# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1241 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1242 --- ## [How to display count of all attributes in Kibana visualization](https://discuss.elastic.co/t/how-to-display-count-of-all-attributes-in-kibana-visualization/283233)
**Author:** [@Sam\_Chats](https://discuss.elastic.co/u/Sam_Chats)\ **Replies:** 6\ **Last updated:** [September 13, 2021, 10:54pm UTC](https://discuss.elastic.co/t/how-to-display-count-of-all-attributes-in-kibana-visualization/283233 "2021-09-13T22:54:18Z")
My data has about 50 different attributes. I have created a dashboard in Kibana to display value distributions of some of these attributes based on the date filter at the top. I want to create one more visualization to s… --- ## [How to match lines in unstructured log starting with specific string](https://discuss.elastic.co/t/how-to-match-lines-in-unstructured-log-starting-with-specific-string/284112)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 7:18pm UTC](https://discuss.elastic.co/t/how-to-match-lines-in-unstructured-log-starting-with-specific-string/284112 "2021-09-13T19:18:35Z")
I have a very big unstructured file. Firstly, I want to parse all lines that starts with ABC or CDE and store them as one document in Elasticsearch. One file should be one document in index, so @message should look like … --- ## [Aggregating transaction data for payments](https://discuss.elastic.co/t/aggregating-transaction-data-for-payments/283713)
**Author:** [@Fenix](https://discuss.elastic.co/u/Fenix)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 8:19pm UTC](https://discuss.elastic.co/t/aggregating-transaction-data-for-payments/283713 "2021-09-13T20:19:13Z")
I want to know how many payments in my environment are of a given status, at a given time broken down by direction, and protocol. In our case, a payment is a collection of transactions (docs) with the same paymentId. Th… --- ## [Failed to publish events: temporary bulk send failure](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/283809)
**Author:** [@plaroche0](https://discuss.elastic.co/u/plaroche0)\ **Replies:** 5\ **Last updated:** [September 13, 2021, 7:55pm UTC](https://discuss.elastic.co/t/failed-to-publish-events-temporary-bulk-send-failure/283809 "2021-09-13T19:55:37Z")
I have filebeat installed on a Syncplify server. It will send a couple of logs to ES and then nothing else. The service says it is still running. If I restart the service I get a couple more logs and then nothing unless … --- ## [Ingest pipeline, "remove" nested fields](https://discuss.elastic.co/t/ingest-pipeline-remove-nested-fields/283989)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 7:50pm UTC](https://discuss.elastic.co/t/ingest-pipeline-remove-nested-fields/283989 "2021-09-13T19:50:54Z")
Version 7.14 I am attempting to filter a winlogbeats stream in an ingest pipeline. One thing I want to do is strip out the whole agent tree as this is repeated in every record. Is there a way to remove "agent.\*" in one… --- ## [Unable to select keyword field for term aggregation](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914)
**Author:** [@adam3](https://discuss.elastic.co/u/adam3)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 5:55pm UTC](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914 "2021-09-13T17:55:45Z")
Hey using 7.10.2 and I'm trying to make some visualizations. There are some fields that I can't select for term aggregations in charts etc. Not sure what I'm doing wrong. But I've tried all sorts of mapping templ… --- ## [I recieve error on test environment but it works fine from my local machine](https://discuss.elastic.co/t/i-recieve-error-on-test-environment-but-it-works-fine-from-my-local-machine/283883)
**Author:** [@Ayat\_Elshazly](https://discuss.elastic.co/u/Ayat_Elshazly)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 5:52pm UTC](https://discuss.elastic.co/t/i-recieve-error-on-test-environment-but-it-works-fine-from-my-local-machine/283883 "2021-09-13T17:52:36Z")
Hi , I am implementing Web job hosted on Azure , this web job migrate data from Sql to Elastic My Elatic URL is = "https://vpc-dev-platform-elasticsearch-bag4d33ftqb3srzritdymf4d5m.eu-west-1.es.amazonaws.com" and by t… --- ## [Slower query\_string query in elasticsearch 7.5 as compared to elasticsearch 2.4](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 8\ **Last updated:** [September 13, 2021, 5:12pm UTC](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222 "2021-09-13T17:12:29Z")
We have recently started migrating from elasticsearch 2.4.1 to elasticsearch 7.5.2 but have faced a major roadblock because of query performance. A query string query that used to respond in around 800ms when queried in … --- ## [Wildcard phrase search using query\_string](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:55pm UTC](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108 "2021-09-13T16:55:58Z")
I use query\_string to generate phrase queries with a proximity, on Elasticsearch 7.9.3 Does query\_string work with wildcard? I found some old similar questions, there wasn't the way to do it. Here is my query: … --- ## [Heavy Bulk inserts -Read & Write performance](https://discuss.elastic.co/t/heavy-bulk-inserts-read-write-performance/284107)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:42pm UTC](https://discuss.elastic.co/t/heavy-bulk-inserts-read-write-performance/284107 "2021-09-13T16:42:19Z")
