# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1268 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1269 --- ## [Different query result between http and kibana](https://discuss.elastic.co/t/different-query-result-between-http-and-kibana/246107)
**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 6:33pm UTC](https://discuss.elastic.co/t/different-query-result-between-http-and-kibana/246107 "2020-08-24T18:33:03Z")
Hi experts, I'm trying to undestand something with a query result but I still don't get it... I have a index (td\_movies) with a lot of movies. I want to search for the movies where the title contains "star" or "wars". … --- ## [Forwarding Rsyslog to Logstash](https://discuss.elastic.co/t/forwarding-rsyslog-to-logstash/246162)
**Author:** [@elasticus3r](https://discuss.elastic.co/u/elasticus3r)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 6:31pm UTC](https://discuss.elastic.co/t/forwarding-rsyslog-to-logstash/246162 "2020-08-24T18:31:04Z")
Hello, I am forwarding my rsyslog to Logstash to which I can see traffic coming on 5001 within logstash using tcpdump command: tcpdump -Xni ens192 port 5001 and src \ However, I am not seeing this serv… --- ## [Kibana infinite loop with elastic operator on Kubernetes](https://discuss.elastic.co/t/kibana-infinite-loop-with-elastic-operator-on-kubernetes/246145)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 6:24pm UTC](https://discuss.elastic.co/t/kibana-infinite-loop-with-elastic-operator-on-kubernetes/246145 "2020-08-24T18:24:07Z")
Hi, So I'm facing this issue that seems to be around for a long time and dealt with in different manners, yet, I don't see a way to deal with it when using ECK. Any ideas on how to fix the kibana "infinite loop" (302) w… --- ## [Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/242646)
**Author:** [@star\_trj](https://discuss.elastic.co/u/star_trj)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 6:27pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-error-request-timeout-after-30000ms/242646 "2020-08-24T18:27:27Z")
hi ,i have problem to connect kibana with elasticsearch. my OS is Manjaro and it is Arch base. i install the latest version of elastic & kibana (7.8.0) and try to handle errors, change port or delete kibana and install… --- ## [Query datastream - all shards - how to avoid?](https://discuss.elastic.co/t/query-datastream-all-shards-how-to-avoid/246127)
**Author:** [@abenas](https://discuss.elastic.co/u/abenas)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 5:51pm UTC](https://discuss.elastic.co/t/query-datastream-all-shards-how-to-avoid/246127 "2020-08-24T17:51:20Z")
Hi, We currently use a date pattern in index name to contain a monthly breakdown of documents. In this way, an app can query the right index (or indexes) based on an initial/end date, avoiding hitting all indexes / sha… --- ## [Running custom aggregations in ES](https://discuss.elastic.co/t/running-custom-aggregations-in-es/243213)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 5:31pm UTC](https://discuss.elastic.co/t/running-custom-aggregations-in-es/243213 "2020-08-24T17:31:36Z")
Is it possible to run custom "aggregations" directly db side? I know there are builtin functionalities like averaging etc. But I want to run a custom function on the data that is stored in a specific index. --- ## [Parsing JSON input with multiple arrays as events](https://discuss.elastic.co/t/parsing-json-input-with-multiple-arrays-as-events/246040)
**Author:** [@InnerJoin](https://discuss.elastic.co/u/InnerJoin)\ **Replies:** 6\ **Last updated:** [August 24, 2020, 5:30pm UTC](https://discuss.elastic.co/t/parsing-json-input-with-multiple-arrays-as-events/246040 "2020-08-24T17:30:25Z")
Hi, I am currently using the http\_poller input to pull from an API which is giving me 4 arrays which hold 4 different kinds of events. I am trying to move them all into another array and tag each event so that I know wh… --- ## [Visualizing inactive users](https://discuss.elastic.co/t/visualizing-inactive-users/246057)
