# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=716 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 717 --- ## [Cannot search on field \[log.original\] since it is not indexed](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897)
**Author:** [@mevan](https://discuss.elastic.co/u/mevan)\ **Replies:** 12\ **Last updated:** [February 1, 2022, 9:32pm UTC](https://discuss.elastic.co/t/cannot-search-on-field-log-original-since-it-is-not-indexed/295897 "2022-02-01T21:32:09Z")
Hi --I am not sure how to diagnose this issue. My searching has offered no results. When I try to refine my iptables query with \> log.original: "ID=1234" I get the error: failed to create query: Cannot search on field … --- ## [Highlight exact phrases/keywords](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982)
**Author:** [@Fidel\_Perez](https://discuss.elastic.co/u/Fidel_Perez)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:40pm UTC](https://discuss.elastic.co/t/highlight-exact-phrases-keywords/295982 "2022-02-01T18:40:50Z")
hello everyone I want to highlight the query match but to be an exact match when words or phrases { "body": { "highlight": { "fields": { "textContent": { "fragment\_size": 150, "n… --- ## [Convert Appsearch query to Elasticsearch query](https://discuss.elastic.co/t/convert-appsearch-query-to-elasticsearch-query/292795)
**Author:** [@ammarhaider](https://discuss.elastic.co/u/ammarhaider)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:03pm UTC](https://discuss.elastic.co/t/convert-appsearch-query-to-elasticsearch-query/292795 "2022-02-01T21:03:11Z")
I am using Appsearch/Enterprise search at the frontend, but I need some heavy processing / complex queries to be made at the backend for which I need more control. And as per my understanding appsearch is basically a wra… --- ## [Error when trying to reindex old indices thru Kibana 7.0 Upgrade Assistant](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362)
**Author:** [@willdennis](https://discuss.elastic.co/u/willdennis)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:58pm UTC](https://discuss.elastic.co/t/error-when-trying-to-reindex-old-indices-thru-kibana-7-0-upgrade-assistant/295362 "2022-02-01T20:58:50Z")
Getting this error when trying to reindex old indexes (which were created in 5.6.x) thru Kibana's 7.0 Upgrade Assistant: \[mapper\_parsing\_exception\]\[include\_in\_all\] is not allowed for indices created on or after version … --- ## [Getting different results for the same query](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997)
**Author:** [@hamzahda](https://discuss.elastic.co/u/hamzahda)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 8:53pm UTC](https://discuss.elastic.co/t/getting-different-results-for-the-same-query/295997 "2022-02-01T20:53:24Z")
When I execute this search with Postmn or the Elastic console I get different results as when I do it in a script using axios any ideas.. {"query":{"exists":{"field":"RefreshOrderNo"}}} I can't share the whole data eca… --- ## [Failed to start Elasticsearch in AlmaLinux](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995)
**Author:** [@MBekhit](https://discuss.elastic.co/u/MBekhit)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 8:24pm UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-in-almalinux/295995 "2022-02-01T20:24:07Z")
Elasticsearch stopped working and this is a error log Feb 1 20:17:25 server33 systemd\[1\]: Starting Elasticsearch... Feb 1 20:17:30 server33 systemd-entrypoint\[93293\]: encountered \[2\] errors parsing \[/etc/elasticsearch… --- ## [ELK - Elasticsearch nodes High CPU](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373)
**Author:** [@aumthanki](https://discuss.elastic.co/u/aumthanki)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 7:44pm UTC](https://discuss.elastic.co/t/elk-elasticsearch-nodes-high-cpu/295373 "2022-02-01T19:44:05Z")
Setup: 3 nodes in Azure. 2 masters and one voting\_only. Info: (Nodes) { "name" : "\<\>", "cluster\_name" : "\<\>", "cluster\_uuid" : "\<\>", "version" : { "number" : "7.16.1", "build\_flavor" : "default", "… --- ## [Multiple Count Aggregations With Multiple Fields](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909)
