# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=910 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 911 --- ## [Cannot make this work](https://discuss.elastic.co/t/cannot-make-this-work/276090)
**Author:** [@Peque](https://discuss.elastic.co/u/Peque)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/cannot-make-this-work/276090 "2021-06-18T05:13:28Z")
Hi Group I struggling like H\*\*\* t omake this work I have created an ELK server on Ubuntu 20.04LTS - and would like to monitor both Normal Linux/Windows Server - and allso our PFsense Routers. I'm using the PFELK --\> G… --- ## [Ruby Code to split key value pair in Logstash 6.8.0](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933)
**Author:** [@Santy](https://discuss.elastic.co/u/Santy)\ **Replies:** 4\ **Last updated:** [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933 "2021-06-18T05:13:16Z")
json { source =\> "message" } split { field =\> "data" } date { match =\> \["\[data\]\[currentDate\]", "yyyy-MM-dd HH:mm:ss"\] target =\> "@timestamp" } ruby { code =\> " event\['data'\].each {|k, v| … --- ## [Elastic Observability Certification Question](https://discuss.elastic.co/t/elastic-observability-certification-question/276292)
**Author:** [@Anabella\_Cristaldi](https://discuss.elastic.co/u/Anabella_Cristaldi)\ **Replies:** 7\ **Last updated:** [June 18, 2021, 2:24am UTC](https://discuss.elastic.co/t/elastic-observability-certification-question/276292 "2021-06-18T02:24:05Z")
Hi all, I've just finished the Observability Course and I'll start to prepare the certification. Reviewing the exam objectives there is one it is not clear to me Metrics Configure and run Metricbeat to collect metri… --- ## [Elastic-endpoint process still running when I stop the elastic-agent service](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269)
**Author:** [@lotus](https://discuss.elastic.co/u/lotus)\ **Replies:** 2\ **Last updated:** [June 18, 2021, 1:35am UTC](https://discuss.elastic.co/t/elastic-endpoint-process-still-running-when-i-stop-the-elastic-agent-service/276269 "2021-06-18T01:35:56Z")
Hello, we have installed elastic-agent-7.12 on Ubuntu 18.04 to test Endpoint security recently, but we found the elastic-endpoint take a quit large CPU, we decide to sopt it temporarily. while we stop the service elas… --- ## [How to sort fields used as terms?](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325)
**Author:** [@Lucas\_Boswell](https://discuss.elastic.co/u/Lucas_Boswell)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:42pm UTC](https://discuss.elastic.co/t/how-to-sort-fields-used-as-terms/276325 "2021-06-17T23:42:53Z")
Hello there, I am attempting to understand the sorting/bucket\_sort functionality a bit better. Below is a simple query that groups by a productId, gathers some additional info related to productId, and then calculates a… --- ## [Workaround for search query issue with Lucene multiple OR](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323)
**Author:** [@zkirill](https://discuss.elastic.co/u/zkirill)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:24pm UTC](https://discuss.elastic.co/t/workaround-for-search-query-issue-with-lucene-multiple-or/276323 "2021-06-17T23:24:07Z")
In reference to the original post by @sikeeoh (Search Query with Lucene Query issue) We were able to find a workaround. I'm not sure if it accomplishes the same result but it seems to be working. "ten" OR ("teen" OR ("… --- ## [Logstash is losing connection to Elastic search](https://discuss.elastic.co/t/logstash-is-losing-connection-to-elastic-search/276319)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 10:26pm UTC](https://discuss.elastic.co/t/logstash-is-losing-connection-to-elastic-search/276319 "2021-06-17T22:26:35Z")
Hi, My logstash is disconnecting to elasticsearch after 20 mins, elasticsearch is running and no error. Here is the logs I have: \[WARN \]\[logstash.outputs.elasticsearch\] Marking url as dead. Last error: \[LogStash::Outp… --- ## [termsQuery no longer uses XContentWriters](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316)
