# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=952 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 953 --- ## [\[7.12.0\] Kibana Line Chart creates Duplicates when more than 10 lines](https://discuss.elastic.co/t/7-12-0-kibana-line-chart-creates-duplicates-when-more-than-10-lines/272640)
**Author:** [@pruoff](https://discuss.elastic.co/u/pruoff)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 3:46pm UTC](https://discuss.elastic.co/t/7-12-0-kibana-line-chart-creates-duplicates-when-more-than-10-lines/272640 "2021-05-11T15:46:45Z")
Hi! When creating a Kibana Line Chart Visualization in v7.12.0 or v7.12.1, I encounter an issue that duplicate lines are shown, when adding an eleventh line. In my case, I have 3 y-axes but I observe the same issue for … --- ## [Index "\_source.enabled": false does not remove source data and index size does not change at all due to this setting](https://discuss.elastic.co/t/index-source-enabled-false-does-not-remove-source-data-and-index-size-does-not-change-at-all-due-to-this-setting/272677)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 3:38pm UTC](https://discuss.elastic.co/t/index-source-enabled-false-does-not-remove-source-data-and-index-size-does-not-change-at-all-due-to-this-setting/272677 "2021-05-11T15:38:03Z")
Hi Elastic 7.11.2 I am indexing documents through pipelines (using ingest\_attachment plugin) My pipeline looks like this: PUT \_ingest/pipeline/my\_pipeline { "description": "pipeline for indexing documents", "… --- ## [ERROR: Pipelines YAML file must contain an array of pipeline configs. Found "Hash"](https://discuss.elastic.co/t/error-pipelines-yaml-file-must-contain-an-array-of-pipeline-configs-found-hash/272708)
**Author:** [@andcur](https://discuss.elastic.co/u/andcur)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 3:33pm UTC](https://discuss.elastic.co/t/error-pipelines-yaml-file-must-contain-an-array-of-pipeline-configs-found-hash/272708 "2021-05-11T15:33:10Z")
Windows server: I have the following pipeline.yml file -pipeline.id: policylocalexposurehub path.config: "config/logstash-sample.conf" pipeline.workers: 1 error ERROR: Pipelines YAML file must contain an array of pip… --- ## [Search multiple words using wildcard query](https://discuss.elastic.co/t/search-multiple-words-using-wildcard-query/272648)
**Author:** [@schawla](https://discuss.elastic.co/u/schawla)\ **Replies:** 5\ **Last updated:** [May 11, 2021, 3:32pm UTC](https://discuss.elastic.co/t/search-multiple-words-using-wildcard-query/272648 "2021-05-11T15:32:59Z")
I have documents indexed to elastic search in the following structure - \[{ "firstname" : "john", "lastname" : "cena" } , { "firstname" : "peter", "lastname" : "parker" }\] I am trying to use a bool query that contains… --- ## [Kibana Sort in visualization is not correct](https://discuss.elastic.co/t/kibana-sort-in-visualization-is-not-correct/272607)
**Author:** [@lachlann562](https://discuss.elastic.co/u/lachlann562)\ **Replies:** 3\ **Last updated:** [May 11, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-sort-in-visualization-is-not-correct/272607 "2021-05-11T15:11:10Z")
In some visualizations, the sorting appears to not respect the selected values. for example, when using metricbeat i have a scripted field for "hour of day", "day of week" and "sundayOfWeek". Depending on how i filter my… --- ## [Elasticsearch - 'network.host': is not allowed](https://discuss.elastic.co/t/elasticsearch-network-host-is-not-allowed/272669)
**Author:** [@mfa](https://discuss.elastic.co/u/mfa)\ **Replies:** 4\ **Last updated:** [May 11, 2021, 2:52pm UTC](https://discuss.elastic.co/t/elasticsearch-network-host-is-not-allowed/272669 "2021-05-11T14:52:00Z")
I am using ElasticCloud , version v7.12.1, I have sat up a watcher for health check of cluster that it looks like below: PUT \_watcher/watch/cluster\_health\_watch { "trigger" : { "schedule" : { "cron… --- ## [\_id like var in output email](https://discuss.elastic.co/t/id-like-var-in-output-email/272696)
**Author:** [@cassiopee](https://discuss.elastic.co/u/cassiopee)\ **Replies:** 4\ **Last updated:** [May 11, 2021, 2:09pm UTC](https://discuss.elastic.co/t/id-like-var-in-output-email/272696 "2021-05-11T14:09:46Z")
hi everyone, I would use \_id (metadata) like variable in my output mail. I make my output on this way : \`output { elasticsearch { hosts =\> \[ "https://192.168.1.160:9200" \] ssl =\> true ssl\_certificate\_ve… --- ## [Combine different log events in one data table](https://discuss.elastic.co/t/combine-different-log-events-in-one-data-table/272403)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 2:04pm UTC](https://discuss.elastic.co/t/combine-different-log-events-in-one-data-table/272403 "2021-05-11T14:04:40Z")
