# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1013 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1014 --- ## [Shield License Update Problem](https://discuss.elastic.co/t/shield-license-update-problem/217314)
**Author:** [@anilkocaturk](https://discuss.elastic.co/u/anilkocaturk)\ **Replies:** 4\ **Last updated:** [February 18, 2020, 12:42pm UTC](https://discuss.elastic.co/t/shield-license-update-problem/217314 "2020-02-18T12:42:46Z")
Hi Everyone, Several years ago, "shield" installed to one of our new customer's elasticsearch(v5.5) servers by an old employee and it's licence expired long time ago. On here they have 10 servers as cluster structure. … --- ## [Specify different path.data for different enviroments](https://discuss.elastic.co/t/specify-different-path-data-for-different-enviroments/219779)
**Author:** [@Saravana37](https://discuss.elastic.co/u/Saravana37)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 12:44pm UTC](https://discuss.elastic.co/t/specify-different-path-data-for-different-enviroments/219779 "2020-02-18T12:44:47Z")
Hello All , We are using same Elastic search instance for storing DEV,TEST and PROD data . My path.data and path.logs . path.data: G:/DEV/Elastic\_Search\_Data path.logs: G:/DEV/Elastic\_Search\_logs But i am trying to s… --- ## [Why minimum\_should\_match does not return multiple match?](https://discuss.elastic.co/t/why-minimum-should-match-does-not-return-multiple-match/219680)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 8:50pm UTC](https://discuss.elastic.co/t/why-minimum-should-match-does-not-return-multiple-match/219680 "2020-02-17T20:50:57Z")
Hi All, i am refering to this question How to use "OR" in Dev Tool Query While trying to extend this to 3 Match with a minimum should match number to 2 it does not return any when i set it like this ""minimum\_should\_mat… --- ## [Grouping the Index values by using common field](https://discuss.elastic.co/t/grouping-the-index-values-by-using-common-field/219780)
**Author:** [@SanTiaGo\_KarThiCk](https://discuss.elastic.co/u/SanTiaGo_KarThiCk)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 12:24pm UTC](https://discuss.elastic.co/t/grouping-the-index-values-by-using-common-field/219780 "2020-02-18T12:24:01Z")
Hy guys, My indexes are =\> index1=\> eid,name,age index2=\>eid,company,address Now i am combine these two indexes by creating index as index\* but, … --- ## [Advice for a Active Session graph](https://discuss.elastic.co/t/advice-for-a-active-session-graph/219774)
**Author:** [@Stefano\_Bossi](https://discuss.elastic.co/u/Stefano_Bossi)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 11:32am UTC](https://discuss.elastic.co/t/advice-for-a-active-session-graph/219774 "2020-02-18T11:32:52Z")
Dear ES forum, I am facing a problem with elastic search and I would like to ask an advice from some expert member. In my ES I have an index which is basically a streaming server log (e.g. it's actually radio streaming… --- ## [Highlighting copied fields in percolate queries](https://discuss.elastic.co/t/highlighting-copied-fields-in-percolate-queries/219768)
**Author:** [@smatamoros](https://discuss.elastic.co/u/smatamoros)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 11:15am UTC](https://discuss.elastic.co/t/highlighting-copied-fields-in-percolate-queries/219768 "2020-02-18T11:15:54Z")
Hi, I'm working with a use case where the results of percolate queries must been highlighted. With normal fields it works fine but I have problems with fields which content has been copied from other field. Here is an … --- ## [Issue with grok pattern which doesn't work](https://discuss.elastic.co/t/issue-with-grok-pattern-which-doesnt-work/219406)
**Author:** [@Cuju](https://discuss.elastic.co/u/Cuju)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 10:59am UTC](https://discuss.elastic.co/t/issue-with-grok-pattern-which-doesnt-work/219406 "2020-02-18T10:59:46Z")
Hello, I need to create a grok into Elasticsearch/Kibana/Filebeat to parse my message field. I find myself with two issues : Here is my pipeline : PUT /\_ingest/pipeline/filebeat-7.6.2-system-syslog-pipeline { "desc… --- ## [ES watcher Transform: formatting the script source](https://discuss.elastic.co/t/es-watcher-transform-formatting-the-script-source/219660)
