# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1039 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1040 --- ## [Endpoint Security Detection Rule Failed](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 4:00pm UTC](https://discuss.elastic.co/t/endpoint-security-detection-rule-failed/265011 "2021-02-22T16:00:21Z")
Elastic Cloud, 7.11, added a brand new Agent on Windows 10: Why does it fail? --- ## [Export to CSV on 7.9.3](https://discuss.elastic.co/t/export-to-csv-on-7-9-3/264113)
**Author:** [@Francisco\_Navarro](https://discuss.elastic.co/u/Francisco_Navarro)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 3:11pm UTC](https://discuss.elastic.co/t/export-to-csv-on-7-9-3/264113 "2021-02-22T15:11:38Z")
I'm trying to export the content of an index to CSV using Kibana 7.9.3 I've seen that this is possible on 7.10.0 but I cannot find the button on 7.9.3, is it not available? 7.10 7.9 Best regards! --- ## [How can I index HTML tags](https://discuss.elastic.co/t/how-can-i-index-html-tags/265078)
**Author:** [@peterbe](https://discuss.elastic.co/u/peterbe)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 3:09pm UTC](https://discuss.elastic.co/t/how-can-i-index-html-tags/265078 "2021-02-22T15:09:27Z")
I use the standard tokenizer and I don't use the html\_strip char filter. How can I index HTML tags? In fact, I want to be able to search with and without the \< and \> characters. I.e. a search for \ should match… --- ## [Grok matching multi-lines saving first and last value to separate fields](https://discuss.elastic.co/t/grok-matching-multi-lines-saving-first-and-last-value-to-separate-fields/264958)
**Author:** [@Daniel\_Jankech](https://discuss.elastic.co/u/Daniel_Jankech)\ **Replies:** 11\ **Last updated:** [February 22, 2021, 3:08pm UTC](https://discuss.elastic.co/t/grok-matching-multi-lines-saving-first-and-last-value-to-separate-fields/264958 "2021-02-22T15:08:30Z")
Hello everyone, as the caption indicates I am trying to match multiple-lines of logs of which I would like to save first occurence of timestamp to separate field than last occurence of the timestamp. I am using codec mu… --- ## [Kibana Date Histogram restricting date on graph](https://discuss.elastic.co/t/kibana-date-histogram-restricting-date-on-graph/264098)
**Author:** [@Ganesh\_Rao\_B](https://discuss.elastic.co/u/Ganesh_Rao_B)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 3:01pm UTC](https://discuss.elastic.co/t/kibana-date-histogram-restricting-date-on-graph/264098 "2021-02-22T15:01:01Z")
I am using Kibana visualization 'vertical bar'. In Vertical bar on x-axis i am using Date histogram and x axis minimum interval is given monthly . Data is shown in Vertical bar but its overlapped ,because X axis is shown… --- ## [TSVB Time filter question](https://discuss.elastic.co/t/tsvb-time-filter-question/264095)
**Author:** [@Vincent\_Vanclef](https://discuss.elastic.co/u/Vincent_Vanclef)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:50pm UTC](https://discuss.elastic.co/t/tsvb-time-filter-question/264095 "2021-02-22T14:50:48Z")
I've tried finding some documentation on it, but how does the TSVB visualization calculcate its aggregation? Especially a simple "count". It shows way too high data count compared to the total documents: I am just try… --- ## [Aggregations: sort by mutliple terms](https://discuss.elastic.co/t/aggregations-sort-by-mutliple-terms/265081)
**Author:** [@Douglas\_Leister](https://discuss.elastic.co/u/Douglas_Leister)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 2:38pm UTC](https://discuss.elastic.co/t/aggregations-sort-by-mutliple-terms/265081 "2021-02-22T14:38:04Z")
I have a mapping of businesses, for which I am using an aggregation to calculate average ratings for the businesses grouped by business id. Sorting the aggregation by business id or average rating works fine. My issue… --- ## [Colourful bullets in Discover section](https://discuss.elastic.co/t/colourful-bullets-in-discover-section/265062)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 2:35pm UTC](https://discuss.elastic.co/t/colourful-bullets-in-discover-section/265062 "2021-02-22T14:35:56Z")