Hi all, given are two log files from two different sources. log 1 2021-05-03 10:00:38,656 INFO \[Service TP\] : | M\_ID(3867) | ABC trade received from AFG via MM 2021-05-03 10:00:38,662 INFO \[Service TP\] : | M\_ID(3… --- ## [Storage usage when maintaining data over 2 seperate indexes](https://discuss.elastic.co/t/storage-usage-when-maintaining-data-over-2-seperate-indexes/272257)
**Author:** [@Koren\_Molcho](https://discuss.elastic.co/u/Koren_Molcho)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 11:54am UTC](https://discuss.elastic.co/t/storage-usage-when-maintaining-data-over-2-seperate-indexes/272257 "2021-05-11T11:54:02Z")
Hello, I am looking into a solution for producing a dedup version of an existing index, similar to the solution offered here: Little Logstash Lessons: Handling Duplicates | Elastic Blog I have an index containing all … --- ## [Kibana Dashboard Drilldown](https://discuss.elastic.co/t/kibana-dashboard-drilldown/272554)
**Author:** [@Nisha2297](https://discuss.elastic.co/u/Nisha2297)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 11:20am UTC](https://discuss.elastic.co/t/kibana-dashboard-drilldown/272554 "2021-05-11T11:20:54Z")
Is it possible to create drilldowns on a Table visualization in Kibana version 7.11? I want to create a drilldown on a table viz which redirects me to another table containing details in the same dashboard. --- ## [Display the DNS of the visiting IP](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 10:38am UTC](https://discuss.elastic.co/t/display-the-dns-of-the-visiting-ip/272174 "2021-05-11T10:38:40Z")
Hi, In SEIM I can see the DNS requests coming out from my machine. Like when I'm visiting google it is logged here in SIEM --\> Network --\> DNS I need the contrary, How can I see the DNS of the IP's visiting my machin… --- ## [Elastic Search update api - updating complex data including array objects and parts of document](https://discuss.elastic.co/t/elastic-search-update-api-updating-complex-data-including-array-objects-and-parts-of-document/272644)
**Author:** [@ab.umarjikar](https://discuss.elastic.co/u/ab.umarjikar)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 9:20am UTC](https://discuss.elastic.co/t/elastic-search-update-api-updating-complex-data-including-array-objects-and-parts-of-document/272644 "2021-05-11T09:20:40Z")
I have complex structure of data coming in as bellow: { ​​​​​ "id": 1, "other\_details": \[{ ​​​​​ "address\_details": { ​​​​​ "city": "pune", … --- ## [Please explain how rewrite top\_terms\_n works](https://discuss.elastic.co/t/please-explain-how-rewrite-top-terms-n-works/270128)
**Author:** [@carantunes](https://discuss.elastic.co/u/carantunes)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 8:57am UTC](https://discuss.elastic.co/t/please-explain-how-rewrite-top-terms-n-works/270128 "2021-05-11T08:57:59Z")
Can someone expand a bit on how rewrite top\_terms\_n works? Related to https://discuss.elastic.co/t/missing-results-using-query-string-wildcard-query-with-rewrite-top-terms-n/269680 Thanks in advance! --- ## [ElasaticSearch Killed](https://discuss.elastic.co/t/elasaticsearch-killed/272580)
**Author:** [@Sohaib\_Gondal](https://discuss.elastic.co/u/Sohaib_Gondal)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 7:16am UTC](https://discuss.elastic.co/t/elasaticsearch-killed/272580 "2021-05-11T07:16:04Z")
When I try to run the Elasticsearch it says "Killed" and shows the following error. Error Log \[2021-05-10T11:56:50.233+0000\]\[15547\]\[gc\] Using Concurrent Mark Sweep \[2021-05-10T11:56:50.233+0000\]\[15547\]\[gc,heap,coops\] … --- ## [String Scripted field conversion to keyword](https://discuss.elastic.co/t/string-scripted-field-conversion-to-keyword/272531)
**Author:** [@SHUBHAM\_SALUNKHE](https://discuss.elastic.co/u/SHUBHAM_SALUNKHE)\ **Replies:** 5\ **Last updated:** [May 11, 2021, 5:35am UTC](https://discuss.elastic.co/t/string-scripted-field-conversion-to-keyword/272531 "2021-05-11T05:35:40Z")
Hi, I have created one scripted field of string format. Need to convert that in keyword format to perform aggregation operation on that scripted field. How can I convert that string? Thanks in advance. --- ## [Elasticsearch cluster have millions of pending tasks](https://discuss.elastic.co/t/elasticsearch-cluster-have-millions-of-pending-tasks/272349)
