# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1647 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1648 --- ## [Filter by multiple fields in one document (one field more than other field)](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427)
**Author:** [@Delagardi1](https://discuss.elastic.co/u/Delagardi1)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 5:11pm UTC](https://discuss.elastic.co/t/filter-by-multiple-fields-in-one-document-one-field-more-than-other-field/258427 "2020-12-11T17:11:10Z")
Hi! I am pretty new to elasticsearch. Is there is a way to filter my search results by comparing two values in one document? I have two fields in my document: inStock, inOtherStock and 3 filter values like: show me all… --- ## [Cluster\_block\_exception blocks all ingestion](https://discuss.elastic.co/t/cluster-block-exception-blocks-all-ingestion/258338)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 6\ **Last updated:** [December 11, 2020, 5:14pm UTC](https://discuss.elastic.co/t/cluster-block-exception-blocks-all-ingestion/258338 "2020-12-11T17:14:41Z")
Hello, We have a ELK 7.3.2 cluster with 3 nodes and almost 3 TB disk free. Also have Index lifecycle policy which force merge all indices older than 7 days Free Disk: ILP: We deployed filebeat to ingest some ol… --- ## [Elasticsearch-oss-7.10.1-1.x86\_64: installation: startup issue](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 5\ **Last updated:** [December 11, 2020, 5:07pm UTC](https://discuss.elastic.co/t/elasticsearch-oss-7-10-1-1-x86-64-installation-startup-issue/258436 "2020-12-11T17:07:40Z")
When elastic instance start is attempted, I see exception as - \[2020-12-11T10:12:32,933\]\[WARN \]\[o.e.i.m.MapperService \] \[fully-qualified-host-name\] \[.kibana\_1\] \[\[.kibana\_1/9r8cU43FQlWzDMRvN-dxHA\]\] failed to apply map… --- ## [Taming ElasticSearch Field Explosion](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433)
**Author:** [@tjohnell](https://discuss.elastic.co/u/tjohnell)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:41pm UTC](https://discuss.elastic.co/t/taming-elasticsearch-field-explosion/258433 "2020-12-11T16:41:39Z")
Hello all, I recently created a post on how my company, Handy, reduced the number of fields within our main ES index, and I wanted to share with the ES community. Any feedback is appreciated! Best, Tom --- ## [JDBC Input Error after upgrading to 7.10.0 on Windows](https://discuss.elastic.co/t/jdbc-input-error-after-upgrading-to-7-10-0-on-windows/256902)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 4:41pm UTC](https://discuss.elastic.co/t/jdbc-input-error-after-upgrading-to-7-10-0-on-windows/256902 "2020-12-11T16:41:19Z")
Hi All, I updated my Windows DEV environment to 7.10.0 from 7.9.2 earlier today. When I try to run my existing Logstash configurations in 7.10.0 (which worked fine under 7.9.2) I see the following error: \[2020-11-27T12… --- ## [Calling getFieldsForWildcard from Indexpatternservice in a server side kibana plugin to refresh an index pattern](https://discuss.elastic.co/t/calling-getfieldsforwildcard-from-indexpatternservice-in-a-server-side-kibana-plugin-to-refresh-an-index-pattern/258296)
**Author:** [@Aadrien](https://discuss.elastic.co/u/Aadrien)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 12:46pm UTC](https://discuss.elastic.co/t/calling-getfieldsforwildcard-from-indexpatternservice-in-a-server-side-kibana-plugin-to-refresh-an-index-pattern/258296 "2020-12-11T12:46:25Z")
Hi, I'm working on a plugin for kibana 7.9.1, at some point I'd like to refresh the fields of an index pattern. hence calling getFieldsForWildcard() of IndexPatternsApiClient would be nice. I've basically the same ques… --- ## [Error when creating email alert in Cloud](https://discuss.elastic.co/t/error-when-creating-email-alert-in-cloud/258168)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 3:10pm UTC](https://discuss.elastic.co/t/error-when-creating-email-alert-in-cloud/258168 "2020-12-11T15:10:10Z")
When attempting to create an email alert I get the following error: Action failed to run The following error was found: error sending email Details: 139794888578880:error:1408F10B:SSL routines:ssl3\_get\_record:wrong ver… --- ## [Reindexing: Move mapping up a level](https://discuss.elastic.co/t/reindexing-move-mapping-up-a-level/258327)
