# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=953 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 954 --- ## [False-positive](https://discuss.elastic.co/t/false-positive/272598)
**Author:** [@em3rals](https://discuss.elastic.co/u/em3rals)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 3:53pm UTC](https://discuss.elastic.co/t/false-positive/272598 "2021-05-10T15:53:30Z")
Hello, how is everything ? My name is Emerson, I work in the IT infrastructure sector at GAtec Gestão agroindustrial, I would like to report a FALSE POSITIVE in relation to an executable of our company. False positive wa… --- ## [Static lookup empty field value not showing in Kibana](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 3:16pm UTC](https://discuss.elastic.co/t/static-lookup-empty-field-value-not-showing-in-kibana/272428 "2021-05-10T15:16:06Z")
Hi all, I'm using Currency field with option of Static lookup to change values . But I'm not able to change values for empty field values. Below screenshot. Empty fields are not showing unknown. Still they are emp… --- ## [Kibana increasing memory usage](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171)
**Author:** [@radovan](https://discuss.elastic.co/u/radovan)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 2:03pm UTC](https://discuss.elastic.co/t/kibana-increasing-memory-usage/272171 "2021-05-10T14:03:05Z")
Hi, after upgrading to 7.12.0 a strange problem started occuring. Kibana keeps consuming more and more RAM until it goes to swap and then I have to restart kibana service because the performance goes wildly off. We have… --- ## [Actual Exam Lab environment](https://discuss.elastic.co/t/actual-exam-lab-environment/272236)
**Author:** [@suselena22](https://discuss.elastic.co/u/suselena22)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 1:45pm UTC](https://discuss.elastic.co/t/actual-exam-lab-environment/272236 "2021-05-10T13:45:36Z")
Hi there: I was using 21'inc monitor but I still find the lab screen was pretty small, is that possible to make the lab's screen bigger as big as my 21'inc monitor? Please advise, thanks. --- ## [Grok works in debugger but not in Logstash](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509)
**Author:** [@therealjack404](https://discuss.elastic.co/u/therealjack404)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 1:41pm UTC](https://discuss.elastic.co/t/grok-works-in-debugger-but-not-in-logstash/272509 "2021-05-10T13:41:39Z")
Hi. I am struggling to write a grok pattern for Modsecurity Logs from the apache error log. I have included a sample log and the grok pattern. I isolated the timestamp creation which works on its own. However the rest wo… --- ## [Kibana Sorting out Array values](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266)
**Author:** [@kanikasingla](https://discuss.elastic.co/u/kanikasingla)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:35pm UTC](https://discuss.elastic.co/t/kibana-sorting-out-array-values/272266 "2021-05-10T13:35:13Z")
Hi Team, I am working with Elastic FunctionBeat to send logs from AWS CloudWatch Logs. I am able to create data tables, graphs etc. There is one issue when I am trying to show field which is nested array (nestedResults… --- ## [Dashboard or Canvas with a drop down for filters for a data table](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310)
**Author:** [@chapmantrain](https://discuss.elastic.co/u/chapmantrain)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 1:32pm UTC](https://discuss.elastic.co/t/dashboard-or-canvas-with-a-drop-down-for-filters-for-a-data-table/272310 "2021-05-10T13:32:43Z")
I have some network utilization data that I need to filter by all hours, prime business hours, non business hours. The filters are not straight forward as I'm dealing with local times across time zones. The prime filter … --- ## [I need pass one kibana nginx header name(testHeader1) to elasticsearch proxy. Now i use requestHeadersWhitelist which including "testHeader1" ,but it does not word](https://discuss.elastic.co/t/i-need-pass-one-kibana-nginx-header-name-testheader1-to-elasticsearch-proxy-now-i-use-requestheaderswhitelist-which-including-testheader1-but-it-does-not-word/272374)
**Author:** [@linger000](https://discuss.elastic.co/u/linger000)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:07pm UTC](https://discuss.elastic.co/t/i-need-pass-one-kibana-nginx-header-name-testheader1-to-elasticsearch-proxy-now-i-use-requestheaderswhitelist-which-including-testheader1-but-it-does-not-word/272374 "2021-05-10T12:07:27Z")
i need pass one kibana nginx header name(testHeader1) to elasticsearch proxy. Now i use requestHeadersWhitelist which including "testHeader1" ,but it does not word. kibana version:6.8.0 --- ## [Find and replace word in all documents in any field](https://discuss.elastic.co/t/find-and-replace-word-in-all-documents-in-any-field/272393)
**Author:** [@simone.dicola](https://discuss.elastic.co/u/simone.dicola)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 11:52am UTC](https://discuss.elastic.co/t/find-and-replace-word-in-all-documents-in-any-field/272393 "2021-05-10T11:52:12Z")
As per title, due to a bug in conversion library, we got more than 200k documents containing & instead of &. Is there a query I can run to do a find and replace in any field? Thanks --- ## [Logstash cannot find logstash.yml directory](https://discuss.elastic.co/t/logstash-cannot-find-logstash-yml-directory/272288)
