# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1019

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1020

---

## [Joining two indexes in elasticsearch](https://discuss.elastic.co/t/joining-two-indexes-in-elasticsearch/218729)

<div class="topic-metadata">

**Author:** [@sarvendras](https://discuss.elastic.co/u/sarvendras)\
**Replies:** 3\
**Last updated:** [February 12, 2020, 6:19am UTC](https://discuss.elastic.co/t/joining-two-indexes-in-elasticsearch/218729 "2020-02-12T06:19:03Z")

</div>

Hi All, I have one index having one column as primary key and some other fields while second index also have same primary key and some new column(which is not there in first index) How Can i create third index which ha…

---

## [Doc\_value for numeric field does not match the \_source field value](https://discuss.elastic.co/t/doc-value-for-numeric-field-does-not-match-the-source-field-value/218897)

<div class="topic-metadata">

**Author:** [@kabcampbell](https://discuss.elastic.co/u/kabcampbell)\
**Replies:** 0\
**Last updated:** [February 12, 2020, 6:07am UTC](https://discuss.elastic.co/t/doc-value-for-numeric-field-does-not-match-the-source-field-value/218897 "2020-02-12T06:07:23Z")

</div>

Running Elasticsearch 6.8.0. I have a field of type float. Here is the mapping: "constructionCost" : { "type" : "float" } It is being populated from a SQL Server decimal(19,4) column. Here is my query: GET pro…

---

## [Index size is increased while deleting](https://discuss.elastic.co/t/index-size-is-increased-while-deleting/217804)

<div class="topic-metadata">

**Author:** [@nhatnam](https://discuss.elastic.co/u/nhatnam)\
**Replies:** 1\
**Last updated:** [February 12, 2020, 6:03am UTC](https://discuss.elastic.co/t/index-size-is-increased-while-deleting/217804 "2020-02-12T06:03:19Z")

</div>

I've just upgraded my cluster from v5.3 to v7.5 and I see strange behaviour. I'm using Bulk API to delete and index docs to a newly created index. I'm sure that at the beginning my bulk requests only contain deletion of…

---

## [Elasticsearch Memory Consumption](https://discuss.elastic.co/t/elasticsearch-memory-consumption/218336)

<div class="topic-metadata">

**Author:** [@guruprasadb](https://discuss.elastic.co/u/guruprasadb)\
**Replies:** 8\
**Last updated:** [February 12, 2020, 5:55am UTC](https://discuss.elastic.co/t/elasticsearch-memory-consumption/218336 "2020-02-12T05:55:36Z")

</div>

Hello, In the current system we have 90 days of logs. However, most of the time, only 30 days of data is queried. So, I am thinking of following optimizations to manage old indices to reduce system memory utilization. …

---

## [How to protect against accidental exposure like Microsoft posted on Jan 22](https://discuss.elastic.co/t/how-to-protect-against-accidental-exposure-like-microsoft-posted-on-jan-22/218880)

<div class="topic-metadata">

**Author:** [@ArtKhanna](https://discuss.elastic.co/u/ArtKhanna)\
**Replies:** 1\
**Last updated:** [February 12, 2020, 3:16am UTC](https://discuss.elastic.co/t/how-to-protect-against-accidental-exposure-like-microsoft-posted-on-jan-22/218880 "2020-02-12T03:16:15Z")

</div>

Accidental exposure seems to be happening often. Has anybody found this to be a compliance issue?

