# Top

**URL:** https://discuss.elastic.co/top.md?page=1378&period=all

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1379

---

## [Support SLM (Snapshot Lifecycle management) for license 7.10.2 Elashticsearch](https://discuss.elastic.co/t/support-slm-snapshot-lifecycle-management-for-license-7-10-2-elashticsearch/286354)

<div class="topic-metadata">

**Author:** [@ttttien](https://discuss.elastic.co/u/ttttien)\
**Replies:** 6\
**Last updated:** [October 11, 2021, 2:58pm UTC](https://discuss.elastic.co/t/support-slm-snapshot-lifecycle-management-for-license-7-10-2-elashticsearch/286354 "2021-10-11T14:58:27Z")

</div>

Hello everyone, I would like to know that Elasticsearch version 7.10.2 supports or not for SLM (Snapshot Lifecycle Management) in open versions (not enterprise) ? And how can I get the link of the information about that…

---

## [How can FileBeat access Kibana over SSL?](https://discuss.elastic.co/t/how-can-filebeat-access-kibana-over-ssl/256420)

<div class="topic-metadata">

**Author:** [@houmie](https://discuss.elastic.co/u/houmie)\
**Replies:** 6\
**Last updated:** [November 30, 2020, 3:03am UTC](https://discuss.elastic.co/t/how-can-filebeat-access-kibana-over-ssl/256420 "2020-11-30T03:03:06Z")

</div>

Hello, filebeat.inputs: - type: log paths: - /var/log/app-uwsgi/app.json json.keys\_under\_root: true json.add\_error\_key: true filebeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: tr…

---

## [Kibana --\> ES master vs ES Coordinating Nodes in Cluster Question](https://discuss.elastic.co/t/kibana-es-master-vs-es-coordinating-nodes-in-cluster-question/167741)

<div class="topic-metadata">

**Author:** [@rbendik](https://discuss.elastic.co/u/rbendik)\
**Replies:** 1\
**Last updated:** [February 10, 2019, 8:12am UTC](https://discuss.elastic.co/t/kibana-es-master-vs-es-coordinating-nodes-in-cluster-question/167741 "2019-02-10T08:12:48Z")

</div>

Hi all, I have two main questions. I read through a lo to documentation and forums, but still am unclear regarding how 1) queries are handled on a host that has Kibana talking locally to master ES node, and 2) whether I…

---

## [Bulk adding new field](https://discuss.elastic.co/t/bulk-adding-new-field/51203)

<div class="topic-metadata">

**Author:** [@Thinesh](https://discuss.elastic.co/u/Thinesh)\
**Replies:** 1\
**Last updated:** [May 30, 2016, 1:57pm UTC](https://discuss.elastic.co/t/bulk-adding-new-field/51203 "2016-05-30T13:57:47Z")

</div>

Hi, I am trying to add new field to the existing documents via bulk. currently am struggling with below scenario. Mapping: "fourthField": { "type": "string", "index": "not\_analyzed" } Scri…

---

## [Need help on elastic search](https://discuss.elastic.co/t/need-help-on-elastic-search/49372)

<div class="topic-metadata">

**Author:** [@vmankala](https://discuss.elastic.co/u/vmankala)\
**Replies:** 1\
**Last updated:** [May 6, 2016, 6:00am UTC](https://discuss.elastic.co/t/need-help-on-elastic-search/49372 "2016-05-06T06:00:09Z")

</div>

I have setup ELK environment. Installed filebeat on few servers and installed logstash on separate single server -10-192-4-253. I have setup Elastalert configuration in logstash server. Below is "/example\_frequency.yaml"…

---

## [Any way to show aggregations by columns instead of by rows?](https://discuss.elastic.co/t/any-way-to-show-aggregations-by-columns-instead-of-by-rows/42719)

<div class="topic-metadata">

**Author:** [@feicipet](https://discuss.elastic.co/u/feicipet)\
**Replies:** 1\
**Last updated:** [February 26, 2016, 6:57pm UTC](https://discuss.elastic.co/t/any-way-to-show-aggregations-by-columns-instead-of-by-rows/42719 "2016-02-26T18:57:34Z")

