# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1071 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1072 --- ## [Decode\_xml fails on UTF-16 formatted input](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996)
**Author:** [@mesposito](https://discuss.elastic.co/u/mesposito)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 8:17pm UTC](https://discuss.elastic.co/t/decode-xml-fails-on-utf-16-formatted-input/295996 "2022-02-01T20:17:21Z")
Hi, I am facing an issue where xml\_decode and xml\_decode\_wineventlog fail to parse input data when it is in UTF-16. The following errors are produced: failed in decode\_xml on the "winlog.event\_data.TaskContent" field: e… --- ## [ELK - Elasticsearch nodes High CPU](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373)
**Author:** [@aumthanki](https://discuss.elastic.co/u/aumthanki)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 7:44pm UTC](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373 "2022-02-01T19:44:05Z")
Setup: 3 nodes in Azure. 2 masters and one voting\_only. Info: (Nodes) { "name" : "\<\>", "cluster\_name" : "\<\>", "cluster\_uuid" : "\<\>", "version" : { "number" : "7.16.1", "build\_flavor" : "default", "… --- ## [Multiple Count Aggregations With Multiple Fields](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 7:29pm UTC](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909 "2022-02-01T19:29:48Z")
Is it possible to filter individual Count aggregations? I'm trying to get a count of all items that were opened in a month vs all items that were closed in a month. Each document will have an OPEN\_DT field and if closed … --- ## [Token filter predicate script and query-time 'params'](https://discuss.elastic.co/t/token-filter-predicate-script-and-query-time-params/295752)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 6:50pm UTC](https://discuss.elastic.co/t/token-filter-predicate-script-and-query-time-params/295752 "2022-02-01T18:50:32Z")
Hello! I have been spelunking through Elastic code to try to understand how the following is possible. The Analysis Predicate Context says that painless scripts run at analysis can accept query-time params" params ( M… --- ## [Rollover ILM policy for existing Index](https://discuss.elastic.co/t/rollover-ilm-policy-for-existing-index/295885)
**Author:** [@Vani1](https://discuss.elastic.co/u/Vani1)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 6:39pm UTC](https://discuss.elastic.co/t/rollover-ilm-policy-for-existing-index/295885 "2022-02-01T18:39:59Z")
Hi Can anyone help me on Rollover ILM for existing index , which needs to be rolled over on reaching certain age/ gb. Thankyou in advance. --- ## [Splitting the log into a csv file](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922)
**Author:** [@PanPiotr](https://discuss.elastic.co/u/PanPiotr)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 6:08pm UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922 "2022-02-01T18:08:31Z")
Hi, I want to use logstash to separate the appropriate logs by a constant value appearing in these logs, and then divide the log into pieces after the separator ("|") and put it into a csv file with headers. The logs I'… --- ## [Unable to view logs on February 1st in Discover Kibana](https://discuss.elastic.co/t/unable-to-view-logs-on-february-1st-in-discover-kibana/295971)
**Author:** [@Amedisetti](https://discuss.elastic.co/u/Amedisetti)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:06pm UTC](https://discuss.elastic.co/t/unable-to-view-logs-on-february-1st-in-discover-kibana/295971 "2022-02-01T18:06:10Z")
While we are trying to check logs in Discover-Kibana, we noticed popup that showed 1 of 17 shards failed and its not showing up logs for today- 1st feb Request logs: "took": 34, "timed\_out": false, "\_shards": { … --- ## [Kibana Lens/Line customizations](https://discuss.elastic.co/t/kibana-lens-line-customizations/295783)
