# Latest **URL:** https://discuss.elastic.co/latest.md?page=1480 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1481 --- ## [Ingest pipeline, "remove" nested fields](https://discuss.elastic.co/t/ingest-pipeline-remove-nested-fields/283989)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 7:50pm UTC](https://discuss.elastic.co/t/ingest-pipeline-remove-nested-fields/283989 "2021-09-13T19:50:54Z")
Version 7.14 I am attempting to filter a winlogbeats stream in an ingest pipeline. One thing I want to do is strip out the whole agent tree as this is repeated in every record. Is there a way to remove "agent.\*" in one… --- ## [Unable to select keyword field for term aggregation](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914)
**Author:** [@adam3](https://discuss.elastic.co/u/adam3)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 5:55pm UTC](https://discuss.elastic.co/t/unable-to-select-keyword-field-for-term-aggregation/283914 "2021-09-13T17:55:45Z")
Hey using 7.10.2 and I'm trying to make some visualizations. There are some fields that I can't select for term aggregations in charts etc. Not sure what I'm doing wrong. But I've tried all sorts of mapping templ… --- ## [I recieve error on test environment but it works fine from my local machine](https://discuss.elastic.co/t/i-recieve-error-on-test-environment-but-it-works-fine-from-my-local-machine/283883)
**Author:** [@Ayat\_Elshazly](https://discuss.elastic.co/u/Ayat_Elshazly)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 5:52pm UTC](https://discuss.elastic.co/t/i-recieve-error-on-test-environment-but-it-works-fine-from-my-local-machine/283883 "2021-09-13T17:52:36Z")
Hi , I am implementing Web job hosted on Azure , this web job migrate data from Sql to Elastic My Elatic URL is = "https://vpc-dev-platform-elasticsearch-bag4d33ftqb3srzritdymf4d5m.eu-west-1.es.amazonaws.com" and by t… --- ## [Slower query\_string query in elasticsearch 7.5 as compared to elasticsearch 2.4](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 8\ **Last updated:** [September 13, 2021, 5:12pm UTC](https://discuss.elastic.co/t/slower-query-string-query-in-elasticsearch-7-5-as-compared-to-elasticsearch-2-4/282222 "2021-09-13T17:12:29Z")
We have recently started migrating from elasticsearch 2.4.1 to elasticsearch 7.5.2 but have faced a major roadblock because of query performance. A query string query that used to respond in around 800ms when queried in … --- ## [How to correlate container logs with APM in django?](https://discuss.elastic.co/t/how-to-correlate-container-logs-with-apm-in-django/283157)
**Author:** [@maar](https://discuss.elastic.co/u/maar)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 5:07pm UTC](https://discuss.elastic.co/t/how-to-correlate-container-logs-with-apm-in-django/283157 "2021-09-13T17:07:22Z")
Kibana version: 7.14.0 Elasticsearch version: 7.14.0 APM Server version: 7.14.0 Filebeat version: 7.14.0 APM Agent language and version: Python Django - elastic-apm 6.3.3 Description: The APM server and Python… --- ## [Wildcard phrase search using query\_string](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108)
**Author:** [@Wonder\_Garance](https://discuss.elastic.co/u/Wonder_Garance)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:55pm UTC](https://discuss.elastic.co/t/wildcard-phrase-search-using-query-string/284108 "2021-09-13T16:55:58Z")
I use query\_string to generate phrase queries with a proximity, on Elasticsearch 7.9.3 Does query\_string work with wildcard? I found some old similar questions, there wasn't the way to do it. Here is my query: … --- ## [Heavy Bulk inserts -Read & Write performance](https://discuss.elastic.co/t/heavy-bulk-inserts-read-write-performance/284107)
**Author:** [@Vishnu\_Singhal](https://discuss.elastic.co/u/Vishnu_Singhal)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:42pm UTC](https://discuss.elastic.co/t/heavy-bulk-inserts-read-write-performance/284107 "2021-09-13T16:42:19Z")
Hi, Im using ES 7.14.0 with 16 data hot nodes and 2 warm nodes. When I'm doing heavy inserts, there is high thread pool write active count, and sometimes I get NONodeLeftException I'm using ES-Hadoop Library with spark… --- ## [Looking for a list of "Out of the Box" Use Cases for Elastic SIEM](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 4:34pm UTC](https://discuss.elastic.co/t/looking-for-a-list-of-out-of-the-box-use-cases-for-elastic-siem/284101 "2021-09-13T16:34:18Z")