</div>

Hi, In Kibana, I can only create sub-bucket aggregations which is visualized as rows: Is there a way to display the aggregation as columns instead? Invitation time CampaignType:Sms CampaignType:Email …

---

## [Kibana extension using TypeScript](https://discuss.elastic.co/t/kibana-extension-using-typescript/104166)

<div class="topic-metadata">

**Author:** [@jollyparamjit](https://discuss.elastic.co/u/jollyparamjit)\
**Replies:** 1\
**Last updated:** [October 17, 2017, 7:23am UTC](https://discuss.elastic.co/t/kibana-extension-using-typescript/104166 "2017-10-17T07:23:26Z")

</div>

We are planning to use Kibana as base for our custom development. One option is i start using angular 1.x version to extend kibana. Lot of developers wants to use latest technology to do future development. We can plan…

---

## [Failed to put mappings on indices](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices/311224)

<div class="topic-metadata">

**Author:** [@davekang](https://discuss.elastic.co/u/davekang)\
**Replies:** 2\
**Last updated:** [August 4, 2022, 1:59am UTC](https://discuss.elastic.co/t/failed-to-put-mappings-on-indices/311224 "2022-08-04T01:59:59Z")

</div>

hi I created a new index for re-indexing and tried re-indexing, but I get the following error: \[DEBUG\]\[o.e.a.a.i.m.p.TransportPutMappingAction\] \[node-01\] failed to put mappings on indices \[\[\[ma\_2022/mmRNrJPwRfutlNQs8L…

---

## [Is Logstash beats input with multiline codec allowed or not?](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230)

<div class="topic-metadata">

**Author:** [@Rodrigo\_Jimenez](https://discuss.elastic.co/u/Rodrigo_Jimenez)\
**Replies:** 2\
**Last updated:** [October 21, 2021, 11:55am UTC](https://discuss.elastic.co/t/is-logstash-beats-input-with-multiline-codec-allowed-or-not/287230 "2021-10-21T11:55:33Z")

</div>

I know some of this might have been asked here before but Documentation and logs express differently. I want to fetch logs from AWS Cloudwatch. For that, i'm using filebeat's input. This input is not doing any kind of m…

---

## [Shards not relocating to warm nodes](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198)

<div class="topic-metadata">

**Author:** [@Smrithin\_N\_S](https://discuss.elastic.co/u/Smrithin_N_S)\
**Replies:** 2\
**Last updated:** [January 6, 2021, 2:34pm UTC](https://discuss.elastic.co/t/shards-not-relocating-to-warm-nodes/260198 "2021-01-06T14:34:27Z")

</div>

I have a deployment with hot-warm architecture enabled. Below is the ILM policy being used. PUT \_ilm/policy/apm-rollover-30-days { "policy": { "phases": { "hot": { "min\_age":…

---

## [Does close index free up disk or memory](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868)

<div class="topic-metadata">

**Author:** [@divya\_lakshmi](https://discuss.elastic.co/u/divya_lakshmi)\
**Replies:** 2\
**Last updated:** [December 17, 2020, 6:40am UTC](https://discuss.elastic.co/t/does-close-index-free-up-disk-or-memory/258868 "2020-12-17T06:40:14Z")

</div>

Hi, I am using elasticsearch6.5 as single node, using 8GB of JVM and just 3% of memory is free. Will closing index using close API help to free heap memory .please tell what are the advantages of close index

---

## [Siem Rule to detect ssh login with multiple source address](https://discuss.elastic.co/t/siem-rule-to-detect-ssh-login-with-multiple-source-address/247718)

<div class="topic-metadata">

**Author:** [@Kambing](https://discuss.elastic.co/u/Kambing)\
**Replies:** 2\
**Last updated:** [September 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/siem-rule-to-detect-ssh-login-with-multiple-source-address/247718 "2020-09-09T08:23:04Z")

</div>

Hi, I'm new with Elastic SIEM and now I need to create a rule to detect ssh successful login with multiple IP address with the same username. I wonder how can I create a rule like this since if I using Custon Query or Th…

---

## [Display percentage growth on vertical bar](https://discuss.elastic.co/t/display-percentage-growth-on-vertical-bar/232489)

<div class="topic-metadata">

**Author:** [@johnkary](https://discuss.elastic.co/u/johnkary)\
**Replies:** 2\
**Last updated:** [May 21, 2020, 8:02pm UTC](https://discuss.elastic.co/t/display-percentage-growth-on-vertical-bar/232489 "2020-05-21T20:02:18Z")

</div>

Hi all! I have the following vertical bar diagram on Kibana visualization and i want to add on it percentage progress between months (bars). Is there somehow a way to do this; Thank you in advance!

