# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1014

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1015

---

## [SSLHandshakeException](https://discuss.elastic.co/t/sslhandshakeexception/219616)

<div class="topic-metadata">

**Author:** [@Chelambarasan\_CR](https://discuss.elastic.co/u/Chelambarasan_CR)\
**Replies:** 0\
**Last updated:** [February 17, 2020, 12:30pm UTC](https://discuss.elastic.co/t/sslhandshakeexception/219616 "2020-02-17T12:30:21Z")

</div>

Getting the below error in Elastic 7.5.1 and readonly rest 1.19.0 version. I am using OSS Elastic and Open source read only rest verification. SSL and Auth works fine but after enabling certificate verification for inte…

---

## [Restore a partial data (results matching to a query) from a snapshot](https://discuss.elastic.co/t/restore-a-partial-data-results-matching-to-a-query-from-a-snapshot/219608)

<div class="topic-metadata">

**Author:** [@kaushik.vankayala](https://discuss.elastic.co/u/kaushik.vankayala)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 12:13pm UTC](https://discuss.elastic.co/t/restore-a-partial-data-results-matching-to-a-query-from-a-snapshot/219608 "2020-02-17T12:13:35Z")

</div>

Hi Team, I am wondering if we can restore data from a snapshot that matches a query. This i am doing because i have a snapshot of about 96gb stored in custom S3 repository. There was a policy applied and the storage cl…

---

## [Case insensitive LDAP integration for Elasticsearch](https://discuss.elastic.co/t/case-insensitive-ldap-integration-for-elasticsearch/219604)

<div class="topic-metadata">

**Author:** [@dantonag](https://discuss.elastic.co/u/dantonag)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 12:09pm UTC](https://discuss.elastic.co/t/case-insensitive-ldap-integration-for-elasticsearch/219604 "2020-02-17T12:09:04Z")

</div>

Hello, we have configured the company LDAP integration for our instance of ES (6.8). Our problem is that LDAP is case sensitive, and many users wrongly insert their username in lowercase. Is there a way to avoid this b…

---

## [Locked/read only indices Notifications](https://discuss.elastic.co/t/locked-read-only-indices-notifications/219610)

<div class="topic-metadata">

**Author:** [@cowensel](https://discuss.elastic.co/u/cowensel)\
**Replies:** 0\
**Last updated:** [February 17, 2020, 12:06pm UTC](https://discuss.elastic.co/t/locked-read-only-indices-notifications/219610 "2020-02-17T12:06:36Z")

</div>

Is there a way of being able to send an external email when Elasticsearch enters the read only state due to disk space or logstash cannot create records? We have had a couple of instances where this has happened and wou…

---

## [Add creation (not update) time of doc using ingest](https://discuss.elastic.co/t/add-creation-not-update-time-of-doc-using-ingest/217515)

<div class="topic-metadata">

**Author:** [@alza](https://discuss.elastic.co/u/alza)\
**Replies:** 11\
**Last updated:** [February 17, 2020, 11:53am UTC](https://discuss.elastic.co/t/add-creation-not-update-time-of-doc-using-ingest/217515 "2020-02-17T11:53:54Z")

</div>

I'm using the following pipeline to add creation timestamp to docs but it changes the timestamp every time that I put a newer version of a same doc to elastic. PUT \_ingest/pipeline/set\_creation\_date { "description":…

---

## [Permanently Delete All Old Documents with a Rollup Job?](https://discuss.elastic.co/t/permanently-delete-all-old-documents-with-a-rollup-job/218801)

<div class="topic-metadata">

**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\
**Replies:** 5\
**Last updated:** [February 17, 2020, 11:48am UTC](https://discuss.elastic.co/t/permanently-delete-all-old-documents-with-a-rollup-job/218801 "2020-02-17T11:48:47Z")

</div>

Hello Master Elasticsearch Gurus, I am new to ELK and last year implemented a simple Elasticsearch server (ver 7.4.0, I know, I have to upgrade) that is archiving some simple production user data. When I set up ES, I t…

---

## [Why is synced flush failing for this index?](https://discuss.elastic.co/t/why-is-synced-flush-failing-for-this-index/219425)

