# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1326 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1327 --- ## [Is it possible for ES to drop every field that's not in mapping upon indexing](https://discuss.elastic.co/t/is-it-possible-for-es-to-drop-every-field-thats-not-in-mapping-upon-indexing/278449)
**Author:** [@R.L](https://discuss.elastic.co/u/R.L)\ **Replies:** 4\ **Last updated:** [July 12, 2021, 6:58pm UTC](https://discuss.elastic.co/t/is-it-possible-for-es-to-drop-every-field-thats-not-in-mapping-upon-indexing/278449 "2021-07-12T18:58:52Z")
Let's say I have a index template mapping which has fields: { "first\_name"..., "last\_name"..., } and someone is uploading docs with fields: { "first\_name": "jon", "last\_name": "connington", "address": "blah… --- ## [Max heap size in nodes elasticsearch](https://discuss.elastic.co/t/max-heap-size-in-nodes-elasticsearch/278444)
**Author:** [@Oskr](https://discuss.elastic.co/u/Oskr)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:41pm UTC](https://discuss.elastic.co/t/max-heap-size-in-nodes-elasticsearch/278444 "2021-07-12T17:41:41Z")
Hi, I have a 3-node architecture with the following roles: "roles" : \[ "ingest", "master", "data", "ml" \] currently each server has 32GB of memory, which means that my nodes have 16GB for elastic. In the last few… --- ## [Kibana Unable to find the process running](https://discuss.elastic.co/t/kibana-unable-to-find-the-process-running/278315)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:20pm UTC](https://discuss.elastic.co/t/kibana-unable-to-find-the-process-running/278315 "2021-07-12T18:20:01Z")
I have started Kibana using nohup ./kibana & but unable to find the same nohup using ps -ef | grep kibana However I do see the nohup.out file is being populated. --- ## [Which mapping data type should be user for particulartText](https://discuss.elastic.co/t/which-mapping-data-type-should-be-user-for-particularttext/278443)
**Author:** [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 6:08pm UTC](https://discuss.elastic.co/t/which-mapping-data-type-should-be-user-for-particularttext/278443 "2021-07-12T18:08:27Z")
Hi, Current Index Mapping is- "question\_prompt": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore\_above": 256 } } … --- ## [Metricbeat http module nested json](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452)
**Author:** [@creativeguitar](https://discuss.elastic.co/u/creativeguitar)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 6:00pm UTC](https://discuss.elastic.co/t/metricbeat-http-module-nested-json/278452 "2021-07-12T18:00:15Z")
I need help regarding elastic search mapping of nested json response. I am using the meatricbeat's http module to query data from our asset management system and I am getting the following response in return "fields": \[… --- ## [Can't reassign shards, all shards currently on same node](https://discuss.elastic.co/t/cant-reassign-shards-all-shards-currently-on-same-node/277794)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 5:38pm UTC](https://discuss.elastic.co/t/cant-reassign-shards-all-shards-currently-on-same-node/277794 "2021-07-12T17:38:27Z")
We are maintaining a 10 node cluster (5 hot nodes with SSD storage and 5 warm nodes with SAS storage, latest Elasticsearch version by the way). The shard allocation for a specific index like looks this: GET \_cat/shards… --- ## [Not able to visualize percentage on pie with signals](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-with-signals/276481)
**Author:** [@saumya1](https://discuss.elastic.co/u/saumya1)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 5:34pm UTC](https://discuss.elastic.co/t/not-able-to-visualize-percentage-on-pie-with-signals/276481 "2021-07-12T17:34:44Z")
{ "$schema":"https://vega.github.io/schema/vega/v5.json", "description":"A basic pie chart example.", "width":200, "height":200, "autosize":"none", "signals":\[ { "name":"startAngle", … --- ## [Drop event in heartbeat](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096)
**Author:** [@guimap](https://discuss.elastic.co/u/guimap)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 5:02pm UTC](https://discuss.elastic.co/t/drop-event-in-heartbeat/278096 "2021-07-12T17:02:02Z")
I would like drop event when namespace is different of "production" I'm using auto discover kubernetes into my heartbeat.yml heartbeat.autodiscover: # Autodiscover services providers: - type: kubernetes resou… --- ## [Retrieving all records from query search without having to use .size -ElasticsSearch](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440)
