# Latest **URL:** https://discuss.elastic.co/latest.md?page=1326 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1327 --- ## [How to filter two fields based on a list of values](https://discuss.elastic.co/t/how-to-filter-two-fields-based-on-a-list-of-values/292846)
**Author:** [@Muharez](https://discuss.elastic.co/u/Muharez)\ **Replies:** 2\ **Last updated:** [December 31, 2021, 3:03pm UTC](https://discuss.elastic.co/t/how-to-filter-two-fields-based-on-a-list-of-values/292846 "2021-12-31T15:03:34Z")
Hi there! I have just started learning Elasticsearch. I created an index with four fields that contain information on distances between pairs of postcodes. { "distances" : { "mappings" : { "properties" : {… --- ## [ElasticSearch Input Plugin has no log output](https://discuss.elastic.co/t/elasticsearch-input-plugin-has-no-log-output/292906)
**Author:** [@l0ady](https://discuss.elastic.co/u/l0ady)\ **Replies:** 2\ **Last updated:** [December 31, 2021, 2:26pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-has-no-log-output/292906 "2021-12-31T14:26:40Z")
I want to extract one ES from another es periodically through logstash, but only the startup log, no other log information。。。THX config: input { #beats { # port =\> 5044 #} elasticsearch { hosts =\> \["10.1.2… --- ## [Stacked bars with percentages not clickable again](https://discuss.elastic.co/t/stacked-bars-with-percentages-not-clickable-again/292914)
**Author:** [@alrubaa](https://discuss.elastic.co/u/alrubaa)\ **Replies:** 1\ **Last updated:** [December 31, 2021, 2:17pm UTC](https://discuss.elastic.co/t/stacked-bars-with-percentages-not-clickable-again/292914 "2021-12-31T14:17:33Z")
Hi All, I recently upgraded Elasticsearch and Kibana to version 7.16.1 due to log4j issue and I noticed that my stacked bars charts with percentages are no longer clickable to filter. I had this issue with version 7.12.… --- ## [Registry not working in filebeat 7.16.1](https://discuss.elastic.co/t/registry-not-working-in-filebeat-7-16-1/292464)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 4\ **Last updated:** [December 31, 2021, 12:16pm UTC](https://discuss.elastic.co/t/registry-not-working-in-filebeat-7-16-1/292464 "2021-12-31T12:16:35Z")
I have recently updated from filebeat 7.7.1 to 7.16.1 running in docker and finding that even though the registry is persisted, each time I restart the filebeat container all logs are being re-read When I reverted from … --- ## [Kibana dev tools appears to ignore the env variable NOPROXY](https://discuss.elastic.co/t/kibana-dev-tools-appears-to-ignore-the-env-variable-noproxy/293165)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 1\ **Last updated:** [December 31, 2021, 10:38am UTC](https://discuss.elastic.co/t/kibana-dev-tools-appears-to-ignore-the-env-variable-noproxy/293165 "2021-12-31T10:38:59Z")
The Linux server on which kibana is running does not have direct internet access. Instead there are a bunch of ENV variable set that most network aware programs use. In particular we set NOPROXY= local.domain. Most o… --- ## [Sample size](https://discuss.elastic.co/t/sample-size/293230)
**Author:** [@Moni](https://discuss.elastic.co/u/Moni)\ **Replies:** 1\ **Last updated:** [December 31, 2021, 10:38am UTC](https://discuss.elastic.co/t/sample-size/293230 "2021-12-31T10:38:08Z")
What is the max value we can enter for disciver:sampleSize? Is 10k the max limit? --- ## [Kibana Markdown Panel Result](https://discuss.elastic.co/t/kibana-markdown-panel-result/293240)
**Author:** [@jennamul90](https://discuss.elastic.co/u/jennamul90)\ **Replies:** 1\ **Last updated:** [December 31, 2021, 10:32am UTC](https://discuss.elastic.co/t/kibana-markdown-panel-result/293240 "2021-12-31T10:32:52Z")
Is there a way to get the result of a panel included in the mark-down? My skills are pretty basic when it comes to using Elastic/Kibana --- ## [Collecting Elasticsearch monitoring data with Metricbeat in docker deployment](https://discuss.elastic.co/t/collecting-elasticsearch-monitoring-data-with-metricbeat-in-docker-deployment/293246)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [December 31, 2021, 9:26am UTC](https://discuss.elastic.co/t/collecting-elasticsearch-monitoring-data-with-metricbeat-in-docker-deployment/293246 "2021-12-31T09:26:43Z")
