# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1628 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1629 --- ## [How to find events with duplicate field value?](https://discuss.elastic.co/t/how-to-find-events-with-duplicate-field-value/219219)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 8:53pm UTC](https://discuss.elastic.co/t/how-to-find-events-with-duplicate-field-value/219219 "2020-02-13T20:53:34Z")
Hi, I have events which contains a numeric field action.id. When I filter action.id to be present for these events and aggregate for count and unique count I get different values. I understand it this way, that one or… --- ## [Under management Security feature is not enabled in kibana dashboard 6.5.4](https://discuss.elastic.co/t/under-management-security-feature-is-not-enabled-in-kibana-dashboard-6-5-4/219207)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 8:32pm UTC](https://discuss.elastic.co/t/under-management-security-feature-is-not-enabled-in-kibana-dashboard-6-5-4/219207 "2020-02-13T20:32:41Z")
Hi , I am using ELK 6.5.4 version, have enabled the x-pack security by adding xpack.security.enabled: true in elasticsearch.yml file. but could not see the security feature in dashbaord. please help Thanks Nikhilesh G… --- ## [Two nodes cluster - can't detect each other](https://discuss.elastic.co/t/two-nodes-cluster-cant-detect-each-other/219098)
**Author:** [@kuku\_blof](https://discuss.elastic.co/u/kuku_blof)\ **Replies:** 2\ **Last updated:** [February 13, 2020, 7:55pm UTC](https://discuss.elastic.co/t/two-nodes-cluster-cant-detect-each-other/219098 "2020-02-13T19:55:26Z")
Hello, I'm running a two nodes cluster on AWS (as EC2 instances, didn't use any community image, installed with RPM). the nodes are 10.90.20.100 and 10.90.20.101, both are reachable to each other in ports 9200 and 930… --- ## [Filter a field that has different formats](https://discuss.elastic.co/t/filter-a-field-that-has-different-formats/219232)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 7:32pm UTC](https://discuss.elastic.co/t/filter-a-field-that-has-different-formats/219232 "2020-02-13T19:32:45Z")
Hi, I am currently filtering logs that normaly return this kind of field (among others): vfs.fs.size\[D:,pused\] and my grok for this field is the following: vfs.fs.size\\\[%{DATA:disco},pused\\\] but for certain machines … --- ## [Auditbeat omniscience?](https://discuss.elastic.co/t/auditbeat-omniscience/218695)
**Author:** [@hilt86](https://discuss.elastic.co/u/hilt86)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 6:13pm UTC](https://discuss.elastic.co/t/auditbeat-omniscience/218695 "2020-02-13T18:13:26Z")
I have an event picked up by Auditbeat where it registers a tcp connection to my machine (port 22 where openssh is listening) from an external source. That's fine and dandy however it claims to know what the process and… --- ## [Map in Kibana not visible](https://discuss.elastic.co/t/map-in-kibana-not-visible/219080)
**Author:** [@wolfsbane](https://discuss.elastic.co/u/wolfsbane)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 5:45pm UTC](https://discuss.elastic.co/t/map-in-kibana-not-visible/219080 "2020-02-13T17:45:47Z")
Hello, my map in Kibana is not visible. Any idea why this may occur? The map was showing and sudendly now there is no map. --- ## [How can I set up default settings in Kibana / Docker?](https://discuss.elastic.co/t/how-can-i-set-up-default-settings-in-kibana-docker/219056)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 5:44pm UTC](https://discuss.elastic.co/t/how-can-i-set-up-default-settings-in-kibana-docker/219056 "2020-02-13T17:44:13Z")
Is there a way to do this? I mean settings as in using the dark theme, index patterns, etc. --- ## [Managing Dangling Indices](https://discuss.elastic.co/t/managing-dangling-indices/219258)
**Author:** [@C\_Sawyer](https://discuss.elastic.co/u/C_Sawyer)\ **Replies:** 2\ **Last updated:** [February 13, 2020, 5:42pm UTC](https://discuss.elastic.co/t/managing-dangling-indices/219258 "2020-02-13T17:42:59Z")
Hi I'm new to ES and have inherited a 3-node data/master cluster which continually logs the same set of DanglingIndices. All of the indices listed are closed. Some appear to be common to all 3 nodes, others only 2 or … --- ## [Kibana cannot reload automatically after configuring per 5 seconds in the dashboard](https://discuss.elastic.co/t/kibana-cannot-reload-automatically-after-configuring-per-5-seconds-in-the-dashboard/219061)
