# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1167 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1168 --- ## [SQL - having equivalent query strategy](https://discuss.elastic.co/t/sql-having-equivalent-query-strategy/288954)
**Author:** [@SaitejaParsi](https://discuss.elastic.co/u/SaitejaParsi)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 6:48am UTC](https://discuss.elastic.co/t/sql-having-equivalent-query-strategy/288954 "2021-11-11T06:48:09Z")
Hi, I have the following query to be converted to DSL and executed on ES. I could not find a suitable aggregation and filter over results of aggregation available out-of-the-box in ES. As an alternative, I am fetching th… --- ## [Don't import duplicates in nested objects](https://discuss.elastic.co/t/dont-import-duplicates-in-nested-objects/288952)
**Author:** [@Lazaro\_O\_Farrill](https://discuss.elastic.co/u/Lazaro_O_Farrill)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 6:27am UTC](https://discuss.elastic.co/t/dont-import-duplicates-in-nested-objects/288952 "2021-11-11T06:27:56Z")
Trying to index a SQL database for a eCommerce. It is divided by store where each store has it's own products. I'm trying to create a schema with the following structure. { name: "store1", products: \[{name: "pro… --- ## [7.15 for multi\_terms](https://discuss.elastic.co/t/7-15-for-multi-terms/288606)
**Author:** [@Alexzkh](https://discuss.elastic.co/u/Alexzkh)\ **Replies:** 2\ **Last updated:** [November 11, 2021, 6:04am UTC](https://discuss.elastic.co/t/7-15-for-multi-terms/288606 "2021-11-11T06:04:52Z")
i used elaticsearch for 7.9.3 ,when I need a method that i can group by multi fields in my aggregations . I find that multi\_terms can combine multi fields and help me complete my aggregation .So I upgrade my dependency w… --- ## [Potential parsing failure of zeek.smtp.date field through the zeek's filebeat smtp pipeline](https://discuss.elastic.co/t/potential-parsing-failure-of-zeek-smtp-date-field-through-the-zeeks-filebeat-smtp-pipeline/288948)
**Author:** [@eyng](https://discuss.elastic.co/u/eyng)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 5:51am UTC](https://discuss.elastic.co/t/potential-parsing-failure-of-zeek-smtp-date-field-through-the-zeeks-filebeat-smtp-pipeline/288948 "2021-11-11T05:51:00Z")
Hello, This appears to be a known issue similar to Filebeat Zeek and date parsing with SMTP broken, but the issue still persists in filebeat-7.15.1-x86\_64.rpm module. As the SMTP Date fields format can vary depending on… --- ## [Create and search nested document](https://discuss.elastic.co/t/create-and-search-nested-document/288946)
**Author:** [@Odunayo\_Ogundepo](https://discuss.elastic.co/u/Odunayo_Ogundepo)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 4:51am UTC](https://discuss.elastic.co/t/create-and-search-nested-document/288946 "2021-11-11T04:51:42Z")
Hi, I have a document that looks like this {"rid" : "1", "oid":"23, "data" :{ "ticks": \[{ "a": "xx", "b" : "yy" }, { "a": "xxx"… --- ## [Squarewave type line graph](https://discuss.elastic.co/t/squarewave-type-line-graph/288917)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [November 11, 2021, 3:59am UTC](https://discuss.elastic.co/t/squarewave-type-line-graph/288917 "2021-11-11T03:59:33Z")
Using Stack 7.13.4 I am plotting some binary data (e.g. oscillates between 0 and 1) and I want basically a square wave style graph. I cannot get the transitions from 0 to 1 or from 1 to 0 to show a vertical line. I jus… --- ## [How to export all data from filebeat with specific time range](https://discuss.elastic.co/t/how-to-export-all-data-from-filebeat-with-specific-time-range/288873)
**Author:** [@budums](https://discuss.elastic.co/u/budums)\ **Replies:** 2\ **Last updated:** [November 11, 2021, 2:48am UTC](https://discuss.elastic.co/t/how-to-export-all-data-from-filebeat-with-specific-time-range/288873 "2021-11-11T02:48:32Z")
hi there I already set Elasticsearch, kibana and logstash. and then I already set on client for filebeat to get mysql\_error.log & mysql\_slow.log Currently from filebeat already send to Elasticsearch and I can see usin… --- ## [Winlogbeat high cpu & log volume](https://discuss.elastic.co/t/winlogbeat-high-cpu-log-volume/288942)