**Author:** [@fengxiaobai](https://discuss.elastic.co/u/fengxiaobai)\ **Replies:** 14\ **Last updated:** [May 11, 2021, 5:33am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-have-millions-of-pending-tasks/272349 "2021-05-11T05:33:57Z")
i have a es cluster , 7.4 version . There are a lot of pending tasks around 8 a.m. every day。 pending task list info： 639479 "source": "ilm-execute-cluster-state-steps", 82666 "source": "ilm-move-to-step"… --- ## [Need curl/kibana command which returns "same ids" which are present in 2 different indexes](https://discuss.elastic.co/t/need-curl-kibana-command-which-returns-same-ids-which-are-present-in-2-different-indexes/272529)
**Author:** [@Rinku\_Gulia](https://discuss.elastic.co/u/Rinku_Gulia)\ **Replies:** 5\ **Last updated:** [May 11, 2021, 4:43am UTC](https://discuss.elastic.co/t/need-curl-kibana-command-which-returns-same-ids-which-are-present-in-2-different-indexes/272529 "2021-05-11T04:43:58Z")
We have a requirement where we are generating 2 indexes one is open index ,another is closed index. we want to know if same data/id exists in both of them( we are inserting bulk data through one job and at the same time… --- ## [After enabling xPack ssl I am now receiving an error with monitoring failed to flush export bulks](https://discuss.elastic.co/t/after-enabling-xpack-ssl-i-am-now-receiving-an-error-with-monitoring-failed-to-flush-export-bulks/272630)
**Author:** [@cheeks5281](https://discuss.elastic.co/u/cheeks5281)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 4:30am UTC](https://discuss.elastic.co/t/after-enabling-xpack-ssl-i-am-now-receiving-an-error-with-monitoring-failed-to-flush-export-bulks/272630 "2021-05-11T04:30:13Z")
the yaml with my basic auth was working before on my ElasticSearch/Kibana 7.1 cluster. Within my pod for the data nodes I have I am now seeing the following message org.elasticsearch.xpack.monitoring.exporter.ExportExce… --- ## [Data type long error](https://discuss.elastic.co/t/data-type-long-error/272631)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 2\ **Last updated:** [May 11, 2021, 4:22am UTC](https://discuss.elastic.co/t/data-type-long-error/272631 "2021-05-11T04:22:53Z")
Hi, ELK version: 7.10.0 I have a request, which is to import the ip2location csv data into elasticsearch and then use program (c# or python) to search the ip range and return the country info. The data were not able t… --- ## [Wildcards+fuzzy in one query](https://discuss.elastic.co/t/wildcards-fuzzy-in-one-query/272620)
**Author:** [@abdess](https://discuss.elastic.co/u/abdess)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 2:46am UTC](https://discuss.elastic.co/t/wildcards-fuzzy-in-one-query/272620 "2021-05-11T02:46:32Z")
I'm new to Elasticsearch and have 2 Questions: Q1) The following query return this result(pic): Query: { "query": { "query\_string": { "query": "china~" } } } Result: {… --- ## [How to create by fields sending data through elasticsearch](https://discuss.elastic.co/t/how-to-create-by-fields-sending-data-through-elasticsearch/272615)
**Author:** [@bruno\_aleixo](https://discuss.elastic.co/u/bruno_aleixo)\ **Replies:** 4\ **Last updated:** [May 11, 2021, 2:40am UTC](https://discuss.elastic.co/t/how-to-create-by-fields-sending-data-through-elasticsearch/272615 "2021-05-11T02:40:54Z")
I know sending by through logstash, creating a grok pattern within the pippeline configuration follows example created by going through logstash, I would like to reply in the same way sending through elasticsearch, is … --- ## [How do i create a visualisation/dashboard with all data from yesterday](https://discuss.elastic.co/t/how-do-i-create-a-visualisation-dashboard-with-all-data-from-yesterday/272623)
**Author:** [@KS\_123](https://discuss.elastic.co/u/KS_123)\ **Replies:** 1\ **Last updated:** [May 11, 2021, 1:04am UTC](https://discuss.elastic.co/t/how-do-i-create-a-visualisation-dashboard-with-all-data-from-yesterday/272623 "2021-05-11T01:04:57Z")
how do i create a visualisation/dashboard with all data from yesterday? So in the date picker it will always default to yesterday whenever I look at the visualisation or the dashboard. --- ## [Setting custom date format from kibana for index template](https://discuss.elastic.co/t/setting-custom-date-format-from-kibana-for-index-template/272611)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 6\ **Last updated:** [May 11, 2021, 12:54am UTC](https://discuss.elastic.co/t/setting-custom-date-format-from-kibana-for-index-template/272611 "2021-05-11T00:54:13Z")
