# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=995 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 996 --- ## [Split filebeat log with a variable length into several new events](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957)
**Author:** [@rmartinez.rv](https://discuss.elastic.co/u/rmartinez.rv)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 9:49pm UTC](https://discuss.elastic.co/t/split-filebeat-log-with-a-variable-length-into-several-new-events/268957 "2021-03-31T21:49:48Z")
Hi. I'm fairly new with ELK, and i been struggling a lot trying to make this work, with no luck, so i'm asking for a way to solve this... I'm using Filebeat to get logs into my elasticsearc server and, the line logs ar… --- ## [How to combine multi timelines in one vega graph using layers](https://discuss.elastic.co/t/how-to-combine-multi-timelines-in-one-vega-graph-using-layers/266932)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 9:30pm UTC](https://discuss.elastic.co/t/how-to-combine-multi-timelines-in-one-vega-graph-using-layers/266932 "2021-03-31T21:30:37Z")
hi experts, am trying to combine multi time lines Vega graphic to one but i'm stock, can anyone check my code, where i missed. { $schema: https://vega.github.io/schema/vega-lite/v2.json data: { url: { %con… --- ## [Logstash importing hostname incorrectly](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496)
**Author:** [@ASA01](https://discuss.elastic.co/u/ASA01)\ **Replies:** 6\ **Last updated:** [March 31, 2021, 9:02pm UTC](https://discuss.elastic.co/t/logstash-importing-hostname-incorrectly/268496 "2021-03-31T21:02:39Z")
Running across something I don't understand after building a new stack with the latest release of Logstash (7.11.1). It appears to be entering the hostname wrong or I understand it wrong. The system hostname is cmscd h… --- ## [Query\_string with fuzzy and stammer filter works wierd](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956)
**Author:** [@fedoroko](https://discuss.elastic.co/u/fedoroko)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 7:58pm UTC](https://discuss.elastic.co/t/query-string-with-fuzzy-and-stammer-filter-works-wierd/268956 "2021-03-31T19:58:31Z")
Found some strange thing with query\_string and stemmer/snowball filters, can't understand how does it work and how to fix this, help me, please. Analyzer and filter: 'analyzer' =\> \[ … --- ## [Console not listing exact match above partial match](https://discuss.elastic.co/t/console-not-listing-exact-match-above-partial-match/268401)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 7:12pm UTC](https://discuss.elastic.co/t/console-not-listing-exact-match-above-partial-match/268401 "2021-03-31T19:12:04Z")
Hello: Is there a way to configure kibana to list exact match first before partial match in console? I tried to delete indices with certain pattern (date time). for example: When I type "202101", I am getting a list … --- ## [Suricata -\> Filebeat -\> Elasticsearch](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 6:51pm UTC](https://discuss.elastic.co/t/suricata-filebeat-elasticsearch/268944 "2021-03-31T18:51:59Z")
Hi there! I´m implementing a IDS solution (suricata). I am sending logs via filebeat to a remote ELK server. What happens is that i´m not getting real-time searches. For instance, on the "Discovery" page an event that h… --- ## [Filter postgresql ERROR, FATAL, PANIC messages from postgresql logs](https://discuss.elastic.co/t/filter-postgresql-error-fatal-panic-messages-from-postgresql-logs/268843)
**Author:** [@elk\_newbie](https://discuss.elastic.co/u/elk_newbie)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 6:46pm UTC](https://discuss.elastic.co/t/filter-postgresql-error-fatal-panic-messages-from-postgresql-logs/268843 "2021-03-31T18:46:21Z")
Hi community, Is there any way to filter only ERROR, FATAL and PANIC messages from Postgresql logs? appreciate any help! Regards Patrick --- ## [Rally 2.1.0 released](https://discuss.elastic.co/t/rally-2-1-0-released/268943)