---

## [Any benefit using a node with 32GB heap & 96GB for OS+filesystem cache?](https://discuss.elastic.co/t/any-benefit-using-a-node-with-32gb-heap-96gb-for-os-filesystem-cache/218881)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 0\
**Last updated:** [February 12, 2020, 2:15am UTC](https://discuss.elastic.co/t/any-benefit-using-a-node-with-32gb-heap-96gb-for-os-filesystem-cache/218881 "2020-02-12T02:15:31Z")

</div>

I assume this type of node setting would benefit querying the same data over and over. But is there any down side to this in term of GC? Has anybody deploy nodes with much more RAM for FS than JVM? Anybody sharing his…

---

## [Could not create SSL/TLS secure channel](https://discuss.elastic.co/t/could-not-create-ssl-tls-secure-channel/218668)

<div class="topic-metadata">

**Author:** [@steevegldev](https://discuss.elastic.co/u/steevegldev)\
**Replies:** 4\
**Last updated:** [February 12, 2020, 12:33am UTC](https://discuss.elastic.co/t/could-not-create-ssl-tls-secure-channel/218668 "2020-02-12T00:33:07Z")

</div>

I'm trying to post index by using ApiKey and .NET library, but I got an error. Dim auth = New ApiKeyAuthenticationCredentials("ApiKeyID", "ApiKey" ) Dim settings = New ConnectionConfiguration("CloudID", auth) Dim client…

---

## [Elasticsearch cluster UUID: \_na\_](https://discuss.elastic.co/t/elasticsearch-cluster-uuid-na/218707)

<div class="topic-metadata">

**Author:** [@AndyGarcia](https://discuss.elastic.co/u/AndyGarcia)\
**Replies:** 2\
**Last updated:** [February 11, 2020, 4:59pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-uuid-na/218707 "2020-02-11T16:59:19Z")

</div>

I have multiple elasticsearch nodes, all on seperate machines. For some reason they can't join the cluster. My first node: { "name" : "myNode\_1", "cluster\_name" : "SRT411", "cluster\_uuid" : "7lao\_UsP…

---

## [Uptime Monitoring without external pings](https://discuss.elastic.co/t/uptime-monitoring-without-external-pings/218840)

<div class="topic-metadata">

**Author:** [@Nico\_Duldhardt](https://discuss.elastic.co/u/Nico_Duldhardt)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 8:03pm UTC](https://discuss.elastic.co/t/uptime-monitoring-without-external-pings/218840 "2020-02-11T20:03:49Z")

</div>

Hello everybody, is there another solution to monitor the uptime of several (\> 100) machines when I cannot externally ping them? I assume heartbeat won't work then? I tried to count the logs of each machine. However, th…

---

## [Terms\_set within a nested query](https://discuss.elastic.co/t/terms-set-within-a-nested-query/218852)

<div class="topic-metadata">

**Author:** [@edragom](https://discuss.elastic.co/u/edragom)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 7:28pm UTC](https://discuss.elastic.co/t/terms-set-within-a-nested-query/218852 "2020-02-11T19:28:44Z")

</div>

Is it possible to use a terms\_set within a nested query? I haven't be able to find any examples or documentation. Various testing attempts have failed. Most recently it has looked like... Mappings as... { "mappings":…

---

## [Sparse vector vs rank features. Which one?](https://discuss.elastic.co/t/sparse-vector-vs-rank-features-which-one/214772)

<div class="topic-metadata">

**Author:** [@snakeztc](https://discuss.elastic.co/u/snakeztc)\
**Replies:** 12\
**Last updated:** [February 11, 2020, 7:02pm UTC](https://discuss.elastic.co/t/sparse-vector-vs-rank-features-which-one/214772 "2020-02-11T19:02:04Z")

</div>

I am trying to implement a customized search function that will rank documents based on sparse features. Concretely, each document will have a list of sparse features, e.g. doc\_1 -\> {a: 1.1, b: 0.2} doc\_2 -\> {a: 0.2, z…

---

## [Fetch all documents from index having max(field) \<= today's date](https://discuss.elastic.co/t/fetch-all-documents-from-index-having-max-field-todays-date/218844)

<div class="topic-metadata">

**Author:** [@priteshshah17](https://discuss.elastic.co/u/priteshshah17)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 6:49pm UTC](https://discuss.elastic.co/t/fetch-all-documents-from-index-having-max-field-todays-date/218844 "2020-02-11T18:49:40Z")

