# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1400 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1401 --- ## [Exporting Million of documents in Kibana](https://discuss.elastic.co/t/exporting-million-of-documents-in-kibana/235997)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 3:17am UTC](https://discuss.elastic.co/t/exporting-million-of-documents-in-kibana/235997 "2020-06-09T03:17:28Z")
Their is a limitation for exporting the documents in Kibana. How to export more then 1 Million of documents in Kibana. Any expert advice would be highly appreciated. Regards --- ## [Convert value of nested date field to UTC with date filter](https://discuss.elastic.co/t/convert-value-of-nested-date-field-to-utc-with-date-filter/236250)
**Author:** [@alxsss](https://discuss.elastic.co/u/alxsss)\ **Replies:** 1\ **Last updated:** [June 9, 2020, 2:41am UTC](https://discuss.elastic.co/t/convert-value-of-nested-date-field-to-utc-with-date-filter/236250 "2020-06-09T02:41:01Z")
Hello, I am trying to convert values of all date fields to UTC. I use date filter, which works fine for top level fields. However, looks like it does not work for nested fields like "abc" : \[ { "dateField" : "2020-0… --- ## [How to handle nil or null values within mutate add field](https://discuss.elastic.co/t/how-to-handle-nil-or-null-values-within-mutate-add-field/236160)
**Author:** [@genehunter29009](https://discuss.elastic.co/u/genehunter29009)\ **Replies:** 6\ **Last updated:** [June 8, 2020, 11:38pm UTC](https://discuss.elastic.co/t/how-to-handle-nil-or-null-values-within-mutate-add-field/236160 "2020-06-08T23:38:09Z")
So I have my data being parsed , transformed correctly however I have this issue where null or nil values cause me problems. "userActions.cdnBusyTime" =\> "%{\[userActions\]\[cdnBusyTime\]}" output ends up looking like this … --- ## [FIM module in auditbeat keeps too many file handles open on Kubrenetes](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239)
**Author:** [@premendra2020singh](https://discuss.elastic.co/u/premendra2020singh)\ **Replies:** 2\ **Last updated:** [June 8, 2020, 11:31pm UTC](https://discuss.elastic.co/t/fim-module-in-auditbeat-keeps-too-many-file-handles-open-on-kubrenetes/236239 "2020-06-08T23:31:16Z")
I'm using Auditbeat with FIM module on Kubernetes daemonset with 40 pods on it. Auditbeat version - latest OS - Debian GNU/Linux 9 ulimit -n 1048576 Auditbeat pod memory allocation - 200mb Open file handles go up … --- ## [Can't run Logstash on FreeBSD](https://discuss.elastic.co/t/cant-run-logstash-on-freebsd/236240)
**Author:** [@bherczyk](https://discuss.elastic.co/u/bherczyk)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 10:25pm UTC](https://discuss.elastic.co/t/cant-run-logstash-on-freebsd/236240 "2020-06-08T22:25:52Z")
Hello, I try running elastisearch, kibana and logstash on FreeBSD 11.3. Elasticseach and Kibana works very well, but I can't running logstash. When I try to do this, an error occurs: \[ERROR\]\[org.logstash.Logstash \]… --- ## [Querying shingles](https://discuss.elastic.co/t/querying-shingles/236233)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 8:58pm UTC](https://discuss.elastic.co/t/querying-shingles/236233 "2020-06-08T20:58:59Z")
I have used the following settings to index content and generate bigrams. es.indices.create( index= "shingles", body= { "settings": { "analysis": { "analyzer": { "shingle\_analyzer": { … --- ## [Complex JSON structure - Mapping](https://discuss.elastic.co/t/complex-json-structure-mapping/236229)
**Author:** [@Lemonlemmings](https://discuss.elastic.co/u/Lemonlemmings)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 8:27pm UTC](https://discuss.elastic.co/t/complex-json-structure-mapping/236229 "2020-06-08T20:27:31Z")
Hi, I'm looking at using elasticsearch for a project I'm working on. I think it'll be a good fit because I want to use elasticsearch as a place to aggregate lots of different data sources to help centralise my data. I'm… --- ## [Aggregate filter for mixed data lines](https://discuss.elastic.co/t/aggregate-filter-for-mixed-data-lines/236110)
