# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=996 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 997 --- ## [Shrink unable to allocate index due to initial\_recovery setting](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813)
**Author:** [@toby\_jn](https://discuss.elastic.co/u/toby_jn)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 9:38am UTC](https://discuss.elastic.co/t/shrink-unable-to-allocate-index-due-to-initial-recovery-setting/268813 "2021-03-31T09:38:43Z")
We ran into a very strange issue with index shrink following recovery from a complete cluster network outage. The outage appears to have taken place in the middle of a shrink operation and following the restart the shrin… --- ## [Trying to build a table visualization with multiple aggregations](https://discuss.elastic.co/t/trying-to-build-a-table-visualization-with-multiple-aggregations/268288)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 9:28am UTC](https://discuss.elastic.co/t/trying-to-build-a-table-visualization-with-multiple-aggregations/268288 "2021-03-31T09:28:18Z")
I want to build a table of alerts from and IDS where the rows are keyed on a term (alert name) then in the first column, the second column I want the alert category then I want then number of unique src IP addresses and … --- ## [Issue with query\_string query](https://discuss.elastic.co/t/issue-with-query-string-query/268889)
**Author:** [@arthur\_th](https://discuss.elastic.co/u/arthur_th)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 9:28am UTC](https://discuss.elastic.co/t/issue-with-query-string-query/268889 "2021-03-31T09:28:17Z")
Hello, I am new to the Elastic stack, I want to do a specific search and it doesn't seem to work. I want to search for a regex respecting word order. For example this would be a query with query\_string: '(/Cytochrome\[… --- ## [Multi tenant cluster architecture](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:15am UTC](https://discuss.elastic.co/t/multi-tenant-cluster-architecture/268841 "2021-03-31T06:15:22Z")
How would you design a multi tenant cluster in eladtic 7.12? Should support 5000 tenants . Some have less than 100mb of data and some 150 gb or more. I thought of having shared datastream for the small ones, and dedicat… --- ## [How to assign one value to another](https://discuss.elastic.co/t/how-to-assign-one-value-to-another/268824)
**Author:** [@Pallavibhushan](https://discuss.elastic.co/u/Pallavibhushan)\ **Replies:** 5\ **Last updated:** [March 31, 2021, 8:52am UTC](https://discuss.elastic.co/t/how-to-assign-one-value-to-another/268824 "2021-03-31T08:52:13Z")
Hi , I am new to logstash I have below data in JSON. "attributes": \[ { "name": "test1", "value": "test1\_value" }, { "name": "test2", "value": "test2\_value" } \] I want this data in below format : "attributes": … --- ## [Script query - iterating through nested docs](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877)
**Author:** [@bruno\_v](https://discuss.elastic.co/u/bruno_v)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 8:20am UTC](https://discuss.elastic.co/t/script-query-iterating-through-nested-docs/268877 "2021-03-31T08:20:14Z")
I have the following nested property in my mapping: "books": { "type": "nested", "properties": { "book\_id": { "type": "keyword" }, "book\_name": { "type": "keyword" } … --- ## [How get object in script in aggregations](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082)
**Author:** [@Marina\_S](https://discuss.elastic.co/u/Marina_S)\ **Replies:** 2\ **Last updated:** [March 23, 2021, 12:26pm UTC](https://discuss.elastic.co/t/how-get-object-in-script-in-aggregations/268082 "2021-03-23T12:26:31Z")
I have this object which have ArrayList wirh objects "sizeData" : { "id" : 1, "elasticSizeScale" : { "id" : 3, "sizes" : \[ { "id" : 321, … --- ## [Elasticsearch giving query\_shard\_exception for query\_string](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 8:01am UTC](https://discuss.elastic.co/t/elasticsearch-giving-query-shard-exception-for-query-string/268556 "2021-03-31T08:01:47Z")
