# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=959 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 960 --- ## [Importing and querying against a list](https://discuss.elastic.co/t/importing-and-querying-against-a-list/301896)
**Author:** [@chin1](https://discuss.elastic.co/u/chin1)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 10:35am UTC](https://discuss.elastic.co/t/importing-and-querying-against-a-list/301896 "2022-04-28T10:35:09Z")
Hey, i'm trying to query against a large list, so apposed to copying and pasting data in KQL, and running something user: ("name","name2","name3") Is there away of importing that list and making it into a variable? the… --- ## [How to compare two aggregations (Apr 2022)](https://discuss.elastic.co/t/how-to-compare-two-aggregations-apr-2022/303480)
**Author:** [@jurisn](https://discuss.elastic.co/u/jurisn)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 8:39am UTC](https://discuss.elastic.co/t/how-to-compare-two-aggregations-apr-2022/303480 "2022-04-28T08:39:24Z")
Three years ago I asked the question: How to compare two aggregations Hi, I have list for 24 hour period: PC1 PC2 PC3 PC4 I have list for 1 hour period: PC3 PC4 as result I will receive such list: PC1 PC2 Do… --- ## [Kibana dashboard with "message" filter as a user input](https://discuss.elastic.co/t/kibana-dashboard-with-message-filter-as-a-user-input/303408)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 8:39am UTC](https://discuss.elastic.co/t/kibana-dashboard-with-message-filter-as-a-user-input/303408 "2022-04-28T08:39:32Z")
Hi! I am in the process of setting up Filebeat-based monitoring of our Kubernetes workloads' logs. For starters, I want to have a simple page where devs and PMs can go to to view the logs ingested from our deployments. I… --- ## [Lifecycling of rollup index](https://discuss.elastic.co/t/lifecycling-of-rollup-index/303167)
**Author:** [@sandeepmuthathi](https://discuss.elastic.co/u/sandeepmuthathi)\ **Replies:** 8\ **Last updated:** [April 28, 2022, 8:38am UTC](https://discuss.elastic.co/t/lifecycling-of-rollup-index/303167 "2022-04-28T08:38:46Z")
I would want to lifecycle the rollup index. Is there any way we can do it? --- ## [Kibana gauge visualization](https://discuss.elastic.co/t/kibana-gauge-visualization/303244)
**Author:** [@wagnar](https://discuss.elastic.co/u/wagnar)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 8:25am UTC](https://discuss.elastic.co/t/kibana-gauge-visualization/303244 "2022-04-28T08:25:58Z")
I am trying to achieve one usecase, i want to see the sales per country vs targeted sales for that particular country with the help of guage chart. But I'm not able to see add the targeted value for each country. |Count… --- ## [Ruby Script to rename fields base on a dictionary](https://discuss.elastic.co/t/ruby-script-to-rename-fields-base-on-a-dictionary/303413)
**Author:** [@frank\_esg](https://discuss.elastic.co/u/frank_esg)\ **Replies:** 4\ **Last updated:** [April 28, 2022, 8:23am UTC](https://discuss.elastic.co/t/ruby-script-to-rename-fields-base-on-a-dictionary/303413 "2022-04-28T08:23:27Z")
Hello, we use in a logstash pipeline an external ruby script which contains several methods to process logfiles. now we want to add a new method to rename all top level fields of a document based on a hashtable. I hav… --- ## [Java Client API: FieldValue vs JsonData](https://discuss.elastic.co/t/java-client-api-fieldvalue-vs-jsondata/303476)
**Author:** [@sbrunot](https://discuss.elastic.co/u/sbrunot)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 8:04am UTC](https://discuss.elastic.co/t/java-client-api-fieldvalue-vs-jsondata/303476 "2022-04-28T08:04:32Z")
Hello, with the new Java Client API, some queries takes a FieldValue parameter (exemple: term query) and some other takes a JsonData parameter (exemple: range queries). One issue that I have with FieldValue parameters … --- ## [Failed to retrieve password hash for reserved user \[elastic\]](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475)