---

## [Synchronize objects across spaces](https://discuss.elastic.co/t/synchronize-objects-across-spaces/222018)

<div class="topic-metadata">

**Author:** [@adrian0](https://discuss.elastic.co/u/adrian0)\
**Replies:** 2\
**Last updated:** [March 4, 2020, 9:28am UTC](https://discuss.elastic.co/t/synchronize-objects-across-spaces/222018 "2020-03-04T09:28:58Z")

</div>

Hi! This is the situation: We have a default space and a dark mode activated space meant for wall screens, since dark-mode isn't based on user account preferences. We work daily in the default space and sometimes does …

---

## [Ingest pipeline analyze time difference](https://discuss.elastic.co/t/ingest-pipeline-analyze-time-difference/207140)

<div class="topic-metadata">

**Author:** [@Andrii](https://discuss.elastic.co/u/Andrii)\
**Replies:** 2\
**Last updated:** [November 9, 2019, 9:35am UTC](https://discuss.elastic.co/t/ingest-pipeline-analyze-time-difference/207140 "2019-11-09T09:35:47Z")

</div>

Hello, I need to route messages which have @timestamp field that differs more than 8 hours from now to a separate topic. I tried to use ingest pipeline with some processors for that. But the only one which comes to my …

---

## [" Show partial rows " ignores " Show metrics for every bucket/level "](https://discuss.elastic.co/t/show-partial-rows-ignores-show-metrics-for-every-bucket-level/154456)

<div class="topic-metadata">

**Author:** [@nick.e](https://discuss.elastic.co/u/nick.e)\
**Replies:** 2\
**Last updated:** [October 29, 2018, 3:22pm UTC](https://discuss.elastic.co/t/show-partial-rows-ignores-show-metrics-for-every-bucket-level/154456 "2018-10-29T15:22:28Z")

</div>

In 5.x, when creating a data table visualization with the Option "Show partial rows" enabled, there was one metric-column (in my case "Count") at the end. When I enabled "Show metrics for every bucket/level" there was…

---

## [How to retrieve the content of Elasticsearch reverse indexes?](https://discuss.elastic.co/t/how-to-retrieve-the-content-of-elasticsearch-reverse-indexes/142758)

<div class="topic-metadata">

**Author:** [@fmind](https://discuss.elastic.co/u/fmind)\
**Replies:** 2\
**Last updated:** [August 6, 2018, 9:05am UTC](https://discuss.elastic.co/t/how-to-retrieve-the-content-of-elasticsearch-reverse-indexes/142758 "2018-08-06T09:05:45Z")

</div>

Hello, I want to run an analysis on Elasticsearch to retrieve the content of its reverse indexes. I need this information to know the list of document ID associated to combination of field/value stored in the reverse i…

---

## [Ability to Deep Link to Run Graph Query](https://discuss.elastic.co/t/ability-to-deep-link-to-run-graph-query/139403)

<div class="topic-metadata">

**Author:** [@robert.j.foreman](https://discuss.elastic.co/u/robert.j.foreman)\
**Replies:** 2\
**Last updated:** [July 10, 2018, 7:55pm UTC](https://discuss.elastic.co/t/ability-to-deep-link-to-run-graph-query/139403 "2018-07-10T19:55:55Z")

</div>

Is there a way to open the Kibana Graph UI with a URL that includes a query to run so that the UI loads with an initial graph? The setting a query in the URL works for Discover and Visualize tabs in Kibana, but I can't …

---

## [Could not locate that index-pattern (auditbeat,filebat)](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-auditbeat-filebat/121485)

<div class="topic-metadata">

**Author:** [@illiash](https://discuss.elastic.co/u/illiash)\
**Replies:** 2\
**Last updated:** [February 27, 2018, 10:40am UTC](https://discuss.elastic.co/t/could-not-locate-that-index-pattern-auditbeat-filebat/121485 "2018-02-27T10:40:04Z")