I am storing URL in the elastic search and I making the following request to get a result for elastic search: { "query\_string": { "query": "\*http://localhost:8000/v3/a… --- ## [Index template creation: can we parameterize the shards and replica](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811)
**Author:** [@raja\_augstin](https://discuss.elastic.co/u/raja_augstin)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 7:36am UTC](https://discuss.elastic.co/t/index-template-creation-can-we-parameterize-the-shards-and-replica/268811 "2021-03-31T07:36:04Z")
can't we parameterize index shards and replicas in index template. { "index\_template\_1": { "index\_patterns": \[ "\*" \], "settings": { "index": { "analysis": { "analyzer": { "index\_edgeNGram\_analyzer": { "filter"… --- ## [Wont be able to generate .csv file](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798)
**Author:** [@Kaustubh20](https://discuss.elastic.co/u/Kaustubh20)\ **Replies:** 4\ **Last updated:** [March 31, 2021, 7:01am UTC](https://discuss.elastic.co/t/wont-be-able-to-generate-csv-file/268798 "2021-03-31T07:01:42Z")
Hi , i am using kibana version 6.4 and Wont be able to generate .csv file. sometimes it work automatically and sometimes not. It showing me error that field format is not a constructor. Please suggest me --- ## [Indexing performance degraded in Elasticsearch 7.10](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938)
**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 6:28am UTC](https://discuss.elastic.co/t/indexing-performance-degraded-in-elasticsearch-7-10/267938 "2021-03-31T06:28:01Z")
Hi, As per the blog below, there is considerable improvement made in Elasticsearch 7.10 in data storage needs. https://www.elastic.co/blog/save-space-and-money-with-improved-storage-efficiency-in-elasticsearch-7-10. I… --- ## [How to increase the number of filebeat servers in stages](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853)
**Author:** [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\ **Replies:** 8\ **Last updated:** [March 31, 2021, 3:44am UTC](https://discuss.elastic.co/t/how-to-increase-the-number-of-filebeat-servers-in-stages/268853 "2021-03-31T03:44:45Z")
We are currently trying to increase the number of servers we log using filebeat and logstash in stages. Filebeat can be installed on a new logging server, and logstash can send logs to the installed server. logstash is… --- ## [For an I/O block on a machine in the ES cluster, how can I set it so that ES returns a 504 timeout and then tries to poll the node to retry](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857)
**Author:** [@serug](https://discuss.elastic.co/u/serug)\ **Replies:** 0\ **Last updated:** [March 31, 2021, 2:59am UTC](https://discuss.elastic.co/t/for-an-i-o-block-on-a-machine-in-the-es-cluster-how-can-i-set-it-so-that-es-returns-a-504-timeout-and-then-tries-to-poll-the-node-to-retry/268857 "2021-03-31T02:59:28Z")
I have a question to ask . The scenario is that one of the machines in my ES(6.7) cluster is blocked by I/O, which causes the ES request to be blocked as well, thus causing the thread pool resource depletion. I would li… --- ## [Attaching a drill down to a table panel](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [March 31, 2021, 1:50am UTC](https://discuss.elastic.co/t/attaching-a-drill-down-to-a-table-panel/268691 "2021-03-31T01:50:52Z")
Kibana 7 I have a table visualisation with with a total column and two Unique counts. I now want to be able to drill down into the cells to see a further level of detail for each of those cells. Signature … --- ## [User system Kibana](https://discuss.elastic.co/t/user-system-kibana/268747)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:16am UTC](https://discuss.elastic.co/t/user-system-kibana/268747 "2021-03-31T01:16:48Z")
