# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1000 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1001 --- ## [Fetch 1 million records](https://discuss.elastic.co/t/fetch-1-million-records/220636)
**Author:** [@otherview](https://discuss.elastic.co/u/otherview)\ **Replies:** 6\ **Last updated:** [March 2, 2020, 4:33pm UTC](https://discuss.elastic.co/t/fetch-1-million-records/220636 "2020-03-02T16:33:09Z")
Hi ! I'm trying to fetch +1 Million records from elastic search. So far all approaches are still slow. At the moment I'm using a sliced scroll search. I just need a few fields from the documents, not the whole docume… --- ## [How can I add condition in the Watcher](https://discuss.elastic.co/t/how-can-i-add-condition-in-the-watcher/221357)
**Author:** [@shylendran](https://discuss.elastic.co/u/shylendran)\ **Replies:** 1\ **Last updated:** [March 2, 2020, 4:21pm UTC](https://discuss.elastic.co/t/how-can-i-add-condition-in-the-watcher/221357 "2020-03-02T16:21:35Z")
I am configuring Watcher and getting the alert email. Version is 7.3 Actually, I need to add conditions like this - if the statusCode (one of the available field in the index) is 500 in the last 10 min, generate an emai… --- ## [Rookie Question: Record a count in a new Index](https://discuss.elastic.co/t/rookie-question-record-a-count-in-a-new-index/221716)
**Author:** [@BlueTeamNinja](https://discuss.elastic.co/u/BlueTeamNinja)\ **Replies:** 2\ **Last updated:** [March 2, 2020, 3:47pm UTC](https://discuss.elastic.co/t/rookie-question-record-a-count-in-a-new-index/221716 "2020-03-02T15:47:21Z")
Hey all, I'm brand new to my Elastic journey. I am collecting some firewall logs, which accumulate really quickly. What would I like to do is create a new index based on the counts of some of my tags. A daily record … --- ## [Newbie Elastic Kibana filebeat 7.6 not working](https://discuss.elastic.co/t/newbie-elastic-kibana-filebeat-7-6-not-working/221488)
**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\ **Replies:** 1\ **Last updated:** [March 2, 2020, 3:36pm UTC](https://discuss.elastic.co/t/newbie-elastic-kibana-filebeat-7-6-not-working/221488 "2020-03-02T15:36:52Z")
I have tried over and over and I followed these steps each in a separate window of powershell Elastic .\\bin\\elasticsearch.bat Kibana .\\bin\\kibana.bat filebeat .\\install-service-filebeat.ps1 Status Name … --- ## [Updating from ES 6.4.3 to ES 6.8 with the analysis-phonetic plug-in installed](https://discuss.elastic.co/t/updating-from-es-6-4-3-to-es-6-8-with-the-analysis-phonetic-plug-in-installed/221707)
**Author:** [@creynolds34](https://discuss.elastic.co/u/creynolds34)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 2:53pm UTC](https://discuss.elastic.co/t/updating-from-es-6-4-3-to-es-6-8-with-the-analysis-phonetic-plug-in-installed/221707 "2020-03-02T14:53:56Z")
I'm trying to update from ES 6.4 to ES 6.8 and I have the analysis-phonetic plug-in installed. From what I can tell in the documentation I need to uninstall the analysis-phonetic plug-in from ES 6.4, update to ES 6.8 an… --- ## [Metaphone analyzer being too ambigous](https://discuss.elastic.co/t/metaphone-analyzer-being-too-ambigous/221516)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 4\ **Last updated:** [March 2, 2020, 1:52pm UTC](https://discuss.elastic.co/t/metaphone-analyzer-being-too-ambigous/221516 "2020-03-02T13:52:55Z")
Hi, I am currently using the Metaphone analyzer and it is acting too ambiguous. For example, here is the result for Murder using the \_analyze API. { "tokens": \[ { "token": "MRTR", "s… --- ## [ElasticSearch Hot-warm-Cold](https://discuss.elastic.co/t/elasticsearch-hot-warm-cold/221575)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [March 2, 2020, 1:47pm UTC](https://discuss.elastic.co/t/elasticsearch-hot-warm-cold/221575 "2020-03-02T13:47:41Z")
I have plan to rebuild ElasticStack with 7 node (3 master + 4 Data), verison 7.6.x. Total data per month ~ 2TB. I have question, with Hot-warm-cold architecture, what is the compression ratio of each type? Can i use H… --- ## [Is there any APIs to fetch query history?](https://discuss.elastic.co/t/is-there-any-apis-to-fetch-query-history/220131)
