# \#none **URL:** https://discuss.elastic.co/tag/none.md?no_tags=true&page=912 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 913 --- ## [Nested Query Filter](https://discuss.elastic.co/t/nested-query-filter/276160)
**Author:** [@SAMBUDDHA\_CHAUDHURI](https://discuss.elastic.co/u/SAMBUDDHA_CHAUDHURI)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 3:37pm UTC](https://discuss.elastic.co/t/nested-query-filter/276160 "2021-06-16T15:37:23Z")
Currently I am trying to search/filter a nested Document in Elastic Search Spring Data. The Current Document Structure is: { "id": 1, "customername": "Cust@123", "policydetails": { "address": { "city": … --- ## [Change colors for each result on stacked bar?](https://discuss.elastic.co/t/change-colors-for-each-result-on-stacked-bar/275598)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 7\ **Last updated:** [June 16, 2021, 3:24pm UTC](https://discuss.elastic.co/t/change-colors-for-each-result-on-stacked-bar/275598 "2021-06-16T15:24:20Z")
Hello I have stacked bar that is showing me success logons and failed logons. I want them to be different colors than the default but I dont see where I can change that. How do I do it? --- ## [Logstash Extract Elasticsearch Nested Fields](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 28\ **Last updated:** [June 16, 2021, 2:13pm UTC](https://discuss.elastic.co/t/logstash-extract-elasticsearch-nested-fields/275451 "2021-06-16T14:13:37Z")
Hello Team I am using Elasticsearch version 7.8.0 and Logstash version 7.8.0 I am having ES Index having following mappings : "mappings" : { "properties" : { "appEvents" : { "properties" : … --- ## [Convert a legacy template into a composable template?](https://discuss.elastic.co/t/convert-a-legacy-template-into-a-composable-template/276145)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 1:06pm UTC](https://discuss.elastic.co/t/convert-a-legacy-template-into-a-composable-template/276145 "2021-06-16T13:06:07Z")
Hello There is a legacy template with a lot of good default mappings that I want to use as a base (a base template, even though it is rudundent) That being said, I want to use it as a composable template. Is there a wa… --- ## [Check whether document returned is from a read or a write index](https://discuss.elastic.co/t/check-whether-document-returned-is-from-a-read-or-a-write-index/276133)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 12:48pm UTC](https://discuss.elastic.co/t/check-whether-document-returned-is-from-a-read-or-a-write-index/276133 "2021-06-16T12:48:58Z")
I have a requirement where I want to delete the documents which match the query but only if they are in the read index , if it is in a write index I don't want the documents to be deleted. Below query deletes irrespecti… --- ## [Filtering Rules according to "Last response" Field](https://discuss.elastic.co/t/filtering-rules-according-to-last-response-field/275743)
**Author:** [@inf](https://discuss.elastic.co/u/inf)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 12:37pm UTC](https://discuss.elastic.co/t/filtering-rules-according-to-last-response-field/275743 "2021-06-16T12:37:43Z")
Hi there, As I understand, there are 3 kinds of Last response for rules - Succeeded, Warning, and Failure. I would like to filter rules according to just these 3 statuses. It appears that there is currently no way of d… --- ## [Higher CPU vs Higher Memory. Which helps in what cases?](https://discuss.elastic.co/t/higher-cpu-vs-higher-memory-which-helps-in-what-cases/272798)
**Author:** [@Aurel\_Drejta](https://discuss.elastic.co/u/Aurel_Drejta)\ **Replies:** 23\ **Last updated:** [June 16, 2021, 12:33pm UTC](https://discuss.elastic.co/t/higher-cpu-vs-higher-memory-which-helps-in-what-cases/272798 "2021-06-16T12:33:32Z")
Hi everyone, What are the cases where a higher CPU and/or faster CPU benefits the cluster more than higher memory? I am currently running on 3 Nodes that are 8 CPU 16GB RAM configurations. I will scale the cluster fir… --- ## [Highlighting | Fragments | Order:Score --- is it possible to get the score of every fragment?](https://discuss.elastic.co/t/highlighting-fragments-order-score-is-it-possible-to-get-the-score-of-every-fragment/276137)
**Author:** [@edyas](https://discuss.elastic.co/u/edyas)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 12:20pm UTC](https://discuss.elastic.co/t/highlighting-fragments-order-score-is-it-possible-to-get-the-score-of-every-fragment/276137 "2021-06-16T12:20:11Z")
When using Highlighting, fragments can be sorted by their respective score, which is a very useful feature. But is there any way to get their individual score (which must be calculated in the background for the sorting)… --- ## [Date Logstash](https://discuss.elastic.co/t/date-logstash/275816)