Is it the system in Kibana that runs the service has a system user: kibana? --- ## [Track user logged into Kibana and track their activities](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 1:14am UTC](https://discuss.elastic.co/t/track-user-logged-into-kibana-and-track-their-activities/268779 "2021-03-31T01:14:28Z")
Hi All, For the monitoring purpose, we need to do the analysis on below two points in Kibana Which all users logged in to Kibana What all activities they performed/which all query they executed. Can somebody please h… --- ## [How to set @timestamp in Filebeat?](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804)
**Author:** [@fzyzcjy](https://discuss.elastic.co/u/fzyzcjy)\ **Replies:** 1\ **Last updated:** [March 31, 2021, 12:14am UTC](https://discuss.elastic.co/t/how-to-set-timestamp-in-filebeat/268804 "2021-03-31T00:14:06Z")
Hi thanks for the wonderful elastic stack! I need to set @timestamp in Filebeat. I have seen this and this. But they seems to be outdated and no updates :frowning: --- ## [How to break long condition in logstash config](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 10:34pm UTC](https://discuss.elastic.co/t/how-to-break-long-condition-in-logstash-config/268709 "2021-03-30T22:34:11Z")
I have a filter section that removes a field if the event matches with regex. So my if condition is very long. if \[type\] == "something" { if \[displayName\] =~ /(\[M-m\]as|MAS)\[\\d\]\*/ or \[displayName\] =~ /(\[E-e\]lk|ELK)/ … --- ## [Logstash doesn't log to elastic](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 5\ **Last updated:** [March 30, 2021, 9:43pm UTC](https://discuss.elastic.co/t/logstash-doesnt-log-to-elastic/268025 "2021-03-30T21:43:02Z")
I've been trying to troubleshoot this for quite some time and have managed to find out the following: filebeat logs everything seemingly fine turning on logstash after deleting the indexes i'm logging to SEEMINGLY wor… --- ## [Kibana showing different Packetbeat data](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834)
**Author:** [@Claudio\_Ract\_Costa](https://discuss.elastic.co/u/Claudio_Ract_Costa)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 8:16pm UTC](https://discuss.elastic.co/t/kibana-showing-different-packetbeat-data/268834 "2021-03-30T20:16:50Z")
Hi Guys, I have two version of Elasticsearch x Kibana (Version 7.6 and version 7.12) When i am analysing data in Kibana, using Discover, the information is showed in different ways for each ES/Kibana version. Example: … --- ## [Поиск по полю message](https://discuss.elastic.co/t/message/268757)
**Author:** [@frostwar](https://discuss.elastic.co/u/frostwar)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 8:06pm UTC](https://discuss.elastic.co/t/message/268757 "2021-03-30T20:06:13Z")
При загрузке нового индекса через Logstash перестали видиться настройки поля message Mapping у поля есть Куда копать не пойму... --- ## [Kibana Alert API not handling float value correcly](https://discuss.elastic.co/t/kibana-alert-api-not-handling-float-value-correcly/268141)
**Author:** [@leela\_kumili](https://discuss.elastic.co/u/leela_kumili)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 7:19pm UTC](https://discuss.elastic.co/t/kibana-alert-api-not-handling-float-value-correcly/268141 "2021-03-30T19:19:44Z")
I have created a monitor in Kibana using ES query Blockquote { "size": 0, "aggregations": { "byType": { "terms": { "field": "type.keyword", "size": 10, "min\_doc\_count": 1, "shard\_min\_doc\_count": 0, "show\_term… --- ## [Username and password do not work on a shared dashboard](https://discuss.elastic.co/t/username-and-password-do-not-work-on-a-shared-dashboard/268832)
**Author:** [@AlfredoC](https://discuss.elastic.co/u/AlfredoC)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 6:26pm UTC](https://discuss.elastic.co/t/username-and-password-do-not-work-on-a-shared-dashboard/268832 "2021-03-30T18:26:30Z")
I am sharing a dashboard on a web page. To be able to see the dashboard, it asks me for username and password; I enter them, but it does not allow me to see the dashboard, it asks me again for username and password, and … --- ## [Is there a way to parse country names to Geospatial Coordinates?](https://discuss.elastic.co/t/is-there-a-way-to-parse-country-names-to-geospatial-coordinates/268716)