</div>

Hi , It looks like when using custom pattern in auditbeat of filebeat, that ID for dashboards which are created with auditbeat or filebeat are created with extra space in the begging , For example in auditbeat I'm usin…

---

## [Elasticsearch php client search and range query](https://discuss.elastic.co/t/elasticsearch-php-client-search-and-range-query/96919)

<div class="topic-metadata">

**Author:** [@Akhil\_Prashar](https://discuss.elastic.co/u/Akhil_Prashar)\
**Replies:** 2\
**Last updated:** [August 14, 2017, 7:55am UTC](https://discuss.elastic.co/t/elasticsearch-php-client-search-and-range-query/96919 "2017-08-14T07:55:45Z")

</div>

I am trying to write a query which can search a particular word in a field in between the mentioned dates. So, I should use search and range query. I have written a query but I think I am doing something wrong. $params …

---

## [Not sorted numeric doc values](https://discuss.elastic.co/t/not-sorted-numeric-doc-values/92999)

<div class="topic-metadata">

**Author:** [@Pawel\_Rog](https://discuss.elastic.co/u/Pawel_Rog)\
**Replies:** 2\
**Last updated:** [July 21, 2017, 3:23pm UTC](https://discuss.elastic.co/t/not-sorted-numeric-doc-values/92999 "2017-07-21T15:23:24Z")

</div>

Hello. Is there any chance to store floating point numeric doc values in not sorted version? To give you a little background: I send documents to ES and they have a field which is a vector of floats. Later I use these…

---

## [Read from elasticsearch into Hive](https://discuss.elastic.co/t/read-from-elasticsearch-into-hive/71277)

<div class="topic-metadata">

**Author:** [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Replies:** 2\
**Last updated:** [January 13, 2017, 9:17am UTC](https://discuss.elastic.co/t/read-from-elasticsearch-into-hive/71277 "2017-01-13T09:17:08Z")

</div>

Hi, In the documentation, Hive external table is being used to map the data from Elasticsearch index. Does the external table in Hive store the data once it is created? say in user/hive/warehouse? Or for every sele…

---

## [Kibana 4 Process Crash](https://discuss.elastic.co/t/kibana-4-process-crash/23688)

<div class="topic-metadata">

**Author:** [@airone](https://discuss.elastic.co/u/airone)\
**Replies:** 2\
**Last updated:** [May 28, 2015, 9:14am UTC](https://discuss.elastic.co/t/kibana-4-process-crash/23688 "2015-05-28T09:14:06Z")

</div>

Hello everyone I have a problem with Kibana 4, every moorning I open my browser on kibana page and I received the message "Waiting for elasticsearch is loading messages", the page don't get results, If I refresh the…

---

## [How to calculate percentage of a field over all documents present in index](https://discuss.elastic.co/t/how-to-calculate-percentage-of-a-field-over-all-documents-present-in-index/334544)

<div class="topic-metadata">

**Author:** [@Amit\_Charkha](https://discuss.elastic.co/u/Amit_Charkha)\
**Replies:** 5\
**Last updated:** [June 6, 2023, 4:54am UTC](https://discuss.elastic.co/t/how-to-calculate-percentage-of-a-field-over-all-documents-present-in-index/334544 "2023-06-06T04:54:48Z")

</div>

how to calculate percentage of a field log\_count over all documents present in index.

---

## [Endpoint Security decraded/ Unhealthy status](https://discuss.elastic.co/t/endpoint-security-decraded-unhealthy-status/303031)

<div class="topic-metadata">

**Author:** [@fbijl](https://discuss.elastic.co/u/fbijl)\
**Replies:** 5\
**Last updated:** [April 26, 2022, 2:40pm UTC](https://discuss.elastic.co/t/endpoint-security-decraded-unhealthy-status/303031 "2022-04-26T14:40:14Z")

</div>

I have the same issue as described in this topic: And in the enpoint logfile: {"@timestamp":"2022-04-22T09:31:25.117229549Z","agent":{"id":"3b2a53b3-f192-49eb-adcc-ea5b040d5986","type":"endpoint"},"ecs":{"version":…

