# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1020 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1021 --- ## [Elastic run by Docker on Windows Server fails, when Docker upgraded to 2.2.0](https://discuss.elastic.co/t/elastic-run-by-docker-on-windows-server-fails-when-docker-upgraded-to-2-2-0/216149)
**Author:** [@Slavik\_Fursov](https://discuss.elastic.co/u/Slavik_Fursov)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 10:15am UTC](https://discuss.elastic.co/t/elastic-run-by-docker-on-windows-server-fails-when-docker-upgraded-to-2-2-0/216149 "2020-02-11T10:15:55Z")
I'm not sure, if running elastic on Docker on Windows Server 2019 is a recommended setup. But that's what I have and so far it was working very stable. Today, I upgraded Docker to 2.2.0, and Elastic fails to start. Her… --- ## [Removing Dynamic field](https://discuss.elastic.co/t/removing-dynamic-field/218742)
**Author:** [@Stefano\_Bossi](https://discuss.elastic.co/u/Stefano_Bossi)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 10:02am UTC](https://discuss.elastic.co/t/removing-dynamic-field/218742 "2020-02-11T10:02:44Z")
Dear forum, I am dealing with a strange behaviour of Elastic Search; at least strange for me. Let me explain: I have indexed some data and ES inserted in dynamic mapping all the fields he found in the data, so far so … --- ## [Filter Search by Scripted field elastic](https://discuss.elastic.co/t/filter-search-by-scripted-field-elastic/218139)
**Author:** [@umay\_fb](https://discuss.elastic.co/u/umay_fb)\ **Replies:** 8\ **Last updated:** [February 11, 2020, 9:47am UTC](https://discuss.elastic.co/t/filter-search-by-scripted-field-elastic/218139 "2020-02-11T09:47:41Z")
i have create a scripted field query search and filter it. but the hits i founds is zero. and show the error like : #! Deprecation: Deprecated field \[inline\] used, expected \[source\] instead { "took": 1542, "timed\_out… --- ## [Need help with Elasticsearch query](https://discuss.elastic.co/t/need-help-with-elasticsearch-query/218399)
**Author:** [@ankitwandx](https://discuss.elastic.co/u/ankitwandx)\ **Replies:** 8\ **Last updated:** [February 11, 2020, 9:41am UTC](https://discuss.elastic.co/t/need-help-with-elasticsearch-query/218399 "2020-02-11T09:41:58Z")
I am fairly new with ES queries. Need urgent help with this: --- ## [Oracle cloud S3 repository - No Snapshots after restart](https://discuss.elastic.co/t/oracle-cloud-s3-repository-no-snapshots-after-restart/218363)
**Author:** [@Alrik\_Geselle](https://discuss.elastic.co/u/Alrik_Geselle)\ **Replies:** 6\ **Last updated:** [February 11, 2020, 9:34am UTC](https://discuss.elastic.co/t/oracle-cloud-s3-repository-no-snapshots-after-restart/218363 "2020-02-11T09:34:11Z")
Hi there, I have a problem with the snapshot API when it comes to use it with a S3 repository on oracle cloud. My elasticsearch 7.5.2 instance is running inside a docker container. GET /\_snapshot/s3\_repository/ retur… --- ## [Trouble with Instructions in 'getting started' documentation](https://discuss.elastic.co/t/trouble-with-instructions-in-getting-started-documentation/218584)
**Author:** [@kumar.saurabh](https://discuss.elastic.co/u/kumar.saurabh)\ **Replies:** 3\ **Last updated:** [February 11, 2020, 9:15am UTC](https://discuss.elastic.co/t/trouble-with-instructions-in-getting-started-documentation/218584 "2020-02-11T09:15:15Z")
I installed Elasticsearch 7.5.2 from the Windows MSI and tried to follow the instructions in the getting started page at https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-install.html At th… --- ## [How to deal with splitted docs?](https://discuss.elastic.co/t/how-to-deal-with-splitted-docs/218728)
**Author:** [@Vigen\_Abrahamyan](https://discuss.elastic.co/u/Vigen_Abrahamyan)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 8:31am UTC](https://discuss.elastic.co/t/how-to-deal-with-splitted-docs/218728 "2020-02-11T08:31:20Z")
Hi. We have parent docs indexed in one index and child documents indexed in another. The reason for doing so is performance, since we may have thousand of children docs. to be able to paginate the children separately. … --- ## [Need email alert for every single condition match](https://discuss.elastic.co/t/need-email-alert-for-every-single-condition-match/218726)
