# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1961 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1962 --- ## [Install on LXC hangs at 17%](https://discuss.elastic.co/t/install-on-lxc-hangs-at-17/194724)
**Author:** [@Jeremy\_D](https://discuss.elastic.co/u/Jeremy_D)\ **Replies:** 3\ **Last updated:** [August 14, 2019, 12:02am UTC](https://discuss.elastic.co/t/install-on-lxc-hangs-at-17/194724 "2019-08-14T00:02:17Z")
Trying to install kibana on an LXC container under proxmox. Fresh container using an ubuntu template, installed the repo just fine, did apt update, no problems. Once I do apt install kibana, it seems to go ok until it r… --- ## [Why do I need to set times in UTC in the query bar?](https://discuss.elastic.co/t/why-do-i-need-to-set-times-in-utc-in-the-query-bar/194281)
**Author:** [@jcaballero](https://discuss.elastic.co/u/jcaballero)\ **Replies:** 3\ **Last updated:** [August 13, 2019, 11:56pm UTC](https://discuss.elastic.co/t/why-do-i-need-to-set-times-in-utc-in-the-query-bar/194281 "2019-08-13T23:56:01Z")
Using Kibana 5.4.1 Here are the facts: The data I am parsing with LogStash includes some timestamps I need to convert to a new field "my\_datefield". Those timestamps are in local time in the logs files. I conve… --- ## [Restricting time period selection in Kibana](https://discuss.elastic.co/t/restricting-time-period-selection-in-kibana/194548)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 11:27pm UTC](https://discuss.elastic.co/t/restricting-time-period-selection-in-kibana/194548 "2019-08-13T23:27:36Z")
I would like to explore the options for restricting users' ability to change time periods. Ideally I would like to allow "any 24 hour period" or similar, but I would accept just locking the time filter full stop for now.… --- ## [Data Table Visualization from different documents](https://discuss.elastic.co/t/data-table-visualization-from-different-documents/194621)
**Author:** [@joseja](https://discuss.elastic.co/u/joseja)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 11:22pm UTC](https://discuss.elastic.co/t/data-table-visualization-from-different-documents/194621 "2019-08-13T23:22:05Z")
I am trying to create a data table visualization in Kibana 6.6.2 - but my problem is that I am getting the values for the table from different documents. Say that I have one document which has an event field = event\_A\_S… --- ## [Remove part of message string in logstash config](https://discuss.elastic.co/t/remove-part-of-message-string-in-logstash-config/194913)
**Author:** [@rohitg](https://discuss.elastic.co/u/rohitg)\ **Replies:** 5\ **Last updated:** [August 13, 2019, 11:19pm UTC](https://discuss.elastic.co/t/remove-part-of-message-string-in-logstash-config/194913 "2019-08-13T23:19:36Z")
Hi, I have a string like - 123RGT78.XY.ABD.COM I need only 123RGT78 from this string and want to remove everything coming after the first dot (.) How to achieve this. filter { mutate { gsub =\> \["message", "\] } } --- ## [How can I customize label in a new visualization?](https://discuss.elastic.co/t/how-can-i-customize-label-in-a-new-visualization/194848)
**Author:** [@grad](https://discuss.elastic.co/u/grad)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 11:10pm UTC](https://discuss.elastic.co/t/how-can-i-customize-label-in-a-new-visualization/194848 "2019-08-13T23:10:45Z")
Hi all, I would like to customize a label in a new visualization... How can I reach out this? When you create a new visualization you can edit 2 label: the metric label the bucket/split group label And the final res… --- ## [Painless script. Illegal list shortcut value \[value\]. For try to stup field variable](https://discuss.elastic.co/t/painless-script-illegal-list-shortcut-value-value-for-try-to-stup-field-variable/194864)
**Author:** [@nopma](https://discuss.elastic.co/u/nopma)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 11:08pm UTC](https://discuss.elastic.co/t/painless-script-illegal-list-shortcut-value-value-for-try-to-stup-field-variable/194864 "2019-08-13T23:08:47Z")
Hello all, I tried with Painless script to create a new field from another field. I have this code if(doc\['name.keyword'\].size()!=0){ def p =/\[^\\/\]+\\/(\[^\\/\]+)/; def m = p.matcher(doc\['name.keyword'\].value)… --- ## [Text blocked in gauge view](https://discuss.elastic.co/t/text-blocked-in-gauge-view/194902)