**Author:** [@Lars\_Benedetto](https://discuss.elastic.co/u/Lars_Benedetto)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 9:15pm UTC](https://discuss.elastic.co/t/termsquery-no-longer-uses-xcontentwriters/276316 "2021-06-17T21:15:39Z")
Between 7.9.3 and 7.12.1 it seems the way that arguments to termsQuery() are serialized have changed. In 7.9.3 it used my XContentBuilderExtension to convert my classes to strings that could be understood by elasticsearc… --- ## [Kibana - metric with top hits based on string](https://discuss.elastic.co/t/kibana-metric-with-top-hits-based-on-string/275738)
**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-metric-with-top-hits-based-on-string/275738 "2021-06-17T20:08:01Z")
Hello - I have been hunting around, and I think I cannot actually do what it is I want to do, but am wanting to confirm my suspicions. The plan is to read the data from a log, to see the progress of users downloading fi… --- ## [How to dispay hostname and host ip on my elastic search output?](https://discuss.elastic.co/t/how-to-dispay-hostname-and-host-ip-on-my-elastic-search-output/275928)
**Author:** [@gisellecarballo](https://discuss.elastic.co/u/gisellecarballo)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 7:49pm UTC](https://discuss.elastic.co/t/how-to-dispay-hostname-and-host-ip-on-my-elastic-search-output/275928 "2021-06-17T19:49:14Z")
Hi, Can help me please extract the host name from the message output (devname) in elasticsearch. In my current config on the host portion only ip is displayed. Current config: input { syslog { port =\> 5000 host =\> … --- ## [Elastic solution on multiple vlan network](https://discuss.elastic.co/t/elastic-solution-on-multiple-vlan-network/276283)
**Author:** [@Polo](https://discuss.elastic.co/u/Polo)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:05pm UTC](https://discuss.elastic.co/t/elastic-solution-on-multiple-vlan-network/276283 "2021-06-17T15:05:22Z")
Hi all, i would like to deploy elastic solution, search, beats... in a network with multiple vlan. My network is a aggregation of many customer newtwork, each on different vlan and only accessible via dedicated "jump ho… --- ## [Logstash ElasticSearch Output not using special characters (!)](https://discuss.elastic.co/t/logstash-elasticsearch-output-not-using-special-characters/276282)
**Author:** [@Mahdj](https://discuss.elastic.co/u/Mahdj)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 3:01pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-not-using-special-characters/276282 "2021-06-17T15:01:45Z")
Hello everyone, I have my logstash and want to connect to my ElasticSearch instance with OpenDistro installed. I've created an user logstash with password "logstash!" but logstash have an error saying "Got response cod… --- ## [Http output plugin is not working in logstash, Please help](https://discuss.elastic.co/t/http-output-plugin-is-not-working-in-logstash-please-help/275889)
**Author:** [@rajkumar.m](https://discuss.elastic.co/u/rajkumar.m)\ **Replies:** 7\ **Last updated:** [June 17, 2021, 2:53pm UTC](https://discuss.elastic.co/t/http-output-plugin-is-not-working-in-logstash-please-help/275889 "2021-06-17T14:53:17Z")
Hi, I am trying to send json message to kibana api using http plugin, I found the below error, Please help and appreciated. \[2021-06-14T14:45:26,361\]\[ERROR\]\[logstash.outputs.http \] \[HTTP Output Failure\] Encountered n… --- ## [Problem with "Last Value"](https://discuss.elastic.co/t/problem-with-last-value/276268)
**Author:** [@LL\_FED](https://discuss.elastic.co/u/LL_FED)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 2:25pm UTC](https://discuss.elastic.co/t/problem-with-last-value/276268 "2021-06-17T14:25:56Z")
Hi, for example: i want to show the last value of my Data: State in a metric aggregation. I receive the documents in Kibana like this: Doc 1: { "timestamp": ..., "state": 1 } Doc2: { "timestamp": ..., "room\_t… --- ## [Entities architecture with custom fields and Upsert script issue](https://discuss.elastic.co/t/entities-architecture-with-custom-fields-and-upsert-script-issue/276267)