**Author:** [@Yiw](https://discuss.elastic.co/u/Yiw)\ **Replies:** 3\ **Last updated:** [February 13, 2020, 5:30pm UTC](https://discuss.elastic.co/t/kibana-cannot-reload-automatically-after-configuring-per-5-seconds-in-the-dashboard/219061 "2020-02-13T17:30:00Z")
Hi all, I am using Kibana 7.6.0 on Ubuntu 16 right now. I made visualizations by myself and add them to my new dashboard. However, I cannot reload data automatically after configuring per 5 seconds and start in the dash… --- ## [Fielddata stats](https://discuss.elastic.co/t/fielddata-stats/194315)
**Author:** [@ram123](https://discuss.elastic.co/u/ram123)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 5:28pm UTC](https://discuss.elastic.co/t/fielddata-stats/194315 "2020-02-13T17:28:58Z")
I am on ElasticSearch 6.3 and there are no text fields in my schema with fielddata enabled (but I do have keyword fields). When I do GET /\_stats/fielddata?fields=\* , I see something like \` "\_all" : { "primaries" : {… --- ## [Question about approximate counts](https://discuss.elastic.co/t/question-about-approximate-counts/218800)
**Author:** [@axlrosen](https://discuss.elastic.co/u/axlrosen)\ **Replies:** 5\ **Last updated:** [February 13, 2020, 5:22pm UTC](https://discuss.elastic.co/t/question-about-approximate-counts/218800 "2020-02-13T17:22:21Z")
We're currently evaluating Elasticsearch, and trying to get a handle on the approximate counts that it uses. I know that in cardinality aggregations, the default value for 'precision\_threshold' is 3000. I think this mean… --- ## [Watcher to create snapshot and restore snapshot](https://discuss.elastic.co/t/watcher-to-create-snapshot-and-restore-snapshot/219236)
**Author:** [@jlim0930](https://discuss.elastic.co/u/jlim0930)\ **Replies:** 2\ **Last updated:** [February 13, 2020, 5:07pm UTC](https://discuss.elastic.co/t/watcher-to-create-snapshot-and-restore-snapshot/219236 "2020-02-13T17:07:23Z")
I am trying to create a watcher to create a snapshot and another watcher to restore the same snapshot then delete it. to take the snapshot I have POST \_watcher/watch/test { "trigger": { "schedule": { "inter… --- ## [How to get particular document using cmd from an index in Elastic Search](https://discuss.elastic.co/t/how-to-get-particular-document-using-cmd-from-an-index-in-elastic-search/219020)
**Author:** [@Joseph\_Raj](https://discuss.elastic.co/u/Joseph_Raj)\ **Replies:** 8\ **Last updated:** [February 13, 2020, 4:45pm UTC](https://discuss.elastic.co/t/how-to-get-particular-document-using-cmd-from-an-index-in-elastic-search/219020 "2020-02-13T16:45:31Z")
We want to see the particular document is available in ES under the particular index, so we tried the below query in cerebro visualization tool. GET Method en\_y\_91/basic\_type/denmod\_y\_107722 Output: { "\_index": "… --- ## [ElasticSearch - DiskThresholdMonitor - Indexes read only](https://discuss.elastic.co/t/elasticsearch-diskthresholdmonitor-indexes-read-only/219250)
**Author:** [@Klearchos\_Klearchou](https://discuss.elastic.co/u/Klearchos_Klearchou)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 4:24pm UTC](https://discuss.elastic.co/t/elasticsearch-diskthresholdmonitor-indexes-read-only/219250 "2020-02-13T16:24:21Z")
Hi , I am receiving the following exception: org.elasticsearch.ElasticsearchStatusException: Elasticsearch exception \[type=cluster\_block\_exception, reason=blocked by: \[FORBIDDEN/12/index read-only / allow delete (api)\]… --- ## [Filter syslog messages via priority](https://discuss.elastic.co/t/filter-syslog-messages-via-priority/219190)
**Author:** [@ptselios](https://discuss.elastic.co/u/ptselios)\ **Replies:** 3\ **Last updated:** [February 13, 2020, 3:59pm UTC](https://discuss.elastic.co/t/filter-syslog-messages-via-priority/219190 "2020-02-13T15:59:13Z")
Hello, Currently I have logstash as a centralized syslog server. I want to send to Elasticsearch only syslog messages with priority warn and above. So, I create the following configuration file: input { tcp { p… --- ## [G Suite integration with ELK](https://discuss.elastic.co/t/g-suite-integration-with-elk/219244)