**Author:** [@mskadu](https://discuss.elastic.co/u/mskadu)\ **Replies:** 4\ **Last updated:** [June 8, 2020, 7:54pm UTC](https://discuss.elastic.co/t/aggregate-filter-for-mixed-data-lines/236110 "2020-06-08T19:54:03Z")
Hello all! I am trying to use the Aggregate filter plugin to correlate and combine data from two different CSV file inputs which represent API data calls. The idea is to produce a record showing a combined picture. As y… --- ## [Find a document with query and modify a string in the message field](https://discuss.elastic.co/t/find-a-document-with-query-and-modify-a-string-in-the-message-field/236222)
**Author:** [@cotjoey](https://discuss.elastic.co/u/cotjoey)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 7:47pm UTC](https://discuss.elastic.co/t/find-a-document-with-query-and-modify-a-string-in-the-message-field/236222 "2020-06-08T19:47:57Z")
Hello, I have some filebeat events which were processed by Logstash and output in an Elasticsearch index. The documents in the index have a "message" field which contain a string that I need to modify. Is there a comma… --- ## [Syslog - logs contain dynamic fields(parameters) based on event type, how to index?](https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144)
**Author:** [@Ilya\_Geller](https://discuss.elastic.co/u/Ilya_Geller)\ **Replies:** 6\ **Last updated:** [June 8, 2020, 7:42pm UTC](https://discuss.elastic.co/t/syslog-logs-contain-dynamic-fields-parameters-based-on-event-type-how-to-index/236144 "2020-06-08T19:42:10Z")
Hi, I am trying to write a syslog collector for to store logs from a Cisco CUCM into elasticsearch. Cisco CUCM sends audit logs and alarms as syslog to my logstash server for different system and application events. T… --- ## [Elastic search azure](https://discuss.elastic.co/t/elastic-search-azure/236221)
**Author:** [@geethu\_priya](https://discuss.elastic.co/u/geethu_priya)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 7:20pm UTC](https://discuss.elastic.co/t/elastic-search-azure/236221 "2020-06-08T19:20:30Z")
HI, Am trying to snapshot the index data from on prem to azure am getting the same exception { "error": { "root\_cause": \[ { "type": "repository\_verification\_exception", "reason": "\[qarepository\] path is not acces… --- ## [Trouble getting an new node added to a cluster](https://discuss.elastic.co/t/trouble-getting-an-new-node-added-to-a-cluster/234814)
**Author:** [@Andreas\_Falk](https://discuss.elastic.co/u/Andreas_Falk)\ **Replies:** 2\ **Last updated:** [June 8, 2020, 7:16pm UTC](https://discuss.elastic.co/t/trouble-getting-an-new-node-added-to-a-cluster/234814 "2020-06-08T19:16:00Z")
Hi, When trying to add the new node to the cluster it fails on bootstrapcheck. \[2020-05-28T20:05:45,054\]\[INFO \]\[o.e.t.TransportService \] \[log04\] publish\_address {192.168.2.194:9300}, bound\_addresses {192.168.2.194:93… --- ## [Developers would like to see some log files from they applications](https://discuss.elastic.co/t/developers-would-like-to-see-some-log-files-from-they-applications/235814)
**Author:** [@jacobzh](https://discuss.elastic.co/u/jacobzh)\ **Replies:** 8\ **Last updated:** [June 8, 2020, 5:26pm UTC](https://discuss.elastic.co/t/developers-would-like-to-see-some-log-files-from-they-applications/235814 "2020-06-08T17:26:26Z")
I created elk project(elasticsearch, logstash, kibana and filebeat) for production environment. It’s contained 1 server and 5 filebeat clients. Our developers would like to see some log files from they applications. I us… --- ## [Logstash should not use the "tags" field](https://discuss.elastic.co/t/logstash-should-not-use-the-tags-field/236209)
**Author:** [@elastictake](https://discuss.elastic.co/u/elastictake)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 5:10pm UTC](https://discuss.elastic.co/t/logstash-should-not-use-the-tags-field/236209 "2020-06-08T17:10:33Z")
Logstash should not use the "tags" field The name tags is easy to use in applications And when Elasticsearch mapping is set to strict, it becomes a problem. mapping set to strict, dynamic introduction of \[tags\] withi… --- ## [Rescore from Page 2 only](https://discuss.elastic.co/t/rescore-from-page-2-only/236203)
