# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1023 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1024 --- ## [Custom Analyzer \[my\_analyzer\] failed to find tokenizer under name \[whitespace\]](https://discuss.elastic.co/t/custom-analyzer-my-analyzer-failed-to-find-tokenizer-under-name-whitespace/217743)
**Author:** [@amit.nema](https://discuss.elastic.co/u/amit.nema)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 2:06pm UTC](https://discuss.elastic.co/t/custom-analyzer-my-analyzer-failed-to-find-tokenizer-under-name-whitespace/217743 "2020-02-07T14:06:23Z")
Hello Team, I'm using elasticsearch version 6.7.2. While testing with elasticsearch test framework, getting following error. java.lang.IllegalArgumentException: Custom Analyzer \[my\_analyzer\] failed to find tokenizer un… --- ## [Pagination of the elastic buckets with size, from and order by a timestamp field](https://discuss.elastic.co/t/pagination-of-the-elastic-buckets-with-size-from-and-order-by-a-timestamp-field/217803)
**Author:** [@shivamkrpandey](https://discuss.elastic.co/u/shivamkrpandey)\ **Replies:** 3\ **Last updated:** [February 7, 2020, 2:02pm UTC](https://discuss.elastic.co/t/pagination-of-the-elastic-buckets-with-size-from-and-order-by-a-timestamp-field/217803 "2020-02-07T14:02:20Z")
I want to paginate the buckets with "size" and "from" ordered by the "Timestamp" field. I have tried the bucket\_sort but it did not work as it expects another sibling aggregation and cannot aggregate on the Timestamp fie… --- ## [Encrypt Snapshots before sending to S3](https://discuss.elastic.co/t/encrypt-snapshots-before-sending-to-s3/218351)
**Author:** [@danieln](https://discuss.elastic.co/u/danieln)\ **Replies:** 3\ **Last updated:** [February 7, 2020, 1:59pm UTC](https://discuss.elastic.co/t/encrypt-snapshots-before-sending-to-s3/218351 "2020-02-07T13:59:18Z")
I wonder if there is any possibility to encrypt snapshots before uploading them to s3 via the repository plugin. According to the documentation only server\_side\_encryption seems to be possible, or am I missing something? … --- ## [Regex string from field value](https://discuss.elastic.co/t/regex-string-from-field-value/218298)
**Author:** [@ganchu](https://discuss.elastic.co/u/ganchu)\ **Replies:** 5\ **Last updated:** [February 7, 2020, 1:54pm UTC](https://discuss.elastic.co/t/regex-string-from-field-value/218298 "2020-02-07T13:54:01Z")
First query can find events included this string "registry\_key\_path" : """HKCR\\mscfile\\shell\\open\\command\\(Default)""" GET \_search { "query": { "query\_string": { "query": "(registry\_key\_path:/.\*mscfile.\*/)" } } }… --- ## [Closed index shard replication prior to Elasticsearch 7.2](https://discuss.elastic.co/t/closed-index-shard-replication-prior-to-elasticsearch-7-2/218337)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 3\ **Last updated:** [February 7, 2020, 1:08pm UTC](https://discuss.elastic.co/t/closed-index-shard-replication-prior-to-elasticsearch-7-2/218337 "2020-02-07T13:08:12Z")
Could someone clarify how replicas of closed index shards are handled prior to 7.2? I work with a cluster that's currently running Elasticsearch 6.8.6. I have always thought that closed index shards are replicated. I.e.… --- ## [Watcher transform assistance](https://discuss.elastic.co/t/watcher-transform-assistance/218210)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 12:35pm UTC](https://discuss.elastic.co/t/watcher-transform-assistance/218210 "2020-02-07T12:35:18Z")
Hi, Below is my watcher alert. I have the index section working with it creating multi docs based on the few fields ive fed it in the transform. The next challenge is to access the relevent data within the teams actio… --- ## [Need Help With Analyzing Rally Benchmark Report](https://discuss.elastic.co/t/need-help-with-analyzing-rally-benchmark-report/217635)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 12:26pm UTC](https://discuss.elastic.co/t/need-help-with-analyzing-rally-benchmark-report/217635 "2020-02-07T12:26:58Z")
Hey,... I'm just installing our new Elasticsearch cluster which hat the following hardware specs: 5 HP DL360 G10 nodes, each node is equipped with: 64GB RAM 2x XEON Silver 4216 CPU 1x HP 1.6TB NVMe SSD (hot storage) 1… --- ## [Update data into a existing key](https://discuss.elastic.co/t/update-data-into-a-existing-key/218330)
