# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=687 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 688 --- ## [Retrieve filters KQL Query](https://discuss.elastic.co/t/retrieve-filters-kql-query/317784)
**Author:** [@bandodkarD](https://discuss.elastic.co/u/bandodkarD)\ **Replies:** 5\ **Last updated:** [October 31, 2022, 12:08pm UTC](https://discuss.elastic.co/t/retrieve-filters-kql-query/317784 "2022-10-31T12:08:41Z")
Can you advise how we can retrieve the backend KQL query once we filter out data on Kibana Dashboard? Our requirement is to filter out data using charts and other visualisations are retrieve the query generated in backe… --- ## [Filtering expired child document while searching](https://discuss.elastic.co/t/filtering-expired-child-document-while-searching/321957)
**Author:** [@Lokesh\_Reddy1](https://discuss.elastic.co/u/Lokesh_Reddy1)\ **Replies:** 0\ **Last updated:** [December 24, 2022, 10:50pm UTC](https://discuss.elastic.co/t/filtering-expired-child-document-while-searching/321957 "2022-12-24T22:50:26Z")
Hi Everyone, I am struck with this unique problem and hopefully one of you might know the answer. Here is the situation: I have an object hierarchy Asset -\> Media Items (One to Many). Some of the Media Items may expir… --- ## [Authentication methods Kibana Dash](https://discuss.elastic.co/t/authentication-methods-kibana-dash/317690)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 8\ **Last updated:** [October 31, 2022, 10:31am UTC](https://discuss.elastic.co/t/authentication-methods-kibana-dash/317690 "2022-10-31T10:31:42Z")
Hello, I configured my ES e Kibana for a token authentication. Both are reachable by browser, but Kibana asks me login credentials to access even if I have configured Token Authentication. Is it normal? Shouldn't i l… --- ## [Upgrade from 7.17.1 to 8.5.3 failed](https://discuss.elastic.co/t/upgrade-from-7-17-1-to-8-5-3-failed/321946)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [December 24, 2022, 11:03pm UTC](https://discuss.elastic.co/t/upgrade-from-7-17-1-to-8-5-3-failed/321946 "2022-12-24T23:03:01Z")
here is error. java.lang.IllegalStateException: cannot upgrade node because incompatible indices created with version \[6.5.4\] exist, while the minimum compatible index version is \[7.0.0\]. Upgrade your older indices by … --- ## [Records field not getting updated in Kibana dashboard](https://discuss.elastic.co/t/records-field-not-getting-updated-in-kibana-dashboard/321345)
**Author:** [@Shashank02](https://discuss.elastic.co/u/Shashank02)\ **Replies:** 1\ **Last updated:** [December 24, 2022, 6:24pm UTC](https://discuss.elastic.co/t/records-field-not-getting-updated-in-kibana-dashboard/321345 "2022-12-24T18:24:51Z")
I'm pushing my CSV data directly to Elasticsearch using python. Because of that, an index is getting created. But, then I am creating a data view manually in order to use it for KIBANA DASHBOARDS. The error I am facing i… --- ## [Dashboard building](https://discuss.elastic.co/t/dashboard-building/320883)
**Author:** [@moep](https://discuss.elastic.co/u/moep)\ **Replies:** 5\ **Last updated:** [December 24, 2022, 2:48pm UTC](https://discuss.elastic.co/t/dashboard-building/320883 "2022-12-24T14:48:03Z")
Dear Community, Im running Kibana 8.4.3 and want to create a speacial typ of visulization. I'm analysing my my flow and Im interessted into the MSD ID and the timestamp (I want to see the newest on the top). Right now… --- ## [Send “raw log” and “filter log” from single server to elastic server](https://discuss.elastic.co/t/send-raw-log-and-filter-log-from-single-server-to-elastic-server/321824)
**Author:** [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\ **Replies:** 7\ **Last updated:** [December 24, 2022, 1:42pm UTC](https://discuss.elastic.co/t/send-raw-log-and-filter-log-from-single-server-to-elastic-server/321824 "2022-12-24T13:42:40Z")
Hi Need to Send “raw log” and “filter log” from single server to elastic server, but in different index. Like this: Host1 (rawlog) \> elastic (rawindex) Host1 (filter log) \> elastic (filterindex) Is it possible? Any… --- ## [Tokenizing using runtime-fields](https://discuss.elastic.co/t/tokenizing-using-runtime-fields/319469)