**Author:** [@cbmurphy87](https://discuss.elastic.co/u/cbmurphy87)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 11:06pm UTC](https://discuss.elastic.co/t/text-blocked-in-gauge-view/194902 "2019-08-13T23:06:27Z")
I'm doing a multi-host gauge view, and the text on the first is too large to be shown in the gauge when it is in MB/s instead of GB/s. Is there a way to reduce the text size, or have it shrink automatically if it's too l… --- ## [Custom Region Maps in Elastic Cloud Service](https://discuss.elastic.co/t/custom-region-maps-in-elastic-cloud-service/195107)
**Author:** [@Paul\_Goldsmith](https://discuss.elastic.co/u/Paul_Goldsmith)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 10:54pm UTC](https://discuss.elastic.co/t/custom-region-maps-in-elastic-cloud-service/195107 "2019-08-13T22:54:13Z")
I'd like to add some custom region maps to my ECS Kibana instance similar to what is discussed in this post https://www.elastic.co/blog/custom-region-maps-in-kibana-6-0. I see how to edit the kibana.yml file in the "adv… --- ## [Error parsing mappings: Unexpected token f in JSON at position 81](https://discuss.elastic.co/t/error-parsing-mappings-unexpected-token-f-in-json-at-position-81/194966)
**Author:** [@pharshil9697](https://discuss.elastic.co/u/pharshil9697)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 10:31pm UTC](https://discuss.elastic.co/t/error-parsing-mappings-unexpected-token-f-in-json-at-position-81/194966 "2019-08-13T22:31:35Z")
I am trying to import one CSV file in Data Visualizer in Kibana. Mappings : { "@timestamp": { "type": "date" }, "Date": { "type": "date" format : "dd-MM-yyyy" }, "Order\_Demand": { "type": "l… --- ## [Kibana Login page customization](https://discuss.elastic.co/t/kibana-login-page-customization/195017)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 10:22pm UTC](https://discuss.elastic.co/t/kibana-login-page-customization/195017 "2019-08-13T22:22:04Z")
Hi All, We have been using elasticsearch cloud instance and have been using default kibana login page, there is a requirement to have customer logo in the login page instead of kibana. Is there a way to change the logi… --- ## [Can't register snapshot repository to S3](https://discuss.elastic.co/t/cant-register-snapshot-repository-to-s3/195115)
**Author:** [@Bursade](https://discuss.elastic.co/u/Bursade)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 10:14pm UTC](https://discuss.elastic.co/t/cant-register-snapshot-repository-to-s3/195115 "2019-08-13T22:14:41Z")
Hi all! I'm trying to register an S3 bucket as my snapshot repository. I'm using Elasticsearch Service, from AWS (which uses version 5.5 of Elasticsearch) When I run this script import boto3 import requests from req… --- ## [Spaces default dashboard](https://discuss.elastic.co/t/spaces-default-dashboard/195039)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 10:07pm UTC](https://discuss.elastic.co/t/spaces-default-dashboard/195039 "2019-08-13T22:07:22Z")
Hi all, I was wondering if there exists a way to set a default route/dashboard for a specific Kibana Space, i.e. multiple Spaces having different default dashboard. Let me explain better. In my Kibana instance I have … --- ## [Terms aggregation on both axes of line graph and dot size using doc count](https://discuss.elastic.co/t/terms-aggregation-on-both-axes-of-line-graph-and-dot-size-using-doc-count/195063)
**Author:** [@nitesh.nawada](https://discuss.elastic.co/u/nitesh.nawada)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 9:59pm UTC](https://discuss.elastic.co/t/terms-aggregation-on-both-axes-of-line-graph-and-dot-size-using-doc-count/195063 "2019-08-13T21:59:56Z")
I have documents like this { "\_index": "bbd-smartaccess", "\_type": "transaction", "\_id": "361989", "\_version": 1, "\_score": null, "\_source": { "transaction\_id": 361989, "@timestamp": "2019-08-12T10:23:41.154Z", … --- ## [Does number of fields increases if we index some fields with offsets?](https://discuss.elastic.co/t/does-number-of-fields-increases-if-we-index-some-fields-with-offsets/193326)
**Author:** [@elk11](https://discuss.elastic.co/u/elk11)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 8:47pm UTC](https://discuss.elastic.co/t/does-number-of-fields-increases-if-we-index-some-fields-with-offsets/193326 "2019-08-13T20:47:55Z")
Hi, To solve the issue of 'lenght of the field x exceeding the limit set for highlighting', we decided to index large fields with 'index\_options: offsets' as suggested by error message. But post this fix we are getting… --- ## [Logstash won't change template](https://discuss.elastic.co/t/logstash-wont-change-template/195098)
