# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=1046 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1047 --- ## [Elastic stores string in numeric (long) field](https://discuss.elastic.co/t/elastic-stores-string-in-numeric-long-field/264102)
**Author:** [@Yaniv\_Bogdanov](https://discuss.elastic.co/u/Yaniv_Bogdanov)\ **Replies:** 6\ **Last updated:** [February 16, 2021, 7:31pm UTC](https://discuss.elastic.co/t/elastic-stores-string-in-numeric-long-field/264102 "2021-02-16T19:31:02Z")
Hello, I noticed that elastic allows to store a string value in a numeric field that was mapped as long (as the string can be parsed as a number). I'm not sure if this is a bug or a feature (and if it has a setting to … --- ## [Best way to export data do SQL database](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:16pm UTC](https://discuss.elastic.co/t/best-way-to-export-data-do-sql-database/264462 "2021-02-16T19:16:22Z")
Hi, could you help me advice What tools/techniques do you recommend to export data to SQL Database. (PostgreSQL/Oracle or any other) I need aggregations results export to SQL database (continuous query). I supposed… --- ## [Extract nested json](https://discuss.elastic.co/t/extract-nested-json/264062)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 7:13pm UTC](https://discuss.elastic.co/t/extract-nested-json/264062 "2021-02-16T19:13:23Z")
I have the following nested json that I'm trying to pull out into top level fields so I can use mutate to add and modify, These events are picked from an awscloudwatch stream with filebeat v7.10.2 then fed to a logstash… --- ## [Storm and ElasticStack with external ZooKeeper Server](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363)
**Author:** [@AaronNGray](https://discuss.elastic.co/u/AaronNGray)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 6:32pm UTC](https://discuss.elastic.co/t/storm-and-elasticstack-with-external-zookeeper-server/264363 "2021-02-16T18:32:44Z")
I am trying to create a docker-compose script that marries ElasticStack with Storm for the purposes of StormCrawler development. I have a storm script that includes a ZooKeeper server. I tried combining this with the… --- ## [Difference between aggregating on analyzed text field (using field data), compared to aggregating on high cardinality non-analyzed field](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444)
**Author:** [@bagge](https://discuss.elastic.co/u/bagge)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 6:06pm UTC](https://discuss.elastic.co/t/difference-between-aggregating-on-analyzed-text-field-using-field-data-compared-to-aggregating-on-high-cardinality-non-analyzed-field/264444 "2021-02-16T18:06:08Z")
Hi, We are seeing performance problems with our elasticsearch cluster. Our setup is running ES 6.6 with 6 nodes total where 2 are master and 4 are data. Each data node has 32GB memory and 16 available to the heap. We h… --- ## [Conditional N-gram token filter?](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460)
**Author:** [@ehsan\_kabiri\_33](https://discuss.elastic.co/u/ehsan_kabiri_33)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 5:21pm UTC](https://discuss.elastic.co/t/conditional-n-gram-token-filter/264460 "2021-02-16T17:21:19Z")
Could we have conditional N-gram token filter? Tell me yes or no ? More explanation : I have a text "The animal is cute" I want to know if it is possible to have min\_gram=3 if word.length\>=3 and min\_gram=2 if word.len… --- ## [Точный count distinct](https://discuss.elastic.co/t/count-distinct/264091)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 5:15pm UTC](https://discuss.elastic.co/t/count-distinct/264091 "2021-02-16T17:15:40Z")
Есть ли воможность сделать точный count distinct по полю без cardinality? --- ## [Endpoint security rules](https://discuss.elastic.co/t/endpoint-security-rules/264410)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 4\ **Last updated:** [February 16, 2021, 5:01pm UTC](https://discuss.elastic.co/t/endpoint-security-rules/264410 "2021-02-16T17:01:51Z")
