# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1091 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1092 --- ## [Elk custome log](https://discuss.elastic.co/t/elk-custome-log/260407)
**Author:** [@Supun\_Madushanka](https://discuss.elastic.co/u/Supun_Madushanka)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 3:35am UTC](https://discuss.elastic.co/t/elk-custome-log/260407 "2021-01-08T03:35:03Z")
Hi, I am new to elk. I have a nodejs application. current I am writing nodejs log to the log file. my log format is "type username ip eventname data". I set up filebeat in nodejs server and I setup kibana with elastic se… --- ## [Search query based of number of values a field contains](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 2\ **Last updated:** [January 8, 2021, 2:34am UTC](https://discuss.elastic.co/t/search-query-based-of-number-of-values-a-field-contains/260408 "2021-01-08T02:34:14Z")
Hi, I was wondering whether you can point me at any documentation, or let me know if this is not possible for the following. I am trying to write a query of a fields called result\_code. Some of my documents contain mul… --- ## [Painless script for a comparison between two fields taken at interval](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464)
**Author:** [@CyaTo](https://discuss.elastic.co/u/CyaTo)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 10:41pm UTC](https://discuss.elastic.co/t/painless-script-for-a-comparison-between-two-fields-taken-at-interval/260464 "2021-01-07T22:41:21Z")
Hello :wave: I take the ELK suite in hand and try to do a few things with it to learn. Currently I'm trying to make a scripted field that will be able to determine a change between two hashes taken at two different mom… --- ## [Name saved in disk when taking snapshot](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429)
**Author:** [@khzied](https://discuss.elastic.co/u/khzied)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 9:34pm UTC](https://discuss.elastic.co/t/name-saved-in-disk-when-taking-snapshot/260429 "2021-01-07T21:34:22Z")
Hello, I have Elasticsearch 5.6 and I have a question when making snapshot: it's possible to find the same name of directory like index name after making snap. Now the directory generated is random name like this lMTV… --- ## [Kibana 7.10 custom plugin grayed out in dashboard](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471)
**Author:** [@ssimmons](https://discuss.elastic.co/u/ssimmons)\ **Replies:** 8\ **Last updated:** [January 7, 2021, 8:08pm UTC](https://discuss.elastic.co/t/kibana-7-10-custom-plugin-grayed-out-in-dashboard/260471 "2021-01-07T20:08:53Z")
I've create a test plugin for Kibana 7.10 using logic from a 7.8 plugin. It works fine when I create a visualization using the custom plugin. However, when I add the visualization to a dashboard everything is grayed out … --- ## [Search for String Literal in KQL](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482)
**Author:** [@Samsquantch](https://discuss.elastic.co/u/Samsquantch)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 8:04pm UTC](https://discuss.elastic.co/t/search-for-string-literal-in-kql/260482 "2021-01-07T20:04:21Z")
How do I search for a literal string value? Current example query: Subject : "\[External Sender\] Test" Brings back what I'm looking for, but also the following: \[External Sender\] test-results.pdf \[External Sender\] Te… --- ## [Audit logging in ECE 1.1](https://discuss.elastic.co/t/audit-logging-in-ece-1-1/260486)
**Author:** [@jhegarty](https://discuss.elastic.co/u/jhegarty)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 8:01pm UTC](https://discuss.elastic.co/t/audit-logging-in-ece-1-1/260486 "2021-01-07T20:01:05Z")
We have an ECE 1.1 installation that’s been running for a while, and we’d like to know which clusters are still being used. We don’t have access to most of the clusters, so we need a way to do this through ECE for all cl… --- ## ["simple\_query\_string" with "default\_operator": "AND" doesn't imply "analyzer": "default"](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 7:59pm UTC](https://discuss.elastic.co/t/simple-query-string-with-default-operator-and-doesnt-imply-analyzer-default/260485 "2021-01-07T19:59:38Z")