**Author:** [@wendy](https://discuss.elastic.co/u/wendy)\ **Replies:** 4\ **Last updated:** [March 2, 2020, 1:08pm UTC](https://discuss.elastic.co/t/is-there-any-apis-to-fetch-query-history/220131 "2020-03-02T13:08:12Z")
Hi all, I'd like to access the query history of users by invoking API for analyzing the user behavior. Does Elastic Search provide such an API for fetching query history? Any comment is greatly appreciated. Best Reg… --- ## [7.6.0 Windows Installer MSI - Java Home Preservation](https://discuss.elastic.co/t/7-6-0-windows-installer-msi-java-home-preservation/221673)
**Author:** [@Jason\_Nunn](https://discuss.elastic.co/u/Jason_Nunn)\ **Replies:** 1\ **Last updated:** [March 2, 2020, 12:16pm UTC](https://discuss.elastic.co/t/7-6-0-windows-installer-msi-java-home-preservation/221673 "2020-03-02T12:16:52Z")
Can I suggest an improvement to the Windows MSI Installer? Now that a compatible JDK is bundled with the installer, can the location of the JDK be controlled just like the config, logs and data folders? We have our "stat… --- ## [7.6.0 Windows Installer MSI - Preserve Windows Service Logon User Info](https://discuss.elastic.co/t/7-6-0-windows-installer-msi-preserve-windows-service-logon-user-info/221672)
**Author:** [@Jason\_Nunn](https://discuss.elastic.co/u/Jason_Nunn)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 12:03pm UTC](https://discuss.elastic.co/t/7-6-0-windows-installer-msi-preserve-windows-service-logon-user-info/221672 "2020-03-02T12:03:54Z")
Hi, can I suggest an improvement to the Windows MSI Installer: When performing an upgrade can the installer preserve the windows service "logon as" user and password? Maybe the service should be updated rather than delet… --- ## [Error while posting data on ElasticSearch Index using RestyClient](https://discuss.elastic.co/t/error-while-posting-data-on-elasticsearch-index-using-restyclient/221668)
**Author:** [@cravinder489](https://discuss.elastic.co/u/cravinder489)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 11:50am UTC](https://discuss.elastic.co/t/error-while-posting-data-on-elasticsearch-index-using-restyclient/221668 "2020-03-02T11:50:36Z")
I'm posting data to my elasticsearch index using RestClient (see code below) JSONObject obj3 = new JSONObject(); obj3.put("name","question"); obj3.put("parent",Integer.toString(id+2)); JSONObject jsonObject3 = new J… --- ## [6.7.0 ELK Connectivity using ODBC](https://discuss.elastic.co/t/6-7-0-elk-connectivity-using-odbc/221573)
**Author:** [@Baksh](https://discuss.elastic.co/u/Baksh)\ **Replies:** 1\ **Last updated:** [March 2, 2020, 11:42am UTC](https://discuss.elastic.co/t/6-7-0-elk-connectivity-using-odbc/221573 "2020-03-02T11:42:49Z")
I am trying to connect to Elastic 6.7.0 Index using Dot Net ODBC driver and getting below exception Need help on likely cause of this exception. System.Data.Odbc.OdbcException (0x80131937): ERROR \[HY000\] \[Elastic\]\[EsOD… --- ## [How can I search a time series backward in time efficiently](https://discuss.elastic.co/t/how-can-i-search-a-time-series-backward-in-time-efficiently/221665)
**Author:** [@Nick\_Walton](https://discuss.elastic.co/u/Nick_Walton)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 11:18am UTC](https://discuss.elastic.co/t/how-can-i-search-a-time-series-backward-in-time-efficiently/221665 "2020-03-02T11:18:35Z")
I have a number of time series, each indexed by a numeric field sampleindex and each series has a unique identifier. Each entry in a time series is a sequence of words. I now need for each time series to count for each … --- ## [Data too large, data for \[\\]](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/221661)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 10:34am UTC](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/221661 "2020-03-02T10:34:00Z")
Hello, I have such error like this and I don't understand what does this mean. Can you help me how to fix it? { "error": { "root\_cause": \[ { "type": "circuit\_breaking\_exception", "reason": "\[… --- ## [Limit of total fields \[1000\] exceeded for index with 699 fields](https://discuss.elastic.co/t/limit-of-total-fields-1000-exceeded-for-index-with-699-fields/221605)
**Author:** [@JohanP](https://discuss.elastic.co/u/JohanP)\ **Replies:** 2\ **Last updated:** [March 2, 2020, 10:23am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-exceeded-for-index-with-699-fields/221605 "2020-03-02T10:23:27Z")
Elasticsearch 7.2.1 Ingesting an XLSX sheet with 1x title and 1x data row using the excellent tool @GitHub - codingchili/excelastic: Vert.x web and commandline application to import CSV/XLS/XLSX files into ElasticSearch… --- ## [What is the equivalent datatype for clob column in elastic search?](https://discuss.elastic.co/t/what-is-the-equivalent-datatype-for-clob-column-in-elastic-search/221658)