Running 7.11 in Elastic Cloud and the endpoint agent and noticed all endpoint security rules are failing due to The following index patterns did not match any indices: \["endgame-\*"\] I do not have this indices, should I… --- ## [Can I conditionally trigger a processor based on the current nested iteration or execute a plugin in script?](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288)
**Author:** [@dswitzer](https://discuss.elastic.co/u/dswitzer)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 4:17pm UTC](https://discuss.elastic.co/t/can-i-conditionally-trigger-a-processor-based-on-the-current-nested-iteration-or-execute-a-plugin-in-script/262288 "2021-02-16T16:17:48Z")
Is there a way to process an attachment conditionally for a nested object that's represented by an array? I looked into the foreach processor with a conditional if, but the ctx object does not appear to hold a reference… --- ## [Security agent tuning](https://discuss.elastic.co/t/security-agent-tuning/264406)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 3:51pm UTC](https://discuss.elastic.co/t/security-agent-tuning/264406 "2021-02-16T15:51:36Z")
I have the agent running on some Linux servers and it generates about 15M process events within a 24 hour period. Is there a way to tune this as its consumes a lot of storage with data that is not very useful. Also, are… --- ## [Duplicate Issue - document\_id, how to prevent overwriting of entries](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404)
**Author:** [@Sampson\_Light](https://discuss.elastic.co/u/Sampson_Light)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 1:44pm UTC](https://discuss.elastic.co/t/duplicate-issue-document-id-how-to-prevent-overwriting-of-entries/264404 "2021-02-16T13:44:57Z")
Hi All, Some background information: I have duplicate entries in my elasticsearch indexes. Have used document\_id which prevented duplicates from appearing. But the issue with this is that it overwrites and updates the… --- ## [Highlight query in URI](https://discuss.elastic.co/t/highlight-query-in-uri/263543)
**Author:** [@vikram\_singh](https://discuss.elastic.co/u/vikram_singh)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:39pm UTC](https://discuss.elastic.co/t/highlight-query-in-uri/263543 "2021-02-16T13:39:11Z")
Hi, I want to use highlight in URI query. Ex. http://myservername.com:9200/myindex/\_search?q=myfieldname:searchvalue&highlight=myfieldname But this is not working. I want to use URI search with highlight but not get… --- ## [Issue with Endgame lab](https://discuss.elastic.co/t/issue-with-endgame-lab/264298)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 1:19pm UTC](https://discuss.elastic.co/t/issue-with-endgame-lab/264298 "2021-02-16T13:19:01Z")
Hi, In the Elastic Endgame free training, Strigo Lab: http://ec2-3-64-54-139.eu-central-1.compute.amazonaws.com/instructions/labs.html#\_lab\_1\_elastic\_endgame\_sensor\_deployment In the very first part when you cat /hom… --- ## [Dead letter queue not printing logs for events failed to get indexed in Elasticsearch](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967)
**Author:** [@ankitdevnalkar](https://discuss.elastic.co/u/ankitdevnalkar)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:42pm UTC](https://discuss.elastic.co/t/dead-letter-queue-not-printing-logs-for-events-failed-to-get-indexed-in-elasticsearch/263967 "2021-02-16T12:42:30Z")
Objective: print log/event in a log file which are failed to index in Elasticsearch. I am ingesting logs via SQS input and few messages are getting failed to index in Elasticsearch. I have debug logs and it shows the fo… --- ## [Difference between sharing dashboard as snapshot and saved object](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385)
**Author:** [@BitBucketUser\_user](https://discuss.elastic.co/u/BitBucketUser_user)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:33pm UTC](https://discuss.elastic.co/t/difference-between-sharing-dashboard-as-snapshot-and-saved-object/264385 "2021-02-16T12:33:23Z")
Hello All, I use Kibana version 7.9.0. I would like to know the actual difference between sharing/embedding a dashboard URL as a snapshot or a saved object According to the pop-up info : For snapshot, the pop-up says… --- ## [It seems mapping update for "date\_range" field type is not idempotent](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034)
