# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=982 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 983 --- ## [Event Correlation detection - tiebreaker field](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 8:12am UTC](https://discuss.elastic.co/t/event-correlation-detection-tiebreaker-field/269974 "2021-04-13T08:12:10Z")
Hi, I need to use a tiebreaker field within an Event Correlation detection rule, I cannot find in the docs other than for a query, hoping its possible somehow Thanks --- ## [Display image from rows on kibana](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927)
**Author:** [@erwan22](https://discuss.elastic.co/u/erwan22)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 7:32am UTC](https://discuss.elastic.co/t/display-image-from-rows-on-kibana/269927 "2021-04-13T07:32:17Z")
Hello, I have a DataFrame (100 rows) in which i have a column dedicated to base64 encoded image. I have uploaded this dataframe in elastic and i'm able to visualise all the images in the "Discover" section for each row… --- ## [Hot warm architecture in ES](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915)
**Author:** [@sathish.mtech01](https://discuss.elastic.co/u/sathish.mtech01)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 6:12am UTC](https://discuss.elastic.co/t/hot-warm-architecture-in-es/269915 "2021-04-13T06:12:22Z")
How to configure Hot warm architecture of elastic serach in kubernetes cluster? Is this comes under community edition or x-pack? Could you please share urls to configure. --- ## [Issues with Canvas when using a time filter](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958)
**Author:** [@azulgrana](https://discuss.elastic.co/u/azulgrana)\ **Replies:** 5\ **Last updated:** [April 13, 2021, 3:48am UTC](https://discuss.elastic.co/t/issues-with-canvas-when-using-a-time-filter/269958 "2021-04-13T03:48:47Z")
Hi there! I have a Canvas workpad with a few charts (metrics, horizontal bars, pie) that was working fine until I added a time filter. I added the time filter to take advantage of a timelion query I already have on the … --- ## [Can Significant text aggregation work on copy\_to fields](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908)
**Author:** [@sj12345](https://discuss.elastic.co/u/sj12345)\ **Replies:** 2\ **Last updated:** [April 13, 2021, 3:14am UTC](https://discuss.elastic.co/t/can-significant-text-aggregation-work-on-copy-to-fields/269908 "2021-04-13T03:14:34Z")
I want to do a significant text aggregation on a field which was copied from few other fields (i.e. its a copy\_to field) "combined\_fields" : { "type" : "text", "store" : true, "norms" : fa… --- ## [Kibana visualization custom count column in table](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925)
**Author:** [@kibanaUser3](https://discuss.elastic.co/u/kibanaUser3)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 2:23am UTC](https://discuss.elastic.co/t/kibana-visualization-custom-count-column-in-table/269925 "2021-04-13T02:23:24Z")
I'd like to create visualization for IIS logs group by urls with following strucutre url, total count, total count of urls with 500 status code, total count of urls with status code 200 How do I configure the Metric: C… --- ## [Сравнение значений полей в Grafana](https://discuss.elastic.co/t/grafana/269962)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 0\ **Last updated:** [April 13, 2021, 2:14am UTC](https://discuss.elastic.co/t/grafana/269962 "2021-04-13T02:14:00Z")
Есть 2 Datasources с индексами Elasticsearch в Grafana. Оба источника данных располагаются на 1 сервере с Elastic. Необходимо получить количество документов в которых совпадают значения полей (сравнить документы разных … --- ## [Detection-Rules - Subtechniques](https://discuss.elastic.co/t/detection-rules-subtechniques/269658)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 3\ **Last updated:** [April 13, 2021, 1:47am UTC](https://discuss.elastic.co/t/detection-rules-subtechniques/269658 "2021-04-13T01:47:59Z")