**Author:** [@dkishore](https://discuss.elastic.co/u/dkishore)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 11:14am UTC](https://discuss.elastic.co/t/update-data-into-a-existing-key/218330 "2020-02-07T11:14:01Z")
How can I update data in ES when we want to insert a huge amount of data for example- { appName:test, notes:test notes, bulkData:\[ { id:345345, name:test, data:\[ {temp:1},{temp;2} \] } \] } now I want to ad… --- ## [ServiceNow integration with Elasticsearch](https://discuss.elastic.co/t/servicenow-integration-with-elasticsearch/218095)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 9\ **Last updated:** [February 7, 2020, 10:31am UTC](https://discuss.elastic.co/t/servicenow-integration-with-elasticsearch/218095 "2020-02-07T10:31:34Z")
Hi, I have a setup of ELK Stack 7.5.1 to visualize/analyse different kind of logs in our environment. Now, I have a serviceNow of tool where we raise ticket. I want to integrate serviceNow with elasticsearch is there a… --- ## [Method getTotalHits() duplicated and not found at the same time?](https://discuss.elastic.co/t/method-gettotalhits-duplicated-and-not-found-at-the-same-time/217251)
**Author:** [@franzisk](https://discuss.elastic.co/u/franzisk)\ **Replies:** 6\ **Last updated:** [February 7, 2020, 10:27am UTC](https://discuss.elastic.co/t/method-gettotalhits-duplicated-and-not-found-at-the-same-time/217251 "2020-02-07T10:27:53Z")
Hi, I am using spring-boot-starter-elasticsearch and when I do query via repository I get this error saying the method getTotalHits() doesn't exist, at the same time shows on Eclipse console that there are 2 classes on … --- ## [Union query](https://discuss.elastic.co/t/union-query/218192)
**Author:** [@mehmetozalp](https://discuss.elastic.co/u/mehmetozalp)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 10:11am UTC](https://discuss.elastic.co/t/union-query/218192 "2020-02-07T10:11:52Z")
Hi can i do this query in elasticsearch? My elasticsearch is last version. Thank you. (SELECT \* FROM images where file\_id = 0) UNION (SELECT \* FROM images where file\_id \> 0 Group by image\_path,file\_id) LIMIT 20,2… --- ## [Thread pool configuration](https://discuss.elastic.co/t/thread-pool-configuration/215683)
**Author:** [@Abhishek\_Tiwari](https://discuss.elastic.co/u/Abhishek_Tiwari)\ **Replies:** 11\ **Last updated:** [February 7, 2020, 10:04am UTC](https://discuss.elastic.co/t/thread-pool-configuration/215683 "2020-02-07T10:04:50Z")
Hi , I am new in elastic search . here i want to know that how one should configure thread pool. My current configuration is following thread\_pool: search: size: 64 queue\_size: 500 min\_queue\_size: 10 max\_queue\_si… --- ## [Snapshot is taking too long](https://discuss.elastic.co/t/snapshot-is-taking-too-long/218262)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 8:25am UTC](https://discuss.elastic.co/t/snapshot-is-taking-too-long/218262 "2020-02-07T08:25:28Z")
We are using Elasticsearch 7.2.0 We are trying to create a snapshot for one of our indices. The index size is 30 GB. It took around 1 hour to create this snapshot. There were no previously created snapshots. Our elastic… --- ## [Bug: Cannot race. 'NoneType' object has no attribute 'read\_bytes'](https://discuss.elastic.co/t/bug-cannot-race-nonetype-object-has-no-attribute-read-bytes/218221)
**Author:** [@steevegldev](https://discuss.elastic.co/u/steevegldev)\ **Replies:** 1\ **Last updated:** [February 7, 2020, 8:00am UTC](https://discuss.elastic.co/t/bug-cannot-race-nonetype-object-has-no-attribute-read-bytes/218221 "2020-02-07T08:00:26Z")
--- ## [Scroll contexts are left open and they never get deleted or expired in Elasticsearch v7.3?](https://discuss.elastic.co/t/scroll-contexts-are-left-open-and-they-never-get-deleted-or-expired-in-elasticsearch-v7-3/218284)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 7:43am UTC](https://discuss.elastic.co/t/scroll-contexts-are-left-open-and-they-never-get-deleted-or-expired-in-elasticsearch-v7-3/218284 "2020-02-07T07:43:40Z")
--- ## [Getting 403 forbidden error on User authentication with OpenID connect](https://discuss.elastic.co/t/getting-403-forbidden-error-on-user-authentication-with-openid-connect/218120)