**Author:** [@Spyros\_Giannopoulos](https://discuss.elastic.co/u/Spyros_Giannopoulos)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 2:08pm UTC](https://discuss.elastic.co/t/entities-architecture-with-custom-fields-and-upsert-script-issue/276267 "2021-06-17T14:08:15Z")
Hello, I'm building an application in ES that needs to contain information about lists of members. The members in a list have a name, surname, etc.. but also contain some custom fields which are different for each list.… --- ## [Logstash Helm deploy pattern error](https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276)
**Author:** [@emergrin](https://discuss.elastic.co/u/emergrin)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 2:04pm UTC](https://discuss.elastic.co/t/logstash-helm-deploy-pattern-error/276276 "2021-06-17T14:04:21Z")
Hi all, I have some problems with my value.yaml from my helm deploy of logstash 7.9 and I need some help. This it's an example of my file: logstashPipeline: logstash.conf: | input { beats { port =\> … --- ## [Logstash file input performance](https://discuss.elastic.co/t/logstash-file-input-performance/276050)
**Author:** [@seadub](https://discuss.elastic.co/u/seadub)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 2:03pm UTC](https://discuss.elastic.co/t/logstash-file-input-performance/276050 "2021-06-17T14:03:55Z")
Continuing the discussion from Tuning to handle extreme initial ingestion conditions (with logstash): @Christian\_Dahlqvist - I know I'm resurrecting an old thread here but I'd love to confirm a point you'd raised. I hop… --- ## [Elastic-Agent stand alone host only sends very few events](https://discuss.elastic.co/t/elastic-agent-stand-alone-host-only-sends-very-few-events/276164)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 2:03pm UTC](https://discuss.elastic.co/t/elastic-agent-stand-alone-host-only-sends-very-few-events/276164 "2021-06-17T14:03:54Z")
Hello, because the new fleet stuff doesn't work for me (see here), I tried setting up an elastic agent in "stand alone" mode. In Kibana\>Fleet\>Agents I clicked on "Add agent", downloaded the EA files and extracted them … --- ## [Kibana API Reference](https://discuss.elastic.co/t/kibana-api-reference/276153)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 1:34pm UTC](https://discuss.elastic.co/t/kibana-api-reference/276153 "2021-06-17T13:34:28Z")
Hi, Can someone point me to the reference that documents all of the api settings mentioned on this page please? Thx D --- ## [Implementing DocViewer](https://discuss.elastic.co/t/implementing-docviewer/273486)
**Author:** [@masterThomas](https://discuss.elastic.co/u/masterThomas)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 12:53pm UTC](https://discuss.elastic.co/t/implementing-docviewer/273486 "2021-06-17T12:53:32Z")
Hi team, is it posible to implement DocViewer component from Discover app to my custom plugin? Kibana 7.10.0 --- ## [Index Date Math with seconds](https://discuss.elastic.co/t/index-date-math-with-seconds/276161)
**Author:** [@dimitris\_sb](https://discuss.elastic.co/u/dimitris_sb)\ **Replies:** 4\ **Last updated:** [June 17, 2021, 12:48pm UTC](https://discuss.elastic.co/t/index-date-math-with-seconds/276161 "2021-06-17T12:48:59Z")
Hi All, When I try to create an index using date math expression PUT /%3Cdata-index-%7Bnow%2Fm%7Byyyy-MM-dd-HH-mm-ss%7D%7D%3E which produces an index as data-index-2021-06-16-12-41-00 Why seconds are always 00 (if yo… --- ## [IIS Dashboard for metricbeat](https://discuss.elastic.co/t/iis-dashboard-for-metricbeat/276247)
**Author:** [@graimato](https://discuss.elastic.co/u/graimato)\ **Replies:** 6\ **Last updated:** [June 17, 2021, 12:33pm UTC](https://discuss.elastic.co/t/iis-dashboard-for-metricbeat/276247 "2021-06-17T12:33:12Z")
Dear all, I have a problem with data visualization dashboard exactly with metricbeat IIS dashboard. The problem is that I have filter "locked" on metricbeat-\* index pattern there is a way to show data that are stor… --- ## [New data source mysql](https://discuss.elastic.co/t/new-data-source-mysql/276261)
