuss.elastic.co/t/generate-event-in-kibana-when-clicking-at-the-table-row-in-dashboard/273929 "2021-06-22T18:18:26Z")
It is possible to generate event when clicking at the table row and That generated event send data to the other index in the kibana. Is it possible to generate event on table row in kibana. --- ## [Sort/Toggle Detection Rules by Severity or Risk Score](https://discuss.elastic.co/t/sort-toggle-detection-rules-by-severity-or-risk-score/276064)
**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 5:48pm UTC](https://discuss.elastic.co/t/sort-toggle-detection-rules-by-severity-or-risk-score/276064 "2021-06-22T17:48:30Z")
Is it possible to sort detection rules by risk score or severity? I would like to only enable rules above a certain severity/risk score. What is the best way to do this? --- ## [Wrong Total on listed fields in an index pattern](https://discuss.elastic.co/t/wrong-total-on-listed-fields-in-an-index-pattern/276684)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 5:29pm UTC](https://discuss.elastic.co/t/wrong-total-on-listed-fields-in-an-index-pattern/276684 "2021-06-22T17:29:12Z")
Hi all, I have an index pattern with list format data as below: linkedGPO's { "name": "Password and lockout policy", "enabled": true, "enforced": false }, { "name": "Screen Saver Lockout Policy", "enabled": t… --- ## [Elasticsearch cluster without replication](https://discuss.elastic.co/t/elasticsearch-cluster-without-replication/276682)
**Author:** [@Abhishek\_Shinde](https://discuss.elastic.co/u/Abhishek_Shinde)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 5:17pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-without-replication/276682 "2021-06-22T17:17:51Z")
Can I create Elasticsearch cluster without replication? Which all settings needed to be taken care of, if I want to use it only for scaling and not for high availability. --- ## [Logstash error and MetricBeat stopped](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-error-and-metricbeat-stopped/276398 "2021-06-22T16:49:15Z")
I noticed yesterday that my Metricbeat service had stopped running on the Windows test box I have. When I start Logstash I receive the below information. \[2021-06-18T10:28:12,009\]\[WARN \]\[logstash.outputs.elasticsearch\]… --- ## [Getting an error while installing logstash websocket plugin](https://discuss.elastic.co/t/getting-an-error-while-installing-logstash-websocket-plugin/276618)
**Author:** [@syrine\_chelly](https://discuss.elastic.co/u/syrine_chelly)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 4:37pm UTC](https://discuss.elastic.co/t/getting-an-error-while-installing-logstash-websocket-plugin/276618 "2021-06-22T16:37:10Z")
i want to install logstash websocket pluginto make a real-time communication between Elasticsearch and Logstash, through a websocket.\`this is the error that i get while installing ERROR: Installation Aborted, message: B… --- ## [How to create View only user in Kibana for dashboard and logs](https://discuss.elastic.co/t/how-to-create-view-only-user-in-kibana-for-dashboard-and-logs/276230)
**Author:** [@Bugsbee](https://discuss.elastic.co/u/Bugsbee)\ **Replies:** 5\ **Last updated:** [June 22, 2021, 4:01pm UTC](https://discuss.elastic.co/t/how-to-create-view-only-user-in-kibana-for-dashboard-and-logs/276230 "2021-06-22T16:01:30Z")
hi all, I'm using elk cloud,now I created user but i see that the kibana\_dashboard\_only\_user ,kibana\_user is deprecated I need to be able to create user that can only view the logs and dashboard. Only admin should be … --- ## [How to query n-gram completions that match phrase prefix?](https://discuss.elastic.co/t/how-to-query-n-gram-completions-that-match-phrase-prefix/276607)
**Author:** [@sabetai](https://discuss.elastic.co/u/sabetai)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 3:17pm UTC](https://discuss.elastic.co/t/how-to-query-n-gram-completions-that-match-phrase-prefix/276607 "2021-06-22T15:17:02Z")
How can I query my index to suggest phrases that complete the user's query? I'd like a query similar to match\_phrase\_prefix , except instead of retrieving the entire doc it returns n-grams from the doc fields that comple… --- ## [Searching by \_id returns different results when the search is repeated](https://discuss.elastic.co/t/searching-by-id-returns-different-results-when-the-search-is-repeated/276577)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 3:06pm UTC](https://discuss.elastic.co/t/searching-by-id-returns-different-results-when-the-search-is-repeated/276577 "2021-06-22T15:06:38Z")
I'm on ES 6.8, with a 3 node cluster, and the status is green. First of all, I'm aware that I can Get by ID, but for this scenario, I am searching by ID. My question is.... Is this a bug, or just a quirk of how distrib… --- ## [Error while installing offline Elasticsearch 7.12](https://discuss.elastic.co/t/error-while-installing-offline-elasticsearch-7-12/276659)
