# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1102 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1103 --- ## [Kibana Vlookup Equivalent](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 5\ **Last updated:** [January 10, 2022, 4:25am UTC](https://discuss.elastic.co/t/kibana-vlookup-equivalent/293640 "2022-01-10T04:25:07Z")
Hi all, I have 2 indices in an index pattern. I want to see what are the documents which have the same fields values in both indices. Basically like vlookup in excel. I've tried a scripted field, but not getting appr… --- ## [Search multiple data streams and indices - Permissions](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678)
**Author:** [@carlos.cilleruelo](https://discuss.elastic.co/u/carlos.cilleruelo)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 11:11pm UTC](https://discuss.elastic.co/t/search-multiple-data-streams-and-indices-permissions/293678 "2022-01-09T23:11:43Z")
Hello, I am trying to perform some searches over multiple data streams and indices using a -\* pattern. Everything seems to be working when I search over a specific index, but if a tried the wildcard my client prompts an… --- ## [Anyone else have tried to monitor harbor?](https://discuss.elastic.co/t/anyone-else-have-tried-to-monitor-harbor/293795)
**Author:** [@dengyun19900722](https://discuss.elastic.co/u/dengyun19900722)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 10:39pm UTC](https://discuss.elastic.co/t/anyone-else-have-tried-to-monitor-harbor/293795 "2022-01-09T22:39:45Z")
Anyone else have tried to monitor harbor? --- ## [What is a classic and recommanded ElasticSearch architecture?](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:57pm UTC](https://discuss.elastic.co/t/what-is-a-classic-and-recommanded-elasticsearch-architecture/293727 "2022-01-09T21:57:25Z")
Our former cluster ES was made of 40 data nodes. 4 of them were coordinators as well 3 of them were electable as a master (for one node, it gathers data, coordinator and master-electable role) We aim to create a new c… --- ## [Elastic Diagnostics and Log4j2 vulnerability](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808)
**Author:** [@newschapmj1](https://discuss.elastic.co/u/newschapmj1)\ **Replies:** 1\ **Last updated:** [January 9, 2022, 9:31pm UTC](https://discuss.elastic.co/t/elastic-diagnostics-and-log4j2-vulnerability/293808 "2022-01-09T21:31:33Z")
Does upgrading to 8.2.6 fix all known Log4j2 issues with Elastic Diagnostics? Should it be on the Elastic list of software affected by Log4j2 to remind users to upgrade? --- ## [Aggregation numbers do not add up](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825)
**Author:** [@Lark](https://discuss.elastic.co/u/Lark)\ **Replies:** 0\ **Last updated:** [January 9, 2022, 12:42pm UTC](https://discuss.elastic.co/t/aggregation-numbers-do-not-add-up/293825 "2022-01-09T12:42:01Z")
Hello friends! I'm trying to learn aggregations on Elastic for my company's backend. Our documents include a label field (which could be many different keywords), and I would like to aggregate and calculate certain thi… --- ## [Kibana dashboard creation issue](https://discuss.elastic.co/t/kibana-dashboard-creation-issue/293132)
**Author:** [@vipeen](https://discuss.elastic.co/u/vipeen)\ **Replies:** 19\ **Last updated:** [January 9, 2022, 12:38am UTC](https://discuss.elastic.co/t/kibana-dashboard-creation-issue/293132 "2022-01-09T00:38:50Z")
Hi, I am trying to move logs from a Gateway server to Syslog and then to Elasticsearch and finally build dashboards on Kibana. I am newbie and try to do my best to get this completed. I actually got this task from an ex-… --- ## [Output to different index based on field](https://discuss.elastic.co/t/output-to-different-index-based-on-field/293804)
**Author:** [@krsecurity](https://discuss.elastic.co/u/krsecurity)\ **Replies:** 11\ **Last updated:** [January 8, 2022, 11:01pm UTC](https://discuss.elastic.co/t/output-to-different-index-based-on-field/293804 "2022-01-08T23:01:30Z")
Hi there, I have a couple of use-cases where I want to ingest filebeat module data, send it through Logstash, and then put it into different indexes based on what filebeat module that it used. So for example, the two I… --- ## [Visualisation based of an aggregated search](https://discuss.elastic.co/t/visualisation-based-of-an-aggregated-search/293811)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [January 8, 2022, 8:32pm UTC](https://discuss.elastic.co/t/visualisation-based-of-an-aggregated-search/293811 "2022-01-08T20:32:08Z")
