# \#eql-elastic-query-language **URL:** https://discuss.elastic.co/tag/eql-elastic-query-language/93.md [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) --- ## [Fetch top k frequent fields](https://discuss.elastic.co/t/fetch-top-k-frequent-fields/378928)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [June 6, 2025, 7:53am UTC](https://discuss.elastic.co/t/fetch-top-k-frequent-fields/378928 "2025-06-06T07:53:57Z")
Hi all, I want to fetch the top k fields that are most frequent in the last 5 minutes of documents or in whole index. I have tried some queries, as shown below, to get the desired output, but it's taking a long time. I … --- ## [Use of unmapped\_type in sorting](https://discuss.elastic.co/t/use-of-unmapped-type-in-sorting/378127)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [May 20, 2025, 8:33am UTC](https://discuss.elastic.co/t/use-of-unmapped-type-in-sorting/378127 "2025-05-20T08:33:22Z")
Hi everyone, In my application, I want to sort fields similar to the Kibana Discover page. While exploring Kibana APIs for sorting, I noticed that Kibana addsunmapped\_type: "boolean" in sort query to all the fields. I j… --- ## [How to know field is sortable or not](https://discuss.elastic.co/t/how-to-know-field-is-sortable-or-not/378124)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [May 15, 2025, 10:05am UTC](https://discuss.elastic.co/t/how-to-know-field-is-sortable-or-not/378124 "2025-05-15T10:05:09Z")
Hi Everyone, In my application, I want to sort fields similar to the Kibana Discover page. After exploring the Kibana Discover page, I found that some fields are not sortable, meaning the sort functionality is disabled … --- ## [Is Self Inner Join Supported in ES?](https://discuss.elastic.co/t/is-self-inner-join-supported-in-es/377906)
**Author:** [@sekarvicky73](https://discuss.elastic.co/u/sekarvicky73)\ **Replies:** 2\ **Last updated:** [May 9, 2025, 1:36pm UTC](https://discuss.elastic.co/t/is-self-inner-join-supported-in-es/377906 "2025-05-09T13:36:40Z")
is possible to the below DB in query in Elasticsearch in SIngle query. SELECT \* FROM ADSMFolderDetails a INNER JOIN ADSMFolderDetails b ON a.parent\_path = b.path AND a.perm = b.perm AND a.sid = b.sid --- ## [Latest value in ESQL Elasticsearch piped query language on kibana](https://discuss.elastic.co/t/latest-value-in-esql-elasticsearch-piped-query-language-on-kibana/373427)
**Author:** [@roopeshetty](https://discuss.elastic.co/u/roopeshetty)\ **Replies:** 2\ **Last updated:** [January 23, 2025, 12:11pm UTC](https://discuss.elastic.co/t/latest-value-in-esql-elasticsearch-piped-query-language-on-kibana/373427 "2025-01-23T12:11:07Z")
Hi Guys We are running below ES|QL query on Kibana to make a table of list of alerts triggered from a external Monitoring tool. FROM winlogbeat-\* | WHERE event.code == "3003" | stats Alert\_Time = VALUES(@timestamp), Se… --- ## [ODBC SQL SELECT queries for DataStreams?](https://discuss.elastic.co/t/odbc-sql-select-queries-for-datastreams/372762)
**Author:** [@Yechezkal\_Gutfreund](https://discuss.elastic.co/u/Yechezkal_Gutfreund)\ **Replies:** 1\ **Last updated:** [January 4, 2025, 12:50am UTC](https://discuss.elastic.co/t/odbc-sql-select-queries-for-datastreams/372762 "2025-01-04T00:50:04Z")
I see that ESQL can easily be used to query a DataStream. What about the SQL queries supported by the ODBC connector? I want use the ODBC connector to look at data in my ELK Cloud stack. Thank you. --- ## [Query rules / Curations](https://discuss.elastic.co/t/query-rules-curations/370868)
**Author:** [@pngworkforce](https://discuss.elastic.co/u/pngworkforce)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 12:50am UTC](https://discuss.elastic.co/t/query-rules-curations/370868 "2024-11-21T00:50:59Z")
Hello! I have created the following ruleset in my Elastic Cloud instance PUT \_query\_rules/rule1 { "rules": \[ { "rule\_id": "rates", "type": "pinned", "criteria": \[ { "… --- ## [Possible to access sibling aggregation value within sibling child aggregation?](https://discuss.elastic.co/t/possible-to-access-sibling-aggregation-value-within-sibling-child-aggregation/368537)
