# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1382 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1383 --- ## [Slow Kibana after update 6.8.1 -\> 7.6.2](https://discuss.elastic.co/t/slow-kibana-after-update-6-8-1-7-6-2/237491)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 9:04pm UTC](https://discuss.elastic.co/t/slow-kibana-after-update-6-8-1-7-6-2/237491 "2020-06-17T21:04:58Z")
Hi everybody, after Elastic Stack updating from 6.8.1 to 7.6.2 we noticed that Kibana is slower to opening dashboards, settings, home and any other tab. Can we improve speed by changing some settings or understand the … --- ## [Geoip to geopoint in logstash kibana 7.7](https://discuss.elastic.co/t/geoip-to-geopoint-in-logstash-kibana-7-7/237032)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 9:03pm UTC](https://discuss.elastic.co/t/geoip-to-geopoint-in-logstash-kibana-7-7/237032 "2020-06-17T21:03:11Z")
Hi I am using the latest 7.7.1 version of elk stack and my logstash geoip snippet looks as below: if \[log\_type\] == "querylog" { grok{ match =\> {"message" =\> "%{TIMESTAMP\_ISO8601:Activity-Time}%{SPACE}USERID=%{QUOTEDS… --- ## [Use Mutate after KV filter](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 8:46pm UTC](https://discuss.elastic.co/t/use-mutate-after-kv-filter/237460 "2020-06-17T20:46:04Z")
Is it not possible to use mutate filter after kv filter on fields created by the kv filter? I have key value pairs which get divided by a kv filter. this is working great, the new fields appears on discover menu in kiba… --- ## [Перенос данных с 5.6.2 на 7.7.1 версию (reindex from a remote) и консистентность данных](https://discuss.elastic.co/t/5-6-2-7-7-1-reindex-from-a-remote/237477)
**Author:** [@Sergei\_Frolov](https://discuss.elastic.co/u/Sergei_Frolov)\ **Replies:** 9\ **Last updated:** [June 17, 2020, 8:04pm UTC](https://discuss.elastic.co/t/5-6-2-7-7-1-reindex-from-a-remote/237477 "2020-06-17T20:04:43Z")
Добрый день! Выполняю перенос данных из 5.6.2 на 7.7.1 версию (reindex from a remote) через \_reindex api - как описано тут Все прекрасно переносится - по большей части обошелся лишь удалением типа из маппинга. Но есть… --- ## [How vector based text similarity works under the hood?](https://discuss.elastic.co/t/how-vector-based-text-similarity-works-under-the-hood/237498)
**Author:** [@yash\_budukh](https://discuss.elastic.co/u/yash_budukh)\ **Replies:** 3\ **Last updated:** [June 17, 2020, 7:35pm UTC](https://discuss.elastic.co/t/how-vector-based-text-similarity-works-under-the-hood/237498 "2020-06-17T19:35:32Z")
This blog says that we’ve provided a match\_all query, which means the script will be run over all documents in the index. This is a current limitation of vector similarity in Elasticsearch — vectors can be used for scor… --- ## [Logstash to Elastic Cloud error 400](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524)
**Author:** [@zee67](https://discuss.elastic.co/u/zee67)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/logstash-to-elastic-cloud-error-400/237524 "2020-06-17T19:10:18Z")
Trying to connect Logstash to Elastic Cloud but getting error 400. My Logstash config is below, any help appreciated. input { tcp { port =\> 9600 } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:sysl… --- ## [SIEM can't detect DNS activity to Internet](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 20\ **Last updated:** [June 17, 2020, 6:44pm UTC](https://discuss.elastic.co/t/siem-cant-detect-dns-activity-to-internet/236552 "2020-06-17T18:44:44Z")
Dear, I have running an ELK server 7.7 with Elastic SIEM. I have enabled the related pre-built nmap and tcpdump signals detection rules and I could detect these type of "attacks". But now I have enabled the "DNS Activi… --- ## [Kibana 6.4.2 to Kibana 7.0 simple scripted field issue](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367)
**Author:** [@chowpay](https://discuss.elastic.co/u/chowpay)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 10:03pm UTC](https://discuss.elastic.co/t/kibana-6-4-2-to-kibana-7-0-simple-scripted-field-issue/237367 "2020-06-16T22:03:05Z")
Porting over my stuff from 6.4.2 I had a very simple scripted field that looks like this (all values are in format Number: doc\['ADN-KR'\].value+doc\['ADN-SSL-KR'\].value+doc\['LF-KR'.value\]+doc\['LF-SSL-KR'\].value... about 1… --- ## [Need help Parsing json with grok](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518)
