# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1145 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1146 --- ## [Get datepart from @timestamp in 7.1](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752)
**Author:** [@himanshur](https://discuss.elastic.co/u/himanshur)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:09pm UTC](https://discuss.elastic.co/t/get-datepart-from-timestamp-in-7-1/255752 "2020-11-19T19:09:23Z")
I am trying to get the date part from the @timestamp field in 7.1. Looks like all the date functions were introduced in 7.5. Is there a way I can get the date part using SQL in Kibana Trying the below query SELECT dat… --- ## [Time Series Sum aggregation](https://discuss.elastic.co/t/time-series-sum-aggregation/255770)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 7:03pm UTC](https://discuss.elastic.co/t/time-series-sum-aggregation/255770 "2020-11-19T19:03:07Z")
I have a series of endpoint readings each containing an integer value as read at that point in time (on the hour) and I am trying to generate a time series sum aggregation. I want to view it for a year but I want to kee… --- ## [Kibana metric visualization - Get Inner hits count](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781)
**Author:** [@Abhilash\_Sathe](https://discuss.elastic.co/u/Abhilash_Sathe)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:59pm UTC](https://discuss.elastic.co/t/kibana-metric-visualization-get-inner-hits-count/255781 "2020-11-19T18:59:53Z")
Here's my code to get inner hits count. GET my\_index/\_search { "\_source": \[ "inner\_hits" \], "query": { "nested": { "path": "someNestedK… --- ## [Grok cant detect change of line](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 7:36am UTC](https://discuss.elastic.co/t/grok-cant-detect-change-of-line/255796 "2020-11-18T07:36:45Z")
Hello all, I have the following file that i want to grok: AG 100045 1FB702 27.12.2011 675337068 ZFA31200000...... AG 100045 X 17.11.1961 084260332 5352... AG 100046 1SF995 22.04.2016 217347660 TMBET6NH1G4...... AG 1… --- ## [Bucket key/item counting](https://discuss.elastic.co/t/bucket-key-item-counting/255826)
**Author:** [@sam7](https://discuss.elastic.co/u/sam7)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 6:54pm UTC](https://discuss.elastic.co/t/bucket-key-item-counting/255826 "2020-11-19T18:54:45Z")
Hello, I have a bucket that looks like this: { "took" : 0, "timed\_out" : false, "\_shards" : { "total" : 1, "successful" : 1, "skipped" : 0, "failed" : 0 }, "hits" : { "total" : { "va… --- ## [External IPs - Kibana Dashboard - Version 7.9.1](https://discuss.elastic.co/t/external-ips-kibana-dashboard-version-7-9-1/255337)
**Author:** [@krinfra](https://discuss.elastic.co/u/krinfra)\ **Replies:** 25\ **Last updated:** [November 19, 2020, 6:45pm UTC](https://discuss.elastic.co/t/external-ips-kibana-dashboard-version-7-9-1/255337 "2020-11-19T18:45:55Z")
Good Morning. I have a problem with Kibana. I need my Kibana to be able to bring the external IPs, it can only show internal IPs on my dashboards. A friend said that I have to log the External IP into my index for this … --- ## [Elasticsearch 7.7.1 shards getting unassigned](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 6:37pm UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-shards-getting-unassigned/256006 "2020-11-19T18:37:53Z")
We recently upgraded our elasticsearch cluster from 5.6.16 to 7.7.1. After that sometimes I am observing that few of the shards not getting assigned. My node stats is placed here. The allocation explanation for an una… --- ## [How many users' traffic can be handled by one kibana instance?](https://discuss.elastic.co/t/how-many-users-traffic-can-be-handled-by-one-kibana-instance/255932)
**Author:** [@DSMilestone](https://discuss.elastic.co/u/DSMilestone)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 5:25pm UTC](https://discuss.elastic.co/t/how-many-users-traffic-can-be-handled-by-one-kibana-instance/255932 "2020-11-19T17:25:33Z")
we have implemented a ES cluster with 4 nodes; out of 4, 3 nodes are master eligible nodes and also those nodes are data nodes, 4th node is a data node and also marked as a ingest node. We use this cluster for logs. We … --- ## [How to Restore snapshop from 5 node cluster to single node host?](https://discuss.elastic.co/t/how-to-restore-snapshop-from-5-node-cluster-to-single-node-host/255761)