**Author:** [@NoviceESCoder](https://discuss.elastic.co/u/NoviceESCoder)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 4:53pm UTC](https://discuss.elastic.co/t/retrieving-all-records-from-query-search-without-having-to-use-size-elasticssearch/278440 "2021-07-12T16:53:33Z")
I noticed that when running the following dsl query search on the cli console for ElasticSearch that it will only return a few of the records. If I add a "size": 3000, then I will be able to retrieve more than I original… --- ## [Large number of queued refresh threads on a single node, queue count keeps increasing](https://discuss.elastic.co/t/large-number-of-queued-refresh-threads-on-a-single-node-queue-count-keeps-increasing/278435)
**Author:** [@BradVido](https://discuss.elastic.co/u/BradVido)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 2:41pm UTC](https://discuss.elastic.co/t/large-number-of-queued-refresh-threads-on-a-single-node-queue-count-keeps-increasing/278435 "2021-07-12T14:41:48Z")
I have a 3 node cluster on ES 7.8.1 Once in a while, it seems that the refresh queue gets "stuck" on a node (not always the same node), and the queued number of refresh threads keeps increasing, while the active number … --- ## [The new node cannot add to the cluster but creating a separate new cluster instead](https://discuss.elastic.co/t/the-new-node-cannot-add-to-the-cluster-but-creating-a-separate-new-cluster-instead/278373)
**Author:** [@Zongxian\_Feng](https://discuss.elastic.co/u/Zongxian_Feng)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 2:41pm UTC](https://discuss.elastic.co/t/the-new-node-cannot-add-to-the-cluster-but-creating-a-separate-new-cluster-instead/278373 "2021-07-12T14:41:31Z")
Hi. I am trying to add a new node to an existing cluster(only has one node in it). After configuring in .yml and running the elasticsearch on both nodes, the new node creates a new cluster instead of joining the original… --- ## [Query string boolean operators vs. stop words](https://discuss.elastic.co/t/query-string-boolean-operators-vs-stop-words/276535)
**Author:** [@zsonglorman](https://discuss.elastic.co/u/zsonglorman)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 2:34pm UTC](https://discuss.elastic.co/t/query-string-boolean-operators-vs-stop-words/276535 "2021-07-12T14:34:15Z")
Hello, I'm using a query string query with boolean operators as stated in the docs, like this: ((quick AND fox) OR (brown AND fox) OR fox) AND NOT news This works all right, but I noticed that stop words are not ignore… --- ## [Winlogbeat Keystore Command Not working](https://discuss.elastic.co/t/winlogbeat-keystore-command-not-working/278413)
**Author:** [@Ashwin\_Patil1](https://discuss.elastic.co/u/Ashwin_Patil1)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:00am UTC](https://discuss.elastic.co/t/winlogbeat-keystore-command-not-working/278413 "2021-07-12T11:00:08Z")
I am trying to create keystore for winlogbeat, am getting the below error. Can anyone please tell me what is my mistake? C:\\Program Files\\Winlogbeat\\data\>winlogbeat keystore create 'winlogbeat' is not recognized as an i… --- ## [How to remove duplicate document and field with null value](https://discuss.elastic.co/t/how-to-remove-duplicate-document-and-field-with-null-value/278424)
**Author:** [@Busra\_Duygu](https://discuss.elastic.co/u/Busra_Duygu)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:04pm UTC](https://discuss.elastic.co/t/how-to-remove-duplicate-document-and-field-with-null-value/278424 "2021-07-12T12:04:29Z")
Hello friends, there are duplicate lines with empty values in the csv file. I want to delete the null fields in these records and overwrite them with other records. i managed to delete fields with null value. However, I … --- ## [How to update elastic search \_source settings?](https://discuss.elastic.co/t/how-to-update-elastic-search-source-settings/278431)
**Author:** [@MarvinLiu](https://discuss.elastic.co/u/MarvinLiu)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 1:45pm UTC](https://discuss.elastic.co/t/how-to-update-elastic-search-source-settings/278431 "2021-07-12T13:45:01Z")
When I try to update the \_source parameter in elastic search,I got an error. Can I change this settings? PUT source-test POST source-test/\_mappings { "\_source" : { "enabled":true } } POST source-test/\_mapping… --- ## [Boost two related fields in a search query](https://discuss.elastic.co/t/boost-two-related-fields-in-a-search-query/278428)