**Author:** [@reconluke](https://discuss.elastic.co/u/reconluke)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 2:14am UTC](https://discuss.elastic.co/t/winlogbeat-high-cpu-log-volume/288942 "2021-11-11T02:14:23Z")
What is considered a "safe" number of daily logs from winlogbeat? What number of daily logs have you experienced issues from winlogbeat? I know these are hard to answer because there are many many variables, but I am c… --- ## [Need inverted nested mapping](https://discuss.elastic.co/t/need-inverted-nested-mapping/288936)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 11:40pm UTC](https://discuss.elastic.co/t/need-inverted-nested-mapping/288936 "2021-11-10T23:40:40Z")
How do I get search results that have the nested relationships inverted? Do I need to create another index with the nested relationships inverted? Or can I do this in another way with a different type of query and/or mod… --- ## [ILM for hot & warm nodes](https://discuss.elastic.co/t/ilm-for-hot-warm-nodes/288933)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:18pm UTC](https://discuss.elastic.co/t/ilm-for-hot-warm-nodes/288933 "2021-11-10T23:18:13Z")
From what I have read, it's best to setup indices base on time and let time determine which node to move the shards. For example: All shards within 1 month stay in hot and older than 1 month move the cold. Question: … --- ## [Date filtering from crash course part 2](https://discuss.elastic.co/t/date-filtering-from-crash-course-part-2/288934)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:03pm UTC](https://discuss.elastic.co/t/date-filtering-from-crash-course-part-2/288934 "2021-11-10T23:03:51Z")
In part 2 of the crash course Part-2-Understanding-the-relevance-of-your-search-with-Elasticsearch-and-Kibana-/README.md at main · LisaHJung/Part-2-Understanding-the-relevance-of-your-search-with-Elasticsearch-and-Kibana… --- ## [Logstash - MSSQL Events and alerts](https://discuss.elastic.co/t/logstash-mssql-events-and-alerts/288931)
**Author:** [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 10:33pm UTC](https://discuss.elastic.co/t/logstash-mssql-events-and-alerts/288931 "2021-11-10T22:33:39Z")
This is probably a basic question, but I cannot find a good example of where to start. I am currently ingesting MSSQL's ERRORLOG using Filebeat -\> LogStash -\> Elasticsearch. In Elasticsearch, I would like to set an ale… --- ## [Customize lens colors in kibana](https://discuss.elastic.co/t/customize-lens-colors-in-kibana/288901)
**Author:** [@mohamed.softparadigm](https://discuss.elastic.co/u/mohamed.softparadigm)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 9:50pm UTC](https://discuss.elastic.co/t/customize-lens-colors-in-kibana/288901 "2021-11-10T21:50:20Z")
By using filters in kibana, i cannot change lens colors, does kibana support this option? --- ## [Field type conflict where indices with conflicting type do not exist](https://discuss.elastic.co/t/field-type-conflict-where-indices-with-conflicting-type-do-not-exist/288788)
**Author:** [@adamsm](https://discuss.elastic.co/u/adamsm)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 9:34pm UTC](https://discuss.elastic.co/t/field-type-conflict-where-indices-with-conflicting-type-do-not-exist/288788 "2021-11-10T21:34:38Z")
Hi We run Kibana on AWS. We are seeing Field type conflict on a few fields, see an example image below: However we have a stack management policy which has already deleted the conflicting indices in question (those … --- ## [Warning After Upgrading to 7.15.2](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927)