What is the best practice to switch from legacy to metricbeat monitoring for clusters deployed in docker.? How should I modify our docker compose file to incorporate metricbeat for internal Elasticsearch monitoring. Is… --- ## [Kibana failed to start (after upgrade 7.4 \> 7.16)](https://discuss.elastic.co/t/kibana-failed-to-start-after-upgrade-7-4-7-16/293210)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 3\ **Last updated:** [December 31, 2021, 9:01am UTC](https://discuss.elastic.co/t/kibana-failed-to-start-after-upgrade-7-4-7-16/293210 "2021-12-31T09:01:38Z")
Hello, After updating my Elasticsearch nodes from 7.4 to 7.16, I followed the upgrade documentation and upgraded my Kibana node from 7.4 to 7.16 through rpm (rpm -Uvh kibana\[...\].rpm The install process finished and ev… --- ## [Subsecond precision in Elasticsearch/Opensearch](https://discuss.elastic.co/t/subsecond-precision-in-elasticsearch-opensearch/293215)
**Author:** [@rizvaughan](https://discuss.elastic.co/u/rizvaughan)\ **Replies:** 3\ **Last updated:** [December 31, 2021, 8:08am UTC](https://discuss.elastic.co/t/subsecond-precision-in-elasticsearch-opensearch/293215 "2021-12-31T08:08:38Z")
Hello all, I had opened a similar issue before to get sub second precision in Elasticsearch. I wasn't able to send logs in epoch millseconds to Elasticsearch which now I have figured out how to do. Now I have two issue… --- ## [Kibana Dashboard testing](https://discuss.elastic.co/t/kibana-dashboard-testing/293175)
**Author:** [@dhamoust](https://discuss.elastic.co/u/dhamoust)\ **Replies:** 2\ **Last updated:** [December 31, 2021, 3:53am UTC](https://discuss.elastic.co/t/kibana-dashboard-testing/293175 "2021-12-31T03:53:05Z")
How to test charts in dashboard through automation? --- ## [Error on installing Elastic Search](https://discuss.elastic.co/t/error-on-installing-elastic-search/293239)
**Author:** [@syahmi](https://discuss.elastic.co/u/syahmi)\ **Replies:** 0\ **Last updated:** [December 31, 2021, 2:56am UTC](https://discuss.elastic.co/t/error-on-installing-elastic-search/293239 "2021-12-31T02:56:15Z")
Hello, I'm trying to install Elasticsearch on my windows 10 virtual machine. I installed JDK, and already set the environment path. I downloaded the Elasticsearch and run the cli commands for installation as given in th… --- ## [How can we apply ILM to Stack Monitoring indices?](https://discuss.elastic.co/t/how-can-we-apply-ilm-to-stack-monitoring-indices/293231)
**Author:** [@Laurent\_Gauthier](https://discuss.elastic.co/u/Laurent_Gauthier)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 10:20pm UTC](https://discuss.elastic.co/t/how-can-we-apply-ilm-to-stack-monitoring-indices/293231 "2021-12-30T22:20:22Z")
We are using Stack Monitoring on our Elastic Cloud clusters and this is proving very helpful. However, by default, the Stack Monitoring creates new indexes everyday (.monitoring-\*) and we have not found and easy way to c… --- ## [The Elastic Community Conference is back! February 12th, 2022, CfP closing soon](https://discuss.elastic.co/t/the-elastic-community-conference-is-back-february-12th-2022-cfp-closing-soon/293234)
**Author:** [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Replies:** 0\ **Last updated:** [December 31, 2021, 12:54am UTC](https://discuss.elastic.co/t/the-elastic-community-conference-is-back-february-12th-2022-cfp-closing-soon/293234 "2021-12-31T00:54:29Z")
The Elastic Community Conference 2022 is kicking off: Our second annual global Community event, in English, French, Japanese, Korean, Mandarin, Portuguese, and Spanish is happening in February 2022. We want your talks … --- ## [Indexing Performance drop after a few hours](https://discuss.elastic.co/t/indexing-performance-drop-after-a-few-hours/293223)
**Author:** [@stretchy](https://discuss.elastic.co/u/stretchy)\ **Replies:** 8\ **Last updated:** [December 30, 2021, 9:16pm UTC](https://discuss.elastic.co/t/indexing-performance-drop-after-a-few-hours/293223 "2021-12-30T21:16:19Z")
Hi, I'm having an issue with the Elasticsearch after a few hours (2-3 hours). There is a massive performance drop (50%-60%) but no symptoms as to why. Setup: Three nodes: 1 master two data nodes Elasticsearch version… --- ## [New header field in my ElasticSearch log dashboard](https://discuss.elastic.co/t/new-header-field-in-my-elasticsearch-log-dashboard/293191)
