# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1006 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1007 --- ## [Elasticsearch query to return the most recent of 'each document' based on a condition](https://discuss.elastic.co/t/elasticsearch-query-to-return-the-most-recent-of-each-document-based-on-a-condition/220927)
**Author:** [@dagus2020](https://discuss.elastic.co/u/dagus2020)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 9:38pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-return-the-most-recent-of-each-document-based-on-a-condition/220927 "2020-02-25T21:38:18Z")
0 I am trying to retrieve the most recent version of each document in my dataset when the document is not already archived ( archived: false ). So when any version of the document has archived set to true, it should not… --- ## [Alternatives to document level security / Performance of multiples indices](https://discuss.elastic.co/t/alternatives-to-document-level-security-performance-of-multiples-indices/220914)
**Author:** [@Pablo\_Albertengo](https://discuss.elastic.co/u/Pablo_Albertengo)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 6:45pm UTC](https://discuss.elastic.co/t/alternatives-to-document-level-security-performance-of-multiples-indices/220914 "2020-02-25T18:45:45Z")
I have the following scenario. We currently use an index to audit the operations of our suppliers in our system (supplierop index). This index is consulted internally, accessing the information of all suppliers, throug… --- ## [Unable to view my custom index patterns in kibana](https://discuss.elastic.co/t/unable-to-view-my-custom-index-patterns-in-kibana/220905)
**Author:** [@preeti20](https://discuss.elastic.co/u/preeti20)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 6:17pm UTC](https://discuss.elastic.co/t/unable-to-view-my-custom-index-patterns-in-kibana/220905 "2020-02-25T18:17:05Z")
Hi all, I am doing an install of Elasticsearch 7.6 version on my kubernetes cluster. I have an index-template json which creates custom index patterns. my template.json looks like below. When i create the template, I ge… --- ## [Unable to retreive aggregation for keyword field with high cardinality (Data Table)](https://discuss.elastic.co/t/unable-to-retreive-aggregation-for-keyword-field-with-high-cardinality-data-table/220874)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 2\ **Last updated:** [February 25, 2020, 5:06pm UTC](https://discuss.elastic.co/t/unable-to-retreive-aggregation-for-keyword-field-with-high-cardinality-data-table/220874 "2020-02-25T17:06:24Z")
Hello, I am gathering logs from one of our machines. One of our fields: error.keyword is a high cardinality field and we are doing an aggregation using it. I run the query for last 5 minutes, where there are less than 1… --- ## [Rollup job id with space](https://discuss.elastic.co/t/rollup-job-id-with-space/220892)
**Author:** [@alarka](https://discuss.elastic.co/u/alarka)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 4:32pm UTC](https://discuss.elastic.co/t/rollup-job-id-with-space/220892 "2020-02-25T16:32:33Z")
I created a Rollup job with the "id" field having a space. Now, for stopping the job, I have to run POST \_rollup/job/\/\_stop How do I handle the space? I tried the following and they did not work. I am running E… --- ## [Some questions about “cat/tasks” api](https://discuss.elastic.co/t/some-questions-about-cat-tasks-api/220832)
**Author:** [@ITzhangqiang](https://discuss.elastic.co/u/ITzhangqiang)\ **Replies:** 1\ **Last updated:** [February 25, 2020, 4:08pm UTC](https://discuss.elastic.co/t/some-questions-about-cat-tasks-api/220832 "2020-02-25T16:08:25Z")
hi, I use "GET \_cat/tasks?v&detailed" to show tasks details, as follows： But I don't know what‘s the meaning of “request\[24\]” ，how to understand the number “24”？ --- ## [Delete\_snapshot action fails, get() takes at least 2 arguments (2 given)](https://discuss.elastic.co/t/delete-snapshot-action-fails-get-takes-at-least-2-arguments-2-given/219934)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 6\ **Last updated:** [February 25, 2020, 3:39pm UTC](https://discuss.elastic.co/t/delete-snapshot-action-fails-get-takes-at-least-2-arguments-2-given/219934 "2020-02-25T15:39:19Z")
Hi, We have the following action file for curator: --- actions: 1: action: delete\_snapshots description: \>- Delete snapshots older than 6 months for all logstash snapshots options: repository:… --- ## [MatchPhraseQuery not working](https://discuss.elastic.co/t/matchphrasequery-not-working/220871)