**Author:** [@data101](https://discuss.elastic.co/u/data101)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 3:50pm UTC](https://discuss.elastic.co/t/g-suite-integration-with-elk/219244 "2020-02-13T15:50:44Z")
Hi everybody, hope that someone can help me to solve my issue. I've already read all the related topics on this forum but didn't find anything apt to me. I wanted to know whether is it possible to integrate G Suite log… --- ## [Dense vector Euclidean Distance comparison function speed](https://discuss.elastic.co/t/dense-vector-euclidean-distance-comparison-function-speed/218992)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [February 13, 2020, 3:37pm UTC](https://discuss.elastic.co/t/dense-vector-euclidean-distance-comparison-function-speed/218992 "2020-02-13T15:37:35Z")
Are there any benchmarks on the speed of this function (release in 7.4, I believe)? I have some data that represents a high-dimension vectors that I'd like to consider it for. Thanks for any help! --- ## [ISO8601 to epoch seconds](https://discuss.elastic.co/t/iso8601-to-epoch-seconds/219033)
**Author:** [@fim](https://discuss.elastic.co/u/fim)\ **Replies:** 10\ **Last updated:** [February 13, 2020, 2:47pm UTC](https://discuss.elastic.co/t/iso8601-to-epoch-seconds/219033 "2020-02-13T14:47:23Z")
Hi I ingest data from a mysql database and in a specific column there are date/time in ISO8601 format stored, which I would like to convert as @timestamp in elasticsearch. I followed the question here: https://discuss.… --- ## [Import ndjson in kibana helm deployment](https://discuss.elastic.co/t/import-ndjson-in-kibana-helm-deployment/215338)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 5\ **Last updated:** [February 13, 2020, 2:43pm UTC](https://discuss.elastic.co/t/import-ndjson-in-kibana-helm-deployment/215338 "2020-02-13T14:43:30Z")
Hi, I have exported some dashboards (ndjson files) and I would like to have these exports imported in a new kibana-helm deployment. Is this possible? If yes, how can I do something like this? Thank you in advance! --- ## [Elastic search book recommendation 2020](https://discuss.elastic.co/t/elastic-search-book-recommendation-2020/219007)
**Author:** [@raghavan20](https://discuss.elastic.co/u/raghavan20)\ **Replies:** 2\ **Last updated:** [February 13, 2020, 2:32pm UTC](https://discuss.elastic.co/t/elastic-search-book-recommendation-2020/219007 "2020-02-13T14:32:08Z")
Hi, I do use the online documentation for reference. At the same time, I would like to read book(s) which help understand Elastic Search (not LK) in-depth. Hope the book would cover following areas in-depth indexes cl… --- ## [Logstash prune nested fields](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984)
**Author:** [@gangireddy\_l](https://discuss.elastic.co/u/gangireddy_l)\ **Replies:** 3\ **Last updated:** [February 13, 2020, 2:22pm UTC](https://discuss.elastic.co/t/logstash-prune-nested-fields/218984 "2020-02-13T14:22:32Z")
HI TEAM, I am using ELK version 7.0. Facing an issue with prune filter. I need to blacklist exact nested fields coming from filebeat. When i tried with below format, prune is unable to blacklist host.architecture field… --- ## [A question about primary/replica re-sync implementation](https://discuss.elastic.co/t/a-question-about-primary-replica-re-sync-implementation/219109)
**Author:** [@iamorchid](https://discuss.elastic.co/u/iamorchid)\ **Replies:** 3\ **Last updated:** [February 13, 2020, 2:10pm UTC](https://discuss.elastic.co/t/a-question-about-primary-replica-re-sync-implementation/219109 "2020-02-13T14:10:12Z")
Let's say we have 3 replicas for one index shard and they have the following local op seqs: node#1(primary) : 1, 2, 3, 4, 5, 6, 7, 8 (local checkpoint: 8, max seqNo: 8, global checkpoint: 5) node#2(replica#1): 1, 2, 3… --- ## [Server send security events with WEF and in Authentication tab I don't found all accesses](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221)
**Author:** [@franco.federico](https://discuss.elastic.co/u/franco.federico)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 2:02pm UTC](https://discuss.elastic.co/t/server-send-security-events-with-wef-and-in-authentication-tab-i-dont-found-all-accesses/219221 "2020-02-13T14:02:37Z")
Hi all I'm using Elastic Stack v7.4.0 and I have a single winlogbeat on the Windows Server that receive with WEF all event of security of differents other server. So I just correct by logstash, that I used to filter al… --- ## [Split Filter Parse Failure - Only String and Array types are splittable](https://discuss.elastic.co/t/split-filter-parse-failure-only-string-and-array-types-are-splittable/219204)
