# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1022 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1023 --- ## [Difficulties forming a new Elastic Stack possibly because of Elasticsearch discovery procedure](https://discuss.elastic.co/t/difficulties-forming-a-new-elastic-stack-possibly-because-of-elasticsearch-discovery-procedure/218482)
**Author:** [@pwh589](https://discuss.elastic.co/u/pwh589)\ **Replies:** 2\ **Last updated:** [February 9, 2020, 11:48pm UTC](https://discuss.elastic.co/t/difficulties-forming-a-new-elastic-stack-possibly-because-of-elasticsearch-discovery-procedure/218482 "2020-02-09T23:48:35Z")
Hi, I am trying to form an Elastic Stack made of a single RHEL 7.4 Elasticsearch node, a RHEL 7.4 Kibana node, and RHEL 7.4 Logstash node, all 7.5.2 (current version as of now). For some reason, in 7.5.2 Elasticsearch … --- ## [Exact + partial match of text documents (with bool query?)](https://discuss.elastic.co/t/exact-partial-match-of-text-documents-with-bool-query/218454)
**Author:** [@hao9850](https://discuss.elastic.co/u/hao9850)\ **Replies:** 1\ **Last updated:** [February 9, 2020, 6:02pm UTC](https://discuss.elastic.co/t/exact-partial-match-of-text-documents-with-bool-query/218454 "2020-02-09T18:02:32Z")
Hi friends! I am building a news search engine and need a way to construct ES queries that delivers relevant results. Currently, I am using a combination of must and should clauses in a bool query for every news topic a … --- ## [Elasticsearch with OpenJDK Early Access build](https://discuss.elastic.co/t/elasticsearch-with-openjdk-early-access-build/217439)
**Author:** [@Sourav\_Paul](https://discuss.elastic.co/u/Sourav_Paul)\ **Replies:** 9\ **Last updated:** [February 9, 2020, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-with-openjdk-early-access-build/217439 "2020-02-09T16:45:42Z")
Elasticsearch does not allow OpenJDK Early access build to start with. Is there a way to bypass this check? --- ## [Using Triple Quotes in Elastic Templates](https://discuss.elastic.co/t/using-triple-quotes-in-elastic-templates/218474)
**Author:** [@index](https://discuss.elastic.co/u/index)\ **Replies:** 0\ **Last updated:** [February 9, 2020, 4:16pm UTC](https://discuss.elastic.co/t/using-triple-quotes-in-elastic-templates/218474 "2020-02-09T16:16:21Z")
I am using templating to do query and rescoring work. The rescoring happens based on couple of values that are index in the document. Due to the logic that needs to happen based on the value in the document I decided to… --- ## [Multiple Elasticsearch instance on one node](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449)
**Author:** [@AndyGarcia](https://discuss.elastic.co/u/AndyGarcia)\ **Replies:** 5\ **Last updated:** [February 9, 2020, 9:44am UTC](https://discuss.elastic.co/t/multiple-elasticsearch-instance-on-one-node/218449 "2020-02-09T09:44:50Z")
I'm having an issue with setting up multiple instances of Elasticsearch 7.5 on one node. I've created 3 seperate directories, each with elasticsearch.yml, jvm.options, and log44j2.properties. I run the command "/bin/ela… --- ## [Elasticsearc with xpack security enabled](https://discuss.elastic.co/t/elasticsearc-with-xpack-security-enabled/218282)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 2\ **Last updated:** [February 9, 2020, 6:46am UTC](https://discuss.elastic.co/t/elasticsearc-with-xpack-security-enabled/218282 "2020-02-09T06:46:59Z")
Hi Team, I have configued elasticsearch statefulset object using official elasticsearch helm chart https://github.com/elastic/helm-charts. I enabeld xpack security feature and created a CA certificate on one of the ela… --- ## [Help for value to use additionalRemoteRepository URL config in Dependency Management for Interpreter Spark](https://discuss.elastic.co/t/help-for-value-to-use-additionalremoterepository-url-config-in-dependency-management-for-interpreter-spark/218458)
**Author:** [@larryzhu](https://discuss.elastic.co/u/larryzhu)\ **Replies:** 0\ **Last updated:** [February 9, 2020, 2:52am UTC](https://discuss.elastic.co/t/help-for-value-to-use-additionalremoterepository-url-config-in-dependency-management-for-interpreter-spark/218458 "2020-02-09T02:52:46Z")
I am stuck adding the following class to zeppelin: https://mvnrepository.com/artifact/org.elasticsearch/elasticsearch-spark-20\_2.10/7.5.2 What is the syntax for zeppelin.dep.additionalRemoteRepository to add mvnreposit… --- ## [Watcher Assistance](https://discuss.elastic.co/t/watcher-assistance/218451)