I there a was to include a date format in an index template mapping using Kibaba? I can select from the standard ones but I there is no option for entering a custom format. Noe of the standard formats seem to support d… --- ## [Index vs Update for partial updates](https://discuss.elastic.co/t/index-vs-update-for-partial-updates/272590)
**Author:** [@bogdanjsx](https://discuss.elastic.co/u/bogdanjsx)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 11:23pm UTC](https://discuss.elastic.co/t/index-vs-update-for-partial-updates/272590 "2021-05-10T23:23:28Z")
Hello! I'm having a hard time deciding on the Index vs Update APIs for a particular use case. Let's say I have an index with documents containing a name field, which nests a string translated in different languages/loc… --- ## [Multiple Date format in mapping fails](https://discuss.elastic.co/t/multiple-date-format-in-mapping-fails/272616)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 11:22pm UTC](https://discuss.elastic.co/t/multiple-date-format-in-mapping-fails/272616 "2021-05-10T23:22:08Z")
Hi all, There is provision for multiple date format in elasticsearch. But whenever I try my multiple date format in console, it fails to parse and no data is displayed. PUT brs\_total { "mappings": { "properties"… --- ## [Can I press enter in a Kibana Search and not do a search it just moves the text to a new line](https://discuss.elastic.co/t/can-i-press-enter-in-a-kibana-search-and-not-do-a-search-it-just-moves-the-text-to-a-new-line/272618)
**Author:** [@KS\_123](https://discuss.elastic.co/u/KS_123)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 11:05pm UTC](https://discuss.elastic.co/t/can-i-press-enter-in-a-kibana-search-and-not-do-a-search-it-just-moves-the-text-to-a-new-line/272618 "2021-05-10T23:05:26Z")
Can I press enter in a Kibana Search and not do a search it just moves the text to a new line? So my data appears like this, that is not one big long text in one line and rather 4 different lines: eventType:DeviceReque… --- ## [Storage rate for a specefic machine](https://discuss.elastic.co/t/storage-rate-for-a-specefic-machine/272043)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 7\ **Last updated:** [May 10, 2021, 11:03pm UTC](https://discuss.elastic.co/t/storage-rate-for-a-specefic-machine/272043 "2021-05-10T23:03:11Z")
Hello everyobody, I have a production cluster where I have some windows machines connected to my ELK Cluster, and for some monitoring reasons, I would like to know how many data collected from each machine for eample fo… --- ## [When do you really need full text search capabilities? Need help understanding tradeoffs](https://discuss.elastic.co/t/when-do-you-really-need-full-text-search-capabilities-need-help-understanding-tradeoffs/272613)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 11:00pm UTC](https://discuss.elastic.co/t/when-do-you-really-need-full-text-search-capabilities-need-help-understanding-tradeoffs/272613 "2021-05-10T23:00:12Z")
Should we add Elastic for our very simple searches on metadata fields that have a few words (\<10) such as titles? Does this constitute requiring "Full Text Search"? We have a database w/ postgres to store all our metada… --- ## [Logstash conf output to elasticsearch with document\_id set only indexes one record](https://discuss.elastic.co/t/logstash-conf-output-to-elasticsearch-with-document-id-set-only-indexes-one-record/272604)
**Author:** [@andcur](https://discuss.elastic.co/u/andcur)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 5:41pm UTC](https://discuss.elastic.co/t/logstash-conf-output-to-elasticsearch-with-document-id-set-only-indexes-one-record/272604 "2021-05-10T17:41:37Z")
Hi, I am using logstash to populate data from SQL server to elastic. When I specify document\_id (as below) I only get one document in my index. If I do not specify that document\_id field should be taken from PolicyId,… --- ## [Logstash no processing all my logs from Filebeat](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 4:05pm UTC](https://discuss.elastic.co/t/logstash-no-processing-all-my-logs-from-filebeat/272593 "2021-05-10T16:05:20Z")
I have Filebeat transporting my logs to logstash and then to ES. The behaviour I have noticed is that some of my logs are processed and available in Kibana by not all. I see all the logs in the logstash debug log with … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=951) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=953)