# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1007 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1008 --- ## [Cross Cluster Search - Intermittant Failures](https://discuss.elastic.co/t/cross-cluster-search-intermittant-failures/218379)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 16\ **Last updated:** [February 24, 2020, 5:54pm UTC](https://discuss.elastic.co/t/cross-cluster-search-intermittant-failures/218379 "2020-02-24T17:54:55Z")
I have an Elasticsearch setup at 5 physical sites. Kibana is installed at two of them, and I've configured cross-cluster search to enable searching data at the other locations. Each Kibana instance is separate, with se… --- ## [Return task id when submitting a POST request](https://discuss.elastic.co/t/return-task-id-when-submitting-a-post-request/220697)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 5:03pm UTC](https://discuss.elastic.co/t/return-task-id-when-submitting-a-post-request/220697 "2020-02-24T17:03:38Z")
Hello, How do I return the TASK ID when submitting a POST request like: POST \_reindex?requests\_per\_second=115&wait\_for\_completion=true { "source": { "index": "elb-2020.01.\*", "size": 500 }, "dest": { … --- ## [Watcher, X amount of logs, per X host per hour](https://discuss.elastic.co/t/watcher-x-amount-of-logs-per-x-host-per-hour/220674)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 1\ **Last updated:** [February 24, 2020, 4:43pm UTC](https://discuss.elastic.co/t/watcher-x-amount-of-logs-per-x-host-per-hour/220674 "2020-02-24T16:43:05Z")
Hello, I have been fighting with this for a few hours now and just can't get an alert that works. I want to basically find out when a host is spamming syslog, so I have a watcher like so: { "trigger": { "schedule… --- ## [Elastic search URI search to query object](https://discuss.elastic.co/t/elastic-search-uri-search-to-query-object/220367)
**Author:** [@arjun\_kumar](https://discuss.elastic.co/u/arjun_kumar)\ **Replies:** 7\ **Last updated:** [February 24, 2020, 4:37pm UTC](https://discuss.elastic.co/t/elastic-search-uri-search-to-query-object/220367 "2020-02-24T16:37:22Z")
GET twitter/\_search?q="11|2019|myName:user|testname|5b2b18f2-54ab-11ea-a2e3-2e728ce88125|A|M|testuser" when I run the above query able to get the exact results even I tried GET twitter/\_search?q="11|2019|myName:user|t… --- ## [New to ELk](https://discuss.elastic.co/t/new-to-elk/220686)
**Author:** [@oumy](https://discuss.elastic.co/u/oumy)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 3:28pm UTC](https://discuss.elastic.co/t/new-to-elk/220686 "2020-02-24T15:28:09Z")
Hello everyone, I am new to Elk, I am trying to build a SIEM with it, and it would be helpful if i know the architecture i can use, the parser i would need, And if it possible to add logrhythm Netmon for network monito… --- ## [Synonym list combined with wildcards got no more results](https://discuss.elastic.co/t/synonym-list-combined-with-wildcards-got-no-more-results/220683)
**Author:** [@JoeLiMo](https://discuss.elastic.co/u/JoeLiMo)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 3:14pm UTC](https://discuss.elastic.co/t/synonym-list-combined-with-wildcards-got-no-more-results/220683 "2020-02-24T15:14:59Z")
Hi, I hope anyone could help us to develop the right way to solve our little problems with synonyms and wildcards in elastic search. We are using a synonym list at our search to identified all relevant typings of users… --- ## [Cannot run ElasticSearch-7.5.0 on Linux(SUSE)](https://discuss.elastic.co/t/cannot-run-elasticsearch-7-5-0-on-linux-suse/220333)
**Author:** [@elabedouss](https://discuss.elastic.co/u/elabedouss)\ **Replies:** 2\ **Last updated:** [February 24, 2020, 3:01pm UTC](https://discuss.elastic.co/t/cannot-run-elasticsearch-7-5-0-on-linux-suse/220333 "2020-02-24T15:01:28Z")
I am trying to run ES on my server, and I got this error: Exception in thread "main" java.lang.UnsupportedClassVersionError: org/elasticsearch/tools/java\_version\_checker/JavaVersionChecker : Unsupported major.minor vers… --- ## [Increase no of shared not working (template update)](https://discuss.elastic.co/t/increase-no-of-shared-not-working-template-update/220429)