**Author:** [@piyush\_kashyap](https://discuss.elastic.co/u/piyush_kashyap)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 6:33am UTC](https://discuss.elastic.co/t/getting-403-forbidden-error-on-user-authentication-with-openid-connect/218120 "2020-02-07T06:33:02Z")
I am trying to authenticate kibana users using OpenID connect and I am getting 403 forbidden error. Please find below the realm configuration :- xpack.security.authc.realms.oidc.cloud-oidc: order: 0 rp.client\_id: "" … --- ## [Bulk Performance issue when having version Conflict in Elasticsearch-5.4.3](https://discuss.elastic.co/t/bulk-performance-issue-when-having-version-conflict-in-elasticsearch-5-4-3/218281)
**Author:** [@Sumit\_Jha](https://discuss.elastic.co/u/Sumit_Jha)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 6:26am UTC](https://discuss.elastic.co/t/bulk-performance-issue-when-having-version-conflict-in-elasticsearch-5-4-3/218281 "2020-02-07T06:26:19Z")
Hi, We are having huge bulk performance issue when request comes for similar document at same timestamp in bulk . I was curious to know why version conflict would have significant impact . --- ## [Setting keystore for Slack, cannot see what I am typing?](https://discuss.elastic.co/t/setting-keystore-for-slack-cannot-see-what-i-am-typing/218176)
**Author:** [@JimP](https://discuss.elastic.co/u/JimP)\ **Replies:** 2\ **Last updated:** [February 7, 2020, 5:14am UTC](https://discuss.elastic.co/t/setting-keystore-for-slack-cannot-see-what-i-am-typing/218176 "2020-02-07T05:14:27Z")
I am unable to see what I am typing to enter the value for ...secure\_url: Is this by design? bin/elasticsearch-keystore add xpack.notification.slack.account.monitoring.secure\_url Enter value for xpack.notification.slac… --- ## [ElasticSearch Query with Powershell Invoke-RestMethod](https://discuss.elastic.co/t/elasticsearch-query-with-powershell-invoke-restmethod/218228)
**Author:** [@paul1243](https://discuss.elastic.co/u/paul1243)\ **Replies:** 5\ **Last updated:** [February 7, 2020, 5:02am UTC](https://discuss.elastic.co/t/elasticsearch-query-with-powershell-invoke-restmethod/218228 "2020-02-07T05:02:34Z")
Hi- I have a Elastic Search Rest API to query along with range condition, which would need to be executed thru Powershell using Invoke-RestMethod command, but it fails. It works alright using Curl. Curl command: curl … --- ## [Text match scoring on multiple indexes](https://discuss.elastic.co/t/text-match-scoring-on-multiple-indexes/218271)
**Author:** [@Avhirup\_Chakraborty](https://discuss.elastic.co/u/Avhirup_Chakraborty)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:56am UTC](https://discuss.elastic.co/t/text-match-scoring-on-multiple-indexes/218271 "2020-02-07T03:56:41Z")
Hi all, I had a doubt regarding the score when we fire a multi-index query. Does the scoring happen by default happen on per index tf-idf statistics or global tf-idf statistics? For example: GET test\_1,test\_2/\_search?… --- ## [Cannot search doc with key field start with "\_"](https://discuss.elastic.co/t/cannot-search-doc-with-key-field-start-with/218268)
**Author:** [@Hoang\_Nguyen2](https://discuss.elastic.co/u/Hoang_Nguyen2)\ **Replies:** 0\ **Last updated:** [February 7, 2020, 3:00am UTC](https://discuss.elastic.co/t/cannot-search-doc-with-key-field-start-with/218268 "2020-02-07T03:00:38Z")
cannot search doc with key field start with "\_" I have below doc, when I search doc by url: http://localhost:9200/indexName/\_search?q=hanoi It return empty doc { "company": "software", "\_quantity":500, "company\_loc… --- ## [Create custom indices privilege](https://discuss.elastic.co/t/create-custom-indices-privilege/217516)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 1\ **Last updated:** [February 3, 2020, 3:08am UTC](https://discuss.elastic.co/t/create-custom-indices-privilege/217516 "2020-02-03T03:08:10Z")
Is there a way to create a privilege for indices such that it allows to create indices and aliases but prevents index deletion? Currently if I want to give a user the following privileges : create index create alias t… --- ## [Zeek input only creating index templates and system indices](https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253)
**Author:** [@Junebee](https://discuss.elastic.co/u/Junebee)\ **Replies:** 0\ **Last updated:** [February 6, 2020, 11:02pm UTC](https://discuss.elastic.co/t/zeek-input-only-creating-index-templates-and-system-indices/218253 "2020-02-06T23:02:51Z")
I am trying to ingest data from a Zeek sensor directly into Elasticsearch and when I do ES creates index templates and system indices for each Zeek log but no usable indices. This is from a clean instance but this result… --- ## [Getting \_source fields with bulk api](https://discuss.elastic.co/t/getting-source-fields-with-bulk-api/218235)