**Author:** [@Antojvlt](https://discuss.elastic.co/u/Antojvlt)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:45pm UTC](https://discuss.elastic.co/t/boost-two-related-fields-in-a-search-query/278428 "2021-07-12T12:45:57Z")
Hi, I am new to Elasticsearch and I encounter a difficultly to make my search query to work as expected. I want to search on documents that contain two field: "review\_count" : { "type" : "long" }, "s… --- ## [How to make stopwords path text file work with words that have single quotes](https://discuss.elastic.co/t/how-to-make-stopwords-path-text-file-work-with-words-that-have-single-quotes/278427)
**Author:** [@Zubair\_Ali](https://discuss.elastic.co/u/Zubair_Ali)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 12:34pm UTC](https://discuss.elastic.co/t/how-to-make-stopwords-path-text-file-work-with-words-that-have-single-quotes/278427 "2021-07-12T12:34:12Z")
I have the following stopwords filter: "english\_stop": { "type": "stop", "stopwords\_path": "/usr/local/etc/elasticsearch/stopwords.txt", "updateable": true } These are the words in my st… --- ## [Use predicate expression with NEST in .NET 5](https://discuss.elastic.co/t/use-predicate-expression-with-nest-in-net-5/278420)
**Author:** [@Henrique\_Mauri](https://discuss.elastic.co/u/Henrique_Mauri)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:50am UTC](https://discuss.elastic.co/t/use-predicate-expression-with-nest-in-net-5/278420 "2021-07-12T11:50:26Z")
Hi Is it possible to configure in NEST (.NET 5) a way to use a default predicate expression (Default Query Filter) for all NEST queries (GetAsync, GetManyAsync, SearchAsync, ExistsAsync, ...) performed on any index? Th… --- ## [Yum repo doesn't work](https://discuss.elastic.co/t/yum-repo-doesnt-work/278404)
**Author:** [@loposk](https://discuss.elastic.co/u/loposk)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 11:41am UTC](https://discuss.elastic.co/t/yum-repo-doesnt-work/278404 "2021-07-12T11:41:05Z")
Added a repository according to the instructions Install Elasticsearch with RPM | Elasticsearch Guide \[7.13\] | Elastic When yum trying download https://artifacts.elastic.co/packages/7.x/yum/repodata/filelists.xml.gz I g… --- ## [Elasticsearch query DSL as a filter on Kibana](https://discuss.elastic.co/t/elasticsearch-query-dsl-as-a-filter-on-kibana/278415)
**Author:** [@bab](https://discuss.elastic.co/u/bab)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-as-a-filter-on-kibana/278415 "2021-07-12T11:16:29Z")
Hi guys, i need help with - my challenge is that i have to generate a new field when the query match the cretiria. see the code below: Here I need to add/create a field (references) and fill it with the same value I … --- ## [Translating Kibana to el](https://discuss.elastic.co/t/translating-kibana-to-el/277195)
**Author:** [@marrel](https://discuss.elastic.co/u/marrel)\ **Replies:** 5\ **Last updated:** [July 12, 2021, 11:08am UTC](https://discuss.elastic.co/t/translating-kibana-to-el/277195 "2021-07-12T11:08:05Z")
Hi there! I started localization for el (Greek language). I did everything according to guidelines. I extracted the en.json file from kibana after clone it from git. On kibana downloaded from here (v.7.6.2), I made t… --- ## [Search in Frozen Indices](https://discuss.elastic.co/t/search-in-frozen-indices/278410)
**Author:** [@Mojtaba\_Taleghani](https://discuss.elastic.co/u/Mojtaba_Taleghani)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 10:17am UTC](https://discuss.elastic.co/t/search-in-frozen-indices/278410 "2021-07-12T10:17:13Z")
Hi everyone, In my version 7.10.1 ELK cluster I setup ILM policy which creates frozen indices that their creation date are after 3 days. In kibana setting I turned on search in frozen indices but when I create visualize… --- ## [Unable to handshake Logstash and Elastic after TLS encryption](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319)
**Author:** [@Debarati\_Goswami](https://discuss.elastic.co/u/Debarati_Goswami)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 9:37am UTC](https://discuss.elastic.co/t/unable-to-handshake-logstash-and-elastic-after-tls-encryption/278319 "2021-07-12T09:37:05Z")
Hi All , This is the first time I am building up an ELK stack for my customer . After enabling minimal , basic and basic+HTTPs security for Elastic Stack , I am unable to run pipelines due to certification related issue… --- ## [Logstash is not showing in kibana UI](https://discuss.elastic.co/t/logstash-is-not-showing-in-kibana-ui/278395)