**Author:** [@GustavoEH](https://discuss.elastic.co/u/GustavoEH)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 6:03pm UTC](https://discuss.elastic.co/t/kibana-lens-line-customizations/295783 "2022-02-01T18:03:44Z")
Hello, I created a Line view in Kibana to see the data I'm getting from different exchanges, but I' having difficulties to customize the view. As I don't have much experience with Kibana, now I'm not sure if Lens/Line i… --- ## [SQL query does not work in filter bar of visualization](https://discuss.elastic.co/t/sql-query-does-not-work-in-filter-bar-of-visualization/295909)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 5:49pm UTC](https://discuss.elastic.co/t/sql-query-does-not-work-in-filter-bar-of-visualization/295909 "2022-02-01T17:49:20Z")
Hi all, I want to use SQL query just as KQL query in Query filter bar to build visualizations and dashboards. But the Query does not work in filter bar even after installing SQL plugin. Any ideas? --- ## [Updating all documents using a dictionary as input](https://discuss.elastic.co/t/updating-all-documents-using-a-dictionary-as-input/295728)
**Author:** [@Jenobi](https://discuss.elastic.co/u/Jenobi)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 5:14pm UTC](https://discuss.elastic.co/t/updating-all-documents-using-a-dictionary-as-input/295728 "2022-02-01T17:14:44Z")
Update All Documents Background Information I have a use case where I need to update all documents in my index. My source looks similar to the below: { 'hits': \[ {'\_index': 'main-index-v2', '\_type': '\_doc', … --- ## [Kibana aliases conflicting when restoring a snapshot](https://discuss.elastic.co/t/kibana-aliases-conflicting-when-restoring-a-snapshot/295390)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 7\ **Last updated:** [February 1, 2022, 4:49pm UTC](https://discuss.elastic.co/t/kibana-aliases-conflicting-when-restoring-a-snapshot/295390 "2022-02-01T16:49:50Z")
I'm trying to restore a snapshot created on a Elastic Stack cluster version 7.9.1 into another cluster version 7.14.0, but it seems the restore action is corrupting the indexes and after the attempt I'm not longer able t… --- ## [Elastic config file revert to default](https://discuss.elastic.co/t/elastic-config-file-revert-to-default/295955)
**Author:** [@Gamliel\_Alon](https://discuss.elastic.co/u/Gamliel_Alon)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 3:23pm UTC](https://discuss.elastic.co/t/elastic-config-file-revert-to-default/295955 "2022-02-01T15:23:23Z")
Hi after installing security patches on ubuntu 18.04 the yml config file was revert to default like all was commented again on the logs I see this see this: Setting up linux-cloud-tools-common (4.15.0-166.174) ... S… --- ## [Count equal element in array](https://discuss.elastic.co/t/count-equal-element-in-array/295925)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 4:27pm UTC](https://discuss.elastic.co/t/count-equal-element-in-array/295925 "2022-02-01T16:27:57Z")
Hello everyone ! I need help. I have boolean field "sendSMS" with many values, for exemple : sendSMS : \[true , false, true\] and i want use scripted field to count the number of "true" in my field. Thanks in advance … --- ## [Kibana 7.16 sorts split slices in alphabetical order and not according to filter sequence](https://discuss.elastic.co/t/kibana-7-16-sorts-split-slices-in-alphabetical-order-and-not-according-to-filter-sequence/295684)
**Author:** [@Opti](https://discuss.elastic.co/u/Opti)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 3:55pm UTC](https://discuss.elastic.co/t/kibana-7-16-sorts-split-slices-in-alphabetical-order-and-not-according-to-filter-sequence/295684 "2022-02-01T15:55:23Z")
Hi, I have some dashboards that were created in Kibana 7.10 that use a count aggregation with filters as split slices within a bucket. The split slices each have a label with a description. WIthin version 7.10, this wou… --- ## [Unable to find User and role management feature in Kibana 7.16](https://discuss.elastic.co/t/unable-to-find-user-and-role-management-feature-in-kibana-7-16/295954)
**Author:** [@Adityadgr8](https://discuss.elastic.co/u/Adityadgr8)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 3:51pm UTC](https://discuss.elastic.co/t/unable-to-find-user-and-role-management-feature-in-kibana-7-16/295954 "2022-02-01T15:51:33Z")
Hello, I have used user and role management features in Kibana v6.8 and v7.1 also but recently i setup latest elk stack, there I am unable to get this feature This is kibana snip from older version: This is kibana … --- ## [Building a Kibana distributable Plugin fails in 7.16.3](https://discuss.elastic.co/t/building-a-kibana-distributable-plugin-fails-in-7-16-3/295877)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 3:08pm UTC](https://discuss.elastic.co/t/building-a-kibana-distributable-plugin-fails-in-7-16-3/295877 "2022-02-01T15:08:12Z")
