# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1869 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1870 --- ## [Hourly Average over 24 hours](https://discuss.elastic.co/t/hourly-average-over-24-hours/201445)
**Author:** [@neilp](https://discuss.elastic.co/u/neilp)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 7:47pm UTC](https://discuss.elastic.co/t/hourly-average-over-24-hours/201445 "2019-09-27T19:47:09Z")
Hi folks, I am trying to build a bar graph (x-axis=hours 0-23 and y-axis= avg. number of logs) but I have not been able to get this information. I have even tried creating custom Elasticsearch queries with dev tools. Bu… --- ## [Function toJson in stored search template](https://discuss.elastic.co/t/function-tojson-in-stored-search-template/201430)
**Author:** [@p\_tarte](https://discuss.elastic.co/u/p_tarte)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 3:34pm UTC](https://discuss.elastic.co/t/function-tojson-in-stored-search-template/201430 "2019-09-27T15:34:24Z")
Hello, I'm trying to save and call a search template having a parameter that is transformed using the toJson function. Here is an example: POST \_scripts/testScript { "script": { "lang": "mustache", "source": "{ "q… --- ## [React visualization plugin missing access to config and editorConfig](https://discuss.elastic.co/t/react-visualization-plugin-missing-access-to-config-and-editorconfig/201442)
**Author:** [@brandtj](https://discuss.elastic.co/u/brandtj)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 7:12pm UTC](https://discuss.elastic.co/t/react-visualization-plugin-missing-access-to-config-and-editorconfig/201442 "2019-09-27T19:12:35Z")
There are two things that seem missing when creating React visualization plugins. Passing editor config values to your React components that don't get saved in the plugin saved object. (i.e. editorConfig: {collections… --- ## [Kibana Discovery Regex](https://discuss.elastic.co/t/kibana-discovery-regex/199785)
**Author:** [@GaffaOverflow](https://discuss.elastic.co/u/GaffaOverflow)\ **Replies:** 3\ **Last updated:** [September 27, 2019, 7:12pm UTC](https://discuss.elastic.co/t/kibana-discovery-regex/199785 "2019-09-27T19:12:11Z")
Hi Elastic Community, Im trying to use regex in Kibana Discovery search bar but i think im to stupid :smiley: I Found some Threads and Blog Post but it doesnt work for me. Example: Event 1: Some Message: C:\\ProgramD… --- ## [Visualization and Dashboard Suggestion/Question](https://discuss.elastic.co/t/visualization-and-dashboard-suggestion-question/201431)
**Author:** [@TFresenius](https://discuss.elastic.co/u/TFresenius)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 7:06pm UTC](https://discuss.elastic.co/t/visualization-and-dashboard-suggestion-question/201431 "2019-09-27T19:06:47Z")
Hi, I've been working within Kibana to create some useful dashboards with custom fields. But it appears the "Controls" visualization doesn't properly adapt to the established filters of one's dashboard. For example - S… --- ## [How to prettyprint logstash conf file](https://discuss.elastic.co/t/how-to-prettyprint-logstash-conf-file/201458)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 6:56pm UTC](https://discuss.elastic.co/t/how-to-prettyprint-logstash-conf-file/201458 "2019-09-27T18:56:44Z")
Anyone know how to prettyprint these files? I've tried a bunch of the online prettyprinters, using JSON, Ruby, C++, Python, and a few others... but they do weird things with comments. How can I prettyprint these files?… --- ## [How to grok then send to kafka as JSON text?](https://discuss.elastic.co/t/how-to-grok-then-send-to-kafka-as-json-text/201456)
**Author:** [@DeliciousPickle](https://discuss.elastic.co/u/DeliciousPickle)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 6:48pm UTC](https://discuss.elastic.co/t/how-to-grok-then-send-to-kafka-as-json-text/201456 "2019-09-27T18:48:23Z")
In my Logstash config I want to read in a syslog, parse the message text to get some field values, then assemble those fields/values into a JSON string which I then output to a kafka topic. I must be missing something, … --- ## [Monitoring queries sent to Elastic v5.6](https://discuss.elastic.co/t/monitoring-queries-sent-to-elastic-v5-6/201453)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 6:22pm UTC](https://discuss.elastic.co/t/monitoring-queries-sent-to-elastic-v5-6/201453 "2019-09-27T18:22:35Z")