**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 9:26pm UTC](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927 "2021-11-10T21:26:33Z")
After upgrading a test cluster to 7.15.2 I see this warning when running Kibana queries in Discover constantly: 299 Elasticsearch-7.15.2-93d5a7f6192e8a1a12e154a2b81bf6fa7309da0c "Camel case format name dateOptionalTime … --- ## [CorruptIndexException: checksum status indeterminate](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 14\ **Last updated:** [November 10, 2021, 9:11pm UTC](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827 "2021-11-10T21:11:47Z")
Hi We recently had an outage on our openshift clusters. In our Test environment the pods came back up with warnings. The log file shows the following Suppressed: org.apache.lucene.index.CorruptIndexException: checksu… --- ## [How to make optimize snapshot's indices/ directory](https://discuss.elastic.co/t/how-to-make-optimize-snapshots-indices-directory/288776)
**Author:** [@alicango](https://discuss.elastic.co/u/alicango)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 8:41pm UTC](https://discuss.elastic.co/t/how-to-make-optimize-snapshots-indices-directory/288776 "2021-11-10T20:41:14Z")
Hi, We have a cluster that has a number of 3 Masters, 2 Hot, 2 Warm, and 2 Cold nodes. We have a path setting in the Elasticsearch config file like this; \[root@cold-2 ~\]# grep path /etc/elasticsearch/elasticsearch.yml… --- ## [Possible for users to specify logical operators (OR. AND) in a field applied to a query?](https://discuss.elastic.co/t/possible-for-users-to-specify-logical-operators-or-and-in-a-field-applied-to-a-query/288926)
**Author:** [@JP\_B](https://discuss.elastic.co/u/JP_B)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 8:14pm UTC](https://discuss.elastic.co/t/possible-for-users-to-specify-logical-operators-or-and-in-a-field-applied-to-a-query/288926 "2021-11-10T20:14:25Z")
I’m building an app to search scientific documents. The abstract from such articles is indexed as a text field. A web front end has input text field to specify keywords which are used in a match query with standard analy… --- ## [How to exclude a specific field in multi get query globally for all docs?](https://discuss.elastic.co/t/how-to-exclude-a-specific-field-in-multi-get-query-globally-for-all-docs/288919)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 8:05pm UTC](https://discuss.elastic.co/t/how-to-exclude-a-specific-field-in-multi-get-query-globally-for-all-docs/288919 "2021-11-10T20:05:03Z")
Hi, I'm trying to exclude a specific field in a multi-get query, but not by specifying \_source ou \_source\_excludes in each doc but globally for all docs, how is it possible? Thank u in advance for your help :wink: --- ## [Setup one ILM merge task at a time](https://discuss.elastic.co/t/setup-one-ilm-merge-task-at-a-time/288715)
**Author:** [@alfianaf](https://discuss.elastic.co/u/alfianaf)\ **Replies:** 6\ **Last updated:** [November 10, 2021, 8:03pm UTC](https://discuss.elastic.co/t/setup-one-ilm-merge-task-at-a-time/288715 "2021-11-10T20:03:35Z")
Hello, I've been setting up ILM to merge and compress indices, but when I checked on stats API GET \_stats?pretty the result is two merge tasks run concurrently "merges" : { "current" : 2, "curre… --- ## [Winlogbeat to Logstash Load Balancing and Failover](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 7:41pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902 "2021-11-10T19:41:34Z")
I have two logstash servers. Do I have to choose between load balancing between them all the time vs using one as a fail over? For instance, if I am load balancing winlogbeat output and one of the logstash servers goes … --- ## ['exists' query not working for nested docs with norms=false](https://discuss.elastic.co/t/exists-query-not-working-for-nested-docs-with-norms-false/288256)
**Author:** [@matobaa](https://discuss.elastic.co/u/matobaa)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 7:24pm UTC](https://discuss.elastic.co/t/exists-query-not-working-for-nested-docs-with-norms-false/288256 "2021-11-10T19:24:15Z")
For fields within nested docs with norms disabled, querying for their existence via 'exists' query appears to not be working. It does however work when norms is enabled. curl -XPUT localhost:9200/test -d '{ { "mapping… --- ## [Will Elasticsearch 7.10 allow me to remain under Apache 2.0 license?](https://discuss.elastic.co/t/will-elasticsearch-7-10-allow-me-to-remain-under-apache-2-0-license/288898)