**Author:** [@almotasim90](https://discuss.elastic.co/u/almotasim90)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 10:53am UTC](https://discuss.elastic.co/t/logstash-cannot-find-logstash-yml-directory/272288 "2021-05-10T10:53:13Z")
Hi, I am running ELK stack in debian 10. I removed logstash with apt command and removed /etc/logstash , /var/lib/logstash directories. Now I am trying to install logstash again, but it does not install all confugrati… --- ## [https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease intermittently fails](https://discuss.elastic.co/t/https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-intermittently-fails/272317)
**Author:** [@baba.tunde](https://discuss.elastic.co/u/baba.tunde)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 10:49am UTC](https://discuss.elastic.co/t/https-artifacts-elastic-co-packages-7-x-apt-dists-stable-inrelease-intermittently-fails/272317 "2021-05-10T10:49:05Z")
Hi folks, ############################################### wget https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease --2021-05-06 17:35:16-- https://artifacts.elastic.co/packages/7.x/apt/dists/stable/I… --- ## [\_component\_template APT got error](https://discuss.elastic.co/t/component-template-apt-got-error/271731)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 6\ **Last updated:** [May 10, 2021, 9:36am UTC](https://discuss.elastic.co/t/component-template-apt-got-error/271731 "2021-05-10T09:36:42Z")
Hello experts, We are doing features about data-stream,ilm....I use GET /\_component\_template/template\_1,template\_2API to get more templates for once,but I got an error: resource\_not\_found\_exception,I had see the guide,I… --- ## [Changed the field type after adding in elasticsearch](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:30am UTC](https://discuss.elastic.co/t/changed-the-field-type-after-adding-in-elasticsearch/272558 "2021-05-10T09:30:46Z")
Hello, I have created one index. in which I send one field name as "elapsed\_time" as float. for that, I use logstash filter for converting data types. but it is added as a string into elasticsearch instead of float. I … --- ## [Redundant should block or query\_string in query?](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 2\ **Last updated:** [May 10, 2021, 9:27am UTC](https://discuss.elastic.co/t/redundant-should-block-or-query-string-in-query/270602 "2021-05-10T09:27:56Z")
hey there, I can get the same result using two different approach for a specific query. The first one uses several should terms "should": \[ { "terms": { "fieldname": \["valu… --- ## [Product title autocompletion/suggestions](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949)
**Author:** [@corlee](https://discuss.elastic.co/u/corlee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:26am UTC](https://discuss.elastic.co/t/product-title-autocompletion-suggestions/271949 "2021-05-10T09:26:34Z")
Hi there, I'm currently struggling with autocompletion/suggestions. I've got a product database with a title, description, price, etc. What i want to achieve is for example: Example: When i search for "ipad", I want t… --- ## [Named Query Confusion](https://discuss.elastic.co/t/named-query-confusion/271997)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:25am UTC](https://discuss.elastic.co/t/named-query-confusion/271997 "2021-05-10T09:25:37Z")
I understand that named queries add the matched\_queries property to the response, but is there any way to access documents that match the named queries in aggregations? The goal is to be able to use the "%dashboard\_cont… --- ## [Multiple date format failes](https://discuss.elastic.co/t/multiple-date-format-failes/272100)
**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:23am UTC](https://discuss.elastic.co/t/multiple-date-format-failes/272100 "2021-05-10T09:23:49Z")
Hi .. I have mapping for a date field set as follows. ES version used 7.9 "itemtransactionid": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ss:SSZ||strict\_date\_optional\_time||yyyy-MM-dd'T… --- ## [Grouping similar buckets](https://discuss.elastic.co/t/grouping-similar-buckets/272068)
**Author:** [@Gregorkosmina](https://discuss.elastic.co/u/Gregorkosmina)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:14am UTC](https://discuss.elastic.co/t/grouping-similar-buckets/272068 "2021-05-10T09:14:57Z")
My aggregations buckets are sorted by doc\_count at the moment. I would like to group them by similar buckets (e.g 40 km/h, 50 km/h, 60 km/h) even if doc\_count is different. Is this even possible? --- ## [How do I extend the default analyzer?](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 9:10am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-default-analyzer/272390 "2021-05-10T09:10:08Z")
This is example data. POST coding/\_bulk {"index":{"\_id":"1"}} {"language":"xyz\_foo@abc"} I confirmed that the defulat analyzer distinguishes @ but not the \_ (underscore)symbol through \_termvectors. GET coding/\_termve… --- ## [\[script\_exception\] runtime error bad request](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/272394)
**Author:** [@Furman](https://discuss.elastic.co/u/Furman)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 8:08am UTC](https://discuss.elastic.co/t/script-exception-runtime-error-bad-request/272394 "2021-05-10T08:08:48Z")
Hi, I am new in Kibana .So I added a scripted field in one of the index pattern. I am pretty sure the code should work fine. When I previewed the results, it works fine. However, when I tried to view it in Discover, … --- ## [Kibana hosts list](https://discuss.elastic.co/t/kibana-hosts-list/272315)