<div class="topic-metadata">

**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\
**Replies:** 2\
**Last updated:** [February 17, 2020, 11:03am UTC](https://discuss.elastic.co/t/why-is-synced-flush-failing-for-this-index/219425 "2020-02-17T11:03:26Z")

</div>

Elasticsearch 6.8.6. The index has ten primary shards and replicas is set to 1. Each shards is ~30GB. The index (and cluster) health is Green. No data is being written to the index. A flushed sync consistently fails on a…

---

## [Too many wildcards in the search request causes system to immediately shoot to 100% CPU, HEAP- DOS attack](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508)

<div class="topic-metadata">

**Author:** [@shamzeer](https://discuss.elastic.co/u/shamzeer)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 10:49am UTC](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508 "2020-02-17T10:49:14Z")

</div>

Hi, Greetings!! We recently came across a case where when there are wild card search like " ab bcd xyz" (just an example to indicate that wild cards are present beginning and end or anywhere on multiple words). Similar…

---

## [Suggester completion with short product model names](https://discuss.elastic.co/t/suggester-completion-with-short-product-model-names/219514)

<div class="topic-metadata">

**Author:** [@Martin\_Aronsen](https://discuss.elastic.co/u/Martin_Aronsen)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 10:47am UTC](https://discuss.elastic.co/t/suggester-completion-with-short-product-model-names/219514 "2020-02-17T10:47:35Z")

</div>

Hi, We're building a database with various technological products, and trying to use the completion suggester to build an autocomplete search bar. This is built inside Invision Community, so we're using the same index …

---

## [Will there be any data loss when the disk reached its 90% watermark?](https://discuss.elastic.co/t/will-there-be-any-data-loss-when-the-disk-reached-its-90-watermark/219585)

<div class="topic-metadata">

**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 10:38am UTC](https://discuss.elastic.co/t/will-there-be-any-data-loss-when-the-disk-reached-its-90-watermark/219585 "2020-02-17T10:38:05Z")

</div>

HI, I am using elastic stack of version 7.11 with x- pack installed I using filebeat to ingest the data into the elastic, but my disk is reached to 90% which is the watermark i configured. All i want to know is ? if i…

---

## [How to generate multiple time granular indexes?](https://discuss.elastic.co/t/how-to-generate-multiple-time-granular-indexes/219325)

<div class="topic-metadata">

**Author:** [@ziyang](https://discuss.elastic.co/u/ziyang)\
**Replies:** 3\
**Last updated:** [February 17, 2020, 10:32am UTC](https://discuss.elastic.co/t/how-to-generate-multiple-time-granular-indexes/219325 "2020-02-17T10:32:33Z")

</div>

I want to write monitoring data in ES. At present, there are 4 indicators, each indicator is 5 minutes granularity, every 5 minutes has more than 10,000 data, about 3 million data a day. The requirements are: How shou…

---

## [Elasticsearch, terms aggs according to sibling nested fields](https://discuss.elastic.co/t/elasticsearch-terms-aggs-according-to-sibling-nested-fields/216174)

<div class="topic-metadata">

**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\
**Replies:** 4\
**Last updated:** [February 17, 2020, 10:17am UTC](https://discuss.elastic.co/t/elasticsearch-terms-aggs-according-to-sibling-nested-fields/216174 "2020-02-17T10:17:05Z")

</div>

Elasticsearch v7.5 Hello and good day! We have 2 indices named socialmedia and influencers Sample contents: socialmedia : { '\_id' : 1001, 'title' : "Title 1", 'smp\_id' : 1, "latest" : \[ { …

---

## [How to use only the search set generated by the previous query for searching the current query in ElasticSearch](https://discuss.elastic.co/t/how-to-use-only-the-search-set-generated-by-the-previous-query-for-searching-the-current-query-in-elasticsearch/217528)

<div class="topic-metadata">

**Author:** [@shikjind](https://discuss.elastic.co/u/shikjind)\
**Replies:** 2\
**Last updated:** [February 17, 2020, 9:58am UTC](https://discuss.elastic.co/t/how-to-use-only-the-search-set-generated-by-the-previous-query-for-searching-the-current-query-in-elasticsearch/217528 "2020-02-17T09:58:20Z")