Is there a way to base a visualisation on the results of an aggregation? For example: I have data on logins to our wireless network. It is trivial to get a pie chart that shows the proportion of success & failures ho… --- ## [Search template condition on paramters](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809)
**Author:** [@ylasri](https://discuss.elastic.co/u/ylasri)\ **Replies:** 0\ **Last updated:** [January 8, 2022, 7:25pm UTC](https://discuss.elastic.co/t/search-template-condition-on-paramters/293809 "2022-01-08T19:25:37Z")
Hello Everybody, Happy new year 2022. I have a small use case that i want to implement using Elasticsearch search template The idea is to limit the parameter from so that it can't go more that a limit value. Do you ha… --- ## [Elasticsearch-keystore: not found during attempt to configure elasticsearch 7.16.2](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805)
**Author:** [@Nicole\_Hirshler](https://discuss.elastic.co/u/Nicole_Hirshler)\ **Replies:** 1\ **Last updated:** [January 8, 2022, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-not-found-during-attempt-to-configure-elasticsearch-7-16-2/293805 "2022-01-08T18:04:14Z")
I'm trying to upgrade to the latest version of elasticsearch 7.16.2 inside docker. During the setup I see the following error: docker logs -f emr\_cloud\_elasticsearch /usr/local/bin/docker-entrypoint.sh: line 14: exec… --- ## [Ignore log record if log does not contain specific string "jenkins\_build\_number"](https://discuss.elastic.co/t/ignore-log-record-if-log-does-not-contain-specific-string-jenkins-build-number/293800)
**Author:** [@chandu.2035](https://discuss.elastic.co/u/chandu.2035)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 4:10pm UTC](https://discuss.elastic.co/t/ignore-log-record-if-log-does-not-contain-specific-string-jenkins-build-number/293800 "2022-01-08T16:10:51Z")
Hi there, I would like to ignore inserting entry in Elasticsearch index if the parsed log pattern does not contain the specific string jenkins\_build\_number Here is my filebeat and logstash configs. filebeat.yml #=====… --- ## [How to parse AWS Cloudfront logs](https://discuss.elastic.co/t/how-to-parse-aws-cloudfront-logs/293690)
**Author:** [@leo-baltus](https://discuss.elastic.co/u/leo-baltus)\ **Replies:** 4\ **Last updated:** [January 8, 2022, 9:49am UTC](https://discuss.elastic.co/t/how-to-parse-aws-cloudfront-logs/293690 "2022-01-08T09:49:04Z")
Tring to get filebeat to parse AWS Cloudfront logs. SQS seem to work. but once in ES I see: Provided Grok expressions do not match field value: \[2022-01-06\\t20:06:28\\tFRA56-C2\\t1729\\t3.125.241.170\\tGET\\tdtc81dn1qkg0w.c… --- ## [In memory Indices on ES 7.x](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778)
**Author:** [@mario12](https://discuss.elastic.co/u/mario12)\ **Replies:** 2\ **Last updated:** [January 8, 2022, 12:06am UTC](https://discuss.elastic.co/t/in-memory-indices-on-es-7-x/293778 "2022-01-08T00:06:22Z")
We are planning to implement an indices on ES 7.x. Is there a way we can keep the indices on memory instead of disk? The total size of the indices will be 150 GB and shared across multiple data nodes. --- ## [Elastic Agent Crashes and Restarts Every Second on Windows 11](https://discuss.elastic.co/t/elastic-agent-crashes-and-restarts-every-second-on-windows-11/293789)
**Author:** [@res260](https://discuss.elastic.co/u/res260)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elastic-agent-crashes-and-restarts-every-second-on-windows-11/293789 "2022-01-07T22:59:22Z")
Hey, I just setup the Elastic Stack to act as a SIEM and successfully deployed the Elastic Agent on 2 systems: my personnal laptop (running windows 10 pro) and my ubuntu 20 VPS. Both work fine. However, when trying to i… --- ## [Kibana Vega-lite xOffset is not a valid encoding channel](https://discuss.elastic.co/t/kibana-vega-lite-xoffset-is-not-a-valid-encoding-channel/292178)