hi guys, just one question: currently I have a cluster with ES 5.6.3. We have scheduled the upgrade to 6.8 but I would like to know if in the meantime I can consider as good the guidelines at the following URL: https://… --- ## [CSV EXPORT BUG](https://discuss.elastic.co/t/csv-export-bug/201414)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 5\ **Last updated:** [September 27, 2019, 6:18pm UTC](https://discuss.elastic.co/t/csv-export-bug/201414 "2019-09-27T18:18:13Z")
kibana exports csv inside but writes in one column. I want separate columns in excel format as I described in the figure. I am developing in kibana development environment. The page developed is on the following page. … --- ## [Snapshots - Deleted Documents](https://discuss.elastic.co/t/snapshots-deleted-documents/201449)
**Author:** [@lucyne](https://discuss.elastic.co/u/lucyne)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 5:54pm UTC](https://discuss.elastic.co/t/snapshots-deleted-documents/201449 "2019-09-27T17:54:27Z")
When taking snapshots of an index, are deleted documents handled? I.E. When I later restore a snapshot it will not re-index documents that I deleted? --- ## [When to use docvalue\_fields](https://discuss.elastic.co/t/when-to-use-docvalue-fields/103144)
**Author:** [@shaharmor](https://discuss.elastic.co/u/shaharmor)\ **Replies:** 5\ **Last updated:** [September 27, 2019, 5:40pm UTC](https://discuss.elastic.co/t/when-to-use-docvalue-fields/103144 "2019-09-27T17:40:03Z")
Hi, I see that Kibana is using docvalue\_fields all the time for the @timestamp field. When is using docvalue\_fields vs stored\_fields better? Is there a general use case? Aren't all fields fetched using doc\_values anywa… --- ## [Is possible Exact match substring in kibana?](https://discuss.elastic.co/t/is-possible-exact-match-substring-in-kibana/200062)
**Author:** [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)\ **Replies:** 4\ **Last updated:** [September 27, 2019, 5:27pm UTC](https://discuss.elastic.co/t/is-possible-exact-match-substring-in-kibana/200062 "2019-09-27T17:27:14Z")
Hello. Is it possible to exact match substring of text field in kibana? I try to search "Get-System", but i get results like What ways are possible to solve the problem? I know, that it is possible to write a DSL q… --- ## [Is there a faster way to test logstash configs with stdin?](https://discuss.elastic.co/t/is-there-a-faster-way-to-test-logstash-configs-with-stdin/201113)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 8\ **Last updated:** [September 27, 2019, 4:34pm UTC](https://discuss.elastic.co/t/is-there-a-faster-way-to-test-logstash-configs-with-stdin/201113 "2019-09-27T16:34:16Z")
I found this post from Dec 2018, but the automatic reload doesn't work with stdin (at least up to 6.8, which is my limit at the moment)... Any tips on how to test a developing configuration faster? Or we really have to s… --- ## [Translate keys/fields](https://discuss.elastic.co/t/translate-keys-fields/201127)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 1\ **Last updated:** [September 26, 2019, 11:46pm UTC](https://discuss.elastic.co/t/translate-keys-fields/201127 "2019-09-26T23:46:32Z")
So, after that dissect doubt, the new one is: how can I translate keys or fieldnames? The files I'm reading are IAS/NPS, so they come with "key,value" and key being a number. But to better understand, navigate, use at w… --- ## [How can we import only new/updated records if there is no unique/timestamp in sql server (using logstash)](https://discuss.elastic.co/t/how-can-we-import-only-new-updated-records-if-there-is-no-unique-timestamp-in-sql-server-using-logstash/201421)
**Author:** [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 4:12pm UTC](https://discuss.elastic.co/t/how-can-we-import-only-new-updated-records-if-there-is-no-unique-timestamp-in-sql-server-using-logstash/201421 "2019-09-27T16:12:45Z")
Dear All. i have some data in sql server side but there is no any unique records there but we want to import only newly / updated data from sql server to elastic search as index . please help for this use case. Tha… --- ## [Error calling \_cat/indices from Java REST Client - Illegal request-target, unexpected character '/' at position 4](https://discuss.elastic.co/t/error-calling-cat-indices-from-java-rest-client-illegal-request-target-unexpected-character-at-position-4/201434)