**Author:** [@F\_Doe\_FW](https://discuss.elastic.co/u/F_Doe_FW)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 2:59pm UTC](https://discuss.elastic.co/t/reindexing-move-mapping-up-a-level/258327 "2020-12-11T14:59:44Z")
Greetings! I am trying to remap an index that inadvertently had a top level 'doc' node. So, the documents were indexed like this : "\_source" : { "doc" : { "week\_starting" : "2020-05-24", … --- ## [Restore snapshot from remote fails to find snapshot](https://discuss.elastic.co/t/restore-snapshot-from-remote-fails-to-find-snapshot/258411)
**Author:** [@haarts](https://discuss.elastic.co/u/haarts)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 2:19pm UTC](https://discuss.elastic.co/t/restore-snapshot-from-remote-fails-to-find-snapshot/258411 "2020-12-11T14:19:48Z")
Dear readers, I have two clusters. One I'll call 'remote', the other 'local'. I have successfully created a snapshot called 'snapshot\_1' in the repository 'my\_backup' on the remote cluster. I'm trying to follow the in… --- ## [Kibana timeout but curl with same query works perfectly](https://discuss.elastic.co/t/kibana-timeout-but-curl-with-same-query-works-perfectly/258405)
**Author:** [@Julio\_reyes](https://discuss.elastic.co/u/Julio_reyes)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 1:28pm UTC](https://discuss.elastic.co/t/kibana-timeout-but-curl-with-same-query-works-perfectly/258405 "2020-12-11T13:28:25Z")
Hi, I'm facing an issue from kibana. Trying to fetch the data of last 90 days I get a timeout. After that I tried to make a curl to the server using the full request that kibana runs in the inspect windows and curl worke… --- ## [Field value ACL](https://discuss.elastic.co/t/field-value-acl/258417)
**Author:** [@dgovergun](https://discuss.elastic.co/u/dgovergun)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 1:22pm UTC](https://discuss.elastic.co/t/field-value-acl/258417 "2020-12-11T13:22:01Z")
I have a database with basic people data like name, last name, address, etc. And for those people I have a table with contact data like email, phone, cellphone, etc. I have that information indexed already. But now I ha… --- ## [Unable to access data from elastic search](https://discuss.elastic.co/t/unable-to-access-data-from-elastic-search/257258)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 19\ **Last updated:** [December 11, 2020, 12:28pm UTC](https://discuss.elastic.co/t/unable-to-access-data-from-elastic-search/257258 "2020-12-11T12:28:19Z")
In elastic search, when checking index health link, we could see that each index is having huge amount of data as per the size. But when running api \/\_search, it is retrieving only only one alias data. We are… --- ## [Cannot load Filebeat 7.9.0 and higher template in Elasticsearch 6.8.12](https://discuss.elastic.co/t/cannot-load-filebeat-7-9-0-and-higher-template-in-elasticsearch-6-8-12/257663)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 12:24pm UTC](https://discuss.elastic.co/t/cannot-load-filebeat-7-9-0-and-higher-template-in-elasticsearch-6-8-12/257663 "2020-12-11T12:24:11Z")
Hello, I am running an Elasticsearch 6.8.12 cluster and have Filebeats agent in various versions. I usually install the filebeat template using the export command : filebeat.exe export template --es.version 6.8.12 | Out… --- ## [Forcefully reindex more than 1000 properties](https://discuss.elastic.co/t/forcefully-reindex-more-than-1000-properties/258407)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:47am UTC](https://discuss.elastic.co/t/forcefully-reindex-more-than-1000-properties/258407 "2020-12-11T11:47:41Z")
Hi Team, I have to do reindex in ES. My index containts total 278 records where 7 records having properties more than 1000. Am not able to reindex by running kibana query POST \_reindex { "source": { "index": "roche… --- ## [Elasticsearch on AWS ECS - Master node itself unable to discover master](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-master-node-itself-unable-to-discover-master/256091)
**Author:** [@s0umen](https://discuss.elastic.co/u/s0umen)\ **Replies:** 9\ **Last updated:** [December 11, 2020, 11:38am UTC](https://discuss.elastic.co/t/elasticsearch-on-aws-ecs-master-node-itself-unable-to-discover-master/256091 "2020-12-11T11:38:45Z")
Hi I am trying to run elasticsearch on ECS. I am using simple elasticsearch.yml as below for the docker I am using for the Master Service. =================== Start Elasticsearch YML ==================== cluster.name:… --- ## [Match query with minimum field should match](https://discuss.elastic.co/t/match-query-with-minimum-field-should-match/258403)