Hello, all - I went to convert some code using query\_string to simple\_query\_string (using "default\_operator": "AND" for both) and was surprised to find I needed to explicitly say "analyzer": "default" despite the analyz… --- ## [Trouble With Multiline Codec Logstash](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483)
**Author:** [@bigbobolue](https://discuss.elastic.co/u/bigbobolue)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:51pm UTC](https://discuss.elastic.co/t/trouble-with-multiline-codec-logstash/260483 "2021-01-07T19:51:55Z")
I am having trouble with a particular multiline log 2021-01-07T07:17:59.942 INFO (129c-2b04) \[LogonMonitor::LogSummary\] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* Session Summary (User: User1234, Session: 1) \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 2021-01-07T07:17:… --- ## [Count fields with the same value as one](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466)
**Author:** [@Angelos](https://discuss.elastic.co/u/Angelos)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:31pm UTC](https://discuss.elastic.co/t/count-fields-with-the-same-value-as-one/260466 "2021-01-07T19:31:29Z")
Hi! I have many fields which have the same value. So let's we have those document in different time periods: @timestamp Jan 6, 2021 @ 23:00:00 field.mess value1 field.sub examp1 @timestamp Jan 6, 2021 @ 23:00:01 fie… --- ## [Help on creating a visualization of total time taken for service in Kibana](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401)
**Author:** [@Thols](https://discuss.elastic.co/u/Thols)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 7:10pm UTC](https://discuss.elastic.co/t/help-on-creating-a-visualization-of-total-time-taken-for-service-in-kibana/260401 "2021-01-07T19:10:30Z")
Hi I am trying to create a time visualization like below Where 1 - 5 are various calls the single service travels through and come back. Each of these has a separate log source and are indexed in different patterns. … --- ## [Matching Documents by Hour](https://discuss.elastic.co/t/matching-documents-by-hour/260480)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 6:57pm UTC](https://discuss.elastic.co/t/matching-documents-by-hour/260480 "2021-01-07T18:57:31Z")
I have an issue with a dataset that we imported. The source marked the midnight timestamps as 2400 on the previous day. After ingestion, that time has been adjusted to 0000 but the day is still the previous day. So, I… --- ## [Handling unmounted data volume](https://discuss.elastic.co/t/handling-unmounted-data-volume/260478)
**Author:** [@a06ced31bae02498a46d](https://discuss.elastic.co/u/a06ced31bae02498a46d)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 5:59pm UTC](https://discuss.elastic.co/t/handling-unmounted-data-volume/260478 "2021-01-07T17:59:32Z")
Hello! We are facing an issue with the store volume hardware on a given data node which results in full production outage. While the problem is clearly lies in the system/hardware level there might be some Elasticsearch… --- ## [Pipeline sending to itself](https://discuss.elastic.co/t/pipeline-sending-to-itself/260413)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 5:27pm UTC](https://discuss.elastic.co/t/pipeline-sending-to-itself/260413 "2021-01-07T17:27:52Z")
Hello all, We have the following usecase: We want to read data from a service provider that requires paging when polling data(they also support pushing data but we are not accessible from the internet). I found that th… --- ## [Create visualization with actual status of process ("group by"?/subquery?)](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379)
**Author:** [@Joao\_Palma](https://discuss.elastic.co/u/Joao_Palma)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 4:32pm UTC](https://discuss.elastic.co/t/create-visualization-with-actual-status-of-process-group-by-subquery/260379 "2021-01-07T16:32:51Z")
Hello, I have a log file, like this : {"process": "X2", "status": "open", "@timestamp": "2021-01-05T15:34:41.061Z"} {"process": "X1", "status": "open", "@timestamp": "2021-01-05T15:35:42.061Z"} {"process": "X5", "sta… --- ## [Logstash fails to run: ES\_TEMPDIR does not get translated properly?](https://discuss.elastic.co/t/logstash-fails-to-run-es-tempdir-does-not-get-translated-properly/260441)