**Author:** [@elkdummy](https://discuss.elastic.co/u/elkdummy)\ **Replies:** 21\ **Last updated:** [November 19, 2020, 5:24pm UTC](https://discuss.elastic.co/t/how-to-restore-snapshop-from-5-node-cluster-to-single-node-host/255761 "2020-11-19T17:24:22Z")
Hello all, I am trying to restore a snapshot from a 5 node v6.8 to a single v7.9 host. When restoring the snapshot it finishes almost instantly. So no data was imported as its 166gb snapshot. My status goes red and sho… --- ## [How to make the "Save Search" as the dafault page in "Discover"](https://discuss.elastic.co/t/how-to-make-the-save-search-as-the-dafault-page-in-discover/256021)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 5:23pm UTC](https://discuss.elastic.co/t/how-to-make-the-save-search-as-the-dafault-page-in-discover/256021 "2020-11-19T17:23:54Z")
Hi, I have created a "Save Search" in the Kibana's "Discover" mode with the table view of one of the index. But everytime when I click the "Discover" tab, it will not give me my Save Search. And I need to open it from O… --- ## [Problem with split add field](https://discuss.elastic.co/t/problem-with-split-add-field/256018)
**Author:** [@gius78](https://discuss.elastic.co/u/gius78)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 5:17pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018 "2020-11-19T17:17:15Z")
Hello, I am using logstash 7.6.2 I am trying to parse a CEF log, separated by pipes "|" I've done: mutate { copy =\> { "cefmessage" =\> "tmp\_message" } split =\> { "tmp\_message" =\> "|" } … --- ## [Kibana creating bar visualization with different filters on each bar, y axis advanced option json input](https://discuss.elastic.co/t/kibana-creating-bar-visualization-with-different-filters-on-each-bar-y-axis-advanced-option-json-input/256013)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 4:27pm UTC](https://discuss.elastic.co/t/kibana-creating-bar-visualization-with-different-filters-on-each-bar-y-axis-advanced-option-json-input/256013 "2020-11-19T16:27:34Z")
Hi, I would like to create a bar chart looks like below. But each bar in the bar chart will need to have different filters. For example, one of the bar call record\_id, and this bar need to have filter in the filter 1, a… --- ## [Session Count per number of Transactions](https://discuss.elastic.co/t/session-count-per-number-of-transactions/255959)
**Author:** [@Max\_Handle](https://discuss.elastic.co/u/Max_Handle)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 4:14pm UTC](https://discuss.elastic.co/t/session-count-per-number-of-transactions/255959 "2020-11-19T16:14:14Z")
Hi, I am trying to solve the following problem with little success so far concerning Barcharts: X-axis --\> Number of rows per Session Y-axis --\> Count of Sessions So it would look something like this: There are 4 … --- ## [Kibana fails to start after 7.9.3 -\> 7.10.0 upgrade](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737)
**Author:** [@OrangeDog](https://discuss.elastic.co/u/OrangeDog)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 4:10pm UTC](https://discuss.elastic.co/t/kibana-fails-to-start-after-7-9-3-7-10-0-upgrade/255737 "2020-11-19T16:10:23Z")
Just updated Elastic stack from 7.9.3 to 7.10 and now kibana fails to start. I didn't notice anything in breaking changes that would apply. License is Basic, authentication is not used. \[16:24:26.937\] \[error\]\[data\]\[e… --- ## [Influxdb ( Victoria Metrics ) Error + Filtering Logstash ( remove - split )](https://discuss.elastic.co/t/influxdb-victoria-metrics-error-filtering-logstash-remove-split/255994)
**Author:** [@recepbalibey](https://discuss.elastic.co/u/recepbalibey)\ **Replies:** 7\ **Last updated:** [November 19, 2020, 3:29pm UTC](https://discuss.elastic.co/t/influxdb-victoria-metrics-error-filtering-logstash-remove-split/255994 "2020-11-19T15:29:12Z")
Here is only one example from my JSON file \>\> {"host":"ABCDEFASD","groups":\["ABVD","TEST"\],"applications": \["NETWORK"\],"itemid":143172,"name":"Operational status of interface Se0/1/0:17","clock":1604283792,"ns":92656332… --- ## [\_grokparsefailure](https://discuss.elastic.co/t/grokparsefailure/255996)