Can we show the following image like bullets for particular entries? For example, I have a field to show the 'Priority' of a log such as HIGH, CRITICAL, LOW. I want to show a red bullet when priority is CRITICAL, orange … --- ## [Help me understand Elasticsearch structure](https://discuss.elastic.co/t/help-me-understand-elasticsearch-structure/264859)
**Author:** [@butaminas](https://discuss.elastic.co/u/butaminas)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 2:31pm UTC](https://discuss.elastic.co/t/help-me-understand-elasticsearch-structure/264859 "2021-02-22T14:31:57Z")
I'm new to Elasticsearch and I've been reading and playing around with it a lot lately but I still can't understand one thing and am hoping to find the answer here. From my understanding, Elasticsearch is not something … --- ## [Elasticsearch not starting after UID and GID change](https://discuss.elastic.co/t/elasticsearch-not-starting-after-uid-and-gid-change/265054)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-after-uid-and-gid-change/265054 "2021-02-22T14:31:23Z")
Hello! I have a cluster of 2 nodes and I wanted to do the snapshot by setting up the NFS server and a directory as the repository. I had read that all nodes should have the same UID and GID. Thus, I changed them using co… --- ## [Data is showing wrong when i add some nested fields](https://discuss.elastic.co/t/data-is-showing-wrong-when-i-add-some-nested-fields/263748)
**Author:** [@Juan\_Alvarez](https://discuss.elastic.co/u/Juan_Alvarez)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:30pm UTC](https://discuss.elastic.co/t/data-is-showing-wrong-when-i-add-some-nested-fields/263748 "2021-02-22T14:30:48Z")
hello, i need help to visualiza the next json: { "\_index": "signaturetrace", "\_type": "\_doc", "\_id": "pFVCUHcBaUOzInAquLbu", "\_version": 17, "\_score": null, "\_source": { "contractId": "baeb4e31-56a8-4b4e-32a3-08d856… --- ## [Cors in Kibana](https://discuss.elastic.co/t/cors-in-kibana/264575)
**Author:** [@seba\_galban](https://discuss.elastic.co/u/seba_galban)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 2:27pm UTC](https://discuss.elastic.co/t/cors-in-kibana/264575 "2021-02-22T14:27:33Z")
Hi Everyone, We have a problem when we want to get the cookie from Kibana 7.10.0. We have two scenarios: If we don´t use the credentials: true, In the header response we have the set-cookie attribute but the browser… --- ## [Stringo Lab - data analysis with kibana - password protected -need help to reset](https://discuss.elastic.co/t/stringo-lab-data-analysis-with-kibana-password-protected-need-help-to-reset/264710)
**Author:** [@fperrotta](https://discuss.elastic.co/u/fperrotta)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 2:26pm UTC](https://discuss.elastic.co/t/stringo-lab-data-analysis-with-kibana-password-protected-need-help-to-reset/264710 "2021-02-22T14:26:08Z")
Hi, My lab web interface is password protected but I can not remember the password for elastic user. Can anyone from elastic please reset it? Thanks a lot. --- ## [Logstash mutate rename](https://discuss.elastic.co/t/logstash-mutate-rename/265043)
**Author:** [@Jokie74](https://discuss.elastic.co/u/Jokie74)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:25pm UTC](https://discuss.elastic.co/t/logstash-mutate-rename/265043 "2021-02-22T14:25:08Z")
hello dear community, I have a question about the "mutate rename" filter option. In my logstash filter I have this: mutate { rename =\> { "\[fields\]\[host\]\[name\]" =\> "\[host\]\[name\]" … --- ## [Введение координационных нод в действующий кластер](https://discuss.elastic.co/t/topic/264938)
**Author:** [@technautist](https://discuss.elastic.co/u/technautist)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:21pm UTC](https://discuss.elastic.co/t/topic/264938 "2021-02-22T14:21:46Z")
Добрый день! Имеется: Версия elasticsearch 7.3.2 3 master ноды (16 CPU, 30GB RAM) 23 data ноды (12 CPU, 26GB RAM, 2.5Tb SSD) Общий объём данных порядка 34ТБ Для разгрузки от пользовательских запросов было принято р… --- ## [Script on nested fileds](https://discuss.elastic.co/t/script-on-nested-fileds/263389)