**Author:** [@jxerome](https://discuss.elastic.co/u/jxerome)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 4:11pm UTC](https://discuss.elastic.co/t/error-calling-cat-indices-from-java-rest-client-illegal-request-target-unexpected-character-at-position-4/201434 "2019-09-27T16:11:29Z")
Hello everyone, I have strange problem with \_cat/indices on a client deployment: it always fails on the client cluster, it always works using curl with the same parameters, I never reproduced it on a test cluster of t… --- ## [Using gsub to replace an unknown amount of multiple white space to single whitespace](https://discuss.elastic.co/t/using-gsub-to-replace-an-unknown-amount-of-multiple-white-space-to-single-whitespace/201363)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 4:08pm UTC](https://discuss.elastic.co/t/using-gsub-to-replace-an-unknown-amount-of-multiple-white-space-to-single-whitespace/201363 "2019-09-27T16:08:54Z")
Hi guys, Does anyone know how to replace multiple whitespace using gsub? Below doesn't work - but something like this? gsub =\> \[ "syslog\_event", "\\s+", " ", \] Thanks --- ## [Prevent Keyword Stuffing](https://discuss.elastic.co/t/prevent-keyword-stuffing/200284)
**Author:** [@Cannon\_Moyer](https://discuss.elastic.co/u/Cannon_Moyer)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 3:31pm UTC](https://discuss.elastic.co/t/prevent-keyword-stuffing/200284 "2019-09-27T15:31:54Z")
I'm using ES 7.3. I have a product index with titles, part, model numbers, etc. I am having issues with keyword stuffing because some of the products might contain the same word, part or model number multiple times throu… --- ## [Recommended max\_buckets](https://discuss.elastic.co/t/recommended-max-buckets/201427)
**Author:** [@baselai](https://discuss.elastic.co/u/baselai)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 3:23pm UTC](https://discuss.elastic.co/t/recommended-max-buckets/201427 "2019-09-27T15:23:12Z")
What's the recommended search.max\_buckets ? It's set in the aggregations to 10000, but we can't use pagination, so we need to increase the value from 10k to something else. --- ## [Elasticsearch terms aggregation with sub query](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-sub-query/201165)
**Author:** [@Jayabal\_K](https://discuss.elastic.co/u/Jayabal_K)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 3:19pm UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggregation-with-sub-query/201165 "2019-09-27T15:19:13Z")
I need to aggregate the docs (term aggregation), based on the another field vale (atleast one occurrence). For example, I using the api traffic data, I need to get the top api list based on the total doc\_count, who has … --- ## [Передача переменной в запросе из Powershell в Elasticsearch](https://discuss.elastic.co/t/powershell-elasticsearch/201395)
**Author:** [@KOTOXJle6](https://discuss.elastic.co/u/KOTOXJle6)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 3:09pm UTC](https://discuss.elastic.co/t/powershell-elasticsearch/201395 "2019-09-27T15:09:22Z")
Добрый день. Хочу настроить возможность получать данные из ES через powershell. В моем случае это поиск по логу Exchange. Вижу это так: администратор запускает скрипт, вводит в переменные отправителя, получателя, дату и… --- ## [Find and show values of a field, which is also in another field](https://discuss.elastic.co/t/find-and-show-values-of-a-field-which-is-also-in-another-field/201077)
**Author:** [@MarcusCaepio](https://discuss.elastic.co/u/MarcusCaepio)\ **Replies:** 4\ **Last updated:** [September 27, 2019, 3:03pm UTC](https://discuss.elastic.co/t/find-and-show-values-of-a-field-which-is-also-in-another-field/201077 "2019-09-27T15:03:31Z")
Hi all, I try to explain my problem as best as I can. Please ask if it is still not clear: So, I am sending me logfiles of two different systems via filebeat and parse them via logstash. The documents of "ServerA" con… --- ## [How to Split the mail body message field into different new fields](https://discuss.elastic.co/t/how-to-split-the-mail-body-message-field-into-different-new-fields/201419)