**Author:** [@jlrivera81](https://discuss.elastic.co/u/jlrivera81)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 1:54pm UTC](https://discuss.elastic.co/t/possible-to-access-sibling-aggregation-value-within-sibling-child-aggregation/368537 "2024-10-09T13:54:51Z")
Hello, I have a test pipeline that is triggered for every code commit. The code commit has a unique "revision" and you can determine commit-order based on the revision's associated "revision\_order". Additionally, each… --- ## [Does Elastic internally perform 'query' and 'suggest' requests in parallel?](https://discuss.elastic.co/t/does-elastic-internally-perform-query-and-suggest-requests-in-parallel/368536)
**Author:** [@alliswell](https://discuss.elastic.co/u/alliswell)\ **Replies:** 0\ **Last updated:** [October 9, 2024, 1:40pm UTC](https://discuss.elastic.co/t/does-elastic-internally-perform-query-and-suggest-requests-in-parallel/368536 "2024-10-09T13:40:42Z")
Elastics search provides feature to get search results and suggestions in a single request, reducing network overhead. POST my-index-000001/\_search { "query" : { "match": { "message": "tring out Elasticsearc… --- ## [How to perform filter with condition?](https://discuss.elastic.co/t/how-to-perform-filter-with-condition/366295)
**Author:** [@\_Zhang](https://discuss.elastic.co/u/_Zhang)\ **Replies:** 2\ **Last updated:** [September 11, 2024, 2:13am UTC](https://discuss.elastic.co/t/how-to-perform-filter-with-condition/366295 "2024-09-11T02:13:29Z")
In SQL: select \* from my\_index where type in ('a', 'b') and (type \<\> 'a' or value\_field = 'sth') Filter by field value\_field when type is 'a'. Using script: { "query": { "bool": { "filter": \[ … --- ## [Bucket Selector with Top Hits aggregation](https://discuss.elastic.co/t/bucket-selector-with-top-hits-aggregation/364847)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [August 13, 2024, 4:24pm UTC](https://discuss.elastic.co/t/bucket-selector-with-top-hits-aggregation/364847 "2024-08-13T16:24:24Z")
Hello, I have this query that is aggregates with top hits to retrieve the last doc. I want to use the bucket selector to filter for buckets that match a source field, event.outcome: "failure". I am struggling with the… --- ## [Natural language to Query DSL building](https://discuss.elastic.co/t/natural-language-to-query-dsl-building/364586)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 0\ **Last updated:** [August 8, 2024, 8:26am UTC](https://discuss.elastic.co/t/natural-language-to-query-dsl-building/364586 "2024-08-08T08:26:39Z")
Hi Folks, I want to build an app that converts natural language query to elasticsearch query DSL. I have gone through How to use Elasticsearch to prompt ChatGPT with natural language | Elastic Blog Are there any refere… --- ## [Nested Field exists check not working as expected](https://discuss.elastic.co/t/nested-field-exists-check-not-working-as-expected/356859)
**Author:** [@Sankar\_S](https://discuss.elastic.co/u/Sankar_S)\ **Replies:** 8\ **Last updated:** [July 22, 2024, 3:28pm UTC](https://discuss.elastic.co/t/nested-field-exists-check-not-working-as-expected/356859 "2024-07-22T15:28:37Z")
GET index1/\_search { "query": { "bool": { "must\_not": \[ { "nested": { "path": "publish\_details", "query": { "bool": { "must\_not": \[ … --- ## [Performance comparison: KQL vs ES|QL vs DSL](https://discuss.elastic.co/t/performance-comparison-kql-vs-es-ql-vs-dsl/363151)
**Author:** [@yar](https://discuss.elastic.co/u/yar)\ **Replies:** 0\ **Last updated:** [July 15, 2024, 1:33pm UTC](https://discuss.elastic.co/t/performance-comparison-kql-vs-es-ql-vs-dsl/363151 "2024-07-15T13:33:04Z")
Hi! I'm facing some performance degradation with my ELK setup. I believe that poorly written querys are one of the main causes of this degradation. Due to the specific use cases I must write queries with a lot of OR sta… --- ## [Elastic search query - parent child permissions](https://discuss.elastic.co/t/elastic-search-query-parent-child-permissions/362824)
**Author:** [@anuj99](https://discuss.elastic.co/u/anuj99)\ **Replies:** 0\ **Last updated:** [July 9, 2024, 10:10pm UTC](https://discuss.elastic.co/t/elastic-search-query-parent-child-permissions/362824 "2024-07-09T22:10:57Z")
I have the following use case : I have multiple folders each having associated accesses for users and teams. Each folder is associated with multiple files and inherits the folder permissions. I want to query based on… --- ## [Wildcard is not working as expected](https://discuss.elastic.co/t/wildcard-is-not-working-as-expected/360117)
