# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=968 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 969 --- ## [Hide elasticsearch superuser name and password in logstash conf](https://discuss.elastic.co/t/hide-elasticsearch-superuser-name-and-password-in-logstash-conf/271124)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 3:17pm UTC](https://discuss.elastic.co/t/hide-elasticsearch-superuser-name-and-password-in-logstash-conf/271124 "2021-04-26T15:17:11Z")
Hello all, The logstash (7.x) in the environment resides on the same server as filebeat. I am reluctant to mention superuser name and password info for elasticsearch in logstash.conf. Can I create a new user in Kibana … --- ## [Ingest with condition issue](https://discuss.elastic.co/t/ingest-with-condition-issue/271175)
**Author:** [@tbs575](https://discuss.elastic.co/u/tbs575)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 3:13pm UTC](https://discuss.elastic.co/t/ingest-with-condition-issue/271175 "2021-04-26T15:13:47Z")
met strange issue. created one ingest with condition by Kibana, and tested pass with my data in ingest edit by 'Add documents'. but failed when I use 'Dev Tools' in kibana, 'PUT' same data. why? will be failed, paste t… --- ## [Is it possible to change the font color of the X and Y axis values on a Lens Bar Chart?](https://discuss.elastic.co/t/is-it-possible-to-change-the-font-color-of-the-x-and-y-axis-values-on-a-lens-bar-chart/271196)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 3:10pm UTC](https://discuss.elastic.co/t/is-it-possible-to-change-the-font-color-of-the-x-and-y-axis-values-on-a-lens-bar-chart/271196 "2021-04-26T15:10:06Z")
Hi Team, I'm using a Lens bar chart on one of my Canvas projects to bypass some of the existing printing to PDF issues w/ 7.9.2 where the X axis gets cut off, and I need to find a way to change the font color / size of … --- ## [Cases feature in Kibana](https://discuss.elastic.co/t/cases-feature-in-kibana/271075)
**Author:** [@cctk](https://discuss.elastic.co/u/cctk)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 2:41pm UTC](https://discuss.elastic.co/t/cases-feature-in-kibana/271075 "2021-04-26T14:41:26Z")
Hi, I have a issue with the cases feature in Kibana Security section. I have created a timeline and I am trying to add any errors that I find as a case or to an existing case. However, it will not allow me to do this th… --- ## [Difference between results of two queries](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991)
**Author:** [@Askia\_Mohamed\_Kadri](https://discuss.elastic.co/u/Askia_Mohamed_Kadri)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 2:40pm UTC](https://discuss.elastic.co/t/difference-between-results-of-two-queries/270991 "2021-04-26T14:40:26Z")
Hi! I'm stuck and I really need help. Here is my use case: I would like to perform two queries and get as final result the difference between those two queries based on a specific field. Let's assume that I have these … --- ## [Calculate time difference in scripted field](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 18\ **Last updated:** [April 26, 2021, 2:22pm UTC](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/271213 "2021-04-26T14:22:57Z")
The question is how to get the difference from following date format in a second? For example, if date1 = 4/21/2021 7:53:50 and date2 = 6/21/2021 7:54:10, the answer should 20 . I am trying below code but it is providi… --- ## [Relocation in loop on Elasticsearch 7.7](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 1:25pm UTC](https://discuss.elastic.co/t/relocation-in-loop-on-elasticsearch-7-7/270486 "2021-04-26T13:25:18Z")
We recently upgraded from ES 5.4 to ES 7.7 and are facing this weird issue in production where relocation goes in a loop. Have noticed majorly on large clusters and having hot/cold config. e.g. following is cluster confi… --- ## [Query to calculate login success and failure rates](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787)
