# Latest **URL:** https://discuss.elastic.co/latest.md?page=1835 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1836 --- ## [Best way to export data do SQL database](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:16pm UTC](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462 "2021-02-16T19:16:22Z")
Hi, could you help me advice What tools/techniques do you recommend to export data to SQL Database. (PostgreSQL/Oracle or any other) I need aggregations results export to SQL database (continuous query). I supposed… --- ## [Extract nested json](https://discuss.elastic.co/t/extract-nested-json/264062)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:13pm UTC](https://discuss.elastic.co/t/extract-nested-json/264062 "2021-02-16T19:13:23Z")
I have the following nested json that I'm trying to pull out into top level fields so I can use mutate to add and modify, These events are picked from an awscloudwatch stream with filebeat v7.10.2 then fed to a logstash… --- ## [Storm and ElasticStack with external ZooKeeper Server](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363)
**Author:** [@AaronNGray](https://discuss.elastic.co/u/AaronNGray)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 6:32pm UTC](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363 "2021-02-16T18:32:44Z")
I am trying to create a docker-compose script that marries ElasticStack with Storm for the purposes of StormCrawler development. I have a storm script that includes a ZooKeeper server. I tried combining this with the… --- ## [Difference between aggregating on analyzed text field (using field data), compared to aggregating on high cardinality non-analyzed field](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444)
**Author:** [@bagge](https://discuss.elastic.co/u/bagge)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 6:06pm UTC](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444 "2021-02-16T18:06:08Z")
Hi, We are seeing performance problems with our elasticsearch cluster. Our setup is running ES 6.6 with 6 nodes total where 2 are master and 4 are data. Each data node has 32GB memory and 16 available to the heap. We h… --- ## [Highlight field is empty](https://discuss.elastic.co/t/highlight-field-is-empty/264458)
**Author:** [@jrartiga](https://discuss.elastic.co/u/jrartiga)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 5:40pm UTC](https://discuss.elastic.co/t/highlight-field-is-empty/264458 "2021-02-16T17:40:45Z")
Hi all, I'm using the Swiftype: Application Search, Site Search and Enterprise Search Platform API and I'm concern about why for some results the highlight field comes empty, that field always should return values right… --- ## [Elasticsearch - How to start the instance/cluster with Gold or Platinum license](https://discuss.elastic.co/t/elasticsearch-how-to-start-the-instance-cluster-with-gold-or-platinum-license/264337)
**Author:** [@Pramodh\_Bettadapura](https://discuss.elastic.co/u/Pramodh_Bettadapura)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 5:32pm UTC](https://discuss.elastic.co/t/elasticsearch-how-to-start-the-instance-cluster-with-gold-or-platinum-license/264337 "2021-02-16T17:32:10Z")
Is their a way to statically start the Elasticsearch instances with Gold or Platinum license. or is it only enabled on calling "PUT \_license" API with license JSON --- ## [Conditional N-gram token filter?](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 5:21pm UTC](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460 "2021-02-16T17:21:19Z")
Could we have conditional N-gram token filter? Tell me yes or no ? More explanation : I have a text "The animal is cute" I want to know if it is possible to have min\_gram=3 if word.length\>=3 and min\_gram=2 if word.len… --- ## [Точный count distinct](https://discuss.elastic.co/t/count-distinct/264091)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 5:15pm UTC](https://discuss.elastic.co/t/count-distinct/264091 "2021-02-16T17:15:40Z")
Есть ли воможность сделать точный count distinct по полю без cardinality? --- ## [Endpoint security rules](https://discuss.elastic.co/t/endpoint-security-rules/264410)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 5:01pm UTC](https://discuss.elastic.co/t/endpoint-security-rules/264410 "2021-02-16T17:01:51Z")
Running 7.11 in Elastic Cloud and the endpoint agent and noticed all endpoint security rules are failing due to The following index patterns did not match any indices: \["endgame-\*"\] I do not have this indices, should I… --- ## [How to prevent query execution within certain hours of the day?](https://discuss.elastic.co/t/how-to-prevent-query-execution-within-certain-hours-of-the-day/264456)
**Author:** [@mattinVS](https://discuss.elastic.co/u/mattinVS)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 4:23pm UTC](https://discuss.elastic.co/t/how-to-prevent-query-execution-within-certain-hours-of-the-day/264456 "2021-02-16T16:23:49Z")
Hi, I'd like to prevent the execution of a query within certain hours of the day. The solution that comes into my mind is to use a painless script filter for this like "query": { "bool": { "filter": \[ … --- ## [Can I conditionally trigger a processor based on the current nested iteration or execute a plugin in script?](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288)