**Author:** [@some\_IT\_guy](https://discuss.elastic.co/u/some_IT_guy)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 5:22pm UTC](https://discuss.elastic.co/t/need-help-parsing-json-with-grok/237518 "2020-06-17T17:22:53Z")
I am trying to use grok to parse down json, I am new and have the following filter { if \[syslog5424\_app\] == "nginx-access" { json { source =\> "syslog5424\_msg" skip\_on\_invalid\_json =\> … --- ## [Kibana 7.7.0 (docker container ) inaccessible after enabling SSL. Times out](https://discuss.elastic.co/t/kibana-7-7-0-docker-container-inaccessible-after-enabling-ssl-times-out/234439)
**Author:** [@tenet\_testuser1](https://discuss.elastic.co/u/tenet_testuser1)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 5:01pm UTC](https://discuss.elastic.co/t/kibana-7-7-0-docker-container-inaccessible-after-enabling-ssl-times-out/234439 "2020-06-17T17:01:55Z")
Hello, What I've done so far. Followed - https://www.elastic.co/guide/en/kibana/7.7/configuring-tls.html I followed the certutil route to generate (ca first and then cert). elasticsearch-certutil cert --ca /kiban… --- ## [Call URL with invalid SSL certificate from custom plugin](https://discuss.elastic.co/t/call-url-with-invalid-ssl-certificate-from-custom-plugin/237350)
**Author:** [@nplatis](https://discuss.elastic.co/u/nplatis)\ **Replies:** 4\ **Last updated:** [June 17, 2020, 4:48pm UTC](https://discuss.elastic.co/t/call-url-with-invalid-ssl-certificate-from-custom-plugin/237350 "2020-06-17T16:48:30Z")
We have developed a custom Kibana plugin, and it needs to call a REST API endpoint at another internal server of ours. We run Kibana on https since we need authentication, but we use a self-signed certificate since this … --- ## [Scripted Field in Kibana to extract from a nested document structure](https://discuss.elastic.co/t/scripted-field-in-kibana-to-extract-from-a-nested-document-structure/237380)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 3:30pm UTC](https://discuss.elastic.co/t/scripted-field-in-kibana-to-extract-from-a-nested-document-structure/237380 "2020-06-17T15:30:43Z")
Hi all Kibana and ES 7.7.0 My doc structure is like this: { "key1": "value1", "key2": "value3", "key3": { "key4": { "key5": "value5", "key6": "val6/val7/val8/val9.html" }, "key7": "val10" }, "key8": "val11", … --- ## [Is it good to use NIOFS in hot data node?](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500)
**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:21pm UTC](https://discuss.elastic.co/t/is-it-good-to-use-niofs-in-hot-data-node/237500 "2020-06-17T15:21:10Z")
When our es cluster upgrade to v7.7,a big change is that the term index(.tip) is not in jvm heap but managed by mmap in pagecache. Our es cluster have hot data node and cold data node,hot data node used to storage last … --- ## [If-Else in an Index Template, and How Smart is the IP Field?](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 3:07pm UTC](https://discuss.elastic.co/t/if-else-in-an-index-template-and-how-smart-is-the-ip-field/237496 "2020-06-17T15:07:15Z")
Hi Elasticsearch Jedi Masters, I have an Elasticsearch instance (ver 7.7.1) that is archiving network data. I also have an index template transforming the data type of the “IP.host” field from text string to IP address… --- ## [Reading JSON data from logstash](https://discuss.elastic.co/t/reading-json-data-from-logstash/237465)
**Author:** [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 2:28pm UTC](https://discuss.elastic.co/t/reading-json-data-from-logstash/237465 "2020-06-17T14:28:39Z")
Hi all, I have a lot of JSON data and I want to visualize it. I have seen the POST\_bulk method in Kibana, but it is not dynamic. We can not update the data whenever it is being generated. So, I thought of using logstash… --- ## [Kibana Options List Visualization Not Showing All Values](https://discuss.elastic.co/t/kibana-options-list-visualization-not-showing-all-values/237360)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 8:45pm UTC](https://discuss.elastic.co/t/kibana-options-list-visualization-not-showing-all-values/237360 "2020-06-16T20:45:45Z")
