# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1038 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1039 --- ## [Memory lock check on Elastic Cloud](https://discuss.elastic.co/t/memory-lock-check-on-elastic-cloud/264867)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 7\ **Last updated:** [February 23, 2021, 7:41am UTC](https://discuss.elastic.co/t/memory-lock-check-on-elastic-cloud/264867 "2021-02-23T07:41:52Z")
I'm curious how it is possible that a cluster on Elastic Cloud passes the memory lock bootstrap check even though the memory doesn't seem to be locked. Here is the mlockall state on all nodes GET \_nodes?filter\_path=\*\*.… --- ## [Filter issue with Logstash](https://discuss.elastic.co/t/filter-issue-with-logstash/265171)
**Author:** [@nyquillus](https://discuss.elastic.co/u/nyquillus)\ **Replies:** 0\ **Last updated:** [February 23, 2021, 7:31am UTC](https://discuss.elastic.co/t/filter-issue-with-logstash/265171 "2021-02-23T07:31:54Z")
Hi, I recently added a filter to my logstash to change indexing for spesific indices(weekly, monthly etc.) The filter is this: filter { if \[retention\] == "weekly" { mutate { add\_field =\> { "\[@metadata\]… --- ## [Kibana Cases Analytics](https://discuss.elastic.co/t/kibana-cases-analytics/265116)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 23, 2021, 6:55am UTC](https://discuss.elastic.co/t/kibana-cases-analytics/265116 "2021-02-23T06:55:39Z")
Hello, I need to do some basic analytics on the Kibana cases we created until now. Where are these cases indexed? For example I added some tags and I want to visualise the amount of cases out of all cases that have cert… --- ## [Problem With parsing mikrotik log](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977)
**Author:** [@asan](https://discuss.elastic.co/u/asan)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 5:17am UTC](https://discuss.elastic.co/t/problem-with-parsing-mikrotik-log/264977 "2021-02-23T05:17:08Z")
Hi i've been trying to normalize mikrotik log with grok in logstash and my sample log is : Feb 20 04:38:02 192.168.202.101 id=firewall sn=C0EAE45CA55 time="2021-02-20 12:54:43" fw=188.126.145.3 pri=6 c=1 m=911 msg="A… --- ## [ElasticSearch(ES) Engineer 1 and 2 training lab](https://discuss.elastic.co/t/elasticsearch-es-engineer-1-and-2-training-lab/265141)
**Author:** [@suselena22](https://discuss.elastic.co/u/suselena22)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 3:34am UTC](https://discuss.elastic.co/t/elasticsearch-es-engineer-1-and-2-training-lab/265141 "2021-02-23T03:34:21Z")
Hello guys: I would like to check with you, does the lab training env. for ES Engineer 1 will be overwritten by ES Engineer 2 lab training env. or they both independent? because I wanted to go back to ES Engineer 1 lab … --- ## [Permissions on $ES\_HOME](https://discuss.elastic.co/t/permissions-on-es-home/265142)
**Author:** [@zellamsee](https://discuss.elastic.co/u/zellamsee)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 2:19am UTC](https://discuss.elastic.co/t/permissions-on-es-home/265142 "2021-02-23T02:19:07Z")
Hello, We've installed the elasticsearch on linux via the .tar.gz archive. I was wondering what the permissions on this $ES\_HOME directory and it's subdirectories are suppose to be? I have set up and elasticsearch us… --- ## [Logstash iterate through loop](https://discuss.elastic.co/t/logstash-iterate-through-loop/265092)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 4\ **Last updated:** [February 23, 2021, 2:12am UTC](https://discuss.elastic.co/t/logstash-iterate-through-loop/265092 "2021-02-23T02:12:16Z")
if \[field2\] == 10 { mutate { replace =\> { "field2" =\> "1" } } } if \[field2\] == 11 { mutate { replace =\> { "field2" =\> "2" } } } if \[field2\] == 12 { mutate { replace =\> { "field2" =\> "3" } } } I h… --- ## [Kibana Plugin detect Dark Mode on New Platform](https://discuss.elastic.co/t/kibana-plugin-detect-dark-mode-on-new-platform/264924)