**Author:** [@Balaji\_Arumugam](https://discuss.elastic.co/u/Balaji_Arumugam)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 7:57am UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-elastic/303475 "2022-04-28T07:57:41Z")
Hi Team, We have facing an issue while we start the Elasticsearch master node with the following errors \[2022-04-28T07:40:11,318\]\[INFO \]\[o.e.x.s.a.AuthenticationService\] \[master\] Authentication of \[elastic\] was termina… --- ## [Access to elasticsearch host from kibana in other host](https://discuss.elastic.co/t/access-to-elasticsearch-host-from-kibana-in-other-host/303353)
**Author:** [@Firas\_Bougrine](https://discuss.elastic.co/u/Firas_Bougrine)\ **Replies:** 8\ **Last updated:** [April 28, 2022, 7:43am UTC](https://discuss.elastic.co/t/access-to-elasticsearch-host-from-kibana-in-other-host/303353 "2022-04-28T07:43:09Z")
hi I can't access to Elasticsearch host from kibana host , i tested this command and it not work this cmd : curl -XGET es-ip-or-hostname:9200/ , the response of the command : kibana@kibana:~$ curl -XGET 172.19.14.67:9… --- ## [Authenticate using google firebase](https://discuss.elastic.co/t/authenticate-using-google-firebase/303469)
**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 6:57am UTC](https://discuss.elastic.co/t/authenticate-using-google-firebase/303469 "2022-04-28T06:57:09Z")
Hi I am working on an app that needs user to login to kibana using GCP firebase as my application runs on GCP and users are already imported to firebase. I was considering to use SAML method. There are a few issues I ne… --- ## [Issue with multiple instances of the same token](https://discuss.elastic.co/t/issue-with-multiple-instances-of-the-same-token/303467)
**Author:** [@dishant.sharma](https://discuss.elastic.co/u/dishant.sharma)\ **Replies:** 0\ **Last updated:** [April 28, 2022, 6:43am UTC](https://discuss.elastic.co/t/issue-with-multiple-instances-of-the-same-token/303467 "2022-04-28T06:43:34Z")
I am getting a token multiple times after the analysis process. I am using the pattern token filter and using different regexes with different instances of token filter on the same input string. In some cases, I'm gettin… --- ## [Term Aggregation on sorted data](https://discuss.elastic.co/t/term-aggregation-on-sorted-data/303361)
**Author:** [@dev\_test](https://discuss.elastic.co/u/dev_test)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 6:36am UTC](https://discuss.elastic.co/t/term-aggregation-on-sorted-data/303361 "2022-04-28T06:36:58Z")
Hi, i want to run some term aggregations on sorted data and i want these changes to be reflected inside the buckets. Suppose i have an order\_id field inside my document. I query over the index with size 0, while sort m… --- ## [High CPU, search intensive indices, course of action?](https://discuss.elastic.co/t/high-cpu-search-intensive-indices-course-of-action/303431)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 6:15am UTC](https://discuss.elastic.co/t/high-cpu-search-intensive-indices-course-of-action/303431 "2022-04-28T06:15:22Z")
I have a 7.17 cluster with 6 data nodes. There's a website using this ES cluster with a dashboard that customers are constantly querying... It has data for the last 2 months exceeding 300 GB in only 2 indices (2 pri, 1 … --- ## [Match two tags in same time (not one at the time)](https://discuss.elastic.co/t/match-two-tags-in-same-time-not-one-at-the-time/303438)
**Author:** [@eugenci](https://discuss.elastic.co/u/eugenci)\ **Replies:** 2\ **Last updated:** [April 28, 2022, 4:05am UTC](https://discuss.elastic.co/t/match-two-tags-in-same-time-not-one-at-the-time/303438 "2022-04-28T04:05:20Z")
I folders index with following mapping: { "mappings": { "\_doc": { "properties": { "tags": { "type": "nested", "properties": { "bg\_color": { "type": "keyw… --- ## [Failed to authenticate user \[elastic\] after changing environment](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-after-changing-environment/303319)
**Author:** [@Jasper\_Tan](https://discuss.elastic.co/u/Jasper_Tan)\ **Replies:** 5\ **Last updated:** [April 28, 2022, 2:26am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic-after-changing-environment/303319 "2022-04-28T02:26:58Z")
I am aware that there are multiple post on this issue already but my situation is kinda unique. Back story: I have provisioned a VM on an offline server with Elasticsearch, Logstash and Kibana running fine on it for the… --- ## [Stack Monitoring with elastic agent / fleet?](https://discuss.elastic.co/t/stack-monitoring-with-elastic-agent-fleet/303266)