**Author:** [@0bivan](https://discuss.elastic.co/u/0bivan)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 12:21pm UTC](https://discuss.elastic.co/t/it-seems-mapping-update-for-date-range-field-type-is-not-idempotent/263034 "2021-02-16T12:21:49Z")
Hi. Want to confirm the issue before posting it on github. ES does not allow to update date\_range field with exact same mapping settings and responds with 500. Tried with docker container (https://hub.docker.com/\_/elasti… --- ## [Logstash pipeline output and elastic cloud](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659)
**Author:** [@alfredo.deluca](https://discuss.elastic.co/u/alfredo.deluca)\ **Replies:** 10\ **Last updated:** [February 16, 2021, 12:17pm UTC](https://discuss.elastic.co/t/logstash-pipeline-output-and-elastic-cloud/263659 "2021-02-16T12:17:29Z")
Hi all. I have elastic cloud 7.10.2 and we are setting up logstash with a pipilne with input/filter/output. Also we are using helm to deploy. Of course I have cloud.id and cloud.auth and not sure how to configure the … --- ## [Create new field from query](https://discuss.elastic.co/t/create-new-field-from-query/263892)
**Author:** [@paasi6666](https://discuss.elastic.co/u/paasi6666)\ **Replies:** 17\ **Last updated:** [February 16, 2021, 11:57am UTC](https://discuss.elastic.co/t/create-new-field-from-query/263892 "2021-02-16T11:57:03Z")
I got a query which creates a new field sophos.utm.to.domain. That query extracts the full mail domain. The mail address which is stored in sophos.utm.to. My Question: How do I create a new field out of this query? --- ## [Aggregating sequence of connected events](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421)
**Author:** [@steff1](https://discuss.elastic.co/u/steff1)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 11:25am UTC](https://discuss.elastic.co/t/aggregating-sequence-of-connected-events/264421 "2021-02-16T11:25:48Z")
Lets say I have events like this in my log {type:"approval\_revokation", approval\_id=22} {type:"approval", request\_id=12, approval\_id=22} {type:"control3", request\_id=12} {type:"control2", request\_id=12} {type:"control1"… --- ## [How to debug suggest queries](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396)
**Author:** [@Fabrizio\_Fortino](https://discuss.elastic.co/u/Fabrizio_Fortino)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 9:16am UTC](https://discuss.elastic.co/t/how-to-debug-suggest-queries/264396 "2021-02-16T09:16:27Z")
I have a suggest query that is not returning a document and I would like to understand the reason. Is there any way to debug why this happens? I tried using the explain API but this does not return back any useful inform… --- ## [“Error” message creates a pop-up \[esaggs\]\>](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803)
**Author:** [@gulshann](https://discuss.elastic.co/u/gulshann)\ **Replies:** 5\ **Last updated:** [February 16, 2021, 11:15am UTC](https://discuss.elastic.co/t/error-message-creates-a-pop-up-esaggs/260803 "2021-02-16T11:15:18Z")
Hi, if I am ideal for more than 10 minutes and then try to interact Dashboard then I am getting a error pop up msg in my widget. I am using kibana v 7.10 --- ## [How to build visualizations based on String fields](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 10:42am UTC](https://discuss.elastic.co/t/how-to-build-visualizations-based-on-string-fields/264000 "2021-02-16T10:42:52Z")
Hi there. I am trying to figure out a way to work with our data in kibana. Problem is, even tough we have a lot of diffrent lines within the Payload part of our logs wich means its kind of difficult to build filters in … --- ## [Graph Synonym search case sensitive](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094)
**Author:** [@sagar.pattnayak](https://discuss.elastic.co/u/sagar.pattnayak)\ **Replies:** 3\ **Last updated:** [February 16, 2021, 10:11am UTC](https://discuss.elastic.co/t/graph-synonym-search-case-sensitive/264094 "2021-02-16T10:11:44Z")
Hi I have applied graph synonym search and it is working as expected when ever I search on lowercase. However the moment i change the keyword to upper case it is not working as expected. For example I have the terms la… --- ## [How to add multiple filter in Search template](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132)