**Author:** [@npm\_install](https://discuss.elastic.co/u/npm_install)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 2:03am UTC](https://discuss.elastic.co/t/kibana-plugin-detect-dark-mode-on-new-platform/264924 "2021-02-23T02:03:52Z")
Hi I have a Kibana Plugin that I have installed on my Kibana instance, but it is in light mode while the rest of the instance is in dark mode. I have tried to find information on retrieving the dark mode setting config,… --- ## [Logstash](https://discuss.elastic.co/t/logstash/265052)
**Author:** [@ranju](https://discuss.elastic.co/u/ranju)\ **Replies:** 1\ **Last updated:** [February 23, 2021, 12:58am UTC](https://discuss.elastic.co/t/logstash/265052 "2021-02-23T00:58:49Z")
Hi All {"log":"abc","system":"ABC","country":"India","ids":\["111222","22233344"\]} logtag= event.get('system') --\> value getting as ABC itemIds = event.get('ids') --\> Not getting How can we take a String array value? --- ## [How to watch the watchers?](https://discuss.elastic.co/t/how-to-watch-the-watchers/265084)
**Author:** [@anmmok](https://discuss.elastic.co/u/anmmok)\ **Replies:** 2\ **Last updated:** [February 23, 2021, 12:50am UTC](https://discuss.elastic.co/t/how-to-watch-the-watchers/265084 "2021-02-23T00:50:36Z")
Is there a simple way to create a kind of dashboard or simple an index to track the execution history of the watchers as well as the watcher setup? --- ## [Elastic Endpoint Security on 150 Windows PCs](https://discuss.elastic.co/t/elastic-endpoint-security-on-150-windows-pcs/265008)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 6\ **Last updated:** [February 23, 2021, 12:16am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-on-150-windows-pcs/265008 "2021-02-23T00:16:05Z")
I want to deploy Endpoint Security on 150 Windows PCs, how big should my Elastic Cloud container be to support all the data coming in? --- ## [How to move data in a ingest node to data node](https://discuss.elastic.co/t/how-to-move-data-in-a-ingest-node-to-data-node/265102)
**Author:** [@testsemd\_email](https://discuss.elastic.co/u/testsemd_email)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 11:25pm UTC](https://discuss.elastic.co/t/how-to-move-data-in-a-ingest-node-to-data-node/265102 "2021-02-22T23:25:26Z")
Hi, I have a cluster with 4 nodes. node1-master node2-master node3-ingest noode4-data Now ingest node fully filled with data and can not start elasticsearch service. I want to move data from ingest node to the dat… --- ## [Problem accured](https://discuss.elastic.co/t/problem-accured/265115)
**Author:** [@Sena\_O](https://discuss.elastic.co/u/Sena_O)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:57pm UTC](https://discuss.elastic.co/t/problem-accured/265115 "2021-02-22T22:57:52Z")
hello, i'm trying to open kibana but i always see the blank page. i dont know why it's happening. how can i solve the problem? --- ## [Having trouble with field mappings types](https://discuss.elastic.co/t/having-trouble-with-field-mappings-types/265109)
**Author:** [@lostsoul352](https://discuss.elastic.co/u/lostsoul352)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 10:56pm UTC](https://discuss.elastic.co/t/having-trouble-with-field-mappings-types/265109 "2021-02-22T22:56:46Z")
ELK stack 7.11 I'm having some trouble getting my field mappings types. This is a snippet of my logstash configuration which I've added to include some new fields into an index. if \[log\_message\] =~ /TP status:/… --- ## [Migrating clusters from ECE 1.1 to ECE 2.6](https://discuss.elastic.co/t/migrating-clusters-from-ece-1-1-to-ece-2-6/265100)
**Author:** [@jhegarty](https://discuss.elastic.co/u/jhegarty)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 5:40pm UTC](https://discuss.elastic.co/t/migrating-clusters-from-ece-1-1-to-ece-2-6/265100 "2021-02-22T17:40:53Z")
My team is attempting to come up with procedures to migrate clusters created on ECE 1.1 to a new installation that will be running ECE 2.6. We're trying to use remote snapshots. Our ECE 1.1 clusters have custom base path… --- ## [How to switch between languages without changes in kibana.yml file?](https://discuss.elastic.co/t/how-to-switch-between-languages-without-changes-in-kibana-yml-file/265099)