**Author:** [@dswitzer](https://discuss.elastic.co/u/dswitzer)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 4:17pm UTC](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288 "2021-02-16T16:17:48Z")
Is there a way to process an attachment conditionally for a nested object that's represented by an array? I looked into the foreach processor with a conditional if, but the ctx object does not appear to hold a reference… --- ## [Difference b/w Aggregate & joinaggregate in vega-lite](https://discuss.elastic.co/t/difference-b-w-aggregate-joinaggregate-in-vega-lite/263826)
**Author:** [@Yashaswini](https://discuss.elastic.co/u/Yashaswini)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 4:12pm UTC](https://discuss.elastic.co/t/difference-b-w-aggregate-joinaggregate-in-vega-lite/263826 "2021-02-16T16:12:16Z")
When I use aggregate i'm getting value as 0, but when I use joinaggregate i'm proper value. Why is this happening ? { "$schema": "https://vega.github.io/schema/vega-lite/v4.json", "width": 400, data: { … --- ## [Security agent tuning](https://discuss.elastic.co/t/security-agent-tuning/264406)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 3:51pm UTC](https://discuss.elastic.co/t/security-agent-tuning/264406 "2021-02-16T15:51:36Z")
I have the agent running on some Linux servers and it generates about 15M process events within a 24 hour period. Is there a way to tune this as its consumes a lot of storage with data that is not very useful. Also, are… --- ## [Startup Docker race condition](https://discuss.elastic.co/t/startup-docker-race-condition/264365)
**Author:** [@tman5](https://discuss.elastic.co/u/tman5)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 3:27pm UTC](https://discuss.elastic.co/t/startup-docker-race-condition/264365 "2021-02-16T15:27:48Z")
Facing an issue when a server reboots with Filebeat 7.10 and Docker. Filebeat will start slightly before Docker and not pick up Docker container logs. If you restart Filebeat, it will then pick them up. I could set start… --- ## [Can I delete a data-stream backing index?](https://discuss.elastic.co/t/can-i-delete-a-data-stream-backing-index/264449)
**Author:** [@gkman](https://discuss.elastic.co/u/gkman)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 3:00pm UTC](https://discuss.elastic.co/t/can-i-delete-a-data-stream-backing-index/264449 "2021-02-16T15:00:53Z")
I have a few data-streams configured in my Elasticsearch cluster (with ILM policy). Suppose I run into storage problems and etc. and I want to prematurely delete a few backing indices of the data-streams- Is it possible… --- ## [Panic: runtime error: invalid memory address or nil pointer dereference in ecctl 1.1.0](https://discuss.elastic.co/t/panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference-in-ecctl-1-1-0/263808)
**Author:** [@bbaronas](https://discuss.elastic.co/u/bbaronas)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 2:18pm UTC](https://discuss.elastic.co/t/panic-runtime-error-invalid-memory-address-or-nil-pointer-dereference-in-ecctl-1-1-0/263808 "2021-02-16T14:18:29Z")
I am trying to output an upload template for my Elastic Cloud deployment using ecctl. However, when I run ecctl deployment show \ --generate-update-payload \> update.json using my actual deployment id I get … --- ## [Duplicate Issue - document\_id, how to prevent overwriting of entries](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 1:44pm UTC](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404 "2021-02-16T13:44:57Z")
Hi All, Some background information: I have duplicate entries in my elasticsearch indexes. Have used document\_id which prevented duplicates from appearing. But the issue with this is that it overwrites and updates the… --- ## [Highlight query in URI](https://discuss.elastic.co/t/highlight-query-in-uri/263543)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:39pm UTC](https://discuss.elastic.co/t/highlight-query-in-uri/263543 "2021-02-16T13:39:11Z")
Hi, I want to use highlight in URI query. Ex. http://myservername.com:9200/myindex/\_search?q=myfieldname:searchvalue&highlight=myfieldname But this is not working. I want to use URI search with highlight but not get… --- ## [Get all data from sharepoint to Workplace search](https://discuss.elastic.co/t/get-all-data-from-sharepoint-to-workplace-search/263119)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 1:36pm UTC](https://discuss.elastic.co/t/get-all-data-from-sharepoint-to-workplace-search/263119 "2021-02-16T13:36:45Z")
Hi I setup Workplace search and make a source connection to sharepoint as I got instruction from this url https://www.elastic.co/guide/en/workplace-search/current/workplace-search-sharepoint-online-connector.html It is… --- ## [Issue with Endgame lab](https://discuss.elastic.co/t/issue-with-endgame-lab/264298)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:19pm UTC](https://discuss.elastic.co/t/issue-with-endgame-lab/264298 "2021-02-16T13:19:01Z")
Hi, In the Elastic Endgame free training, Strigo Lab: http://ec2-3-64-54-139.eu-central-1.compute.amazonaws.com/instructions/labs.html#\_lab\_1\_elastic\_endgame\_sensor\_deployment In the very first part when you cat /hom… --- ## [Problem Using Filebeat for logging ssh log in](https://discuss.elastic.co/t/problem-using-filebeat-for-logging-ssh-log-in/264412)