**Author:** [@Senthil\_ak](https://discuss.elastic.co/u/Senthil_ak)\ **Replies:** 2\ **Last updated:** [February 24, 2020, 3:01pm UTC](https://discuss.elastic.co/t/increase-no-of-shared-not-working-template-update/220429 "2020-02-24T15:01:20Z")
Hi, I have 3 master nodes and 3 data nodes running in elk. Beats sends logs to log stash and then to elk. The index name created from log stash o/p like below. elasticsearch { hosts =\> \["http://host1:9200","http://ho… --- ## [Aggregation that multiplies averages](https://discuss.elastic.co/t/aggregation-that-multiplies-averages/220680)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 2:53pm UTC](https://discuss.elastic.co/t/aggregation-that-multiplies-averages/220680 "2020-02-24T14:53:24Z")
Hello, With following dataset: area type result bld1 inspection 1 bld1 inspection 1 bld1 inspection 0 bld1 packing 1 bld1 packing 0 bld1 packing 0 bld1 inspection 1 bld1 packing 0 I would like to visualize a metr… --- ## [Missing fields in .security templates](https://discuss.elastic.co/t/missing-fields-in-security-templates/220678)
**Author:** [@kannan\_raj](https://discuss.elastic.co/u/kannan_raj)\ **Replies:** 1\ **Last updated:** [February 24, 2020, 2:52pm UTC](https://discuss.elastic.co/t/missing-fields-in-security-templates/220678 "2020-02-24T14:52:55Z")
Hi, I have tried to enable native realm authentication in elasticsearch 7.3.0 but the problem i have noticed that I could see missing values in .security index mapping when ES cluster is running without kibana. As a res… --- ## [Install Cluster of Elasticsearch on EC2 AWS](https://discuss.elastic.co/t/install-cluster-of-elasticsearch-on-ec2-aws/220494)
**Author:** [@Miguel\_Plazas](https://discuss.elastic.co/u/Miguel_Plazas)\ **Replies:** 8\ **Last updated:** [February 24, 2020, 2:45pm UTC](https://discuss.elastic.co/t/install-cluster-of-elasticsearch-on-ec2-aws/220494 "2020-02-24T14:45:02Z")
Hi, currently I'm trying to deploy a cluster with 3 nodes on EC2 AWS. The configuration is the following: #master node cluster.name: woombat node.name: node1 node.master: true bootstrap.memory\_lock: true discovery.zen.h… --- ## [Skipped responses](https://discuss.elastic.co/t/skipped-responses/220671)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 2:08pm UTC](https://discuss.elastic.co/t/skipped-responses/220671 "2020-02-24T14:08:28Z")
Hi, I am using ES 7.1.1 and elasticsearchjs. When I do msearch for the first time, it return "skipped" responses. But when I do the same msearch again (click F5 in gui), I finally get my data. Timerange is correct (last … --- ## [Problems with elasticsearch application](https://discuss.elastic.co/t/problems-with-elasticsearch-application/220666)
**Author:** [@waitangi1](https://discuss.elastic.co/u/waitangi1)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 1:52pm UTC](https://discuss.elastic.co/t/problems-with-elasticsearch-application/220666 "2020-02-24T13:52:24Z")
I have an application using ElasticSearch. Application worked for about year until last week. Now I have an error: \[DEBUG\] \[2020-02-24 12:44:18,868\] \[marek\] \[/claimexpert/Request/Access\] \[p132aiaqksed23jlzj3bodjj\] \[Moz… --- ## [Watcher : Extract \_source field in transform](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607)
**Author:** [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\ **Replies:** 1\ **Last updated:** [February 24, 2020, 1:25pm UTC](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607 "2020-02-24T13:25:54Z")
Hello all, I am trying to create a watcher based on my input query and trying to ingest data in another index. I have a multilevel output from the query and i am trying to transform that payload. My input payload loo… --- ## [Limit of total fields \[1000\] in index" has been exceeded](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-has-been-exceeded/220661)
**Author:** [@Veeresh\_Reddy](https://discuss.elastic.co/u/Veeresh_Reddy)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 1:23pm UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-has-been-exceeded/220661 "2020-02-24T13:23:34Z")
can i know how to know what values of index is being ingested , we were not getting this error earlier ? would you please help me debug what new values in index causing ? --- ## [Write elasticsearch's data directly on HDFS rather than on local filesystem](https://discuss.elastic.co/t/write-elasticsearchs-data-directly-on-hdfs-rather-than-on-local-filesystem/220640)
