# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=780 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 781 --- ## [Calculate the percentage in the table using already aggregated fields](https://discuss.elastic.co/t/calculate-the-percentage-in-the-table-using-already-aggregated-fields/288921)
**Author:** [@Michael\_Derevyanko](https://discuss.elastic.co/u/Michael_Derevyanko)\ **Replies:** 3\ **Last updated:** [November 11, 2021, 9:26am UTC](https://discuss.elastic.co/t/calculate-the-percentage-in-the-table-using-already-aggregated-fields/288921 "2021-11-11T09:26:12Z")
Hi I have a question. Dose it possible to calculate the percentage using already aggregated fields. I have two columns aggregated and grouped by Buckets ( split rows was used): Sum of items (jmeter.count) Sum of item… --- ## [Remove from \_source.fieldA if fieldA is zero](https://discuss.elastic.co/t/remove-from-source-fielda-if-fielda-is-zero/288961)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 7:55am UTC](https://discuss.elastic.co/t/remove-from-source-fielda-if-fielda-is-zero/288961 "2021-11-11T07:55:16Z")
Hi I am using ES 7.10.2 and wanted to remove from existing indices \_source fieldA if fieldA is zero. I tried to use update\_by\_query \> pipeline \> processor \> remove to remove a field if it's value is zero but when I ran… --- ## [Merge matching documents](https://discuss.elastic.co/t/merge-matching-documents/288959)
**Author:** [@samhagin](https://discuss.elastic.co/u/samhagin)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 7:51am UTC](https://discuss.elastic.co/t/merge-matching-documents/288959 "2021-11-11T07:51:09Z")
I have two different indices with matching documents - the \_id field is the same. How can I copy documents from one index to another and overwrite the document at the destination, and also insert a document if it doesn't… --- ## [I need a ES Query equalent to sql count(if(somecondition))](https://discuss.elastic.co/t/i-need-a-es-query-equalent-to-sql-count-if-somecondition/288877)
**Author:** [@Brintha](https://discuss.elastic.co/u/Brintha)\ **Replies:** 4\ **Last updated:** [November 11, 2021, 7:23am UTC](https://discuss.elastic.co/t/i-need-a-es-query-equalent-to-sql-count-if-somecondition/288877 "2021-11-11T07:23:04Z")
Hello, My Question is How to frame Query for 'SELECT EMPLOYEE,COUNT(IF(COUNTRY IN US)) FROM ORG WHERE SOMECRITERIA' --- ## [Don't import duplicates in nested objects](https://discuss.elastic.co/t/dont-import-duplicates-in-nested-objects/288952)
**Author:** [@Lazaro\_O\_Farrill](https://discuss.elastic.co/u/Lazaro_O_Farrill)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 6:27am UTC](https://discuss.elastic.co/t/dont-import-duplicates-in-nested-objects/288952 "2021-11-11T06:27:56Z")
Trying to index a SQL database for a eCommerce. It is divided by store where each store has it's own products. I'm trying to create a schema with the following structure. { name: "store1", products: \[{name: "pro… --- ## [7.15 for multi\_terms](https://discuss.elastic.co/t/7-15-for-multi-terms/288606)
**Author:** [@Alexzkh](https://discuss.elastic.co/u/Alexzkh)\ **Replies:** 2\ **Last updated:** [November 11, 2021, 6:04am UTC](https://discuss.elastic.co/t/7-15-for-multi-terms/288606 "2021-11-11T06:04:52Z")
i used elaticsearch for 7.9.3 ,when I need a method that i can group by multi fields in my aggregations . I find that multi\_terms can combine multi fields and help me complete my aggregation .So I upgrade my dependency w… --- ## [Create and search nested document](https://discuss.elastic.co/t/create-and-search-nested-document/288946)
**Author:** [@Odunayo\_Ogundepo](https://discuss.elastic.co/u/Odunayo_Ogundepo)\ **Replies:** 0\ **Last updated:** [November 11, 2021, 4:51am UTC](https://discuss.elastic.co/t/create-and-search-nested-document/288946 "2021-11-11T04:51:42Z")
Hi, I have a document that looks like this {"rid" : "1", "oid":"23, "data" :{ "ticks": \[{ "a": "xx", "b" : "yy" }, { "a": "xxx"… --- ## [Squarewave type line graph](https://discuss.elastic.co/t/squarewave-type-line-graph/288917)