</div>

I have a SQL query as below which is very simple when its SQL however I am not getting how to convert it to elastic query, Select \* from user A where A.field = (select max(C.field) from user C where C.table = A.table a…

---

## [ELK Security SSL TLS](https://discuss.elastic.co/t/elk-security-ssl-tls/218683)

<div class="topic-metadata">

**Author:** [@Dilip\_Sharma77](https://discuss.elastic.co/u/Dilip_Sharma77)\
**Replies:** 2\
**Last updated:** [February 11, 2020, 6:49pm UTC](https://discuss.elastic.co/t/elk-security-ssl-tls/218683 "2020-02-11T18:49:13Z")

</div>

I am trying implementing SSL/TLS in ELK end to end using self signed certificates that means if you want to access ELK from browser that it should be over https. I just need inputs whether this could be achieved under ba…

---

## [Node Discovery Issue](https://discuss.elastic.co/t/node-discovery-issue/218833)

<div class="topic-metadata">

**Author:** [@damasu](https://discuss.elastic.co/u/damasu)\
**Replies:** 6\
**Last updated:** [February 11, 2020, 5:49pm UTC](https://discuss.elastic.co/t/node-discovery-issue/218833 "2020-02-11T17:49:55Z")

</div>

Hi, I have created two AWS EC2 instances the first is using the following docker-compose configuration elasticsearch: build: context: ./docker/elasticsearch/ dockerfile: Dockerfile args: …

---

## [Setting max\_concurrent\_shard\_requests with Java client](https://discuss.elastic.co/t/setting-max-concurrent-shard-requests-with-java-client/218831)

<div class="topic-metadata">

**Author:** [@Brent\_Farrell](https://discuss.elastic.co/u/Brent_Farrell)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 5:15pm UTC](https://discuss.elastic.co/t/setting-max-concurrent-shard-requests-with-java-client/218831 "2020-02-11T17:15:26Z")

</div>

Hello, I am using the high-level REST client to invoke the multi-search and multi-template search APIs. I see that I can set max\_concurrent\_searches with the method maxConcurrentSearchRequests(int) but I do not see a m…

---

## [Cluster scaling analysis](https://discuss.elastic.co/t/cluster-scaling-analysis/218397)

<div class="topic-metadata">

**Author:** [@Sirius](https://discuss.elastic.co/u/Sirius)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 5:02pm UTC](https://discuss.elastic.co/t/cluster-scaling-analysis/218397 "2020-02-11T17:02:46Z")

</div>

Hi, I'm running an ES cluster over 3 nodes with docker. Thinking about scaling analysis based on current resource usage (memory, cpu, disk) ... is there a way to get a breakdown resource operational information usage i.…

---

## [Setting up TLS/SSL with PEM format CA](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478)

<div class="topic-metadata">

**Author:** [@jthoni](https://discuss.elastic.co/u/jthoni)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 4:45pm UTC](https://discuss.elastic.co/t/setting-up-tls-ssl-with-pem-format-ca/218478 "2020-02-11T16:45:17Z")

</div>

I am trying to set up SSL between the nodes on my cluster. I have ran through the docs at: \[Encrypting communications in Elasticsearch | Elasticsearch Guide \[6.3\] | Elastic\](http://Encrypting communications in Elastics…

---

## [Cron in elastic.co to exec a Node.js script?](https://discuss.elastic.co/t/cron-in-elastic-co-to-exec-a-node-js-script/218815)

<div class="topic-metadata">

**Author:** [@Zoomi4he](https://discuss.elastic.co/u/Zoomi4he)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 4:05pm UTC](https://discuss.elastic.co/t/cron-in-elastic-co-to-exec-a-node-js-script/218815 "2020-02-11T16:05:55Z")

</div>

Using my elastic,co deployment, how can I run a node.js script every minute and collect the execution time for the script? I'd like to collect time series data on the scripts execution time and get alerts when it takes l…