**Author:** [@EExisT](https://discuss.elastic.co/u/EExisT)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 9:38am UTC](https://discuss.elastic.co/t/new-header-field-in-my-elasticsearch-log-dashboard/293191 "2021-12-30T09:38:54Z")
Hello, i describe you the scenario. The system involved are: reverse proxy; elastic; kibana suricata logstash Actually i only see, on the kibana dashboard monitoring, traffic incoming with the reverse proxy ip to th… --- ## [Runtime field just stopped returning a value sometime around 4 AM this morning](https://discuss.elastic.co/t/runtime-field-just-stopped-returning-a-value-sometime-around-4-am-this-morning/293224)
**Author:** [@kossde](https://discuss.elastic.co/u/kossde)\ **Replies:** 3\ **Last updated:** [December 30, 2021, 7:03pm UTC](https://discuss.elastic.co/t/runtime-field-just-stopped-returning-a-value-sometime-around-4-am-this-morning/293224 "2021-12-30T19:03:34Z")
I created the following runtime field a couple of days ago and it was working fine. This morning, however it just stopped. The field is blank for all log entries that came in after around 4 AM this morning. Any idea… --- ## [Uninstall elasticsearch and kibana](https://discuss.elastic.co/t/uninstall-elasticsearch-and-kibana/293106)
**Author:** [@alipujaistopo](https://discuss.elastic.co/u/alipujaistopo)\ **Replies:** 6\ **Last updated:** [December 30, 2021, 3:39pm UTC](https://discuss.elastic.co/t/uninstall-elasticsearch-and-kibana/293106 "2021-12-30T15:39:36Z")
so I once had Elasticsearch and activated the trial license. After I uninstalled and reinstalled, this license still seems annoying. So how do I uninstall Elasticsearch completely clean, no more binding trial licenses? --- ## [How data will be distributed among the data nodes](https://discuss.elastic.co/t/how-data-will-be-distributed-among-the-data-nodes/293099)
**Author:** [@NK2812](https://discuss.elastic.co/u/NK2812)\ **Replies:** 8\ **Last updated:** [December 30, 2021, 5:09pm UTC](https://discuss.elastic.co/t/how-data-will-be-distributed-among-the-data-nodes/293099 "2021-12-30T17:09:23Z")
Hi, I have cluster with 3 master nodes and 3 data nodes and when I am trying to add the documents/data to cluster it seems only 2 data nodes are used. I have only one index and it is same for all the data nodes. if yo… --- ## [\[elastic output\] Differences in SSL between 7.9.1 and 7.16.2](https://discuss.elastic.co/t/elastic-output-differences-in-ssl-between-7-9-1-and-7-16-2/293035)
**Author:** [@rockandska](https://discuss.elastic.co/u/rockandska)\ **Replies:** 4\ **Last updated:** [December 30, 2021, 5:07pm UTC](https://discuss.elastic.co/t/elastic-output-differences-in-ssl-between-7-9-1-and-7-16-2/293035 "2021-12-30T17:07:30Z")
Hi, Previously, on 7.9.1, I had a configuration like the one bellow for my output : output { elasticsearch { hosts =\> "https://myhost:9200" index =\> "myindex" user =\> "myuser" password =\> "mypassword"… --- ## [Logstash not start after upgrade to new version](https://discuss.elastic.co/t/logstash-not-start-after-upgrade-to-new-version/291849)
**Author:** [@Alexander\_Popov](https://discuss.elastic.co/u/Alexander_Popov)\ **Replies:** 9\ **Last updated:** [December 30, 2021, 4:48pm UTC](https://discuss.elastic.co/t/logstash-not-start-after-upgrade-to-new-version/291849 "2021-12-30T16:48:35Z")
was 7.10.2, upgrade to 7.16.1 but it not start: 21-12-14T17:31:17,721\]\[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@sbemiller](https://discuss.elastic.co/u/sbemiller)\ **Replies:** 9\ **Last updated:** [December 30, 2021, 4:30pm UTC](https://discuss.elastic.co/t/issue-with-keystore-on-winlogbeat/293138 "2021-12-30T16:30:55Z") Elastic 7.15.1 I have read through a lot of discussions on how to solve this issue but nothing is working. I am working on an install process for the winlogbeat service. The Service installs and starts with no issues … --- ## [Kibana Plugin development: Search strategy vs. custom API route](https://discuss.elastic.co/t/kibana-plugin-development-search-strategy-vs-custom-api-route/293152)
**Author:** [@Specialist](https://discuss.elastic.co/u/Specialist)\ **Replies:** 2\ **Last updated:** [December 30, 2021, 4:19pm UTC](https://discuss.elastic.co/t/kibana-plugin-development-search-strategy-vs-custom-api-route/293152 "2021-12-30T16:19:44Z")
Hello, I am starting to develop a Kibana plugin, which is supposed to retrieve data from Elasticsearch and present it to the user in tabular form. I had a look at the "search\_examples" plugin, which exposes an aggregati… --- ## [Ability to change self passsword](https://discuss.elastic.co/t/ability-to-change-self-passsword/293086)