**Author:** [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)\ **Replies:** 0\ **Last updated:** [February 11, 2020, 7:48am UTC](https://discuss.elastic.co/t/need-email-alert-for-every-single-condition-match/218726 "2020-02-11T07:48:44Z")
Need email alert for every single condition match . In a interval suppose 5 hits are met so 5 email alerts needs to be triggered . --- ## [How can I Write dsl query inside of the Nest query with C# for updatinds specific fields?](https://discuss.elastic.co/t/how-can-i-write-dsl-query-inside-of-the-nest-query-with-c-for-updatinds-specific-fields/218590)
**Author:** [@Yusuf\_Karatoprak](https://discuss.elastic.co/u/Yusuf_Karatoprak)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 2:11am UTC](https://discuss.elastic.co/t/how-can-i-write-dsl-query-inside-of-the-nest-query-with-c-for-updatinds-specific-fields/218590 "2020-02-11T02:11:27Z")
Hi; Iam trying to update my index fields by using CId ; CId can be used many rows. My Structure like : { AId: 4244, BId : 53535, CId: "4242342" } if you look at below query what My intend to achieve, It retur… --- ## [Feedback requested: automatic query expansion](https://discuss.elastic.co/t/feedback-requested-automatic-query-expansion/217863)
**Author:** [@Julie\_Tibshirani](https://discuss.elastic.co/u/Julie_Tibshirani)\ **Replies:** 1\ **Last updated:** [February 11, 2020, 1:34am UTC](https://discuss.elastic.co/t/feedback-requested-automatic-query-expansion/217863 "2020-02-11T01:34:48Z")
Relevance model 3 (RM3) is a traditional query expansion strategy based on language modeling. Several recent papers have shown that BM25 retrieval with RM3 expansion gives a very strong baseline, competitive even with mo… --- ## [Error starting Elasticsearch '/var/log/elasticsearch/gc.log': Permission denied](https://discuss.elastic.co/t/error-starting-elasticsearch-var-log-elasticsearch-gc-log-permission-denied/218475)
**Author:** [@ecofintech](https://discuss.elastic.co/u/ecofintech)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 11:05pm UTC](https://discuss.elastic.co/t/error-starting-elasticsearch-var-log-elasticsearch-gc-log-permission-denied/218475 "2020-02-10T23:05:51Z")
Hello to everyone in the Elastic community. I am having a problem with Elasticsearch after last upgrade to 7.5.2 and installing a plugin. It stopped working and I cannot fix the issue. it seems a problems with permissio… --- ## [Saving requests from fscrawler](https://discuss.elastic.co/t/saving-requests-from-fscrawler/218664)
**Author:** [@rsofaer](https://discuss.elastic.co/u/rsofaer)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 11:05pm UTC](https://discuss.elastic.co/t/saving-requests-from-fscrawler/218664 "2020-02-10T23:05:46Z")
Hello, I am using elasticsearch and fscrawler to process and index a number of documents. In order to extract structured data from these documents, I have a growing ingest pipeline. I'd like to include the ingest pipe… --- ## [Easiest OS to install ELK 7.x on?](https://discuss.elastic.co/t/easiest-os-to-install-elk-7-x-on/218632)
**Author:** [@greenwar](https://discuss.elastic.co/u/greenwar)\ **Replies:** 9\ **Last updated:** [February 10, 2020, 10:18pm UTC](https://discuss.elastic.co/t/easiest-os-to-install-elk-7-x-on/218632 "2020-02-10T22:18:13Z")
Hello, Really NEW user here, and also really new or have forgotten most of my LINUX Skills. Anyway, I tried setting up a VM running CENTOS version 7 and then installed JAVA as instructions stated. Then I installed Elast… --- ## [How to parse a query to remove null statements](https://discuss.elastic.co/t/how-to-parse-a-query-to-remove-null-statements/218677)
**Author:** [@maxrahder](https://discuss.elastic.co/u/maxrahder)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 10:06pm UTC](https://discuss.elastic.co/t/how-to-parse-a-query-to-remove-null-statements/218677 "2020-02-10T22:06:39Z")
I'm very new to elasticsearch. I'm working on a UI that lets users compose queries by dragging UI widgets around. Sometimes they end up trying to run a search without having provided arguments, and the resulting search … --- ## [Looking for advice on an Elastic Search index approach, proximity search on it, and storing additional data to be return with the search](https://discuss.elastic.co/t/looking-for-advice-on-an-elastic-search-index-approach-proximity-search-on-it-and-storing-additional-data-to-be-return-with-the-search/218671)
**Author:** [@dammeul](https://discuss.elastic.co/u/dammeul)\ **Replies:** 0\ **Last updated:** [February 10, 2020, 9:07pm UTC](https://discuss.elastic.co/t/looking-for-advice-on-an-elastic-search-index-approach-proximity-search-on-it-and-storing-additional-data-to-be-return-with-the-search/218671 "2020-02-10T21:07:22Z")
Preamble: Thanks for any help and advice in advance on this, I've dug around for anything that I feel is a similar use case and not found it, and it's fairly basic so it makes me wonder... I've recently picked up Elast… --- ## [System indices and number of replicas](https://discuss.elastic.co/t/system-indices-and-number-of-replicas/218395)
