# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=978 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 979 --- ## [Display string list returned by scripted field in new line in discovery](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074)
**Author:** [@yash\_gupta](https://discuss.elastic.co/u/yash_gupta)\ **Replies:** 2\ **Last updated:** [April 16, 2021, 1:13am UTC](https://discuss.elastic.co/t/display-string-list-returned-by-scripted-field-in-new-line-in-discovery/270074 "2021-04-16T01:13:30Z")
Hi, I have a scripted filed returning a list of String, when I am viewing the field in discovery page I can see the values are coming as coma separated but I need them to come in new line. Is there any way to achieve t… --- ## [Distinct Report based on 2 columns (Text Field )](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143)
**Author:** [@Showman](https://discuss.elastic.co/u/Showman)\ **Replies:** 3\ **Last updated:** [April 16, 2021, 1:05am UTC](https://discuss.elastic.co/t/distinct-report-based-on-2-columns-text-field/270143 "2021-04-16T01:05:25Z")
Hello, am new to kibana & elastic am trying to get a simple report from a table that has different status for the same Refrence id as Follows: '''''' { "took": 0, "timed\_out": false, "\_shards": { "total": 1, "su… --- ## [Elastic Support Portal beta](https://discuss.elastic.co/t/elastic-support-portal-beta/269304)
**Author:** [@Erwin\_Willemsen](https://discuss.elastic.co/u/Erwin_Willemsen)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 11:16pm UTC](https://discuss.elastic.co/t/elastic-support-portal-beta/269304 "2021-04-15T23:16:14Z")
Hi community, I have received an invite to participate in the Elastic Support beta. I am looking forward to this, however I would like to know if there is an indication of the workload involved. I need this to manage the… --- ## [Using Fortinet Integration in Logstash](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304)
**Author:** [@b0r1s](https://discuss.elastic.co/u/b0r1s)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 10:17pm UTC](https://discuss.elastic.co/t/using-fortinet-integration-in-logstash/270304 "2021-04-15T22:17:28Z")
Hey everyone o/ I'm using that conf I found on this topic for parsing logs from FortigateFW with Logstash: input { udp { port =\> 514 type =\> "forti\_log" tags =\> \[""\] } } #THE BEGINNING DOESN'T FORMAT TO CODE … --- ## [Is it possible to use regexp or wildcard when adding exception to detection rules?](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 8:22pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-regexp-or-wildcard-when-adding-exception-to-detection-rules/270204 "2021-04-15T20:22:02Z")
Hi, when adding exceptions to detection rules, is it possible to use regular expressions or wildcards? sometimes executable are started in directories created with random names, or have parameters with other variable p… --- ## [How to identify the ip address of application which sends the bulk updates to elasticsearch cluster?](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 7\ **Last updated:** [April 15, 2021, 7:32pm UTC](https://discuss.elastic.co/t/how-to-identify-the-ip-address-of-application-which-sends-the-bulk-updates-to-elasticsearch-cluster/270154 "2021-04-15T19:32:45Z")
How to identify the IP address of the application which sends the bulk updates to elasticsearch cluster? --- ## [Weird test configuration problem || log\_file --\> Syslog-ng --\> Logstash --\> another\_file](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 6:58pm UTC](https://discuss.elastic.co/t/weird-test-configuration-problem-log-file-syslog-ng-logstash-another-file/270253 "2021-04-15T18:58:42Z")
Hi All, please ignore the stupid use case as I only use this config for testing purposes. I have an Ubuntu server with installed syslog-ng and Logstash. I'd like to do the following: I have a cronjob that on every min… --- ## [Kibana:getting past login page with selenium](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782)
**Author:** [@jmlucjav](https://discuss.elastic.co/u/jmlucjav)\ **Replies:** 14\ **Last updated:** [April 15, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-getting-past-login-page-with-selenium/269782 "2021-04-15T18:20:51Z")
I am trying to get some to some pages in kibana through selenium/crome dirver. I have seen some samples from some time ago where providing the user/pwd in the url worked, but now, if I do this, still gets me to the page … --- ## [Detections coverage of ATT&CK documentation](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:57pm UTC](https://discuss.elastic.co/t/detections-coverage-of-att-ck-documentation/269692 "2021-04-15T17:57:24Z")
Hi, We are trying to review the ATT&CK coverage for the current detections to help us with creation and coverage of our own ruleset, is there anything available for us to use? Thanks --- ## [Gauges don't display a number for last 5 min, but do display for last 1hr, even though there is data](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 5:18pm UTC](https://discuss.elastic.co/t/gauges-dont-display-a-number-for-last-5-min-but-do-display-for-last-1hr-even-though-there-is-data/270282 "2021-04-15T17:18:42Z")