**Author:** [@Venkatesh\_Sridharan](https://discuss.elastic.co/u/Venkatesh_Sridharan)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 12:45pm UTC](https://discuss.elastic.co/t/query-to-calculate-login-success-and-failure-rates/270787 "2021-04-26T12:45:21Z")
Hello All, I have a list of login events on the index which has the following fields. ip\_address: \ login\_success: \ Now I want to query the logs and get a count of number of success and failed logins from e… --- ## [Csv with date column](https://discuss.elastic.co/t/csv-with-date-column/271255)
**Author:** [@Muhammad\_Faisal](https://discuss.elastic.co/u/Muhammad_Faisal)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 12:37pm UTC](https://discuss.elastic.co/t/csv-with-date-column/271255 "2021-04-26T12:37:34Z")
hi all, i have below blocks of csv data....date comes in first line followed by csv data ...i need to bring date with csv data as a column to process it with timestamp. 20210409 0030 Counter node-3 … --- ## [Customized Uptime dashboard , need to remove the TLS certificate field and modify the other field name](https://discuss.elastic.co/t/customized-uptime-dashboard-need-to-remove-the-tls-certificate-field-and-modify-the-other-field-name/271254)
**Author:** [@priya\_singh](https://discuss.elastic.co/u/priya_singh)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 12:31pm UTC](https://discuss.elastic.co/t/customized-uptime-dashboard-need-to-remove-the-tls-certificate-field-and-modify-the-other-field-name/271254 "2021-04-26T12:31:16Z")
Hi Teams , I have to customizwd the uptime dashboard as per client requiremnet . need to rename the Monitor to Backend System Url to Url Encode as well nned to made this feild value disabled Remove the TLS Certifica… --- ## [Making cURL PUT, POST and DELETE requests?](https://discuss.elastic.co/t/making-curl-put-post-and-delete-requests/271235)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 10:46am UTC](https://discuss.elastic.co/t/making-curl-put-post-and-delete-requests/271235 "2021-04-26T10:46:44Z")
Sometimes Kibana times out when making certain large requests so I think I am forced to do it thru CLI. Issue is that I do not know how to currently make the sintaxis. I already generated a api key. For the sake of a e… --- ## [Adding additional weight without matching](https://discuss.elastic.co/t/adding-additional-weight-without-matching/270865)
**Author:** [@Silas\_Hansen](https://discuss.elastic.co/u/Silas_Hansen)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 10:07am UTC](https://discuss.elastic.co/t/adding-additional-weight-without-matching/270865 "2021-04-26T10:07:14Z")
I want to be able to Match a subset of the index with a query\_string query. Add additional weight to documents that match a set of post-evaluated criterias. Example: Let's say I have these two documents: \[ { … --- ## [Shard allocation awareness implementation in elasticsarch](https://discuss.elastic.co/t/shard-allocation-awareness-implementation-in-elasticsarch/271193)
**Author:** [@722826c085cfc824006d](https://discuss.elastic.co/u/722826c085cfc824006d)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 9:55am UTC](https://discuss.elastic.co/t/shard-allocation-awareness-implementation-in-elasticsarch/271193 "2021-04-26T09:55:25Z")
we are using open source elasticsearch 5.6.10 from last 2 years in AWS cloud, but didn't implement shard allocation awareness in the clusters. Since the lack of shard allocation of awareness, the shards are distributed i… --- ## [Make two indexes which different fields communicate](https://discuss.elastic.co/t/make-two-indexes-which-different-fields-communicate/271137)
**Author:** [@dumpnetflow](https://discuss.elastic.co/u/dumpnetflow)\ **Replies:** 3\ **Last updated:** [April 26, 2021, 9:07am UTC](https://discuss.elastic.co/t/make-two-indexes-which-different-fields-communicate/271137 "2021-04-26T09:07:23Z")
Hi Everyone, I have two indexes which are automatically generated by an application which I cannot modify. Index one has two fields: { "mappings": { "properties": { "src.ip.address": { "type": "ip" }, "dst.ip.ad… --- ## [Logging DELETE query in logs](https://discuss.elastic.co/t/logging-delete-query-in-logs/271229)
**Author:** [@Kunal\_Salvi](https://discuss.elastic.co/u/Kunal_Salvi)\ **Replies:** 0\ **Last updated:** [April 26, 2021, 8:07am UTC](https://discuss.elastic.co/t/logging-delete-query-in-logs/271229 "2021-04-26T08:07:40Z")
Hello Elasticsearch team, Is there any place where Elasticsearch logs DELETE query action. Is any feature in BASIC license where I can trace the DELETE action happing on Elasticsearch? I understand the audit events can … --- ## [Using kibana7.10 with elasticsearch7.12 and beats 7.12](https://discuss.elastic.co/t/using-kibana7-10-with-elasticsearch7-12-and-beats-7-12/271176)