**Author:** [@alexkr](https://discuss.elastic.co/u/alexkr)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 12:29pm UTC](https://discuss.elastic.co/t/new-data-source-mysql/276261 "2021-06-17T12:29:41Z")
Hey I need your help please I try to connect new data source mysql The DB is also local in the same server How I can do it? --- ## [Field search using Logstash configuration](https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 11:41am UTC](https://discuss.elastic.co/t/field-search-using-logstash-configuration/276259 "2021-06-17T11:41:10Z")
Hi , Below is my requirement. I have two indexes Index : Client\_one \[fields : employee\_no1,salary, exp\] Index: client\_two. \[fields " employee\_no2, total\_exp\] Both index have one common field employee\_no. I want to … --- ## [How to Query the data between 2 different timestamp](https://discuss.elastic.co/t/how-to-query-the-data-between-2-different-timestamp/276150)
**Author:** [@Kannan\_V](https://discuss.elastic.co/u/Kannan_V)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 11:40am UTC](https://discuss.elastic.co/t/how-to-query-the-data-between-2-different-timestamp/276150 "2021-06-17T11:40:49Z")
Hi, How to query the data between 2 different timestamps? We have a data. I am able to query through Kibana Discover tab. But i am not able to query through devTools or Curl command. Following is my devtool command G… --- ## [Transform API](https://discuss.elastic.co/t/transform-api/276256)
**Author:** [@Iliya\_Zukerman](https://discuss.elastic.co/u/Iliya_Zukerman)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 10:54am UTC](https://discuss.elastic.co/t/transform-api/276256 "2021-06-17T10:54:01Z")
hI I am able to create Transform but after it has been created and started there is no corresponding IndexPattern so I can't see it in Kiban when I create the same transform from UI the indexpattern is created automatic… --- ## [Network in bout traffic rollup](https://discuss.elastic.co/t/network-in-bout-traffic-rollup/276244)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 0\ **Last updated:** [June 17, 2021, 9:36am UTC](https://discuss.elastic.co/t/network-in-bout-traffic-rollup/276244 "2021-06-17T09:36:56Z")
Hi I am trying to rollup (daily) network inbound traffic using field system.network.in.bytes. but when i use inbound visualization with rollup index i got this(image) what the problem and is there another way to ro… --- ## [Fetch list in dropdown from newest in index](https://discuss.elastic.co/t/fetch-list-in-dropdown-from-newest-in-index/276009)
**Author:** [@Mik\_a](https://discuss.elastic.co/u/Mik_a)\ **Replies:** 2\ **Last updated:** [June 17, 2021, 10:38am UTC](https://discuss.elastic.co/t/fetch-list-in-dropdown-from-newest-in-index/276009 "2021-06-17T10:38:58Z")
I made a drop down for the filter with the Controls type in kibana visualizations. however it seem like this is starting the fetch from the beginning of the index, and if a keyword/value is indexed for the first time ye… --- ## [Refreshing Indices](https://discuss.elastic.co/t/refreshing-indices/274252)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 3\ **Last updated:** [June 17, 2021, 10:29am UTC](https://discuss.elastic.co/t/refreshing-indices/274252 "2021-06-17T10:29:28Z")
Hi All, Is there a way I could refresh indices (field list) by not relying on doing it manually through Kibana? Can a curl command be used instead? I have ELK 7.6.2 stack. Thanks --- ## [ダッシュボードで直近1日、1週間、1ヶ月の情報を一度に表示する方法について](https://discuss.elastic.co/t/1-1-1/276207)
**Author:** [@t-nakata](https://discuss.elastic.co/u/t-nakata)\ **Replies:** 1\ **Last updated:** [June 17, 2021, 10:23am UTC](https://discuss.elastic.co/t/1-1-1/276207 "2021-06-17T10:23:52Z")
ダッシュボード上で、表示対象のドキュメント件数を表示したいです。その際、直近1日分、1週間分、1ヶ月分のデータ件数を1枚のダッシュボードで出力したいのですが、出力する時間の範囲は画面右上のボックスで指定するので、実現方法が分からずにおります。 そもそもこうしたことは実現可能でしょうか？可能であれば、方法をご教示頂けないでしょうか。 ダッシュボードのイメージを添付します [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=909) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=911)