**Author:** [@bsmith](https://discuss.elastic.co/u/bsmith)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 7:29pm UTC](https://discuss.elastic.co/t/multiple-count-aggregations-with-multiple-fields/293909 "2022-02-01T19:29:48Z")
Is it possible to filter individual Count aggregations? I'm trying to get a count of all items that were opened in a month vs all items that were closed in a month. Each document will have an OPEN\_DT field and if closed … --- ## [Splitting the log into a csv file](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922)
**Author:** [@PanPiotr](https://discuss.elastic.co/u/PanPiotr)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 6:08pm UTC](https://discuss.elastic.co/t/splitting-the-log-into-a-csv-file/295922 "2022-02-01T18:08:31Z")
Hi, I want to use logstash to separate the appropriate logs by a constant value appearing in these logs, and then divide the log into pieces after the separator ("|") and put it into a csv file with headers. The logs I'… --- ## [Kibana Lens/Line customizations](https://discuss.elastic.co/t/kibana-lens-line-customizations/295783)
**Author:** [@GustavoEH](https://discuss.elastic.co/u/GustavoEH)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 6:03pm UTC](https://discuss.elastic.co/t/kibana-lens-line-customizations/295783 "2022-02-01T18:03:44Z")
Hello, I created a Line view in Kibana to see the data I'm getting from different exchanges, but I' having difficulties to customize the view. As I don't have much experience with Kibana, now I'm not sure if Lens/Line i… --- ## [SQL query does not work in filter bar of visualization](https://discuss.elastic.co/t/sql-query-does-not-work-in-filter-bar-of-visualization/295909)
**Author:** [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 5:49pm UTC](https://discuss.elastic.co/t/sql-query-does-not-work-in-filter-bar-of-visualization/295909 "2022-02-01T17:49:20Z")
Hi all, I want to use SQL query just as KQL query in Query filter bar to build visualizations and dashboards. But the Query does not work in filter bar even after installing SQL plugin. Any ideas? --- ## [Elastic config file revert to default](https://discuss.elastic.co/t/elastic-config-file-revert-to-default/295955)
**Author:** [@Gamliel\_Alon](https://discuss.elastic.co/u/Gamliel_Alon)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 3:23pm UTC](https://discuss.elastic.co/t/elastic-config-file-revert-to-default/295955 "2022-02-01T15:23:23Z")
Hi after installing security patches on ubuntu 18.04 the yml config file was revert to default like all was commented again on the logs I see this see this: Setting up linux-cloud-tools-common (4.15.0-166.174) ... S… --- ## [Count equal element in array](https://discuss.elastic.co/t/count-equal-element-in-array/295925)
**Author:** [@meyer1](https://discuss.elastic.co/u/meyer1)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 4:27pm UTC](https://discuss.elastic.co/t/count-equal-element-in-array/295925 "2022-02-01T16:27:57Z")
Hello everyone ! I need help. I have boolean field "sendSMS" with many values, for exemple : sendSMS : \[true , false, true\] and i want use scripted field to count the number of "true" in my field. Thanks in advance … --- ## [Kibana 7.16 sorts split slices in alphabetical order and not according to filter sequence](https://discuss.elastic.co/t/kibana-7-16-sorts-split-slices-in-alphabetical-order-and-not-according-to-filter-sequence/295684)
**Author:** [@Opti](https://discuss.elastic.co/u/Opti)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 3:55pm UTC](https://discuss.elastic.co/t/kibana-7-16-sorts-split-slices-in-alphabetical-order-and-not-according-to-filter-sequence/295684 "2022-02-01T15:55:23Z")
Hi, I have some dashboards that were created in Kibana 7.10 that use a count aggregation with filters as split slices within a bucket. The split slices each have a label with a description. WIthin version 7.10, this wou… --- ## [Использование одного и того же nested документа в разных корневых документах](https://discuss.elastic.co/t/nested/295957)
**Author:** [@Oleksandr](https://discuss.elastic.co/u/Oleksandr)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 3:49pm UTC](https://discuss.elastic.co/t/nested/295957 "2022-02-01T15:49:29Z")
Индекс имеет вид: PUT company { "settings": { "index": { "number\_of\_shards": 1, "number\_of\_replicas": 1 }, "analysis": { "analyzer": { "analyzer-name": { "type": "custom… --- ## [Unable to change date format](https://discuss.elastic.co/t/unable-to-change-date-format/295948)