**Author:** [@truth\_is](https://discuss.elastic.co/u/truth_is)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 7:13pm UTC](https://discuss.elastic.co/t/will-elasticsearch-7-10-allow-me-to-remain-under-apache-2-0-license/288898 "2021-11-10T19:13:47Z")
My Firm has built client products using \< Elasticsearch 5.0 version. We are planning for an upgrade. If I upgrade Elasticsearch to 7.10 version, will I remain under Apache 2.0 license? Thank you --- ## [Creating runtime fields in Canvas](https://discuss.elastic.co/t/creating-runtime-fields-in-canvas/288817)
**Author:** [@mbhakta](https://discuss.elastic.co/u/mbhakta)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 7:07pm UTC](https://discuss.elastic.co/t/creating-runtime-fields-in-canvas/288817 "2021-11-10T19:07:47Z")
Hello! I'm new to Canvas and Elasticsearch SQL, and I was wondering if it's possible to create and access runtime fields through queries in Canvas, similar to how you can do so using Elasticsearch DSL? --- ## [Attempting to Install template](https://discuss.elastic.co/t/attempting-to-install-template/288899)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 6:58pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899 "2021-11-10T18:58:54Z")
Good Morning Logstash experts. As most of you know I have been working on injesting and being able to see the syslogs that are being sent directly to my logstash server. When I run a debug on my logstash I see the foll… --- ## [Logstash-keystore.bat not using bundled JDK (Windows)](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 6:05pm UTC](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719 "2021-11-10T18:05:44Z")
I was trying to setup a keystore and when running .\\logstash-keystore.bat I get a message saying "Using bundled JDK: "" then it says, No 'java.exe' executable found on PATH. I'm running version 7.15.1. The crazy thing is… --- ## [Logstash Filtering logs](https://discuss.elastic.co/t/logstash-filtering-logs/288521)
**Author:** [@John\_snow](https://discuss.elastic.co/u/John_snow)\ **Replies:** 5\ **Last updated:** [November 10, 2021, 5:46pm UTC](https://discuss.elastic.co/t/logstash-filtering-logs/288521 "2021-11-10T17:46:31Z")
I want to filter logs on base of account\_id and send to different output in logstash. Log1: {'account\_id': '1234567890', 'other data': "Some\_data"} Log2: {'account\_id': '0987654321', 'other data': "Some\_data"} i want … --- ## [Date (Snapshot) - Month name in English for snapshot policy](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 5:40pm UTC](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885 "2021-11-10T17:40:52Z")
Hi, I want Elasticsearch snapshots named with date in english and date in numerals when they are created. With the following template snapshot\_MMYYYY\_foo Something like this: snapshot\_nov2021\_foo How this can be done… --- ## [Elasticsearch Query discard documents where sum of field is x](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916 "2021-11-10T17:23:56Z")
Hello, I have documents that look like the following: "\_index": "test", "\_type": "\_doc", "\_id": "p767Cn0BpA6tOYGm9B\_P", "\_version": 1, "\_score": null, "\_source": { "path": "entry\_1", "elap\_t": 89, … --- ## [Canvas switch case not working after first case](https://discuss.elastic.co/t/canvas-switch-case-not-working-after-first-case/288627)
**Author:** [@MTV](https://discuss.elastic.co/u/MTV)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 5:03pm UTC](https://discuss.elastic.co/t/canvas-switch-case-not-working-after-first-case/288627 "2021-11-10T17:03:42Z")
Hi, I am trying to use switch cases in canvas kibana (7.14) but it's not working. I tried to use the demo data with the following code: demodata | mapColumn "project\_map" fn=${getCell "project" | switch {c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1166) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1168)