**Author:** [@Nagach](https://discuss.elastic.co/u/Nagach)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 4:20pm UTC](https://discuss.elastic.co/t/rescore-from-page-2-only/236203 "2020-06-08T16:20:27Z")
Can re-scoring be done from page2 only. Use case is we are trying to learn user interests in page 1 and want to apply re-scoring basing on user interest and behavior based off of page 1 clicks and apply to page 2..n wit… --- ## [Using shingle and stop filters](https://discuss.elastic.co/t/using-shingle-and-stop-filters/236067)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 1\ **Last updated:** [June 8, 2020, 4:17pm UTC](https://discuss.elastic.co/t/using-shingle-and-stop-filters/236067 "2020-06-08T16:17:48Z")
I am using shingle and stop filters, trim and filler\_token="". When i run analyze API on a string : "Word1 Word2 StopWord1 StopWord2 Word3 Word4", I get the following SHINGLES which seem to be correct. i) "Word1 Word2… --- ## [Doubts on Huge Elastic Clustering and HA](https://discuss.elastic.co/t/doubts-on-huge-elastic-clustering-and-ha/235539)
**Author:** [@Adrian\_Varona](https://discuss.elastic.co/u/Adrian_Varona)\ **Replies:** 3\ **Last updated:** [June 8, 2020, 4:11pm UTC](https://discuss.elastic.co/t/doubts-on-huge-elastic-clustering-and-ha/235539 "2020-06-08T16:11:22Z")
Hello mates. Today I got involved in a project in which we are supposed to provide high availability on an elasticsearch cluster. This is going to be a huge project, meaning this that resources are not a problem (We are… --- ## [Calcule elapsed time of a VPN user](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199)
**Author:** [@Leonardo\_Posadas](https://discuss.elastic.co/u/Leonardo_Posadas)\ **Replies:** 1\ **Last updated:** [June 8, 2020, 3:39pm UTC](https://discuss.elastic.co/t/calcule-elapsed-time-of-a-vpn-user/236199 "2020-06-08T15:39:36Z")
Hi, What is the best way to calculate the duration or elapsed time of a VPN user trough the logs?. I had thought of it as a timestamp difference. Format Message: Jun 7, 2020 @ 18:11:22.165 message: pptp,ppp,info \ **Author:** [@Johnny2Chen](https://discuss.elastic.co/u/Johnny2Chen)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 3:35pm UTC](https://discuss.elastic.co/t/aggregate-over-bucket-result/236201 "2020-06-08T15:35:26Z") I want to aggregate or count the result in the bucket. for example: { ID: 1, customer\_name: a, age: 21, other\_field: x }, { ID: 2, customer\_name: a, age: 25, other\_fie… --- ## [Insert in to existing index using some condition](https://discuss.elastic.co/t/insert-in-to-existing-index-using-some-condition/235848)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [June 8, 2020, 3:28pm UTC](https://discuss.elastic.co/t/insert-in-to-existing-index-using-some-condition/235848 "2020-06-08T15:28:24Z")
Here is what I am trying to do I have a existing index with { index= my\_index id=1 fname= xyz lname = abc emp\_num=123 loction=usa } now i am reading new data from new source A which have fnam… --- ## [Ruby Filter URI Request](https://discuss.elastic.co/t/ruby-filter-uri-request/235556)
**Author:** [@aannee](https://discuss.elastic.co/u/aannee)\ **Replies:** 1\ **Last updated:** [June 8, 2020, 3:09pm UTC](https://discuss.elastic.co/t/ruby-filter-uri-request/235556 "2020-06-08T15:09:19Z")
Hi Guys, I have a little problem here and I just really don't know what I'm missing because it's my first time using ruby filter. No result is coming from the output stdout. Hope you can help me. Here's my only data. {… --- ## [Custom weights for fields, custom score](https://discuss.elastic.co/t/custom-weights-for-fields-custom-score/236191)
**Author:** [@Alex\_D](https://discuss.elastic.co/u/Alex_D)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 2:40pm UTC](https://discuss.elastic.co/t/custom-weights-for-fields-custom-score/236191 "2020-06-08T14:40:38Z")
Hi all ! I'm trying to make a query with a custom weights for fields and custom result score. Suppose we have 3 fields: field1 : Text, field2 : Text, phrase : Text. Each field must have a different weight in the res… --- ## [How to build an es query from kibana filters in a kibana plugin](https://discuss.elastic.co/t/how-to-build-an-es-query-from-kibana-filters-in-a-kibana-plugin/232218)