**Author:** [@reale](https://discuss.elastic.co/u/reale)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 5:15pm UTC](https://discuss.elastic.co/t/visualizing-inactive-users/246057 "2020-08-24T17:15:44Z")
Hi guys, I'm currently working on Kibana visualization, and I'm stuck in searching the right path to find inactive users. Is there a way to query for users who didn't login in the last x amount of time? Thank you in ad… --- ## [Logstash wildcard](https://discuss.elastic.co/t/logstash-wildcard/246121)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 5:12pm UTC](https://discuss.elastic.co/t/logstash-wildcard/246121 "2020-08-24T17:12:49Z")
Logstash recieves many .log files such as mongod.log and mysqld.log. I deal with it in logstash by having an if statement for each file such as: if \[log\]\[file\]\[path\] =~ "mysqld.log" I've been asked to also ship data fr… --- ## [Request timed out within 30000ms](https://discuss.elastic.co/t/request-timed-out-within-30000ms/245840)
**Author:** [@chaitra\_pc](https://discuss.elastic.co/u/chaitra_pc)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:59pm UTC](https://discuss.elastic.co/t/request-timed-out-within-30000ms/245840 "2020-08-24T16:59:47Z")
I doing a fresh installation of Elastic searh and Kibana. I have elastic search running on default port 9200, however, I am unable to start Kibana. Error: log \[02:00:46.810\] \[info\]\[savedobjects-service\] Waiting unt… --- ## [Create custom tag based filtering criteria and visualise on Kibana](https://discuss.elastic.co/t/create-custom-tag-based-filtering-criteria-and-visualise-on-kibana/245826)
**Author:** [@byc-art](https://discuss.elastic.co/u/byc-art)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:56pm UTC](https://discuss.elastic.co/t/create-custom-tag-based-filtering-criteria-and-visualise-on-kibana/245826 "2020-08-24T16:56:17Z")
Hi, I want to create custom tags to files based on the filtering criteria and visualise these tags on dashboard. For example, I want to label files with 'Shakespear' if the files contain words like 'Hamlet' or 'Macbeth'… --- ## [How to remove unwanted filters in kibana](https://discuss.elastic.co/t/how-to-remove-unwanted-filters-in-kibana/245546)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:55pm UTC](https://discuss.elastic.co/t/how-to-remove-unwanted-filters-in-kibana/245546 "2020-08-24T16:55:25Z")
I am getting below hyperlinks in my kibana when i try to select filters, but i do not want most of them as they do not seem to be relevant, please let me know how they can be removed.. --- ## [How to use search\_after with rest low client api](https://discuss.elastic.co/t/how-to-use-search-after-with-rest-low-client-api/246156)
**Author:** [@abhishek\_chaturvedi](https://discuss.elastic.co/u/abhishek_chaturvedi)\ **Replies:** 0\ **Last updated:** [August 24, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-to-use-search-after-with-rest-low-client-api/246156 "2020-08-24T16:54:16Z")
How to use search\_after in below implementation: String esQuery = String.format(searchTextQuery, startDate, endDate, formattedQueries); request.setJsonEntity(esQuery); String offset = String.valueOf((Integer.parseIn… --- ## [Rest API/Reporting in Kibana 7.4.2](https://discuss.elastic.co/t/rest-api-reporting-in-kibana-7-4-2/245927)
**Author:** [@Ramadevi](https://discuss.elastic.co/u/Ramadevi)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:33pm UTC](https://discuss.elastic.co/t/rest-api-reporting-in-kibana-7-4-2/245927 "2020-08-24T16:33:40Z")
Hi Team, In Kibana 7.4 Version, we could see Reporting and Rest API where as we can't see the feature's with the basic Kibana version(7.4.2) we have. Could you please suggest on this. Thanks & Regards, Ramadevi Edam… --- ## [Kibana partial/substring matches are not working](https://discuss.elastic.co/t/kibana-partial-substring-matches-are-not-working/245844)
**Author:** [@Rakesh\_B](https://discuss.elastic.co/u/Rakesh_B)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:28pm UTC](https://discuss.elastic.co/t/kibana-partial-substring-matches-are-not-working/245844 "2020-08-24T16:28:08Z")
Hi, Setup: Elasticsearch version 7.6.1 field name is log, here is the config in index template: "log": { "type": "text", "fields": { "keyword": { "type": "keyword… --- ## [Logstash http\_poller json parsing error](https://discuss.elastic.co/t/logstash-http-poller-json-parsing-error/245990)