**Author:** [@Krunal](https://discuss.elastic.co/u/Krunal)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 12:07pm UTC](https://discuss.elastic.co/t/date-logstash/275816 "2021-06-16T12:07:21Z")
Hello Expert, I would like convert date into timestamp which is mention below.. I dont have any column with reference to date but I have just 1 line in which date is mention. what changes I can do in config file of logs… --- ## [Problem with data merging](https://discuss.elastic.co/t/problem-with-data-merging/274425)
**Author:** [@ravi-shanker](https://discuss.elastic.co/u/ravi-shanker)\ **Replies:** 14\ **Last updated:** [June 16, 2021, 12:02pm UTC](https://discuss.elastic.co/t/problem-with-data-merging/274425 "2021-06-16T12:02:05Z")
Hello All, I am using jdbc input and jdbc\_streaming section in my logstash config to bring data from two different table into the same index. My logstash config is below. input { jdbc { jdbc\_connection\_str… --- ## [Can i connect two different (not clustered) elasticsearch hosts to single kibana?](https://discuss.elastic.co/t/can-i-connect-two-different-not-clustered-elasticsearch-hosts-to-single-kibana/275626)
**Author:** [@Kamil\_Siraliyev](https://discuss.elastic.co/u/Kamil_Siraliyev)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 11:20am UTC](https://discuss.elastic.co/t/can-i-connect-two-different-not-clustered-elasticsearch-hosts-to-single-kibana/275626 "2021-06-16T11:20:19Z")
I have 2 different not clustered elasticsearch hosts 192.168.1.10 and 192.168.1.85. The 192.168.1.10 server also has kibana. Question: can i connect both of them to a single kibana? Thanks. --- ## [Filter on multiple indice](https://discuss.elastic.co/t/filter-on-multiple-indice/276042)
**Author:** [@dgastudio](https://discuss.elastic.co/u/dgastudio)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 10:31am UTC](https://discuss.elastic.co/t/filter-on-multiple-indice/276042 "2021-06-16T10:31:34Z")
Hello. i have 2 indices, employee\_profile and employee\_shift a need to create a page, on which one, i have to list all the employees with calendar of shifts for each one right now, i'm doing a request to employee\_prof… --- ## [How to give dashboard filter as input to markdown](https://discuss.elastic.co/t/how-to-give-dashboard-filter-as-input-to-markdown/276016)
**Author:** [@venkatesh\_prasanth](https://discuss.elastic.co/u/venkatesh_prasanth)\ **Replies:** 3\ **Last updated:** [June 16, 2021, 10:01am UTC](https://discuss.elastic.co/t/how-to-give-dashboard-filter-as-input-to-markdown/276016 "2021-06-16T10:01:34Z")
Hello, I want to automatically update the markdown query input from the filter given in dashboard. what ever i give filter on that dashboard should be automatically given input to markdown so that i cant see the filter … --- ## [Concatenate log](https://discuss.elastic.co/t/concatenate-log/275968)
**Author:** [@cassiopee](https://discuss.elastic.co/u/cassiopee)\ **Replies:** 4\ **Last updated:** [June 16, 2021, 9:18am UTC](https://discuss.elastic.co/t/concatenate-log/275968 "2021-06-16T09:18:07Z")
hello, I have a beats log, who are concatenate and special characters. I wanted request one of this field but I supposed my request is blocked because a bad syntax. { "user" =\> { "name" =\> "AD-WSUS… --- ## [How to create autoincremented Id (integer) in Elasticsearch?](https://discuss.elastic.co/t/how-to-create-autoincremented-id-integer-in-elasticsearch/276108)
**Author:** [@zeusfsx](https://discuss.elastic.co/u/zeusfsx)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 8:53am UTC](https://discuss.elastic.co/t/how-to-create-autoincremented-id-integer-in-elasticsearch/276108 "2021-06-16T08:53:06Z")
Hi, I\`m interested in how to create autoincremented Id (integer) in Elasticsearch, or maybe someone knows how to create autoincrement field with the script when added a new document into the index? --- ## [Jdbc\_streaming parameters on From](https://discuss.elastic.co/t/jdbc-streaming-parameters-on-from/276104)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 8:29am UTC](https://discuss.elastic.co/t/jdbc-streaming-parameters-on-from/276104 "2021-06-16T08:29:37Z")