---

## [Logstash node not sending to elasticsearch node](https://discuss.elastic.co/t/logstash-node-not-sending-to-elasticsearch-node/213489)

<div class="topic-metadata">

**Author:** [@smaxxx](https://discuss.elastic.co/u/smaxxx)\
**Replies:** 5\
**Last updated:** [January 3, 2020, 4:30pm UTC](https://discuss.elastic.co/t/logstash-node-not-sending-to-elasticsearch-node/213489 "2020-01-03T16:30:45Z")

</div>

Hello, so after performance problems. we decided to split logstash and elasticsearch up in separate nodes. However, the logstash node isn't sending anything to the elasticsearch node. Here are my findings so far: Can t…

---

## [Is there a way to alter the value of live API data polled using http\_poller input plugin?](https://discuss.elastic.co/t/is-there-a-way-to-alter-the-value-of-live-api-data-polled-using-http-poller-input-plugin/142671)

<div class="topic-metadata">

**Author:** [@APJ](https://discuss.elastic.co/u/APJ)\
**Replies:** 5\
**Last updated:** [August 2, 2018, 5:57pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-alter-the-value-of-live-api-data-polled-using-http-poller-input-plugin/142671 "2018-08-02T17:57:19Z")

</div>

Hi all, I have a logstash config file that pulls in live data using the http\_poller plugin. Here is my logstash.conf input { http\_poller { urls =\> { weather =\> { url =\> "http://api.openweather…

---

## [Restore to new cluster - No MetaData Problem](https://discuss.elastic.co/t/restore-to-new-cluster-no-metadata-problem/96666)

<div class="topic-metadata">

**Author:** [@Bruce\_Carey](https://discuss.elastic.co/u/Bruce_Carey)\
**Replies:** 5\
**Last updated:** [August 23, 2017, 1:03pm UTC](https://discuss.elastic.co/t/restore-to-new-cluster-no-metadata-problem/96666 "2017-08-23T13:03:03Z")

</div>

I’m testing the backup system. I want to be able to restore to a new/different cluster/host if for some reason the original crashes and is entirely unrecoverable. So, I did a backup to an NFS storage on a backup machin…

---

## [Choosing tracks that contain long-running tasks](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193)

<div class="topic-metadata">

**Author:** [@Sunt-ing](https://discuss.elastic.co/u/Sunt-ing)\
**Replies:** 2\
**Last updated:** [October 10, 2022, 3:34pm UTC](https://discuss.elastic.co/t/choosing-tracks-that-contain-long-running-tasks/316193 "2022-10-10T15:34:44Z")

</div>

Hi all! I need to benchmark on a track that contains some long-running (such as larger than 10s) tasks. Benchmarking one track after another is definitely an approach and I'm working on that, but there are so many tracks…

---

## [Why kibana.yml needs a user given, when kibana already gets the credentials by UI prompt?](https://discuss.elastic.co/t/why-kibana-yml-needs-a-user-given-when-kibana-already-gets-the-credentials-by-ui-prompt/247402)

<div class="topic-metadata">

**Author:** [@mrraj470](https://discuss.elastic.co/u/mrraj470)\
**Replies:** 2\
**Last updated:** [September 3, 2020, 4:41pm UTC](https://discuss.elastic.co/t/why-kibana-yml-needs-a-user-given-when-kibana-already-gets-the-credentials-by-ui-prompt/247402 "2020-09-03T16:41:19Z")

</div>

This is a simple question, but I could not find answers from the internet. Also, I'm a beginner in using elk. I know, the security (x-pack) is free from 6.8 version onwards. Even I'm trying to use that feature. But I'm …

---

## [Notes on Alerts or auto open case](https://discuss.elastic.co/t/notes-on-alerts-or-auto-open-case/345771)

<div class="topic-metadata">

**Author:** [@Renato\_Arraes](https://discuss.elastic.co/u/Renato_Arraes)\
**Replies:** 0\
**Last updated:** [October 26, 2023, 5:41am UTC](https://discuss.elastic.co/t/notes-on-alerts-or-auto-open-case/345771 "2023-10-26T05:41:51Z")