**Author:** [@Nitin\_Malhar](https://discuss.elastic.co/u/Nitin_Malhar)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 2:42pm UTC](https://discuss.elastic.co/t/how-to-split-the-mail-body-message-field-into-different-new-fields/201419 "2019-09-27T14:42:51Z")
Hi I am new to ELK please may I know how to split mail body into different fields so that i can create a table kind of data out of mail body. --- ## [Kibana rastarize.js customize](https://discuss.elastic.co/t/kibana-rastarize-js-customize/201403)
**Author:** [@mr\_searchng](https://discuss.elastic.co/u/mr_searchng)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 2:18pm UTC](https://discuss.elastic.co/t/kibana-rastarize-js-customize/201403 "2019-09-27T14:18:19Z")
rastarize.js how import webpage phantom js ? I use kibana dev platform. I add with yarn add webpage ,but there is error. --- ## [Cluster recovery after deleting indices directory](https://discuss.elastic.co/t/cluster-recovery-after-deleting-indices-directory/201276)
**Author:** [@Sergio\_Peral\_Aguiler](https://discuss.elastic.co/u/Sergio_Peral_Aguiler)\ **Replies:** 2\ **Last updated:** [September 27, 2019, 12:27pm UTC](https://discuss.elastic.co/t/cluster-recovery-after-deleting-indices-directory/201276 "2019-09-27T12:27:40Z")
Hello team, First of all, thank you for the product. My question is: is there any way to recover a cluster after having removed the path.data/nodes/\/indices ? After having done that, my cluster is not able to fin… --- ## [Elastic in docker container logs](https://discuss.elastic.co/t/elastic-in-docker-container-logs/201412)
**Author:** [@jlim0930](https://discuss.elastic.co/u/jlim0930)\ **Replies:** 0\ **Last updated:** [September 27, 2019, 1:53pm UTC](https://discuss.elastic.co/t/elastic-in-docker-container-logs/201412 "2019-09-27T13:53:34Z")
if we are running elastic/logstash/kibana in docker containers how do you setup the logging so that the logs show up in the stack monitoring? when you click on the link it saids to use filebeat but since each component … --- ## [Not able to load kibana in browser](https://discuss.elastic.co/t/not-able-to-load-kibana-in-browser/201220)
**Author:** [@priiya21](https://discuss.elastic.co/u/priiya21)\ **Replies:** 5\ **Last updated:** [September 27, 2019, 1:47pm UTC](https://discuss.elastic.co/t/not-able-to-load-kibana-in-browser/201220 "2019-09-27T13:47:26Z")
Am getting the following log for kibana. Am running my kibana in port 80 in my linux server. But am not able to load kibana in browser "state":"green","message":"Status changed from yellow to green - Ready","prevState"… --- ## [Update field value if it matches a certain word](https://discuss.elastic.co/t/update-field-value-if-it-matches-a-certain-word/201305)
**Author:** [@naveenrt23](https://discuss.elastic.co/u/naveenrt23)\ **Replies:** 3\ **Last updated:** [September 26, 2019, 8:32pm UTC](https://discuss.elastic.co/t/update-field-value-if-it-matches-a-certain-word/201305 "2019-09-26T20:32:13Z")
Hello, I am trying to replace the value of a field if the field value matches with a certain regex. I am looking at the update function in mutate filter. output: "repo" =\> "test-xyz;buildNumber=2.1", how do i set a … --- ## [How to constrain sum metrics based on value of a count metric](https://discuss.elastic.co/t/how-to-constrain-sum-metrics-based-on-value-of-a-count-metric/197843)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 3\ **Last updated:** [September 27, 2019, 1:37pm UTC](https://discuss.elastic.co/t/how-to-constrain-sum-metrics-based-on-value-of-a-count-metric/197843 "2019-09-27T13:37:42Z")
Got a table visualization bucktizing on two Term fields and then doing various split Metrics on other fields. Wondering if I might be able to filter out documents with 2. bucktize term seen more than once from other sum… --- ## [Filter and sort based on attributes in Terms lookup document](https://discuss.elastic.co/t/filter-and-sort-based-on-attributes-in-terms-lookup-document/200241)
**Author:** [@come\_along\_bort](https://discuss.elastic.co/u/come_along_bort)\ **Replies:** 1\ **Last updated:** [September 27, 2019, 1:36pm UTC](https://discuss.elastic.co/t/filter-and-sort-based-on-attributes-in-terms-lookup-document/200241 "2019-09-27T13:36:51Z")
I have documents which contain a users collection which are linked to other documents through the documents id attribute like so: PUT /collection/1 { "items": \[ {"id": 1, "time\_added": "2017-08-07T09:07:15.0… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1868) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1870)