**Author:** [@Jurilz](https://discuss.elastic.co/u/Jurilz)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 2:51pm UTC](https://discuss.elastic.co/t/grokparsefailure/255996 "2020-11-19T14:51:03Z")
Good day. I'm trying to parse tomcat logs with logstash using the filebeat input plugin. My log-files look like: 2020-11-19 11:34:40,260 \[thread0-exec-1\] WARN org.springframework.web.servlet.PageNotFound - Request me… --- ## [How gsub parse the log line](https://discuss.elastic.co/t/how-gsub-parse-the-log-line/255803)
**Author:** [@msk\_76](https://discuss.elastic.co/u/msk_76)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 2:32pm UTC](https://discuss.elastic.co/t/how-gsub-parse-the-log-line/255803 "2020-11-19T14:32:12Z")
I have a log file in json format having values and corresponding sub-values till 2 levels. All are encapsulated with double quotes. Normally the log is having simple key-value pairs having key and values encapsulated wit… --- ## [Create a conf file using grok or json filter](https://discuss.elastic.co/t/create-a-conf-file-using-grok-or-json-filter/255903)
**Author:** [@Omair](https://discuss.elastic.co/u/Omair)\ **Replies:** 5\ **Last updated:** [November 19, 2020, 2:09pm UTC](https://discuss.elastic.co/t/create-a-conf-file-using-grok-or-json-filter/255903 "2020-11-19T14:09:23Z")
Hi.. I'm new to elastic stack and trying to learn using filters to structure my data but unfortunately not getting much help. Below is the application log 2020-11-19T00:08:34.627+0500 INFO 141799 com.l7tech.server.p… --- ## [Correct way to reboot a node in 7.x cluster while data updates are happening](https://discuss.elastic.co/t/correct-way-to-reboot-a-node-in-7-x-cluster-while-data-updates-are-happening/253166)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 2:00pm UTC](https://discuss.elastic.co/t/correct-way-to-reboot-a-node-in-7-x-cluster-while-data-updates-are-happening/253166 "2020-11-19T14:00:53Z")
Hi.. If the cluster with N nodes \[at least 10\] is getting constant data updates, how can one gracefully reboot a given node\[for any maintenance work\] that is master+data node? We do not want to loose any incoming update… --- ## [Elasitic Engineer 2 - Elastic Training](https://discuss.elastic.co/t/elasitic-engineer-2-elastic-training/255839)
**Author:** [@chris3](https://discuss.elastic.co/u/chris3)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 1:53pm UTC](https://discuss.elastic.co/t/elasitic-engineer-2-elastic-training/255839 "2020-11-19T13:53:01Z")
Hi, Wonder if you might be able to provide a bit of assistance. I was completing 4.3 on Elastic Engineer 2, near the bottom it asks to change cluster.routing.allocation to force shard awareness based on which rack a no… --- ## [In Kibana dashboard, latest logs are not showing](https://discuss.elastic.co/t/in-kibana-dashboard-latest-logs-are-not-showing/255993)
**Author:** [@shajimsh](https://discuss.elastic.co/u/shajimsh)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 1:35pm UTC](https://discuss.elastic.co/t/in-kibana-dashboard-latest-logs-are-not-showing/255993 "2020-11-19T13:35:39Z")
Team, Even though we have latest records in the table, we are not able to see these latest records in kibana dashboard, below is the logstash jdbc query for fetching latest record. But it was working properly previously… --- ## [Error after restarting the elasticsearch pod managed by ECK](https://discuss.elastic.co/t/error-after-restarting-the-elasticsearch-pod-managed-by-eck/255935)
**Author:** [@Vineeth\_varma](https://discuss.elastic.co/u/Vineeth_varma)\ **Replies:** 6\ **Last updated:** [November 19, 2020, 1:16pm UTC](https://discuss.elastic.co/t/error-after-restarting-the-elasticsearch-pod-managed-by-eck/255935 "2020-11-19T13:16:49Z")
I am currently using ECK version 1.2 and Elasticsearch version 7.10.0 managed by ECK. I have restarted one of the elasticsearch pods and I am getting the below errors after pod has restarted. kubectl logs -n eo elastic-… --- ## [Logstash help with pattern for grok needed](https://discuss.elastic.co/t/logstash-help-with-pattern-for-grok-needed/255518)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 1:02pm UTC](https://discuss.elastic.co/t/logstash-help-with-pattern-for-grok-needed/255518 "2020-11-19T13:02:32Z")
Hello, I am trying to parse some data which is in one of the two following formats: Sample data: Data from service service-a loaded Data from service service-b not loaded With the following Grok Pattern: Data from se… --- ## [Is there a way to customise the order of the x axis values in visualisations](https://discuss.elastic.co/t/is-there-a-way-to-customise-the-order-of-the-x-axis-values-in-visualisations/254912)