I've seen documentation about using parameters as statement =\> "select \* from WORLD.COUNTRY WHERE Code = :code" parameters =\> { "code" =\> "country\_code"} But I'm in situation where I have 9 different cases and … --- ## [CSV reports](https://discuss.elastic.co/t/csv-reports/275796)
**Author:** [@Andrejs\_G](https://discuss.elastic.co/u/Andrejs_G)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 8:15am UTC](https://discuss.elastic.co/t/csv-reports/275796 "2021-06-16T08:15:57Z")
Hi, I'm new in Elasticsearch, don't know if it is some kind bug or just need to enable something. Problem is that when I generate CSV file it always contains only one row, doesn't mater if I want to export search with 20… --- ## [Logstash filter jdbc\_streaming : JDBC:AdapterNotFound: Could not load jdbc/mssql adapter: adapter class not registered in ADAPTER\_MAP\>](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-jdbc-could-not-load-jdbc-mssql-adapter-adapter-class-not-registered-in-adapter-map/275546)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 7\ **Last updated:** [June 16, 2021, 8:00am UTC](https://discuss.elastic.co/t/logstash-filter-jdbc-streaming-jdbc-could-not-load-jdbc-mssql-adapter-adapter-class-not-registered-in-adapter-map/275546 "2021-06-16T08:00:13Z")
I'm trying to use logstash filter plugin jdbc\_streaming, my logstash version is 7.13 OS centos 7 openjdk 11.0.11 2021-04-20 LTS jdbc 6.0 : "/home/jdbc/sqljdbc\_6.0/enu/jre7/sqljdbc41.jar" my logstash config input {… --- ## [How to export a scripted field in the elasticsearch-output-plugin](https://discuss.elastic.co/t/how-to-export-a-scripted-field-in-the-elasticsearch-output-plugin/276091)
**Author:** [@fidsamurai](https://discuss.elastic.co/u/fidsamurai)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 7:12am UTC](https://discuss.elastic.co/t/how-to-export-a-scripted-field-in-the-elasticsearch-output-plugin/276091 "2021-06-16T07:12:42Z")
I've written a scripted field to standardise and create a shorthand for URLs. However from what I understood in the docs we can't use it as a keyword field, also it works only on Kibana and not if I try and get data dir… --- ## [Kibana upgrade from 7.12.0 to 7.13.1 is failing](https://discuss.elastic.co/t/kibana-upgrade-from-7-12-0-to-7-13-1-is-failing/275680)
**Author:** [@Vincent\_Uribe](https://discuss.elastic.co/u/Vincent_Uribe)\ **Replies:** 8\ **Last updated:** [June 16, 2021, 6:19am UTC](https://discuss.elastic.co/t/kibana-upgrade-from-7-12-0-to-7-13-1-is-failing/275680 "2021-06-16T06:19:01Z")
Hi, I have been trying to upgrade kibana for a few days ow and it does not work. I have the following error : {"type":"log","@timestamp":"2021-06-11T10:10:39+00:00","tags":\["info","savedobjects-service"\],"pid":27709,"m… --- ## [Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion to rational from nil"](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370)
**Author:** [@AmitC](https://discuss.elastic.co/u/AmitC)\ **Replies:** 6\ **Last updated:** [June 16, 2021, 6:00am UTC](https://discuss.elastic.co/t/exception-in-pipelineworker-the-pipeline-stopped-processing-new-events-please-check-your-filter-configuration-and-restart-logstash-pipeline-id-main-exception-no-implicit-conversion-to-rational-from-nil/275370 "2021-06-16T06:00:14Z")
Logstash Version : 6.1.1 Exception in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {:pipeline\_id=\>"main", "exception"=\>"no implicit conversion… --- ## [One configuration file (single pipeline) or mutiple configuration files (various pipelines)?](https://discuss.elastic.co/t/one-configuration-file-single-pipeline-or-mutiple-configuration-files-various-pipelines/276080)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [June 16, 2021, 5:40am UTC](https://discuss.elastic.co/t/one-configuration-file-single-pipeline-or-mutiple-configuration-files-various-pipelines/276080 "2021-06-16T05:40:06Z")
Hello Currently I have multiple configuration files, each listening on their own port and with their filters. Would it be better to merge it all in one and using conditionals, filter out, do transformations needed and … --- ## [Sort doesn't work with delete by query](https://discuss.elastic.co/t/sort-doesnt-work-with-delete-by-query/276074)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 5:33am UTC](https://discuss.elastic.co/t/sort-doesnt-work-with-delete-by-query/276074 "2021-06-16T05:33:01Z")
Iam trying to delete the oldest document in the alias by using sort ,but this deletes all the documents that matches the query. Is sort not supported by delete by query? Is there any other option to use in the delete by… --- ## [Kibana shows sometimes 503 license not available (due to timeout after 30000ms)](https://discuss.elastic.co/t/kibana-shows-sometimes-503-license-not-available-due-to-timeout-after-30000ms/274726)
