# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=985 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 986 --- ## [Deleting a space-agnostic exception container](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640)
**Author:** [@gplourde](https://discuss.elastic.co/u/gplourde)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 12:27pm UTC](https://discuss.elastic.co/t/deleting-a-space-agnostic-exception-container/269640 "2021-04-09T12:27:07Z")
How do you delete an exception container that is space agnostic? "namespace\_type": "agnostic" If I try to delete it using the Exceptions API I get an error stating the list does not exist. { "message": "exce… --- ## [Parsing variable multiline text from event log](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450)
**Author:** [@SimonR](https://discuss.elastic.co/u/SimonR)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 11:35am UTC](https://discuss.elastic.co/t/parsing-variable-multiline-text-from-event-log/269450 "2021-04-09T11:35:13Z")
Hi Logstash experts. Im having big issues parsing MSSQL logs from the Windows event log, and i hope someone can assist. MSSQL logs event id 33205 to Windows event log, in a somewhat structured format, except the "State… --- ## [Formatted values in logstash are not displayed](https://discuss.elastic.co/t/formatted-values-in-logstash-are-not-displayed/268974)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 3\ **Last updated:** [April 9, 2021, 11:43am UTC](https://discuss.elastic.co/t/formatted-values-in-logstash-are-not-displayed/268974 "2021-04-09T11:43:54Z")
Formatted values in logstash are not displayed. want to I would like to split the log collected by logstash and get it by dissect, and check each in a different field in Kibana. issue However, the variable name o… --- ## [Problems with latest elasticsearch-ruby search using point in time](https://discuss.elastic.co/t/problems-with-latest-elasticsearch-ruby-search-using-point-in-time/269646)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 11:28am UTC](https://discuss.elastic.co/t/problems-with-latest-elasticsearch-ruby-search-using-point-in-time/269646 "2021-04-09T11:28:42Z")
Hey folks, \< EDITED -- PROBLEM SOLVED -- SEE REPLY BELOW \> I'm trying to use the elasticsearch-ruby and elasticsearch-xpack Ruby gems to search using the new point in time interface now that the scrolling API has been … --- ## [Calculation of Average](https://discuss.elastic.co/t/calculation-of-average/269325)
**Author:** [@vivekshukla](https://discuss.elastic.co/u/vivekshukla)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 11:23am UTC](https://discuss.elastic.co/t/calculation-of-average/269325 "2021-04-09T11:23:36Z")
Hi Team, I am using Metric Bar to find the average time for below scenario: Need to find Average time = Sum of Duration / Sum( Number of Attempts) Provided Aggregation are not helpful in Metric Bar for above calcula… --- ## [Multiple pipelines](https://discuss.elastic.co/t/multiple-pipelines/269689)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/multiple-pipelines/269689 "2021-04-09T09:15:29Z")
hi everyone I have multiple sources so I want to parse them with logstash , so if that need multiple pipelines or just a pipeline is enough , in my case I have multiple source ( filebeats , winlogbeats and syslog server… --- ## [Plot a line with different colours for evening than for morning](https://discuss.elastic.co/t/plot-a-line-with-different-colours-for-evening-than-for-morning/269687)
**Author:** [@Facu](https://discuss.elastic.co/u/Facu)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 8:57am UTC](https://discuss.elastic.co/t/plot-a-line-with-different-colours-for-evening-than-for-morning/269687 "2021-04-09T08:57:38Z")
Hi All! Would it be possible to plot a line, or two lines, which will change the color depending on the time of the day I am plotting. Like grey in the afternoon and red in the morning using Timelion ? I'm doing someth… --- ## [How to add additional value in bucket aggregation?](https://discuss.elastic.co/t/how-to-add-additional-value-in-bucket-aggregation/269666)