**Author:** [@Giovanni\_Di\_Lembo](https://discuss.elastic.co/u/Giovanni_Di_Lembo)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 2:18pm UTC](https://discuss.elastic.co/t/script-on-nested-fileds/263389 "2021-02-22T14:18:30Z")
hi all and sorry for my poor english . I have an index with this mapping "mappings":{ "properties":{ "\_class":{ "type": "text", "fields":{"keyword":{"type": "keyword", "ignore\_above": … --- ## [Get Akamai SIEM logs to ELK](https://discuss.elastic.co/t/get-akamai-siem-logs-to-elk/265075)
**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 2:11pm UTC](https://discuss.elastic.co/t/get-akamai-siem-logs-to-elk/265075 "2021-02-22T14:11:54Z")
Hi, We want to ingest SIEM logs from akamai to Logstash, then Elasticsearch. To access SIEM logs, we have created akamai API credentials and have gotten SIEM connector details. They include: client\_secret = host = xy… --- ## [Filebeat setup. fail to create the Kibana loader](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264283)
**Author:** [@DavidEA](https://discuss.elastic.co/u/DavidEA)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 2:11pm UTC](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264283 "2021-02-22T14:11:28Z")
Будьте добры, подскажите пожалуйста, не знаю куда уже смотреть. При установке filebeat делаю: filebeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=\['remote\_ip:9200'\] -E setup.kibana.host=rem… --- ## [Kibana "Goal" Visual - how to make the end of the scale dynamic](https://discuss.elastic.co/t/kibana-goal-visual-how-to-make-the-end-of-the-scale-dynamic/264686)
**Author:** [@luca.scarpato](https://discuss.elastic.co/u/luca.scarpato)\ **Replies:** 3\ **Last updated:** [February 22, 2021, 2:04pm UTC](https://discuss.elastic.co/t/kibana-goal-visual-how-to-make-the-end-of-the-scale-dynamic/264686 "2021-02-22T14:04:42Z")
Dear Kibana & ES team, We are trying to use the Kibana Goal Visual to represents a proportion of a metrics over its total. E.g. Newly Received Emails / Total of Emails E.g. 16,700 new emails / 100,000 of total emails … --- ## [Unrecognized scale name: "child\_layer\_0\_y" error for facet dual charts](https://discuss.elastic.co/t/unrecognized-scale-name-child-layer-0-y-error-for-facet-dual-charts/263117)
**Author:** [@Pranusha119](https://discuss.elastic.co/u/Pranusha119)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 1:59pm UTC](https://discuss.elastic.co/t/unrecognized-scale-name-child-layer-0-y-error-for-facet-dual-charts/263117 "2021-02-22T13:59:31Z")
{ "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "data":{ "url": "data/cars.json" }, "facet":{ "column": { "field":"Origin", "type": "nominal" … --- ## [Upgrade to Kibana 7.11 results in 'Unexpected token \< in JSON at position 0' for eaggs](https://discuss.elastic.co/t/upgrade-to-kibana-7-11-results-in-unexpected-token-in-json-at-position-0-for-eaggs/264707)
**Author:** [@commandline](https://discuss.elastic.co/u/commandline)\ **Replies:** 6\ **Last updated:** [February 22, 2021, 1:53pm UTC](https://discuss.elastic.co/t/upgrade-to-kibana-7-11-results-in-unexpected-token-in-json-at-position-0-for-eaggs/264707 "2021-02-22T13:53:16Z")
Following an upgrade to 7.11 for elasticsearch and kibana there now appear many Error states on dashboard panels. Inspect shows the response for the request to be { “message”: “Unexpected token \< in JSON at position 0… --- ## [Snapshot: repository\_verification\_exception](https://discuss.elastic.co/t/snapshot-repository-verification-exception/265059)
**Author:** [@rojin](https://discuss.elastic.co/u/rojin)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 1:52pm UTC](https://discuss.elastic.co/t/snapshot-repository-verification-exception/265059 "2021-02-22T13:52:29Z")
Hi! I am trying to do a snapshot for my cluster including 2 nodes. I have a shared file on both of my nodes. node-1 as an NFS server and node-2 as the client. if I add a file to the specified shared directory which is /v… --- ## [Phrase Suggester Returns Suggestions from Deleted Documents as of 7.0.0](https://discuss.elastic.co/t/phrase-suggester-returns-suggestions-from-deleted-documents-as-of-7-0-0/265068)
**Author:** [@bencody](https://discuss.elastic.co/u/bencody)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 1:39pm UTC](https://discuss.elastic.co/t/phrase-suggester-returns-suggestions-from-deleted-documents-as-of-7-0-0/265068 "2021-02-22T13:39:20Z")
Issue As of Elasticsearch 7.0.0, the Phrase Suggester returns suggestions of deleted documents. I assume this is a bug. However, the documentation on Suggesters | Elasticsearch Reference \[7.11\] | Elastic does not state… --- ## [\[s3-repository\] path is not accessible on master node](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/264942)
