# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1278 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1279 --- ## [Heatmap Derivative aggregation not available](https://discuss.elastic.co/t/heatmap-derivative-aggregation-not-available/244924)
**Author:** [@ulfsa](https://discuss.elastic.co/u/ulfsa)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 8:30am UTC](https://discuss.elastic.co/t/heatmap-derivative-aggregation-not-available/244924 "2020-08-18T08:30:32Z")
I enjoy using Heatmaps to visualize (non) change. In a heatmap of a thousand cells, the human eye can immediately spot any outliers. I would like to visualize the delta of log data such as total bytes written. I would a… --- ## [Red Cluster State: failed to create shard, failure IOException\[failed to obtain in-memory shard lock\]](https://discuss.elastic.co/t/red-cluster-state-failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/245345)
**Author:** [@Asad.Anwar](https://discuss.elastic.co/u/Asad.Anwar)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 5:07am UTC](https://discuss.elastic.co/t/red-cluster-state-failed-to-create-shard-failure-ioexception-failed-to-obtain-in-memory-shard-lock/245345 "2020-08-18T05:07:05Z")
Hi Team, We have 8 node cluster, where we noticed 2 shards were unassigned last week. We tried this command GET : /\_cluster/allocation/explain?pretty and got below explanation- { "index": "v20-con\*\*\*\*\*", "shard": 2, … --- ## [Shard Allocation Failed - Even Manually](https://discuss.elastic.co/t/shard-allocation-failed-even-manually/245357)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 8:20am UTC](https://discuss.elastic.co/t/shard-allocation-failed-even-manually/245357 "2020-08-18T08:20:35Z")
Hey, a few weeks ago we hit the 10k shard limit in our cluster, the problem is solved now but since then we have problems with 256 replica shards which are unassigned. It is also not possible the reassign the shards, se… --- ## [DataTable visualization order by timestamp, desending](https://discuss.elastic.co/t/datatable-visualization-order-by-timestamp-desending/245068)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 8:18am UTC](https://discuss.elastic.co/t/datatable-visualization-order-by-timestamp-desending/245068 "2020-08-18T08:18:36Z")
Hi, Im trying to order a data table visualization by timestamp,but always one row is misplaced, ( i solve this clicking in the arrow of the header of the row) and often I get missing rows when I compare it with discover. … --- ## [Is there a limit for the msearch?](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361)
**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\ **Replies:** 5\ **Last updated:** [August 18, 2020, 8:11am UTC](https://discuss.elastic.co/t/is-there-a-limit-for-the-msearch/245361 "2020-08-18T08:11:50Z")
i tried getting results from elastic\_client.search and elastic\_client.msearch and both returns different amount of results. and elastic\_client.search returns the most accurate result --- ## [Is possible to make a kibana data visualization like this](https://discuss.elastic.co/t/is-possible-to-make-a-kibana-data-visualization-like-this/244642)
**Author:** [@FranB](https://discuss.elastic.co/u/FranB)\ **Replies:** 3\ **Last updated:** [August 18, 2020, 8:01am UTC](https://discuss.elastic.co/t/is-possible-to-make-a-kibana-data-visualization-like-this/244642 "2020-08-18T08:01:56Z")
Hello, i'm triying to make a visualization that take 3 numbers from fileds in my index ej: total\_amount : "500" approved\_amount: "400" rejected\_amount: "100" i want to know if is possible to make one visualization wher… --- ## [Why doesn't Elastic Cloud allow multiple data nodes unless its RAM is the highest?](https://discuss.elastic.co/t/why-doesnt-elastic-cloud-allow-multiple-data-nodes-unless-its-ram-is-the-highest/245367)
**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 7:57am UTC](https://discuss.elastic.co/t/why-doesnt-elastic-cloud-allow-multiple-data-nodes-unless-its-ram-is-the-highest/245367 "2020-08-18T07:57:48Z")
I'm new to Elasticsearch, and calculating the price when I use Elastic Cloud. I noticed that I can use multiple data nodes only when I use data nodes with the highest RAM settings. https://cloud.elastic.co/pricing W… --- ## [Aggregating the sum of sub-aggregation](https://discuss.elastic.co/t/aggregating-the-sum-of-sub-aggregation/245363)
