# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=925 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 926 --- ## [TSVB table - Filter ratio - color rules](https://discuss.elastic.co/t/tsvb-table-filter-ratio-color-rules/274943)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 2\ **Last updated:** [June 5, 2021, 4:54am UTC](https://discuss.elastic.co/t/tsvb-table-filter-ratio-color-rules/274943 "2021-06-05T04:54:41Z")
Hi Everyone, Not sure if this is a bug or a limitation, I'm trying to set colour rules on a TSVB Table where the columns use Filter Ratio. I've used a custom format of 0.00%. As can be seen, it's just using the c… --- ## [Default module mapping has too many fields by default](https://discuss.elastic.co/t/default-module-mapping-has-too-many-fields-by-default/274651)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 9\ **Last updated:** [June 4, 2021, 11:29pm UTC](https://discuss.elastic.co/t/default-module-mapping-has-too-many-fields-by-default/274651 "2021-06-04T23:29:34Z")
I'm using the Zeek module in filebeat to ingest logs. By default, the module imports around 5000 fields into kibana and I'm wondering if it's best practice to cut that list down or not. I'm noticing my dashboard is runn… --- ## [Grok Pattern/Expression for Multiline log from kibana (icingabeat index)](https://discuss.elastic.co/t/grok-pattern-expression-for-multiline-log-from-kibana-icingabeat-index/273059)
**Author:** [@shailesh](https://discuss.elastic.co/u/shailesh)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 10:30pm UTC](https://discuss.elastic.co/t/grok-pattern-expression-for-multiline-log-from-kibana-icingabeat-index/273059 "2021-06-04T22:30:00Z")
Hello Team - I am trying to process some data from icinagbeat index from Kibana- so that i can visualize the output from icinagbeat - for that reason i am writing the Grok pattern - but the problem is when i write the pa… --- ## [Logstash with heavy Syslog input](https://discuss.elastic.co/t/logstash-with-heavy-syslog-input/275007)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 10:28pm UTC](https://discuss.elastic.co/t/logstash-with-heavy-syslog-input/275007 "2021-06-04T22:28:19Z")
Hi friends, I have a SIEM system that sends 10,000 events per second to Logstash over Syslog TCP. It seems there is a bottleneck on logstash and i get only 1500 events per second. Is there a nice solution for that? A… --- ## [Calculated positional field based on \_score](https://discuss.elastic.co/t/calculated-positional-field-based-on-score/274887)
**Author:** [@jcater](https://discuss.elastic.co/u/jcater)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 10:15pm UTC](https://discuss.elastic.co/t/calculated-positional-field-based-on-score/274887 "2021-06-04T22:15:28Z")
I need to add a position/ordinal field to my Elasticsearch search results, relative to a sort by \_score, regardless of how the actual results are sorted. I'm using the term "field" loosely... I just need access to some … --- ## [Logstash Kinesis Plugin - with\_kinesisEndpoint - Undefined Method](https://discuss.elastic.co/t/logstash-kinesis-plugin-with-kinesisendpoint-undefined-method/274922)
**Author:** [@cosruss](https://discuss.elastic.co/u/cosruss)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 8:00pm UTC](https://discuss.elastic.co/t/logstash-kinesis-plugin-with-kinesisendpoint-undefined-method/274922 "2021-06-04T20:00:14Z")
Trying to use the Logstash Kinesis Plugin with a custom endpoint. In the config, I've got the following line: additional\_settings =\> {"kinesisEndpoint" =\> "https://\"} but I'm getting a strange error… --- ## [Update Existing Log Via Logstash](https://discuss.elastic.co/t/update-existing-log-via-logstash/274796)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 17\ **Last updated:** [June 4, 2021, 6:49pm UTC](https://discuss.elastic.co/t/update-existing-log-via-logstash/274796 "2021-06-04T18:49:05Z")
I want to update an existing document in Elasticsearch based on certain conditions. However, I am facing some errors. Here is my filter plugin configuration filter { json { source =\> "message" } if \[baseValueUnitA… --- ## [Phrase proximity with simple\_query\_string and NEST](https://discuss.elastic.co/t/phrase-proximity-with-simple-query-string-and-nest/275002)