**Author:** [@danoli](https://discuss.elastic.co/u/danoli)\ **Replies:** 1\ **Last updated:** [February 6, 2020, 9:44pm UTC](https://discuss.elastic.co/t/getting-source-fields-with-bulk-api/218235 "2020-02-06T21:44:11Z")
The Bulk API docs mention the query parameter \_source, however, when I add the parameter to the request, no source fields are included. For example: curl -X POST "localhost:9200/\_bulk?\_source=field1" -H 'Content-Type: … --- ## [NEST Brings down the whole Webserver](https://discuss.elastic.co/t/nest-brings-down-the-whole-webserver/217693)
**Author:** [@han1](https://discuss.elastic.co/u/han1)\ **Replies:** 38\ **Last updated:** [February 6, 2020, 7:55pm UTC](https://discuss.elastic.co/t/nest-brings-down-the-whole-webserver/217693 "2020-02-06T19:55:45Z")
Does anyone realize that the NEST Library brings down a whole web server? Does anyone even care about such a Humongous bug! Gone Warkolm - Close this thread to save EMBARRASSMENT(as you unusually do) instead of acknowl… --- ## [ILM says it is waiting to allocate 1 shard (but it isn't)](https://discuss.elastic.co/t/ilm-says-it-is-waiting-to-allocate-1-shard-but-it-isnt/218194)
**Author:** [@DanRoscigno](https://discuss.elastic.co/u/DanRoscigno)\ **Replies:** 4\ **Last updated:** [February 6, 2020, 6:50pm UTC](https://discuss.elastic.co/t/ilm-says-it-is-waiting-to-allocate-1-shard-but-it-isnt/218194 "2020-02-06T18:50:39Z")
Hi Folks, I see this for all of my warm indices: Here is the phase definition: { "policy": "filebeat-7.5.2", "phase\_definition": { "min\_age": "0ms", "actions": { "allocate": { "include": {}, "exclude": {}, "… --- ## [Writing to new index using Spark with mapping disabled](https://discuss.elastic.co/t/writing-to-new-index-using-spark-with-mapping-disabled/218072)
**Author:** [@tchu01](https://discuss.elastic.co/u/tchu01)\ **Replies:** 1\ **Last updated:** [February 6, 2020, 4:49pm UTC](https://discuss.elastic.co/t/writing-to-new-index-using-spark-with-mapping-disabled/218072 "2020-02-06T16:49:22Z")
Hi all, I am using AWS EMR PySpark to write to AWS ElasticSearch (cluster version 6.3) using the elasticsearch-hadoop-7.5.2.jar from https://www.elastic.co/downloads/hadoop. I am trying to write to a new index with map… --- ## [Does an ES sizing calculator exist?](https://discuss.elastic.co/t/does-an-es-sizing-calculator-exist/218218)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 0\ **Last updated:** [February 6, 2020, 4:35pm UTC](https://discuss.elastic.co/t/does-an-es-sizing-calculator-exist/218218 "2020-02-06T16:35:52Z")
Since I haven't found any, I'm considering making a CLI tool / library where you can enter some info about what you'll be using ES for and it can give you a recommended config. Do you think this would be useful? --- ## [Index.mapping.total\_fields.limit is important only for query operations?](https://discuss.elastic.co/t/index-mapping-total-fields-limit-is-important-only-for-query-operations/218217)
**Author:** [@111287](https://discuss.elastic.co/u/111287)\ **Replies:** 0\ **Last updated:** [February 6, 2020, 4:25pm UTC](https://discuss.elastic.co/t/index-mapping-total-fields-limit-is-important-only-for-query-operations/218217 "2020-02-06T16:25:51Z")
Hello, On next page I fount interesting statement regarding mapping total fields limit settings: index.mapping.total\_fields.limit The maximum number of fields in an index. Field and object mappings, as well as field… --- ## [Elastic Cloud with Synonyms](https://discuss.elastic.co/t/elastic-cloud-with-synonyms/218213)
**Author:** [@Lone\_Eagle](https://discuss.elastic.co/u/Lone_Eagle)\ **Replies:** 0\ **Last updated:** [February 6, 2020, 3:45pm UTC](https://discuss.elastic.co/t/elastic-cloud-with-synonyms/218213 "2020-02-06T15:45:46Z")
Hi, How do I use synonyms with Elastic Cloud as I can not use a text file? I want something that is expandable (change the list) and if possible, no re-indexing. I found an example to create a new index with synonyms … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1022) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1024)