</div>

I am working on a Search Engine for searching strings. There is around 600 GB of data stored at ElasticSearch index with 4 nodes, having 5 primary shards and 1 replica set. Assume there is a complete data set A(600GB) o…

---

## [The Service of ES don't start](https://discuss.elastic.co/t/the-service-of-es-dont-start/219315)

<div class="topic-metadata">

**Author:** [@Barsash](https://discuss.elastic.co/u/Barsash)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 9:21am UTC](https://discuss.elastic.co/t/the-service-of-es-dont-start/219315 "2020-02-17T09:21:33Z")

</div>

Hello! I have some problem here. First of all i installed ES from .rar file, and did some features in config's files and in registry. But in was ES 7.5, so i download 7.6.0 version .msi, and started install. After all…

---

## [What is the best way to logging any errors in nodejs application?](https://discuss.elastic.co/t/what-is-the-best-way-to-logging-any-errors-in-nodejs-application/218945)

<div class="topic-metadata">

**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\
**Replies:** 5\
**Last updated:** [February 17, 2020, 9:09am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-logging-any-errors-in-nodejs-application/218945 "2020-02-17T09:09:12Z")

</div>

Hi! Can you confirm me what is the best way to logging any errors in javascript (I mean in frontend applications, in web client browser) I would like to know when the application doesnt work in any devices (mobile, ipad…

---

## [Elasticsearch uses more memory than JVM heap settings, reaches container memory limit and crash](https://discuss.elastic.co/t/elasticsearch-uses-more-memory-than-jvm-heap-settings-reaches-container-memory-limit-and-crash/218873)

<div class="topic-metadata">

**Author:** [@vroad](https://discuss.elastic.co/u/vroad)\
**Replies:** 10\
**Last updated:** [February 17, 2020, 8:35am UTC](https://discuss.elastic.co/t/elasticsearch-uses-more-memory-than-jvm-heap-settings-reaches-container-memory-limit-and-crash/218873 "2020-02-17T08:35:35Z")

</div>

Elasticsearch uses more memory than JVM heap settings, which is currently -Xms512m, -Xmx512m. I tried setting those values to 1g and reverted because the container crashed immediately after relaunching containers, becaus…

---

## [ES Multiple configuration files support](https://discuss.elastic.co/t/es-multiple-configuration-files-support/219405)

<div class="topic-metadata">

**Author:** [@yuvald](https://discuss.elastic.co/u/yuvald)\
**Replies:** 1\
**Last updated:** [February 17, 2020, 8:35am UTC](https://discuss.elastic.co/t/es-multiple-configuration-files-support/219405 "2020-02-17T08:35:28Z")

</div>

Is there any option to use multiple configuration files for elasticsearch ? I want to override the defaults of elasticsearch.yml but without touching that file like specifying a second file like local.yml to override. …

---

## [429 retry bulk doc question?](https://discuss.elastic.co/t/429-retry-bulk-doc-question/219578)

<div class="topic-metadata">

**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Replies:** 0\
**Last updated:** [February 17, 2020, 8:16am UTC](https://discuss.elastic.co/t/429-retry-bulk-doc-question/219578 "2020-02-17T08:16:00Z")

</div>

Hi all, My elastic cluster have an index that are quite heavily indexed every day so sometime i got the 429 error so i was wondering if the bullk when they retry pushing the doc up does the doc got lost or it still goes…

---

## [Location Mapping in Elasticsearch 7.6](https://discuss.elastic.co/t/location-mapping-in-elasticsearch-7-6/219537)

<div class="topic-metadata">

**Author:** [@Andre\_Bruederle](https://discuss.elastic.co/u/Andre_Bruederle)\
**Replies:** 2\
**Last updated:** [February 17, 2020, 8:05am UTC](https://discuss.elastic.co/t/location-mapping-in-elasticsearch-7-6/219537 "2020-02-17T08:05:58Z")