**Author:** [@ted1621](https://discuss.elastic.co/u/ted1621)\ **Replies:** 0\ **Last updated:** [February 8, 2020, 10:38pm UTC](https://discuss.elastic.co/t/watcher-assistance/218451 "2020-02-08T22:38:36Z")
Hello I am hoping someone can assist with this JSON watcher alert. I am simply trying to create an alert the triggers when any monitored host experiences 5 failed logon attempts within 1 minute. Thanks in advance for … --- ## [Queries regarding snapshot APIs](https://discuss.elastic.co/t/queries-regarding-snapshot-apis/218422)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 11:08am UTC](https://discuss.elastic.co/t/queries-regarding-snapshot-apis/218422 "2020-02-08T11:08:37Z")
We are trying to use backup/restore feature of Elasticsearch using Azure Storage. We are using OSS version of ES 7.2.0. During the process we came across following queries for which we could not find documentation: Is … --- ## [How to filter the following query?](https://discuss.elastic.co/t/how-to-filter-the-following-query/218430)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 10:57am UTC](https://discuss.elastic.co/t/how-to-filter-the-following-query/218430 "2020-02-08T10:57:42Z")
Hi, I am using the following search: { "\_source": \[ "title", "bench", "court", "id\_" \], "size": 10, "query": { "bool": { "must": { … --- ## [Prevent co-placement of daily heavy-duty indices](https://discuss.elastic.co/t/prevent-co-placement-of-daily-heavy-duty-indices/218432)
**Author:** [@Niteshade](https://discuss.elastic.co/u/Niteshade)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 10:41am UTC](https://discuss.elastic.co/t/prevent-co-placement-of-daily-heavy-duty-indices/218432 "2020-02-08T10:41:38Z")
Hi We operate a \>100 nodes cluster, the size mainly intended to allow requests on a big temporal depth. We are daily creating a few separate indices for indexing ( up to ten shard per indice + replicas ). We notice t… --- ## [Resolve alert when previous alarm is recovered](https://discuss.elastic.co/t/resolve-alert-when-previous-alarm-is-recovered/218429)
**Author:** [@matrixcal](https://discuss.elastic.co/u/matrixcal)\ **Replies:** 0\ **Last updated:** [February 8, 2020, 9:29am UTC](https://discuss.elastic.co/t/resolve-alert-when-previous-alarm-is-recovered/218429 "2020-02-08T09:29:24Z")
I have seen many applications sending {Firing}Alarm as well {Resolved}Alarm in Slack notification. I am in the process of writing alerting based on Elastic Watchers but unable to find out right direction. Sending alarm i… --- ## [Add new node in ES cluster](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529)
**Author:** [@bdn](https://discuss.elastic.co/u/bdn)\ **Replies:** 4\ **Last updated:** [February 8, 2020, 5:53am UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529 "2020-02-08T05:53:08Z")
Previously, I generated certificates for my ES nodes through the below command. /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /root/new/new\_cert.zip Now I want to add … --- ## [Latest change to Elasticsearch configuration failed](https://discuss.elastic.co/t/latest-change-to-elasticsearch-configuration-failed/218374)
**Author:** [@Edward\_Genochio](https://discuss.elastic.co/u/Edward_Genochio)\ **Replies:** 1\ **Last updated:** [February 8, 2020, 2:04am UTC](https://discuss.elastic.co/t/latest-change-to-elasticsearch-configuration-failed/218374 "2020-02-08T02:04:19Z")
We tried to run the following upgrade: Change size from 15 GB to 29 GB RAM The result was: Finished 2 hours ago and took an hour, but ultimately failed Here's a partial view of the log We now seem to have both … --- ## [ElasticSearch Service won't run as Local System](https://discuss.elastic.co/t/elasticsearch-service-wont-run-as-local-system/218203)
**Author:** [@dshepard](https://discuss.elastic.co/u/dshepard)\ **Replies:** 3\ **Last updated:** [February 8, 2020, 1:40am UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-run-as-local-system/218203 "2020-02-08T01:40:55Z")
I upgraded my ElasticSearch from 7.3 to 7.5.2 using the MSI, and after the upgrade the ElasticSearch service won't start using the Local System account. I can start it from the command line, and if I change the service t… --- ## [How to import Winlogbeat index template when using ILM and Logstash?](https://discuss.elastic.co/t/how-to-import-winlogbeat-index-template-when-using-ilm-and-logstash/218354)