**Author:** [@jerin](https://discuss.elastic.co/u/jerin)\ **Replies:** 19\ **Last updated:** [August 24, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-http-poller-json-parsing-error/245990 "2020-08-24T16:27:26Z")
Hello , I am using http\_poller logstash input plugin to poll rest API ( JIRA ) . When i poll it , these are the sample fields maxresults startAt tags issues Fields under issues issues { fields … --- ## [Matching fields and create new field](https://discuss.elastic.co/t/matching-fields-and-create-new-field/245620)
**Author:** [@Rajesh\_M](https://discuss.elastic.co/u/Rajesh_M)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:11pm UTC](https://discuss.elastic.co/t/matching-fields-and-create-new-field/245620 "2020-08-24T16:11:52Z")
Hi, I have an index with our application logs, which is exported directly to ELK. Below is one of the session log, {"@timestamp": "2020-08-19T13:42:15.236Z", "session": "fdb56d5f", "client": "192.168.1.2", "operation":… --- ## [Numerator ignore global filter](https://discuss.elastic.co/t/numerator-ignore-global-filter/245452)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:08pm UTC](https://discuss.elastic.co/t/numerator-ignore-global-filter/245452 "2020-08-24T16:08:47Z")
Hi, I am creating coverage over time using TSVB using filter ratio. I want the global filter (the control visualization) only filter the numerator, but keep the denominator unchange, so that my client can see different t… --- ## [Monitoring shows no\_data](https://discuss.elastic.co/t/monitoring-shows-no-data/246135)
**Author:** [@Christos\_Gitsis](https://discuss.elastic.co/u/Christos_Gitsis)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 4:00pm UTC](https://discuss.elastic.co/t/monitoring-shows-no-data/246135 "2020-08-24T16:00:11Z")
I have the problem that sometimes the "Monitoring" Tab in Kibana shows me nothing. Sometimes instead of home?\_g=() there is no\_data?\_g() at the end of that URL. (Sometimes I am even surprised to see "no\_data" immediat… --- ## [What is the difference between \_bulk\_get and export](https://discuss.elastic.co/t/what-is-the-difference-between-bulk-get-and-export/245932)
**Author:** [@Redcxx](https://discuss.elastic.co/u/Redcxx)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 3:57pm UTC](https://discuss.elastic.co/t/what-is-the-difference-between-bulk-get-and-export/245932 "2020-08-24T15:57:43Z")
I know export has includeReferencesDeep and \_bulk\_get has fields which makes them different, but is there any difference if I just send a list of type and id to both end points like this? I experiment a little and find … --- ## [Export raw data(that is displayed in Kibana dashboard) to csv](https://discuss.elastic.co/t/export-raw-data-that-is-displayed-in-kibana-dashboard-to-csv/244034)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 4\ **Last updated:** [August 24, 2020, 3:47pm UTC](https://discuss.elastic.co/t/export-raw-data-that-is-displayed-in-kibana-dashboard-to-csv/244034 "2020-08-24T15:47:31Z")
Hi, I want to export all the raw data that is aggregated by all the visualizations and filters in Kibana dashboard (not from Discovery tab) In the following shot you can see that it was supported once but I can't se… --- ## [Painless script too long](https://discuss.elastic.co/t/painless-script-too-long/246043)
**Author:** [@wfeng888](https://discuss.elastic.co/u/wfeng888)\ **Replies:** 2\ **Last updated:** [August 24, 2020, 3:46pm UTC](https://discuss.elastic.co/t/painless-script-too-long/246043 "2020-08-24T15:46:15Z")
When i use painless script, i get the following error: Does this "plugin" mean the elasticsearch built-in aggregation function or something else? --- ## [Kibana Alert for Pod frequently bounded](https://discuss.elastic.co/t/kibana-alert-for-pod-frequently-bounded/243940)
**Author:** [@jinkim59](https://discuss.elastic.co/u/jinkim59)\ **Replies:** 5\ **Last updated:** [August 24, 2020, 3:20pm UTC](https://discuss.elastic.co/t/kibana-alert-for-pod-frequently-bounded/243940 "2020-08-24T15:20:17Z")
I noticed some of pods are getting goes down and new one is created. What is the most suitable way to detect and set an alert for any K8s deployment that one or more of pods get frequently go down and new one created. … --- ## [How to visualize data from different CSV file?](https://discuss.elastic.co/t/how-to-visualize-data-from-different-csv-file/245448)