</div>

Hello, I need help to get the location mapping for my dataset. I have the longitude and latitude and I tried to follow the official documentation about "geo-point datatype", but it doesn't work. Here is the logstash f…

---

## [Add scripted field aggregations into date histogram](https://discuss.elastic.co/t/add-scripted-field-aggregations-into-date-histogram/219565)

<div class="topic-metadata">

**Author:** [@StephenGoodall](https://discuss.elastic.co/u/StephenGoodall)\
**Replies:** 0\
**Last updated:** [February 17, 2020, 5:59am UTC](https://discuss.elastic.co/t/add-scripted-field-aggregations-into-date-histogram/219565 "2020-02-17T05:59:22Z")

</div>

Is it possible to add an aggregated value of a scripted field into a date histogram? I'm trying to create a Vega chart and so far I can get it to graph the "doc\_count" value of the date histogram. What I would like is …

---

## [How to use custom field type in mappings to achieve multiple type mappings within an index?](https://discuss.elastic.co/t/how-to-use-custom-field-type-in-mappings-to-achieve-multiple-type-mappings-within-an-index/219530)

<div class="topic-metadata">

**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\
**Replies:** 2\
**Last updated:** [February 16, 2020, 6:39pm UTC](https://discuss.elastic.co/t/how-to-use-custom-field-type-in-mappings-to-achieve-multiple-type-mappings-within-an-index/219530 "2020-02-16T18:39:47Z")

</div>

Hi, I'm trying to migrate my elasticsearch from 2.4 to 7.5 I was working on fixing breaking changes in the mappings. This example here (for custom field type): https://www.elastic.co/guide/en/elasticsearch/reference/cur…

---

## [In elasticsearch with logstash, 'doc' property in mapping option had been deprecated?](https://discuss.elastic.co/t/in-elasticsearch-with-logstash-doc-property-in-mapping-option-had-been-deprecated/219556)

<div class="topic-metadata">

**Author:** [@teemoGod](https://discuss.elastic.co/u/teemoGod)\
**Replies:** 3\
**Last updated:** [February 17, 2020, 3:34am UTC](https://discuss.elastic.co/t/in-elasticsearch-with-logstash-doc-property-in-mapping-option-had-been-deprecated/219556 "2020-02-17T03:34:41Z")

</div>

i upgraded my elasticsearch 6.7.1 to 7.5.2 and curator 5.6 to 5.8.1. i used both logstash and fluentd. in first, i used fluentd and curator's create\_index was like this. actions: 1: action: create\_index desc…

---

## [Elasticsearch Scroll Query](https://discuss.elastic.co/t/elasticsearch-scroll-query/219554)

<div class="topic-metadata">

**Author:** [@rickyooi](https://discuss.elastic.co/u/rickyooi)\
**Replies:** 2\
**Last updated:** [February 17, 2020, 2:25am UTC](https://discuss.elastic.co/t/elasticsearch-scroll-query/219554 "2020-02-17T02:25:10Z")

</div>

{ "scroll":"1m", "scroll\_id": "ABCDEF......" } The "1m" (one minute) refers to the query will only available to be called for 1 minute OR the query will stay alive for 1 minute whenever it is being called?

---

## [Java High Level REST Client - order of fields in document during saving and retrieval](https://discuss.elastic.co/t/java-high-level-rest-client-order-of-fields-in-document-during-saving-and-retrieval/217621)

<div class="topic-metadata">

**Author:** [@jb79](https://discuss.elastic.co/u/jb79)\
**Replies:** 7\
**Last updated:** [February 16, 2020, 10:04pm UTC](https://discuss.elastic.co/t/java-high-level-rest-client-order-of-fields-in-document-during-saving-and-retrieval/217621 "2020-02-16T22:04:16Z")

</div>

Is the order of the saved document structure guaranteed in elasticsearch? Currently I see that it is, but I don't know if it's because of some default value of some option in the es-rest-client - generally I'd like to …

---

## [How to avoid duplicate fields copied during bulk indexing?](https://discuss.elastic.co/t/how-to-avoid-duplicate-fields-copied-during-bulk-indexing/219528)