---

## [ILM - custom index name with rollover\_alias is creating new index templates](https://discuss.elastic.co/t/ilm-custom-index-name-with-rollover-alias-is-creating-new-index-templates/218803)

<div class="topic-metadata">

**Author:** [@MagicNotElastic](https://discuss.elastic.co/u/MagicNotElastic)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 3:39pm UTC](https://discuss.elastic.co/t/ilm-custom-index-name-with-rollover-alias-is-creating-new-index-templates/218803 "2020-02-11T15:39:39Z")

</div>

In my Beats, I have settings as follow: setup.template.name: "metricbeat" setup.template.pattern: "metricbeat-\*" setup.ilm.rollover\_alias: "metricbeat-%{\[agent.version\]}-hkhqdev" Index is created correctly as metric…

---

## [Elasticsearch master node election](https://discuss.elastic.co/t/elasticsearch-master-node-election/218700)

<div class="topic-metadata">

**Author:** [@Javier\_Meza\_Cogollo](https://discuss.elastic.co/u/Javier_Meza_Cogollo)\
**Replies:** 4\
**Last updated:** [February 11, 2020, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-master-node-election/218700 "2020-02-11T15:39:20Z")

</div>

Hi everyone! I was working with the version 6.4 of elasticsearch, I always have had two nodes, in that version when the node A got down, the node B automatically took the master role. I just upgrade to the 7.5.2 versio…

---

## [Omit Zero Score Results From Filtered Query?](https://discuss.elastic.co/t/omit-zero-score-results-from-filtered-query/218224)

<div class="topic-metadata">

**Author:** [@codyspeck](https://discuss.elastic.co/u/codyspeck)\
**Replies:** 2\
**Last updated:** [February 11, 2020, 3:15pm UTC](https://discuss.elastic.co/t/omit-zero-score-results-from-filtered-query/218224 "2020-02-11T15:15:19Z")

</div>

Is it possible to omit results with a zero score when doing a filtered query? Take the following query for example: GET demo/\_search?pretty { "query": { "bool": { "should": { "match": { "part\_number": { …

---

## [.monitoring-es - increase retention?](https://discuss.elastic.co/t/monitoring-es-increase-retention/218344)

<div class="topic-metadata">

**Author:** [@TNO](https://discuss.elastic.co/u/TNO)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 2:57pm UTC](https://discuss.elastic.co/t/monitoring-es-increase-retention/218344 "2020-02-11T14:57:56Z")

</div>

Hi, We're using Elastic Cloud and have a deployment with 3 zones. When going to Kibana-\>Monitoring-\>Overview we only have 2 days worth of data. I also only see indices for two days when GETing: \_cat/indices (.monito…

---

## [Need help with ILM](https://discuss.elastic.co/t/need-help-with-ilm/218333)

<div class="topic-metadata">

**Author:** [@tennaen](https://discuss.elastic.co/u/tennaen)\
**Replies:** 3\
**Last updated:** [February 11, 2020, 1:57pm UTC](https://discuss.elastic.co/t/need-help-with-ilm/218333 "2020-02-11T13:57:46Z")

</div>

Hello, i'm trying to understand ILM. I have created a policy "dev-focus-rollover" : { "version" : 3, "modified\_date" : "2020-02-06T10:21:55.920Z", "policy" : { "phases" : { "warm" : { …

---

## [Elasticsearch Randomly Crashing](https://discuss.elastic.co/t/elasticsearch-randomly-crashing/218679)

<div class="topic-metadata">

**Author:** [@Mike121](https://discuss.elastic.co/u/Mike121)\
**Replies:** 5\
**Last updated:** [February 11, 2020, 1:55pm UTC](https://discuss.elastic.co/t/elasticsearch-randomly-crashing/218679 "2020-02-11T13:55:43Z")