</div>

Hello everyone, Im currently doing the configuration of the Alerts, and i want to know if theres a way to put some notes or open directly a case from an alert, since we do have to treat the Alerts we need to input some …

---

## [\[Elasticsearch NEST\] Unable to define language for collate queries](https://discuss.elastic.co/t/elasticsearch-nest-unable-to-define-language-for-collate-queries/129773)

<div class="topic-metadata">

**Author:** [@ishim](https://discuss.elastic.co/u/ishim)\
**Replies:** 0\
**Last updated:** [April 27, 2018, 6:43am UTC](https://discuss.elastic.co/t/elasticsearch-nest-unable-to-define-language-for-collate-queries/129773 "2018-04-27T06:43:09Z")

</div>

I'm using NEST/ElasticSearch 5.4 and I am trying to write a NEST object which uses collate. Basically i want to have json something like this: "collate": { "query": { "lang" : "my\_own\_language", …

---

## [Update parent(\_parent) from JSON rather than query](https://discuss.elastic.co/t/update-parent--parent-from-json-rather-than-query/19703)

<div class="topic-metadata">

**Author:** [@Santosh\_B](https://discuss.elastic.co/u/Santosh_B)\
**Replies:** 0\
**Last updated:** [September 10, 2014, 8:52am UTC](https://discuss.elastic.co/t/update-parent--parent-from-json-rather-than-query/19703 "2014-09-10T08:52:21Z")

</div>

usually parent field is updated using POST /dsdemo/content/child11787?parent=parent1 { "title": "The 111 document", "body": "This 111 could be huge #14" } instead of this can we try to update parent…

---

## [The field "@timestamp" associate with this object no longer exists in the index pattern. please use another field](https://discuss.elastic.co/t/the-field-timestamp-associate-with-this-object-no-longer-exists-in-the-index-pattern-please-use-another-field/341923)

<div class="topic-metadata">

**Author:** [@sebast.ssoto](https://discuss.elastic.co/u/sebast.ssoto)\
**Replies:** 4\
**Last updated:** [September 1, 2023, 3:24pm UTC](https://discuss.elastic.co/t/the-field-timestamp-associate-with-this-object-no-longer-exists-in-the-index-pattern-please-use-another-field/341923 "2023-09-01T15:24:05Z")

</div>

There have been multiple errors where the timestamp varies according to the source, the problem itself comes in the index pattern which does not know how to identify that it may be failing since it does not show data.

---

## [Secure browser to kibana](https://discuss.elastic.co/t/secure-browser-to-kibana/243593)

<div class="topic-metadata">

**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\
**Replies:** 4\
**Last updated:** [August 5, 2020, 10:07am UTC](https://discuss.elastic.co/t/secure-browser-to-kibana/243593 "2020-08-05T10:07:27Z")

</div>

I'm following this documentation page for securing communications between the browser and kibana. I'm a little confused as the documentation suggests createing a csr while later in the line ( and in kibana.yml) it expect…

---

## [Kibana Markdown : Is there any way to put text data with markdown plugin using indexed fields as well?](https://discuss.elastic.co/t/kibana-markdown-is-there-any-way-to-put-text-data-with-markdown-plugin-using-indexed-fields-as-well/172112)

<div class="topic-metadata">

**Author:** [@Sujata\_Yadav](https://discuss.elastic.co/u/Sujata_Yadav)\
**Replies:** 4\
**Last updated:** [March 17, 2019, 5:44am UTC](https://discuss.elastic.co/t/kibana-markdown-is-there-any-way-to-put-text-data-with-markdown-plugin-using-indexed-fields-as-well/172112 "2019-03-17T05:44:31Z")

</div>

Hi All, I am trying to create a Report-Card kind of view for my indexed data fields by highlighting critical fields. Is there any way to achieve this using markdown visualization? Regards, Sujata

---

## [ML Aggregation and Fields](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474)

<div class="topic-metadata">

**Author:** [@mathurin68](https://discuss.elastic.co/u/mathurin68)\
**Replies:** 4\
**Last updated:** [November 23, 2017, 4:04am UTC](https://discuss.elastic.co/t/ml-aggregation-and-fields/107474 "2017-11-23T04:04:49Z")

