# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1197 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1198 --- ## [Is a value stored twice when using a tolowercase normalizer on keywords?](https://discuss.elastic.co/t/is-a-value-stored-twice-when-using-a-tolowercase-normalizer-on-keywords/251884)
**Author:** [@DanglingNode](https://discuss.elastic.co/u/DanglingNode)\ **Replies:** 1\ **Last updated:** [October 13, 2020, 10:43am UTC](https://discuss.elastic.co/t/is-a-value-stored-twice-when-using-a-tolowercase-normalizer-on-keywords/251884 "2020-10-13T10:43:15Z")
Hi all, I'm using a 'tolowercase' normalizer upon index (mapping) time to be able to find documents with value 'John Doe' when searching for 'john doe'. Upon index creation: client.Indices.Create( … --- ## [How to optimise heap usage on elasticsearch nodes?](https://discuss.elastic.co/t/how-to-optimise-heap-usage-on-elasticsearch-nodes/251627)
**Author:** [@Nitish\_Goyal](https://discuss.elastic.co/u/Nitish_Goyal)\ **Replies:** 8\ **Last updated:** [October 13, 2020, 10:20am UTC](https://discuss.elastic.co/t/how-to-optimise-heap-usage-on-elasticsearch-nodes/251627 "2020-10-13T10:20:53Z")
We use elasticsearch for analytics and ingest around 3 billions events a day. For this, we create daily indices and each index has a ttl of 30 days. We flush out older indices through a cron job Cluster Size : 200 nodes … --- ## [Can I use elasticsearch 7 with Kibana 6](https://discuss.elastic.co/t/can-i-use-elasticsearch-7-with-kibana-6/251867)
**Author:** [@111320](https://discuss.elastic.co/u/111320)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 10:02am UTC](https://discuss.elastic.co/t/can-i-use-elasticsearch-7-with-kibana-6/251867 "2020-10-13T10:02:49Z")
I have a server with RHEL 6. I saw in the Support Matrix that Kibana 7 is not supported in RHEL 6. Can I use Elasticsearch 7 with Kibana 6? --- ## [Error In Logstash JSON Parsing](https://discuss.elastic.co/t/error-in-logstash-json-parsing/251880)
**Author:** [@rkAyachitula](https://discuss.elastic.co/u/rkAyachitula)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 9:56am UTC](https://discuss.elastic.co/t/error-in-logstash-json-parsing/251880 "2020-10-13T09:56:34Z")
Hi All, I have noticed a log message which is being pumped to elastic search through Logstash JSON filter combined two different messages to a single message. Both of these messages came from different filebeats. What m… --- ## [Process 별 DISK IO 및 Network IO 를 볼수 있을까요?](https://discuss.elastic.co/t/process-disk-io-network-io/251698)
**Author:** [@jongpyo.lee](https://discuss.elastic.co/u/jongpyo.lee)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 9:56am UTC](https://discuss.elastic.co/t/process-disk-io-network-io/251698 "2020-10-13T09:56:14Z")
안녕하세요. Kibana 에서 Process 별 DISK IO 값과 Process 별 Network IO 값을 표시하고 싶습니다. Top N 차트에 Process 별 cpu 사용률은 구할수 있는데, Process 별 DISK IO 값과 Network IO 값을 알수 있는 방법은 없을까요? metricbeat.yml 이나 수정해야하는 파일이 있는것인지요? 수집 대상 OS는 Windows … --- ## [Only want alias field name showing in Kibana visualization aggregation drop down list, and need to hide the actual field name from drop down list](https://discuss.elastic.co/t/only-want-alias-field-name-showing-in-kibana-visualization-aggregation-drop-down-list-and-need-to-hide-the-actual-field-name-from-drop-down-list/251473)
**Author:** [@qub123](https://discuss.elastic.co/u/qub123)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 9:34am UTC](https://discuss.elastic.co/t/only-want-alias-field-name-showing-in-kibana-visualization-aggregation-drop-down-list-and-need-to-hide-the-actual-field-name-from-drop-down-list/251473 "2020-10-13T09:34:44Z")
I have some questions about alias fields in Kibana. I have created a set of aliases on the actual ES field name, like the table below. But in Kibana, I only want to see those alias names ( ES Alias Name column ) appear … --- ## [How to match Elasticsearch timestamp to windows format?](https://discuss.elastic.co/t/how-to-match-elasticsearch-timestamp-to-windows-format/251515)