As I understand from the official GitHub repository for detection-rules, sub-techniques are already used as part of the existing rules. One example can be found here. However, from what I see in the latest guide, it is … --- ## [Value Lists as Exception in Threshold and Correlation type rules](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353)
**Author:** [@tushar.bansal](https://discuss.elastic.co/u/tushar.bansal)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 1:20am UTC](https://discuss.elastic.co/t/value-lists-as-exception-in-threshold-and-correlation-type-rules/268353 "2021-04-13T01:20:53Z")
Why Can't we add value list as exception for Threshold rules and correlation rules even in 7.12? --- ## [Csv filter plugin not working](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 28\ **Last updated:** [April 13, 2021, 1:07am UTC](https://discuss.elastic.co/t/csv-filter-plugin-not-working/268777 "2021-04-13T01:07:06Z")
I would like to use logstash to format my logs. Specifically, I have a log with the following format format: timestamp \[thread-name\] log-level class-name - log-message example: 2021-03-30 09:38:20.201 \[ConnectionChe… --- ## [Удаление пробелов из поля в LS](https://discuss.elastic.co/t/ls/269957)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 12:43am UTC](https://discuss.elastic.co/t/ls/269957 "2021-04-13T00:43:48Z")
Здравствуйте. Хочу удалить пробелы из поля filed. Сейчас поле содержит следующее значение: "val1 2 3". Хочу, чтобы было так: "val123". Пробовал так: filter { mutate { gsub =\> \["field"," ",""\] } } Также пробо… --- ## [Does logstash use openssl?](https://discuss.elastic.co/t/does-logstash-use-openssl/269827)
**Author:** [@TakaSeki](https://discuss.elastic.co/u/TakaSeki)\ **Replies:** 4\ **Last updated:** [April 13, 2021, 12:41am UTC](https://discuss.elastic.co/t/does-logstash-use-openssl/269827 "2021-04-13T00:41:09Z")
Does logstash use openssl when using the SSL / TLS protocol? If so, where can I find the version of openssl? --- ## [Observability/Logs works only with modules?](https://discuss.elastic.co/t/observability-logs-works-only-with-modules/269953)
**Author:** [@UltimateOrb](https://discuss.elastic.co/u/UltimateOrb)\ **Replies:** 1\ **Last updated:** [April 13, 2021, 12:22am UTC](https://discuss.elastic.co/t/observability-logs-works-only-with-modules/269953 "2021-04-13T00:22:38Z")
I have a log file in json format. Each line is a separate message. I can parse the log and send it to elastic. But I don't understand how to output it to Observability/Logs --- ## [Replace the @TimeStamp with actual time during a bulk Filebeat Send](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882)
**Author:** [@Wilks](https://discuss.elastic.co/u/Wilks)\ **Replies:** 3\ **Last updated:** [April 12, 2021, 11:22pm UTC](https://discuss.elastic.co/t/replace-the-timestamp-with-actual-time-during-a-bulk-filebeat-send/269882 "2021-04-12T23:22:37Z")
Hi, We are collecting a large amount of logs through out the day and then sending them at 4:30am via Filebeat in a bulk send. The problem is when they end up in Elasticsearch/Kibana all the @TimeStamp fields are 4:30am… --- ## [Update vs Reindex](https://discuss.elastic.co/t/update-vs-reindex/269929)
**Author:** [@abhishekc92](https://discuss.elastic.co/u/abhishekc92)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 10:04pm UTC](https://discuss.elastic.co/t/update-vs-reindex/269929 "2021-04-12T22:04:31Z")
Hello, I am evaluating a few ways of organizing my indices. One of the questions I had was generally speaking, what is the difference in overhead(if any) between updating a document within an index vs using the reindex … --- ## ["Azure Excessive Signin Logs by Azure Identity" unusable azure.signinlogs.identity](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 9:55pm UTC](https://discuss.elastic.co/t/azure-excessive-signin-logs-by-azure-identity-unusable-azure-signinlogs-identity/269708 "2021-04-12T21:55:03Z")