**Author:** [@sagarpatel](https://discuss.elastic.co/u/sagarpatel)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 9:45am UTC](https://discuss.elastic.co/t/how-to-add-multiple-filter-in-search-template/264132 "2021-02-16T09:45:57Z")
Hi, I am trying to create search template which will support the multiple term filter for different fields. I have created search template but facing issue for adding comm after each filter. in current case if all the f… --- ## [Shards getting bigger with updates (same number of documents)](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329)
**Author:** [@marcineq](https://discuss.elastic.co/u/marcineq)\ **Replies:** 13\ **Last updated:** [February 16, 2021, 8:42am UTC](https://discuss.elastic.co/t/shards-getting-bigger-with-updates-same-number-of-documents/264329 "2021-02-16T08:42:23Z")
Hi all I have a ES 7 cluster of couple of EC2 instances, the index has 6 shards and each shard has 2 replicas (so 1+2 x 6 = 18 shards for an index). When I create the index each shard size is around 25-30gb and we hold … --- ## [Top\_hits aggregation performance problem](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336)
**Author:** [@ozgun](https://discuss.elastic.co/u/ozgun)\ **Replies:** 1\ **Last updated:** [February 16, 2021, 8:31am UTC](https://discuss.elastic.co/t/top-hits-aggregation-performance-problem/264336 "2021-02-16T08:31:51Z")
Hello everyone, I've a query which returns response in 3k-4k ms. When i remove top\_hits aggregations it reduces to 60-70 ms. Why is top\_hits aggregation so slow? How can i speed up my query? Is there any alternative to … --- ## [Strigo environment for Elastic Eingineer I server1-20](https://discuss.elastic.co/t/strigo-environment-for-elastic-eingineer-i-server1-20/264319)
**Author:** [@rhys](https://discuss.elastic.co/u/rhys)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 7:58am UTC](https://discuss.elastic.co/t/strigo-environment-for-elastic-eingineer-i-server1-20/264319 "2021-02-16T07:58:15Z")
Hello, I am using the Strigo env with the Elastic Engineer I course. In /etc/hosts we have the details for server1-20 (as well as a host named db\_server). I wanted to have a go at setting up a large cluster with special… --- ## [Pin ES Documents at specific position](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386)
**Author:** [@Venkata\_Naresh](https://discuss.elastic.co/u/Venkata_Naresh)\ **Replies:** 0\ **Last updated:** [February 16, 2021, 7:21am UTC](https://discuss.elastic.co/t/pin-es-documents-at-specific-position/264386 "2021-02-16T07:21:39Z")
I have some documents in ES Index in which I have a requirement to pin the documents at specific index positions irrespective of their score based on the ids. I tried pinned query but it fetching and pinning the documen… --- ## [\[SQL Translate API\] Wrong query generated when querying for nested fields](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083)
**Author:** [@Abhilash\_B](https://discuss.elastic.co/u/Abhilash_B)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 6:32am UTC](https://discuss.elastic.co/t/sql-translate-api-wrong-query-generated-when-querying-for-nested-fields/264083 "2021-02-16T06:32:24Z")
Hi folks, I have an index with documents that are customer centric. Every document has customer ID, array of orders, within orders array we have an items array. Both orders and items fields are of type nested. There is … --- ## [Feature Requests](https://discuss.elastic.co/t/feature-requests/264276)
**Author:** [@fchiorascu](https://discuss.elastic.co/u/fchiorascu)\ **Replies:** 2\ **Last updated:** [February 16, 2021, 6:22am UTC](https://discuss.elastic.co/t/feature-requests/264276 "2021-02-16T06:22:19Z")
Hi, Dear Product team, below are some kind feature requests: In Stack Monitoring view of Elastic Stack it will be a great feature to have a maturity overall index of the stack deployed/installed having the acceptance… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1045) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1047)