**Author:** [@opentree](https://discuss.elastic.co/u/opentree)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 6:53am UTC](https://discuss.elastic.co/t/aggregating-the-sum-of-sub-aggregation/245363 "2020-08-18T06:53:05Z")
I've been trying to put together an aggregation on what I would call an "intermediate bucket" (aggregating the total of a bucket). The data is coming from packetbeat, where I'm trying to aggregate the total number bytes… --- ## [Max\_concurrent\_shard\_request per node](https://discuss.elastic.co/t/max-concurrent-shard-request-per-node/245359)
**Author:** [@hamid\_bayat](https://discuss.elastic.co/u/hamid_bayat)\ **Replies:** 0\ **Last updated:** [August 18, 2020, 6:48am UTC](https://discuss.elastic.co/t/max-concurrent-shard-request-per-node/245359 "2020-08-18T06:48:08Z")
Hi I have read the elasticsearch document search API and understand Max\_concurrent\_shard\_request is used to control the maximum number of concurrent shard requests the search API will execute per node for the (per?) req… --- ## [Как удалить fields которые экспортирует Filebeat (7.8) в logstash?](https://discuss.elastic.co/t/fields-filebeat-7-8-logstash/244401)
**Author:** [@xXxTRexXx](https://discuss.elastic.co/u/xXxTRexXx)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 6:40am UTC](https://discuss.elastic.co/t/fields-filebeat-7-8-logstash/244401 "2020-08-18T06:40:39Z")
нужно отсюда удалить поле fields со всем его содержимым. вот как я пытался это сделать. У меня не получилось как видно, никто не может подсказать где я ошибся? --- ## [How to run Logstash Multiple Pipelines?](https://discuss.elastic.co/t/how-to-run-logstash-multiple-pipelines/245346)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 6:31am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-pipelines/245346 "2020-08-18T06:31:19Z")
I configured pipelines.yml file as shown as the image and i created two logstash conf files. I want to know how to run multiple pipelines. --- ## [Nested query within single index](https://discuss.elastic.co/t/nested-query-within-single-index/244937)
**Author:** [@j3grewal](https://discuss.elastic.co/u/j3grewal)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 5:52am UTC](https://discuss.elastic.co/t/nested-query-within-single-index/244937 "2020-08-18T05:52:13Z")
Hi, Is there support for nested queries within a single index. I'll try to explain in SQL terms what I am trying to achieve in Elasticsearch: Say mytable has these columns: name, type, value fields in it. There can be… --- ## [Getting some documents ahead of my current time that alter the sql\_last\_value](https://discuss.elastic.co/t/getting-some-documents-ahead-of-my-current-time-that-alter-the-sql-last-value/241945)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 4\ **Last updated:** [July 21, 2020, 4:53am UTC](https://discuss.elastic.co/t/getting-some-documents-ahead-of-my-current-time-that-alter-the-sql-last-value/241945 "2020-07-21T04:53:32Z")
I get data from a DB every 30 minutes, in the image the current time is 18:50 pm, I should have no data from 18:30 to current time because this data is collected at 19:00 pm It seems that some documents are misconfigu… --- ## [Cannot allocate because a previous copy of the primary shard existed but can no longer be found on the nodes in the cluster](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/245335)
**Author:** [@daemon](https://discuss.elastic.co/u/daemon)\ **Replies:** 8\ **Last updated:** [August 18, 2020, 4:42am UTC](https://discuss.elastic.co/t/cannot-allocate-because-a-previous-copy-of-the-primary-shard-existed-but-can-no-longer-be-found-on-the-nodes-in-the-cluster/245335 "2020-08-18T04:42:18Z")
{ "index" : "edge-access", "shard" : 0, "primary" : true, "current\_state" : "unassigned", "unassigned\_info" : { "reason" : "INDEX\_REOPENED", "at" : "2020-08-18T03:02:26.620Z", "last\_allocation\_statu… --- ## [Elasticsearch Error "Event loop shutdown"](https://discuss.elastic.co/t/elasticsearch-error-event-loop-shutdown/245329)
**Author:** [@nguacon90](https://discuss.elastic.co/u/nguacon90)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 3:20am UTC](https://discuss.elastic.co/t/elasticsearch-error-event-loop-shutdown/245329 "2020-08-18T03:20:07Z")
Hi All, I'm using elastic search with information as following: { "name": "3KOuo1W", "cluster\_name": "common-cluster", "cluster\_uuid": "H9IcVILhROqC76KMneIxlA", "version": { "number": "5.5.3", … --- ## [Aggregate filter not creating path](https://discuss.elastic.co/t/aggregate-filter-not-creating-path/245299)