**Author:** [@Enigmatr](https://discuss.elastic.co/u/Enigmatr)\ **Replies:** 5\ **Last updated:** [October 13, 2020, 9:28am UTC](https://discuss.elastic.co/t/how-to-match-elasticsearch-timestamp-to-windows-format/251515 "2020-10-13T09:28:37Z")
I'm currently trying to parse some logs using Elasticsearch and displaying them on Kibana. I have tried to make sure that the timestamp of the filter in the conf.d file matches the format that is displayed in the log fil… --- ## [Trigger event when file is closed in file-output plugin](https://discuss.elastic.co/t/trigger-event-when-file-is-closed-in-file-output-plugin/251870)
**Author:** [@yogevyuval](https://discuss.elastic.co/u/yogevyuval)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 9:06am UTC](https://discuss.elastic.co/t/trigger-event-when-file-is-closed-in-file-output-plugin/251870 "2020-10-13T09:06:51Z")
Hi, Is it possible to get some kind of an event/trigger/code execution every time the file-output plugin closes a file? The use case is that I want some processing to happen after every file is created, and I was wonde… --- ## [Script\_score query: fvh highlighter doesn't work](https://discuss.elastic.co/t/script-score-query-fvh-highlighter-doesnt-work/248926)
**Author:** [@grob](https://discuss.elastic.co/u/grob)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 8:50am UTC](https://discuss.elastic.co/t/script-score-query-fvh-highlighter-doesnt-work/248926 "2020-10-13T08:50:03Z")
Hi, (ElasticSearch 7.8.0) it looks like script\_score queries in conjunction with fvh highligher and matched\_fields doesn't work. I don't know if i'm missing something, but i couldn't find any do's/don'ts in the documen… --- ## [Lab Enviro Not Working](https://discuss.elastic.co/t/lab-enviro-not-working/243621)
**Author:** [@alexiirf](https://discuss.elastic.co/u/alexiirf)\ **Replies:** 21\ **Last updated:** [October 13, 2020, 8:45am UTC](https://discuss.elastic.co/t/lab-enviro-not-working/243621 "2020-10-13T08:45:41Z")
I recently signed up for the free Kibana for Splunk SPL Users training and tried to setup my lab through Strigo. However, when I log in to strigo, it never brings up a command line. It just shows a blank screen (see sc… --- ## [Unable to start Elasticsearch](https://discuss.elastic.co/t/unable-to-start-elasticsearch/251816)
**Author:** [@prabhukiran](https://discuss.elastic.co/u/prabhukiran)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 8:18am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch/251816 "2020-10-13T08:18:01Z")
I've installed Elasticsearch on a clean, new, updated build of CentOS (7.7.1908). This installation is in support of a Wazuh installation using instructions found here: https://documentation.wazuh.com/3.10/installation-… --- ## [Query with two date range filters 8x slower than an equivalent query with one?](https://discuss.elastic.co/t/query-with-two-date-range-filters-8x-slower-than-an-equivalent-query-with-one/251804)
**Author:** [@adamleonard](https://discuss.elastic.co/u/adamleonard)\ **Replies:** 1\ **Last updated:** [October 13, 2020, 8:06am UTC](https://discuss.elastic.co/t/query-with-two-date-range-filters-8x-slower-than-an-equivalent-query-with-one/251804 "2020-10-13T08:06:36Z")
We recently added a query that had two date range filters applied for the same field, in short, if dates X, Y, and Z are sorted chronologically, the query was: "Date between X and Y" "Date before Z" This query is of c… --- ## [Kibana error randomly](https://discuss.elastic.co/t/kibana-error-randomly/249471)