**Author:** [@juliana\_cg](https://discuss.elastic.co/u/juliana_cg)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 10:02pm UTC](https://discuss.elastic.co/t/kibana-vega-lite-xoffset-is-not-a-valid-encoding-channel/292178 "2022-01-07T22:02:28Z")
Hello, i've been trying to create a grouped bar chart in kibana with vega lite, as shown in this example, but i always get a warning "xOffset-encoding is dropped as xOffset is not a valid encoding channel". As a result,… --- ## [Elasticsearh Error : Pods not coming back up](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 8\ **Last updated:** [January 7, 2022, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearh-error-pods-not-coming-back-up/293380 "2022-01-07T20:51:24Z")
Hi We have Elasticsearch running on openshift. Image: docker.elastic.co/elasticsearch/elasticsearch:6.8.15 All of a sudden on the the pods went down and are not restarting. Trying to figure out what the cause is. Log… --- ## [Deleting Index kibana](https://discuss.elastic.co/t/deleting-index-kibana/293773)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 8:09pm UTC](https://discuss.elastic.co/t/deleting-index-kibana/293773 "2022-01-07T20:09:46Z")
Hello there, Following log entry is appearing in kibana logs. I understand this is because of previous kibana versions. can I delete these indexes? Will deleting this affect my cluster? log \[15:17:55.850\] \[error\]\[eve… --- ## [Exact match](https://discuss.elastic.co/t/exact-match/293761)
**Author:** [@shafouz](https://discuss.elastic.co/u/shafouz)\ **Replies:** 3\ **Last updated:** [January 7, 2022, 7:19pm UTC](https://discuss.elastic.co/t/exact-match/293761 "2022-01-07T19:19:19Z")
Hi, I need to search in a big text field for a exact match. I tried with different analyzers but in a lot of them i run on the lucerne size limit and i haven't found any that exact matches. Are there any way to do that… --- ## [Request body is required when updating an index template using the Dev console](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775)
**Author:** [@dev9](https://discuss.elastic.co/u/dev9)\ **Replies:** 5\ **Last updated:** [January 7, 2022, 6:49pm UTC](https://discuss.elastic.co/t/request-body-is-required-when-updating-an-index-template-using-the-dev-console/293775 "2022-01-07T18:49:41Z")
Hi, How do I update an index template using the Dev Console? when I tried the below, I got a parse exception request body is required. I am using the latest version of elastic PUT \_index\_template/test/ { "… --- ## [Discover stream in dashboard](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772)
**Author:** [@Gforce](https://discuss.elastic.co/u/Gforce)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:55pm UTC](https://discuss.elastic.co/t/discover-stream-in-dashboard/293772 "2022-01-07T17:55:31Z")
How can I get a "Discover-like" stream into a Dashboard? The Log Stream widget does not behave the same. The stream visible in the Discover section adds new items to the top and it does not completely blank-out during r… --- ## [Updating Elasticstack from 7.16.1 to 7.16.2](https://discuss.elastic.co/t/updating-elasticstack-from-7-16-1-to-7-16-2/293586)
**Author:** [@Akhil2](https://discuss.elastic.co/u/Akhil2)\ **Replies:** 1\ **Last updated:** [January 6, 2022, 2:41pm UTC](https://discuss.elastic.co/t/updating-elasticstack-from-7-16-1-to-7-16-2/293586 "2022-01-06T14:41:23Z")
Hello all, I am updating my elasticstack to 7.16.2. Elasticsearch cluster started fine but I see following in Kibana logs. These events are constantly appearing in Kibana logs. GET /\_nodes?filter\_path=nodes.\*.version%2… --- ## [Hints based autodiscovery not working as described in documentation](https://discuss.elastic.co/t/hints-based-autodiscovery-not-working-as-described-in-documentation/293150)
**Author:** [@gehgerds](https://discuss.elastic.co/u/gehgerds)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:33pm UTC](https://discuss.elastic.co/t/hints-based-autodiscovery-not-working-as-described-in-documentation/293150 "2022-01-07T17:33:43Z")
I'm following documentation on hints based autodiscovery. I want to use annotations to control which pods logs are being discovered. When I use example config like this, then all containers in cluster gets discovered and… --- ## [Hardware server requirements for a fast ElasticSearch experience on one website with 900k entries](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768)