**Author:** [@Evgenia\_Badiyanova](https://discuss.elastic.co/u/Evgenia_Badiyanova)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 6:25pm UTC](https://discuss.elastic.co/t/rally-2-1-0-released/268943 "2021-03-31T18:25:50Z")
We have just released Rally 2.1.0. This is a bug fix release but also adds quite a few enhancements. Here are some highlights: We added support for search\_after and point-in-time. There are new track operations: open-p… --- ## [Time in logstash is getting different due to daylight saving time](https://discuss.elastic.co/t/time-in-logstash-is-getting-different-due-to-daylight-saving-time/268934)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 5:35pm UTC](https://discuss.elastic.co/t/time-in-logstash-is-getting-different-due-to-daylight-saving-time/268934 "2021-03-31T17:35:16Z")
Hi i am using ruby code in logstash as below and getting the time one hour less. ruby { code =\> "event.set('current\_window\_end', Time.now());" } if current time is 10 :00 (in London) getting the time as 9:00. i have … --- ## [How to embed visualization into my app](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591)
**Author:** [@whitediver](https://discuss.elastic.co/u/whitediver)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 4:48pm UTC](https://discuss.elastic.co/t/how-to-embed-visualization-into-my-app/268591 "2021-03-31T16:48:04Z")
Since the embedVisualizationWithId was removed from the Kibana, I have no way to embed visualization into my Kibana app. Does anybody know what I should use instead? --- ## [Using ILP with rollup](https://discuss.elastic.co/t/using-ilp-with-rollup/267204)
**Author:** [@vishal\_ramanlal](https://discuss.elastic.co/u/vishal_ramanlal)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 4:21pm UTC](https://discuss.elastic.co/t/using-ilp-with-rollup/267204 "2021-03-31T16:21:57Z")
I am trying to configure Kibana to use a rollup to parse and simplify apache James data. I can currently push data to an index which sets the data according to a template. I can also use rollup to get and simplify the da… --- ## [Vega Visualizations in Kibana: 400 error setting default pattern](https://discuss.elastic.co/t/vega-visualizations-in-kibana-400-error-setting-default-pattern/268808)
**Author:** [@jonahzirkle](https://discuss.elastic.co/u/jonahzirkle)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 4:20pm UTC](https://discuss.elastic.co/t/vega-visualizations-in-kibana-400-error-setting-default-pattern/268808 "2021-03-31T16:20:55Z")
Class/lab has me create index patterns; which works fine. I cannot proceed to the next step of going to Discover w/o setting a default pattern. When I click the start, for either pattern, a 400 error is throw w/an exce… --- ## [Discover JSON missing \_source field](https://discuss.elastic.co/t/discover-json-missing-source-field/268922)
**Author:** [@frebri](https://discuss.elastic.co/u/frebri)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 4:01pm UTC](https://discuss.elastic.co/t/discover-json-missing-source-field/268922 "2021-03-31T16:01:47Z")
Hi, We reinstalled Kibana and Elastic with 7.12 and are accustomed to look at certain documents through just pure json, since it has a specific order and grouping. After the upgrade, the JSON tab seems to "pretty print"… --- ## [Preventing specific events from being indexed](https://discuss.elastic.co/t/preventing-specific-events-from-being-indexed/268522)
**Author:** [@tsmori](https://discuss.elastic.co/u/tsmori)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 3:48pm UTC](https://discuss.elastic.co/t/preventing-specific-events-from-being-indexed/268522 "2021-03-31T15:48:30Z")
Is there a way to prevent specific events from being indexed? I don't mean specific fields, but conditionals for a field. For example, we're ingesting netflow traffic data and I want to exclude all events that have both… --- ## [Tabelle in Vega](https://discuss.elastic.co/t/tabelle-in-vega/268793)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 3:35pm UTC](https://discuss.elastic.co/t/tabelle-in-vega/268793 "2021-03-31T15:35:36Z")
hello guys, I have a requirement, looks like this scenario, from a CSV file 5 columns are imported into kibana and the expected visualization of it data is to create kind of table Visia.. where the values of the fields… --- ## [Logstash Kafka input : conditonnal consuming?](https://discuss.elastic.co/t/logstash-kafka-input-conditonnal-consuming/268664)
