# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1676 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1677 --- ## [Master role does not switch automaticaly](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213)
**Author:** [@The-oo](https://discuss.elastic.co/u/The-oo)\ **Replies:** 16\ **Last updated:** [January 20, 2020, 10:09am UTC](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213 "2020-01-20T10:09:32Z")
Hello everyone, I've recently having issue moving the master role from node to node. I got 3 node in my cluster and there are all 3 master-eligible nodes : I first disable shard allocation on my second node and i le… --- ## [Missing "Split Series" option on Heat Map Visualization](https://discuss.elastic.co/t/missing-split-series-option-on-heat-map-visualization/215710)
**Author:** [@MARCO\_RAMBALDI](https://discuss.elastic.co/u/MARCO_RAMBALDI)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 10:23am UTC](https://discuss.elastic.co/t/missing-split-series-option-on-heat-map-visualization/215710 "2020-01-20T10:23:01Z")
Hi, I have noticed the lack of the SPLIT SERIES option since the 7.4 version. Why? Before this change, I was able to discriminate data on the y-axis. Now there is only SPLIT CHARTS option, so i can do a similar operati… --- ## [Elasticsearch support both case sensitive & insensitive](https://discuss.elastic.co/t/elasticsearch-support-both-case-sensitive-insensitive/215686)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 10:16am UTC](https://discuss.elastic.co/t/elasticsearch-support-both-case-sensitive-insensitive/215686 "2020-01-20T10:16:17Z")
Setup: Elasticsearch 6.3 I have an index that represents the products catalog. Every document contains one product's data. One of the fields called categories which is an array of strings - List of relevant categories… --- ## [Filebeat to ECK on GKE](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575)
**Author:** [@Zero\_Day](https://discuss.elastic.co/u/Zero_Day)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 10:03am UTC](https://discuss.elastic.co/t/filebeat-to-eck-on-gke/215575 "2020-01-20T10:03:58Z")
I built a cluster on GKE with ECK operator and am trying to send logs from an on premises Filebeat installation to the cloud. Elasticsearch has LoadBlancer IP. I specified certificate, password and necessary things, but… --- ## [Index S3 and Git Files having metadata in to elastic](https://discuss.elastic.co/t/index-s3-and-git-files-having-metadata-in-to-elastic/215705)
**Author:** [@Aakash\_Sharma](https://discuss.elastic.co/u/Aakash_Sharma)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 9:52am UTC](https://discuss.elastic.co/t/index-s3-and-git-files-having-metadata-in-to-elastic/215705 "2020-01-20T09:52:13Z")
we are looking to index meta-info for S3 documents and Github repo files in to elastic. these files will have additional/metadata fields like howtouse, description, licensenumber etc. Ideally indexing should be event bas… --- ## [Synonym and synonym graph filters](https://discuss.elastic.co/t/synonym-and-synonym-graph-filters/215704)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 9:51am UTC](https://discuss.elastic.co/t/synonym-and-synonym-graph-filters/215704 "2020-01-20T09:51:41Z")
Hi, this page on synonym graphs reads: The synonym\_graph token filter allows to easily handle synonyms, including multi-word synonyms correctly during the analysis process. Does that mean that a simple "synonyms" f… --- ## [Search doesn't find the document that it should find when index is big?](https://discuss.elastic.co/t/search-doesnt-find-the-document-that-it-should-find-when-index-is-big/214386)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 28\ **Last updated:** [January 20, 2020, 9:49am UTC](https://discuss.elastic.co/t/search-doesnt-find-the-document-that-it-should-find-when-index-is-big/214386 "2020-01-20T09:49:31Z")
Hi, I have a problem with Elasticsearch 6.8 (I also tried with 5.6 and 2.4 since we are upgrading) where it can't find the document that I want when the index has over 800K documents but when I create another index with … --- ## [CSV filter plugin and changing column headers](https://discuss.elastic.co/t/csv-filter-plugin-and-changing-column-headers/215493)