**Author:** [@WhatsIsKibana](https://discuss.elastic.co/u/WhatsIsKibana)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:34pm UTC](https://discuss.elastic.co/t/how-to-switch-between-languages-without-changes-in-kibana-yml-file/265099 "2021-02-22T22:34:29Z")
Hi, Is it possible to switch between languages in kibana on the fly? At this moment I need to change option i18n.locale in kibana.yml file and restart kibana every time when I want to change language, but it would be mu… --- ## [CSP error after enabling xpack (Dark mode broken)](https://discuss.elastic.co/t/csp-error-after-enabling-xpack-dark-mode-broken/264955)
**Author:** [@dmitryyankowski](https://discuss.elastic.co/u/dmitryyankowski)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:21pm UTC](https://discuss.elastic.co/t/csp-error-after-enabling-xpack-dark-mode-broken/264955 "2021-02-22T22:21:41Z")
Current version: 7.11.1 Hi there, i've just enabled xpack.. and logged in and i'm seeing the following error in my console: Refused to execute inline script because it violates the following Content Security Policy dir… --- ## [Will Endpoint Security work offline?](https://discuss.elastic.co/t/will-endpoint-security-work-offline/265119)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 8:58pm UTC](https://discuss.elastic.co/t/will-endpoint-security-work-offline/265119 "2021-02-22T20:58:07Z")
Hello, if I deploy Endpoint Security to hundreds of computers, and suddenly they cannot contact Elastic Cloud for a few hours, will they continue to run, protect, and download the virus database and all? --- ## [Kibana chart legend options](https://discuss.elastic.co/t/kibana-chart-legend-options/264926)
**Author:** [@CJ\_Chang](https://discuss.elastic.co/u/CJ_Chang)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 7:58pm UTC](https://discuss.elastic.co/t/kibana-chart-legend-options/264926 "2021-02-22T19:58:36Z")
Is there a way to reduce the legend length? --- ## [Pie chart visualization](https://discuss.elastic.co/t/pie-chart-visualization/265022)
**Author:** [@saintjohn](https://discuss.elastic.co/u/saintjohn)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 7:50pm UTC](https://discuss.elastic.co/t/pie-chart-visualization/265022 "2021-02-22T19:50:20Z")
Hi experts, I'm creating a pie chart as below(labels hidden) but struggling with the following 2 points. Could you please advise? The chart is sliced as descended in anticlockwise manner. I would like to order them… --- ## [Field length and average field lengths BM25](https://discuss.elastic.co/t/field-length-and-average-field-lengths-bm25/265105)
**Author:** [@d3v3lop3r](https://discuss.elastic.co/u/d3v3lop3r)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 7:39pm UTC](https://discuss.elastic.co/t/field-length-and-average-field-lengths-bm25/265105 "2021-02-22T19:39:36Z")
I dont quite understand the forumula of the BM25 explained here: What is menat by the field length? --- ## [Kibana failing to install on centos6 or upgrading to kibana-7.11.1-1.x86\_64](https://discuss.elastic.co/t/kibana-failing-to-install-on-centos6-or-upgrading-to-kibana-7-11-1-1-x86-64/265110)
**Author:** [@Bjen\_Shah](https://discuss.elastic.co/u/Bjen_Shah)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 7:18pm UTC](https://discuss.elastic.co/t/kibana-failing-to-install-on-centos6-or-upgrading-to-kibana-7-11-1-1-x86-64/265110 "2021-02-22T19:18:19Z")
While I try to install on centos 7 is fine but on centos 6 I get all of these errors /usr/share/kibana/bin/../node/bin/node: /lib64/libc.so.6: versionGLIBC\_2.16' not found (required by /usr/share/kibana/bin/../node/… --- ## [Dynamic query in jdbc plugin](https://discuss.elastic.co/t/dynamic-query-in-jdbc-plugin/264806)
**Author:** [@niki1](https://discuss.elastic.co/u/niki1)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 6:57pm UTC](https://discuss.elastic.co/t/dynamic-query-in-jdbc-plugin/264806 "2021-02-22T18:57:29Z")
I got a mysql(or any other relational database) with a table like this: id,name,prod 11,alex,car 22,alice,ship 33,bob,airplane and I have messages going through logstash pipeline like this: 11,20210215,ford,.... 2… --- ## [Pipeline: field \[evidence\] not present as part of path \[threatintel.evidence\]](https://discuss.elastic.co/t/pipeline-field-evidence-not-present-as-part-of-path-threatintel-evidence/263008)