**Author:** [@casreenath](https://discuss.elastic.co/u/casreenath)\ **Replies:** 4\ **Last updated:** [November 19, 2020, 12:26pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-customise-the-order-of-the-x-axis-values-in-visualisations/254912 "2020-11-19T12:26:57Z")
The order of the x-axis seems to not match my requirement. Is there a way I can customise it to the order I need. I basically want the values to be sorted and the value 'imix' to be at the end. --- ## [Does DELETE /\_all actually erase data from disk?](https://discuss.elastic.co/t/does-delete-all-actually-erase-data-from-disk/255973)
**Author:** [@mahalabobis](https://discuss.elastic.co/u/mahalabobis)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 12:13pm UTC](https://discuss.elastic.co/t/does-delete-all-actually-erase-data-from-disk/255973 "2020-11-19T12:13:43Z")
What does the below request mean? curl -X DELETE http://elasticsearch:9200/\_all Does it erase data from disk? If not how can I achieve this? --- ## [Spring StringQuery not working while actual query directly works on postman](https://discuss.elastic.co/t/spring-stringquery-not-working-while-actual-query-directly-works-on-postman/255882)
**Author:** [@satyarajp](https://discuss.elastic.co/u/satyarajp)\ **Replies:** 2\ **Last updated:** [November 19, 2020, 12:07pm UTC](https://discuss.elastic.co/t/spring-stringquery-not-working-while-actual-query-directly-works-on-postman/255882 "2020-11-19T12:07:19Z")
I'm migrating our native to springboot+java and am stuck here with this search. Didn't find much examples around web also. { "query": output in log below} I'm getting output in postman. Yet the actual java code retu… --- ## [How to search without punctuations when the document has punctuations](https://discuss.elastic.co/t/how-to-search-without-punctuations-when-the-document-has-punctuations/255983)
**Author:** [@Trupti\_Shet](https://discuss.elastic.co/u/Trupti_Shet)\ **Replies:** 0\ **Last updated:** [November 19, 2020, 12:03pm UTC](https://discuss.elastic.co/t/how-to-search-without-punctuations-when-the-document-has-punctuations/255983 "2020-11-19T12:03:51Z")
When I search for Brother's I can see the exact document in suggestions I am searching for. What do I do if I wish to see the exact same suggestion after typing Brother or Brothers. --- ## [Upgrading from Basic to Gold license](https://discuss.elastic.co/t/upgrading-from-basic-to-gold-license/255975)
**Author:** [@linfordwoode](https://discuss.elastic.co/u/linfordwoode)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 11:44am UTC](https://discuss.elastic.co/t/upgrading-from-basic-to-gold-license/255975 "2020-11-19T11:44:59Z")
Hello Community, I have an elk stack with 1 node each for Elasticsearch, Logstash, and Kibana with a basic license. I am thinking of upgrading from a basic license to gold. Are there any prerequisites or requirements th… --- ## [Parsing logs with logstash](https://discuss.elastic.co/t/parsing-logs-with-logstash/255960)
**Author:** [@Falikou1](https://discuss.elastic.co/u/Falikou1)\ **Replies:** 1\ **Last updated:** [November 19, 2020, 10:58am UTC](https://discuss.elastic.co/t/parsing-logs-with-logstash/255960 "2020-11-19T10:58:25Z")
I need to help on the parsing of my logs. This is my parser: input{ tcp { port =\> "5140" tags =\> "syslog" } } filter { grok { match =\> { "message" =\> "%{SYSLOG5424PRI:syslog\_index}%{SYSLOGHOST:syslog\_host} %{GR… --- ## [Anyone, Help me about vizualization with my log pattern!](https://discuss.elastic.co/t/anyone-help-me-about-vizualization-with-my-log-pattern/255871)
**Author:** [@quangdv.6466](https://discuss.elastic.co/u/quangdv.6466)\ **Replies:** 3\ **Last updated:** [November 19, 2020, 10:40am UTC](https://discuss.elastic.co/t/anyone-help-me-about-vizualization-with-my-log-pattern/255871 "2020-11-19T10:40:56Z")
Hi there! Here is my complete configuration of the elk stack for my stub. Log example: Filebeat configuration: Logstash configuration: Fields auto define on kibana: And here is result on my Kibana… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1144) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1146)