**Author:** [@mhare](https://discuss.elastic.co/u/mhare)\ **Replies:** 3\ **Last updated:** [November 11, 2021, 3:59am UTC](https://discuss.elastic.co/t/squarewave-type-line-graph/288917 "2021-11-11T03:59:33Z")
Using Stack 7.13.4 I am plotting some binary data (e.g. oscillates between 0 and 1) and I want basically a square wave style graph. I cannot get the transitions from 0 to 1 or from 1 to 0 to show a vertical line. I jus… --- ## [How to export all data from filebeat with specific time range](https://discuss.elastic.co/t/how-to-export-all-data-from-filebeat-with-specific-time-range/288873)
**Author:** [@budums](https://discuss.elastic.co/u/budums)\ **Replies:** 2\ **Last updated:** [November 11, 2021, 2:48am UTC](https://discuss.elastic.co/t/how-to-export-all-data-from-filebeat-with-specific-time-range/288873 "2021-11-11T02:48:32Z")
hi there I already set Elasticsearch, kibana and logstash. and then I already set on client for filebeat to get mysql\_error.log & mysql\_slow.log Currently from filebeat already send to Elasticsearch and I can see usin… --- ## [Need inverted nested mapping](https://discuss.elastic.co/t/need-inverted-nested-mapping/288936)
**Author:** [@elastic\_yogi](https://discuss.elastic.co/u/elastic_yogi)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 11:40pm UTC](https://discuss.elastic.co/t/need-inverted-nested-mapping/288936 "2021-11-10T23:40:40Z")
How do I get search results that have the nested relationships inverted? Do I need to create another index with the nested relationships inverted? Or can I do this in another way with a different type of query and/or mod… --- ## [Date filtering from crash course part 2](https://discuss.elastic.co/t/date-filtering-from-crash-course-part-2/288934)
**Author:** [@iamtheschmitzer](https://discuss.elastic.co/u/iamtheschmitzer)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 11:03pm UTC](https://discuss.elastic.co/t/date-filtering-from-crash-course-part-2/288934 "2021-11-10T23:03:51Z")
In part 2 of the crash course Part-2-Understanding-the-relevance-of-your-search-with-Elasticsearch-and-Kibana-/README.md at main · LisaHJung/Part-2-Understanding-the-relevance-of-your-search-with-Elasticsearch-and-Kibana… --- ## [Customize lens colors in kibana](https://discuss.elastic.co/t/customize-lens-colors-in-kibana/288901)
**Author:** [@mohamed.softparadigm](https://discuss.elastic.co/u/mohamed.softparadigm)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 9:50pm UTC](https://discuss.elastic.co/t/customize-lens-colors-in-kibana/288901 "2021-11-10T21:50:20Z")
By using filters in kibana, i cannot change lens colors, does kibana support this option? --- ## [Field type conflict where indices with conflicting type do not exist](https://discuss.elastic.co/t/field-type-conflict-where-indices-with-conflicting-type-do-not-exist/288788)
**Author:** [@adamsm](https://discuss.elastic.co/u/adamsm)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 9:34pm UTC](https://discuss.elastic.co/t/field-type-conflict-where-indices-with-conflicting-type-do-not-exist/288788 "2021-11-10T21:34:38Z")
Hi We run Kibana on AWS. We are seeing Field type conflict on a few fields, see an example image below: However we have a stack management policy which has already deleted the conflicting indices in question (those … --- ## [Warning After Upgrading to 7.15.2](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927)
**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 9:26pm UTC](https://discuss.elastic.co/t/warning-after-upgrading-to-7-15-2/288927 "2021-11-10T21:26:33Z")
After upgrading a test cluster to 7.15.2 I see this warning when running Kibana queries in Discover constantly: 299 Elasticsearch-7.15.2-93d5a7f6192e8a1a12e154a2b81bf6fa7309da0c "Camel case format name dateOptionalTime … --- ## [CorruptIndexException: checksum status indeterminate](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827)
**Author:** [@tropically](https://discuss.elastic.co/u/tropically)\ **Replies:** 14\ **Last updated:** [November 10, 2021, 9:11pm UTC](https://discuss.elastic.co/t/corruptindexexception-checksum-status-indeterminate/288827 "2021-11-10T21:11:47Z")
Hi We recently had an outage on our openshift clusters. In our Test environment the pods came back up with warnings. The log file shows the following Suppressed: org.apache.lucene.index.CorruptIndexException: checksu… --- ## [Possible for users to specify logical operators (OR. AND) in a field applied to a query?](https://discuss.elastic.co/t/possible-for-users-to-specify-logical-operators-or-and-in-a-field-applied-to-a-query/288926)