**Author:** [@DMinovski](https://discuss.elastic.co/u/DMinovski)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 6:33pm UTC](https://discuss.elastic.co/t/phrase-proximity-with-simple-query-string-and-nest/275002 "2021-06-04T18:33:20Z")
I'm using the simple\_query\_string with the tilde ~ operator to specify proximity between words in a phrase, and it works. The simple query has other functions that match doesn't provide. { "simple\_qu… --- ## [How to extract response and key-values value from response time string of apache logs](https://discuss.elastic.co/t/how-to-extract-response-and-key-values-value-from-response-time-string-of-apache-logs/274991)
**Author:** [@learningelk](https://discuss.elastic.co/u/learningelk)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 4:02pm UTC](https://discuss.elastic.co/t/how-to-extract-response-and-key-values-value-from-response-time-string-of-apache-logs/274991 "2021-06-04T16:02:19Z")
My logs are as follows : ::ffff:10.67.0.179 - - \[23/Feb/2021:13:55:18 +0000\] "GET /files/77570035-bc7e-4be7-9554-e2164dd9397e.otf HTTP/1.1" 200 211 "-" "-" "c37004e0-75de-11eb-b6d4-cb790f9fe1ad" "40.324 ms" "serviceName… --- ## [Configuration problem](https://discuss.elastic.co/t/configuration-problem/274358)
**Author:** [@farciarz121](https://discuss.elastic.co/u/farciarz121)\ **Replies:** 20\ **Last updated:** [June 4, 2021, 12:12am UTC](https://discuss.elastic.co/t/configuration-problem/274358 "2021-06-04T00:12:43Z")
I have cloud elastic activated. I want to set up my environment in following way: \[beats - on prem\] ----\> \[logstash-on prem\] ------\> \[elastic cloud\] So, basically install beats on servers, send logs to logstash on prem… --- ## [Getting lots of Errors on dashboard visuals "EsError"](https://discuss.elastic.co/t/getting-lots-of-errors-on-dashboard-visuals-eserror/274245)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 5\ **Last updated:** [June 4, 2021, 2:41pm UTC](https://discuss.elastic.co/t/getting-lots-of-errors-on-dashboard-visuals-eserror/274245 "2021-06-04T14:41:45Z")
I keep getting these errors on my dashboard and they appear relatively often. When I hover over it, it only says \[esaggs\] \> EsError . When I look at network/console in inspector, I get {"statusCode":404,"error":"Not … --- ## [\[Feedback wanted\] New time comparison feature in APM 7.13](https://discuss.elastic.co/t/feedback-wanted-new-time-comparison-feature-in-apm-7-13/274146)
**Author:** [@casper](https://discuss.elastic.co/u/casper)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 2:39pm UTC](https://discuss.elastic.co/t/feedback-wanted-new-time-comparison-feature-in-apm-7-13/274146 "2021-06-04T14:39:42Z")
Hello community :wave: The entire team is excited to introduce time comparison into the APM Service overview in 7.13 and we'd love to hear what you think of it? Here's a short summary of what it's all about; Time c… --- ## [How to apply custom shard selection algorithm in Elasticsearch?](https://discuss.elastic.co/t/how-to-apply-custom-shard-selection-algorithm-in-elasticsearch/274994)
**Author:** [@Yashasvi\_Raj\_Pant](https://discuss.elastic.co/u/Yashasvi_Raj_Pant)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 2:18pm UTC](https://discuss.elastic.co/t/how-to-apply-custom-shard-selection-algorithm-in-elasticsearch/274994 "2021-06-04T14:18:54Z")
I came across some papers where custom shard selection algorithms like ReDDE, Sushi, and Rank-S are applied instead of default ones. One of them is here. How can we apply a custom shard selection algorithm in Elasticsear… --- ## [Conditional parsing for the logs using logstash](https://discuss.elastic.co/t/conditional-parsing-for-the-logs-using-logstash/274892)
**Author:** [@learningelk](https://discuss.elastic.co/u/learningelk)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 2:11pm UTC](https://discuss.elastic.co/t/conditional-parsing-for-the-logs-using-logstash/274892 "2021-06-04T14:11:52Z")
I am able to parse the logs and send to elk but I have this requirement and would request some suggestions on it . Application and Access logs are being written to the stdout of K8 cluster. I am able to setup logshippe… --- ## [Disaster recovery in elasticsearch](https://discuss.elastic.co/t/disaster-recovery-in-elasticsearch/274984)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 1:29pm UTC](https://discuss.elastic.co/t/disaster-recovery-in-elasticsearch/274984 "2021-06-04T13:29:39Z")