Hi, Im using ES 7.14.0 with 16 data hot nodes and 2 warm nodes. When I'm doing heavy inserts, there is high thread pool write active count, and sometimes I get NONodeLeftException I'm using ES-Hadoop Library with spark… --- ## [Exec command Linux and extract specific field](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 2\ **Last updated:** [September 6, 2021, 2:13pm UTC](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254 "2021-09-06T14:13:17Z")
Hi Community, i'm executing several linux commands in Logstash. and i want to extract specific fields to build some graphs in Kibana. for Example this is the result of an executed command \[2021-02-13 19:28:49.200\] chan… --- ## [How to match by different prefixes](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104)
**Author:** [@mydeadvictoria](https://discuss.elastic.co/u/mydeadvictoria)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:01pm UTC](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104 "2021-09-13T16:01:14Z")
Will try to explain what I mean by saying "different prefixes". I have a text field "Name", and I want to check (while searching) whether this field starts with some particular prefix with length varying from 3 to 5. Le… --- ## [Forcing elasticsearch cluster to run on single node in the event of failure](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:58pm UTC](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658 "2021-09-13T15:58:33Z")
Hi folks, Currently we are in the process of setting up 3 node elasticsearch cluster on v7.11.2 (self-managed) using below setup : All 3 nodes will be data nodes and master eligible. We will set "index.number\_of\_repl… --- ## [Filebeat kubernetes provider mixed logs another containers from same pod](https://discuss.elastic.co/t/filebeat-kubernetes-provider-mixed-logs-another-containers-from-same-pod/283784)
**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-provider-mixed-logs-another-containers-from-same-pod/283784 "2021-09-13T15:55:45Z")
Hi guys. May be anyone can check that? Im using daemonset of filebeat 7.14.1 in openshift cluster with config filebeat.autodiscover: providers: - type: kubernetes include\_pod\_uid: true … --- ## [Kibana: Divide column data with time range](https://discuss.elastic.co/t/kibana-divide-column-data-with-time-range/284075)
**Author:** [@Vishal\_Patil](https://discuss.elastic.co/u/Vishal_Patil)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:52pm UTC](https://discuss.elastic.co/t/kibana-divide-column-data-with-time-range/284075 "2021-09-13T15:52:19Z")
I have a data table in Kibana with one of the columns representing a metric in terms of hours . I would like to create a new column whose values equal to the hour values divided by the number of hours selected in the tim… --- ## [Elastic pipeline compare two fields condition](https://discuss.elastic.co/t/elastic-pipeline-compare-two-fields-condition/283620)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 3:26pm UTC](https://discuss.elastic.co/t/elastic-pipeline-compare-two-fields-condition/283620 "2021-09-13T15:26:01Z")
Im trying to create a set condition if two fields are the same, ive not been able to find how to do this with the elastic pipeline ctx.dns.question.name =='{{{ctx.host.hostname}}}' --- ## [Is a moving average line possible in Canvas](https://discuss.elastic.co/t/is-a-moving-average-line-possible-in-canvas/284057)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/is-a-moving-average-line-possible-in-canvas/284057 "2021-09-13T15:13:49Z")
Hi, I am currently experimenting with a line graph within Canvas and was wondering if it was possible to get a moving average/trend line on a line graph using the canvas charts. E.g. If i had a chart that looked lik… --- ## [Where is the callback function executed for searchAsync method](https://discuss.elastic.co/t/where-is-the-callback-function-executed-for-searchasync-method/283674)
**Author:** [@fatcloud](https://discuss.elastic.co/u/fatcloud)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 3:07pm UTC](https://discuss.elastic.co/t/where-is-the-callback-function-executed-for-searchasync-method/283674 "2021-09-13T15:07:41Z")
Hi, I'm wondering where the callback function is executed when using searchAsync: Search API | Java REST Client \[7.14\] | Elastic Is there some thread pool for the es client? --- ## [Elasticsearch not parsing cloudtrail index](https://discuss.elastic.co/t/elasticsearch-not-parsing-cloudtrail-index/283913)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:07pm UTC](https://discuss.elastic.co/t/elasticsearch-not-parsing-cloudtrail-index/283913 "2021-09-13T15:07:36Z")
I'm running into an issue parsing cloudtrail logs from filebeat. I am getting this error from the the ecs logs. WARN \[elasticsearch\] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Time… --- ## [Does ES join support composite key?](https://discuss.elastic.co/t/does-es-join-support-composite-key/283806)
**Author:** [@manjurgani](https://discuss.elastic.co/u/manjurgani)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:57pm UTC](https://discuss.elastic.co/t/does-es-join-support-composite-key/283806 "2021-09-13T14:57:44Z")
\--my parent document looks like below PUT example3/\_doc/9 { "userId":9999 "accountId":101, } -- PUT example3/\_doc/10 { "userId":9999 "accountId":102, } ---my child look like below PUT example3/\_doc/11 { "a… --- ## [Vega Bar Chart](https://discuss.elastic.co/t/vega-bar-chart/283578)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/vega-bar-chart/283578 "2021-09-13T14:56:29Z")