<div class="topic-metadata">

**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\
**Replies:** 1\
**Last updated:** [February 16, 2020, 5:46pm UTC](https://discuss.elastic.co/t/how-to-avoid-duplicate-fields-copied-during-bulk-indexing/219528 "2020-02-16T17:46:59Z")

</div>

Hi, I'm trying to create my mappings have multiple types within the same index. This is how it looks: mappings := map\[string\]interface{}{ "properties": map\[string\]interface{}{ "category": map\[string\]interface{}{ …

---

## [How to alter GET /index/\_mapping output to work with PUT /index/\_mapping](https://discuss.elastic.co/t/how-to-alter-get-index-mapping-output-to-work-with-put-index-mapping/219260)

<div class="topic-metadata">

**Author:** [@LansK](https://discuss.elastic.co/u/LansK)\
**Replies:** 4\
**Last updated:** [February 16, 2020, 1:43pm UTC](https://discuss.elastic.co/t/how-to-alter-get-index-mapping-output-to-work-with-put-index-mapping/219260 "2020-02-16T13:43:40Z")

</div>

I am upgrading elasticsearch from 2.x to 7.x. I am trying to re-add index mappings from 2.x. I want to know how to alter a mapping to make it compatible with 7.x. Here is the result of GET /syslog/\_mapping from 2.x { …

---

## [Rejecting mapping update to \[test-index\] as the final mapping would have more than 1 type: \[\_doc, products\]](https://discuss.elastic.co/t/rejecting-mapping-update-to-test-index-as-the-final-mapping-would-have-more-than-1-type-doc-products/219282)

<div class="topic-metadata">

**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\
**Replies:** 2\
**Last updated:** [February 16, 2020, 10:29am UTC](https://discuss.elastic.co/t/rejecting-mapping-update-to-test-index-as-the-final-mapping-would-have-more-than-1-type-doc-products/219282 "2020-02-16T10:29:41Z")

</div>

Hi, I'm working on migrating my elasticsearch 2.4 to the latest version 7.5. Due to removal of mapping types in the elasticsearch 6.0, I was earlier using multiple types in a single index. Now, I've defined my mappings…

---

## [Performance impact of deleting large index in Elasticsearch](https://discuss.elastic.co/t/performance-impact-of-deleting-large-index-in-elasticsearch/219503)

<div class="topic-metadata">

**Author:** [@the123saurav](https://discuss.elastic.co/u/the123saurav)\
**Replies:** 1\
**Last updated:** [February 16, 2020, 9:59am UTC](https://discuss.elastic.co/t/performance-impact-of-deleting-large-index-in-elasticsearch/219503 "2020-02-16T09:59:10Z")

</div>

We are using Elasticsearch 6.0 with 2 indices both of size 200gb(primary shards store) and 3 primary shards and 2 replicas. We want to delete one index fully. The cluster has 3 dedicated master nodes(1core, 4gb) and 5 da…

---

## [Indexing the document is recommend approach](https://discuss.elastic.co/t/indexing-the-document-is-recommend-approach/219395)

<div class="topic-metadata">

**Author:** [@SivaPrasad\_Ampolu](https://discuss.elastic.co/u/SivaPrasad_Ampolu)\
**Replies:** 12\
**Last updated:** [February 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/indexing-the-document-is-recommend-approach/219395 "2020-02-15T14:18:33Z")

</div>

Hello, Is it recommended approach to store documents on elastic search? what if we extract keywords from document and creating index on those keywords( assumption is file path will stored index along with keywords phys…

---

## [Using payloads for scoring](https://discuss.elastic.co/t/using-payloads-for-scoring/219476)

<div class="topic-metadata">

**Author:** [@divyanshumarwah](https://discuss.elastic.co/u/divyanshumarwah)\
**Replies:** 0\
**Last updated:** [February 15, 2020, 12:13pm UTC](https://discuss.elastic.co/t/using-payloads-for-scoring/219476 "2020-02-15T12:13:06Z")

</div>

I am working on a research project in which I need to use some specific term weights for relevance score calculation. I have indexed the term weights as payloads along with the text and looks something like this : "Amer…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1013)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1015)