**Author:** [@fdaa](https://discuss.elastic.co/u/fdaa)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 1:42pm UTC](https://discuss.elastic.co/t/how-to-import-winlogbeat-index-template-when-using-ilm-and-logstash/218354 "2020-02-07T13:42:30Z")
How do I manually import the Winlogbeat index template when using ILM and Logstash with the following configuration? I have tried every possible setting I can think of in my temporary winlogbeat.yml but can't get it to w… --- ## [Multi Search with Count greater than 10000](https://discuss.elastic.co/t/multi-search-with-count-greater-than-10000/218257)
**Author:** [@xavierstein](https://discuss.elastic.co/u/xavierstein)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 7:31pm UTC](https://discuss.elastic.co/t/multi-search-with-count-greater-than-10000/218257 "2020-02-07T19:31:47Z")
Hello, I have two elasticsearch queries that I would like to combine into one using the \_msearch endpoint. The first one is a normal query to filter by \_ids and the second is a \_count query. Now I know I am able to com… --- ## [Match when paragraph contains sentences from indexes](https://discuss.elastic.co/t/match-when-paragraph-contains-sentences-from-indexes/218263)
**Author:** [@danieldou](https://discuss.elastic.co/u/danieldou)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 1:07am UTC](https://discuss.elastic.co/t/match-when-paragraph-contains-sentences-from-indexes/218263 "2020-02-07T01:07:32Z")
I use elasticsearch to create a program allowing to find all the places in a text where the bible is quoted as well as the place where is the verse mentioned I indexed all the verses of the bible in elasticsearch, each v… --- ## [BulkProcessor best practice for heavy ingestion](https://discuss.elastic.co/t/bulkprocessor-best-practice-for-heavy-ingestion/217263)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 6:27pm UTC](https://discuss.elastic.co/t/bulkprocessor-best-practice-for-heavy-ingestion/217263 "2020-02-07T18:27:51Z")
We want to reindex documents into our new 7.2 ES cluster from our old 1.7 ES cluster (around 2TB of data) For indexing purpose, we are going to use the BulkProcessor API. We had three approaches in mind Have N (confi… --- ## [Setting total\_shards\_per\_node to zero](https://discuss.elastic.co/t/setting-total-shards-per-node-to-zero/218386)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 6:25pm UTC](https://discuss.elastic.co/t/setting-total-shards-per-node-to-zero/218386 "2020-02-07T18:25:33Z")
How does Elasticsearch handleindex.routing.allocation.total\_shards\_per\_node getting set to 0 ? Setting it to 0 is obviously something that doesn't make sense to do, but Elasticsearch allows it to be done, so what if it … --- ## [Unable to use termsAggregation with includes\[\] on Long type fields](https://discuss.elastic.co/t/unable-to-use-termsaggregation-with-includes-on-long-type-fields/216895)
**Author:** [@jdcohen220](https://discuss.elastic.co/u/jdcohen220)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 6:12pm UTC](https://discuss.elastic.co/t/unable-to-use-termsaggregation-with-includes-on-long-type-fields/216895 "2020-02-07T18:12:53Z")
I have a query with the following aggregation: "aggs": { "category": { "terms": { "field": "visits.categories", "include": \[ 887706088583989170 \] } This returns no results in the buckets section, however if I re… --- ## [ELK with Xpack](https://discuss.elastic.co/t/elk-with-xpack/218343)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 7\ **Last updated:** [February 7, 2020, 5:01pm UTC](https://discuss.elastic.co/t/elk-with-xpack/218343 "2020-02-07T17:01:08Z")
Hi Team, I have configued elasticsearch statefulset object using official elasticsearch helm chart https://github.com/elastic/helm-charts. I enabeld xpack security feature and created a CA certificate on one of the ela… --- ## [Same field different types (primitive vs. complex)](https://discuss.elastic.co/t/same-field-different-types-primitive-vs-complex/218047)
**Author:** [@Bartlomiej\_Palmowski](https://discuss.elastic.co/u/Bartlomiej_Palmowski)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 4:54pm UTC](https://discuss.elastic.co/t/same-field-different-types-primitive-vs-complex/218047 "2020-02-07T16:54:15Z")
Hi, please forgive me for this very basic question but I can't find an answer so far. I'm sending my logs to AWS CloudWatch and from there I'm using an AWS Lambda to push said logs to AWS hosted ElasticSearch. The prob… --- ## [Confusion between JodaCompatibleZonedDateTime and ZonedDateTime](https://discuss.elastic.co/t/confusion-between-jodacompatiblezoneddatetime-and-zoneddatetime/218384)