**Author:** [@abdelhedi\_yassine](https://discuss.elastic.co/u/abdelhedi_yassine)\ **Replies:** 4\ **Last updated:** [February 18, 2020, 10:50am UTC](https://discuss.elastic.co/t/es-watcher-transform-formatting-the-script-source/219660 "2020-02-18T10:50:22Z")
Hi team, I'm really getting a hard time working with transform scripts cause it's only allowing me to write on 1 line: example: "transform": { "script": { "source": " String k; int i; int s; int a; float sar; for(i=0… --- ## [ES 7.0 New Date Format](https://discuss.elastic.co/t/es-7-0-new-date-format/219413)
**Author:** [@ben-charles](https://discuss.elastic.co/u/ben-charles)\ **Replies:** 3\ **Last updated:** [February 18, 2020, 10:40am UTC](https://discuss.elastic.co/t/es-7-0-new-date-format/219413 "2020-02-18T10:40:28Z")
We are currently upgrading from ES 6.8.2 to 7.0.0. We have date fields in our documents that are stored with the format yyyy-MM-dd'T'HH:mm:ss.SSSZ However, since in ES 7.0 uses java.util.time instead of Joda based time… --- ## [Is process cluster event timeout value configurable and how if yes?](https://discuss.elastic.co/t/is-process-cluster-event-timeout-value-configurable-and-how-if-yes/219710)
**Author:** [@f02061232](https://discuss.elastic.co/u/f02061232)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 10:12am UTC](https://discuss.elastic.co/t/is-process-cluster-event-timeout-value-configurable-and-how-if-yes/219710 "2020-02-18T10:12:05Z")
I got ProcessClusterEventTimeoutException when create/delete index, default value is 30s. Is this configurable and how to config it? org.elasticsearch.cluster.metadata.ProcessClusterEventTimeoutException: failed to proc… --- ## [Elasticsearch docs purging](https://discuss.elastic.co/t/elasticsearch-docs-purging/219656)
**Author:** [@Ron\_ITS](https://discuss.elastic.co/u/Ron_ITS)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 10:11am UTC](https://discuss.elastic.co/t/elasticsearch-docs-purging/219656 "2020-02-18T10:11:48Z")
Hi, Is there a ES function that can replace the epoch time? Currently we purge the doc according to ttl for past 35 days. is there a better way to handle it? {"size":0, "query": { "bool": { "must": \[ { "exists" : … --- ## [Python interface with elasticsearch base & PUT request](https://discuss.elastic.co/t/python-interface-with-elasticsearch-base-put-request/219067)
**Author:** [@cyrduf](https://discuss.elastic.co/u/cyrduf)\ **Replies:** 2\ **Last updated:** [February 18, 2020, 10:11am UTC](https://discuss.elastic.co/t/python-interface-with-elasticsearch-base-put-request/219067 "2020-02-18T10:11:11Z")
Once a base is created when i send a put request with : r = requests.put("http://localhost:9200//\_doc/", data=, headers=headers) I have sometimes exception in elasticsearch : \[2020-02-12T19:09:42,487\]\[INFO \]\[o.e.c.m.M… --- ## [Must\_not but include some data](https://discuss.elastic.co/t/must-not-but-include-some-data/219753)
**Author:** [@grant\_donovan](https://discuss.elastic.co/u/grant_donovan)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 10:08am UTC](https://discuss.elastic.co/t/must-not-but-include-some-data/219753 "2020-02-18T10:08:57Z")
I am trying to do the following, exclude data that matches restricted\_general\_calculated = "all" unless another field(s) = something This is the must\_not { "query": { "bool": { "must\_not": \[ { "terms": { … --- ## [Customize a Dictionary\_Decompounder](https://discuss.elastic.co/t/customize-a-dictionary-decompounder/219668)
**Author:** [@highchem](https://discuss.elastic.co/u/highchem)\ **Replies:** 1\ **Last updated:** [February 18, 2020, 10:07am UTC](https://discuss.elastic.co/t/customize-a-dictionary-decompounder/219668 "2020-02-18T10:07:43Z")
Hello Elasticsearch experts, I have a question about writing a custom analyzer using a dictionary\_decompounder. Here is a simplified example of the current mappings and settings of my index. PUT my\_index { "mapping… --- ## [Query performance issue with the very first one](https://discuss.elastic.co/t/query-performance-issue-with-the-very-first-one/219418)