Hello, Just noticed that in the rule "Azure Excessive Signin Logs by Azure Identity" it seems impossible to display the field azure.signinlogs.identity, which is not very user friendly and a waste of time to lookup afte… --- ## [Multiple pipeline](https://discuss.elastic.co/t/multiple-pipeline/269907)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 2\ **Last updated:** [April 12, 2021, 9:35pm UTC](https://discuss.elastic.co/t/multiple-pipeline/269907 "2021-04-12T21:35:53Z")
hi I have 2 servers , the first is DHCP server and the second is DNS server so for shipping the logs to logstash i installed filebeats so in logstash I will apply the differents filtres on DNS and DHCP so how can do th… --- ## [Translate filter regex capture grouping](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922)
**Author:** [@aap323](https://discuss.elastic.co/u/aap323)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:55pm UTC](https://discuss.elastic.co/t/translate-filter-regex-capture-grouping/269922 "2021-04-12T19:55:42Z")
Hi, I am using Logstash to parse and enter graphite metrics into InfluxDB. However, I wanted to create a large dictionary source where it can match certain metric lines based on their pattern and reorganize the string ba… --- ## [Logstash 7.12.0 High CPU usage](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 7:41pm UTC](https://discuss.elastic.co/t/logstash-7-12-0-high-cpu-usage/269851 "2021-04-12T19:41:21Z")
Hi All, I know that there are several open discussions on the topic already but nothing in there helped me resolving my situation. #1 I installed Logstash on Ubuntu 20.04 for testing purposes and enabling it to run with… --- ## [Display only most recent log per host - Complete Newb](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712)
**Author:** [@Jspang01](https://discuss.elastic.co/u/Jspang01)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 7:18pm UTC](https://discuss.elastic.co/t/display-only-most-recent-log-per-host-complete-newb/269712 "2021-04-12T19:18:54Z")
Hello There All, This is my first post. I fully admit that I am a total newb to Kibana. Up until this past month I was only using it to view data that we have. But I am slowly starting to be tasked with making up new v… --- ## [\_id value is getting changed in elastic](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905)
**Author:** [@gbandasha](https://discuss.elastic.co/u/gbandasha)\ **Replies:** 12\ **Last updated:** [April 12, 2021, 5:52pm UTC](https://discuss.elastic.co/t/id-value-is-getting-changed-in-elastic/268905 "2021-04-12T17:52:45Z")
I have a unique\_id value in my index and that is also used as the document\_id, but as my document count is increasing drastically I had changed the type from double because that was causing truncation of my values. I cha… --- ## [Logstash fell under load](https://discuss.elastic.co/t/logstash-fell-under-load/269766)
**Author:** [@Andrey\_RF](https://discuss.elastic.co/u/Andrey_RF)\ **Replies:** 14\ **Last updated:** [April 12, 2021, 4:54pm UTC](https://discuss.elastic.co/t/logstash-fell-under-load/269766 "2021-04-12T16:54:31Z")
Hello. I have three clients. They send logs via filebeat to main server with logstash. A few days ago there are a lot of logs somewhere around 12 M in an amount. The logstash couldn't process all this logs and it fell. … --- ## [Visualizing Weighted Average Aggregation in Kibana](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901)
**Author:** [@connersexton](https://discuss.elastic.co/u/connersexton)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:55pm UTC](https://discuss.elastic.co/t/visualizing-weighted-average-aggregation-in-kibana/269901 "2021-04-12T15:55:42Z")
I've read a lot of documentation regarding single-value weighted average aggregation in Kibana, but can't seem to find anything on the actual application of this in a dashboard or visualization. My knowledge of Kibana sy… --- ## [Logstash with elasticsearch input](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783)