**Author:** [@mhyager](https://discuss.elastic.co/u/mhyager)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 9:40am UTC](https://discuss.elastic.co/t/csv-filter-plugin-and-changing-column-headers/215493 "2020-01-20T09:40:29Z")
I have a set of CSV files which have similar but not identical headers. I import these using the automatic header detection and autdetect numerics to set correct data types. Depending on the process that generates them,… --- ## [How to apply predefined template if log collection is done in a different way](https://discuss.elastic.co/t/how-to-apply-predefined-template-if-log-collection-is-done-in-a-different-way/215434)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 9:37am UTC](https://discuss.elastic.co/t/how-to-apply-predefined-template-if-log-collection-is-done-in-a-different-way/215434 "2020-01-20T09:37:45Z")
Hey Fellas, I need to collect suricata logs from a machine. By default suricata has a template in kibana if logs collected with filebeat and suricata filebeat module is installed, dashboards are created automatically. S… --- ## [Logstash Failed to Execute](https://discuss.elastic.co/t/logstash-failed-to-execute/215568)
**Author:** [@Srinivas\_Kondapally](https://discuss.elastic.co/u/Srinivas_Kondapally)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 9:32am UTC](https://discuss.elastic.co/t/logstash-failed-to-execute/215568 "2020-01-20T09:32:16Z")
Hello, I am new to Logstash, Just now download logstash and tried to run the command. logstash -e 'input{stdin{}}output{stdout{}}'. I got an error Sending Logstash logs to C:/Users/adity/Desktop/Elastic\_Search/logstas… --- ## [Can ES not to store original keyword content but a mapping num value (4 save space)?](https://discuss.elastic.co/t/can-es-not-to-store-original-keyword-content-but-a-mapping-num-value-4-save-space/215664)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 9:29am UTC](https://discuss.elastic.co/t/can-es-not-to-store-original-keyword-content-but-a-mapping-num-value-4-save-space/215664 "2020-01-20T09:29:49Z")
We use es as tsdb described in my other question and data look like: { "metric": "metric\_name", "@timestamp": "2020-01-01T01:01:01", "t": { "key1": "val1", "key2": "val2" }, "f": { "name1": 1.2, "name2": … --- ## [User/role management best practices](https://discuss.elastic.co/t/user-role-management-best-practices/187197)
**Author:** [@t0ffel](https://discuss.elastic.co/u/t0ffel)\ **Replies:** 4\ **Last updated:** [January 20, 2020, 9:28am UTC](https://discuss.elastic.co/t/user-role-management-best-practices/187197 "2020-01-20T09:28:53Z")
What is the best practice for the user and role management with the operator? Is it preferable to create users k8s resources or is it better to create users via Kibana? is there a way to do custom roles via k8s resourc… --- ## [How make control only for one table on dashboard?](https://discuss.elastic.co/t/how-make-control-only-for-one-table-on-dashboard/215692)
**Author:** [@111249](https://discuss.elastic.co/u/111249)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 9:26am UTC](https://discuss.elastic.co/t/how-make-control-only-for-one-table-on-dashboard/215692 "2020-01-20T09:26:41Z")
Hello everyone, I have a dashboard and where are 2 tables: "products by supermarket" and "products by category". I have kibana control to filter by supermarket. I want to filter only the table with categories on this das… --- ## [Accessing the snapshot after deleting the repository](https://discuss.elastic.co/t/accessing-the-snapshot-after-deleting-the-repository/215682)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 9:03am UTC](https://discuss.elastic.co/t/accessing-the-snapshot-after-deleting-the-repository/215682 "2020-01-20T09:03:32Z")
Hi Team, We have accidentally deleted a repository that was having a valid snapshot. We understand from the snapshot documentation that, deleting a repository only unregister, that means only removes the reference to th… --- ## [User access privilege on specific dashboard](https://discuss.elastic.co/t/user-access-privilege-on-specific-dashboard/215676)