**Author:** [@Gentle-Chen](https://discuss.elastic.co/u/Gentle-Chen)\ **Replies:** 7\ **Last updated:** [October 13, 2020, 8:03am UTC](https://discuss.elastic.co/t/kibana-error-randomly/249471 "2020-10-13T08:03:53Z")
Hi, I am upgrading Kibana from 6.0 to 7.2.1, and it works fine after upgraded, but i found it often shutdown randomly with below error, do you have any idea? events.js:174 throw er; // Unhandled 'error' event … --- ## [Failed to parse field \[coordinates\] of type \[geo\_shape\]](https://discuss.elastic.co/t/failed-to-parse-field-coordinates-of-type-geo-shape/251305)
**Author:** [@davidb1](https://discuss.elastic.co/u/davidb1)\ **Replies:** 6\ **Last updated:** [October 13, 2020, 7:36am UTC](https://discuss.elastic.co/t/failed-to-parse-field-coordinates-of-type-geo-shape/251305 "2020-10-13T07:36:02Z")
I'm using Kibana to upload a geojson to Elasticsearch. It loads and shows up without problems but when I try to index it I get: { "success": true, "failures": \[ { "item": 0, "reason": "failed to pars… --- ## [Logstash ruby time difference appends date\_time](https://discuss.elastic.co/t/logstash-ruby-time-difference-appends-date-time/251857)
**Author:** [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 7:31am UTC](https://discuss.elastic.co/t/logstash-ruby-time-difference-appends-date-time/251857 "2020-10-13T07:31:01Z")
Hello, Am trying to get the difference between two time fields in my logstash ruby filter and when the difference in ingested to elasticsearch I see date\_time appended to the value of the difference. Any possible way we… --- ## [Context Suggester Input Generation: How to optimize \_analyze call over large no. of documents](https://discuss.elastic.co/t/context-suggester-input-generation-how-to-optimize-analyze-call-over-large-no-of-documents/251853)
**Author:** [@Bhavik92](https://discuss.elastic.co/u/Bhavik92)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 7:02am UTC](https://discuss.elastic.co/t/context-suggester-input-generation-how-to-optimize-analyze-call-over-large-no-of-documents/251853 "2020-10-13T07:02:18Z")
We are using Context suggester on our documents to support autocompletion. However, since Context suggester does not support shingle analyzer out of the box, we're trying to generate shingles ourselves. Our custom analy… --- ## [ElasticSearch 7.7.1 Connection issues with Windows Server 2019 vs Windows Server 2012 R2](https://discuss.elastic.co/t/elasticsearch-7-7-1-connection-issues-with-windows-server-2019-vs-windows-server-2012-r2/251818)
**Author:** [@aurelio.rama](https://discuss.elastic.co/u/aurelio.rama)\ **Replies:** 7\ **Last updated:** [October 13, 2020, 6:39am UTC](https://discuss.elastic.co/t/elasticsearch-7-7-1-connection-issues-with-windows-server-2019-vs-windows-server-2012-r2/251818 "2020-10-13T06:39:52Z")
I am running the ElasticSearch service fine on Windows 2012 R2 and when performing netstat I see :\\Windows\\system32\>netstat -ano | find ":9200" TCP 0.0.0.0:9200 0.0.0.0:0 LISTENING 2276 … --- ## [Discover: How to show last occurrence?](https://discuss.elastic.co/t/discover-how-to-show-last-occurrence/251700)
**Author:** [@nameisnotimportant](https://discuss.elastic.co/u/nameisnotimportant)\ **Replies:** 3\ **Last updated:** [October 13, 2020, 5:58am UTC](https://discuss.elastic.co/t/discover-how-to-show-last-occurrence/251700 "2020-10-13T05:58:39Z")
Hi, \[edit\] my ELK version: 7.8.0 I am able to get the last occurrence of my data in the console as following: However, when i copy the code to Discover, it return 5 results: May i know how do i get Discover to di… --- ## [Host statistics](https://discuss.elastic.co/t/host-statistics/251843)