**Author:** [@Kfiro](https://discuss.elastic.co/u/Kfiro)\ **Replies:** 5\ **Last updated:** [April 12, 2021, 3:50pm UTC](https://discuss.elastic.co/t/logstash-with-elasticsearch-input/269783 "2021-04-12T15:50:41Z")
Hi Masters, I'm trying to use Logsash with "elasticsearch" input for taking specific events from winlogbeat Index and write them to another Index, I have a problem with the "query" on the input section, when I'm tryi… --- ## [RemoteTransportException cannot be cast to class org.elasticsearch.index.IndexNotFoundException after upgrade to 7.11.2 from 7.6.0](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121)
**Author:** [@Brady\_Davis](https://discuss.elastic.co/u/Brady_Davis)\ **Replies:** 4\ **Last updated:** [April 12, 2021, 3:46pm UTC](https://discuss.elastic.co/t/remotetransportexception-cannot-be-cast-to-class-org-elasticsearch-index-indexnotfoundexception-after-upgrade-to-7-11-2-from-7-6-0/268121 "2021-04-12T15:46:19Z")
Hello, We recently upgraded our elasticsearch stack to 7.11.2 from 7.6.0 and are seeing an issue when attempting PUTS on indexes that don't exist: "message": "failed to handle exception response \[org.elasticsearch.tran… --- ## [Logstash jdbc input plugin mongodb driver can not query time range](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879)
**Author:** [@john.zhang](https://discuss.elastic.co/u/john.zhang)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:43pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-mongodb-driver-can-not-query-time-range/269879 "2021-04-12T15:43:43Z")
Hi, Please help . I want to search records in mongodb during 3 days. this is my logstash conf: input { jdbc { jdbc\_driver\_class =\> "com.dbschema.MongoJdbcDriver" jdbc\_driver\_library =\> "/usr/share/logstash/logstas… --- ## [Дублирование документов](https://discuss.elastic.co/t/topic/269805)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 3:13pm UTC](https://discuss.elastic.co/t/topic/269805 "2021-04-12T15:13:35Z")
Добрый день. У нас Logstash забирает данные из стороннего ELK стека. Появилось "задваивание" данных на нашей стороне. На стороне первоистоника все данные уникальны. Грубо говоря вижу одинаковые документы, которые проду… --- ## [Перепарсинг существующих индексов Logstash](https://discuss.elastic.co/t/logstash/269025)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 11\ **Last updated:** [April 12, 2021, 2:58pm UTC](https://discuss.elastic.co/t/logstash/269025 "2021-04-12T14:58:48Z")
Как перепарсить через Logstash существующие индексы? У меня в Logstash приходили FileBeat какое-то время. Потом появилась задача выделять отдельные поля. Изменил конфиг, но применяется только ко вновь поступившим данным… --- ## [Is there any alternate way for connecting Elasticsearch from C++ code except ODBC?](https://discuss.elastic.co/t/is-there-any-alternate-way-for-connecting-elasticsearch-from-c-code-except-odbc/269837)
**Author:** [@onkark](https://discuss.elastic.co/u/onkark)\ **Replies:** 6\ **Last updated:** [April 12, 2021, 2:47pm UTC](https://discuss.elastic.co/t/is-there-any-alternate-way-for-connecting-elasticsearch-from-c-code-except-odbc/269837 "2021-04-12T14:47:06Z")
I tried fetching data of Elasticsearch from C++ code using Elasticsearch ODBC. As elasticsearch is known for its fast fetching speed, I'm not getting the expected performance using ODBC as compared to other RDBMS. So, ca… --- ## [Dropdown custom field aggregation](https://discuss.elastic.co/t/dropdown-custom-field-aggregation/269596)
**Author:** [@bilel\_meddeb](https://discuss.elastic.co/u/bilel_meddeb)\ **Replies:** 1\ **Last updated:** [April 12, 2021, 2:19pm UTC](https://discuss.elastic.co/t/dropdown-custom-field-aggregation/269596 "2021-04-12T14:19:51Z")
HELLO, i'm new in ELK i have table id | f1 | f2 | f3 0 | 10| 15| 2 1 | 30| 5 | 9 2 | 1 | 75| 6 i want to create a dropdown list. that list contain a multi choice (x1 x2 x3) if i choice x1 so the result should be … [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=981) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=983)