**Author:** [@Tennis](https://discuss.elastic.co/u/Tennis)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 8:56am UTC](https://discuss.elastic.co/t/user-access-privilege-on-specific-dashboard/215676 "2020-01-20T08:56:39Z")
I have multiple dashboards template (es. D1, D2, D3...etc). Can I control access privilege of each user correspond to dashboard name such as: user\_1 \>\> can access D1, D2 user\_2 \>\> can access D3, D4. --- ## [How to do multiplication on a field like sum function do?](https://discuss.elastic.co/t/how-to-do-multiplication-on-a-field-like-sum-function-do/215690)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 8:56am UTC](https://discuss.elastic.co/t/how-to-do-multiplication-on-a-field-like-sum-function-do/215690 "2020-01-20T08:56:09Z")
As title said, how to do multiplication on a field like sum function do like: POST tsdb\_alias/\_search?routing=metric\_name1 { "query": { "bool": { "filter": \[ { "term": { "metric… --- ## [Using EUI inside FieldFormatter plugin](https://discuss.elastic.co/t/using-eui-inside-fieldformatter-plugin/214032)
**Author:** [@Elaak](https://discuss.elastic.co/u/Elaak)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 8:23am UTC](https://discuss.elastic.co/t/using-eui-inside-fieldformatter-plugin/214032 "2020-01-20T08:23:53Z")
I have a FieldFormatter where I want to use EUI to create a html representation of some data. I want a modal dialog to open when I press on one field. This is a type of extended version for the "Truncated String" FieldFo… --- ## [How to apply filter in kibana visualization](https://discuss.elastic.co/t/how-to-apply-filter-in-kibana-visualization/215431)
**Author:** [@Aurelien1609](https://discuss.elastic.co/u/Aurelien1609)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 8:13am UTC](https://discuss.elastic.co/t/how-to-apply-filter-in-kibana-visualization/215431 "2020-01-20T08:13:06Z")
Hi, I want to filter a specific visualization : a vertical bar chart in my Kibana Dashboard. I don't want to use Control visualization because the filter should be only applied on this bar chart. Example : I created a … --- ## [XML response from unstructured log](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916)
**Author:** [@Kishorekolla](https://discuss.elastic.co/u/Kishorekolla)\ **Replies:** 6\ **Last updated:** [January 20, 2020, 7:25am UTC](https://discuss.elastic.co/t/xml-response-from-unstructured-log/213916 "2020-01-20T07:25:07Z")
Hi Team, I'm a beginner to logstash. Till now worked on configuring basic Input, Filebeats and Output plugins by following product documents which are available in the official website. Now I have a real time scenario … --- ## [Dashboard doesn't "keep" time selected](https://discuss.elastic.co/t/dashboard-doesnt-keep-time-selected/215471)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 6:57am UTC](https://discuss.elastic.co/t/dashboard-doesnt-keep-time-selected/215471 "2020-01-20T06:57:45Z")
Hi! I saved a dashboard with a specific time range selected in time filter but when I open again this dashboard, the time in time filter is "Last 15 minutes". So in the corresponding iframe I see data from last 15 minut… --- ## [Elasticsearch Influx db connection](https://discuss.elastic.co/t/elasticsearch-influx-db-connection/215289)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 6:25am UTC](https://discuss.elastic.co/t/elasticsearch-influx-db-connection/215289 "2020-01-20T06:25:58Z")
How to connect elasticsearch with influx db? --- ## [HOW TO logstash convert all fields to integer(or some fields)](https://discuss.elastic.co/t/how-to-logstash-convert-all-fields-to-integer-or-some-fields/215660)
**Author:** [@esongi](https://discuss.elastic.co/u/esongi)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 6:09am UTC](https://discuss.elastic.co/t/how-to-logstash-convert-all-fields-to-integer-or-some-fields/215660 "2020-01-20T06:09:25Z")
Hello I am a foreign developer. Even if the translation is awkward, please understand My process is Elastic \>\> logstash \>\> fileBeat \>\> Kibana Logstash reads and uses csv file. The flow creates a csv file containing the… --- ## [Optimizing Datefield processing by moving from date{} to ruby code](https://discuss.elastic.co/t/optimizing-datefield-processing-by-moving-from-date-to-ruby-code/215665)