**Author:** [@ranitg](https://discuss.elastic.co/u/ranitg)\ **Replies:** 3\ **Last updated:** [June 8, 2020, 2:52pm UTC](https://discuss.elastic.co/t/how-to-build-an-es-query-from-kibana-filters-in-a-kibana-plugin/232218 "2020-06-08T14:52:44Z")
Hi, I'm writing a Kibana plugin. How can I create an ES request from the current filters. What classes do I need to import and use? Thanks --- ## [Display labels such as count in the bar chart](https://discuss.elastic.co/t/display-labels-such-as-count-in-the-bar-chart/236108)
**Author:** [@Sridhar\_Srinivasan](https://discuss.elastic.co/u/Sridhar_Srinivasan)\ **Replies:** 2\ **Last updated:** [June 8, 2020, 2:33pm UTC](https://discuss.elastic.co/t/display-labels-such-as-count-in-the-bar-chart/236108 "2020-06-08T14:33:27Z")
Hi, Based on the picture attached, I'm trying a couple of options to display the numbers on top of each bar. Is it possible to archive this with kibana? Regards, Sridhar --- ## [Convert UTC datetime to specified timezone](https://discuss.elastic.co/t/convert-utc-datetime-to-specified-timezone/235970)
**Author:** [@not\_found](https://discuss.elastic.co/u/not_found)\ **Replies:** 4\ **Last updated:** [June 8, 2020, 2:09pm UTC](https://discuss.elastic.co/t/convert-utc-datetime-to-specified-timezone/235970 "2020-06-08T14:09:58Z")
Hello, I have this following date : 2020-02-05 15:31:46 UTC I would like to convert it with ruby into Europe/Brussels. I tried : puts Time.parse(mydate2) // 2020-02-05 15:31:46 UTC puts Time.parse(mydate2).zone // UT… --- ## [Pattern not defined grok error](https://discuss.elastic.co/t/pattern-not-defined-grok-error/236139)
**Author:** [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)\ **Replies:** 0\ **Last updated:** [June 8, 2020, 8:24am UTC](https://discuss.elastic.co/t/pattern-not-defined-grok-error/236139 "2020-06-08T08:24:14Z")
Hi , I read all the discussions related to custom grok patterns but couldn't find a solution to my issue. I am getting error as: \[2020-06-08T03:00:07,412\]\[ERROR\]\[logstash.javapipeline \] Pipeline aborted due to error… --- ## [Multiple interval exclusion in Sentinl](https://discuss.elastic.co/t/multiple-interval-exclusion-in-sentinl/234028)
**Author:** [@mohitrawat0123](https://discuss.elastic.co/u/mohitrawat0123)\ **Replies:** 4\ **Last updated:** [June 8, 2020, 1:57pm UTC](https://discuss.elastic.co/t/multiple-interval-exclusion-in-sentinl/234028 "2020-06-08T13:57:54Z")
Hi, I'm trying to configure sentinl watcher with trigger scheduled at "every 5 minutes" which is working fine. But now i need to exclude night hours (after 20th hour) and morning hours (before 5th hour) as well. So i wa… --- ## [Advice on Using Joins](https://discuss.elastic.co/t/advice-on-using-joins/235966)
**Author:** [@denmcktr](https://discuss.elastic.co/u/denmcktr)\ **Replies:** 2\ **Last updated:** [June 8, 2020, 1:34pm UTC](https://discuss.elastic.co/t/advice-on-using-joins/235966 "2020-06-08T13:34:13Z")
Starting a new project (on 7.7) and trying to decide if the join framework (parent/child) makes sense as an approach or not. A simplified model of what I'm building is as follows: A house (the parent type) House membe… --- ## [KIbana embed data](https://discuss.elastic.co/t/kibana-embed-data/234167)
**Author:** [@amTex](https://discuss.elastic.co/u/amTex)\ **Replies:** 9\ **Last updated:** [June 8, 2020, 1:18pm UTC](https://discuss.elastic.co/t/kibana-embed-data/234167 "2020-06-08T13:18:45Z")
Hello, I wanted to create a dynamic dashboard according data i would inject into the embed dashboard code, i know it is possible to pass filters as params but is it possible to pass custom data too? It's probably relat… --- ## [Fetching Cisco , Firewall logs from syslog-ng server](https://discuss.elastic.co/t/fetching-cisco-firewall-logs-from-syslog-ng-server/233951)
**Author:** [@Ajay\_Singh2](https://discuss.elastic.co/u/Ajay_Singh2)\ **Replies:** 10\ **Last updated:** [June 8, 2020, 1:18pm UTC](https://discuss.elastic.co/t/fetching-cisco-firewall-logs-from-syslog-ng-server/233951 "2020-06-08T13:18:31Z")
I have a syslog-ng server which gathers data from Cisco Router, switches, netflow data and firewall related data . The data is stored as flat files. Now, i am looking to send those to ELK SIEM . I see that i can use fi… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1399) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1401)