**Author:** [@duanra22](https://discuss.elastic.co/u/duanra22)\ **Replies:** 3\ **Last updated:** [February 1, 2022, 3:05pm UTC](https://discuss.elastic.co/t/unable-to-change-date-format/295948 "2022-02-01T15:05:05Z")
Hello everyone, I've seen several topics with the same problem, however none of the solutions I found worked for me and it's making me crazy because I am sure it should be very simple. To explain the problem, I am usin… --- ## [Elastic search - filter on a field based on the length of that field's contents](https://discuss.elastic.co/t/elastic-search-filter-on-a-field-based-on-the-length-of-that-fields-contents/295883)
**Author:** [@drwiremore](https://discuss.elastic.co/u/drwiremore)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 3:02pm UTC](https://discuss.elastic.co/t/elastic-search-filter-on-a-field-based-on-the-length-of-that-fields-contents/295883 "2022-02-01T15:02:16Z")
Thought this would be easy. I'm searching a data index of data-awsch\*:ls-aws-cloudtrail\* based on event.type that is not one of start, access, info. This is working as intended, but the output is huge. Rather than fil… --- ## [Calculate delta between two ingestions](https://discuss.elastic.co/t/calculate-delta-between-two-ingestions/295938)
**Author:** [@javidr](https://discuss.elastic.co/u/javidr)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 2:39pm UTC](https://discuss.elastic.co/t/calculate-delta-between-two-ingestions/295938 "2022-02-01T14:39:48Z")
Hi Is it possible to validate the difference between two different ingestions (based on timestamp)? It is, i am ingesting some data from my IOT devices, as temperature, humidity, particulate matter (air quality level) … --- ## [Cold/Frozen Tiers on on-premise storage](https://discuss.elastic.co/t/cold-frozen-tiers-on-on-premise-storage/295881)
**Author:** [@BionicSecurityMgr](https://discuss.elastic.co/u/BionicSecurityMgr)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 2:12pm UTC](https://discuss.elastic.co/t/cold-frozen-tiers-on-on-premise-storage/295881 "2022-02-01T14:12:47Z")
Is anyone using on-premise servers/storage for Cold & Frozen data tiers? It's my understanding that these are the options: • AWS S3 • Google Cloud Storage • Azure Blob Storage • Hadoop Distributed File Store (HDFS) … --- ## [Scrolling Search Template in elasticsearch-java 7.16](https://discuss.elastic.co/t/scrolling-search-template-in-elasticsearch-java-7-16/294869)
**Author:** [@jps](https://discuss.elastic.co/u/jps)\ **Replies:** 2\ **Last updated:** [February 1, 2022, 11:32am UTC](https://discuss.elastic.co/t/scrolling-search-template-in-elasticsearch-java-7-16/294869 "2022-02-01T11:32:08Z")
Hi. Recently I've migrated from Elasticsearch-rest-high-level-client to Elasticsearch-java. My question is how can I scroll across SearchTemplateResponse? In SearchTemplateRequest we can put a scroll but it doesn't app… --- ## [Can Elasticsearch provide offsets of highlighted words?](https://discuss.elastic.co/t/can-elasticsearch-provide-offsets-of-highlighted-words/295323)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 11:18am UTC](https://discuss.elastic.co/t/can-elasticsearch-provide-offsets-of-highlighted-words/295323 "2022-02-01T11:18:38Z")
We are having OCRed text of PDFs searchable in Elasticsearch. Also we have stored original PDFs, passing highlighted terms from Elasticsearch in URL and with custom library we highlight the words in PDFs. But we would … --- ## [Does elastic agent(7,16,3) contains all the beats?](https://discuss.elastic.co/t/does-elastic-agent-7-16-3-contains-all-the-beats/295817)
**Author:** [@boyd\_yang](https://discuss.elastic.co/u/boyd_yang)\ **Replies:** 1\ **Last updated:** [January 31, 2022, 3:13pm UTC](https://discuss.elastic.co/t/does-elastic-agent-7-16-3-contains-all-the-beats/295817 "2022-01-31T15:13:05Z")
How to enable the packetbeat in fleet? Should I install and configure packetbeat manually? The agent installed directory contains some beats: --- ## [ELK Alerting for AD logs](https://discuss.elastic.co/t/elk-alerting-for-ad-logs/295823)
**Author:** [@AbdulVaseem](https://discuss.elastic.co/u/AbdulVaseem)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 9:54am UTC](https://discuss.elastic.co/t/elk-alerting-for-ad-logs/295823 "2022-02-01T09:54:24Z")
How to set up an alert when an Admin or Enterprise admin is created on Local AD in kibana --- ## [Лимит на одновременное удаление индексов](https://discuss.elastic.co/t/topic/295923)