Hi, We have upgraded our plugin from 7.9.3 to 7.16.3. I have ran these commands yarn cache clean yarn kbn clean BUILD\_TS\_REFS\_DISABLE=true yarn kbn bootstrap --no-cache --debug --verbose cd plugins/wind rm -Rf build… --- ## [Unable to change date format](https://discuss.elastic.co/t/unable-to-change-date-format/295948)
**Author:** [@duanra22](https://discuss.elastic.co/u/duanra22)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 3:05pm UTC](https://discuss.elastic.co/t/unable-to-change-date-format/295948 "2022-02-01T15:05:05Z")
Hello everyone, I've seen several topics with the same problem, however none of the solutions I found worked for me and it's making me crazy because I am sure it should be very simple. To explain the problem, I am usin… --- ## [Elastic search - filter on a field based on the length of that field's contents](https://discuss.elastic.co/t/elastic-search-filter-on-a-field-based-on-the-length-of-that-fields-contents/295883)
**Author:** [@drwiremore](https://discuss.elastic.co/u/drwiremore)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 3:02pm UTC](https://discuss.elastic.co/t/elastic-search-filter-on-a-field-based-on-the-length-of-that-fields-contents/295883 "2022-02-01T15:02:16Z")
Thought this would be easy. I'm searching a data index of data-awsch\*:ls-aws-cloudtrail\* based on event.type that is not one of start, access, info. This is working as intended, but the output is huge. Rather than fil… --- ## [Any example of how to connect to elastic cloud using express js](https://discuss.elastic.co/t/any-example-of-how-to-connect-to-elastic-cloud-using-express-js/295952)
**Author:** [@Munashe\_komichi](https://discuss.elastic.co/u/Munashe_komichi)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 3:00pm UTC](https://discuss.elastic.co/t/any-example-of-how-to-connect-to-elastic-cloud-using-express-js/295952 "2022-02-01T15:00:54Z")
Any example of how to implement Elasticsearch into express js,links documentation, i cant find any grappable information on it --- ## [Calculate delta between two ingestions](https://discuss.elastic.co/t/calculate-delta-between-two-ingestions/295938)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 2:39pm UTC](https://discuss.elastic.co/t/calculate-delta-between-two-ingestions/295938 "2022-02-01T14:39:48Z")
Hi Is it possible to validate the difference between two different ingestions (based on timestamp)? It is, i am ingesting some data from my IOT devices, as temperature, humidity, particulate matter (air quality level) … --- ## [Cold/Frozen Tiers on on-premise storage](https://discuss.elastic.co/t/cold-frozen-tiers-on-on-premise-storage/295881)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 2:12pm UTC](https://discuss.elastic.co/t/cold-frozen-tiers-on-on-premise-storage/295881 "2022-02-01T14:12:47Z")
Is anyone using on-premise servers/storage for Cold & Frozen data tiers? It's my understanding that these are the options: • AWS S3 • Google Cloud Storage • Azure Blob Storage • Hadoop Distributed File Store (HDFS) … --- ## [LOG4J vulenrability](https://discuss.elastic.co/t/log4j-vulenrability/295847)
**Author:** [@eden\_shirazi](https://discuss.elastic.co/u/eden_shirazi)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 2:10pm UTC](https://discuss.elastic.co/t/log4j-vulenrability/295847 "2022-02-01T14:10:00Z")
Hi, I didn't found any official information about the log4j vulnerability in elastic. what is the official version of elastic that protect from log4j vulnerability? Thank for the help. --- ## [Transforming Indexes](https://discuss.elastic.co/t/transforming-indexes/295932)