**Author:** [@arvind73156](https://discuss.elastic.co/u/arvind73156)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 2:16pm UTC](https://discuss.elastic.co/t/matchphrasequery-not-working/220871 "2020-02-25T14:16:08Z")
Hi, I am searching text 92% in elastic search using match phrase query. But search response also giving me values containing text 92 but i want only text containing 92% --- ## [Elasticsearch 7.6.0 Installation Failed in server](https://discuss.elastic.co/t/elasticsearch-7-6-0-installation-failed-in-server/220864)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 1:46pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-0-installation-failed-in-server/220864 "2020-02-25T13:46:32Z")
Cannot able to start the elasticsearch using ccommand prompt. It was installed successfully when starting the services it throws Error : Could not find or load main class Warning --- ## [{"statusCode":403,"error":"Forbidden","message":"Forbidden"}to open kibana with AD authentication](https://discuss.elastic.co/t/statuscode-403-error-forbidden-message-forbidden-to-open-kibana-with-ad-authentication/220326)
**Author:** [@Jhansi](https://discuss.elastic.co/u/Jhansi)\ **Replies:** 5\ **Last updated:** [February 25, 2020, 1:02pm UTC](https://discuss.elastic.co/t/statuscode-403-error-forbidden-message-forbidden-to-open-kibana-with-ad-authentication/220326 "2020-02-25T13:02:28Z")
I am trying to login kibana by using Active Directory users.I am done with settings in elasticsearch.yml file and I am able to login kibana page by using Ad users but it shows the {"statusCode":403,"error":"Forbidden","… --- ## [Filter order influences results](https://discuss.elastic.co/t/filter-order-influences-results/220857)
**Author:** [@jakobLIS](https://discuss.elastic.co/u/jakobLIS)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 12:41pm UTC](https://discuss.elastic.co/t/filter-order-influences-results/220857 "2020-02-25T12:41:04Z")
Hey everybody! For our elastic search implementation we use a custom analyzer looking like so: 'my\_analyzer': tokenizer: 'standard' filter: \[ 'german\_stop', 'english\_stop', 'german\_stemmer', 'english\_stemmer', 'sy… --- ## [\[ES 7.0\] Filtering nested aggregation - how do I do it?](https://discuss.elastic.co/t/es-7-0-filtering-nested-aggregation-how-do-i-do-it/220851)
**Author:** [@dirkdiggler41](https://discuss.elastic.co/u/dirkdiggler41)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 12:18pm UTC](https://discuss.elastic.co/t/es-7-0-filtering-nested-aggregation-how-do-i-do-it/220851 "2020-02-25T12:18:44Z")
I have tried to filter out all the objects/documents in the nested objected called jobs\_won, but I can't seem to get it to work. I have been googling for days :sweat\_smile: How do I filter out certain objects/documents … --- ## [Intercepting Elasticsearch response](https://discuss.elastic.co/t/intercepting-elasticsearch-response/220846)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 12:10pm UTC](https://discuss.elastic.co/t/intercepting-elasticsearch-response/220846 "2020-02-25T12:10:37Z")
Hi all, I have written a sample Elasticsearch plugin basically to manipulate the search response. Like extending BaseRestHandler, and registering handler, controller.registerHandler(GET, "/\_mysearch", this);. and by … --- ## [How to make Elasticsearch API calls in Magento 2](https://discuss.elastic.co/t/how-to-make-elasticsearch-api-calls-in-magento-2/220831)
**Author:** [@tajveez](https://discuss.elastic.co/u/tajveez)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 10:55am UTC](https://discuss.elastic.co/t/how-to-make-elasticsearch-api-calls-in-magento-2/220831 "2020-02-25T10:55:19Z")
Hi, I have a custom search field from which I want to access elasticsearch results, for that, I am making API calls to URL: http://\:9200/\_search with body { "query": { "bool": { … --- ## [Posting data to elasticsearch index using java API](https://discuss.elastic.co/t/posting-data-to-elasticsearch-index-using-java-api/219714)
**Author:** [@cravinder489](https://discuss.elastic.co/u/cravinder489)\ **Replies:** 6\ **Last updated:** [February 25, 2020, 10:35am UTC](https://discuss.elastic.co/t/posting-data-to-elasticsearch-index-using-java-api/219714 "2020-02-25T10:35:47Z")
I'm sending data to my elasticsearch index using JestClient in java(using a POJO class). JSONObject obj1 = new JSONObject(); obj1.put("name","answer"); test1 document = new tes… --- ## [Add new field into an array](https://discuss.elastic.co/t/add-new-field-into-an-array/220822)