**Author:** [@anjana1](https://discuss.elastic.co/u/anjana1)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 5:25am UTC](https://discuss.elastic.co/t/host-statistics/251843 "2020-10-13T05:25:36Z")
Kibana version : 7.9 Elasticsearch version : 7.9 APM Server version : 7.9 APM Agent language and version : java 1.8 Fresh install or upgraded from other version? fresh install Is there anything special in your … --- ## [Is there any possibilite to access the nested arrays in json input data to show it in kibana charts](https://discuss.elastic.co/t/is-there-any-possibilite-to-access-the-nested-arrays-in-json-input-data-to-show-it-in-kibana-charts/251711)
**Author:** [@chaithanya\_sivapuram](https://discuss.elastic.co/u/chaithanya_sivapuram)\ **Replies:** 2\ **Last updated:** [October 13, 2020, 4:29am UTC](https://discuss.elastic.co/t/is-there-any-possibilite-to-access-the-nested-arrays-in-json-input-data-to-show-it-in-kibana-charts/251711 "2020-10-13T04:29:16Z")
{ "freqIteration": \[ { "frequency": "2.4GHz", "channel": "1", "antenna": "2x2", "bandwidth": "40MHz", "rawData": \[ { "angle": "0", "testLocation": "10", … --- ## [What value to be used for max\_num\_segments for Es 7.9 when we do force merge? is it a permanent change or the segment no will go increasing once we start writing to the index again?](https://discuss.elastic.co/t/what-value-to-be-used-for-max-num-segments-for-es-7-9-when-we-do-force-merge-is-it-a-permanent-change-or-the-segment-no-will-go-increasing-once-we-start-writing-to-the-index-again/251839)
**Author:** [@GauriA](https://discuss.elastic.co/u/GauriA)\ **Replies:** 0\ **Last updated:** [October 13, 2020, 4:25am UTC](https://discuss.elastic.co/t/what-value-to-be-used-for-max-num-segments-for-es-7-9-when-we-do-force-merge-is-it-a-permanent-change-or-the-segment-no-will-go-increasing-once-we-start-writing-to-the-index-again/251839 "2020-10-13T04:25:21Z")
I am upgrading ES 1.4.2 to ES 7.9. For that I had to do remote indexing by re-indexing API to get all the data from old cluster to new cluster. But after re-indexning the search query performance of ES 7.9 got decreased … --- ## [Kibana iframe Loading time](https://discuss.elastic.co/t/kibana-iframe-loading-time/251787)
**Author:** [@RBT](https://discuss.elastic.co/u/RBT)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:44pm UTC](https://discuss.elastic.co/t/kibana-iframe-loading-time/251787 "2020-10-12T23:44:14Z")
Hi, I am using Kibana dashboard in iframe of UI. Its taking more time to load the dashboard in embedded iframe. Could you please suggest to load the kibana dashboard quicker in embedded iframe. --- ## [How to disable(prune) meta data related fields in the dashboard](https://discuss.elastic.co/t/how-to-disable-prune-meta-data-related-fields-in-the-dashboard/251765)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:37pm UTC](https://discuss.elastic.co/t/how-to-disable-prune-meta-data-related-fields-in-the-dashboard/251765 "2020-10-12T23:37:06Z")
I am currently preparing dashboard for my Business Users (who are not used to Kibana) and was wondering if I can disable(hide, prune) some attributes from the dashboard view-ed content. In the below image if you see, th… --- ## [Kibana server is not ready yet after upgrading from 6.2.3. to 6.8.0](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-upgrading-from-6-2-3-to-6-8-0/251760)