**Author:** [@MdRashid](https://discuss.elastic.co/u/MdRashid)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/logstash-is-not-showing-in-kibana-ui/278395 "2021-07-12T09:00:20Z")
\#\[Couldn’t find any Elasticsearch data Hi All, i have install elk as a docker container but issue not able to see es data in kibana here is the http://95.217.144.48:9200/ in browser it show me { "name" : "92bbcfa73… --- ## [Value\_count aggregation based on key name pattern](https://discuss.elastic.co/t/value-count-aggregation-based-on-key-name-pattern/278402)
**Author:** [@Ray\_Garcia](https://discuss.elastic.co/u/Ray_Garcia)\ **Replies:** 0\ **Last updated:** [July 12, 2021, 9:21am UTC](https://discuss.elastic.co/t/value-count-aggregation-based-on-key-name-pattern/278402 "2021-07-12T09:21:44Z")
Hi all, Elastic newbie here. I just started playing with ES a week ago. It seems super powerful and it fits perfectly with some aggregated data queries I'm performing. Some of them are already done (and they work flawle… --- ## [Lowercase processor - \[field\] property isn't a string, but of type \[java.util.ArrayList\]](https://discuss.elastic.co/t/lowercase-processor-field-property-isnt-a-string-but-of-type-java-util-arraylist/278340)
**Author:** [@f4d0](https://discuss.elastic.co/u/f4d0)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 9:04am UTC](https://discuss.elastic.co/t/lowercase-processor-field-property-isnt-a-string-but-of-type-java-util-arraylist/278340 "2021-07-12T09:04:11Z")
Hi, Elasticsearch version: 7.13.3 Python module in use: elasticsearch-7.13.3 Pipeline: B\_AutoReply\_pipeline = """ { "processors":\[ { "date": { "field": "Parsed\_Datetime", … --- ## [How to check document consistent with current mapping?](https://discuss.elastic.co/t/how-to-check-document-consistent-with-current-mapping/278387)
**Author:** [@peter5](https://discuss.elastic.co/u/peter5)\ **Replies:** 6\ **Last updated:** [July 12, 2021, 9:00am UTC](https://discuss.elastic.co/t/how-to-check-document-consistent-with-current-mapping/278387 "2021-07-12T09:00:28Z")
i need to know if document is matching current mapping or not (if not match i need to reindex) . eg, i change a field analyzer several times by update mapping . i need to know current document index status is identical … --- ## [Clustering Across Multiple Data Centers](https://discuss.elastic.co/t/clustering-across-multiple-data-centers/278367)
**Author:** [@otoce](https://discuss.elastic.co/u/otoce)\ **Replies:** 2\ **Last updated:** [July 12, 2021, 8:54am UTC](https://discuss.elastic.co/t/clustering-across-multiple-data-centers/278367 "2021-07-12T08:54:47Z")
Hi, thanks again for helping us on Warm nodes on spinning disks not stable, falling out of cluster during recovery. Cluster is working fine since than (8 months). For last 5 months there are three more servers. Total: 3… --- ## [Necessary to index a keyword field for exists query?](https://discuss.elastic.co/t/necessary-to-index-a-keyword-field-for-exists-query/278294)
**Author:** [@abhinavkulkarni](https://discuss.elastic.co/u/abhinavkulkarni)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:46am UTC](https://discuss.elastic.co/t/necessary-to-index-a-keyword-field-for-exists-query/278294 "2021-07-12T08:46:26Z")
Hi, Let us say, I have a User schema - name, address, bio and website. The website field is a keyword, but potentially unbounded - that is, the total number of all possible unique websites is limitless. I am interested… --- ## [Node killed after GC doing a Pause Full (G1 Evacuation Pause)](https://discuss.elastic.co/t/node-killed-after-gc-doing-a-pause-full-g1-evacuation-pause/278256)
**Author:** [@Vdm88](https://discuss.elastic.co/u/Vdm88)\ **Replies:** 1\ **Last updated:** [July 12, 2021, 8:41am UTC](https://discuss.elastic.co/t/node-killed-after-gc-doing-a-pause-full-g1-evacuation-pause/278256 "2021-07-12T08:41:48Z")
Hello, We have noticed this. After the GC is doing the Pause Full (G1 Evacuation Pause). The memory is released but the node can not get back in the cluster without a ES Service restart. THE Server replied on the 9200 p… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1325) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1327)