**Author:** [@zeusfsx](https://discuss.elastic.co/u/zeusfsx)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 8:56am UTC](https://discuss.elastic.co/t/how-to-add-additional-value-in-bucket-aggregation/269666 "2021-04-09T08:56:29Z")
Hi, I have documents in the index with the field sentimental\_keywords: sentimental\_keywords: \[ { rate: 0.2857143, keyword: "manager" }, ... { rate: -0.333333343, keyword: "project" }, \] When I do terms … --- ## [Update by query](https://discuss.elastic.co/t/update-by-query/269674)
**Author:** [@yen\_l\_ng\_th](https://discuss.elastic.co/u/yen_l_ng_th)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 8:34am UTC](https://discuss.elastic.co/t/update-by-query/269674 "2021-04-09T08:34:54Z")
create by bluk, after update by quey =\> update run but not updated Timeout is 2m =\> not updated Can you help me? I using php client --- ## [Elasticsearch](https://discuss.elastic.co/t/elasticsearch/269615)
**Author:** [@dddddddddddddddd](https://discuss.elastic.co/u/dddddddddddddddd)\ **Replies:** 7\ **Last updated:** [April 9, 2021, 8:23am UTC](https://discuss.elastic.co/t/elasticsearch/269615 "2021-04-09T08:23:09Z")
hi good day eveyone , why do we need 3 nodes in elasticsearch cluster for guarantee the high availibility and disaster recovery --- ## [Parsing date format](https://discuss.elastic.co/t/parsing-date-format/269488)
**Author:** [@tkkchan](https://discuss.elastic.co/u/tkkchan)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 8:15am UTC](https://discuss.elastic.co/t/parsing-date-format/269488 "2021-04-09T08:15:46Z")
Dear All, I am currently learning how to parse data with logstash and pass them to Logstash. Right now I am confused on how to parse date correctly, as you can see, I have a timestamp with the format yyyy/MM/dd HH:mm:s… --- ## [Kibana not compressing HTTP responses](https://discuss.elastic.co/t/kibana-not-compressing-http-responses/266989)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 4\ **Last updated:** [April 9, 2021, 7:46am UTC](https://discuss.elastic.co/t/kibana-not-compressing-http-responses/266989 "2021-04-09T07:46:41Z")
Recently I've updated to Kibana 7.11.1 and I've noticed slow performance specially in Discover when many documents are returned. After some investigation I've noticed that Kibana is no longer compressing the response of… --- ## [Traiter des sous champs comme des logs à part entier à ingérer](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771)
**Author:** [@Yahya\_Bouzoubaa](https://discuss.elastic.co/u/Yahya_Bouzoubaa)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 7:17am UTC](https://discuss.elastic.co/t/traiter-des-sous-champs-comme-des-logs-a-part-entier-a-ingerer/268771 "2021-04-09T07:17:29Z")
Bonjour, Je souhaite parser un log et parser aussi un sous log (qui est un champ du log parent) et les ingérer dans deux logs différents. Est ce que c'est possible et si oui quelle méthode ou script faudrait utiliser. … --- ## [ECE Admin Console mapping changed after moving to other zone](https://discuss.elastic.co/t/ece-admin-console-mapping-changed-after-moving-to-other-zone/269667)
**Author:** [@bargarfj01](https://discuss.elastic.co/u/bargarfj01)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 6:59am UTC](https://discuss.elastic.co/t/ece-admin-console-mapping-changed-after-moving-to-other-zone/269667 "2021-04-09T06:59:36Z")
Hi, I have been recently working on DR of Admin Console and making it Highly Available. As a result, of moving between zones, its mapping has been changed and I am getting error: Text fields are not optimised for oper… --- ## [ECE Disk full after creating searchable snapshot](https://discuss.elastic.co/t/ece-disk-full-after-creating-searchable-snapshot/269160)