**Author:** [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 2:19am UTC](https://discuss.elastic.co/t/stack-monitoring-with-elastic-agent-fleet/303266 "2022-04-28T02:19:29Z")
Can we Stack Monitoring with elastic agent / fleet ? --- ## [How to reindex data from 5 to six to upgrade ES to 7](https://discuss.elastic.co/t/how-to-reindex-data-from-5-to-six-to-upgrade-es-to-7/303386)
**Author:** [@sameer\_khamkar](https://discuss.elastic.co/u/sameer_khamkar)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 12:56am UTC](https://discuss.elastic.co/t/how-to-reindex-data-from-5-to-six-to-upgrade-es-to-7/303386 "2022-04-28T00:56:18Z")
I want to do reindex data which is created in version 5 to version 6 so that we can upgrade ES to version 7 so we are following below curl 'localhost:9200/\_cat/indices?v' -- list all curl -X PUT "localhost:9200/my\_… --- ## [Kibana HeatMap Layer not displaying](https://discuss.elastic.co/t/kibana-heatmap-layer-not-displaying/303288)
**Author:** [@Alessandro\_Agnello](https://discuss.elastic.co/u/Alessandro_Agnello)\ **Replies:** 4\ **Last updated:** [April 27, 2022, 10:55pm UTC](https://discuss.elastic.co/t/kibana-heatmap-layer-not-displaying/303288 "2022-04-27T22:55:49Z")
I have tried with version 8.1.2 and upgraded to 8.1.3, I cannot get any heat maps to work. I do have it working for Documents Layer type without any problems. Thanks --- ## [How to send data Weblogic exporter data to logstash](https://discuss.elastic.co/t/how-to-send-data-weblogic-exporter-data-to-logstash/303399)
**Author:** [@mangeshmj1992](https://discuss.elastic.co/u/mangeshmj1992)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 10:28pm UTC](https://discuss.elastic.co/t/how-to-send-data-weblogic-exporter-data-to-logstash/303399 "2022-04-27T22:28:43Z")
Hello team, We need to send data from Weblogic exporter to logstash is there any wat to send data to logstash. We don't want to send data directly to Elasticsearch. --- ## [Elastic Search v7.17.1 Alias Filtering Performance Issues](https://discuss.elastic.co/t/elastic-search-v7-17-1-alias-filtering-performance-issues/303443)
**Author:** [@mma1](https://discuss.elastic.co/u/mma1)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 9:53pm UTC](https://discuss.elastic.co/t/elastic-search-v7-17-1-alias-filtering-performance-issues/303443 "2022-04-27T21:53:28Z")
Hello, I have recently started using alias filtering with our application and have seen some performance issues. I am using elastic v7.17.1 on a 12 node cluster. The alias looks like the following (the array in terms c… --- ## [Multiple clusters in elastic search](https://discuss.elastic.co/t/multiple-clusters-in-elastic-search/303383)
**Author:** [@sairaj\_dessai](https://discuss.elastic.co/u/sairaj_dessai)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 9:43pm UTC](https://discuss.elastic.co/t/multiple-clusters-in-elastic-search/303383 "2022-04-27T21:43:01Z")
How to create multiple clusters in a single windows machine. Also how to insert , select , update , delete records from multiple clusters. As of now I tried to run 2 Elasticsearch on single server and changed yaml file s… --- ## [NLP models on Elastic 8 Cloud](https://discuss.elastic.co/t/nlp-models-on-elastic-8-cloud/303199)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 3\ **Last updated:** [April 27, 2022, 9:31pm UTC](https://discuss.elastic.co/t/nlp-models-on-elastic-8-cloud/303199 "2022-04-27T21:31:46Z")
Hello, I started a free 14-days trial of Elastic 8 Cloud, to test NLP models. On this page Third party NLP models | Machine Learning in the Elastic Stack \[8.1\] | Elastic there are a lot of models, I just tried sentence-… --- ## [Getting permission denied error after changing data directory for logstash](https://discuss.elastic.co/t/getting-permission-denied-error-after-changing-data-directory-for-logstash/303426)
**Author:** [@cool999](https://discuss.elastic.co/u/cool999)\ **Replies:** 8\ **Last updated:** [April 27, 2022, 6:43pm UTC](https://discuss.elastic.co/t/getting-permission-denied-error-after-changing-data-directory-for-logstash/303426 "2022-04-27T18:43:29Z")
Hi Team, I am getting permission denied error after changing path.data and path.logs in logstash to new path. Same issue is happening for kibana. However for Elasticsearch it is working, i can see elasticsearch folder… --- ## [Parse xml entry with logstash and create a new field with the data](https://discuss.elastic.co/t/parse-xml-entry-with-logstash-and-create-a-new-field-with-the-data/302262)