</div>

I'm not sure what the problem is here and I've been trying to search for a solution for days, so maybe someone here can help me out. I'm using Elasticsearch 6. It starts fine, and works fine, except for ever several day…

---

## [Upgrade Rollback](https://discuss.elastic.co/t/upgrade-rollback/218774)

<div class="topic-metadata">

**Author:** [@rahulka](https://discuss.elastic.co/u/rahulka)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 1:35pm UTC](https://discuss.elastic.co/t/upgrade-rollback/218774 "2020-02-11T13:35:45Z")

</div>

I have elastic search version 5.5 planning to upgrade it to 7.x .h How can we rollback es node to 5.5 again after the upgrade. Is it even possible?

---

## [Configuration of HTTPS / SSL on 6.8.5 without clustering](https://discuss.elastic.co/t/configuration-of-https-ssl-on-6-8-5-without-clustering/218771)

<div class="topic-metadata">

**Author:** [@Rudy\_Gunawan](https://discuss.elastic.co/u/Rudy_Gunawan)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 1:17pm UTC](https://discuss.elastic.co/t/configuration-of-https-ssl-on-6-8-5-without-clustering/218771 "2020-02-11T13:17:15Z")

</div>

Hi I am trying to configure SSL on Elastic Search. The Elastic Search Server is running as standalone , no nodes / cluster created. My intention is simple : to secure the communication from Elastic Search to Client ( J…

---

## [Send logs email from elasticsearch](https://discuss.elastic.co/t/send-logs-email-from-elasticsearch/218773)

<div class="topic-metadata">

**Author:** [@jskishor](https://discuss.elastic.co/u/jskishor)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 12:53pm UTC](https://discuss.elastic.co/t/send-logs-email-from-elasticsearch/218773 "2020-02-11T12:53:55Z")

</div>

Hi there, I have ingested logs into elastic search using filebeat. My question is how do I send an email from elastic search of the logs which were ingested through filebeat? Thanks Kishore

---

## [Authentication against Active Directory](https://discuss.elastic.co/t/authentication-against-active-directory/217383)

<div class="topic-metadata">

**Author:** [@admin\_berlin](https://discuss.elastic.co/u/admin_berlin)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 12:22pm UTC](https://discuss.elastic.co/t/authentication-against-active-directory/217383 "2020-02-11T12:22:05Z")

</div>

Hi there, I've been trying to set authentication via Active Directory / LDAP for days. With the correct login data I get the error message: { "Status code" 403 "error": "Forbidden", "message": "Forbidden"} With incor…

---

## [Filtering in nested data](https://discuss.elastic.co/t/filtering-in-nested-data/218764)

<div class="topic-metadata">

**Author:** [@tmathwe](https://discuss.elastic.co/u/tmathwe)\
**Replies:** 0\
**Last updated:** [February 11, 2020, 12:08pm UTC](https://discuss.elastic.co/t/filtering-in-nested-data/218764 "2020-02-11T12:08:44Z")

</div>

Hi Experts, We have a data in following format measure:{ name:"",value:"",timestamp:""} now type of value can be vary based on the name example as follows measure:{name:co2,value:1,timestamp} measure:{name:co2,value:…

---

## [Up to 5 hours delay in elasticsearch indexing](https://discuss.elastic.co/t/up-to-5-hours-delay-in-elasticsearch-indexing/218562)

<div class="topic-metadata">

**Author:** [@Andrea\_Caligiuri](https://discuss.elastic.co/u/Andrea_Caligiuri)\
**Replies:** 1\
**Last updated:** [February 11, 2020, 11:08am UTC](https://discuss.elastic.co/t/up-to-5-hours-delay-in-elasticsearch-indexing/218562 "2020-02-11T11:08:44Z")

</div>

Hi, I'm experiencing an issue with Elasticsearch indexing. I've searched online quite a lot but i could not find anyone with a problem even remotely as severe as mine, hence this message. My elasticsearch cluster is co…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1018)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1020)