I have a new index for metricbeat logs to go into but when I try to create a Options List control visualization to filter on each specific host I only see any values for the first host that was added (not sure if that's … --- ## [Repository verification exception when registering new ES snapshot](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 4\ **Last updated:** [June 17, 2020, 1:53pm UTC](https://discuss.elastic.co/t/repository-verification-exception-when-registering-new-es-snapshot/237473 "2020-06-17T13:53:00Z")
Hi, I am trying to snapshot an elasticsearch repository. I have three different nodes across three different centos servers, e.g. 10.212.145.10, 10.212.145.20, 10.212.145.30. I have added the path.repo field in my ela… --- ## [Transform on fields of a nested object](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986)
**Author:** [@sharad\_khandelwal1](https://discuss.elastic.co/u/sharad_khandelwal1)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:45pm UTC](https://discuss.elastic.co/t/transform-on-fields-of-a-nested-object/236986 "2020-06-17T13:45:47Z")
Does transform support group by on nested fields? I was trying to group by on a field of a nested object but no results appear in the preview. --- ## [Node does not match global include filters](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303)
**Author:** [@secumind](https://discuss.elastic.co/u/secumind)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 1:18pm UTC](https://discuss.elastic.co/t/node-does-not-match-global-include-filters/237303 "2020-06-17T13:18:02Z")
I have a cluster of albeit older 2.4.6 Elasticsearch. We're upgrading soon but for right now we need to keep this version running. We have 3 master nodes, 1 search node, 6 data nodes. There are a couple of billion docum… --- ## [Kibana Visualize - Calculate difference between two metrics](https://discuss.elastic.co/t/kibana-visualize-calculate-difference-between-two-metrics/237466)
**Author:** [@Mayestro\_PW](https://discuss.elastic.co/u/Mayestro_PW)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 12:50pm UTC](https://discuss.elastic.co/t/kibana-visualize-calculate-difference-between-two-metrics/237466 "2020-06-17T12:50:47Z")
Hello, I'm in the process of making a new data table, which consists of a date bucket and 3 metrics. First metric(A) is Count, second metric(B) is Unique Count, and third(C) I need to be the difference between A and B. … --- ## [How properly rollover indices](https://discuss.elastic.co/t/how-properly-rollover-indices/237309)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 11:16am UTC](https://discuss.elastic.co/t/how-properly-rollover-indices/237309 "2020-06-17T11:16:40Z")
I harvest logs with filebeat from all docker containers, sending them to logstash and from logstash are forwarded to elasticsearch. I would like to rollover my indices, that are automatically created, if they are too big… --- ## [Issues while installing Logstash 7.7.1 on Windows 10](https://discuss.elastic.co/t/issues-while-installing-logstash-7-7-1-on-windows-10/237458)
**Author:** [@Inshu](https://discuss.elastic.co/u/Inshu)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 11:09am UTC](https://discuss.elastic.co/t/issues-while-installing-logstash-7-7-1-on-windows-10/237458 "2020-06-17T11:09:44Z")
I was installing Logstash 7.7.1 on Windows 10. When I tried to configure it with the command bin/logstash -f logstash.conf it is showing following error ignoring JAVA\_OPTS= -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CM… --- ## [Simple query string: minus (-) doesn't work if WHITESPACE not specified in flags](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 0\ **Last updated:** [June 16, 2020, 5:15pm UTC](https://discuss.elastic.co/t/simple-query-string-minus-doesnt-work-if-whitespace-not-specified-in-flags/237347 "2020-06-16T17:15:05Z")