**Author:** [@Rohit\_Goel1](https://discuss.elastic.co/u/Rohit_Goel1)\ **Replies:** 32\ **Last updated:** [April 27, 2022, 5:52pm UTC](https://discuss.elastic.co/t/parse-xml-entry-with-logstash-and-create-a-new-field-with-the-data/302262 "2022-04-27T17:52:13Z")
I need to parse below xml file with logstash and filter out status and create a new field with its value. below is the sample xml file: \ \ \SUCCESS\ \ I… --- ## [Winlogbeat experimental api missmatch between paresed fields and rendered event](https://discuss.elastic.co/t/winlogbeat-experimental-api-missmatch-between-paresed-fields-and-rendered-event/303388)
**Author:** [@SH\_HSOC](https://discuss.elastic.co/u/SH_HSOC)\ **Replies:** 4\ **Last updated:** [April 27, 2022, 5:18pm UTC](https://discuss.elastic.co/t/winlogbeat-experimental-api-missmatch-between-paresed-fields-and-rendered-event/303388 "2022-04-27T17:18:49Z")
Hi folks, in Winlogbeat I recently switched from the default windows event log API to the experimental one, because winlogbeat was capping out at roughly 1800 events per second and our Windows event collector getting a … --- ## [Ngram behavior vs wildcard field type](https://discuss.elastic.co/t/ngram-behavior-vs-wildcard-field-type/302762)
**Author:** [@maratusa](https://discuss.elastic.co/u/maratusa)\ **Replies:** 7\ **Last updated:** [April 27, 2022, 4:45pm UTC](https://discuss.elastic.co/t/ngram-behavior-vs-wildcard-field-type/302762 "2022-04-27T16:45:33Z")
Hi, Please help me understand n-gram and wildcard field type behaviors. I am working on an application that offers a search by phone number. It will be a contain search. e.g. search for phone number containing "234890"… --- ## [Logstash Deprecation log JSON Format](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 2\ **Last updated:** [April 27, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-deprecation-log-json-format/303155 "2022-04-27T16:14:08Z")
Is it possible to configure the deprecation logs of Logstash as JSON entries? log.format: json works fine for the 'normal' logs, but not for deprecation ones. I've checked log4j2.properties and it seems that some kind … --- ## [Split document into multiple documents](https://discuss.elastic.co/t/split-document-into-multiple-documents/303305)
**Author:** [@ciavam](https://discuss.elastic.co/u/ciavam)\ **Replies:** 12\ **Last updated:** [April 27, 2022, 3:47pm UTC](https://discuss.elastic.co/t/split-document-into-multiple-documents/303305 "2022-04-27T15:47:16Z")
Hello, Through the logstash code I was able to get a result like: {field0 = value field1 = \[value1\_field1; value1\_field1\] field2 = \[value1\_field2; value2\_field2\] } Is it possible through logstash to go to what is w… --- ## [Logstash split filter does not work with match\_only\_text type](https://discuss.elastic.co/t/logstash-split-filter-does-not-work-with-match-only-text-type/303357)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 2\ **Last updated:** [April 27, 2022, 2:56pm UTC](https://discuss.elastic.co/t/logstash-split-filter-does-not-work-with-match-only-text-type/303357 "2022-04-27T14:56:18Z")
Dear Community, We use heartbeat to collect http response from some services. The response format is a JSON array and the array is returned in the http.request.body.content field and http.request.body.content.text field… --- ## [Filebeat HAProxy module does not parse tcplog format](https://discuss.elastic.co/t/filebeat-haproxy-module-does-not-parse-tcplog-format/303422)
**Author:** [@CaptAintHere](https://discuss.elastic.co/u/CaptAintHere)\ **Replies:** 0\ **Last updated:** [April 27, 2022, 2:55pm UTC](https://discuss.elastic.co/t/filebeat-haproxy-module-does-not-parse-tcplog-format/303422 "2022-04-27T14:55:18Z")
Hi, I'm trying to use the HAProxy module of Filebeat with a TCP frontend in HAProxy but the grok does not seem to work with the log lines generated by the option tcplog of HAProxy. This GitHub issue mentions that the o… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=958) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=960)