**Author:** [@Mehrdad\_Hosseinian](https://discuss.elastic.co/u/Mehrdad_Hosseinian)\ **Replies:** 1\ **Last updated:** [October 12, 2020, 11:17pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet-after-upgrading-from-6-2-3-to-6-8-0/251760 "2020-10-12T23:17:51Z")
Hi, I upgrade kibana fro version 6.2.3 to 6.8.0 but after upgrade I get "Kibana server is not ready yet". Under upgrading to new version I keeped kibana.yml. I don't get any error during the upgrading. --- ## [Plot grouped and normalized values on bar chart?](https://discuss.elastic.co/t/plot-grouped-and-normalized-values-on-bar-chart/249087)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 2\ **Last updated:** [October 12, 2020, 10:49pm UTC](https://discuss.elastic.co/t/plot-grouped-and-normalized-values-on-bar-chart/249087 "2020-10-12T22:49:18Z")
Hi, I collect the exit status for sessions reported by many IOT-devices. To get an overview, I would like to group a few of the statuses and then plot them on a bar chart. On the X axis I want to have the SW version the… --- ## [Action\_snapshot error](https://discuss.elastic.co/t/action-snapshot-error/251820)
**Author:** [@ANILL\_KUMAR](https://discuss.elastic.co/u/ANILL_KUMAR)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 10:36pm UTC](https://discuss.elastic.co/t/action-snapshot-error/251820 "2020-10-12T22:36:48Z")
Hi, I'm configuring curator to take snapshot, but failing to do so. ending up with a PARTIAL error. our cluster is with 5 master nodes, 18 data nodes. sharing nfs data domain. curator log is below 2020-10-12 22:20:2… --- ## [Implementing Update by Query in Logstash](https://discuss.elastic.co/t/implementing-update-by-query-in-logstash/251813)
**Author:** [@NomadicCodeGuy](https://discuss.elastic.co/u/NomadicCodeGuy)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 8:47pm UTC](https://discuss.elastic.co/t/implementing-update-by-query-in-logstash/251813 "2020-10-12T20:47:32Z")
I am attempting to use Update by Query with logstash to copy a field \[scenario\] from entries that share the same field \[file\]. I am implementing the solution described by badger in this thread: https://discuss.elastic.co… --- ## [Rollover not happening after ilm policy set](https://discuss.elastic.co/t/rollover-not-happening-after-ilm-policy-set/251812)
**Author:** [@venku](https://discuss.elastic.co/u/venku)\ **Replies:** 0\ **Last updated:** [October 12, 2020, 8:47pm UTC](https://discuss.elastic.co/t/rollover-not-happening-after-ilm-policy-set/251812 "2020-10-12T20:47:28Z")
Hi, I am trying to setup an ilm policy for the index. I created the policy and attached it to the template. Used the same template in the logstash output. But I don't see the rollover happening. For testing purpose I ha… --- ## [Need help to mask XML elements](https://discuss.elastic.co/t/need-help-to-mask-xml-elements/251354)
**Author:** [@tgkumarmca](https://discuss.elastic.co/u/tgkumarmca)\ **Replies:** 4\ **Last updated:** [October 12, 2020, 8:28pm UTC](https://discuss.elastic.co/t/need-help-to-mask-xml-elements/251354 "2020-10-12T20:28:56Z")
Hello, I'm actually stuck to perform the masking! I would request you to help in this regard I need to perform masking of some sensitive data(like card number, account number, etc) from the input XML message. I am cur… --- ## [Elastic 7.9.1 - Security (SIEM) - Your visualization has error(s) - \[illegal\_argument\_exception\]](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265)
**Author:** [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\ **Replies:** 15\ **Last updated:** [October 12, 2020, 8:05pm UTC](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265 "2020-10-12T20:05:40Z")
Hi, We have a brand new cluster install to test 7.9.1 and the security features in particular. When navigating to the Overview page we get the following error. \[illegal\_argument\_exception\] Text fields are not optimise… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1196) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1198)