hi everyone I hope this message finds you well, so in elasticsearch I have 3 nodes, 2 masters nodes and a data node, so if the 2 masters nodes fail can I find all data in the third data node ? regards --- ## [Creating visualization using static data](https://discuss.elastic.co/t/creating-visualization-using-static-data/274921)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 1:21pm UTC](https://discuss.elastic.co/t/creating-visualization-using-static-data/274921 "2021-06-04T13:21:20Z")
Hello, I have ELK stack 7.6.2 running. Logstash was configured to parse a file which gets generated once every 24 hours and display data as follows (few fields shown below): # totalCalls.BServer 3,105,489 # totalC… --- ## [Labels on visualizations](https://discuss.elastic.co/t/labels-on-visualizations/274871)
**Author:** [@Jorge\_Mario\_Montes\_R](https://discuss.elastic.co/u/Jorge_Mario_Montes_R)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 12:55pm UTC](https://discuss.elastic.co/t/labels-on-visualizations/274871 "2021-06-04T12:55:56Z")
Hi, After upgrading to 7.13, all values that are shown inside visualizations changed and are not readable. Is there a way to customize the font? --- ## [Endpoint Security Not Showing Host Events](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918)
**Author:** [@francescouk](https://discuss.elastic.co/u/francescouk)\ **Replies:** 3\ **Last updated:** [June 4, 2021, 12:18pm UTC](https://discuss.elastic.co/t/endpoint-security-not-showing-host-events/274918 "2021-06-04T12:18:36Z")
Hello there, I need to understand why the endpoint security is not showing even after enroll the fleet agents. Follow my screens: Endpoint log: {"@timestamp":"2021-06-03T20:11:54.0871431Z","agent":{"id":"7991… --- ## [Elastic IoT - Facing Ingest Speed "Light Barrier" at 10K docs/sec](https://discuss.elastic.co/t/elastic-iot-facing-ingest-speed-light-barrier-at-10k-docs-sec/274971)
**Author:** [@ibexit](https://discuss.elastic.co/u/ibexit)\ **Replies:** 1\ **Last updated:** [June 4, 2021, 11:28am UTC](https://discuss.elastic.co/t/elastic-iot-facing-ingest-speed-light-barrier-at-10k-docs-sec/274971 "2021-06-04T11:28:42Z")
We´ve set up a bare-metal elastic cluster with high CPU, max ram, and fast local flash storage in hot trier and followed all official preflight checklist and write optimization guides: 3 Dedicated Master Nodes, 2 Dedic… --- ## [Check filed value](https://discuss.elastic.co/t/check-filed-value/274976)
**Author:** [@royalE](https://discuss.elastic.co/u/royalE)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 11:18am UTC](https://discuss.elastic.co/t/check-filed-value/274976 "2021-06-04T11:18:15Z")
I want to check the value of the field if its contain a number or string how can i do that ? --- ## [Logstash monitoring Encountered a retryable error. Will Retry with exponential backoff](https://discuss.elastic.co/t/logstash-monitoring-encountered-a-retryable-error-will-retry-with-exponential-backoff/274958)
**Author:** [@vaclav1](https://discuss.elastic.co/u/vaclav1)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 8:18am UTC](https://discuss.elastic.co/t/logstash-monitoring-encountered-a-retryable-error-will-retry-with-exponential-backoff/274958 "2021-06-04T08:18:43Z")
Hello, I have just swapped to use TLS on http and configured api\_key as per Configuring Security in Logstash | Logstash Reference \[7.9\] | Elastic My logstash.yml file: # X-Pack Monitoring xpack.monitoring.enabled: tru… --- ## [Relevancy of Old article](https://discuss.elastic.co/t/relevancy-of-old-article/274622)
**Author:** [@sj123](https://discuss.elastic.co/u/sj123)\ **Replies:** 9\ **Last updated:** [June 4, 2021, 7:35am UTC](https://discuss.elastic.co/t/relevancy-of-old-article/274622 "2021-06-04T07:35:19Z")
Hi, I am quite new to elasticsearch. I have been reading this article Elasticsearch as a NoSQL Database | Elastic Blog\[Elasticsearch as a NoSQL Database\](https://Elasticsearch as a NoSQL Database). This was posted in 201… --- ## [KIbana Installation Fails](https://discuss.elastic.co/t/kibana-installation-fails/274915)
