# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1003 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1004 --- ## [How many number of data nodes to start with for log analytics](https://discuss.elastic.co/t/how-many-number-of-data-nodes-to-start-with-for-log-analytics/221309)
**Author:** [@gururjrk](https://discuss.elastic.co/u/gururjrk)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 6:53pm UTC](https://discuss.elastic.co/t/how-many-number-of-data-nodes-to-start-with-for-log-analytics/221309 "2020-02-27T18:53:53Z")
Hi, For log analytics I am going to store log data from various application in elasticsearch as time series indices. The estimated total data growth is maximum 10TB in 1 year considering the data retention period. With… --- ## [Plan for upgrading from 2.4 to 5.6?](https://discuss.elastic.co/t/plan-for-upgrading-from-2-4-to-5-6/221304)
**Author:** [@ppbrown](https://discuss.elastic.co/u/ppbrown)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 6:28pm UTC](https://discuss.elastic.co/t/plan-for-upgrading-from-2-4-to-5-6/221304 "2020-02-27T18:28:27Z")
I'm trying to put together a safe plan for upgrading our cluster from v2.4.1 to v5.6 Been doing some googling. So far, i've read that; "just backing up the data directories is not sufficient", and elastic has built i… --- ## [Docs.count given by /\_cat/indices on index with replica shards](https://discuss.elastic.co/t/docs-count-given-by-cat-indices-on-index-with-replica-shards/221303)
**Author:** [@lschmid](https://discuss.elastic.co/u/lschmid)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 6:26pm UTC](https://discuss.elastic.co/t/docs-count-given-by-cat-indices-on-index-with-replica-shards/221303 "2020-02-27T18:26:56Z")
For an index with replica shard(s), does the docs.count field given by /\_cat/indices include docs on the replica shard or only docs on primary shards? Say I want to get even splits of an index by using the scroll AP… --- ## [Elasticsearch pagination approach help](https://discuss.elastic.co/t/elasticsearch-pagination-approach-help/221291)
**Author:** [@g30](https://discuss.elastic.co/u/g30)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 5:23pm UTC](https://discuss.elastic.co/t/elasticsearch-pagination-approach-help/221291 "2020-02-27T17:23:21Z")
Hi, We have developed a file storage solution which uses elastic search to store metadata about files using the rest level client java API. We have pagination currently implemented via “from” and “size”. Client makes a… --- ## [Behaviour of the Java Spark API : JavaEsSpark.saveToEs (background or not)](https://discuss.elastic.co/t/behaviour-of-the-java-spark-api-javaesspark-savetoes-background-or-not/220215)
**Author:** [@sebastienf](https://discuss.elastic.co/u/sebastienf)\ **Replies:** 1\ **Last updated:** [February 27, 2020, 4:28pm UTC](https://discuss.elastic.co/t/behaviour-of-the-java-spark-api-javaesspark-savetoes-background-or-not/220215 "2020-02-27T16:28:09Z")
Hi, In a Spark Streaming Job, I am using JavaEsSpark.saveToEs to bulk documents into ES indices. So far so good, but I was wondering about its behaviour. Indeed, I noticed that the code after the JavaEsSpark call see… --- ## [2 server ELK cluster implementation](https://discuss.elastic.co/t/2-server-elk-cluster-implementation/220308)
**Author:** [@nityaraj06](https://discuss.elastic.co/u/nityaraj06)\ **Replies:** 13\ **Last updated:** [February 27, 2020, 4:21pm UTC](https://discuss.elastic.co/t/2-server-elk-cluster-implementation/220308 "2020-02-27T16:21:14Z")
What is the best way to implement ELK stack for a log monitoring system on Windows. I have 2 servers with windows server 2019 installed. --- ## [Using OIDC authenticated browser session to query Elasticsearch API](https://discuss.elastic.co/t/using-oidc-authenticated-browser-session-to-query-elasticsearch-api/221278)
**Author:** [@Dennis\_Rietvink](https://discuss.elastic.co/u/Dennis_Rietvink)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 4:16pm UTC](https://discuss.elastic.co/t/using-oidc-authenticated-browser-session-to-query-elasticsearch-api/221278 "2020-02-27T16:16:05Z")
Hi There, We are currently successfully using an OIDC setup with Keycloak to integrate Kibana dashboards into our customer portal. We use Elastic Cloud as backend and host the Kibana instances ourselves. Both running 7.… --- ## [Creating new index from aggregation](https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275)