**Author:** [@Travis](https://discuss.elastic.co/u/Travis)\ **Replies:** 12\ **Last updated:** [March 31, 2021, 3:27pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-conditonnal-consuming/268664 "2021-03-31T15:27:08Z")
Hello ! I have multiple firewall log sources. All these sources push the logs in a dedicated topic named "firewall". In logstash, I would like to have a different pipeline for each of these sources to apply different p… --- ## [Kibana change of decimal values in colour](https://discuss.elastic.co/t/kibana-change-of-decimal-values-in-colour/266327)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [March 31, 2021, 3:12pm UTC](https://discuss.elastic.co/t/kibana-change-of-decimal-values-in-colour/266327 "2021-03-31T15:12:08Z")
Hi all, I'm a float numeric field which i have values like 21.283774493. I have managed to limit to 2 digits like 21.28. Now the problem is when i use conditional colour for my number in edit field option, format goes… --- ## [Kibana (7.11.1) isn't showing logs](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399)
**Author:** [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\ **Replies:** 13\ **Last updated:** [March 31, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399 "2021-03-31T15:11:44Z")
Hi, I have an index, that is containing log data, but the data can't be seen under Observability -\> Logs. I have also created an index pattern and choose a time field. I adjusted the settings of Observability -\> Logs t… --- ## [Could not dynamically add mapping for field \[stats.something.else\]. Existing mapping for \[stats.something\] must be of type object but found \[long\]](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919)
**Author:** [@szabgab](https://discuss.elastic.co/u/szabgab)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 2:48pm UTC](https://discuss.elastic.co/t/could-not-dynamically-add-mapping-for-field-stats-something-else-existing-mapping-for-stats-something-must-be-of-type-object-but-found-long/268919 "2021-03-31T14:48:44Z")
The problem seems to be that we have both a field called stats.something and another field called stats.something.else. I get the above error when I try to submit the second piece of data. I could replace each dot with … --- ## [Heatmap with custom space](https://discuss.elastic.co/t/heatmap-with-custom-space/268902)
**Author:** [@Eddie\_Adams](https://discuss.elastic.co/u/Eddie_Adams)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 2:42pm UTC](https://discuss.elastic.co/t/heatmap-with-custom-space/268902 "2021-03-31T14:42:54Z")
{"timestamp": "2021-03-31T14:07:50.465", "key": "h", "code": "4", "type": "\[down\]"} {"timestamp": "2021-03-31T14:07:50.592", "key": "e", "code": "14", "type": "\[down\]"} {"timestamp": "2021-03-31T14:07:50.697", "key": "… --- ## [Best approach to apply Fine Grained Access Control to index documents](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817)
**Author:** [@grugna](https://discuss.elastic.co/u/grugna)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 1:31pm UTC](https://discuss.elastic.co/t/best-approach-to-apply-fine-grained-access-control-to-index-documents/268817 "2021-03-31T13:31:55Z")
I have a service that apply fine grained access control to ES index document and I am facing some ES limitation / performance issue. For this reason I am not sure if my approach is correct, of if there is a better way to… --- ## [I wrote a book with practical Elasticsearch examples](https://discuss.elastic.co/t/i-wrote-a-book-with-practical-elasticsearch-examples/268910)
**Author:** [@JoeSorocin](https://discuss.elastic.co/u/JoeSorocin)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 1:09pm UTC](https://discuss.elastic.co/t/i-wrote-a-book-with-practical-elasticsearch-examples/268910 "2021-03-31T13:09:16Z")
Hey guys! After hundreds of hours spent on answering questions on Stackoverflow, I observed a few barriers of entry that ES newbies struggle with. It's first and foremost the formidable query language. Now, most of us … --- ## [Bucket Path to access Top-hits aggregation in elasticsearch query](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904)