**Author:** [@rvadiga](https://discuss.elastic.co/u/rvadiga)\ **Replies:** 2\ **Last updated:** [November 26, 2022, 2:16pm UTC](https://discuss.elastic.co/t/tokenizing-using-runtime-fields/319469 "2022-11-26T14:16:18Z")
Hello, I have an ELK index created already with the data value ";\@ip". I need to define an aggregation based on the status code. Can someone please share any hints to split this 'status\_code' from the ELK … --- ## [Kibana global filter isn't applied to Vega-lite visualizations](https://discuss.elastic.co/t/kibana-global-filter-isnt-applied-to-vega-lite-visualizations/321210)
**Author:** [@ysattvik](https://discuss.elastic.co/u/ysattvik)\ **Replies:** 3\ **Last updated:** [December 24, 2022, 10:38am UTC](https://discuss.elastic.co/t/kibana-global-filter-isnt-applied-to-vega-lite-visualizations/321210 "2022-12-24T10:38:01Z")
Hi there, I am using Kibana version 8.5.0 I have added some visualizations made in Kibana and some custom visualizations made in Vega-lite on a single dashboard. When I am trying to filter data on the basis control or … --- ## [Elastic Agent and Snort of integations](https://discuss.elastic.co/t/elastic-agent-and-snort-of-integations/321952)
**Author:** [@learning\_deep](https://discuss.elastic.co/u/learning_deep)\ **Replies:** 2\ **Last updated:** [December 24, 2022, 10:12am UTC](https://discuss.elastic.co/t/elastic-agent-and-snort-of-integations/321952 "2022-12-24T10:12:47Z")
I have installed Elastic Agent and Snort of integations and Elastic Stack. But it seems that Snort of integations just receive .log format files? I find my snort only have txt files. Can someone help me? How should i con… --- ## [Order documents by multiple geolocations](https://discuss.elastic.co/t/order-documents-by-multiple-geolocations/321449)
**Author:** [@merianos](https://discuss.elastic.co/u/merianos)\ **Replies:** 1\ **Last updated:** [December 24, 2022, 9:14am UTC](https://discuss.elastic.co/t/order-documents-by-multiple-geolocations/321449 "2022-12-24T09:14:28Z")
I am new to Elasticsearch and I try to create an index for companies that come with multiple branches in the city. Each of the branches it has it's own geolocation point. My companies document looks like this: { "… --- ## [How to disable "View surrounding documents" and "View single document" options from discover searches](https://discuss.elastic.co/t/how-to-disable-view-surrounding-documents-and-view-single-document-options-from-discover-searches/317786)
**Author:** [@sanskar-panchal-gith](https://discuss.elastic.co/u/sanskar-panchal-gith)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 9:50am UTC](https://discuss.elastic.co/t/how-to-disable-view-surrounding-documents-and-view-single-document-options-from-discover-searches/317786 "2022-10-31T09:50:02Z")
Hi , I am working on a Kibana plugin where I have used EmbeddableRenderer to show an dashboard and later I am embedding this dashboard inside an react application with share functionality of dashboard. There is a disco… --- ## [Esrally benchmark run with(/out) refresh\_interval param doesn't show any difference in runtime](https://discuss.elastic.co/t/esrally-benchmark-run-with-out-refresh-interval-param-doesnt-show-any-difference-in-runtime/321668)
**Author:** [@Mahesh3](https://discuss.elastic.co/u/Mahesh3)\ **Replies:** 7\ **Last updated:** [December 24, 2022, 5:59am UTC](https://discuss.elastic.co/t/esrally-benchmark-run-with-out-refresh-interval-param-doesnt-show-any-difference-in-runtime/321668 "2022-12-24T05:59:58Z")
I have done two benchmark runs using the esrally, one with default refresh interval and second with "refresh\_interval" set to "-1" (disabled). Both runs took same amount of time. (382 seconds) I am hoping that second be… --- ## [Trouble with filter conditional logic](https://discuss.elastic.co/t/trouble-with-filter-conditional-logic/321930)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 5\ **Last updated:** [December 24, 2022, 3:53am UTC](https://discuss.elastic.co/t/trouble-with-filter-conditional-logic/321930 "2022-12-24T03:53:21Z")
I have had the following filter conditional logic in place for a while now, and it's working well: filter { mutate { \[...\] } if "STRING1" in \[message\] { \[...\] } else if \[type\] == "syslog" { \[...\] } … --- ## [Elastic Alert](https://discuss.elastic.co/t/elastic-alert/316836)