</div>

I have x-pack up and running and am collecting event logs containing windows and powershell command line activities. Basically, I want to see the anomalies in command line activity. I don't care about something like th…

---

## [Running ELK stack on a server with Websphere and JBoss application servers](https://discuss.elastic.co/t/running-elk-stack-on-a-server-with-websphere-and-jboss-application-servers/106408)

<div class="topic-metadata">

**Author:** [@Ihjaz](https://discuss.elastic.co/u/Ihjaz)\
**Replies:** 4\
**Last updated:** [November 5, 2017, 9:58am UTC](https://discuss.elastic.co/t/running-elk-stack-on-a-server-with-websphere-and-jboss-application-servers/106408 "2017-11-05T09:58:33Z")

</div>

Hi, I'm planning to install ELK stack on nodes which also has a Websphere and a JBoss application server running. There will be multiple applications running on Websphere and 40% of the system's RAM is going to be alloc…

---

## [Embedding visualizations docu error](https://discuss.elastic.co/t/embedding-visualizations-docu-error/105771)

<div class="topic-metadata">

**Author:** [@havidarou](https://discuss.elastic.co/u/havidarou)\
**Replies:** 4\
**Last updated:** [November 1, 2017, 2:58pm UTC](https://discuss.elastic.co/t/embedding-visualizations-docu-error/105771 "2017-11-01T14:58:26Z")

</div>

Hi everyone, I'm following the documentation here: https://www.elastic.co/guide/en/kibana/master/development-embedding-visualizations.html But I can't load a visualization. Whenever I try to do it, lots of errors appea…

---

## [Couchbase health check dashboad using Kibana](https://discuss.elastic.co/t/couchbase-health-check-dashboad-using-kibana/105690)

<div class="topic-metadata">

**Author:** [@AshishC](https://discuss.elastic.co/u/AshishC)\
**Replies:** 4\
**Last updated:** [October 31, 2017, 5:22pm UTC](https://discuss.elastic.co/t/couchbase-health-check-dashboad-using-kibana/105690 "2017-10-31T17:22:20Z")

</div>

Has anyone monitored couchbase logs using Metricbeat and Kibana

---

## [Get substrings from the log](https://discuss.elastic.co/t/get-substrings-from-the-log/62068)

<div class="topic-metadata">

**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\
**Replies:** 4\
**Last updated:** [October 11, 2016, 9:04am UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068 "2016-10-11T09:04:07Z")

</div>

Hello. Could you kindly help me to solve one little problem? I have log strings look like as: 20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;; I load th…

---

## [KIbana - tile map- geo\_point](https://discuss.elastic.co/t/kibana-tile-map-geo-point/61516)

<div class="topic-metadata">

**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Replies:** 4\
**Last updated:** [September 27, 2016, 9:20am UTC](https://discuss.elastic.co/t/kibana-tile-map-geo-point/61516 "2016-09-27T09:20:56Z")

</div>

Hi all, How do I fix my tile map issue whenever I create a new index ,am unable to use the tile map.It always says No Compatible Fields: The "logstash\_sflow\_test-\*" index pattern does not contain any of the following…

---

## [Snapshot in s3 bucket not seen by other cluster](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006)

<div class="topic-metadata">

**Author:** [@raphaelSeguin](https://discuss.elastic.co/u/raphaelSeguin)\
**Replies:** 3\
**Last updated:** [October 8, 2021, 11:22am UTC](https://discuss.elastic.co/t/snapshot-in-s3-bucket-not-seen-by-other-cluster/286006 "2021-10-08T11:22:02Z")

</div>

Hi, I'm using an s3 repository to snapshot a cluster. I was hoping to restore the snapshot on a remote cluster by registering a repository pointing to the same bucket. But the snapshot I took from he first cluster remai…

---

## [Converting Duration Field From Text To Number](https://discuss.elastic.co/t/converting-duration-field-from-text-to-number/265255)

<div class="topic-metadata">

**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\
**Replies:** 3\
**Last updated:** [February 23, 2021, 10:35pm UTC](https://discuss.elastic.co/t/converting-duration-field-from-text-to-number/265255 "2021-02-23T22:35:49Z")

</div>

I have a field that displays connection duration as a string that looks like 3h:49m:57s. Any ideas on how to convert this to an aggregateable format such as epoch time or something?