**Author:** [@mistrhanky](https://discuss.elastic.co/u/mistrhanky)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 4:08pm UTC](https://discuss.elastic.co/t/creating-new-index-from-aggregation/221275 "2020-02-27T16:08:30Z")
Here is my issue: I have to produce visualizations for some extended reporting. For brevity I will simply tell you I end up with events that look like they do below. The key thing is that I have multiple events per day w… --- ## [Hi, my backup disk is out of space](https://discuss.elastic.co/t/hi-my-backup-disk-is-out-of-space/221274)
**Author:** [@tfe2012](https://discuss.elastic.co/u/tfe2012)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 4:08pm UTC](https://discuss.elastic.co/t/hi-my-backup-disk-is-out-of-space/221274 "2020-02-27T16:08:07Z")
Hi, my back up disk is out of space I try to remove the old snapshot, but I getting an error: { "error": { "root\_cause": \[ { "type": "repository\_exception", "reason": "\[backup\] failed to delete snapshot \[snap\_2020… --- ## [Error while inserting data from Hadoop to ES](https://discuss.elastic.co/t/error-while-inserting-data-from-hadoop-to-es/219371)
**Author:** [@zizake](https://discuss.elastic.co/u/zizake)\ **Replies:** 2\ **Last updated:** [February 27, 2020, 4:01pm UTC](https://discuss.elastic.co/t/error-while-inserting-data-from-hadoop-to-es/219371 "2020-02-27T16:01:42Z")
Hello, ES: 6.2.3 Hadoop Plugin 6.2.3 I have an external table I want to be populated with some data from a Hive table (Parquet files) When I execute: INSERT OVERWRITE TABLE external\_es SELECT field-name1,field-name2,… --- ## [Master not discovered or elected yet, an election requires a node with id \[7pxH2sBjRcG2IZzFDfdKGg\]](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-a-node-with-id-7pxh2sbjrcg2izzfdfdkgg/221239)
**Author:** [@oengel](https://discuss.elastic.co/u/oengel)\ **Replies:** 7\ **Last updated:** [February 27, 2020, 3:59pm UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet-an-election-requires-a-node-with-id-7pxh2sbjrcg2izzfdfdkgg/221239 "2020-02-27T15:59:09Z")
Hi to all, On our cluster (not related to elasticsearch), we handle our own master election. (active/stdby architecture). Im trying to setup elasticsearch to work with our arch. We prepare the configuration file for e… --- ## [Will Rollup job run on older data?](https://discuss.elastic.co/t/will-rollup-job-run-on-older-data/221114)
**Author:** [@alarka](https://discuss.elastic.co/u/alarka)\ **Replies:** 1\ **Last updated:** [February 27, 2020, 3:29pm UTC](https://discuss.elastic.co/t/will-rollup-job-run-on-older-data/221114 "2020-02-27T15:29:00Z")
I have an index called data-2020 in my current cluster which has daily data I have a Rollup job which searches on index pattern data-\* I have the job running and it has been adding data to index "rollup-data" so … --- ## [Indeces is being created on the master machines](https://discuss.elastic.co/t/indeces-is-being-created-on-the-master-machines/221206)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 12\ **Last updated:** [February 27, 2020, 3:26pm UTC](https://discuss.elastic.co/t/indeces-is-being-created-on-the-master-machines/221206 "2020-02-27T15:26:15Z")
Hi , I'm new in Elastic world , we have a few master nodes , data nodes , logstash nodes and 2 ing nodes , 4 days a go indexes began to be written to the master nodes also , need your advice , what could be the reas… --- ## [Painless compile error using java](https://discuss.elastic.co/t/painless-compile-error-using-java/221263)
**Author:** [@dobrien](https://discuss.elastic.co/u/dobrien)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 3:21pm UTC](https://discuss.elastic.co/t/painless-compile-error-using-java/221263 "2020-02-27T15:21:46Z")
We are seeing strange errors in our elasticsearch log that our system does not call. "script\_fields" : { "myscript: : { "script" : { "source" : "java.lang.Math.class.forName("java.lang.System").getProperties()", "la… --- ## [Cutoff Frequency alternatives](https://discuss.elastic.co/t/cutoff-frequency-alternatives/221257)
**Author:** [@enthousiast](https://discuss.elastic.co/u/enthousiast)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 2:30pm UTC](https://discuss.elastic.co/t/cutoff-frequency-alternatives/221257 "2020-02-27T14:30:56Z")
Hello, I'm using Elasticsearch as a search engine for several web applications. I was using cutoff\_frequency to ensure good relevance in different cases : for most of our query, it's used for deleveraging high frequen… --- ## [Docker swarm discovery problems](https://discuss.elastic.co/t/docker-swarm-discovery-problems/219691)