**Author:** [@venkatesh\_aamanchi](https://discuss.elastic.co/u/venkatesh_aamanchi)\ **Replies:** 7\ **Last updated:** [May 24, 2024, 8:51am UTC](https://discuss.elastic.co/t/wildcard-is-not-working-as-expected/360117 "2024-05-24T08:51:33Z")
Hello, I am using "wildcard" for matching fields of type text with a specific pattern. "query": { "wildcard": { "description": { "value": "objective\*", "case\_inse… --- ## [Query assistance for conditional querying](https://discuss.elastic.co/t/query-assistance-for-conditional-querying/356218)
**Author:** [@Spandana](https://discuss.elastic.co/u/Spandana)\ **Replies:** 1\ **Last updated:** [March 27, 2024, 3:52am UTC](https://discuss.elastic.co/t/query-assistance-for-conditional-querying/356218 "2024-03-27T03:52:22Z")
I have elastic index with fields styleId, sellingStyleId, styleName, inventoryEnabled, inventoryCount need help with query to pull all the records but if inventoryEnabled is true then check if inventoryCount is greater … --- ## [Kuromoji\_tokenizer: sort clause does not seem to work for some specific character combinations](https://discuss.elastic.co/t/kuromoji-tokenizer-sort-clause-does-not-seem-to-work-for-some-specific-character-combinations/356173)
**Author:** [@Ajay\_Purohit](https://discuss.elastic.co/u/Ajay_Purohit)\ **Replies:** 0\ **Last updated:** [March 26, 2024, 11:40am UTC](https://discuss.elastic.co/t/kuromoji-tokenizer-sort-clause-does-not-seem-to-work-for-some-specific-character-combinations/356173 "2024-03-26T11:40:35Z")
Query: { "query": { "bool": { } }, "sort": \[ { "attribute.sortable": { "order": "asc" } } \] } Results: "hits": \[ { "\_index": "example\_1", "\_type": "example\_1", … --- ## [Default token in Aanlyzer if emitted tokens are empty](https://discuss.elastic.co/t/default-token-in-aanlyzer-if-emitted-tokens-are-empty/355971)
**Author:** [@Sumanth](https://discuss.elastic.co/u/Sumanth)\ **Replies:** 0\ **Last updated:** [March 22, 2024, 8:50am UTC](https://discuss.elastic.co/t/default-token-in-aanlyzer-if-emitted-tokens-are-empty/355971 "2024-03-22T08:50:40Z")
Hello Experts, The requirement is - when firing a query on index, we have one big Elastic Query DSL query built to run a a search on the index. For one of the property field, we have applied a custom analyzer. One of… --- ## [Find documents where same field value is found in any outer or nested fields](https://discuss.elastic.co/t/find-documents-where-same-field-value-is-found-in-any-outer-or-nested-fields/355325)
**Author:** [@spinesmovie](https://discuss.elastic.co/u/spinesmovie)\ **Replies:** 0\ **Last updated:** [March 13, 2024, 4:00pm UTC](https://discuss.elastic.co/t/find-documents-where-same-field-value-is-found-in-any-outer-or-nested-fields/355325 "2024-03-13T16:00:16Z")
Elasticsearch has an index where \_source is of schema { ... "color" : "white", "items" : \[ { ... "color": "blue", "items": \[...\] }, { ... "color": "red", "items": \[.… --- ## [Simple\_query\_string and query\_string not working as expected](https://discuss.elastic.co/t/simple-query-string-and-query-string-not-working-as-expected/352905)
**Author:** [@Sankar\_S](https://discuss.elastic.co/u/Sankar_S)\ **Replies:** 0\ **Last updated:** [February 9, 2024, 5:05am UTC](https://discuss.elastic.co/t/simple-query-string-and-query-string-not-working-as-expected/352905 "2024-02-09T05:05:27Z")
I have a title field in document 1 document has $kitkat as value and another has "title" : "Testing Special\_character Elastic Search in $reference entry search" { "query": { "bool": { "must": \[ … --- ## [Update\_by\_query?routing=orgid performance veryslow](https://discuss.elastic.co/t/update-by-query-routing-orgid-performance-veryslow/351940)
**Author:** [@Sankar\_S](https://discuss.elastic.co/u/Sankar_S)\ **Replies:** 6\ **Last updated:** [January 29, 2024, 12:16pm UTC](https://discuss.elastic.co/t/update-by-query-routing-orgid-performance-veryslow/351940 "2024-01-29T12:16:51Z")
Hello All, /\_update\_by\_query { "query": { "bool": { "filter": \[ { "term": { "my\_key": "myapikey" } } \] } }, "script": { "source": """ … --- ## [Fuzziness and Levenstein distance](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885)