**Author:** [@Denis\_Lamanov](https://discuss.elastic.co/u/Denis_Lamanov)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 9:50am UTC](https://discuss.elastic.co/t/topic/295923 "2022-02-01T09:50:18Z")
Добрый день! Есть кластер в котором очень много индексов: некоторые по дням, некоторым по месяцам Сейчас приходится последовательно удалять старые индексы за месяц, т.к. /indexname\_202112\* даёт сильную нагрузку на ФС и… --- ## [Logstash error during configuration](https://discuss.elastic.co/t/logstash-error-during-configuration/295911)
**Author:** [@harsh19](https://discuss.elastic.co/u/harsh19)\ **Replies:** 4\ **Last updated:** [February 1, 2022, 9:22am UTC](https://discuss.elastic.co/t/logstash-error-during-configuration/295911 "2022-02-01T09:22:19Z")
When i Run ./logstash -f logstash-simple.conf then it's give me an error like this, Using bundled JDK: /usr/share/logstash/jdk OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 a… --- ## [Is Delete by query a clean operation?](https://discuss.elastic.co/t/is-delete-by-query-a-clean-operation/295778)
**Author:** [@yash\_196](https://discuss.elastic.co/u/yash_196)\ **Replies:** 9\ **Last updated:** [February 1, 2022, 7:02am UTC](https://discuss.elastic.co/t/is-delete-by-query-a-clean-operation/295778 "2022-02-01T07:02:00Z")
Hi Everyone, I wanted to know if delete by query is a clean API? Are the resources (Memory or I/O) released gracefully after the query is complete or does it still hold some resource which might affect perormance? --- ## [Logstash is merging messages sent through http](https://discuss.elastic.co/t/logstash-is-merging-messages-sent-through-http/295905)
**Author:** [@Ruben\_Bracamonte](https://discuss.elastic.co/u/Ruben_Bracamonte)\ **Replies:** 0\ **Last updated:** [February 1, 2022, 6:51am UTC](https://discuss.elastic.co/t/logstash-is-merging-messages-sent-through-http/295905 "2022-02-01T06:51:42Z")
Hi, I have a basic Logstash config with HTTP as input. My API is writing logs every 2-3 seconds, and sometimes on Kibana I can see two messages, with their two timestamps and two different IPs (from the caller), etc in … --- ## [Cannot upload Large CSV file, Timeout](https://discuss.elastic.co/t/cannot-upload-large-csv-file-timeout/295774)
**Author:** [@N\_Q](https://discuss.elastic.co/u/N_Q)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 5:31am UTC](https://discuss.elastic.co/t/cannot-upload-large-csv-file-timeout/295774 "2022-02-01T05:31:25Z")
HI Team, I am evaluating Elasticsearch for its multivariate anomaly detection capabilities on data from Manufacturing systems. I have a dataset which is comma separated but whenever I try to upload the full file(around … --- ## [Create a query with OR & And condition in elasticsearch](https://discuss.elastic.co/t/create-a-query-with-or-and-condition-in-elasticsearch/295799)
**Author:** [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\ **Replies:** 1\ **Last updated:** [February 1, 2022, 1:48am UTC](https://discuss.elastic.co/t/create-a-query-with-or-and-condition-in-elasticsearch/295799 "2022-02-01T01:48:34Z")
Hi, I am trying to convert this sql query to the DSL query to query in Python select count(\*) from dean\_acc\_p\_alm\_asset where (substring(cast(sys\_updated\_on as varchar),1,10) \>= '2021-11-01' and substring(cast(sys\_upda… --- ## [Azure Event Hub, The client could not finish the operation within specified maximum execution timeout](https://discuss.elastic.co/t/azure-event-hub-the-client-could-not-finish-the-operation-within-specified-maximum-execution-timeout/295875)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [January 31, 2022, 8:34pm UTC](https://discuss.elastic.co/t/azure-event-hub-the-client-could-not-finish-the-operation-within-specified-maximum-execution-timeout/295875 "2022-01-31T20:34:31Z")
Hi Im having this Warns when I try to get events from event hub. com.microsoft.azure.storage.StorageException: The client could not finish the operation within specified maximum execution timeout. after those warns I g… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=715) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=717)