**Author:** [@Skriix](https://discuss.elastic.co/u/Skriix)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:10pm UTC](https://discuss.elastic.co/t/problem-using-filebeat-for-logging-ssh-log-in/264412 "2021-02-16T13:10:11Z")
Hi, SSh logs are not being shown in the kibana, I am pushing my logs to the ES Only I am using the following configuration, OS - Ubuntu 20.04 ES - 7.11.0 LogStash - 7.11.0 Kibana - 7.11.0 FileBeat - 7.11.0 The en… --- ## [Elasticsearch backup & restore issue](https://discuss.elastic.co/t/elasticsearch-backup-restore-issue/264324)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-backup-restore-issue/264324 "2021-02-16T13:07:25Z")
Hi all, I'm trying to do backup and restore of elasticsearch data. I have taken backup of my elasticsearch data. But when i try to restore my backup, it gives errror that "cannot restore index \[ilm-history-3-000001\] b… --- ## [Dead letter queue not printing logs for events failed to get indexed in Elasticsearch](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:42pm UTC](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967 "2021-02-16T12:42:30Z")
Objective: print log/event in a log file which are failed to index in Elasticsearch. I am ingesting logs via SQS input and few messages are getting failed to index in Elasticsearch. I have debug logs and it shows the fo… --- ## [Difference between sharing dashboard as snapshot and saved object](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:33pm UTC](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385 "2021-02-16T12:33:23Z")
Hello All, I use Kibana version 7.9.0. I would like to know the actual difference between sharing/embedding a dashboard URL as a snapshot or a saved object According to the pop-up info : For snapshot, the pop-up says… --- ## [It seems mapping update for "date\_range" field type is not idempotent](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034)
**Author:** [@0bivan](https://discuss.elastic.co/u/0bivan)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:21pm UTC](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034 "2021-02-16T12:21:49Z")
Hi. Want to confirm the issue before posting it on github. ES does not allow to update date\_range field with exact same mapping settings and responds with 500. Tried with docker container (https://hub.docker.com/\_/elasti… --- ## [Logstash pipeline output and elastic cloud](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 10\ **Last updated:** [February 16, 2021, 12:17pm UTC](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659 "2021-02-16T12:17:29Z")
Hi all. I have elastic cloud 7.10.2 and we are setting up logstash with a pipilne with input/filter/output. Also we are using helm to deploy. Of course I have cloud.id and cloud.auth and not sure how to configure the … --- ## [7.11.0 release forgot to merge ansible-beats](https://discuss.elastic.co/t/7-11-0-release-forgot-to-merge-ansible-beats/264256)
**Author:** [@strophy](https://discuss.elastic.co/u/strophy)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:03pm UTC](https://discuss.elastic.co/t/7-11-0-release-forgot-to-merge-ansible-beats/264256 "2021-02-16T12:03:31Z")
Hello, who is responsible for merging and releasing this? It seems to have been forgotten compared to previous releases, where it was merged on the same day as the rest of Elastic Stack. --- ## [Create new field from query](https://discuss.elastic.co/t/create-new-field-from-query/263892)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 17\ **Last updated:** [February 16, 2021, 11:57am UTC](https://discuss.elastic.co/t/create-new-field-from-query/263892 "2021-02-16T11:57:03Z")
I got a query which creates a new field sophos.utm.to.domain. That query extracts the full mail domain. The mail address which is stored in sophos.utm.to. My Question: How do I create a new field out of this query? --- ## [Filebeat setup. fail to create the Kibana loader](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264394)
**Author:** [@DavidEA](https://discuss.elastic.co/u/DavidEA)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 11:47am UTC](https://discuss.elastic.co/t/filebeat-setup-fail-to-create-the-kibana-loader/264394 "2021-02-16T11:47:48Z")
Please tell me, I don't know where to look. When installing filebeat, I do: filebeat setup -e -E output.logstash.enabled = false -E output.elasticsearch.hosts = \['remote\_ip: 9200'\] -E setup.kibana.host = remote\_ip: 560… --- ## [Configure dropwizard modules for same services in different namespaces](https://discuss.elastic.co/t/configure-dropwizard-modules-for-same-services-in-different-namespaces/264162)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 11:36am UTC](https://discuss.elastic.co/t/configure-dropwizard-modules-for-same-services-in-different-namespaces/264162 "2021-02-16T11:36:41Z")
Hi we have multiple services exposing metrics using dropwizard running in kubernetes environment. Same services run in multiple kubernetes. namespaces, so I need to configure metricbeat everytime a new namespace is ad… [Previous page](https://discuss.elastic.co/latest.md?page=1834) [Next page](https://discuss.elastic.co/latest.md?page=1836)