---

## [How to create chart for User Growth Rate in kibana](https://discuss.elastic.co/t/how-to-create-chart-for-user-growth-rate-in-kibana/258692)

<div class="topic-metadata">

**Author:** [@dharanesh](https://discuss.elastic.co/u/dharanesh)\
**Replies:** 3\
**Last updated:** [December 30, 2020, 5:05pm UTC](https://discuss.elastic.co/t/how-to-create-chart-for-user-growth-rate-in-kibana/258692 "2020-12-30T17:05:12Z")

</div>

I have user logs i need to find user growth rate how to do this in kibana.

---

## [Map column from tiny math result](https://discuss.elastic.co/t/map-column-from-tiny-math-result/251691)

<div class="topic-metadata">

**Author:** [@Hugo\_Pires](https://discuss.elastic.co/u/Hugo_Pires)\
**Replies:** 3\
**Last updated:** [October 13, 2020, 9:10pm UTC](https://discuss.elastic.co/t/map-column-from-tiny-math-result/251691 "2020-10-13T21:10:13Z")

</div>

Hello Is it possible to create a new column in a data table using mapcolumn and a tinymath that divides two existing ones? Thank you Hugo

---

## [Metricbeat kubernetes module collection 401](https://discuss.elastic.co/t/metricbeat-kubernetes-module-collection-401/246904)

<div class="topic-metadata">

**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\
**Replies:** 3\
**Last updated:** [September 25, 2020, 4:28am UTC](https://discuss.elastic.co/t/metricbeat-kubernetes-module-collection-401/246904 "2020-09-25T04:28:01Z")

</div>

I can collect node data, but k8s can't the configuration - module: kubernetes metricsets: - node - system - pod - container - volume period: 10s host: ${NODE\_NAME} hosts: \["https://${NODE\_IP…

---

## [Dashboard with index fields as dropdown](https://discuss.elastic.co/t/dashboard-with-index-fields-as-dropdown/207244)

<div class="topic-metadata">

**Author:** [@gofbor](https://discuss.elastic.co/u/gofbor)\
**Replies:** 3\
**Last updated:** [November 11, 2019, 6:44pm UTC](https://discuss.elastic.co/t/dashboard-with-index-fields-as-dropdown/207244 "2019-11-11T18:44:41Z")

</div>

Hi, I have index with 8 fields. 4 of them are counters and 4 of them are keywords. For each counters I want to create 4 visualizations (avg per every keywords). But in my dashboard I don't want to have 16 visualizati…

---

## [Filebeat =\> Logstash in Elastic Cloud](https://discuss.elastic.co/t/filebeat-logstash-in-elastic-cloud/176064)

<div class="topic-metadata">

**Author:** [@carlduevel](https://discuss.elastic.co/u/carlduevel)\
**Replies:** 3\
**Last updated:** [April 9, 2019, 4:49pm UTC](https://discuss.elastic.co/t/filebeat-logstash-in-elastic-cloud/176064 "2019-04-09T16:49:36Z")

</div>

I am evaluating Elastic Cloud and the preferred usage pattern would be to send log data with Filebeat to Logstash in the Cloud so we would just need to worry about Filebeat being configured the right way. In the documen…

---

## [Where should logstash live? Cloud vs OnPrem](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472)

<div class="topic-metadata">

**Author:** [@Mike\_Hakopyan](https://discuss.elastic.co/u/Mike_Hakopyan)\
**Replies:** 3\
**Last updated:** [November 14, 2017, 9:47pm UTC](https://discuss.elastic.co/t/where-should-logstash-live-cloud-vs-onprem/107472 "2017-11-14T21:47:04Z")

</div>

I'm very new to LogStash and Elasticsearch. I'd like to know where to install Logstash; on prem or cloud? I have multiple locations where I'd be collecting log files with Beats and shipping to Logstash, then to Elastic…

[Previous page](https://discuss.elastic.co/top.md?page=1377&per_page=50&period=all)

[Next page](https://discuss.elastic.co/top.md?page=1379&per_page=50&period=all)