**Author:** [@remote](https://discuss.elastic.co/u/remote)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 6:14pm UTC](https://discuss.elastic.co/t/pipeline-field-evidence-not-present-as-part-of-path-threatintel-evidence/263008 "2021-02-22T18:14:10Z")
Hi, I have an issue when trying to ingest data from a CSV file via Logstash to Elasticsearch. My data contains a nested JSON object (array) that I want to properly parse using the JSON processor in the ingest pipeline. … --- ## [Elastic search migration from 6.4 to 7.10](https://discuss.elastic.co/t/elastic-search-migration-from-6-4-to-7-10/265091)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 5:44pm UTC](https://discuss.elastic.co/t/elastic-search-migration-from-6-4-to-7-10/265091 "2021-02-22T17:44:14Z")
Hello team , By seeing the upgrade strategy from ELK docs I can directly upgrade from 6.4 to 7.10 but if I do so I am facing an issue "incompatible version " is that I need to upgrade from 6.4 to 6.8 and then to 7.10 ? … --- ## [Alert Variables in email action - EQL](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695)
**Author:** [@jancodenew](https://discuss.elastic.co/u/jancodenew)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 5:32pm UTC](https://discuss.elastic.co/t/alert-variables-in-email-action-eql/264695 "2021-02-22T17:32:42Z")
Hello, Can someone please help to add additional field to the alert variable? I have mentioned the Detection EQL rule logic below. sequence with maxspan=5m \[authentication where event.type == "authentication\_failure"\]… --- ## [Drill down visualization for json data that contains nested structure](https://discuss.elastic.co/t/drill-down-visualization-for-json-data-that-contains-nested-structure/264173)
**Author:** [@kinnub](https://discuss.elastic.co/u/kinnub)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:52pm UTC](https://discuss.elastic.co/t/drill-down-visualization-for-json-data-that-contains-nested-structure/264173 "2021-02-22T16:52:45Z")
Continuing the discussion from Drill Down Visualization: I am looking for a solution and my use case is similar to the discussion (above link ). Could you please let me know if there is any solution/workaround for it? M… --- ## [Rsyslog to send logs to logstash](https://discuss.elastic.co/t/rsyslog-to-send-logs-to-logstash/264973)
**Author:** [@Prabhath\_samarasingh](https://discuss.elastic.co/u/Prabhath_samarasingh)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 2:41pm UTC](https://discuss.elastic.co/t/rsyslog-to-send-logs-to-logstash/264973 "2021-02-22T14:41:57Z")
Hi, Configured rsyslog to send logs to logstash. But kibana dosen't receive. Please help. OS : Ubuntu 20.04 \ cat /etc/elasticsearch/elasticsearch.yml Elasticsearch performs poorly when the system is swapping t… --- ## [Strings to numerics](https://discuss.elastic.co/t/strings-to-numerics/265090)
**Author:** [@Marc2](https://discuss.elastic.co/u/Marc2)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:46pm UTC](https://discuss.elastic.co/t/strings-to-numerics/265090 "2021-02-22T16:46:23Z")
Hello community! I am new at this and my problem is the following: I am trying to use some .csv files to represent data in Kibana, and to do that i am using the code i found on this web: https://alexmarquardt.com/2020/… --- ## [Mapping use dynamic strict](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [February 22, 2021, 4:03pm UTC](https://discuss.elastic.co/t/mapping-use-dynamic-strict/264957 "2021-02-22T16:03:07Z")
I am trying to test out this feature but not getting what I want for example PUT \_index\_template/sachin\_quick\_test { "index\_patterns": \["sachin\_quick\_test-\*"\], "template": { "settings": { "number\_of\_shard… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1037) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1039)