**Author:** [@atiqah\_yusri](https://discuss.elastic.co/u/atiqah_yusri)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 3:19pm UTC](https://discuss.elastic.co/t/how-to-visualize-data-from-different-csv-file/245448 "2020-08-24T15:19:24Z")
Hi everyone, I already load 2 CSV files into the elasticsearch. so, now I want to visualize them using kibana, but not all data I want to visualize. for example: -csv\_1: have columns name \[Student name, student id, gen… --- ## [Openam acess log grok filter](https://discuss.elastic.co/t/openam-acess-log-grok-filter/245883)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 3:17pm UTC](https://discuss.elastic.co/t/openam-acess-log-grok-filter/245883 "2020-08-24T15:17:19Z")
Hi, Can any please help on and provide the grok pattern for the below logs. i want to get the uid(uid=12398938) in a separate field or if i can get the complete "uid=12398938,ou=people,dc=abcdef,dc=com" in seperate fie… --- ## [Use Logstash to Ingest Entire .txt file](https://discuss.elastic.co/t/use-logstash-to-ingest-entire-txt-file/246141)
**Author:** [@spyderman4g63](https://discuss.elastic.co/u/spyderman4g63)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 3:07pm UTC](https://discuss.elastic.co/t/use-logstash-to-ingest-entire-txt-file/246141 "2020-08-24T15:07:07Z")
Is it possible to ingest the entire contents of a txt file into a field using logstash? I don't want a multiline delimeter. --- ## [Adding tokenizer/patternReplace on phoneNumber using NEST client](https://discuss.elastic.co/t/adding-tokenizer-patternreplace-on-phonenumber-using-nest-client/246142)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 0\ **Last updated:** [August 24, 2020, 3:01pm UTC](https://discuss.elastic.co/t/adding-tokenizer-patternreplace-on-phonenumber-using-nest-client/246142 "2020-08-24T15:01:05Z")
Hi, i have phone numbers in elastic search -\> saved as ,in any of below formats "+46 23234 5656" "0 23234 5656" "23234-5656" "232345656" so if i search for "232345656" i want all 4 results shown above,can anyone te… --- ## [\[Ingest Pipeline\] \[Performance\] Filebeat Cisco module ingest performance](https://discuss.elastic.co/t/ingest-pipeline-performance-filebeat-cisco-module-ingest-performance/246133)
**Author:** [@pcosic](https://discuss.elastic.co/u/pcosic)\ **Replies:** 0\ **Last updated:** [August 24, 2020, 2:13pm UTC](https://discuss.elastic.co/t/ingest-pipeline-performance-filebeat-cisco-module-ingest-performance/246133 "2020-08-24T14:13:52Z")
Hi, I recently tried the Filebeat Cisco module. I tested the module with a 3 Node cluster where all nodes are: dilmrt There is no other data ingested in the Cluster except Filebeat Cisco Asa log syslogs. Every node h… --- ## [Logstash and Grok filter problem with username](https://discuss.elastic.co/t/logstash-and-grok-filter-problem-with-username/246130)
**Author:** [@mcoa](https://discuss.elastic.co/u/mcoa)\ **Replies:** 1\ **Last updated:** [August 24, 2020, 2:16pm UTC](https://discuss.elastic.co/t/logstash-and-grok-filter-problem-with-username/246130 "2020-08-24T14:16:30Z")
Hi, I try parser apache (access\_log) log but i've problem with username section (not capture the complete name), log example: 10.13.252.185 - - \[23/Aug/2020:23:56:14 -0400\] "PROPFIND /remote.php/dav/files/JF009-01/PAP… --- ## [Logstash to Elasticsearch](https://discuss.elastic.co/t/logstash-to-elasticsearch/246034)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 3\ **Last updated:** [August 24, 2020, 2:12pm UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch/246034 "2020-08-24T14:12:43Z")
I'm trying to send data from logstash to ES and I get an error. I can't make much sense of it. This is my logstash output: output{ elasticsearch { hosts =\> \["https://localhost:9200"\] cacert =\> "/etc/elasticsearch/http.c… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1267) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1269)