**Author:** [@Anatolij](https://discuss.elastic.co/u/Anatolij)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:24am UTC](https://discuss.elastic.co/t/kibana-shows-sometimes-503-license-not-available-due-to-timeout-after-30000ms/274726 "2021-06-16T05:24:06Z")
Hello, I already saw a few errors about 503 license not available. But none of these matched my error. I only see the 503 license not available randomly on a few requests. Sometimes i have to wait the 30000ms loading t… --- ## [Error Loading Data - Authorization Exception (Kibana dashboard)](https://discuss.elastic.co/t/error-loading-data-authorization-exception-kibana-dashboard/274916)
**Author:** [@Sandun\_Akalanka](https://discuss.elastic.co/u/Sandun_Akalanka)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 5:07am UTC](https://discuss.elastic.co/t/error-loading-data-authorization-exception-kibana-dashboard/274916 "2021-06-16T05:07:26Z")
I have a Kibana dashboard inside an AWS ElasticSearch domain (which includes both ES and Kibana). It used to work fine, until a few days ago. I have been receiving this warning message whenever I try to view data on Kiba… --- ## [When I set up the template file and used logstash to create the index, I got an error](https://discuss.elastic.co/t/when-i-set-up-the-template-file-and-used-logstash-to-create-the-index-i-got-an-error/275913)
**Author:** [@Masanori\_Mishima](https://discuss.elastic.co/u/Masanori_Mishima)\ **Replies:** 6\ **Last updated:** [June 16, 2021, 4:25am UTC](https://discuss.elastic.co/t/when-i-set-up-the-template-file-and-used-logstash-to-create-the-index-i-got-an-error/275913 "2021-06-16T04:25:11Z")
The execution environment is shown below. I would like to create an index by specifying mapping in a json file with index template set from logstash. How can I do this? logstash-7.13.0 Settings in the conf file inpu… --- ## [Delete from read indexes](https://discuss.elastic.co/t/delete-from-read-indexes/275919)
**Author:** [@Deepti](https://discuss.elastic.co/u/Deepti)\ **Replies:** 11\ **Last updated:** [June 16, 2021, 3:45am UTC](https://discuss.elastic.co/t/delete-from-read-indexes/275919 "2021-06-16T03:45:30Z")
Hello, I have a current write index and multiple read indexes .Is it possible to delete the documents from only the read indexes? Document with same ID will be present in both read and write index but I want the documen… --- ## [Just tried out ELK stack v7.13 but found two issues](https://discuss.elastic.co/t/just-tried-out-elk-stack-v7-13-but-found-two-issues/276068)
**Author:** [@vincetai](https://discuss.elastic.co/u/vincetai)\ **Replies:** 7\ **Last updated:** [June 16, 2021, 1:57am UTC](https://discuss.elastic.co/t/just-tried-out-elk-stack-v7-13-but-found-two-issues/276068 "2021-06-16T01:57:13Z")
I moved from ELK v6.8.16 to ELK v7.13.2 and found the following issues: - In v6.8.16, when I removed a namespace, Kibana could show such event but it is not happening in v7.13.2 The navigation on Kibana web is faster i… --- ## [Will adding filters make visualizations more responsive?](https://discuss.elastic.co/t/will-adding-filters-make-visualizations-more-responsive/276067)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 2\ **Last updated:** [June 16, 2021, 1:21am UTC](https://discuss.elastic.co/t/will-adding-filters-make-visualizations-more-responsive/276067 "2021-06-16T01:21:57Z")
We have a visualization where we are using the term aggregation. Suppose there are 10000 records in the source index and out of that 1000 records have the field on which we will be doing term aggregration. I am just won… --- ## [How to show max count of last three days with 1 hour time bucket?](https://discuss.elastic.co/t/how-to-show-max-count-of-last-three-days-with-1-hour-time-bucket/275891)
**Author:** [@baragonte](https://discuss.elastic.co/u/baragonte)\ **Replies:** 1\ **Last updated:** [June 16, 2021, 12:22am UTC](https://discuss.elastic.co/t/how-to-show-max-count-of-last-three-days-with-1-hour-time-bucket/275891 "2021-06-16T00:22:49Z")
I have to create a visualization where I want the peak of the number of docs by hour every day for the last 3 days. I was able to show the peak but I can't show the correct timestamp. Is there any way I can show the time… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=911) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=913)