**Author:** [@Tomasz\_Kutyla](https://discuss.elastic.co/u/Tomasz_Kutyla)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:19am UTC](https://discuss.elastic.co/t/match-query-with-minimum-field-should-match/258403 "2020-12-11T11:19:47Z")
Hi, I have an question in regards of match query. Lets imagine we have an index with below data: POST /\_bulk {"index": {"\_index": "composers"}} {"name": "Johann Sebastian Bach", "phone": "543987111"} {"index": {"\_index… --- ## [Same code on query script and sort script](https://discuss.elastic.co/t/same-code-on-query-script-and-sort-script/258402)
**Author:** [@SergioRodenas](https://discuss.elastic.co/u/SergioRodenas)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 11:17am UTC](https://discuss.elastic.co/t/same-code-on-query-script-and-sort-script/258402 "2020-12-11T11:17:07Z")
Hi, how can I avoid this? GET /repository/\_search { "query": { "script": { "script": { "source": "6371 \* Math.acos( Math.cos((Math.PI / 180)\*(39.9874542)) \* Math.cos((Math.PI / 180)\*(doc\['destination… --- ## [How to know if logfile is finished harvested on windows for filebeat 7.10](https://discuss.elastic.co/t/how-to-know-if-logfile-is-finished-harvested-on-windows-for-filebeat-7-10/258056)
**Author:** [@eirik](https://discuss.elastic.co/u/eirik)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 10:37am UTC](https://discuss.elastic.co/t/how-to-know-if-logfile-is-finished-harvested-on-windows-for-filebeat-7-10/258056 "2020-12-11T10:37:28Z")
I am running Filebeat 7.10 sending log events to logstash on Windows server 2016. As filebeat is not cleaning up logfiles I need to write my own script for this, but for this to work I need to know when the harvesting is… --- ## [Automatic copying of document](https://discuss.elastic.co/t/automatic-copying-of-document/257687)
**Author:** [@pskhanapur](https://discuss.elastic.co/u/pskhanapur)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 10:07am UTC](https://discuss.elastic.co/t/automatic-copying-of-document/257687 "2020-12-11T10:07:14Z")
I have two indices, let's say index1 index2 (clone of index1) I always write documents to index1. Is there a way to automatically trigger a copy of the document from index1 to index2, every time I write a document in… --- ## [2 or more nested array without duplicates](https://discuss.elastic.co/t/2-or-more-nested-array-without-duplicates/258391)
**Author:** [@pyrovoice](https://discuss.elastic.co/u/pyrovoice)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 9:45am UTC](https://discuss.elastic.co/t/2-or-more-nested-array-without-duplicates/258391 "2020-12-11T09:45:07Z")
I am building my ES indexes from data from our MySQL databases, using a jdbc plugin. One of my columns has multiple many-to-many parameters, that I need to import into the index (as ES does not manage many-to-many well)… --- ## [Automatically remove older indexes from alias](https://discuss.elastic.co/t/automatically-remove-older-indexes-from-alias/258267)
**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 9:40am UTC](https://discuss.elastic.co/t/automatically-remove-older-indexes-from-alias/258267 "2020-12-11T09:40:36Z")
I have an elastic search alias named "enrich" and it is defined in index template. How can I remove indices older than 15 days from "enrich" alias automatically? I am aware of below command but this is manual and I am … --- ## [How smooth we can upgrade Elasticsearch to 8.0](https://discuss.elastic.co/t/how-smooth-we-can-upgrade-elasticsearch-to-8-0/257986)
**Author:** [@guest123](https://discuss.elastic.co/u/guest123)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 9:00am UTC](https://discuss.elastic.co/t/how-smooth-we-can-upgrade-elasticsearch-to-8-0/257986 "2020-12-11T09:00:06Z")
we are trying upgrade Elasticsearch from 6.7 to 7.7, as per the docs index creation, template and mapping requests are need to be passing parameter "include\_type\_name" in the request uri. but in 8.0 this is gone be rem… --- ## [Why cannot restore index from snapshot if an open index with same name exists in the cluster?](https://discuss.elastic.co/t/why-cannot-restore-index-from-snapshot-if-an-open-index-with-same-name-exists-in-the-cluster/258374)