**Author:** [@mohuss](https://discuss.elastic.co/u/mohuss)\ **Replies:** 4\ **Last updated:** [February 13, 2020, 1:54pm UTC](https://discuss.elastic.co/t/split-filter-parse-failure-only-string-and-array-types-are-splittable/219204 "2020-02-13T13:54:41Z")
I have this error with split filter in logstash . "Only String and Array types are splittable. field:\[log\] is of type = NilClass" I am trying to create events for each object in an array of objects but cannot figure ou… --- ## [How to connect SSL enable MYSQL from LOGSTASH](https://discuss.elastic.co/t/how-to-connect-ssl-enable-mysql-from-logstash/219212)
**Author:** [@santojitg](https://discuss.elastic.co/u/santojitg)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 1:39pm UTC](https://discuss.elastic.co/t/how-to-connect-ssl-enable-mysql-from-logstash/219212 "2020-02-13T13:39:50Z")
Hello I would like to sync my data from MYSQL to ElasticSearch using Logstash. I can do that easily from a standard MYSQL database. But facing problem with a SSL enable MYSQL database, It's unable to connect to my jks … --- ## [Logstash JSON Parser is just parsing fields if no target is defined](https://discuss.elastic.co/t/logstash-json-parser-is-just-parsing-fields-if-no-target-is-defined/219205)
**Author:** [@Simon\_Becker](https://discuss.elastic.co/u/Simon_Becker)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 1:08pm UTC](https://discuss.elastic.co/t/logstash-json-parser-is-just-parsing-fields-if-no-target-is-defined/219205 "2020-02-13T13:08:17Z")
Hello, I am currently trying to parse a JSON message through the JSON filter. Without defining any target it works perfectly. When adding a target field it is not parsing any more throwing this error: response=\>{"index… --- ## [Upgrade ECK cluster 7.5.2 to 7.6.0](https://discuss.elastic.co/t/upgrade-eck-cluster-7-5-2-to-7-6-0/219193)
**Author:** [@operatorequals](https://discuss.elastic.co/u/operatorequals)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 12:09pm UTC](https://discuss.elastic.co/t/upgrade-eck-cluster-7-5-2-to-7-6-0/219193 "2020-02-13T12:09:29Z")
Hello people! A week ago, I used: kubectl apply -f https://download.elastic.co/downloads/eck/1.0.0/all-in-one.yaml and created an ES cluster in a Kubernetes (deployed in EC2 instances), of version 7.5.2. Today, as I … --- ## [Filter Refresh Every](https://discuss.elastic.co/t/filter-refresh-every/218947)
**Author:** [@rwr](https://discuss.elastic.co/u/rwr)\ **Replies:** 2\ **Last updated:** [February 13, 2020, 1:01pm UTC](https://discuss.elastic.co/t/filter-refresh-every/218947 "2020-02-13T13:01:02Z")
Hi All, can I set default Refresh Every in Advance Setting (not in dashboard) ? --- ## [How to limit results with same field value to X amount of documents every time it shows up multiple times in a row](https://discuss.elastic.co/t/how-to-limit-results-with-same-field-value-to-x-amount-of-documents-every-time-it-shows-up-multiple-times-in-a-row/217809)
**Author:** [@SeverinDK](https://discuss.elastic.co/u/SeverinDK)\ **Replies:** 9\ **Last updated:** [February 13, 2020, 12:58pm UTC](https://discuss.elastic.co/t/how-to-limit-results-with-same-field-value-to-x-amount-of-documents-every-time-it-shows-up-multiple-times-in-a-row/217809 "2020-02-13T12:58:21Z")
I have an issue that I am not quite sure how to solve. Really hope someone here can help me figure out how to go about it. Imagine that I have 100 documents, all with user\_id fields. I know that most documents are from … --- ## [EPS count on ELK](https://discuss.elastic.co/t/eps-count-on-elk/219200)
**Author:** [@DavidLevi](https://discuss.elastic.co/u/DavidLevi)\ **Replies:** 0\ **Last updated:** [February 13, 2020, 12:42pm UTC](https://discuss.elastic.co/t/eps-count-on-elk/219200 "2020-02-13T12:42:15Z")
Hello, How can I see the EPS count on my ELK system? ELK version is 6.4. [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1627) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1629)