**Author:** [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\ **Replies:** 5\ **Last updated:** [February 22, 2021, 1:15pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/264942 "2021-02-22T13:15:01Z")
Hello Team, We are trying to configure the snapshot of indices and store over S3 bucket. But we are facing issue when we are trying to configure repository. We are using 3 node cluster and we instlled the repository-s3 … --- ## [Schedule a Job in Elasticsearch](https://discuss.elastic.co/t/schedule-a-job-in-elasticsearch/265032)
**Author:** [@gruselglatz](https://discuss.elastic.co/u/gruselglatz)\ **Replies:** 9\ **Last updated:** [February 22, 2021, 12:56pm UTC](https://discuss.elastic.co/t/schedule-a-job-in-elasticsearch/265032 "2021-02-22T12:56:32Z")
Hi, is it possible to schedule a job in elasticsearch and save it? My requirements are that the team only wants to keep certain messages after xy days to reduce the storage capacity. Can i realize it with rollover, il… --- ## [Can I add dynamic index mapping from Logstash](https://discuss.elastic.co/t/can-i-add-dynamic-index-mapping-from-logstash/264674)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 2\ **Last updated:** [February 22, 2021, 11:51am UTC](https://discuss.elastic.co/t/can-i-add-dynamic-index-mapping-from-logstash/264674 "2021-02-22T11:51:03Z")
I am creating index dynamically(e.g wallet-tx-customer-%{+YYYY.MM}) from Logstash. For some field I am getting an error mapper \[usd\] cannot be changed from type \[long\] to \[float\] and that event doesn't get indexed. I wa… --- ## [Azure Activity Logs in Elastic](https://discuss.elastic.co/t/azure-activity-logs-in-elastic/264856)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 4\ **Last updated:** [February 22, 2021, 11:28am UTC](https://discuss.elastic.co/t/azure-activity-logs-in-elastic/264856 "2021-02-22T11:28:59Z")
Hi, currently we are tryting to ship logs from azure eventhub to logstash. We use this: Azure Event Hubs plugin | Logstash Reference \[7.11\] | Elastic to forward the logs to elastic cluster. As far as I have learnt from… --- ## [TIme series Visual builder : How to do Math calculations betweent the output of two series?](https://discuss.elastic.co/t/time-series-visual-builder-how-to-do-math-calculations-betweent-the-output-of-two-series/264414)
**Author:** [@Harpreet\_Singh](https://discuss.elastic.co/u/Harpreet_Singh)\ **Replies:** 9\ **Last updated:** [February 22, 2021, 11:14am UTC](https://discuss.elastic.co/t/time-series-visual-builder-how-to-do-math-calculations-betweent-the-output-of-two-series/264414 "2021-02-22T11:14:46Z")
Hi Team, I am using Time series visual builder: Top N Chart, i am in a scenario where i am doing Math calculation in 5 different series. See below Screenshot: Pic 1: Final Chart Pic 2: Different time series i have cho… --- ## [Can Logstash accepts GraphQL data and convert into json?](https://discuss.elastic.co/t/can-logstash-accepts-graphql-data-and-convert-into-json/265055)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 0\ **Last updated:** [February 22, 2021, 11:00am UTC](https://discuss.elastic.co/t/can-logstash-accepts-graphql-data-and-convert-into-json/265055 "2021-02-22T11:00:48Z")
I have one endpoint giving data in GarphQL, is it possible to add a codec filter to parse data from GraphQL to JSON ? or is there any way I can covert GraphQL data to Elasticsearch readable format? --- ## [Count of unique events](https://discuss.elastic.co/t/count-of-unique-events/265037)
**Author:** [@artobstrel](https://discuss.elastic.co/u/artobstrel)\ **Replies:** 1\ **Last updated:** [February 22, 2021, 10:51am UTC](https://discuss.elastic.co/t/count-of-unique-events/265037 "2021-02-22T10:51:08Z")
I have 5000 unique events. If I try to unique count with default precision value, I get the wrong value: How can I calculate truly unique values without changing the precision? [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1038) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1040)