**Author:** [@luflow](https://discuss.elastic.co/u/luflow)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 4:48pm UTC](https://discuss.elastic.co/t/confusion-between-jodacompatiblezoneddatetime-and-zoneddatetime/218384 "2020-02-07T16:48:16Z")
Hi everyone! I just tried to do some date calculatoin in painless and just don't get how I can access the functions of the JodaCompatibleZonedDateTime given by an index field. In my index I have a field called "OXACTIV… --- ## [New field or update field after data insertion?](https://discuss.elastic.co/t/new-field-or-update-field-after-data-insertion/218378)
**Author:** [@ccfc1986](https://discuss.elastic.co/u/ccfc1986)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:57pm UTC](https://discuss.elastic.co/t/new-field-or-update-field-after-data-insertion/218378 "2020-02-07T15:57:57Z")
Hello! I am working with a specific data set that i have ingested into elastic via filebeat from a JSON file. The data contains a large number of fields, and two of them are specific to my question. I have longitude and … --- ## [FailureReason: Unrecoverable/Unexpected BadResponse while attempting POST](https://discuss.elastic.co/t/failurereason-unrecoverable-unexpected-badresponse-while-attempting-post/218377)
**Author:** [@amit\_kumar3](https://discuss.elastic.co/u/amit_kumar3)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:55pm UTC](https://discuss.elastic.co/t/failurereason-unrecoverable-unexpected-badresponse-while-attempting-post/218377 "2020-02-07T15:55:12Z")
System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream. at System.Net.ConnectStream.Read(Byte buffer, Int32 offset, Int32 size) at System.IO.StreamReader.ReadBuffer(Char userBuffer, Int3… --- ## [Calculate time difference in scripted field](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/216893)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 11\ **Last updated:** [February 7, 2020, 3:21pm UTC](https://discuss.elastic.co/t/calculate-time-difference-in-scripted-field/216893 "2020-02-07T15:21:12Z")
Hello, The question is how to get the difference rounded to a day between the dates in a document? For example, if date1 = 2019-12-27T23:00:00.999 and date2 = 2019-12-28T01:00:00.999, the answer is 1. I'm already usin… --- ## [Use BulkProcessor with RefreshPolicy.WAIT\_UNTIL](https://discuss.elastic.co/t/use-bulkprocessor-with-refreshpolicy-wait-until/217934)
**Author:** [@mmu](https://discuss.elastic.co/u/mmu)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 3:10pm UTC](https://discuss.elastic.co/t/use-bulkprocessor-with-refreshpolicy-wait-until/217934 "2020-02-07T15:10:27Z")
The the current documentation \[1\] states how to wait for bulk requests to become visible for search: BulkRequest request = new BulkRequest(); // wait for bulk transaction results to become visible for search request.set… --- ## [How to search using only month and year (or only date) in date field?](https://discuss.elastic.co/t/how-to-search-using-only-month-and-year-or-only-date-in-date-field/218332)
**Author:** [@franzisk](https://discuss.elastic.co/u/franzisk)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/how-to-search-using-only-month-and-year-or-only-date-in-date-field/218332 "2020-02-07T14:51:41Z")
Hi, I am using Spring Boot Elasticsearch and I have something like this: Optional\\> findByClienteIdAndDataEqualsAndLogLike(Integer id, String eventDate, String log, Pageable pageable); This eventDate has t… --- ## [Effient way to copy index](https://discuss.elastic.co/t/effient-way-to-copy-index/218365)
**Author:** [@bhushan\_badgujar](https://discuss.elastic.co/u/bhushan_badgujar)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 2:47pm UTC](https://discuss.elastic.co/t/effient-way-to-copy-index/218365 "2020-02-07T14:47:45Z")
We have two index parent\_index child\_index My task is to create new\_child\_index with some fields from parent\_index. Parent Index =\> { "\_parent": { "type": "parent" }, "properties": { "id" : { "id" : "String" … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1021) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1023)