**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 8:32pm UTC](https://discuss.elastic.co/t/system-indices-and-number-of-replicas/218395 "2020-02-10T20:32:50Z")
I have a question about the number of replicas for system indices (Elasticsearch 7.5.x). Standard number of shards = 1, number of replicas = 1. Is it possible to change the number of replicas for system indices? For e… --- ## [Match all children items in an array](https://discuss.elastic.co/t/match-all-children-items-in-an-array/217747)
**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\ **Replies:** 5\ **Last updated:** [February 10, 2020, 8:16pm UTC](https://discuss.elastic.co/t/match-all-children-items-in-an-array/217747 "2020-02-10T20:16:31Z")
I have the below structure Doc1: { "key1": "value1", "key2": \[ { "subId": "id1", "subKey1": "PASS" }, … --- ## [Elastic Search is receiving data from beat, but no documents appear](https://discuss.elastic.co/t/elastic-search-is-receiving-data-from-beat-but-no-documents-appear/218230)
**Author:** [@dsdameron](https://discuss.elastic.co/u/dsdameron)\ **Replies:** 14\ **Last updated:** [February 10, 2020, 7:44pm UTC](https://discuss.elastic.co/t/elastic-search-is-receiving-data-from-beat-but-no-documents-appear/218230 "2020-02-10T19:44:29Z")
We have a beat with the panw module enabled collecting data from Palo Alto Firewalls. The data is being received by Elasticsearch but there are no documents. We have confirmed with a tcpdump the data is arriving from t… --- ## [Email alert in elasticsearch](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 7:36pm UTC](https://discuss.elastic.co/t/email-alert-in-elasticsearch/218105 "2020-02-10T19:36:20Z")
Hi Team, I am working on the Email Alert functionality, where i came different scenario like Let's Suppose I have configured the metricbeat & filebeat in 10 servers which will send the data to the Elastics cluster. Amo… --- ## [Will an even number of master nodes cause split brain situation with 7.x version of ES?](https://discuss.elastic.co/t/will-an-even-number-of-master-nodes-cause-split-brain-situation-with-7-x-version-of-es/218654)
**Author:** [@ted.fed](https://discuss.elastic.co/u/ted.fed)\ **Replies:** 5\ **Last updated:** [February 10, 2020, 7:25pm UTC](https://discuss.elastic.co/t/will-an-even-number-of-master-nodes-cause-split-brain-situation-with-7-x-version-of-es/218654 "2020-02-10T19:25:19Z")
Due to some limitation with our provisioning system, it is difficult to provision an odd number of nodes. For some other technologies, we have provisioned zookeepers with an even number of nodes for 2-3 years now and th… --- ## [What is the maximum indexes I can have in one ES cluster?](https://discuss.elastic.co/t/what-is-the-maximum-indexes-i-can-have-in-one-es-cluster/218492)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 6:22pm UTC](https://discuss.elastic.co/t/what-is-the-maximum-indexes-i-can-have-in-one-es-cluster/218492 "2020-02-10T18:22:19Z")
I understand one ES shard is one Lucien index and it will consume some amount of CPU/ memory. Is there some limitation on how many ES indexes I can have for one ES cluster? e.g. if I have thousands of indexes, but most … --- ## [How to run a custom anomaly detection algorithm on Elasticseach and visualize the time series in Kibana?](https://discuss.elastic.co/t/how-to-run-a-custom-anomaly-detection-algorithm-on-elasticseach-and-visualize-the-time-series-in-kibana/218124)
**Author:** [@dadadima](https://discuss.elastic.co/u/dadadima)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 6:14pm UTC](https://discuss.elastic.co/t/how-to-run-a-custom-anomaly-detection-algorithm-on-elasticseach-and-visualize-the-time-series-in-kibana/218124 "2020-02-10T18:14:10Z")
I went through the definitive guide published by O'Reilly and I couldn't solve my problem. I have also found a similar questions regarding this, but I haven't understand quite well how it is possible to do so. Let's ass… --- ## [Elasticsearch date parsing issue with default format](https://discuss.elastic.co/t/elasticsearch-date-parsing-issue-with-default-format/216617)