**Author:** [@JP\_B](https://discuss.elastic.co/u/JP_B)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 8:14pm UTC](https://discuss.elastic.co/t/possible-for-users-to-specify-logical-operators-or-and-in-a-field-applied-to-a-query/288926 "2021-11-10T20:14:25Z")
I’m building an app to search scientific documents. The abstract from such articles is indexed as a text field. A web front end has input text field to specify keywords which are used in a match query with standard analy… --- ## [How to exclude a specific field in multi get query globally for all docs?](https://discuss.elastic.co/t/how-to-exclude-a-specific-field-in-multi-get-query-globally-for-all-docs/288919)
**Author:** [@Cholley\_Alexandre](https://discuss.elastic.co/u/Cholley_Alexandre)\ **Replies:** 2\ **Last updated:** [November 10, 2021, 8:05pm UTC](https://discuss.elastic.co/t/how-to-exclude-a-specific-field-in-multi-get-query-globally-for-all-docs/288919 "2021-11-10T20:05:03Z")
Hi, I'm trying to exclude a specific field in a multi-get query, but not by specifying \_source ou \_source\_excludes in each doc but globally for all docs, how is it possible? Thank u in advance for your help :wink: --- ## [Winlogbeat to Logstash Load Balancing and Failover](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 7:41pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-load-balancing-and-failover/288902 "2021-11-10T19:41:34Z")
I have two logstash servers. Do I have to choose between load balancing between them all the time vs using one as a fail over? For instance, if I am load balancing winlogbeat output and one of the logstash servers goes … --- ## ['exists' query not working for nested docs with norms=false](https://discuss.elastic.co/t/exists-query-not-working-for-nested-docs-with-norms-false/288256)
**Author:** [@matobaa](https://discuss.elastic.co/u/matobaa)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 7:24pm UTC](https://discuss.elastic.co/t/exists-query-not-working-for-nested-docs-with-norms-false/288256 "2021-11-10T19:24:15Z")
For fields within nested docs with norms disabled, querying for their existence via 'exists' query appears to not be working. It does however work when norms is enabled. curl -XPUT localhost:9200/test -d '{ { "mapping… --- ## [Kibana 7.15.2 Security Update](https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923)
**Author:** [@douglasday](https://discuss.elastic.co/u/douglasday)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 7:18pm UTC](https://discuss.elastic.co/t/kibana-7-15-2-security-update/288923 "2021-11-10T19:18:19Z")
Kibana Path Traversal issue (ESA-2021-26) It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user … --- ## [Webhook body format for threshold term value](https://discuss.elastic.co/t/webhook-body-format-for-threshold-term-value/287894)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [November 10, 2021, 6:59pm UTC](https://discuss.elastic.co/t/webhook-body-format-for-threshold-term-value/287894 "2021-11-10T18:59:55Z")
Hi all. I've just created a webhooks to an internal services that will need to get the value as the result of the signal that a siem threshold rule will produce. Normally for email connector the body will look like thi… --- ## [Attempting to Install template](https://discuss.elastic.co/t/attempting-to-install-template/288899)
**Author:** [@MKirby](https://discuss.elastic.co/u/MKirby)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 6:58pm UTC](https://discuss.elastic.co/t/attempting-to-install-template/288899 "2021-11-10T18:58:54Z")
Good Morning Logstash experts. As most of you know I have been working on injesting and being able to see the syslogs that are being sent directly to my logstash server. When I run a debug on my logstash I see the foll… --- ## [Logstash-keystore.bat not using bundled JDK (Windows)](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 6:05pm UTC](https://discuss.elastic.co/t/logstash-keystore-bat-not-using-bundled-jdk-windows/288719 "2021-11-10T18:05:44Z")