**Author:** [@tarkhil](https://discuss.elastic.co/u/tarkhil)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 4:18pm UTC](https://discuss.elastic.co/t/logstash-fails-to-run-es-tempdir-does-not-get-translated-properly/260441 "2021-01-07T16:18:31Z")
logstash7-7.10.0 openjdk15-15.0.1 Attempt to run logstash fails with # su -m logstash -c 'sh -c "env JAVA\_HOME=/usr/local/openjdk15 /usr/local/logstash/bin/logstash --path.settings /usr/local/etc/logstash -l /var… --- ## [Search\_after With Collapse Pagination Alternative](https://discuss.elastic.co/t/search-after-with-collapse-pagination-alternative/260451)
**Author:** [@MilanGatyas](https://discuss.elastic.co/u/MilanGatyas)\ **Replies:** 1\ **Last updated:** [January 7, 2021, 3:35pm UTC](https://discuss.elastic.co/t/search-after-with-collapse-pagination-alternative/260451 "2021-01-07T15:35:32Z")
We want to utilize the search\_after pagination strategy rather than from-size pagination strategy as we understood that search\_after has better performance for high pagination numbers. At the same time, we do collapse o… --- ## [Philosophy behind ignore\_above mapping parameter](https://discuss.elastic.co/t/philosophy-behind-ignore-above-mapping-parameter/260438)
**Author:** [@agx](https://discuss.elastic.co/u/agx)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 3:08pm UTC](https://discuss.elastic.co/t/philosophy-behind-ignore-above-mapping-parameter/260438 "2021-01-07T15:08:31Z")
we're using serilog to send logs to elastic. it's default mapping parameter is to ignore fields above 256 characters (which might also be an elastic default?). this has been fine for us, but recently one of our devs want… --- ## [Nested terms aggregation performance](https://discuss.elastic.co/t/nested-terms-aggregation-performance/260446)
**Author:** [@shusson](https://discuss.elastic.co/u/shusson)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 1:42pm UTC](https://discuss.elastic.co/t/nested-terms-aggregation-performance/260446 "2021-01-07T13:42:47Z")
I'm trying to optimize nested term aggregations for an autocomplete use case. More info on the query and mapping here: https://stackoverflow.com/questions/65613335/improve-performance-of-a-nested-term-aggregation. Based… --- ## [使用logstash7.4.2往es发送数据得用户信息如何创建用户呢](https://discuss.elastic.co/t/logstash7-4-2-es/260411)
**Author:** [@111351](https://discuss.elastic.co/u/111351)\ **Replies:** 0\ **Last updated:** [January 7, 2021, 6:36am UTC](https://discuss.elastic.co/t/logstash7-4-2-es/260411 "2021-01-07T06:36:44Z")
你好我用es里自带得logstsah\_system用户向es发数据不成功请问有人知道是怎么回事吗 --- ## [Kibana@Docker new instances occure in stack monitoring when I reboot the Kibana node](https://discuss.elastic.co/t/kibana-docker-new-instances-occure-in-stack-monitoring-when-i-reboot-the-kibana-node/258697)
**Author:** [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 1:29pm UTC](https://discuss.elastic.co/t/kibana-docker-new-instances-occure-in-stack-monitoring-when-i-reboot-the-kibana-node/258697 "2021-01-07T13:29:14Z")
Hi There, I'm running on elk 7.9.2 with two kibana's nodes. I'm noticing some interesting behaviour in the stack monitoring . When I reboot one of two kibana's node then I've lost my monitoring graphs and I start… --- ## [Volume expansion](https://discuss.elastic.co/t/volume-expansion/258076)
**Author:** [@knagasri](https://discuss.elastic.co/u/knagasri)\ **Replies:** 16\ **Last updated:** [January 7, 2021, 12:45pm UTC](https://discuss.elastic.co/t/volume-expansion/258076 "2021-01-07T12:45:18Z")
I was deploying elasticsearch cluster as statefulset. I upgraded elastic-operator to 1.3.0. I can see that volume expansion is supported for 1.3.0 release: But still I am seeing the old storage size. Is volume expan… --- ## [Logstash trying to write to read-only index endlessly](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356)
**Author:** [@alexbde](https://discuss.elastic.co/u/alexbde)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 9:52am UTC](https://discuss.elastic.co/t/logstash-trying-to-write-to-read-only-index-endlessly/260356 "2021-01-07T09:52:04Z")
Hello, we're using BELK-Stack with 5 Filebeats =\> 1 Logstash =\> 1 Elasticsearch \<= 1 Kibana. During the last weeks we experienced some downtime of 2 Filebeat services (root cause doesn't matter) which led to some buffere… --- ## [Fleet enrollment is done but doesn't appear on Security \> Administration \> Endpoints](https://discuss.elastic.co/t/fleet-enrollment-is-done-but-doesnt-appear-on-security-administration-endpoints/260142)