**Author:** [@BenjaminD](https://discuss.elastic.co/u/BenjaminD)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 2:14pm UTC](https://discuss.elastic.co/t/error-while-installing-offline-elasticsearch-7-12/276659 "2021-06-22T14:14:33Z")
Hi everyone. I'm trying to install Elasticsearch 7.12.1 on a server for a customer. The OS is Ubuntu Server 9.3.0-17 aka 20.04 (the LTS one). OpenJDK 16 included. This server is offline so I downloaded the deb packag… --- ## [Labels missing from Namespace definition in 1.6.0](https://discuss.elastic.co/t/labels-missing-from-namespace-definition-in-1-6-0/276631)
**Author:** [@pkaramol](https://discuss.elastic.co/u/pkaramol)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 12:58pm UTC](https://discuss.elastic.co/t/labels-missing-from-namespace-definition-in-1-6-0/276631 "2021-06-22T12:58:11Z")
The Namespace definition in 1.5.0 is the following: # Source: eck-operator/templates/operator-namespace.yaml apiVersion: v1 kind: Namespace metadata: name: elastic-system labels: name: elastic-system control… --- ## [Math operation after aggregation in kibana while using scripted fields](https://discuss.elastic.co/t/math-operation-after-aggregation-in-kibana-while-using-scripted-fields/276602)
**Author:** [@shailendra](https://discuss.elastic.co/u/shailendra)\ **Replies:** 3\ **Last updated:** [June 22, 2021, 1:56pm UTC](https://discuss.elastic.co/t/math-operation-after-aggregation-in-kibana-while-using-scripted-fields/276602 "2021-06-22T13:56:16Z")
Hi Everyone, I have two scripted fields in my kibana index pattern, let's say "scripted field1" and "scripted field2". Now I wanted to display sum(scripted field1)/sum(scripted field2) in my visualisation. This kind o… --- ## [Rolling to 7.13](https://discuss.elastic.co/t/rolling-to-7-13/276165)
**Author:** [@geomario](https://discuss.elastic.co/u/geomario)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 1:45pm UTC](https://discuss.elastic.co/t/rolling-to-7-13/276165 "2021-06-22T13:45:31Z")
Hola, I am pretty new to ElasticSearch. I am trying to upgrade my node from 7.6 to 7.13. It happened that when I run my new node with 7.13, the console throws a mistake. I have searched without success on how to solve i… --- ## [How to create a kind of ID card in visualisation with value of different field](https://discuss.elastic.co/t/how-to-create-a-kind-of-id-card-in-visualisation-with-value-of-different-field/276656)
**Author:** [@chriselk](https://discuss.elastic.co/u/chriselk)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 1:41pm UTC](https://discuss.elastic.co/t/how-to-create-a-kind-of-id-card-in-visualisation-with-value-of-different-field/276656 "2021-06-22T13:41:07Z")
I'm trying to create a visualization that look like an ID card for example for a servers (a custom text list of Field : Value from a document ) SERVER: myservername CPU : 8 MEM: 24GB REGION: APAC I see… --- ## [Logstash\_7.5.2\_ Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"https://host:9200/\_bulk"}](https://discuss.elastic.co/t/logstash-7-5-2-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-400-url-https-host-9200-bulk/276635)
**Author:** [@anburethy](https://discuss.elastic.co/u/anburethy)\ **Replies:** 2\ **Last updated:** [June 22, 2021, 1:16pm UTC](https://discuss.elastic.co/t/logstash-7-5-2-encountered-a-retryable-error-will-retry-with-exponential-backoff-code-400-url-https-host-9200-bulk/276635 "2021-06-22T13:16:25Z")
Hi Team, We use an ELK stack and I actually ran into login issue for which I deleted some existing indexes which are old and the login issue sorted but I ran into another issue. I wasnt able to reindex not the new index… --- ## [Transfer logs from rsyslog to logstash and view those logs in browser](https://discuss.elastic.co/t/transfer-logs-from-rsyslog-to-logstash-and-view-those-logs-in-browser/276140)
**Author:** [@vatsal](https://discuss.elastic.co/u/vatsal)\ **Replies:** 4\ **Last updated:** [June 22, 2021, 1:02pm UTC](https://discuss.elastic.co/t/transfer-logs-from-rsyslog-to-logstash-and-view-those-logs-in-browser/276140 "2021-06-22T13:02:05Z")
Hi , I want to send syslogs from rsyslog to logstash and view those in browser. I want to do this with TLS enabled. I have tried following ways: a. configured all corresponding files. b. configured pipeline for logst… --- ## [File input plugin - Delimiter property not working](https://discuss.elastic.co/t/file-input-plugin-delimiter-property-not-working/276650)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 0\ **Last updated:** [June 22, 2021, 12:30pm UTC](https://discuss.elastic.co/t/file-input-plugin-delimiter-property-not-working/276650 "2021-06-22T12:30:30Z")
Hello, I have logstash \[6.7\] complaining when I set "\\r\\n" as delimiter for the file input plugin. The file I'd like logstash to handle is file incident\_sample.csv incident\_sample.csv: ASCII text, with very long lines… --- ## [Figure out which pipeline works the most?](https://discuss.elastic.co/t/figure-out-which-pipeline-works-the-most/276645)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 1\ **Last updated:** [June 22, 2021, 12:42pm UTC](https://discuss.elastic.co/t/figure-out-which-pipeline-works-the-most/276645 "2021-06-22T12:42:21Z")
Hi, we have a pretty old ELK-stack (5.5) and since a few weeks our Logstash CPU usage is through the roof. Is there a way to check which pipeline or grok pattern is causing that? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=905) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=907)