I was trying to setup a keystore and when running .\\logstash-keystore.bat I get a message saying "Using bundled JDK: "" then it says, No 'java.exe' executable found on PATH. I'm running version 7.15.1. The crazy thing is… --- ## [Date (Snapshot) - Month name in English for snapshot policy](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 5:40pm UTC](https://discuss.elastic.co/t/date-snapshot-month-name-in-english-for-snapshot-policy/288885 "2021-11-10T17:40:52Z")
Hi, I want Elasticsearch snapshots named with date in english and date in numerals when they are created. With the following template snapshot\_MMYYYY\_foo Something like this: snapshot\_nov2021\_foo How this can be done… --- ## [Elasticsearch Query discard documents where sum of field is x](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916)
**Author:** [@jjammin92](https://discuss.elastic.co/u/jjammin92)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-query-discard-documents-where-sum-of-field-is-x/288916 "2021-11-10T17:23:56Z")
Hello, I have documents that look like the following: "\_index": "test", "\_type": "\_doc", "\_id": "p767Cn0BpA6tOYGm9B\_P", "\_version": 1, "\_score": null, "\_source": { "path": "entry\_1", "elap\_t": 89, … --- ## [How to count service-down with formula KQL](https://discuss.elastic.co/t/how-to-count-service-down-with-formula-kql/288887)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 1\ **Last updated:** [November 10, 2021, 4:06pm UTC](https://discuss.elastic.co/t/how-to-count-service-down-with-formula-kql/288887 "2021-11-10T16:06:59Z")
Hey there, I am trying to collect monitor event with timeout reached. Heartbeat, according with official docs, will create a service-down. Is there a way to count them? Something like: count(kql='http.response.status… --- ## [ECK on GKE Ingress Health Checks not working](https://discuss.elastic.co/t/eck-on-gke-ingress-health-checks-not-working/288912)
**Author:** [@trudesea](https://discuss.elastic.co/u/trudesea)\ **Replies:** 0\ **Last updated:** [November 10, 2021, 4:03pm UTC](https://discuss.elastic.co/t/eck-on-gke-ingress-health-checks-not-working/288912 "2021-11-10T16:03:53Z")
Hi, So this is my first attempt in getting this working. I was able to get an ingress into Kibana just fine, but using the es-http service as the backend is showing unhealthy. I assume this is because of the path bein… --- ## [Convert duration ms to sec](https://discuss.elastic.co/t/convert-duration-ms-to-sec/288782)
**Author:** [@RickT](https://discuss.elastic.co/u/RickT)\ **Replies:** 3\ **Last updated:** [November 10, 2021, 3:24pm UTC](https://discuss.elastic.co/t/convert-duration-ms-to-sec/288782 "2021-11-10T15:24:25Z")
Today i'm searching how to convert a duration field from ms to sec into a line visualization. as i can't change the advanced params or create a scripted field, i'm trying with the "json input" field but i'm not sure it'… --- ## [Csv filter output splitting a row in two because of some special char](https://discuss.elastic.co/t/csv-filter-output-splitting-a-row-in-two-because-of-some-special-char/288710)
**Author:** [@stillfreem](https://discuss.elastic.co/u/stillfreem)\ **Replies:** 8\ **Last updated:** [November 10, 2021, 2:59pm UTC](https://discuss.elastic.co/t/csv-filter-output-splitting-a-row-in-two-because-of-some-special-char/288710 "2021-11-10T14:59:24Z")
I have a csv file with 7543 entries that I'd like to get to cloud SIEM. My config file is as follows input { file { … --- ## [Bar vertical percentage missing ranges](https://discuss.elastic.co/t/bar-vertical-percentage-missing-ranges/288660)
**Author:** [@adam3](https://discuss.elastic.co/u/adam3)\ **Replies:** 4\ **Last updated:** [November 10, 2021, 2:50pm UTC](https://discuss.elastic.co/t/bar-vertical-percentage-missing-ranges/288660 "2021-11-10T14:50:47Z")
I set up a bar vertical percentage graph with some ranges in it and sometimes the ranges are missing. If I add some filters to the top of my dash they start showing up. Is there a setting I can tweak so these graphs… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=779) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=781)