Hi, I'm actually working on a new VEGA chart and I can't seem to make it work. I'm trying to create something like this Bar Grouped 1 or like this Bar Grouped 2. I wanna display two columns for one X value. The first… --- ## [Bad order with scripted sort and nested filter](https://discuss.elastic.co/t/bad-order-with-scripted-sort-and-nested-filter/283820)
**Author:** [@vovervova](https://discuss.elastic.co/u/vovervova)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:51pm UTC](https://discuss.elastic.co/t/bad-order-with-scripted-sort-and-nested-filter/283820 "2021-09-13T14:51:28Z")
Hello, I have problems. When I am using nested filter in my query sorting order breaks (without nested filters works perfect ) { "query": { "nested": { "path": "status", "query": { "bool": { … --- ## [Can I query a non-indexed field using a runtime field?](https://discuss.elastic.co/t/can-i-query-a-non-indexed-field-using-a-runtime-field/283786)
**Author:** [@shipful](https://discuss.elastic.co/u/shipful)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:49pm UTC](https://discuss.elastic.co/t/can-i-query-a-non-indexed-field-using-a-runtime-field/283786 "2021-09-13T14:49:11Z")
If I create a mapping that doesn't index any fields: PUT test-index/ { "mappings": { "dynamic": false } } and then add a document POST test-index/\_doc { "a": "a", "b": "b", "c": "c" } Can I then use a dy… --- ## [How to aggregate frequency count of words which exist in a field](https://discuss.elastic.co/t/how-to-aggregate-frequency-count-of-words-which-exist-in-a-field/283931)
**Author:** [@Pooya\_Pilechi](https://discuss.elastic.co/u/Pooya_Pilechi)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:45pm UTC](https://discuss.elastic.co/t/how-to-aggregate-frequency-count-of-words-which-exist-in-a-field/283931 "2021-09-13T14:45:20Z")
Hi. I want to evaluate frequency of terms which exist in a hashtags field of a twitter data. for example i have an index which its name is twitter . in twitter index i have a field which its name is hashtags. for ins… --- ## [Search After Pagination with sort field in Query](https://discuss.elastic.co/t/search-after-pagination-with-sort-field-in-query/283952)
**Author:** [@rahulpatwari](https://discuss.elastic.co/u/rahulpatwari)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:40pm UTC](https://discuss.elastic.co/t/search-after-pagination-with-sort-field-in-query/283952 "2021-09-13T14:40:42Z")
Hi, I am using search after pagination logic for deep pagination. The search query extracts documents with a specific DateTime range. { "range": { "my\_date\_t… --- ## [PostgreSQL: infinite DECLARE CURSOR when rebuilding one Elasticsearch index](https://discuss.elastic.co/t/postgresql-infinite-declare-cursor-when-rebuilding-one-elasticsearch-index/283971)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 2:27pm UTC](https://discuss.elastic.co/t/postgresql-infinite-declare-cursor-when-rebuilding-one-elasticsearch-index/283971 "2021-09-13T14:27:26Z")
I have a number of Elasticsearch indices for millions of objects. The problem arises only with one of them that contains around 5 million objects. When I am trying to rebuild the Elasticsearch index (I am using django-e… --- ## [Elasticsearch Query on Array object with must clause is giving empty results](https://discuss.elastic.co/t/elasticsearch-query-on-array-object-with-must-clause-is-giving-empty-results/284066)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:23pm UTC](https://discuss.elastic.co/t/elasticsearch-query-on-array-object-with-must-clause-is-giving-empty-results/284066 "2021-09-13T14:23:12Z")
Hi There, I'm always getting empty results when i query the array objects with multi must clause as mentioned below Index docs: POST test/doc/1 { "name":\["Alex","Bob","Matt"\], "company":"ABC", "city":"NY" } P… --- ## [When using logstash output sends only limited information. Any other output, no problem](https://discuss.elastic.co/t/when-using-logstash-output-sends-only-limited-information-any-other-output-no-problem/283692)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 10\ **Last updated:** [September 13, 2021, 2:17pm UTC](https://discuss.elastic.co/t/when-using-logstash-output-sends-only-limited-information-any-other-output-no-problem/283692 "2021-09-13T14:17:12Z")
If I use auditbeat (I guess is the same with other beats) and configure elasticsearch or file output I see all information I need. In this example I modify /etc/sudoers' attributes, then I modify it, and then I modify i… --- ## [How to fix one field in elasticsearch by using document\_id?](https://discuss.elastic.co/t/how-to-fix-one-field-in-elasticsearch-by-using-document-id/283538)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 2:12pm UTC](https://discuss.elastic.co/t/how-to-fix-one-field-in-elasticsearch-by-using-document-id/283538 "2021-09-13T14:12:17Z")
I am getting multiple messages in different queues and I am also using document\_id to avoid duplicates values. But the problem with docuemnt\_id is, it is overwriting the existing data with a new one But I want to fix one… --- ## [Watcher Field Value Based Alerts](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871)
**Author:** [@Zunera\_Nayyar](https://discuss.elastic.co/u/Zunera_Nayyar)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:09pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871 "2021-09-13T14:09:54Z")
Hi, I have an app which returns different statuscodes based on URL being hit. I want to generate make a watcher alert based on the values in the same field with different outputs. I do not want the collective count/agg… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1240) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1242)