**Author:** [@roh](https://discuss.elastic.co/u/roh)\ **Replies:** 5\ **Last updated:** [January 7, 2021, 9:00am UTC](https://discuss.elastic.co/t/fleet-enrollment-is-done-but-doesnt-appear-on-security-administration-endpoints/260142 "2021-01-07T09:00:57Z")
Hi all! I'm trying to enroll Elastic Agent on Fleet. Kibana and Elasticsearch are on Windows 10 WSL Ubuntu 16.04 and Elastic Agent is on Windows 10. I'm using self-signed certs so I imported certificates as root trust… --- ## [\[Threat Intelligence\]: Avoid redundancy of information in the same index](https://discuss.elastic.co/t/threat-intelligence-avoid-redundancy-of-information-in-the-same-index/260303)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [January 7, 2021, 8:11am UTC](https://discuss.elastic.co/t/threat-intelligence-avoid-redundancy-of-information-in-the-same-index/260303 "2021-01-07T08:11:59Z")
Hello, I am using this pipeline to enrich my SIEM with URLhaus information: input { exec { command =\> 'curl https://urlhaus.abuse.ch/downloads/csv/ --output text.zip && unzip -c text.zip' interval =\> 86400 … --- ## [Disable automatic index creation in elasticsearch](https://discuss.elastic.co/t/disable-automatic-index-creation-in-elasticsearch/260276)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [January 7, 2021, 4:42am UTC](https://discuss.elastic.co/t/disable-automatic-index-creation-in-elasticsearch/260276 "2021-01-07T04:42:09Z")
Hi, I have a setup of ELK 7.10v . I want to know is there a way to configure elasticsearch not to automatically create indexes. I tried adding this to my "elasticsearch.yml" action.auto\_create\_index: 0 also tried … --- ## [Can't opne kibana 7.10.1 on firfox](https://discuss.elastic.co/t/cant-opne-kibana-7-10-1-on-firfox/260399)
**Author:** [@YunZhe](https://discuss.elastic.co/u/YunZhe)\ **Replies:** 2\ **Last updated:** [January 7, 2021, 4:03am UTC](https://discuss.elastic.co/t/cant-opne-kibana-7-10-1-on-firfox/260399 "2021-01-07T04:03:15Z")
I installed elasticsearch with version 7.10.1 and kibana 7.10.1 on my local ubuntu machine. { "name" : "validation-es", "cluster\_name" : "validation-es-cluster", "cluster\_uuid" : "QhjLeuvZQVGA9Str2lc8Wg", "version" … --- ## [Kibana Alert Webhook behind proxy](https://discuss.elastic.co/t/kibana-alert-webhook-behind-proxy/260324)
**Author:** [@aoi1](https://discuss.elastic.co/u/aoi1)\ **Replies:** 2\ **Last updated:** [January 7, 2021, 3:55am UTC](https://discuss.elastic.co/t/kibana-alert-webhook-behind-proxy/260324 "2021-01-07T03:55:15Z")
Hi! I would like to use the Kibana Alert Webhook behind proxy (such as using slack). Is there a way to set proxy using WebUI or yaml? Thanks. --- ## [How to compare the response of elasticsearch query with a list and show final data](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353)
**Author:** [@abhinav3](https://discuss.elastic.co/u/abhinav3)\ **Replies:** 3\ **Last updated:** [January 7, 2021, 2:46am UTC](https://discuss.elastic.co/t/how-to-compare-the-response-of-elasticsearch-query-with-a-list-and-show-final-data/260353 "2021-01-07T02:46:07Z")
I some Json data in elasticsearch. This json data has customer and device in it. I have 2 customer which have multiple devices. I have below query which gives the data for the devices and their customer name: { "aggs"… --- ## [Elasticsearch copy\_to field type](https://discuss.elastic.co/t/elasticsearch-copy-to-field-type/260333)
**Author:** [@Ryze](https://discuss.elastic.co/u/Ryze)\ **Replies:** 2\ **Last updated:** [January 7, 2021, 2:29am UTC](https://discuss.elastic.co/t/elasticsearch-copy-to-field-type/260333 "2021-01-07T02:29:17Z")
I wonder that if the type of destination field of copy\_to must be text type. I have not find the description in the official document. https://www.elastic.co/guide/en/elasticsearch/reference/current/copy-to.html In othe… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1090) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1092)