# Metricbeat query in Kibana **URL:** \ **Category:** Elasticsearch\ **Created:** [April 16, 2021, 2:40pm UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398 "2021-04-16T14:40:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rckvanwijk](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Post date:** [April 16, 2021, 2:40pm UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/1 "2021-04-16T14:40:47Z")
Hi there, I'm creating customer portals within the Kibana interface, this is working nicely. The purpose of this is, is that the customer can check the up-time of their own application without consulting us. Now i can configure it in such a way that they can only see their own application but i cannot figure out how to write the query in such a way so that they can see more applications. This is all done/written in the roles feature within Kibana. The query i'm using is as follows: {"wildcard": {monitor.name: "test1.test.nl" }. This is doing what i'm trying to but i cannot seem to figure out how to write this if i want to add test2 for example. Any clue? Thanks and have a nice weekend! Rick ---
**Author:** ![Jason\_Slater](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_slater/32/63484_2.png) [@Jason\_Slater](https://discuss.elastic.co/u/Jason_Slater)\ **Post date:** [April 17, 2021, 7:30am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/2 "2021-04-17T07:30:12Z")
see this page in the docs: [Wildcard query | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.html) To match test1.test.nl and test2.test.nl, you could try something like this as the query for this role: ``` { "query": { "wildcard": { "monitor.name": { "value": "test*.test.nl" } } } } ``` ---
**Author:** ![rckvanwijk](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Post date:** [April 19, 2021, 7:41am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/3 "2021-04-19T07:41:04Z")
Hi Jason, that is indeed a fine solution which i've used before! But i'm trying to figure out a way on how i can reach this when the names are completely different. Like for say the following example: Application 1: [test.test.com](http://test.test.com) Application 2: [bla.bla.com](http://bla.bla.com) Kind regards. ---
**Author:** ![Jason\_Slater](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_slater/32/63484_2.png) [@Jason\_Slater](https://discuss.elastic.co/u/Jason_Slater)\ **Post date:** [April 19, 2021, 7:55am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/4 "2021-04-19T07:55:23Z")
Making sure I understand your use case. Please correct me if I misunderstood 😉 - Customer 1 wants to monitor [a.com](http://a.com), [b.com](http://b.com), ... - Customer 2 wants to monitor [c.com](http://c.com), [d.com](http://d.com), ... - Each customer should only have access to metrics for the domains they are monitoring Where do you maintain the list of the domains each customer is monitoring? If it's static, you could add tags to the data in metricbeat.yml If it's in a DB, can you send the data from metricbeat =\> logstash and do a lookup on your DB table to add a tag for which customer it's for, and then for security in Kibana, each customer gets access to records with that tag ---
**Author:** ![rckvanwijk](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rckvanwijk](https://discuss.elastic.co/u/rckvanwijk)\ **Post date:** [April 19, 2021, 9:56am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/5 "2021-04-19T09:56:32Z")
Hi Jason, 1 Customer can have completely different URL's (and domain names), that's why i'm trying to create a query which can show both of these urls. Is this even possible? The tags is a good idea, how could i query on the tags? ---
**Author:** ![Jason\_Slater](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jason_slater/32/63484_2.png) [@Jason\_Slater](https://discuss.elastic.co/u/Jason_Slater)\ **Post date:** [April 20, 2021, 2:15am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/6 "2021-04-20T02:15:21Z")
The configuration for any of the beats have a section which looks like this: ``` # The tags of the monitors are included in their own field with each # transaction published. Tags make it easy to group servers by different # logical properties. #tags: ["service-X", "web-tier"] ``` you can uncomment the tags line and add the customer's name/id/etc as a tag then the tag could be applied as a filter for the role in Kibana I don't know how many customers you are tracking URL's for, so in case its a big number, I also offered the idea of sending the events from the beat to logstash, and in logstash you could do a lookup on the URL from a DB table which contains a URLs and which tag to add. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2021, 2:15am UTC](https://discuss.elastic.co/t/metricbeat-query-in-kibana/270398/7 "2021-05-18T02:15:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.