**Author:** [@Anto89](https://discuss.elastic.co/u/Anto89)\ **Replies:** 5\ **Last updated:** [February 18, 2020, 8:15am UTC](https://discuss.elastic.co/t/query-performance-issue-with-the-very-first-one/219418 "2020-02-18T08:15:47Z")
The first time a query (classic full text query with a filter and a sort) is ran, it takes about 15-20s to get the result. It takes only few milliseconds for the next tries. Could anybody give me some explanations about … --- ## [Check if keyword is in text](https://discuss.elastic.co/t/check-if-keyword-is-in-text/219724)
**Author:** [@rcbfred](https://discuss.elastic.co/u/rcbfred)\ **Replies:** 0\ **Last updated:** [February 18, 2020, 7:24am UTC](https://discuss.elastic.co/t/check-if-keyword-is-in-text/219724 "2020-02-18T07:24:56Z")
So I have about 22,000 Boolean-like Keywords(e.g. ("stock market") ("trading"), ("ecology"|"pollution"), etc.) in an index and I want to query for those documents whose keyword can be found in a certain text. { "ma… --- ## [EBS root volume of master node runs out of burst credits after running for several days](https://discuss.elastic.co/t/ebs-root-volume-of-master-node-runs-out-of-burst-credits-after-running-for-several-days/219683)
**Author:** [@vroad](https://discuss.elastic.co/u/vroad)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 11:20pm UTC](https://discuss.elastic.co/t/ebs-root-volume-of-master-node-runs-out-of-burst-credits-after-running-for-several-days/219683 "2020-02-17T23:20:28Z")
On AWS, I run Elasticsearch 7.3.0 cluster composed of 2 t3.small nodes and 1 t3.small node. Each node has 16GB EBS volume for root volume. Nodes are managed by ECK. Is master node in abnormal state for some reasom, or j… --- ## [Elastic failing on Ubuntu 18 on AWS](https://discuss.elastic.co/t/elastic-failing-on-ubuntu-18-on-aws/219531)
**Author:** [@waynesmallman](https://discuss.elastic.co/u/waynesmallman)\ **Replies:** 11\ **Last updated:** [February 17, 2020, 10:10pm UTC](https://discuss.elastic.co/t/elastic-failing-on-ubuntu-18-on-aws/219531 "2020-02-17T22:10:32Z")
I've installed Elastic 7.5 on a t3a.small instance via AWS as part of a rebuild of an existing PHP application, also using Elastic on the same type of instance, although this would be Elastic 6.2 or something in the 6.x … --- ## [What is the best OS to install ELK](https://discuss.elastic.co/t/what-is-the-best-os-to-install-elk/219659)
**Author:** [@kumar4](https://discuss.elastic.co/u/kumar4)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 8:06pm UTC](https://discuss.elastic.co/t/what-is-the-best-os-to-install-elk/219659 "2020-02-17T20:06:56Z")
i have two servers (with similar CPU, RAM and storage but diffrent OS) one with unix and the other with microsoft Windows, i want to know what is the suitable OS fot installing ELK in terms of performance and security t… --- ## [Using 3 servers for ELK installation](https://discuss.elastic.co/t/using-3-servers-for-elk-installation/219657)
**Author:** [@snambu5878](https://discuss.elastic.co/u/snambu5878)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 7:10pm UTC](https://discuss.elastic.co/t/using-3-servers-for-elk-installation/219657 "2020-02-17T19:10:44Z")
Hi Everyone, We have a requirement to analyse and visualize 10 TB of data using ELK and we currently have 3 physical servers(RHEL based) to perform this task. Please suggest the best and different ways to install elasti… --- ## [Aggregation of data from "many to many" relational database tables](https://discuss.elastic.co/t/aggregation-of-data-from-many-to-many-relational-database-tables/219665)
**Author:** [@tales-info](https://discuss.elastic.co/u/tales-info)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 5:56pm UTC](https://discuss.elastic.co/t/aggregation-of-data-from-many-to-many-relational-database-tables/219665 "2020-02-17T17:56:16Z")
I have the following data from "many to many" tables in a relational database: Data in Relational Database ======================================================================= Table User user max\_formation 1… --- ## [Access integer array via doc without sorting?](https://discuss.elastic.co/t/access-integer-array-via-doc-without-sorting/219499)
**Author:** [@PhracturedBlue](https://discuss.elastic.co/u/PhracturedBlue)\ **Replies:** 2\ **Last updated:** [February 17, 2020, 4:43pm UTC](https://discuss.elastic.co/t/access-integer-array-via-doc-without-sorting/219499 "2020-02-17T16:43:56Z")
I was trying to do some scripting on the new 'histogram' datatype that comes with 7.6, but histograms don't support scripting. I thought I might be able to use arrays instead, but have not had any luck because arrays ar… --- ## [Export data](https://discuss.elastic.co/t/export-data/219184)