**Author:** [@bargarfj01](https://discuss.elastic.co/u/bargarfj01)\ **Replies:** 1\ **Last updated:** [April 9, 2021, 6:33am UTC](https://discuss.elastic.co/t/ece-disk-full-after-creating-searchable-snapshot/269160 "2021-04-09T06:33:29Z")
My private Cloud ECE storage had approx. 10% of the storage left so I decided to configure and move the oldest indices to searchable snapshot repo on s3. After setting everything up I've noticed that nothing was created… --- ## [Filebeat stopped после eof, при close\_eof: false](https://discuss.elastic.co/t/filebeat-stopped-eof-close-eof-false/269660)
**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\ **Replies:** 0\ **Last updated:** [April 9, 2021, 5:28am UTC](https://discuss.elastic.co/t/filebeat-stopped-eof-close-eof-false/269660 "2021-04-09T05:28:24Z")
Доброго дня! Проблема такая - файлбит (релизы 7.12 и 7.11.2) разворачиваю демонсетом в кластер k8s openshift, рантайм cri, логи контейнеров забираются из примонтированной директории, после запуска с десяток секунд всё ок… --- ## [ECK kibana dashboard show no result](https://discuss.elastic.co/t/eck-kibana-dashboard-show-no-result/269544)
**Author:** [@cuongnp](https://discuss.elastic.co/u/cuongnp)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 3:13am UTC](https://discuss.elastic.co/t/eck-kibana-dashboard-show-no-result/269544 "2021-04-09T03:13:37Z")
Hi all, I have ECK operator installed on openshift. There are 2 indexes for metricbeat and filebeat. The discover tab still has document but there is no data in dashboard tab. I tried to delete old index and restart elas… --- ## [Not able to add host name to metric filter plugin output](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 8\ **Last updated:** [April 9, 2021, 2:42am UTC](https://discuss.elastic.co/t/not-able-to-add-host-name-to-metric-filter-plugin-output/269554 "2021-04-09T02:42:41Z")
Hi, I wanted to see how rate at which the clients were sending logs to logstash. I wanted to use the metric filter plugin. And it is working. Except one thing. Here is the conf: input { http { … --- ## [Cost more time than normally](https://discuss.elastic.co/t/cost-more-time-than-normally/269576)
**Author:** [@panla](https://discuss.elastic.co/u/panla)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 2:25am UTC](https://discuss.elastic.co/t/cost-more-time-than-normally/269576 "2021-04-09T02:25:03Z")
question restart after a while will cost more time than normally. how to solve it? --- ## [How to partially delete an index](https://discuss.elastic.co/t/how-to-partially-delete-an-index/269317)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 13\ **Last updated:** [April 9, 2021, 2:16am UTC](https://discuss.elastic.co/t/how-to-partially-delete-an-index/269317 "2021-04-09T02:16:11Z")
How can I delete only the records that meet the criteria of the index registered in elasticsearch? I don't want to delete the entire index. In other words, not the following instruction. curl -XDELETE localhost:9200/i… --- ## [Geo-Point Mapping](https://discuss.elastic.co/t/geo-point-mapping/269504)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 22\ **Last updated:** [April 9, 2021, 2:01am UTC](https://discuss.elastic.co/t/geo-point-mapping/269504 "2021-04-09T02:01:51Z")
mutate { add\_field =\> { "location" =\> \["%{\[location\_lat\]}","%{\[location\_lon\]}"\] } } This is my mutate field in my conf file to create my geopoint mapping of the location\_lat and location\_lon value in the… --- ## [Elasticsearch response alway return total hits is 0?](https://discuss.elastic.co/t/elasticsearch-response-alway-return-total-hits-is-0/269603)
**Author:** [@NinhNM](https://discuss.elastic.co/u/NinhNM)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 2:00am UTC](https://discuss.elastic.co/t/elasticsearch-response-alway-return-total-hits-is-0/269603 "2021-04-09T02:00:22Z")
I have use ELS 7.11. I make single query with multiple conditions Query: { "bool" : { "filter" : \[ { "term" : { "loa" : { "value" : "2", "boost" : 1.0 }… --- ## [How to combine default BM25 score of Elasticsearch and Dense Vectors similarity](https://discuss.elastic.co/t/how-to-combine-default-bm25-score-of-elasticsearch-and-dense-vectors-similarity/269614)