**Author:** [@Yogesh\_Pathak](https://discuss.elastic.co/u/Yogesh_Pathak)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 6:40am UTC](https://discuss.elastic.co/t/kibana-installation-fails/274915 "2021-06-04T06:40:15Z")
I am installing Kibana for the first time. I am installing on Windows 10. The installation fails. First I get the error: \> \[error\]\[savedobjects-service\] \[.kibana\] Action failed with 'Request timed out'. Retrying attemp… --- ## [Logstash configuration- How to do dynamic mapping?](https://discuss.elastic.co/t/logstash-configuration-how-to-do-dynamic-mapping/274749)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 5\ **Last updated:** [June 4, 2021, 4:16am UTC](https://discuss.elastic.co/t/logstash-configuration-how-to-do-dynamic-mapping/274749 "2021-06-04T04:16:13Z")
I have one requirement to create dynamic mapping in my Logstash configuration to map two different columns. Please find below details: - Below is the ruby code I'm using in my logstash config: !\[image|690x351\](upload:/… --- ## [Security vulnerability support in ES 6.8.8](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872)
**Author:** [@bhupendra.mskhatri](https://discuss.elastic.co/u/bhupendra.mskhatri)\ **Replies:** 4\ **Last updated:** [June 4, 2021, 3:49am UTC](https://discuss.elastic.co/t/security-vulnerability-support-in-es-6-8-8/274872 "2021-06-04T03:49:40Z")
We ship ES 6.8.8 zip (windows) and tar(non-windows) with our application. I understand that 6.8.8 has reached EOL (Elastic Product End of Life Dates | Elastic). If any security vulnerability is reported in 6.8.8, will i… --- ## [Set fielddata=true after upgrade from 6.8 to 7.12](https://discuss.elastic.co/t/set-fielddata-true-after-upgrade-from-6-8-to-7-12/274939)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 0\ **Last updated:** [June 4, 2021, 3:33am UTC](https://discuss.elastic.co/t/set-fielddata-true-after-upgrade-from-6-8-to-7-12/274939 "2021-06-04T03:33:50Z")
after i upgrade from 6.8 to 7.12 my dashboard says \[Set fielddata=true on fieldname\] when i try to change in template . i found . at during 6.4 to 6.8 my template got vanished. question 1 : how can i set fielddata… --- ## [Set kibana to use more decimal places of millisencond of time field](https://discuss.elastic.co/t/set-kibana-to-use-more-decimal-places-of-millisencond-of-time-field/274850)
**Author:** [@sosogh](https://discuss.elastic.co/u/sosogh)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 1:17am UTC](https://discuss.elastic.co/t/set-kibana-to-use-more-decimal-places-of-millisencond-of-time-field/274850 "2021-06-04T01:17:59Z")
The log record displaying order in kibana discover is from lastest to the oldest . The millisencond of time field is six decimal places , but it seems that kibana only use three ? { "\_index": "btcs-all-in-one-000004… --- ## [Match phrase prefix queryにてField値と同値で検索してもヒットしない](https://discuss.elastic.co/t/match-phrase-prefix-query-field/274703)
**Author:** [@b18bd8be4bf795b30ee7](https://discuss.elastic.co/u/b18bd8be4bf795b30ee7)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 12:55am UTC](https://discuss.elastic.co/t/match-phrase-prefix-query-field/274703 "2021-06-04T00:55:06Z")
掲題のとおりです。Indexに格納済みの値と同値でMatch phrase prefix検索を行ってもヒットしないパターンがあり、現象について理解したく質問いたします。 よろしくお願いいたします。 バージョン：7.10 Mapping PUT /my\_index1 { "settings" : { "index": { "number\_of\_shards" : 1, "number\_of\_re… --- ## [Update field value based on reference variable](https://discuss.elastic.co/t/update-field-value-based-on-reference-variable/274826)
**Author:** [@san2597](https://discuss.elastic.co/u/san2597)\ **Replies:** 2\ **Last updated:** [June 4, 2021, 12:04am UTC](https://discuss.elastic.co/t/update-field-value-based-on-reference-variable/274826 "2021-06-04T00:04:40Z")
Using Logstash, I'm parsing a log file that contains a timestamp value every time a new process starts. Each process starts and logs its own run time starting from 0 to the time the process completes. I'm trying to visua… --- ## [How to convert from String to Keyword, help needed](https://discuss.elastic.co/t/how-to-convert-from-string-to-keyword-help-needed/274830)
**Author:** [@marija.timovska](https://discuss.elastic.co/u/marija.timovska)\ **Replies:** 0\ **Last updated:** [June 3, 2021, 7:50am UTC](https://discuss.elastic.co/t/how-to-convert-from-string-to-keyword-help-needed/274830 "2021-06-03T07:50:25Z")
I need all the Id fields to be a keyword so I am not getting this error. This is my Json file I tried to configure it though I am not sure how because of my lack of experience so I am in need to assistance. I am a… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=924) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=926)