I am working on a secure project that is utilizing ELK SIEM and we are looking for Use Cases that we can direct the client towards for answering what the Elastic SIEM can do for them. Is there a link or area that I can … --- ## [Exec command Linux and extract specific field](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254)
**Author:** [@Mira\_9](https://discuss.elastic.co/u/Mira_9)\ **Replies:** 2\ **Last updated:** [September 6, 2021, 2:13pm UTC](https://discuss.elastic.co/t/exec-command-linux-and-extract-specific-field/283254 "2021-09-06T14:13:17Z")
Hi Community, i'm executing several linux commands in Logstash. and i want to extract specific fields to build some graphs in Kibana. for Example this is the result of an executed command \[2021-02-13 19:28:49.200\] chan… --- ## [How to match by different prefixes](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104)
**Author:** [@mydeadvictoria](https://discuss.elastic.co/u/mydeadvictoria)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 4:01pm UTC](https://discuss.elastic.co/t/how-to-match-by-different-prefixes/284104 "2021-09-13T16:01:14Z")
Will try to explain what I mean by saying "different prefixes". I have a text field "Name", and I want to check (while searching) whether this field starts with some particular prefix with length varying from 3 to 5. Le… --- ## [如何给按条件分组的查询设置默认值](https://discuss.elastic.co/t/topic/284102)
**Author:** [@xxm404](https://discuss.elastic.co/u/xxm404)\ **Replies:** 0\ **Last updated:** [September 13, 2021, 3:59pm UTC](https://discuss.elastic.co/t/topic/284102 "2021-09-13T15:59:19Z")
我想使用 ELK 分析 Nginx 日志，统计每个接口的 Apdex 积分，所以我需要计算不同耗时区间内的请求数，但我发现某些接口在特定耗时区间请求数为 0，在 es 的查询结果中会显示为没有结果，这导致我无法进行后续的计算，请问我该如何解决这个问题，或者说有没有其他方法来计算接口的 Apdex 积分 我的查询大致如下： // 请求总数 logname:"access\_log" AND fields.tagname:"service… --- ## [Forcing elasticsearch cluster to run on single node in the event of failure](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658)
**Author:** [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:58pm UTC](https://discuss.elastic.co/t/forcing-elasticsearch-cluster-to-run-on-single-node-in-the-event-of-failure/283658 "2021-09-13T15:58:33Z")
Hi folks, Currently we are in the process of setting up 3 node elasticsearch cluster on v7.11.2 (self-managed) using below setup : All 3 nodes will be data nodes and master eligible. We will set "index.number\_of\_repl… --- ## [Filebeat kubernetes provider mixed logs another containers from same pod](https://discuss.elastic.co/t/filebeat-kubernetes-provider-mixed-logs-another-containers-from-same-pod/283784)
**Author:** [@froheik](https://discuss.elastic.co/u/froheik)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 3:55pm UTC](https://discuss.elastic.co/t/filebeat-kubernetes-provider-mixed-logs-another-containers-from-same-pod/283784 "2021-09-13T15:55:45Z")
Hi guys. May be anyone can check that? Im using daemonset of filebeat 7.14.1 in openshift cluster with config filebeat.autodiscover: providers: - type: kubernetes include\_pod\_uid: true … --- ## [Kibana: Divide column data with time range](https://discuss.elastic.co/t/kibana-divide-column-data-with-time-range/284075)
**Author:** [@Vishal\_Patil](https://discuss.elastic.co/u/Vishal_Patil)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:52pm UTC](https://discuss.elastic.co/t/kibana-divide-column-data-with-time-range/284075 "2021-09-13T15:52:19Z")
I have a data table in Kibana with one of the columns representing a metric in terms of hours . I would like to create a new column whose values equal to the hour values divided by the number of hours selected in the tim… --- ## [Elastic pipeline compare two fields condition](https://discuss.elastic.co/t/elastic-pipeline-compare-two-fields-condition/283620)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 3:26pm UTC](https://discuss.elastic.co/t/elastic-pipeline-compare-two-fields-condition/283620 "2021-09-13T15:26:01Z")
Im trying to create a set condition if two fields are the same, ive not been able to find how to do this with the elastic pipeline ctx.dns.question.name =='{{{ctx.host.hostname}}}' --- ## [Is a moving average line possible in Canvas](https://discuss.elastic.co/t/is-a-moving-average-line-possible-in-canvas/284057)