**Author:** [@Aymen\_Rahal1](https://discuss.elastic.co/u/Aymen_Rahal1)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 10:28am UTC](https://discuss.elastic.co/t/add-new-field-into-an-array/220822 "2020-02-25T10:28:59Z")
I wanna add a new field into my product mapping. below is my mapping: { "mappings": { "properties": { "name": { "type": "text", "fields": { "keyword": {"type": "keyword"} } }, "resslers": { "type": "nested", … --- ## [Adding char\_filter into language analyzer](https://discuss.elastic.co/t/adding-char-filter-into-language-analyzer/220818)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 10:14am UTC](https://discuss.elastic.co/t/adding-char-filter-into-language-analyzer/220818 "2020-02-25T10:14:00Z")
Is there a way to extend language analyzer with char\_filter without having to reimplement the whole analyzer? We are trying to add html\_strip char\_filter into language analyzed fields, following https://www.elastic.co/g… --- ## [Elasticsearch Screenshot Error](https://discuss.elastic.co/t/elasticsearch-screenshot-error/220816)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 10:06am UTC](https://discuss.elastic.co/t/elasticsearch-screenshot-error/220816 "2020-02-25T10:06:38Z")
Hi, Im currently trying to take a manual screenshot of elasticsearch to backup amazon s3. After I imput my code, i keep getting this error.. {"error":{"root\_cause":\[{"type":"repository\_verification\_exception","reason"… --- ## [Watcher parse an array](https://discuss.elastic.co/t/watcher-parse-an-array/220777)
**Author:** [@cmiscloni](https://discuss.elastic.co/u/cmiscloni)\ **Replies:** 5\ **Last updated:** [February 25, 2020, 9:57am UTC](https://discuss.elastic.co/t/watcher-parse-an-array/220777 "2020-02-25T09:57:25Z")
Hi all, I try to monitor some events with watcher but I can't find the solution to parse the hits of the array below { "watch\_id": "inlined", "node": "\*\*\*\*\*\*\*\*\*\*\*\*\*", "state": "executed", "status": { "state": { "… --- ## [Upgrade Elasticsearch 2.4.0 to 5.6.0](https://discuss.elastic.co/t/upgrade-elasticsearch-2-4-0-to-5-6-0/220808)
**Author:** [@ruipoliveira](https://discuss.elastic.co/u/ruipoliveira)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 9:44am UTC](https://discuss.elastic.co/t/upgrade-elasticsearch-2-4-0-to-5-6-0/220808 "2020-02-25T09:44:20Z")
I have the configuration for the 3 masters: master1 cluster.name: elasticsearch node.master: true node.data: false node.name: "master1" path.data: /data/data path.logs: /data/log bootstrap.memory\_lock: true transport.t… --- ## [Documentation to link remote clusters using proxy](https://discuss.elastic.co/t/documentation-to-link-remote-clusters-using-proxy/220229)
**Author:** [@twiggy](https://discuss.elastic.co/u/twiggy)\ **Replies:** 4\ **Last updated:** [February 25, 2020, 8:41am UTC](https://discuss.elastic.co/t/documentation-to-link-remote-clusters-using-proxy/220229 "2020-02-25T08:41:34Z")
Hello everyone, From the the release note : With Elasticsearch 7.6, a proxy can now be used between clusters for both CCR and CCS. This means fewer ports need to be opened between Elasticsearch clusters when a proxy i… --- ## [Analyzer \[default\_analyzer\] not found for field \[stateNames\]](https://discuss.elastic.co/t/analyzer-default-analyzer-not-found-for-field-statenames/220595)
**Author:** [@Raady\_s](https://discuss.elastic.co/u/Raady_s)\ **Replies:** 3\ **Last updated:** [February 25, 2020, 8:17am UTC](https://discuss.elastic.co/t/analyzer-default-analyzer-not-found-for-field-statenames/220595 "2020-02-25T08:17:23Z")
I am trying to copy data from my old elastic to a new elastic. So, I was copy the mapping and setting of the index. {"mappings":{"profile":{"properties":{"Address":{"type":"text","analyzer":"default\_analyzer"},"Candidat… --- ## [Delete older indices in elasticsearch](https://discuss.elastic.co/t/delete-older-indices-in-elasticsearch/220776)