**Author:** [@hits.elastic](https://discuss.elastic.co/u/hits.elastic)\ **Replies:** 1\ **Last updated:** [February 24, 2020, 1:02pm UTC](https://discuss.elastic.co/t/write-elasticsearchs-data-directly-on-hdfs-rather-than-on-local-filesystem/220640 "2020-02-24T13:02:58Z")
Hi, I have an elasticsearch cluster running on kubernetes. Currently elasticsearch writing indices data on local filesystem (path: /usr/share/elasticsearch/data) as shown below. Since elasticsearch is producing a ver… --- ## [Black and white listing on article index](https://discuss.elastic.co/t/black-and-white-listing-on-article-index/220652)
**Author:** [@JPelastic](https://discuss.elastic.co/u/JPelastic)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 1:00pm UTC](https://discuss.elastic.co/t/black-and-white-listing-on-article-index/220652 "2020-02-24T13:00:15Z")
Imagine: a set of five million documents representing articles you can buy (article id) a set of ten thousand users representing the buyers (customer id) white lists and black lists defined daily on the articles: this … --- ## [Incoporating search with Boolean Queries?](https://discuss.elastic.co/t/incoporating-search-with-boolean-queries/220649)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 12:52pm UTC](https://discuss.elastic.co/t/incoporating-search-with-boolean-queries/220649 "2020-02-24T12:52:12Z")
Hi, I am currently using the following query - { "\_source": \[ "title", "bench", "id\_", "court", "date", "content" \], "size": 15, "from": 0, "query": {… --- ## [UpdateByQuery script update - when does ES update document?](https://discuss.elastic.co/t/updatebyquery-script-update-when-does-es-update-document/220642)
**Author:** [@MattJones](https://discuss.elastic.co/u/MattJones)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 12:08pm UTC](https://discuss.elastic.co/t/updatebyquery-script-update-when-does-es-update-document/220642 "2020-02-24T12:08:38Z")
For an index with the following mapping: { "item\_code": { "type": "keyword", "index": true, }, "prices": { "type": "nested", "dynamic": false, "properties": { "pricing\_hash": { "t… --- ## [Error | Install prometheus plugin for elasticsearch](https://discuss.elastic.co/t/error-install-prometheus-plugin-for-elasticsearch/217520)
**Author:** [@Muhammad\_Badawy](https://discuss.elastic.co/u/Muhammad_Badawy)\ **Replies:** 8\ **Last updated:** [February 24, 2020, 11:55am UTC](https://discuss.elastic.co/t/error-install-prometheus-plugin-for-elasticsearch/217520 "2020-02-24T11:55:40Z")
Trying to install prometheus-exporter plugin for elasticsearch - version 6.5.4.0 but I got the below error Any support to resolve this? \[root@ elasticsearch\]# ./bin/elasticsearch-plugin install -b file:///tmp/elasticse… --- ## [Merge multiple indices in one](https://discuss.elastic.co/t/merge-multiple-indices-in-one/220543)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 6\ **Last updated:** [February 24, 2020, 11:13am UTC](https://discuss.elastic.co/t/merge-multiple-indices-in-one/220543 "2020-02-24T11:13:19Z")
Hello, We have an ES cluster that stores daily indexes, like elb-2020.01.09 logs. Apart from Index Life Cycle, is there are other ways to merge all elb-2020.01.\* indexes into elb-2020.01 index and then delete all the e… --- ## [Shards on K8s elastic cluster](https://discuss.elastic.co/t/shards-on-k8s-elastic-cluster/220634)
**Author:** [@SadeekM](https://discuss.elastic.co/u/SadeekM)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 11:11am UTC](https://discuss.elastic.co/t/shards-on-k8s-elastic-cluster/220634 "2020-02-24T11:11:16Z")
Continuing the discussion from Shards on Kubernets: I updated default template on kibana and my issue fixed === PUT \_template/default { "index\_patterns": \["\*"\], "order": -1, "settings": { "number\_of\_shards": "5"… --- ## [Load Data from other index without searching in this index](https://discuss.elastic.co/t/load-data-from-other-index-without-searching-in-this-index/220412)