**Author:** [@ghaithTK](https://discuss.elastic.co/u/ghaithTK)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 7:50am UTC](https://discuss.elastic.co/t/using-kibana7-10-with-elasticsearch7-12-and-beats-7-12/271176 "2021-04-26T07:50:37Z")
hii Can i use kibana7.10 with elasticsearch 7.12 and beats7.12? thanx --- ## [Kibana cluster email alerts](https://discuss.elastic.co/t/kibana-cluster-email-alerts/270712)
**Author:** [@mutt13y](https://discuss.elastic.co/u/mutt13y)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 7:26am UTC](https://discuss.elastic.co/t/kibana-cluster-email-alerts/270712 "2021-04-26T07:26:22Z")
Hi, I have configured monitoring.cluster\_alerts.email\_notifications.email\_address in kibana.yml in elasticsearch.yml I am using SES The SES configuration does not allow me to include a from, ES refuses to start if its… --- ## [Jira connector mapped to the wrong field](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535)
**Author:** [@kyles](https://discuss.elastic.co/u/kyles)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 6:48am UTC](https://discuss.elastic.co/t/jira-connector-mapped-to-the-wrong-field/269535 "2021-04-26T06:48:38Z")
I setup the Jira connector to Elastic security but it automatically mapped the description field to a custom field that is not the description field. Is there a way to manually change what it is mapped to? --- ## [Environmental variable in Logstash](https://discuss.elastic.co/t/environmental-variable-in-logstash/271063)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [April 26, 2021, 6:25am UTC](https://discuss.elastic.co/t/environmental-variable-in-logstash/271063 "2021-04-26T06:25:41Z")
Hi Folks, I use Logstash to send logs to a cloud SIEM. In particular I use an output plugin for the SIEM Vendor In order to authenticate towards the cloud Logstash presents id which is public and don't bother me and k… --- ## [Logstash is not starting in windows](https://discuss.elastic.co/t/logstash-is-not-starting-in-windows/270577)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 4\ **Last updated:** [April 26, 2021, 4:36am UTC](https://discuss.elastic.co/t/logstash-is-not-starting-in-windows/270577 "2021-04-26T04:36:00Z")
Hey Guys , I am using Logstash to send logs to kibana . I have configured logstash in windows instances with Two pipelines in my pipelines.yaml and this is the config that is present in pipelines.yml - pipeline.id… --- ## [Missing "Host" and Event Log Data under Security tab](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183)
**Author:** [@mually](https://discuss.elastic.co/u/mually)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 10:37am UTC](https://discuss.elastic.co/t/missing-host-and-event-log-data-under-security-tab/271183 "2021-04-25T10:37:46Z")
Hi, I deployed the elastic agent to my Windows server and enabled the endpoint security integration. The agent is visible and healthy from the fleet menu, and also from the administration page under the security menu. H… --- ## [Security not appear data](https://discuss.elastic.co/t/security-not-appear-data/271029)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 2\ **Last updated:** [April 26, 2021, 12:50am UTC](https://discuss.elastic.co/t/security-not-appear-data/271029 "2021-04-26T00:50:03Z")
HI, may i know, why my data not display in security in kibana. Previously i'm using basic license. then i extend it to trial license. however, i saw my data for auditbeat and filebeat appear in discovery. but i just con… --- ## [Element involves results from two KQLs?](https://discuss.elastic.co/t/element-involves-results-from-two-kqls/270915)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 4\ **Last updated:** [April 25, 2021, 7:18pm UTC](https://discuss.elastic.co/t/element-involves-results-from-two-kqls/270915 "2021-04-25T19:18:30Z")
Hi, in Kibana Canvas, I want to have an image element that changes color according to results from two separate KQLs. Is it possible? If not, any suggestions on how I may be able to work around this limitation? Thanks a… --- ## [Split of JSON array into multiple events in Kibana](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018)