**Author:** [@zboinek](https://discuss.elastic.co/u/zboinek)\ **Replies:** 7\ **Last updated:** [February 27, 2020, 1:47pm UTC](https://discuss.elastic.co/t/docker-swarm-discovery-problems/219691 "2020-02-27T13:47:14Z")
Hi all, I have following problem. I try to set up ES 7.6 in docker swarm mode with following docker-compose file version: "3" services: elasticsearch01: image: docker.elastic.co/elasticsearch/elasticsearch:7.6.0 … --- ## [Multiple Level with Parent Child Relation](https://discuss.elastic.co/t/multiple-level-with-parent-child-relation/221237)
**Author:** [@mobeit00](https://discuss.elastic.co/u/mobeit00)\ **Replies:** 1\ **Last updated:** [February 27, 2020, 1:11pm UTC](https://discuss.elastic.co/t/multiple-level-with-parent-child-relation/221237 "2020-02-27T13:11:29Z")
Hi I am new to elasticsearch and I am trying to map a folder structure that I want to search. My folders can have any number of subfolders and any number of files. Later I want to be able to search all children from the… --- ## [Machine Learning - Confused on Typical vs Actual Values](https://discuss.elastic.co/t/machine-learning-confused-on-typical-vs-actual-values/220984)
**Author:** [@Amarbayar\_Amarsanaa](https://discuss.elastic.co/u/Amarbayar_Amarsanaa)\ **Replies:** 3\ **Last updated:** [February 27, 2020, 12:59pm UTC](https://discuss.elastic.co/t/machine-learning-confused-on-typical-vs-actual-values/220984 "2020-02-27T12:59:49Z")
Elasticsearch: 7.5 Kibana: 7.5 This is regarding the Machine Learning feature and specifically around how the "Actual" and "Typical" scores are calculated. Before I posted this topic I read the following: https://www… --- ## [Strict order operator not working](https://discuss.elastic.co/t/strict-order-operator-not-working/219612)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 8\ **Last updated:** [February 27, 2020, 12:53pm UTC](https://discuss.elastic.co/t/strict-order-operator-not-working/219612 "2020-02-27T12:53:14Z")
Hi Support, I have two documents in index. Document 1. 12-34-56 12/34/56 Document 2. 56-12-34 56/12/34 I just need result for Document 1, if i search with "12-34-56" this keyword. The Problem is that when i sea… --- ## [Unable to view the logs in kibana](https://discuss.elastic.co/t/unable-to-view-the-logs-in-kibana/221238)
**Author:** [@rvb\_n](https://discuss.elastic.co/u/rvb_n)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 12:29pm UTC](https://discuss.elastic.co/t/unable-to-view-the-logs-in-kibana/221238 "2020-02-27T12:29:34Z")
Hi I am getting this log as err log data flow is filebeat\>logstash\>kibana but now not able to view the log in kibana. mi/java\] does not meet this requirement \[2020-02-27T11:12:09,372\]\[WARN \]\[o.e.d.c.s.Settings … --- ## [Alert plugin or Alert software to be integrated with Elastic stack in Basic License](https://discuss.elastic.co/t/alert-plugin-or-alert-software-to-be-integrated-with-elastic-stack-in-basic-license/221192)
**Author:** [@Shefali](https://discuss.elastic.co/u/Shefali)\ **Replies:** 2\ **Last updated:** [February 27, 2020, 12:26pm UTC](https://discuss.elastic.co/t/alert-plugin-or-alert-software-to-be-integrated-with-elastic-stack-in-basic-license/221192 "2020-02-27T12:26:01Z")
We are using Elastic stack in Basic License , but we require alert configuration. If there is any, please respond. For version 7.5 --- ## [How to search in array of objects](https://discuss.elastic.co/t/how-to-search-in-array-of-objects/221225)
**Author:** [@thewasta](https://discuss.elastic.co/u/thewasta)\ **Replies:** 2\ **Last updated:** [February 27, 2020, 12:24pm UTC](https://discuss.elastic.co/t/how-to-search-in-array-of-objects/221225 "2020-02-27T12:24:58Z")
Current version of ElasticSearch & Kibana 7.6.0 Hello folks! this is my template: GET \_template/my\_template "mappings" : { "\_meta" : { }, "\_source" : { }, "properties" : { "brands" : { … --- ## [SAP Applications Monitoring](https://discuss.elastic.co/t/sap-applications-monitoring/221235)