**Author:** [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 5:31am UTC](https://discuss.elastic.co/t/optimizing-datefield-processing-by-moving-from-date-to-ruby-code/215665 "2020-01-20T05:31:05Z")
Hello, Currently in my pipeline I'm parsing out loglines, each log line begins with a timestamp such as: "2020-01-19T00:00:08.127+0800" to a field called logtimestamp, and then later in my pipeline update this to the @t… --- ## [Manipulation with Logstash](https://discuss.elastic.co/t/manipulation-with-logstash/215308)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 12\ **Last updated:** [January 20, 2020, 5:06am UTC](https://discuss.elastic.co/t/manipulation-with-logstash/215308 "2020-01-20T05:06:29Z")
Hi All, I am new to Logstash manipulations and I have no idea how to do the below. I have a sample data as below: Column:Type Incident Response P3 Incident Resolution L1.5 P2 ... The column data is… --- ## [How to write a efficient ES query for the below SQL query?](https://discuss.elastic.co/t/how-to-write-a-efficient-es-query-for-the-below-sql-query/215599)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 4:53am UTC](https://discuss.elastic.co/t/how-to-write-a-efficient-es-query-for-the-below-sql-query/215599 "2020-01-20T04:53:09Z")
select tag1, tag2, sum(sum\_val) select tag-uid, sum(value) as sum\_val from data\_table group by tag-uid join tag\_table using(tag-uid) group by tag1, tag2 --- ## [How to export csv in kibana 7.5 with more then 1 million row](https://discuss.elastic.co/t/how-to-export-csv-in-kibana-7-5-with-more-then-1-million-row/214526)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 7\ **Last updated:** [January 20, 2020, 4:29am UTC](https://discuss.elastic.co/t/how-to-export-csv-in-kibana-7-5-with-more-then-1-million-row/214526 "2020-01-20T04:29:15Z")
I need help... i have problem with reporting CSV on kibana. i want to get CSV with 1.000.000 row from discover but its always failed. i get notif that \[Reporting generate CSV error:Unable to generate report Max attempts … --- ## [Master not discovered or elected yet, an election requires at least 2 nodes](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes/213412)
**Author:** [@li-peng](https://discuss.elastic.co/u/li-peng)\ **Replies:** 4\ **Last updated:** [January 20, 2020, 3:16am UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-at-least-2-nodes/213412 "2020-01-20T03:16:03Z")
\[2019-12-31T14:29:23,954\]\[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[node1\] master not discovered or elected yet, an election requires at least 2 nodes with ids from \[5e3LlD8QTHmGaJDhlKY-8w, cJyHBa9ATf-2vg8Tnt7KeQ,… --- ## [Max bucket aggregation (on @timestamp /s)](https://discuss.elastic.co/t/max-bucket-aggregation-on-timestamp-s/213684)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 2\ **Last updated:** [January 19, 2020, 7:27pm UTC](https://discuss.elastic.co/t/max-bucket-aggregation-on-timestamp-s/213684 "2020-01-19T19:27:29Z")
what is the correct approach to draw count of events (showing maximum events/seconds) I am trying to create visualisation (see picture below) show graf with maximum events/seconds Kibana is automatically scale @timest… --- ## [Enable Soundex query](https://discuss.elastic.co/t/enable-soundex-query/215633)
**Author:** [@somesh1980](https://discuss.elastic.co/u/somesh1980)\ **Replies:** 0\ **Last updated:** [January 19, 2020, 5:07pm UTC](https://discuss.elastic.co/t/enable-soundex-query/215633 "2020-01-19T17:07:46Z")
I am using elasticsearch 7.0.1 and trying to enable soundex query First I tried to add following config in elasticsearch.yml index: analysis: analyzer: search\_soundex: type: custom tokenizer: soundex\_filter filt… --- ## [GC allocation failure causing shard to fail](https://discuss.elastic.co/t/gc-allocation-failure-causing-shard-to-fail/215628)
**Author:** [@Alex\_Davidovich](https://discuss.elastic.co/u/Alex_Davidovich)\ **Replies:** 0\ **Last updated:** [January 19, 2020, 3:56pm UTC](https://discuss.elastic.co/t/gc-allocation-failure-causing-shard-to-fail/215628 "2020-01-19T15:56:35Z")
In Elastic log I can see master (node-2) removing node-3 and adding multiple times. At around the same time, I see long GC cycles on node-3. \[2020-01-17T01:33:49,904\]\[INFO \]\[o.e.c.s.ClusterApplierService\] \[node-2\] rem… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1675) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1677)