**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 10:23am UTC](https://discuss.elastic.co/t/what-is-the-equivalent-datatype-for-clob-column-in-elastic-search/221658 "2020-03-02T10:23:16Z")
A CLOB (character large object) value can be up to 2,147,483,647 characters long. A CLOB is used to store unicode character-based data, such as large documents in any character set. What is the equivalent datatype for c… --- ## [How to do currency conversion in elastic search?](https://discuss.elastic.co/t/how-to-do-currency-conversion-in-elastic-search/221656)
**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 10:14am UTC](https://discuss.elastic.co/t/how-to-do-currency-conversion-in-elastic-search/221656 "2020-03-02T10:14:57Z")
Hi All, There is an index in which each document contains ItemNumber,Price and TransactionalCurrencyCode(It might vary for each document). Eg: Doc1: Item1,100,USD Doc2: Item2,100,EUR Usecase : Sorting has to be done… --- ## [Unassigned shards on elasticloud system indexes with 0 replica settings](https://discuss.elastic.co/t/unassigned-shards-on-elasticloud-system-indexes-with-0-replica-settings/221612)
**Author:** [@MagicNotElastic](https://discuss.elastic.co/u/MagicNotElastic)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 10:07am UTC](https://discuss.elastic.co/t/unassigned-shards-on-elasticloud-system-indexes-with-0-replica-settings/221612 "2020-03-02T10:07:39Z")
Using 1 node with number\_of\_replicas": "0", all beats indexes working properly, except system: .monitoring-kibana .watcher-history .watches It seem, that all system indexes have unassigned replicas, but all my settin… --- ## [Get the most recent record which matches a field](https://discuss.elastic.co/t/get-the-most-recent-record-which-matches-a-field/221635)
**Author:** [@mbozic00](https://discuss.elastic.co/u/mbozic00)\ **Replies:** 5\ **Last updated:** [March 2, 2020, 10:04am UTC](https://discuss.elastic.co/t/get-the-most-recent-record-which-matches-a-field/221635 "2020-03-02T10:04:41Z")
Hi, When I perform this query: { "query": { "match": { "service\_id": "foo" } }, "size": 1 } I get one entry (the earliest by timestamp) that matches the desired service\_id. However, I would like to retrieve … --- ## [What can be used to fetch files from one location and store it in elasticsearch](https://discuss.elastic.co/t/what-can-be-used-to-fetch-files-from-one-location-and-store-it-in-elasticsearch/221379)
**Author:** [@samanvi\_sweety](https://discuss.elastic.co/u/samanvi_sweety)\ **Replies:** 6\ **Last updated:** [March 2, 2020, 9:57am UTC](https://discuss.elastic.co/t/what-can-be-used-to-fetch-files-from-one-location-and-store-it-in-elasticsearch/221379 "2020-03-02T09:57:25Z")
I would like to know which techinque can be used to fetch the files from certain location and store it in elastic seach --- ## [Fixing yellow health of cluster due to permission error](https://discuss.elastic.co/t/fixing-yellow-health-of-cluster-due-to-permission-error/221548)
**Author:** [@tbhaxor](https://discuss.elastic.co/u/tbhaxor)\ **Replies:** 3\ **Last updated:** [March 2, 2020, 9:48am UTC](https://discuss.elastic.co/t/fixing-yellow-health-of-cluster-due-to-permission-error/221548 "2020-03-02T09:48:53Z")
In my elastic search cluster, some nodes are red while some of them are yellow. The point is only beats indices are affected. So i executed curl localhost:9200/\_cluster/allocation/explain The output { "index": "filebe… --- ## [Read Writes Per Second](https://discuss.elastic.co/t/read-writes-per-second/220900)
**Author:** [@neuronring](https://discuss.elastic.co/u/neuronring)\ **Replies:** 2\ **Last updated:** [March 2, 2020, 9:31am UTC](https://discuss.elastic.co/t/read-writes-per-second/220900 "2020-03-02T09:31:15Z")
Hi Team, I am trying to get hardware estimates for the elastic cluster based on document growth and Read/Writes per second. To get Read/Writes per second on a cluster, is there are an API or tool ( other than marvel ) … --- ## [Field names starting with \`\_\`(underscore) are not matched with \* wildcard](https://discuss.elastic.co/t/field-names-starting-with-underscore-are-not-matched-with-wildcard/221254)