**Author:** [@hNiven](https://discuss.elastic.co/u/hNiven)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 3:13pm UTC](https://discuss.elastic.co/t/is-a-moving-average-line-possible-in-canvas/284057 "2021-09-13T15:13:49Z")
Hi, I am currently experimenting with a line graph within Canvas and was wondering if it was possible to get a moving average/trend line on a line graph using the canvas charts. E.g. If i had a chart that looked lik… --- ## [Where is the callback function executed for searchAsync method](https://discuss.elastic.co/t/where-is-the-callback-function-executed-for-searchasync-method/283674)
**Author:** [@fatcloud](https://discuss.elastic.co/u/fatcloud)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 3:07pm UTC](https://discuss.elastic.co/t/where-is-the-callback-function-executed-for-searchasync-method/283674 "2021-09-13T15:07:41Z")
Hi, I'm wondering where the callback function is executed when using searchAsync: Search API | Java REST Client \[7.14\] | Elastic Is there some thread pool for the es client? --- ## [Elasticsearch not parsing cloudtrail index](https://discuss.elastic.co/t/elasticsearch-not-parsing-cloudtrail-index/283913)
**Author:** [@EvanGertis](https://discuss.elastic.co/u/EvanGertis)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 3:07pm UTC](https://discuss.elastic.co/t/elasticsearch-not-parsing-cloudtrail-index/283913 "2021-09-13T15:07:36Z")
I'm running into an issue parsing cloudtrail logs from filebeat. I am getting this error from the the ecs logs. WARN \[elasticsearch\] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Time… --- ## [Does ES join support composite key?](https://discuss.elastic.co/t/does-es-join-support-composite-key/283806)
**Author:** [@manjurgani](https://discuss.elastic.co/u/manjurgani)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:57pm UTC](https://discuss.elastic.co/t/does-es-join-support-composite-key/283806 "2021-09-13T14:57:44Z")
\--my parent document looks like below PUT example3/\_doc/9 { "userId":9999 "accountId":101, } -- PUT example3/\_doc/10 { "userId":9999 "accountId":102, } ---my child look like below PUT example3/\_doc/11 { "a… --- ## [Vega Bar Chart](https://discuss.elastic.co/t/vega-bar-chart/283578)
**Author:** [@Alexandre.Bernier](https://discuss.elastic.co/u/Alexandre.Bernier)\ **Replies:** 4\ **Last updated:** [September 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/vega-bar-chart/283578 "2021-09-13T14:56:29Z")
Hi, I'm actually working on a new VEGA chart and I can't seem to make it work. I'm trying to create something like this Bar Grouped 1 or like this Bar Grouped 2. I wanna display two columns for one X value. The first… --- ## [Bad order with scripted sort and nested filter](https://discuss.elastic.co/t/bad-order-with-scripted-sort-and-nested-filter/283820)
**Author:** [@vovervova](https://discuss.elastic.co/u/vovervova)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:51pm UTC](https://discuss.elastic.co/t/bad-order-with-scripted-sort-and-nested-filter/283820 "2021-09-13T14:51:28Z")
Hello, I have problems. When I am using nested filter in my query sorting order breaks (without nested filters works perfect ) { "query": { "nested": { "path": "status", "query": { "bool": { … --- ## [Can I query a non-indexed field using a runtime field?](https://discuss.elastic.co/t/can-i-query-a-non-indexed-field-using-a-runtime-field/283786)
**Author:** [@shipful](https://discuss.elastic.co/u/shipful)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:49pm UTC](https://discuss.elastic.co/t/can-i-query-a-non-indexed-field-using-a-runtime-field/283786 "2021-09-13T14:49:11Z")
If I create a mapping that doesn't index any fields: PUT test-index/ { "mappings": { "dynamic": false } } and then add a document POST test-index/\_doc { "a": "a", "b": "b", "c": "c" } Can I then use a dy… --- ## [How to aggregate frequency count of words which exist in a field](https://discuss.elastic.co/t/how-to-aggregate-frequency-count-of-words-which-exist-in-a-field/283931)
**Author:** [@Pooya\_Pilechi](https://discuss.elastic.co/u/Pooya_Pilechi)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:45pm UTC](https://discuss.elastic.co/t/how-to-aggregate-frequency-count-of-words-which-exist-in-a-field/283931 "2021-09-13T14:45:20Z")
Hi. I want to evaluate frequency of terms which exist in a hashtags field of a twitter data. for example i have an index which its name is twitter . in twitter index i have a field which its name is hashtags. for ins… --- ## [Search After Pagination with sort field in Query](https://discuss.elastic.co/t/search-after-pagination-with-sort-field-in-query/283952)