**Author:** [@jwalls](https://discuss.elastic.co/u/jwalls)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 8:23pm UTC](https://discuss.elastic.co/t/logstash-wont-change-template/195098 "2019-08-13T20:23:38Z")
I am running logstash on a docker container, and I need to put in the template i am using. I have tried a PUT command to my elasticsearch URL, but the container continues to use the default template and gives me the fina… --- ## [Elastic training - Logstash data load](https://discuss.elastic.co/t/elastic-training-logstash-data-load/195097)
**Author:** [@Sangu](https://discuss.elastic.co/u/Sangu)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 8:21pm UTC](https://discuss.elastic.co/t/elastic-training-logstash-data-load/195097 "2019-08-13T20:21:46Z")
I attended Elastic Engineer 1 trainig coursein Feb 2019, and was trying to load data into elastic from postgress using logstash, which is not loading and neither there is any error message. Training was on Elasticseacrh… --- ## [Rollover alias with date](https://discuss.elastic.co/t/rollover-alias-with-date/192308)
**Author:** [@abaullosa](https://discuss.elastic.co/u/abaullosa)\ **Replies:** 2\ **Last updated:** [August 13, 2019, 8:10pm UTC](https://discuss.elastic.co/t/rollover-alias-with-date/192308 "2019-08-13T20:10:56Z")
Hi. I need some help with the Rollover API. I need to have a new index every day with the name + datetime (index-YYYYMMDD) This is what I have now so far.. My app is sending the data to an an alias called alias\_1 t… --- ## [Bytes to kbytes](https://discuss.elastic.co/t/bytes-to-kbytes/195094)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 8:04pm UTC](https://discuss.elastic.co/t/bytes-to-kbytes/195094 "2019-08-13T20:04:55Z")
So i have metricbeats running. I am trying to create a visualization for the reads & writes but in kbytes unit. is scripted field the correct way to achieve it? i tried one but it's giving me this error. "script"… --- ## [ImmutableSettings not. amember of ES](https://discuss.elastic.co/t/immutablesettings-not-amember-of-es/195093)
**Author:** [@andreaperez](https://discuss.elastic.co/u/andreaperez)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 7:58pm UTC](https://discuss.elastic.co/t/immutablesettings-not-amember-of-es/195093 "2019-08-13T19:58:09Z")
Hi! I'm using elasticsearch to import data from S3 to be visualized in kibana, to do this I'm using spark scala running in an EMR instance. The ES service is being started with the following command \< /usr/lib/spark/… --- ## [Setting xpack.telemetry.enabled to false prevents access to roles ui](https://discuss.elastic.co/t/setting-xpack-telemetry-enabled-to-false-prevents-access-to-roles-ui/194857)
**Author:** [@Philos](https://discuss.elastic.co/u/Philos)\ **Replies:** 6\ **Last updated:** [August 13, 2019, 5:19pm UTC](https://discuss.elastic.co/t/setting-xpack-telemetry-enabled-to-false-prevents-access-to-roles-ui/194857 "2019-08-13T17:19:34Z")
If I disable the xpack.telemetry.enabled setting I can't create or edit roles in the kibana ui. The /app/kibana#/management/security/roles site is accessable, but /app/kibana#/management/security/roles/edit is not. Te… --- ## [Recommended logic for handling different log files on same host?](https://discuss.elastic.co/t/recommended-logic-for-handling-different-log-files-on-same-host/195040)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 5\ **Last updated:** [August 13, 2019, 4:57pm UTC](https://discuss.elastic.co/t/recommended-logic-for-handling-different-log-files-on-same-host/195040 "2019-08-13T16:57:03Z")
I have a host with three different log files. Using one instance of filebeat to ship all of the logs. Started this process back on 6.2 and discovered the "type" option. So based on the log file path I would set the ty… --- ## [Bool filter performance and its alternatives](https://discuss.elastic.co/t/bool-filter-performance-and-its-alternatives/195062)