**Author:** [@wijamw](https://discuss.elastic.co/u/wijamw)\ **Replies:** 5\ **Last updated:** [October 31, 2022, 4:48am UTC](https://discuss.elastic.co/t/elastic-alert/316836 "2022-10-31T04:48:55Z")
Hello everyone, I am trying to set up an alert when the CPU is 100% for =\> 20 minutes. Here is my setup But the alert comes even if it is only 100% for a few minutes. Is there something wrong with the configuratio… --- ## [How do I use prune inside of a specific field?](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950)
**Author:** [@ste1](https://discuss.elastic.co/u/ste1)\ **Replies:** 1\ **Last updated:** [December 24, 2022, 3:10am UTC](https://discuss.elastic.co/t/how-do-i-use-prune-inside-of-a-specific-field/321950 "2022-12-24T03:10:54Z")
I have a bunch of csv files from which I need to extract the "user" and "hwid" columns from. The csv filter will pull out all of the columns and put them in a field called "data". I then use the prune filter to keep only… --- ## [Problem "grok"ing when there is a conditional part on it](https://discuss.elastic.co/t/problem-grok-ing-when-there-is-a-conditional-part-on-it/321919)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 4\ **Last updated:** [December 23, 2022, 11:53pm UTC](https://discuss.elastic.co/t/problem-grok-ing-when-there-is-a-conditional-part-on-it/321919 "2022-12-23T23:53:54Z")
If I have this text: blah1=faa faa2 blah2=fee blah3=fii blah4=foo how can I have the values of each variable (the one that are before the equal sign) with regex? I’ve tried with this grok: blah1=(?\\[^=\]+) blah2=… --- ## [Cannot access kibana on remote server](https://discuss.elastic.co/t/cannot-access-kibana-on-remote-server/317573)
**Author:** [@sir\_t](https://discuss.elastic.co/u/sir_t)\ **Replies:** 1\ **Last updated:** [October 31, 2022, 2:20am UTC](https://discuss.elastic.co/t/cannot-access-kibana-on-remote-server/317573 "2022-10-31T02:20:04Z")
--- ## [Significant\_terms aggregation with sampling](https://discuss.elastic.co/t/significant-terms-aggregation-with-sampling/321944)
**Author:** [@colinvdh](https://discuss.elastic.co/u/colinvdh)\ **Replies:** 1\ **Last updated:** [December 23, 2022, 10:19pm UTC](https://discuss.elastic.co/t/significant-terms-aggregation-with-sampling/321944 "2022-12-23T22:19:39Z")
Hi there, I am looking to extract top 100 most significant terms out of a very large index. In particular, terms that have increased the most significantly in frequency between some defined "background set" and "foregro… --- ## [How to dinamically replace - with \_ in nested field names](https://discuss.elastic.co/t/how-to-dinamically-replace-with-in-nested-field-names/321936)
**Author:** [@anubisg1](https://discuss.elastic.co/u/anubisg1)\ **Replies:** 10\ **Last updated:** [December 23, 2022, 9:02pm UTC](https://discuss.elastic.co/t/how-to-dinamically-replace-with-in-nested-field-names/321936 "2022-12-23T21:02:54Z")
i'm try to perform a field name replacement dynamically. I do not know ahead of time how many fields nr what they are. i found this in an elasticsearch pipeline but i need to do the exact same in logstash # Converts a… --- ## [How to develop an external plugin using Angular?](https://discuss.elastic.co/t/how-to-develop-an-external-plugin-using-angular/321883)
**Author:** [@Sheereen](https://discuss.elastic.co/u/Sheereen)\ **Replies:** 1\ **Last updated:** [December 23, 2022, 7:48pm UTC](https://discuss.elastic.co/t/how-to-develop-an-external-plugin-using-angular/321883 "2022-12-23T19:48:44Z")
Hi, I want to develop an external custom plugin using Angular. Is there any example plugin or blogs on the same? Any references? Thanks --- ## [Visualizations for Text Words in Kibana](https://discuss.elastic.co/t/visualizations-for-text-words-in-kibana/321863)
**Author:** [@Cal](https://discuss.elastic.co/u/Cal)\ **Replies:** 5\ **Last updated:** [December 23, 2022, 6:49pm UTC](https://discuss.elastic.co/t/visualizations-for-text-words-in-kibana/321863 "2022-12-23T18:49:33Z")
I'm looking for a way to do visualizations, a graph or a counter, that searches for a keyword in a text paragraph. I have a description text field that is roughly a paragraph of text, and I want it to pull when a descri… --- ## [If condition list in field](https://discuss.elastic.co/t/if-condition-list-in-field/321886)
**Author:** [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\ **Replies:** 1\ **Last updated:** [December 23, 2022, 6:02pm UTC](https://discuss.elastic.co/t/if-condition-list-in-field/321886 "2022-12-23T18:02:43Z")
hello, is it possible to do a searching of a list in field? e.g. filter{ if \["a","b","c","d"\] in \[message\]{ mutate{ add\_field=\>{"new\_field"=\>"%{message}"} } } } i want the "new\_field… --- ## [Sequence Independent Correlation with EQL](https://discuss.elastic.co/t/sequence-independent-correlation-with-eql/321941)