**Author:** [@Atul\_Chadha](https://discuss.elastic.co/u/Atul_Chadha)\ **Replies:** 4\ **Last updated:** [December 30, 2021, 3:51pm UTC](https://discuss.elastic.co/t/ability-to-change-self-passsword/293086 "2021-12-30T15:51:24Z")
I am setting up file based auth for the users using the below link , however it appears the user is not able to update the password by self. Am i missing anything ? --- ## [Enabling SSL Security between Elasticsearch & Kibana when both are on the same server](https://discuss.elastic.co/t/enabling-ssl-security-between-elasticsearch-kibana-when-both-are-on-the-same-server/293141)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 5\ **Last updated:** [December 30, 2021, 3:41pm UTC](https://discuss.elastic.co/t/enabling-ssl-security-between-elasticsearch-kibana-when-both-are-on-the-same-server/293141 "2021-12-30T15:41:49Z")
I am trying to enable security and SSL for my Elastic Stack so that I can't take advantage of the additional functionality and protection that this affords us (e.g. Endpoint Security, Fleet, Integration, etc.) Earlier i… --- ## [Mlcategory -1 in 7.12](https://discuss.elastic.co/t/mlcategory-1-in-7-12/293212)
**Author:** [@evan2424](https://discuss.elastic.co/u/evan2424)\ **Replies:** 1\ **Last updated:** [December 30, 2021, 3:36pm UTC](https://discuss.elastic.co/t/mlcategory-1-in-7-12/293212 "2021-12-30T15:36:32Z")
We are using Elastic Stack 7.12, and have set up some machine learning jobs. When we visit the Anomaly Explorer for one of these jobs, there is a mlcategory -1 that does not have any category examples. I have tried runni… --- ## [Problem with pipeline, grok and dashboards](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818)
**Author:** [@roonick](https://discuss.elastic.co/u/roonick)\ **Replies:** 7\ **Last updated:** [December 30, 2021, 3:04pm UTC](https://discuss.elastic.co/t/problem-with-pipeline-grok-and-dashboards/292818 "2021-12-30T15:04:53Z")
Good day! I had following task. There was necessary to add additional field of client ip address from nginx logs. I composed next pipeline: filebeat -\> logstash (beats pipeline, frok) -\> Elasticsearch. Grok pattern wo… --- ## [Completion suggester high memory usage](https://discuss.elastic.co/t/completion-suggester-high-memory-usage/293209)
**Author:** [@caseydm](https://discuss.elastic.co/u/caseydm)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 2:26pm UTC](https://discuss.elastic.co/t/completion-suggester-high-memory-usage/293209 "2021-12-30T14:26:51Z")
I am trying to add autocomplete to a field in Elasticsearch. The dataset is 260 million journal articles and I want to autocomplete based off of the title of the article. However, when I get to around 100 million indexed… --- ## [ECSEncoder - Add the possibility to process or transform the messages](https://discuss.elastic.co/t/ecsencoder-add-the-possibility-to-process-or-transform-the-messages/293204)
**Author:** [@fpena](https://discuss.elastic.co/u/fpena)\ **Replies:** 0\ **Last updated:** [December 30, 2021, 1:25pm UTC](https://discuss.elastic.co/t/ecsencoder-add-the-possibility-to-process-or-transform-the-messages/293204 "2021-12-30T13:25:33Z")
I need to be able to transform some messages. For example obfuscate some information. I want to be able to do that at the encoder level and not before on several components. Now a days, the encode method add the message… --- ## [Hi is there any difference between match\_phrase and match\_phrase\_prefix?](https://discuss.elastic.co/t/hi-is-there-any-difference-between-match-phrase-and-match-phrase-prefix/293009)
**Author:** [@cnwdoug23](https://discuss.elastic.co/u/cnwdoug23)\ **Replies:** 3\ **Last updated:** [December 30, 2021, 12:11pm UTC](https://discuss.elastic.co/t/hi-is-there-any-difference-between-match-phrase-and-match-phrase-prefix/293009 "2021-12-30T12:11:25Z")
HI is there a difference between using match\_phrase and match\_phrase\_prefix? When do we use one over the other? thanks in advance. [Previous page](https://discuss.elastic.co/latest.md?page=1325) [Next page](https://discuss.elastic.co/latest.md?page=1327)