**Author:** [@amreshakim](https://discuss.elastic.co/u/amreshakim)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 4:29pm UTC](https://discuss.elastic.co/t/bool-filter-performance-and-its-alternatives/195062 "2019-08-13T16:29:41Z")
Hi everyone, I have been profiling a query that is noticeably slow in our ES setup. Setup: AWS, ES 7.3, 11 data nodes, 1 index, 22 shards total, total # of docs: ~350M We store documents like this (~20 fields and mos… --- ## [Cannot get date math to work properly in Elasticsearch](https://discuss.elastic.co/t/cannot-get-date-math-to-work-properly-in-elasticsearch/193655)
**Author:** [@jgorlin](https://discuss.elastic.co/u/jgorlin)\ **Replies:** 10\ **Last updated:** [August 13, 2019, 3:53pm UTC](https://discuss.elastic.co/t/cannot-get-date-math-to-work-properly-in-elasticsearch/193655 "2019-08-13T15:53:43Z")
Hi Team, I've bene struggling for hours on what seems to me should be a very basic search. I'm trying to find all documents that have a date within the last 7 days: GET date\_test/\_search { "query": { "range": { … --- ## [Logstash wildcards in input file path not processing files](https://discuss.elastic.co/t/logstash-wildcards-in-input-file-path-not-processing-files/194921)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 6\ **Last updated:** [August 13, 2019, 3:32pm UTC](https://discuss.elastic.co/t/logstash-wildcards-in-input-file-path-not-processing-files/194921 "2019-08-13T15:32:44Z")
Hi, i have a logstash configuration like this: file { path =\> "/opt/audit\_logs\_modsec/xx/\*/\*/\*" # path =\> "/opt/audit\_logs\_modsec/xx/20171231/20171231-2358/\*" sincedb\_path =\> "/dev/null" … --- ## [\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch](https://discuss.elastic.co/t/warn-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch/194883)
**Author:** [@SCL\_ADMIN](https://discuss.elastic.co/u/SCL_ADMIN)\ **Replies:** 5\ **Last updated:** [August 13, 2019, 3:15pm UTC](https://discuss.elastic.co/t/warn-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch/194883 "2019-08-13T15:15:57Z")
I had a really large logstash.log file which filled up the hdd I deleted the file and restarted the service now I I get this Aug 12 16:54:13 SCL-SIEM-01 logstash\[3096\]: \[2019-08-12T16:54:13,127\]\[WARN \]\[logstash.outputs… --- ## [Why are these rollup documents missing an ID?](https://discuss.elastic.co/t/why-are-these-rollup-documents-missing-an-id/194536)
**Author:** [@EricJohnson](https://discuss.elastic.co/u/EricJohnson)\ **Replies:** 10\ **Last updated:** [August 13, 2019, 3:15pm UTC](https://discuss.elastic.co/t/why-are-these-rollup-documents-missing-an-id/194536 "2019-08-13T15:15:29Z")
Hello - I've run into a major problem and would really appreciate an explanation. Thank you for your input. We are using rollups to process metricbeat data for analysis. We have three servers, say A, B and C. Having … --- ## [Extract string that starts with specific string using Grok](https://discuss.elastic.co/t/extract-string-that-starts-with-specific-string-using-grok/195048)
**Author:** [@Siri\_sour](https://discuss.elastic.co/u/Siri_sour)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 2:41pm UTC](https://discuss.elastic.co/t/extract-string-that-starts-with-specific-string-using-grok/195048 "2019-08-13T14:41:30Z")
Hi everyone, I am trying to structure this log : --- ## [Traverse through XML document](https://discuss.elastic.co/t/traverse-through-xml-document/194967)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 1\ **Last updated:** [August 13, 2019, 2:30pm UTC](https://discuss.elastic.co/t/traverse-through-xml-document/194967 "2019-08-13T14:30:55Z")
Hi I have the below XML structure with a list of cartItem (it can be N and not definite in number). I want help for the below queries 1 - I want to traverse through each of the cartItem and check the conditions based … --- ## [Mocking nodejs client with nock broken after new es client migration](https://discuss.elastic.co/t/mocking-nodejs-client-with-nock-broken-after-new-es-client-migration/195041)
**Author:** [@vbontempi](https://discuss.elastic.co/u/vbontempi)\ **Replies:** 0\ **Last updated:** [August 13, 2019, 2:12pm UTC](https://discuss.elastic.co/t/mocking-nodejs-client-with-nock-broken-after-new-es-client-migration/195041 "2019-08-13T14:12:34Z")
Hello, we are using nock to mock the ES requests towards our ES cluster on nodejs We migrated recently our application running on nodejs from old legacy ES Client to the new one https://github.com/elastic/elasticsearch… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1960) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1962)