**Author:** [@kvtang](https://discuss.elastic.co/u/kvtang)\ **Replies:** 2\ **Last updated:** [August 18, 2020, 2:48am UTC](https://discuss.elastic.co/t/aggregate-filter-not-creating-path/245299 "2020-08-18T02:48:52Z")
Hi guys, I have used "aggregate\_maps\_path" to a folder where my logstash certainly have accessed (cause no error and that's where the logging created) but there is no map being created. Any idea why? Much thanks! --- ## [Visualizations has errors default page](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176)
**Author:** [@bevano](https://discuss.elastic.co/u/bevano)\ **Replies:** 5\ **Last updated:** [August 18, 2020, 2:09am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176 "2020-08-18T02:09:39Z")
Hi All, Just started to play around with SIEM. When opening the menu, we are constantly presented with this error. The only logs we are ingesting is our building security logs, and I have manually created logstash filte… --- ## [URL to Kibana as an interface](https://discuss.elastic.co/t/url-to-kibana-as-an-interface/245109)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 6\ **Last updated:** [August 18, 2020, 1:49am UTC](https://discuss.elastic.co/t/url-to-kibana-as-an-interface/245109 "2020-08-18T01:49:42Z")
I'm wanting to form a URL from my application that can send a user into Kibana with custom parameters for dashboards or Discover searching. Is this a supported interface into Kibana? How do I responsibly link into Kiba… --- ## [Can Elasticsearch cluster appoint the shards to a specific data node?](https://discuss.elastic.co/t/can-elasticsearch-cluster-appoint-the-shards-to-a-specific-data-node/245192)
**Author:** [@Fent](https://discuss.elastic.co/u/Fent)\ **Replies:** 4\ **Last updated:** [August 18, 2020, 12:51am UTC](https://discuss.elastic.co/t/can-elasticsearch-cluster-appoint-the-shards-to-a-specific-data-node/245192 "2020-08-18T00:51:41Z")
Hi ,i have two question 1 , If Elasticsearch cluster data node can located in different cities ? for expample ,some data node server in New York and others in Washington ? 2, IF elasticsearch cluster can appiont th… --- ## [Monitoring the SFTP server availability](https://discuss.elastic.co/t/monitoring-the-sftp-server-availability/245287)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 18, 2020, 12:29am UTC](https://discuss.elastic.co/t/monitoring-the-sftp-server-availability/245287 "2020-08-18T00:29:07Z")
Is it possible to monitor the health/availability of the SFTP server using elastic Stack? --- ## [How to delete all data from an index without deleting the index?](https://discuss.elastic.co/t/how-to-delete-all-data-from-an-index-without-deleting-the-index/245276)
**Author:** [@kovacsbv](https://discuss.elastic.co/u/kovacsbv)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 10:30pm UTC](https://discuss.elastic.co/t/how-to-delete-all-data-from-an-index-without-deleting-the-index/245276 "2020-08-17T22:30:44Z")
Hello, I am looking for a simple and efficient way to delete all data from an index without deleting the index. This is known as a truncate in SQL parlance. The rationale is that I want to clear the data while leaving… --- ## [3rd party plugin - embed data table visualization problem](https://discuss.elastic.co/t/3rd-party-plugin-embed-data-table-visualization-problem/245242)
**Author:** [@AndreaTosti](https://discuss.elastic.co/u/AndreaTosti)\ **Replies:** 1\ **Last updated:** [August 17, 2020, 9:40pm UTC](https://discuss.elastic.co/t/3rd-party-plugin-embed-data-table-visualization-problem/245242 "2020-08-17T21:40:27Z")
Hi everyone, I have a problem with a plugin developed in ReactJS. This problem occurs on Kibana versions Legacy 7.6.2, Legacy 7.7.x, Legacy 7.8.x and does NOT occur on New Platform 7.9.0. The problem concerns only the … --- ## [Consumer threads for topics\_pattern](https://discuss.elastic.co/t/consumer-threads-for-topics-pattern/245303)
**Author:** [@tarunwadhwa13](https://discuss.elastic.co/u/tarunwadhwa13)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 7:43pm UTC](https://discuss.elastic.co/t/consumer-threads-for-topics-pattern/245303 "2020-08-17T19:43:52Z")
The doc mentioned that consumer thread should be equal to number of partition or divided by number of logstash instances if more than 1 is running. Just wanted to understand how do i calculate the value of consumer thre… --- ## [Some Kibana SIEM feature not working with arrays](https://discuss.elastic.co/t/some-kibana-siem-feature-not-working-with-arrays/245029)