**Author:** [@Arya\_Yellapu](https://discuss.elastic.co/u/Arya_Yellapu)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 1:37pm UTC](https://discuss.elastic.co/t/transforming-indexes/295932 "2022-02-01T13:37:03Z")
Transforming Indexes is considering the timestamp field under "\_source" while comparing the data. How to exclude this field while comparison? Below is the query I am using to transform the data from two indexes: PUT /\_… --- ## [Creating Variables in Canvas](https://discuss.elastic.co/t/creating-variables-in-canvas/295854)
**Author:** [@elasticfran](https://discuss.elastic.co/u/elasticfran)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 1:30pm UTC](https://discuss.elastic.co/t/creating-variables-in-canvas/295854 "2022-02-01T13:30:27Z")
Hello there, Can anyone help me creating variables in Canvas? Thanks --- ## [REINDEX : identify fields to remove with a regular expression?](https://discuss.elastic.co/t/reindex-identify-fields-to-remove-with-a-regular-expression/295275)
**Author:** [@TheEvilDonut](https://discuss.elastic.co/u/TheEvilDonut)\ **Replies:** 8\ **Last updated:** [February 1, 2022, 1:03pm UTC](https://discuss.elastic.co/t/reindex-identify-fields-to-remove-with-a-regular-expression/295275 "2022-02-01T13:03:24Z")
Hello. Here's the situation. A source shipping logs to our cluster has messed up and sent us a large number of documents containing undesirable fields. The thing is that the fields names are almost random, there is no w… --- ## [Keystore for logstash](https://discuss.elastic.co/t/keystore-for-logstash/295688)
**Author:** [@Cheroufa](https://discuss.elastic.co/u/Cheroufa)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 12:18pm UTC](https://discuss.elastic.co/t/keystore-for-logstash/295688 "2022-02-01T12:18:51Z")
Hi guys i installed a keystore for logstash 7.16.3 in local on my machine it works fine but when i deploy the same pipeline on kibana =\> logstash pipelines it does'nt work. log : "Unable to configure plugins: (Configu… --- ## [Stringify object during reindexing](https://discuss.elastic.co/t/stringify-object-during-reindexing/295900)
**Author:** [@Animesh\_Agarwal](https://discuss.elastic.co/u/Animesh_Agarwal)\ **Replies:** 5\ **Last updated:** [February 1, 2022, 11:38am UTC](https://discuss.elastic.co/t/stringify-object-during-reindexing/295900 "2022-02-01T11:38:30Z")
Hi Team, I am looking for a solution to convert an object to string during reindexing. I searched for solutions using painless scripting but was unable to do so as it seems painless doesn't support JSON ( might be wrong… --- ## [Scrolling Search Template in elasticsearch-java 7.16](https://discuss.elastic.co/t/scrolling-search-template-in-elasticsearch-java-7-16/294869)
**Author:** [@jps](https://discuss.elastic.co/u/jps)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 11:32am UTC](https://discuss.elastic.co/t/scrolling-search-template-in-elasticsearch-java-7-16/294869 "2022-02-01T11:32:08Z")
Hi. Recently I've migrated from Elasticsearch-rest-high-level-client to Elasticsearch-java. My question is how can I scroll across SearchTemplateResponse? In SearchTemplateRequest we can put a scroll but it doesn't app… --- ## [Can Elasticsearch provide offsets of highlighted words?](https://discuss.elastic.co/t/can-elasticsearch-provide-offsets-of-highlighted-words/295323)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 11:18am UTC](https://discuss.elastic.co/t/can-elasticsearch-provide-offsets-of-highlighted-words/295323 "2022-02-01T11:18:38Z")
We are having OCRed text of PDFs searchable in Elasticsearch. Also we have stored original PDFs, passing highlighted terms from Elasticsearch in URL and with custom library we highlight the words in PDFs. But we would … --- ## [Logs not being harvested after agent restart](https://discuss.elastic.co/t/logs-not-being-harvested-after-agent-restart/294579)
**Author:** [@yelloyonder](https://discuss.elastic.co/u/yelloyonder)\ **Replies:** 9\ **Last updated:** [February 1, 2022, 10:30am UTC](https://discuss.elastic.co/t/logs-not-being-harvested-after-agent-restart/294579 "2022-02-01T10:30:45Z")
Hi, We are using Elastic Agent to collect logs using the Custom Logs integration. This is on Elastic Cloud. The agent servers are turned off nightly. When the servers come up and the elastic-agent service is started, F… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1070) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1072)