**Author:** [@hexer338](https://discuss.elastic.co/u/hexer338)\ **Replies:** 6\ **Last updated:** [March 2, 2020, 9:30am UTC](https://discuss.elastic.co/t/field-names-starting-with-underscore-are-not-matched-with-wildcard/221254 "2020-03-02T09:30:49Z")
Hi, \* wildcard does not match fields starting with \_ in the query\_string query. Example: Create Index with simple mapping: { "mappings": { "properties": { "\_a": { "type": "keyw… --- ## [How to create ILM policy for all indices except for one](https://discuss.elastic.co/t/how-to-create-ilm-policy-for-all-indices-except-for-one/221643)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 8:15am UTC](https://discuss.elastic.co/t/how-to-create-ilm-policy-for-all-indices-except-for-one/221643 "2020-03-02T08:15:16Z")
Hi everyone, i think the question is self explanatory, do i create the policy for the pattern "\*" and then use the new policy for that particular index pattern or is there another way? --- ## [Elasticsearch Data refresh + miss issue](https://discuss.elastic.co/t/elasticsearch-data-refresh-miss-issue/221629)
**Author:** [@sandsriv](https://discuss.elastic.co/u/sandsriv)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 7:06am UTC](https://discuss.elastic.co/t/elasticsearch-data-refresh-miss-issue/221629 "2020-03-02T07:06:49Z")
Just to give some background: We have a 3 node elastic cluster running as docker service . Each VM has configuration having CPU 116, RAM 132G We have a microservice based application which performs the write + read with… --- ## [How to add write privilege to elastic search after enabling https protocol](https://discuss.elastic.co/t/how-to-add-write-privilege-to-elastic-search-after-enabling-https-protocol/220960)
**Author:** [@ShreyaBhat](https://discuss.elastic.co/u/ShreyaBhat)\ **Replies:** 2\ **Last updated:** [March 2, 2020, 6:15am UTC](https://discuss.elastic.co/t/how-to-add-write-privilege-to-elastic-search-after-enabling-https-protocol/220960 "2020-03-02T06:15:59Z")
Hi I have enabled https using the following parameters on the .yml file: xpack.security.enabled: true xpack.security.http.ssl.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.http.ssl.certific… --- ## [Add node to existing elasticsearch cluster](https://discuss.elastic.co/t/add-node-to-existing-elasticsearch-cluster/221613)
**Author:** [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 5:04am UTC](https://discuss.elastic.co/t/add-node-to-existing-elasticsearch-cluster/221613 "2020-03-02T05:04:36Z")
I'm trying to add node to a running cluster. I've got this running elasticsearch cluster status by running GET /\_cluster/stats i got the running cluster name is elasticsearch, and by following this adding node to clust… --- ## [Audit Logs not showing](https://discuss.elastic.co/t/audit-logs-not-showing/221608)
**Author:** [@stormy\_weather](https://discuss.elastic.co/u/stormy_weather)\ **Replies:** 0\ **Last updated:** [March 2, 2020, 1:52am UTC](https://discuss.elastic.co/t/audit-logs-not-showing/221608 "2020-03-02T01:52:23Z")
Hi all. I am trying to access the access\_granted logs. However, even after adding xpack.security.audit.enabled: true to elasticsearch.yml, i still can't find the log files under elasticsearch/logs. Is there anyway to v… --- ## [Document Count vs. Document Size on search performance](https://discuss.elastic.co/t/document-count-vs-document-size-on-search-performance/221597)
**Author:** [@Zhengcong\_Yin](https://discuss.elastic.co/u/Zhengcong_Yin)\ **Replies:** 0\ **Last updated:** [March 1, 2020, 8:48pm UTC](https://discuss.elastic.co/t/document-count-vs-document-size-on-search-performance/221597 "2020-03-01T20:48:02Z")
I am just curious about how does the document count or document size per index impacts the search queries. I can shrink the size of each document on an index, but not sure if it will benefit the reading process or not. … --- ## [Error when close REST response](https://discuss.elastic.co/t/error-when-close-rest-response/221577)
**Author:** [@aiden\_elastic](https://discuss.elastic.co/u/aiden_elastic)\ **Replies:** 3\ **Last updated:** [March 1, 2020, 6:52pm UTC](https://discuss.elastic.co/t/error-when-close-rest-response/221577 "2020-03-01T18:52:53Z")
Hi, I am using Elastic sesarch 7.6.0 with REST Client API in spring-boot. This is problem code. CloseIndexResponse closeIndexResponse = client.indices().close(requestClose, RequestOptions.DEFAULT);… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=999) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1001)