**Author:** [@alba](https://discuss.elastic.co/u/alba)\ **Replies:** 2\ **Last updated:** [January 26, 2024, 5:46pm UTC](https://discuss.elastic.co/t/fuzziness-and-levenstein-distance/351885 "2024-01-26T17:46:15Z")
Hi guys, I have a multi\_match query with "fuzziness" : 2. When I search for "mexico" I get results with "medical" which have Levenstein distance 3 to "mexico". Could somebody explain it to me? --- ## [Add another one sorting to lift 3 docs to positions 3,4,5](https://discuss.elastic.co/t/add-another-one-sorting-to-lift-3-docs-to-positions-3-4-5/349918)
**Author:** [@sahkdevel](https://discuss.elastic.co/u/sahkdevel)\ **Replies:** 2\ **Last updated:** [December 26, 2023, 8:49am UTC](https://discuss.elastic.co/t/add-another-one-sorting-to-lift-3-docs-to-positions-3-4-5/349918 "2023-12-26T08:49:48Z")
I have a query with several sortings. Here is the sorting part: "sort": \[ "isHistorical", "\_score", { "\_script": { "type": "number", "script": { … --- ## [Search any term startswith including special char](https://discuss.elastic.co/t/search-any-term-startswith-including-special-char/349288)
**Author:** [@Sankar\_S](https://discuss.elastic.co/u/Sankar_S)\ **Replies:** 4\ **Last updated:** [December 15, 2023, 4:48pm UTC](https://discuss.elastic.co/t/search-any-term-startswith-including-special-char/349288 "2023-12-15T16:48:45Z")
Hello All, I have a field called title and it has value "title" : "Toddler- $kitkat @taste &roll ^yart !here #you %ice ^oops \*jam (pot) \[beat\] pep |old {jet} \`egg /lol" For given input i would like to match any term s… --- ## [Create a Kibana Rule](https://discuss.elastic.co/t/create-a-kibana-rule/348333)
**Author:** [@Claudia\_Tavares](https://discuss.elastic.co/u/Claudia_Tavares)\ **Replies:** 2\ **Last updated:** [November 30, 2023, 3:05pm UTC](https://discuss.elastic.co/t/create-a-kibana-rule/348333 "2023-11-30T15:05:54Z")
Kibana: version 7.17.3 I am trying to create a Rule in Kibana Alerts and Insights, but I'm having some difficults. To contextualize: 1- I want to calculate the total of documents in last 5 minutes 2- Calculate the nu… --- ## [Elasticsearch Query](https://discuss.elastic.co/t/elasticsearch-query/347768)
**Author:** [@Brian-cf1](https://discuss.elastic.co/u/Brian-cf1)\ **Replies:** 3\ **Last updated:** [November 30, 2023, 2:41pm UTC](https://discuss.elastic.co/t/elasticsearch-query/347768 "2023-11-30T14:41:57Z")
How do i exclude multiple keywords from a field ? I need the following logic but its not letting me include 2 wild cards "must\_not": \[ { "wildcard": { "error.message": { "value": … --- ## [Eql with time range](https://discuss.elastic.co/t/eql-with-time-range/346928)
**Author:** [@mary-20](https://discuss.elastic.co/u/mary-20)\ **Replies:** 0\ **Last updated:** [November 12, 2023, 1:30pm UTC](https://discuss.elastic.co/t/eql-with-time-range/346928 "2023-11-12T13:30:22Z")
Hi guys, I'm looking for EQL to match logs with a timestamp within the last 5 minutes. I have read a with maxspan statement, but it has some limitation: It must be used with sequence it starts at the first event’s ti… --- ## [Query retrieving documents when only one of two conditions are found under same aggregation](https://discuss.elastic.co/t/query-retrieving-documents-when-only-one-of-two-conditions-are-found-under-same-aggregation/345746)
**Author:** [@roblopes](https://discuss.elastic.co/u/roblopes)\ **Replies:** 0\ **Last updated:** [October 25, 2023, 2:52pm UTC](https://discuss.elastic.co/t/query-retrieving-documents-when-only-one-of-two-conditions-are-found-under-same-aggregation/345746 "2023-10-25T14:52:50Z")
There is a process that logs every step of the way. I am looking for processes that have the log informing the process start but don't have the end process log. Log example: { "app": "myapp", "content": "End Pro… --- ## [Filter records having count =0 in aggregation](https://discuss.elastic.co/t/filter-records-having-count-0-in-aggregation/344679)
**Author:** [@star42](https://discuss.elastic.co/u/star42)\ **Replies:** 0\ **Last updated:** [October 9, 2023, 3:24pm UTC](https://discuss.elastic.co/t/filter-records-having-count-0-in-aggregation/344679 "2023-10-09T15:24:30Z")
Hi, I have a requirement to fetch categories having zero count Query : GET /category-sale-\*/\_search?size=100&filter\_path=aggregations { "query": { "bool": { "filter": { "bool": { "must\_not": \[ { "bool": { "sh… [Next page](https://discuss.elastic.co/tag/eql-elastic-query-language/93.md?match_all_tags=true&page=1&tags%5B%5D=eql-elastic-query-language)