**Author:** [@jof300](https://discuss.elastic.co/u/jof300)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 4:10pm UTC](https://discuss.elastic.co/t/export-data/219184 "2020-02-17T16:10:51Z")
Hi, We have a cluster of 7 nodes which is growing up fastly. We want to find a way to "archive" some logs that we must keep (legal inquiries) for several years. I would like to know if there is a solution / command / w… --- ## [Grok expression with if for Elasticseach](https://discuss.elastic.co/t/grok-expression-with-if-for-elasticseach/219623)
**Author:** [@Cuju](https://discuss.elastic.co/u/Cuju)\ **Replies:** 7\ **Last updated:** [February 17, 2020, 3:38pm UTC](https://discuss.elastic.co/t/grok-expression-with-if-for-elasticseach/219623 "2020-02-17T15:38:44Z")
Hello, I would like to know if there is a possibility to make the if condition within a grok for Logstash, but for Elasticsearch ? I don't use Logstash but Filebeat Regards. --- ## [Open closed index, inconsistent status](https://discuss.elastic.co/t/open-closed-index-inconsistent-status/219607)
**Author:** [@Miguel1](https://discuss.elastic.co/u/Miguel1)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 2:53pm UTC](https://discuss.elastic.co/t/open-closed-index-inconsistent-status/219607 "2020-02-17T14:53:15Z")
Hi, folks! (my Elasticsearch version is 7.5.2) I have a closed index called "vpn-2019.52", a weekly vpn index and when I try to open it with: POST vpn-2019.52/\_open It timed out and reported nothing. After that I fou… --- ## [ELK on Virtual machine](https://discuss.elastic.co/t/elk-on-virtual-machine/219630)
**Author:** [@Rockk](https://discuss.elastic.co/u/Rockk)\ **Replies:** 1\ **Last updated:** [February 17, 2020, 2:28pm UTC](https://discuss.elastic.co/t/elk-on-virtual-machine/219630 "2020-02-17T14:28:07Z")
Hello Team, Can the ELK Stack(3 nodes - Elastic Search, Logstash and Kibana) be installed on the Virtual machines(Vmware or Hyper-V), Please advise. Also, what is the procedure to install and configure ELK Stack(3nodes… --- ## [Pulling the data from servicenow](https://discuss.elastic.co/t/pulling-the-data-from-servicenow/219624)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 3\ **Last updated:** [February 17, 2020, 2:11pm UTC](https://discuss.elastic.co/t/pulling-the-data-from-servicenow/219624 "2020-02-17T14:11:56Z")
Is there a way to pull the data from servicenow to be indexed into elasticsearch? --- ## [How Refresh works between primary and replica shards](https://discuss.elastic.co/t/how-refresh-works-between-primary-and-replica-shards/219181)
**Author:** [@Konathala\_Naveen](https://discuss.elastic.co/u/Konathala_Naveen)\ **Replies:** 5\ **Last updated:** [February 17, 2020, 2:01pm UTC](https://discuss.elastic.co/t/how-refresh-works-between-primary-and-replica-shards/219181 "2020-02-17T14:01:16Z")
How the refresh works between primary and replica shards 1.When the refresh happen on index.Does primary and replica shards refresh will happen in synchronous way? or After this indexing can happen asynchronously. --- ## [Elastic v8 Java Requirements](https://discuss.elastic.co/t/elastic-v8-java-requirements/219632)
**Author:** [@ahoffskov](https://discuss.elastic.co/u/ahoffskov)\ **Replies:** 0\ **Last updated:** [February 17, 2020, 1:54pm UTC](https://discuss.elastic.co/t/elastic-v8-java-requirements/219632 "2020-02-17T13:54:53Z")
Will AdoptOpenJDK be sufficient to run Elastic when upgrading to Elastic 8.0? --- ## [Curator 5.8 filters](https://discuss.elastic.co/t/curator-5-8-filters/218982)
**Author:** [@fgonzalez](https://discuss.elastic.co/u/fgonzalez)\ **Replies:** 14\ **Last updated:** [February 17, 2020, 1:24pm UTC](https://discuss.elastic.co/t/curator-5-8-filters/218982 "2020-02-17T13:24:25Z")
Good afternoon, I am trying to configure truncation of the indexes with Curator 5.8 in an ELK 7.6 with the following configuration and there is no way, do you see any errors in the filters? Thank you!! - filtertyp… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1012) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1014)