Here's an issue that I'm having a hard time figuring out how to search on. So far I haven't found anyone else describing something similar. Any tips would be appreciated. So, I've configured a gauge based on the memory … --- ## [Logstash - elasticsarch and double quotes](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133)
**Author:** [@cibernicola](https://discuss.elastic.co/u/cibernicola)\ **Replies:** 11\ **Last updated:** [April 15, 2021, 4:49pm UTC](https://discuss.elastic.co/t/logstash-elasticsarch-and-double-quotes/270133 "2021-04-15T16:49:21Z")
Hello I'm trying to ingest logs wich have " in some of their fields as part of a string, I'm trying to scape them with \\ or \\ or \\\\ but no luck, so, is there any way to ingest double quotes from logs into elasticsearch … --- ## [Java::JavaLang::IllegalStateException\` for \`PipelineAction::Create\](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034)
**Author:** [@prajawalkp](https://discuss.elastic.co/u/prajawalkp)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 5:42pm UTC](https://discuss.elastic.co/t/java-illegalstateexception-for-pipelineaction-create-main/270034 "2021-04-13T17:42:40Z")
Hii, I am new to logstash and using logstash to syncup mysql with elasticsearch. But I can't get through this error. Please help. It is urgent. Using JAVA\_HOME defined java: /Library/Java/JavaVirtualMachines/jdk-15.… --- ## [Elastic search fill missing values in aggregation](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281)
**Author:** [@Ivan\_Janev](https://discuss.elastic.co/u/Ivan_Janev)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 4:29pm UTC](https://discuss.elastic.co/t/elastic-search-fill-missing-values-in-aggregation/270281 "2021-04-15T16:29:19Z")
I'm doing a sum aggregation in elasticsearch and in the query part I'm using a range filter. Is there anyway to fill missing data when the results come back? To make this more clear I'm going to share the code which is c… --- ## [Valuelists in EQL (correlation) & Threshold Rules](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 4:31pm UTC](https://discuss.elastic.co/t/valuelists-in-eql-correlation-threshold-rules/268355 "2021-04-15T16:31:25Z")
Why Can't we add value lists as condition in Correlation Rule Type & Threshold Rule Types even in 7.12? We can only add value lists in indicator match type rules. Why? --- ## [Problem with parent-child join](https://discuss.elastic.co/t/problem-with-parent-child-join/270278)
**Author:** [@MarlMan](https://discuss.elastic.co/u/MarlMan)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:46pm UTC](https://discuss.elastic.co/t/problem-with-parent-child-join/270278 "2021-04-15T15:46:30Z")
Hey guys. I have a big data set with many parents and children. My goal is to find out, how many Jo-children each parent has. So I only want to know about children which have Jo as a part of their name (Joel, John, John… --- ## [Elasticsearch doesn't cache query with rounded date](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706)
**Author:** [@tlinhart](https://discuss.elastic.co/u/tlinhart)\ **Replies:** 25\ **Last updated:** [April 15, 2021, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-cache-query-with-rounded-date/269706 "2021-04-15T15:39:48Z")
I originally posted the question to Stack Overflow but I guess it's more appropriate to ask here. (For reference, the original question is here - caching - Elasticsearch doesn't cache query with rounded date - Stack Over… --- ## [JDBC input parameters add quotes to query](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271)
**Author:** [@mlnusd](https://discuss.elastic.co/u/mlnusd)\ **Replies:** 0\ **Last updated:** [April 15, 2021, 3:32pm UTC](https://discuss.elastic.co/t/jdbc-input-parameters-add-quotes-to-query/270271 "2021-04-15T15:32:48Z")
I'm trying to use jdbc input filter to query Oracle DB and to template a schema name. My statement looks like this: select count(1) from :schema.my\_table And my logstash config is like this: input { \[...connection … --- ## [Flattened alternative for OSS verrsion](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 3:23pm UTC](https://discuss.elastic.co/t/flattened-alternative-for-oss-verrsion/270029 "2021-04-15T15:23:18Z")
Is there an alternative/workaround for the flattened mapping type to prevent mapping explosion when using OSS elasticsearch version? --- ## [Broken grok after the update to Logstash 7.12](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863)
**Author:** [@aviadhaham](https://discuss.elastic.co/u/aviadhaham)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 3:03pm UTC](https://discuss.elastic.co/t/broken-grok-after-the-update-to-logstash-7-12/269863 "2021-04-15T15:03:51Z")
Hello, In my company, after upgrading our cluster to the latest version 7.12, we noticed that one of our grok patterns stopped working. Important things to mention: The pipeline is functioning correctly, logs are com… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/270238)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 3:02pm UTC](https://discuss.elastic.co/t/multiple-pipelines/270238 "2021-04-15T15:02:05Z")
can somebody helps me 4.29} \[INFO \] 2021-04-15 07:55:35.481 \[\[beats-server\]-pipeline-manager\] beats - Starting input listener {:address=\>"0.0.0.0:5044"} \[INFO \] 2021-04-15 07:55:35.666 \[\[auth\]-pipeline-manager\] javapi… --- ## [Mapping a Data in a log to another Field](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 1\ **Last updated:** [April 15, 2021, 2:54pm UTC](https://discuss.elastic.co/t/mapping-a-data-in-a-log-to-another-field/270250 "2021-04-15T14:54:10Z")