**Author:** [@xiaoma](https://discuss.elastic.co/u/xiaoma)\ **Replies:** 2\ **Last updated:** [April 9, 2021, 1:11am UTC](https://discuss.elastic.co/t/how-to-combine-default-bm25-score-of-elasticsearch-and-dense-vectors-similarity/269614 "2021-04-09T01:11:57Z")
i found a issue about how to combine the both default bm25 and vectors, but i try it and found the result was poor, is there any official document about how to combine default BM25 score of Elasticsearch and Dense Vect… --- ## [Collect multiple line in stdin](https://discuss.elastic.co/t/collect-multiple-line-in-stdin/269647)
**Author:** [@elk\_newbie](https://discuss.elastic.co/u/elk_newbie)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 11:46pm UTC](https://discuss.elastic.co/t/collect-multiple-line-in-stdin/269647 "2021-04-08T23:46:34Z")
Hi, Is it possible to read multiple lines at once? The first line indicates the error. I would like to log the statement that causes the error. \< 2021-04-07 10:19:18.883 CEST db dbuser App 37386 \> ERROR: operator… --- ## [Duplicate data Logstash](https://discuss.elastic.co/t/duplicate-data-logstash/269635)
**Author:** [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 9:13pm UTC](https://discuss.elastic.co/t/duplicate-data-logstash/269635 "2021-04-08T21:13:53Z")
Hi, guy's i need your help, please with this... I have a problem with the indexing of data from logstash to elastic, I have two pipelines and when I run the service I duplicate the data from one pipeline to the other, … --- ## [What is this red dot in index data?](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 10\ **Last updated:** [April 8, 2021, 8:54pm UTC](https://discuss.elastic.co/t/what-is-this-red-dot-in-index-data/269612 "2021-04-08T20:54:15Z")
Hi I'm seeing this red dot appear in my index data as shown below: This has also been reported by other people here in the discuss section of elasticsearch. See: Here And here In both cases there was nothing rea… --- ## [Lab 2 Assistance (Observability Fundamentals)](https://discuss.elastic.co/t/lab-2-assistance-observability-fundamentals/268958)
**Author:** [@jasieltego](https://discuss.elastic.co/u/jasieltego)\ **Replies:** 4\ **Last updated:** [April 8, 2021, 7:29pm UTC](https://discuss.elastic.co/t/lab-2-assistance-observability-fundamentals/268958 "2021-04-08T19:29:36Z")
I'm stuck at this step, not to much detail is shown to accomplish this. Now, edit filebeat.yml to configure Filebeat to output to your Elastic Cloud deployment. Insert the following two lines at the end of the config fi… --- ## [\[Kibana Enhanced Table\] Cell line / separator](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072)
**Author:** [@uusername](https://discuss.elastic.co/u/uusername)\ **Replies:** 7\ **Last updated:** [April 8, 2021, 7:20pm UTC](https://discuss.elastic.co/t/kibana-enhanced-table-cell-line-separator/267072 "2021-04-08T19:20:32Z")
Hi @fbaligand, I'm very thank you for creating Kibana Enhanced Table Plugin. Can I know if there is a way to achieve to draw the table cell line / separator in this plugin? --- ## [Questions re Sniffing in Logstash elasticsearch output](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [April 8, 2021, 6:59pm UTC](https://discuss.elastic.co/t/questions-re-sniffing-in-logstash-elasticsearch-output/269631 "2021-04-08T18:59:47Z")
I'm testing Logstash sniffing in our environment for the Elasticsearch output. So far, it appears to resolve a few issues I've had, but I've got a few questions: sniffing =\> true in my elasticsearch output appears to … --- ## [Logstash Parser error - tried to parse field as object, but found a concrete value](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 13\ **Last updated:** [April 8, 2021, 6:42pm UTC](https://discuss.elastic.co/t/logstash-parser-error-tried-to-parse-field-as-object-but-found-a-concrete-value/269140 "2021-04-08T18:42:57Z")
Hi, I am trying to parse a log but i have this error. \[source\] tried to parse field \[source\] as object, but found a concrete value if "string" in \[tags\] { grok { match =\> \[ "message", "(?\