**Author:** [@nerd2000](https://discuss.elastic.co/u/nerd2000)\ **Replies:** 4\ **Last updated:** [February 24, 2020, 11:05am UTC](https://discuss.elastic.co/t/load-data-from-other-index-without-searching-in-this-index/220412 "2020-02-24T11:05:07Z")
Hi, Let's say that I have this 2 indices: { "films": { "mappings": { "properties": { "id": {"type": long}, "title": {"type": keyword}, "release\_da… --- ## [Can not to delete snapshots](https://discuss.elastic.co/t/can-not-to-delete-snapshots/220615)
**Author:** [@Ramazan\_dd](https://discuss.elastic.co/u/Ramazan_dd)\ **Replies:** 1\ **Last updated:** [February 24, 2020, 11:01am UTC](https://discuss.elastic.co/t/can-not-to-delete-snapshots/220615 "2020-02-24T11:01:06Z")
Hello, I need to delete snapshots but delete\_snapshots action does not work. This is my action\_file actions: 1: action: delete\_snapshots description: "Delete selected snapshots from 'backup'" options: … --- ## [How to change index.max\_shingle\_diff?](https://discuss.elastic.co/t/how-to-change-index-max-shingle-diff/220421)
**Author:** [@cgsoratto](https://discuss.elastic.co/u/cgsoratto)\ **Replies:** 3\ **Last updated:** [February 24, 2020, 10:53am UTC](https://discuss.elastic.co/t/how-to-change-index-max-shingle-diff/220421 "2020-02-24T10:53:20Z")
Hi! I installed ES 7.6.0 but I have the error: "In Shingle TokenFilter the difference between max\_shingle\_size and min\_shingle\_size (and +1 if outputting unigrams) must be less than or equal to: \[3\] but was \[9\]. This l… --- ## [Elasticsearch gc overhead](https://discuss.elastic.co/t/elasticsearch-gc-overhead/220620)
**Author:** [@Akaren](https://discuss.elastic.co/u/Akaren)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-gc-overhead/220620 "2020-02-24T10:07:57Z")
I am using ES 7.1.1. I have 4 big indices (around 20-40GB, 2 shards) and 6 small indices (500MB). Disk memory is 32GB, heap size is set (min and max) to 13GB. And only one node. Searching is so slow and I can see warn… --- ## [ALIAS and Complicated Search Query](https://discuss.elastic.co/t/alias-and-complicated-search-query/220617)
**Author:** [@Rishabh\_Baid](https://discuss.elastic.co/u/Rishabh_Baid)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 10:04am UTC](https://discuss.elastic.co/t/alias-and-complicated-search-query/220617 "2020-02-24T10:04:57Z")
Hi I am trying to write this query - search Elasticsearch docs - in the field - foobar - for anything which has the characters "rix" in it - Then lets assume we get 500 documents with "rix" in foobar field.. Now I wa… --- ## [Is there any spaCy libraries for Elasticsearch available?](https://discuss.elastic.co/t/is-there-any-spacy-libraries-for-elasticsearch-available/220284)
**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\ **Replies:** 6\ **Last updated:** [February 24, 2020, 9:59am UTC](https://discuss.elastic.co/t/is-there-any-spacy-libraries-for-elasticsearch-available/220284 "2020-02-24T09:59:32Z")
Hi guys, wanted to check if there is any spaCy plugins or libraries for Elasticsearch available out there? I found the openNLP Ingest processor but my professor wants me to find more on using spaCy... Much appreciated!… --- ## [Combine multiple terms aggregation as a pipeline](https://discuss.elastic.co/t/combine-multiple-terms-aggregation-as-a-pipeline/220588)
**Author:** [@fenster25](https://discuss.elastic.co/u/fenster25)\ **Replies:** 4\ **Last updated:** [February 24, 2020, 9:46am UTC](https://discuss.elastic.co/t/combine-multiple-terms-aggregation-as-a-pipeline/220588 "2020-02-24T09:46:22Z")
Lets say I have two fields in my docs location and projects. I want a terms aggregation on locations first and then on each of the aggregated buckets run a terms aggregation on projects. Is this possible? I went through … --- ## [Java API - List all indices for Elasticsearch v.2.4.5](https://discuss.elastic.co/t/java-api-list-all-indices-for-elasticsearch-v-2-4-5/220611)
**Author:** [@zam999](https://discuss.elastic.co/u/zam999)\ **Replies:** 0\ **Last updated:** [February 24, 2020, 9:38am UTC](https://discuss.elastic.co/t/java-api-list-all-indices-for-elasticsearch-v-2-4-5/220611 "2020-02-24T09:38:19Z")
Dear Support, Is there a way to collect all the indices from Elasticsearch v.2.4.5 in Java? Obtaining at the end a List of String. Thank you [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1006) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1008)