**Author:** [@Vipin\_Gaur](https://discuss.elastic.co/u/Vipin_Gaur)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 6:27am UTC](https://discuss.elastic.co/t/delete-older-indices-in-elasticsearch/220776 "2020-02-25T06:27:12Z")
I have the many of my logs indexed in logstash-Year-Week format. That is if i want to delete indices older than one month, how can I achieve that in elasticsearch using XDELETE --- ## [How to Select First matching document by group by for more than 10000 records](https://discuss.elastic.co/t/how-to-select-first-matching-document-by-group-by-for-more-than-10000-records/220770)
**Author:** [@Pinky\_Agarwal](https://discuss.elastic.co/u/Pinky_Agarwal)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 5:41am UTC](https://discuss.elastic.co/t/how-to-select-first-matching-document-by-group-by-for-more-than-10000-records/220770 "2020-02-25T05:41:13Z")
I am using Collapse to get first element of group by with the search api. but it is working if my Limit+offset is less than 10000. for more than 10000 i am using the scroll api , collpase is not working with scroll , wha… --- ## [Indezes and Sharding on Cluster](https://discuss.elastic.co/t/indezes-and-sharding-on-cluster/220641)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [February 25, 2020, 4:07am UTC](https://discuss.elastic.co/t/indezes-and-sharding-on-cluster/220641 "2020-02-25T04:07:41Z")
Hi, in case we expected 300-500gb data per day and we have 4 data nodes in cluster. We want to create 1 index per day. How many Shards are wise to split the index off? 4 Shards to balance the load to the 4 Nodes? 8 … --- ## [Basic Authentication with cppRest-SDK(casablanca)](https://discuss.elastic.co/t/basic-authentication-with-cpprest-sdk-casablanca/220745)
**Author:** [@IC1101Galaxy](https://discuss.elastic.co/u/IC1101Galaxy)\ **Replies:** 0\ **Last updated:** [February 25, 2020, 1:13am UTC](https://discuss.elastic.co/t/basic-authentication-with-cpprest-sdk-casablanca/220745 "2020-02-25T01:13:20Z")
I'd like to set a Basic Authentication with cppRest-sdk AKA casablanca for the security configuration to elastic-search cluster. I've tried to do with header configuration such as following and it worked fine. http\_cl… --- ## [How to achieve fault tolerance](https://discuss.elastic.co/t/how-to-achieve-fault-tolerance/220720)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 3\ **Last updated:** [February 24, 2020, 9:49pm UTC](https://discuss.elastic.co/t/how-to-achieve-fault-tolerance/220720 "2020-02-24T21:49:49Z")
I have a 8 node elk cluster, 3 data dedicated nodes, 3 master dedicated node and 2 http(kibana) nodes. Currently the indexes are daily created with date stamp. It contains around 21293408 docs on daily average. The inde… --- ## [After adding second host I can no longer create or view visualizations](https://discuss.elastic.co/t/after-adding-second-host-i-can-no-longer-create-or-view-visualizations/220708)
**Author:** [@MalcolmReynoldsWrap](https://discuss.elastic.co/u/MalcolmReynoldsWrap)\ **Replies:** 5\ **Last updated:** [February 24, 2020, 9:22pm UTC](https://discuss.elastic.co/t/after-adding-second-host-i-can-no-longer-create-or-view-visualizations/220708 "2020-02-24T21:22:25Z")
For about a year we operated on a single host/instance of Elastic. I've secured the ElasticStack with the native (basic) authentication scheme and everything was working fine. I've now added a second host and clustered … --- ## [Custom sequence numbers for partial updates](https://discuss.elastic.co/t/custom-sequence-numbers-for-partial-updates/220459)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 2\ **Last updated:** [February 24, 2020, 7:52pm UTC](https://discuss.elastic.co/t/custom-sequence-numbers-for-partial-updates/220459 "2020-02-24T19:52:07Z")
Hi, I'm reading about partial updates and found that we cannot use external version with partial updates. However, I see that ES has introduced seq\_no and primary\_term for concurrency control. I see that seq\_no is auto… --- ## [Elasticsearch warm node CPU spike while search query](https://discuss.elastic.co/t/elasticsearch-warm-node-cpu-spike-while-search-query/220711)
**Author:** [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 6:44pm UTC](https://discuss.elastic.co/t/elasticsearch-warm-node-cpu-spike-while-search-query/220711 "2020-02-24T18:44:33Z")
Hi, I have Elastic Stack v7.4 installed on cloud. I have 8 nodes (3-master, 3-Hot, 2-Warm) ILM policy is in place which keeps one month recent data in hot node and the remaining in warm data node. Now when I do a quer… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1005) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1007)