**Author:** [@accateo](https://discuss.elastic.co/u/accateo)\ **Replies:** 5\ **Last updated:** [May 10, 2021, 7:53am UTC](https://discuss.elastic.co/t/kibana-hosts-list/272315 "2021-05-10T07:53:01Z")
Hello, I have several devices that send data to Elastic via HTTP POST. Is it possible to see them on a list somewhere? Maybe in the Security-\> Hosts section? Thank you --- ## [Reimporting data at the start of a project](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541)
**Author:** [@lachlan.simpson](https://discuss.elastic.co/u/lachlan.simpson)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:54am UTC](https://discuss.elastic.co/t/reimporting-data-at-the-start-of-a-project/272541 "2021-05-10T06:54:41Z")
Have just finished the proof of concept (and learning) stage of ELK 7.12.1 installation. At the moment we are using a relatively simple filebeat-\>logstash-\>elasticsearch-\>kibana set up. During that process, I made some… --- ## [Kibana Search Latency](https://discuss.elastic.co/t/kibana-search-latency/272493)
**Author:** [@111470](https://discuss.elastic.co/u/111470)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:21am UTC](https://discuss.elastic.co/t/kibana-search-latency/272493 "2021-05-10T06:21:41Z")
Hello, I want to know how kibana search latency is calculated. Because I don't understand the kibana source code, so I want to ask you to help me --- ## [Restrict the fields from being updated](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 9\ **Last updated:** [May 10, 2021, 6:21am UTC](https://discuss.elastic.co/t/restrict-the-fields-from-being-updated/272264 "2021-05-10T06:21:35Z")
Hi , Is there a way to restrict the updation of a particular field while indexing a document. For example I have a field 'name' which is of type text and I index a document , next time I try to change this 'name' eithe… --- ## [Dae histogram with line chart](https://discuss.elastic.co/t/dae-histogram-with-line-chart/272405)
**Author:** [@abhishek30](https://discuss.elastic.co/u/abhishek30)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 6:16am UTC](https://discuss.elastic.co/t/dae-histogram-with-line-chart/272405 "2021-05-10T06:16:43Z")
The first interval values on x axis for 0-15 minutes is plotted on 00:00 rather than 00:15. How can i get it to plot on 00:15. --- ## [How to change the \_routing field](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488)
**Author:** [@Anyzm](https://discuss.elastic.co/u/Anyzm)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 2:28am UTC](https://discuss.elastic.co/t/how-to-change-the-routing-field/272488 "2021-05-10T02:28:09Z")
i create the index： PUT mobile\_info/?pretty { "settings": { "number\_of\_shards": 5, "number\_of\_replicas": 1 }, "mappings": { "info": { "\_routing":{ "required":"true" }, "properties": { "cust\_no": { "type": "… --- ## [Windows logs filtered with Active Directory Groups](https://discuss.elastic.co/t/windows-logs-filtered-with-active-directory-groups/272212)
**Author:** [@MitxelF](https://discuss.elastic.co/u/MitxelF)\ **Replies:** 3\ **Last updated:** [May 10, 2021, 1:08am UTC](https://discuss.elastic.co/t/windows-logs-filtered-with-active-directory-groups/272212 "2021-05-10T01:08:23Z")
Sorry if it is obvious but i'm very new with this. I would like to filter our windows security logs based in some groups manged in the active directory. I don't know how to start. Any idea for begin to think how? Tha… --- ## [ES does not push logs to customized \_type . it push logs for \_doc](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320)
**Author:** [@Dhiraj](https://discuss.elastic.co/u/Dhiraj)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:39am UTC](https://discuss.elastic.co/t/es-does-not-push-logs-to-customized-type-it-push-logs-for-doc/272320 "2021-05-10T00:39:34Z")
we have lots of indexes. some have "\_type" : "logs" & some have "\_type" : "log event" . It pushes logs every month after creating an index with the required \_type. but suddenly it was stopped pushing logs to customized … --- ## [Connecting Elasticsearch to Kibana](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463)
**Author:** [@jie\_olaf](https://discuss.elastic.co/u/jie_olaf)\ **Replies:** 1\ **Last updated:** [May 10, 2021, 12:27am UTC](https://discuss.elastic.co/t/connecting-elasticsearch-to-kibana/272463 "2021-05-10T00:27:33Z")
I am trying to display the iris data in kibana by connecting to elasticsearch and creating an index called "iris" in R. I am taking the following steps: Execute elasticsearch 5.5.3 batch file (localhost:9200 displays re… --- ## [Recommendation for number of master nodes in a large cluster having 250 data nodes](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510)
**Author:** [@Praveen\_Atluri](https://discuss.elastic.co/u/Praveen_Atluri)\ **Replies:** 4\ **Last updated:** [May 10, 2021, 12:15am UTC](https://discuss.elastic.co/t/recommendation-for-number-of-master-nodes-in-a-large-cluster-having-250-data-nodes/272510 "2021-05-10T00:15:20Z")
Hi All, Is there any recommendation for how many master nodes must be there for a large cluster containing 250 data nodes? When we monitor the thread pool of each data node in the cluster, I see some tasks that are re… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=952) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=954)