**Author:** [@obuez](https://discuss.elastic.co/u/obuez)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/some-kibana-siem-feature-not-working-with-arrays/245029 "2020-08-17T19:10:13Z")
Hi All, To be able to use the Elastic SIEM feature with our own data, we have decided to be ECS compliant regarding the values (IP,... ) but also the enrichment values (AS name,... ). We are doing the enrichment our-sel… --- ## [Is there a way to switch between dashboard views with one click?](https://discuss.elastic.co/t/is-there-a-way-to-switch-between-dashboard-views-with-one-click/245288)
**Author:** [@markroland](https://discuss.elastic.co/u/markroland)\ **Replies:** 5\ **Last updated:** [August 17, 2020, 7:02pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-switch-between-dashboard-views-with-one-click/245288 "2020-08-17T19:02:52Z")
I think it would be nice if there was a single-step way to switch between Dashboard views in Kibana. Currently in 7.9.1 you have to navigate out of a dashboard back to /app/kibana#/dashboards and then select a new dashbo… --- ## [Continuous transform failure](https://discuss.elastic.co/t/continuous-transform-failure/245302)
**Author:** [@Vlad\_K](https://discuss.elastic.co/u/Vlad_K)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 6:14pm UTC](https://discuss.elastic.co/t/continuous-transform-failure/245302 "2020-08-17T18:14:05Z")
I have 4GB JVM heap and continuous transform with filtered search throws this errors in logs and stops with "failed" state after some period. Insufficient memory for search, reducing number of buckets per search from \[4… --- ## [Is there a way to show RAG status without Canvas?](https://discuss.elastic.co/t/is-there-a-way-to-show-rag-status-without-canvas/243827)
**Author:** [@Bhavya\_Bansal](https://discuss.elastic.co/u/Bhavya_Bansal)\ **Replies:** 3\ **Last updated:** [August 17, 2020, 5:51pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-show-rag-status-without-canvas/243827 "2020-08-17T17:51:36Z")
Hi, I need to create a RAG (red, amber green) indicator that is based on the results of a query. If all the metrics are green (using color rules in tsvb), another panel should be green. Can I achieve something like this… --- ## [Solved: Dell EMC REST API calls with Logstash plugin http\_poller](https://discuss.elastic.co/t/solved-dell-emc-rest-api-calls-with-logstash-plugin-http-poller/245283)
**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\ **Replies:** 0\ **Last updated:** [August 17, 2020, 4:38pm UTC](https://discuss.elastic.co/t/solved-dell-emc-rest-api-calls-with-logstash-plugin-http-poller/245283 "2020-08-17T16:38:56Z")
If anyone is looking to pull performance metrics from the Dell EMC Unity Unisphere servers that they're running I hope that this saves you some time. Useful References: Dell Unisphere® Management REST API Progra… --- ## [Stuck running docker logstash with pipelines.yml (binding)](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [August 17, 2020, 5:03pm UTC](https://discuss.elastic.co/t/stuck-running-docker-logstash-with-pipelines-yml-binding/245225 "2020-08-17T17:03:10Z")
Dear all, i can't get logstash working multipipeline mode inside a docker container. pipelines.yml (inside container) /usr/share/logstash/config bash-4.2$ stat pipelines.yml File: ‘pipelines.yml’ Access: (0644/-rw-… --- ## [How hides the password in json file for jmx input plugin logstash](https://discuss.elastic.co/t/how-hides-the-password-in-json-file-for-jmx-input-plugin-logstash/245166)
**Author:** [@ed2050](https://discuss.elastic.co/u/ed2050)\ **Replies:** 7\ **Last updated:** [August 17, 2020, 4:50pm UTC](https://discuss.elastic.co/t/how-hides-the-password-in-json-file-for-jmx-input-plugin-logstash/245166 "2020-08-17T16:50:56Z")
Hello I am using jmx input plugin logstash to read JVM metrics, everything works fine for me, the JVM I access requires authentication by user and password and in the development environment I have this data burned in t… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1277) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1279)