**Author:** [@raviraj80](https://discuss.elastic.co/u/raviraj80)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 12:16pm UTC](https://discuss.elastic.co/t/sap-applications-monitoring/221235 "2020-02-27T12:16:52Z")
Whether it is possible to do SAP Applications monitoring using ELK stack ? If yes then how..Can we integrate SAP Solution Manager with ELK ..how to ingest SAP logs into ELK --- ## [How to get correct count in aggregations](https://discuss.elastic.co/t/how-to-get-correct-count-in-aggregations/221232)
**Author:** [@tarungargbtp2612](https://discuss.elastic.co/u/tarungargbtp2612)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 12:06pm UTC](https://discuss.elastic.co/t/how-to-get-correct-count-in-aggregations/221232 "2020-02-27T12:06:49Z")
The count in aggregation is different than the documents matching on the aggregated value. Is there any correct way to get exact count of aggregation values. Example: "aggregations" : { "profiles" : { "doc\_co… --- ## [AWS ELK](https://discuss.elastic.co/t/aws-elk/221224)
**Author:** [@Vikas\_Sobti](https://discuss.elastic.co/u/Vikas_Sobti)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 11:46am UTC](https://discuss.elastic.co/t/aws-elk/221224 "2020-02-27T11:46:41Z")
Dear Team I am facing Issue with AWS ELK setup in back end we are facing below issue 1.SNAPSHOT STATUS RED 2.KIBANA STATUS YELLOW 3.DOMAIN STATUS PROCESSING (STUCK HERE FROM LAST FEW DAYS) Below is CLUSTER HEALTH S… --- ## [Configuration of two data nodes.while one is going down there is no data getting to the indexes](https://discuss.elastic.co/t/configuration-of-two-data-nodes-while-one-is-going-down-there-is-no-data-getting-to-the-indexes/221211)
**Author:** [@Ozil](https://discuss.elastic.co/u/Ozil)\ **Replies:** 3\ **Last updated:** [February 27, 2020, 11:46am UTC](https://discuss.elastic.co/t/configuration-of-two-data-nodes-while-one-is-going-down-there-is-no-data-getting-to-the-indexes/221211 "2020-02-27T11:46:09Z")
Hi All, I am using an Elastic search of 9 nodes which includes 2 data nodes. I am facing an issue like if one data node goes down .the all the data will be lost .there I a,m not getting any backup data. what I am think… --- ## [elasticSearch -Search in Italian and Hebrew](https://discuss.elastic.co/t/elasticsearch-search-in-italian-and-hebrew/221205)
**Author:** [@rezekiel](https://discuss.elastic.co/u/rezekiel)\ **Replies:** 5\ **Last updated:** [February 27, 2020, 11:21am UTC](https://discuss.elastic.co/t/elasticsearch-search-in-italian-and-hebrew/221205 "2020-02-27T11:21:21Z")
With elasticSearch 7.4 installed on Windows - what do i need to do/install to search for strings in Hebrew and in Italian --- ## [How to search Text in Multi-valued field elementwise](https://discuss.elastic.co/t/how-to-search-text-in-multi-valued-field-elementwise/221212)
**Author:** [@tarungargbtp2612](https://discuss.elastic.co/u/tarungargbtp2612)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-search-text-in-multi-valued-field-elementwise/221212 "2020-02-27T10:55:23Z")
I have a field: "skills" : \[ "smart worker", "dedicated", "english", "bengali", "dbms" \] If I write a match quer… --- ## [Unable to access payload \_source fields using Watcher foreach with rollup data](https://discuss.elastic.co/t/unable-to-access-payload-source-fields-using-watcher-foreach-with-rollup-data/221049)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 1\ **Last updated:** [February 27, 2020, 9:30am UTC](https://discuss.elastic.co/t/unable-to-access-payload-source-fields-using-watcher-foreach-with-rollup-data/221049 "2020-02-27T09:30:53Z")
Hi, I'm using Elastic 7.6.0. I created a very simple trigger that queries on aggregated rolled up metricbeat data, and logs any documents retrieved using the foreach action. However, I'm able to get the whole ctx.payl… --- ## [Elasticsearch Range Aggregation is including upper limit excluding lower limit](https://discuss.elastic.co/t/elasticsearch-range-aggregation-is-including-upper-limit-excluding-lower-limit/221185)
**Author:** [@tarungargbtp2612](https://discuss.elastic.co/u/tarungargbtp2612)\ **Replies:** 0\ **Last updated:** [February 27, 2020, 9:14am UTC](https://discuss.elastic.co/t/elasticsearch-range-aggregation-is-including-upper-limit-excluding-lower-limit/221185 "2020-02-27T09:14:34Z")
I am using the following query: { "aggs": { "profiles": { "nested": { "path": "profiles" }, "aggs": { "ctc": { "filter": { "range": { "profil… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1002) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1004)