Hey Everyone, How do you map a field from the logs to another field. So for example if I have the following log message":"03-MAR-21 00:30:46|142.122.217.10 |1| I want to parse out |1| but also then map it to an index … --- ## [TSVB Table Sorted by timestamp](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [April 15, 2021, 2:27pm UTC](https://discuss.elastic.co/t/tsvb-table-sorted-by-timestamp/267271 "2021-04-15T14:27:20Z")
Hello, I have a nice TSVB graph and I'm trying to get a table out of it sorted by timestamp. Should be simple, but it doesn't show any value: I want a time-based table like the other Table graph, but needs to be TSVB… --- ## [When to separate data nodes and master node roles](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127)
**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:49pm UTC](https://discuss.elastic.co/t/when-to-separate-data-nodes-and-master-node-roles/270127 "2021-04-15T13:49:39Z")
Hi All, Is there any criteria that should be followed to decide on separating Master nodes and Data nodes? --- ## [GCP Discovert Plugi installation](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220)
**Author:** [@marcin.wizgird](https://discuss.elastic.co/u/marcin.wizgird)\ **Replies:** 5\ **Last updated:** [April 15, 2021, 1:45pm UTC](https://discuss.elastic.co/t/gcp-discovert-plugi-installation/270220 "2021-04-15T13:45:47Z")
Hi, I encountered challenge with GCP Discovery Plugin installation. ElasticSearch version which is installed is 6.8.4. whereas plugin accessible on the website is for version 6.8.15. During the installation I encounter … --- ## [Does ElasticSearch itself have access logs?](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236)
**Author:** [@asasas234](https://discuss.elastic.co/u/asasas234)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:25pm UTC](https://discuss.elastic.co/t/does-elasticsearch-itself-have-access-logs/270236 "2021-04-15T13:25:23Z")
Does ElasticSearch have a feature similar to Tomcat access logs? So that I can see the history of requests at a specific time --- ## [Creating Dashbard and visualisation with python](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235)
**Author:** [@rockiram](https://discuss.elastic.co/u/rockiram)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 1:24pm UTC](https://discuss.elastic.co/t/creating-dashbard-and-visualisation-with-python/270235 "2021-04-15T13:24:02Z")
Hi, I am new to kibana. Is it possible to create kibana visualisation and dashboard using python? If so, Please suggest me some references to start Thanks in Advance!!! --- ## [\[Elasticsearch cluster status red\] : path: /.apm-agent-configuration/\_search, params: {index=.apm-agent-configuration} org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215)
**Author:** [@abi.mc](https://discuss.elastic.co/u/abi.mc)\ **Replies:** 2\ **Last updated:** [April 15, 2021, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-red-path-apm-agent-configuration-search-params-index-apm-agent-configuration-org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed/270215 "2021-04-15T12:49:34Z")
Our two node elasticsearch cluster status shows red. The cluster is configured with HTTP and TLS encryption. Please find below the error from elasticsearch logs. Could you please let us know how the cluster status can be… --- ## [Visualize / Search Date more than X days ago](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905)
**Author:** [@csatola](https://discuss.elastic.co/u/csatola)\ **Replies:** 13\ **Last updated:** [April 15, 2021, 12:47pm UTC](https://discuss.elastic.co/t/visualize-search-date-more-than-x-days-ago/269905 "2021-04-15T12:47:49Z")
In my scenario, I'm logging server vulnerability data. @timestamp is when the document was added (and that's fine), but I also have a "PatchReleasedDate" field. What I would like to do is build visualizations for # of do… --- ## [Extract value from Nested message field - LogStash Kibana Grok Mutate](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368)
**Author:** [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)\ **Replies:** 4\ **Last updated:** [April 15, 2021, 11:39am UTC](https://discuss.elastic.co/t/extract-value-from-nested-message-field-logstash-kibana-grok-mutate/269368 "2021-04-15T11:39:58Z")
I've configured a FileBeat service to send logs to Kibana via LogStash. FileBeat and LogStash are in different servers while Kibana is inside an AWS ElasticSearch domain. The logs are visible in the Kibana dashboard. In … --- ## [Rename field name in saved search](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205)
**Author:** [@thenoobert](https://discuss.elastic.co/u/thenoobert)\ **Replies:** 3\ **Last updated:** [April 15, 2021, 11:37am UTC](https://discuss.elastic.co/t/rename-field-name-in-saved-search/270205 "2021-04-15T11:37:20Z")
Hi, I am currently trying to visualize a result based on saved search. However, the result field name is too distracting/displeasing so would like to rename it to something simple. I know this can be achieved through da… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=977) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=979)