**Author:** [@jmaurio](https://discuss.elastic.co/u/jmaurio)\ **Replies:** 0\ **Last updated:** [December 23, 2022, 5:54pm UTC](https://discuss.elastic.co/t/sequence-independent-correlation-with-eql/321941 "2022-12-23T17:54:41Z")
Is it possible to create a custom rule that is the AND of three events that is order independent? For example, I would like to trigger when event A, event B and event C are satisfied, but I don't care what order they wer… --- ## [Aggregation Based Line Chart - Y axis is inverted](https://discuss.elastic.co/t/aggregation-based-line-chart-y-axis-is-inverted/321907)
**Author:** [@tinrik](https://discuss.elastic.co/u/tinrik)\ **Replies:** 8\ **Last updated:** [December 23, 2022, 5:46pm UTC](https://discuss.elastic.co/t/aggregation-based-line-chart-y-axis-is-inverted/321907 "2022-12-23T17:46:54Z")
Hi, I am running Kibana 7.16.1. I currently have an Aggregation-based Line Chart that works as intended: Now I have created a copy by clicking on "Clone", and simply changed the field of the Split Series to split by… --- ## [Elasticsearch NEST (C# Client)](https://discuss.elastic.co/t/elasticsearch-nest-c-client/321854)
**Author:** [@diegovita](https://discuss.elastic.co/u/diegovita)\ **Replies:** 2\ **Last updated:** [December 23, 2022, 5:37pm UTC](https://discuss.elastic.co/t/elasticsearch-nest-c-client/321854 "2022-12-23T17:37:23Z")
Hello, I want to translate this Filter Agregation to C# (using NEST client) but I don't know how to: "aggs": { "Condiciones": { "filter": { "bool": { "filter": \[ { "terms":{ "genre": \[ "M", "F", "I", "X" \] } }, { … --- ## [An unexpected authentication error occurred. Please log in again. kibana](https://discuss.elastic.co/t/an-unexpected-authentication-error-occurred-please-log-in-again-kibana/319790)
**Author:** [@Praveen\_Prakasan](https://discuss.elastic.co/u/Praveen_Prakasan)\ **Replies:** 2\ **Last updated:** [November 25, 2022, 5:46pm UTC](https://discuss.elastic.co/t/an-unexpected-authentication-error-occurred-please-log-in-again-kibana/319790 "2022-11-25T17:46:48Z")
HI Team, I am facing An unexpected authentication error occurred. Please log in again. issue could you please help me i am using helm chart --- ## [Restoring snapshot in elastic delete some indices once restored](https://discuss.elastic.co/t/restoring-snapshot-in-elastic-delete-some-indices-once-restored/321926)
**Author:** [@marone](https://discuss.elastic.co/u/marone)\ **Replies:** 0\ **Last updated:** [December 23, 2022, 2:55pm UTC](https://discuss.elastic.co/t/restoring-snapshot-in-elastic-delete-some-indices-once-restored/321926 "2022-12-23T14:55:35Z")
Hello, I have an elastic cluster using ECK, running version 8.4.3, testing and understand snapshot restoration and here is what I did: (the questions are listed a the end, started with steps I did) Created a snapshot r… --- ## [Elasticsearch Report Download of size more than 10000 using aggregation](https://discuss.elastic.co/t/elasticsearch-report-download-of-size-more-than-10000-using-aggregation/321927)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 1\ **Last updated:** [December 23, 2022, 3:47pm UTC](https://discuss.elastic.co/t/elasticsearch-report-download-of-size-more-than-10000-using-aggregation/321927 "2022-12-23T15:47:13Z")
Hello All, I'm facing issue when I'm trying to download data more than 10000 records. I've 25000 documents in my elastic index and all these documents are unique(logsatsh doc\_as\_upsert) used.The challenge is elastic re… --- ## [Kinana error:Your query is taking time](https://discuss.elastic.co/t/kinana-error-your-query-is-taking-time/321933)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [December 23, 2022, 3:54pm UTC](https://discuss.elastic.co/t/kinana-error-your-query-is-taking-time/321933 "2022-12-23T15:54:47Z")
Hello All, I am trying to fetch the aggregation data of around 20000 records and visual I'm using is data table. I'm teasting in test server with 8 core cpus and with jvm size of 8GB. Can someone help me understand wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=686) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=688)