**Author:** [@caitlyn.carlisle](https://discuss.elastic.co/u/caitlyn.carlisle)\ **Replies:** 4\ **Last updated:** [March 30, 2021, 6:12pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-parse-country-names-to-geospatial-coordinates/268716 "2021-03-30T18:12:23Z")
I am attempting to create a map using Kibana. I currently only have the country name as one of my data points but was wondering if there was a way to easily convert it to the Geospatial Coordinates? I am using a Logstash… --- ## [I need help with the filter](https://discuss.elastic.co/t/i-need-help-with-the-filter/268822)
**Author:** [@Eduardo\_Bubniak](https://discuss.elastic.co/u/Eduardo_Bubniak)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 5:48pm UTC](https://discuss.elastic.co/t/i-need-help-with-the-filter/268822 "2021-03-30T17:48:44Z")
I intend to build a dashboard showing only untreated errors that occur in the api, I am using error.exception.type to identify the types of errors, but I only need to track errors that do not have the keyword "company na… --- ## [Count elements in JSON payload](https://discuss.elastic.co/t/count-elements-in-json-payload/268325)
**Author:** [@cjeanne](https://discuss.elastic.co/u/cjeanne)\ **Replies:** 3\ **Last updated:** [March 30, 2021, 5:26pm UTC](https://discuss.elastic.co/t/count-elements-in-json-payload/268325 "2021-03-30T17:26:42Z")
Hello, I'm trying to detect index on read-only with a watcher. I use http input, and I juste want to count the result. My json watcher : { "trigger": { "schedule": { "interval": "10m" } }, "input":… --- ## [Could not able to create index-pattern in 7.12.0](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-7-12-0/268812)
**Author:** [@sasvmware](https://discuss.elastic.co/u/sasvmware)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 3:43pm UTC](https://discuss.elastic.co/t/could-not-able-to-create-index-pattern-in-7-12-0/268812 "2021-03-30T15:43:11Z")
Index pattern is not getting saved in kibana in 7.12.0 --- ## [Visualizing Prometheus Histogram](https://discuss.elastic.co/t/visualizing-prometheus-histogram/268668)
**Author:** [@waczi](https://discuss.elastic.co/u/waczi)\ **Replies:** 5\ **Last updated:** [March 30, 2021, 2:40pm UTC](https://discuss.elastic.co/t/visualizing-prometheus-histogram/268668 "2021-03-30T14:40:19Z")
Hi, which type of aggregation should I use for the Prometheus Histogram Metrics generated like shown below. I would like to sum count and values arrays, for given time period, and then based on that create histogram… --- ## [How to limit the size of horizontal bar in Kibana Canvas data table](https://discuss.elastic.co/t/how-to-limit-the-size-of-horizontal-bar-in-kibana-canvas-data-table/268710)
**Author:** [@tangkalo](https://discuss.elastic.co/u/tangkalo)\ **Replies:** 2\ **Last updated:** [March 30, 2021, 2:24pm UTC](https://discuss.elastic.co/t/how-to-limit-the-size-of-horizontal-bar-in-kibana-canvas-data-table/268710 "2021-03-30T14:24:41Z")
Hi, I have a data table that is very wide and the header column titles are long. Is there a way I can limit the size of scroll bar and also wrap the words in each of the column header so that they fit into the fixed-size… --- ## [Elasticsearch API Search query does not give correct results between timestamp range](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 1\ **Last updated:** [March 30, 2021, 2:01pm UTC](https://discuss.elastic.co/t/elasticsearch-api-search-query-does-not-give-correct-results-between-timestamp-range/268786 "2021-03-30T14:01:25Z")
Hello Guys, I have been facing this issue for last 2 days. Can anyone pls help on below issue. Am able to get exact hit counts for example 750755, but field results am not getting between timestamp range. Only few resu… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=995) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=997)