**Author:** [@Dhruvil\_Doshi](https://discuss.elastic.co/u/Dhruvil_Doshi)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 12:34pm UTC](https://discuss.elastic.co/t/bucket-path-to-access-top-hits-aggregation-in-elasticsearch-query/268904 "2021-03-31T12:34:27Z")
Hello, I have an index "jmx\_metrics-\*" that contains JVM monitoring data from Jconsole. Following it the mapping of index. { "jmx\_metrics-2021.03" : { "aliases" : { }, "mappings" : { "properties" : { … --- ## [ElasticSearch performance trouble when indexing data](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745)
**Author:** [@nicolaipre](https://discuss.elastic.co/u/nicolaipre)\ **Replies:** 10\ **Last updated:** [March 31, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-performance-trouble-when-indexing-data/268745 "2021-03-31T11:01:41Z")
Hi. I have about 4 TB of data I want to index in Elasticsearch. The amount of data per index will vary, depending on the source data file. These are only static files containing old data that will be ingested and made s… --- ## [Search multiple values for a single field](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327)
**Author:** [@subham\_p](https://discuss.elastic.co/u/subham_p)\ **Replies:** 12\ **Last updated:** [March 31, 2021, 11:52am UTC](https://discuss.elastic.co/t/search-multiple-values-for-a-single-field/268327 "2021-03-31T11:52:42Z")
Hii.. All , I am pretty new in elk search, I want to find out multiple values for a single field (diseases:” fever,covid\_19”) with in a must with wildcard condition here the data is like this Diseases: “fever, headache… --- ## [Date Range Not Working with Now](https://discuss.elastic.co/t/date-range-not-working-with-now/268825)
**Author:** [@rohan\_5894](https://discuss.elastic.co/u/rohan_5894)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 11:50am UTC](https://discuss.elastic.co/t/date-range-not-working-with-now/268825 "2021-03-31T11:50:38Z")
I am trying to show only those documents where published\_at date is less than now-7d/d. #It seems ES is not working correctly here. I tried with an example of showing documents which are having published\_at filed greater… --- ## [Install elasticsearch on apache](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875)
**Author:** [@alexkr](https://discuss.elastic.co/u/alexkr)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 10:40am UTC](https://discuss.elastic.co/t/install-elasticsearch-on-apache/268875 "2021-03-31T10:40:30Z")
Hey I try to install elasticsearch on my centos 7 but all the installation guide are using ngxin and I need to install it on apache server. Someone did it and please can send me how to do it? --- ## [Exact phrase near other terms](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893)
**Author:** [@rd8388](https://discuss.elastic.co/u/rd8388)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 10:20am UTC](https://discuss.elastic.co/t/exact-phrase-near-other-terms/268893 "2021-03-31T10:20:34Z")
Is there a way to search for one or more exact phrases near one or more other terms/phrases? I'm using MatchPhrase with slop zero to find exact phrases fine and using Match to find two or more terms near each other but … --- ## [Elasticsearch or Kibana How to merge two \_id data](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887)
**Author:** [@Ivan\_chen](https://discuss.elastic.co/u/Ivan_chen)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-or-kibana-how-to-merge-two-id-data/268887 "2021-03-31T09:21:35Z")
Hi I use metricbeat redis moduls My data have two event.dataset in one index I want merge data , Show on kibana data table 1.redis.info Host version 127.0.0.1 5.0.8 127.0.0.2 3.2.0 127.0.0.3 5.0.8 2.re… --- ## [Shrink unable to allocate index due to initial\_recovery setting](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813)
**Author:** [@toby\_jn](https://discuss.elastic.co/u/toby_jn)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 9:38am UTC](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813 "2021-03-31T09:38:43Z")
We ran into a very strange issue with index shrink following recovery from a complete cluster network outage. The outage appears to have taken place in the middle of a shrink operation and following the restart the shrin… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=994) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=996)