**Author:** [@Simolx](https://discuss.elastic.co/u/Simolx)\ **Replies:** 3\ **Last updated:** [December 11, 2020, 8:55am UTC](https://discuss.elastic.co/t/why-cannot-restore-index-from-snapshot-if-an-open-index-with-same-name-exists-in-the-cluster/258374 "2020-12-11T08:55:47Z")
Why cannot restore index from snapshot if an open index with same name exists in the cluster? In Elasticsearch Source Code server/src/main/java/org/elasticsearch/snapshots/RestoreService.java method validateExisting… --- ## [Elastic regular peaks between 03:00-04:00](https://discuss.elastic.co/t/elastic-regular-peaks-between-0300/258385)
**Author:** [@jimmyvalmer19](https://discuss.elastic.co/u/jimmyvalmer19)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 8:22am UTC](https://discuss.elastic.co/t/elastic-regular-peaks-between-0300/258385 "2020-12-11T08:22:33Z")
Hi, I noticed regular peaks in indexing rate every night between 03:00 and 04:00. I think it's something like cluster maintenance, rolling out indices, moving indices from one node to another, but I don't know what it i… --- ## [Hosted Elasticserach in GCP managed by Elastic](https://discuss.elastic.co/t/hosted-elasticserach-in-gcp-managed-by-elastic/258363)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 6:25am UTC](https://discuss.elastic.co/t/hosted-elasticserach-in-gcp-managed-by-elastic/258363 "2020-12-11T06:25:31Z")
What are the key features of Hosted Elastic Stack in GCP (Managed ElasticSearch in GCP) https://www.elastic.co/google-cloud Where is the Elastic indices getting stored ?What is the level of access ELK developer has on E… --- ## [Elasticsearch python client expand\_action\_callback function question](https://discuss.elastic.co/t/elasticsearch-python-client-expand-action-callback-function-question/258372)
**Author:** [@Safak\_Kaya](https://discuss.elastic.co/u/Safak_Kaya)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 6:04am UTC](https://discuss.elastic.co/t/elasticsearch-python-client-expand-action-callback-function-question/258372 "2020-12-11T06:04:43Z")
Hi all, I'm trying to use expand\_action\_callback function to get back one of the action fields from the streaming\_bulk response. There is "\_id" but I need to access another field which is in the original action. Am I o… --- ## [What is the field count for the below mapping?](https://discuss.elastic.co/t/what-is-the-field-count-for-the-below-mapping/258280)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 2\ **Last updated:** [December 11, 2020, 4:14am UTC](https://discuss.elastic.co/t/what-is-the-field-count-for-the-below-mapping/258280 "2020-12-11T04:14:43Z")
Hi Team, Greetings...!!!. Hope everyone is safe. Consider the following mapping for an index and kindly tell me how many fields are there. I have added the keyword mapping for the field "my\_string". So my doubt is the… --- ## [CSV Movement after loading into Elastic Search using Logstash](https://discuss.elastic.co/t/csv-movement-after-loading-into-elastic-search-using-logstash/258159)
**Author:** [@mdwazirhassan](https://discuss.elastic.co/u/mdwazirhassan)\ **Replies:** 4\ **Last updated:** [December 11, 2020, 4:12am UTC](https://discuss.elastic.co/t/csv-movement-after-loading-into-elastic-search-using-logstash/258159 "2020-12-11T04:12:30Z")
Hi, I am new with Elastic and Kibana. Senario is as below: We have a folder called "livedata" In this(livedata) folder on every second or alternate new csv file is arraived from ftp. I have created a config logstash… --- ## [Current Logs Output Is a Single Line - How do I make multi-newlines at specific points](https://discuss.elastic.co/t/current-logs-output-is-a-single-line-how-do-i-make-multi-newlines-at-specific-points/258361)
**Author:** [@test\_tester](https://discuss.elastic.co/u/test_tester)\ **Replies:** 0\ **Last updated:** [December 11, 2020, 3:54am UTC](https://discuss.elastic.co/t/current-logs-output-is-a-single-line-how-do-i-make-multi-newlines-at-specific-points/258361 "2020-12-11T03:54:36Z")
Good Day All, I have a problem whereby my current logs are outputting in a single line. The backstory is that our application is receiving messages from another party and within those messages, we have /n, so when we o… --- ## [Multiline breaking in blank line](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 1\ **Last updated:** [December 11, 2020, 3:42am UTC](https://discuss.elastic.co/t/multiline-breaking-in-blank-line/258359 "2020-12-11T03:42:04Z")
This has been reports a few times but I can not put the answer together. I would like these lines to arrive as one multiline. But they arrive as 5 lines. Which is odd because the pattern clearly only matches the first… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1646) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1648)