**Author:** [@nbadmin](https://discuss.elastic.co/u/nbadmin)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 5:12pm UTC](https://discuss.elastic.co/t/hardware-server-requirements-for-a-fast-elasticsearch-experience-on-one-website-with-900k-entries/293768 "2022-01-07T17:12:00Z")
Hello guys, I want to set up a dedicated vServer on which I want to run a single website. My question is what hardware server requirements do I need to implement a really fast Elasticsearch search and manage it with K… --- ## [Filebeat Kafka Input not able to process Messages](https://discuss.elastic.co/t/filebeat-kafka-input-not-able-to-process-messages/293255)
**Author:** [@cyber\_crab](https://discuss.elastic.co/u/cyber_crab)\ **Replies:** 4\ **Last updated:** [January 7, 2022, 5:07pm UTC](https://discuss.elastic.co/t/filebeat-kafka-input-not-able-to-process-messages/293255 "2022-01-07T17:07:06Z")
Hi everyone, I'm currently facing an issue with the Filebeat Kafka input. The event flow is Data Source \> Logstash \> Kafka \> Filebeat \> Logstash \> Elasticsearch. Kafka is used to handle event ingestion spikes and ES clu… --- ## [Elasticsearch issue: nested: NumberFormatException\[For input string:](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730)
**Author:** [@Kiran\_Chauhan](https://discuss.elastic.co/u/Kiran_Chauhan)\ **Replies:** 1\ **Last updated:** [January 7, 2022, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-issue-nested-numberformatexception-for-input-string/293730 "2022-01-07T16:53:48Z")
Hello @all, I am new here and hope this is the right place to discuss the issue. Sorry if I am violating any community rule. I have Elasticsearch with open-edx. Currently, I am facing an issue with Elasticsearch. wh… --- ## [How to ingest access\_log with x-forwarded-for from oracle http server in elasticsearch](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770)
**Author:** [@Agarwal](https://discuss.elastic.co/u/Agarwal)\ **Replies:** 0\ **Last updated:** [January 7, 2022, 4:51pm UTC](https://discuss.elastic.co/t/how-to-ingest-access-log-with-x-forwarded-for-from-oracle-http-server-in-elasticsearch/293770 "2022-01-07T16:51:31Z")
I am new to Elastic and wanting to ingest Oracle http server access\_log in elastic. i used apache ingestion, it considers entry as error.message. i used filebeat it does the same. i dont understand how to format it for i… --- ## [Why my logstash aggregate sometimes works, sometimes not?](https://discuss.elastic.co/t/why-my-logstash-aggregate-sometimes-works-sometimes-not/293342)
**Author:** [@maoxuguang](https://discuss.elastic.co/u/maoxuguang)\ **Replies:** 7\ **Last updated:** [January 7, 2022, 4:46pm UTC](https://discuss.elastic.co/t/why-my-logstash-aggregate-sometimes-works-sometimes-not/293342 "2022-01-07T16:46:26Z")
for example, sometimes I can get the tag \[ "fordebug\_%{job\_name}" \], it indicates that the aggregate executed successfully, sometimes I can not get this tag. why? I struggled for days but no finding. I am exhausted. cou… --- ## [Filtering nested objects](https://discuss.elastic.co/t/filtering-nested-objects/291911)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 11\ **Last updated:** [January 7, 2022, 3:45pm UTC](https://discuss.elastic.co/t/filtering-nested-objects/291911 "2022-01-07T15:45:10Z")
Hi, I'm trying to build a system that will have a user's phone book in nested field and this will have user\_id and user\_gender. I am trying to filter over gender in search result but i'm only getting the whole nested obj… --- ## [How to combine results from 2 elasticsearch indexes with different layouts](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659)
**Author:** [@jan499](https://discuss.elastic.co/u/jan499)\ **Replies:** 2\ **Last updated:** [January 7, 2022, 3:22pm UTC](https://discuss.elastic.co/t/how-to-combine-results-from-2-elasticsearch-indexes-with-different-layouts/293659 "2022-01-07T15:22:29Z")
We have an Elasticsearch with 2 different indexes. In one index there is a field called physical\_location which contains a lat en lon subfield. in the other index there is a field called program\_run.geolocation with the … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1101) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1103)