**Author:** [@rahulpatwari](https://discuss.elastic.co/u/rahulpatwari)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:40pm UTC](https://discuss.elastic.co/t/search-after-pagination-with-sort-field-in-query/283952 "2021-09-13T14:40:42Z")
Hi, I am using search after pagination logic for deep pagination. The search query extracts documents with a specific DateTime range. { "range": { "my\_date\_t… --- ## [PostgreSQL: infinite DECLARE CURSOR when rebuilding one Elasticsearch index](https://discuss.elastic.co/t/postgresql-infinite-declare-cursor-when-rebuilding-one-elasticsearch-index/283971)
**Author:** [@Drept](https://discuss.elastic.co/u/Drept)\ **Replies:** 2\ **Last updated:** [September 13, 2021, 2:27pm UTC](https://discuss.elastic.co/t/postgresql-infinite-declare-cursor-when-rebuilding-one-elasticsearch-index/283971 "2021-09-13T14:27:26Z")
I have a number of Elasticsearch indices for millions of objects. The problem arises only with one of them that contains around 5 million objects. When I am trying to rebuild the Elasticsearch index (I am using django-e… --- ## [Elasticsearch Query on Array object with must clause is giving empty results](https://discuss.elastic.co/t/elasticsearch-query-on-array-object-with-must-clause-is-giving-empty-results/284066)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:23pm UTC](https://discuss.elastic.co/t/elasticsearch-query-on-array-object-with-must-clause-is-giving-empty-results/284066 "2021-09-13T14:23:12Z")
Hi There, I'm always getting empty results when i query the array objects with multi must clause as mentioned below Index docs: POST test/doc/1 { "name":\["Alex","Bob","Matt"\], "company":"ABC", "city":"NY" } P… --- ## [When using logstash output sends only limited information. Any other output, no problem](https://discuss.elastic.co/t/when-using-logstash-output-sends-only-limited-information-any-other-output-no-problem/283692)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 10\ **Last updated:** [September 13, 2021, 2:17pm UTC](https://discuss.elastic.co/t/when-using-logstash-output-sends-only-limited-information-any-other-output-no-problem/283692 "2021-09-13T14:17:12Z")
If I use auditbeat (I guess is the same with other beats) and configure elasticsearch or file output I see all information I need. In this example I modify /etc/sudoers' attributes, then I modify it, and then I modify i… --- ## [Fleet](https://discuss.elastic.co/t/fleet/284049)
**Author:** [@suraj\_kumar3](https://discuss.elastic.co/u/suraj_kumar3)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:13pm UTC](https://discuss.elastic.co/t/fleet/284049 "2021-09-13T14:13:23Z")
I have created a fleet server and that is showing under fleet\>agents and status is healthy as well but while enrolling agent to fleet server it shows its enrolled but status on kibana fleet\>agents UI is coming as unhealt… --- ## [How to fix one field in elasticsearch by using document\_id?](https://discuss.elastic.co/t/how-to-fix-one-field-in-elasticsearch-by-using-document-id/283538)
**Author:** [@padamrai](https://discuss.elastic.co/u/padamrai)\ **Replies:** 3\ **Last updated:** [September 13, 2021, 2:12pm UTC](https://discuss.elastic.co/t/how-to-fix-one-field-in-elasticsearch-by-using-document-id/283538 "2021-09-13T14:12:17Z")
I am getting multiple messages in different queues and I am also using document\_id to avoid duplicates values. But the problem with docuemnt\_id is, it is overwriting the existing data with a new one But I want to fix one… --- ## [Watcher Field Value Based Alerts](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871)
**Author:** [@Zunera\_Nayyar](https://discuss.elastic.co/u/Zunera_Nayyar)\ **Replies:** 1\ **Last updated:** [September 13, 2021, 2:09pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871 "2021-09-13T14:09:54Z")
Hi, I have an app which returns different statuscodes based on URL being hit. I want to generate make a watcher alert based on the values in the same field with different outputs. I do not want the collective count/agg… [Previous page](https://discuss.elastic.co/latest.md?page=1479) [Next page](https://discuss.elastic.co/latest.md?page=1481)