Hi everyone, like mentionned in the title, i'm facing the problem with simple query string when WHITESPACE is not specified in flags. I'm using docker.elastic.co/elasticsearch/elasticsearch:7.4.1 I have a mapping like … --- ## ["having count" in bar/pie/table chart](https://discuss.elastic.co/t/having-count-in-bar-pie-table-chart/237190)
**Author:** [@gofbor](https://discuss.elastic.co/u/gofbor)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 10:42am UTC](https://discuss.elastic.co/t/having-count-in-bar-pie-table-chart/237190 "2020-06-17T10:42:45Z")
Hi, Is it possible to make a chart with aggregation(avg or min) per filed\_bucket where count of field\_bucket \> 100 ? It's like having count in SQL. BR. --- ## [Unable to use the ODBC driver as a SQL Server Linked Server](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 15\ **Last updated:** [June 17, 2020, 10:39am UTC](https://discuss.elastic.co/t/unable-to-use-the-odbc-driver-as-a-sql-server-linked-server/230660 "2020-06-17T10:39:53Z")
I've setup an ODBC 64-bit driver on a server that runs SQL Server 2017. I picked the ODBC version to match the ElasticSearch installation (6.0.6). The installation of the ODBC driver and creation of a Linked Server wen… --- ## [How to take word order into account in match\_phrase query](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448)
**Author:** [@mehdi89](https://discuss.elastic.co/u/mehdi89)\ **Replies:** 0\ **Last updated:** [June 17, 2020, 10:08am UTC](https://discuss.elastic.co/t/how-to-take-word-order-into-account-in-match-phrase-query/237448 "2020-06-17T10:08:52Z")
Suppose that my index have two documents: "get my money" "my money get here" When I do a regular match query for "get my money", both documents match correctly but they get equal scores. However, I want the order of w… --- ## [Multiline log parsing - Filebeat, Logstash](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132)
**Author:** [@Gyanprakash\_Mishra](https://discuss.elastic.co/u/Gyanprakash_Mishra)\ **Replies:** 1\ **Last updated:** [June 17, 2020, 10:35am UTC](https://discuss.elastic.co/t/multiline-log-parsing-filebeat-logstash/237132 "2020-06-17T10:35:20Z")
Hi All, I am using filebeat to stash data into logstash. Need help in parsing log of following format: 11-Jun-2020 18:31:51.900 SEVERE \[http-nio-8080-exec-24\] org.apache.catalina.core.StandardWrapperValve.invoke Servl… --- ## [Response data from text file multiple folder to multiple index](https://discuss.elastic.co/t/response-data-from-text-file-multiple-folder-to-multiple-index/236694)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 10:33am UTC](https://discuss.elastic.co/t/response-data-from-text-file-multiple-folder-to-multiple-index/236694 "2020-06-17T10:33:42Z")
My logstash configuration is this input { beats { port =\> 5044 } } filter { xml { store\_xml =\> "false" source =\> "message" xpath =\>\["/propertyAvailability/hotelRates/hotel\[2\]/bookingChannel\[4\]/ratePlan\[3\]/miscInfo/tex… --- ## [Why logstash is not considering my ports?](https://discuss.elastic.co/t/why-logstash-is-not-considering-my-ports/237443)
**Author:** [@AngeloM](https://discuss.elastic.co/u/AngeloM)\ **Replies:** 2\ **Last updated:** [June 17, 2020, 10:25am UTC](https://discuss.elastic.co/t/why-logstash-is-not-considering-my-ports/237443 "2020-06-17T10:25:57Z")
Getting crazy here ! The idea is to import different log from different port and import then in different indexes. I got two different configuration files on "etc/logtash/init.d". The two configuration files has two d… --- ## [Extract hour and weekday from custom date time field](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286)
**Author:** [@Rushabh\_Doshi](https://discuss.elastic.co/u/Rushabh_Doshi)\ **Replies:** 5\ **Last updated:** [June 17, 2020, 10:22am UTC](https://discuss.elastic.co/t/extract-hour-and-weekday-from-custom-date-time-field/237286 "2020-06-17T10:22:25Z")
for extracting hour and weekday from Activity-Time field the logstash snippet is as below: date{ match =\> \[ "Activity-Time", "yyyy-MM-dd HH:mm:ss" \] target =\> "Activity-Time-New" add\_field =\> {"hour" =\> "%{+HH}"} ad… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1381) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1383)