**Author:** [@pedro\_gonzalez](https://discuss.elastic.co/u/pedro_gonzalez)\ **Replies:** 7\ **Last updated:** [April 25, 2021, 5:55pm UTC](https://discuss.elastic.co/t/split-of-json-array-into-multiple-events-in-kibana/271018 "2021-04-25T17:55:28Z")
Hi, I am trying to split into different events (logs) this log schema: "\_index": "cocacola", "\_type": "raw", "\_id": "CqwJ63MBEQS11DmXsDyRZl", "\_score": 1, "\_source": { … --- ## [Not sure if a field is nill, null or empty. Help please](https://discuss.elastic.co/t/not-sure-if-a-field-is-nill-null-or-empty-help-please/271123)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 4\ **Last updated:** [April 24, 2021, 6:55pm UTC](https://discuss.elastic.co/t/not-sure-if-a-field-is-nill-null-or-empty-help-please/271123 "2021-04-24T18:55:29Z")
Hi All, It's about barracuda FW log with the following entry +02:00 Security XXX Block: type=FWD|proto=TCP|srcIF=eth0|srcIP=0.0.0.0|srcPort=58570|srcMAC=00:00:00:00:00:00|dstIP=0.0.0.0|dstPort=3002|dstService=exlm-agen… --- ## [Elasticsearch Security - Asking for Data](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 1\ **Last updated:** [April 25, 2021, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-security-asking-for-data/271187 "2021-04-25T14:51:13Z")
I am sending logs from my firewall/home-router(UDM) to rsyslog and copying the logs in Logstash directory. I can see the data in discover and can create visualizations/Dashboard from that data. But the security section i… --- ## [Is using "filter" inside "aggs" more efficient than "query" at the top level of an aggregation body?](https://discuss.elastic.co/t/is-using-filter-inside-aggs-more-efficient-than-query-at-the-top-level-of-an-aggregation-body/271153)
**Author:** [@mattwelke](https://discuss.elastic.co/u/mattwelke)\ **Replies:** 5\ **Last updated:** [April 25, 2021, 1:02pm UTC](https://discuss.elastic.co/t/is-using-filter-inside-aggs-more-efficient-than-query-at-the-top-level-of-an-aggregation-body/271153 "2021-04-25T13:02:02Z")
I'm working in a legacy code base and I think I've uncovered an inefficient way of doing a filter aggregation based on what I read in the docs. These are my assumptions: Using filters to eliminate documents from searc… --- ## [Non-nested query on copy\_to fields performs worse then a nested query](https://discuss.elastic.co/t/non-nested-query-on-copy-to-fields-performs-worse-then-a-nested-query/271186)
**Author:** [@Ron\_lusha](https://discuss.elastic.co/u/Ron_lusha)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 11:50am UTC](https://discuss.elastic.co/t/non-nested-query-on-copy-to-fields-performs-worse-then-a-nested-query/271186 "2021-04-25T11:50:37Z")
Our service uses a lot of nested queries/data, in order to improve our response time I tried to rewrite our heaviest query and use copy\_to to copy the fields I need from inside the nested docs to the root doc and query t… --- ## [Cluster Health Events FROM Elastic TO Arcsight](https://discuss.elastic.co/t/cluster-health-events-from-elastic-to-arcsight/271185)
**Author:** [@yaharin\_ben\_ayon](https://discuss.elastic.co/u/yaharin_ben_ayon)\ **Replies:** 0\ **Last updated:** [April 25, 2021, 11:30am UTC](https://discuss.elastic.co/t/cluster-health-events-from-elastic-to-arcsight/271185 "2021-04-25T11:30:41Z")
Hello, is there a way to import the cluster health logs or any logs FROM Elastic TO Arcsight with the Logstash Arcsight module or other way? Thank you! --- ## [Aggregation on latest n records](https://discuss.elastic.co/t/aggregation-on-latest-n-records/271169)
**Author:** [@behzad\_dadashpour](https://discuss.elastic.co/u/behzad_dadashpour)\ **Replies:** 2\ **Last updated:** [April 25, 2021, 9:32am UTC](https://discuss.elastic.co/t/aggregation-on-latest-n-records/271169 "2021-04-25T09:32:14Z")
Hi Is there any way to do aggregation on latest N records? this solution didn't work { "query": {...}, "size": N, "order": ..., "aggs": { .... } } for more detail: I want to get last 10 records … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=967) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=969)