**Author:** [@MrSeeker](https://discuss.elastic.co/u/MrSeeker)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 6:13pm UTC](https://discuss.elastic.co/t/elasticsearch-date-parsing-issue-with-default-format/216617 "2020-02-10T18:13:15Z")
I am having a problem to parse some dates in elasticsearch. I have posted about the problem in stackoverflow. Please help me on this as i also could have some yyyy-mm-dd format dates along with epoch. Thank you, --- ## [Error in custom analyzer and mappings in ES v7](https://discuss.elastic.co/t/error-in-custom-analyzer-and-mappings-in-es-v7/218593)
**Author:** [@prasad98](https://discuss.elastic.co/u/prasad98)\ **Replies:** 3\ **Last updated:** [February 10, 2020, 6:12pm UTC](https://discuss.elastic.co/t/error-in-custom-analyzer-and-mappings-in-es-v7/218593 "2020-02-10T18:12:34Z")
Hi, I'm trying to migrate my ES setup from 2.3 to 7.5. However, I'm facing an error with my custom analyzer: elastic: Error 400 (Bad Request): analyzer \[keyword\_lowercase\_remove\_space\] not found for field \[identity\_exac… --- ## [Elasticsearch query with timezone conversion](https://discuss.elastic.co/t/elasticsearch-query-with-timezone-conversion/215220)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 10\ **Last updated:** [February 10, 2020, 5:21pm UTC](https://discuss.elastic.co/t/elasticsearch-query-with-timezone-conversion/215220 "2020-02-10T17:21:39Z")
I have put a record in elk input message =\> '{"submitted\_date": "2020-01-14 10:05:11.11"}' it got saved as UTC, 8 hour earlier (Singapore timezone) { "submitted\_date" =\> 2020-01-14T02:05:11.110Z } in kibana dev … --- ## [Cant view indices in kibana discovery after deleting them and indexing them again](https://discuss.elastic.co/t/cant-view-indices-in-kibana-discovery-after-deleting-them-and-indexing-them-again/218607)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 2\ **Last updated:** [February 10, 2020, 5:21pm UTC](https://discuss.elastic.co/t/cant-view-indices-in-kibana-discovery-after-deleting-them-and-indexing-them-again/218607 "2020-02-10T17:21:33Z")
Hi I have deleted some indices, from elastic using kibana, after some changes in the configuration of logstash I have restarted logstash, create kibana indexes again, but nothing is showing in discovery; I have check th… --- ## [Accent-insensitive search](https://discuss.elastic.co/t/accent-insensitive-search/218404)
**Author:** [@danielchodusov](https://discuss.elastic.co/u/danielchodusov)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:12pm UTC](https://discuss.elastic.co/t/accent-insensitive-search/218404 "2020-02-10T17:12:02Z")
Hi, after spending hours trying to figure out I need a help with: How to search accent-insensitive + case insensitive? I have created an index: curl -X PUT "localhost:9200/my\_index?pretty" -H 'Content-Type: applicatio… --- ## [Implement the prune filter using painless script in ingest pipeline](https://discuss.elastic.co/t/implement-the-prune-filter-using-painless-script-in-ingest-pipeline/218619)
**Author:** [@Sarfaraz\_Ahmad](https://discuss.elastic.co/u/Sarfaraz_Ahmad)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:07pm UTC](https://discuss.elastic.co/t/implement-the-prune-filter-using-painless-script-in-ingest-pipeline/218619 "2020-02-10T17:07:16Z")
Hi, I see a remove processor for ingest pipelines in Elasticsearch. But I don't see any counterparts for logstash's prune filter. How can I implement one using painless ? Also I am unable to create deep copies of ctx.k… --- ## [How to reindex using last weeks](https://discuss.elastic.co/t/how-to-reindex-using-last-weeks/218618)
**Author:** [@Mouloud\_CHIKHOUNE](https://discuss.elastic.co/u/Mouloud_CHIKHOUNE)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:01pm UTC](https://discuss.elastic.co/t/how-to-reindex-using-last-weeks/218618 "2020-02-10T17:01:48Z")
Hello, I have a metricbeat index. "metricbeat" index contains documents from 2019 and 2020. I want to re-index the documents from last weekend (w-1) and (w-2) (w-n). example: POST \_reindex { "source": { "index"… --- ## [Elasticsearch IO characteristics on SSD Vs HDD](https://discuss.elastic.co/t/elasticsearch-io-characteristics-on-ssd-vs-hdd/218629)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 1\ **Last updated:** [February 10, 2020, 5:01pm UTC](https://discuss.elastic.co/t/elasticsearch-io-characteristics-on-ssd-vs-hdd/218629 "2020-02-10T17:01:43Z")
Hi! We are trying to compare between SSD and HDD for our Elasticsearch use case. In one of the scenarios, we want to see how fast we can Open an index. Index size is around 4.5 - 5GB. For SSD, we observe that there s… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1019) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1021)