# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1026 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1027 --- ## [Cluster become red](https://discuss.elastic.co/t/cluster-become-red/217950)
**Author:** [@Ivan\_Kulynych](https://discuss.elastic.co/u/Ivan_Kulynych)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 9:58am UTC](https://discuss.elastic.co/t/cluster-become-red/217950 "2020-02-05T09:58:08Z")
Hi colleagues, after migrating my Elasticsearch cluster from Docker 6.2.2 version to VMs with 6.8.5 version, my cluster periodically get RED status. In logs I see that some node left the cluster. On the node that left cl… --- ## [Query Elasticsearch to get count of Keywords within matched Keywords](https://discuss.elastic.co/t/query-elasticsearch-to-get-count-of-keywords-within-matched-keywords/217945)
**Author:** [@rakmo](https://discuss.elastic.co/u/rakmo)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 9:48am UTC](https://discuss.elastic.co/t/query-elasticsearch-to-get-count-of-keywords-within-matched-keywords/217945 "2020-02-05T09:48:08Z")
Data: Doc 1: field\_a : \["A", "B", 'C", "D", "E"\] Doc 2: field\_a : \["A", "D", "G", "Z", "Y"\] Doc 3: field\_a : \["F", "W", 'C"\] Doc 4: field\_a : \["A", "B", 'C", "D", "E", "Z", "Y"\] Doc 5: … --- ## [Index date starting with "Day of Week"](https://discuss.elastic.co/t/index-date-starting-with-day-of-week/217874)
**Author:** [@theonlyalterego](https://discuss.elastic.co/u/theonlyalterego)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 9:45am UTC](https://discuss.elastic.co/t/index-date-starting-with-day-of-week/217874 "2020-02-05T09:45:13Z")
Elastic Error: Caused by: java.lang.IllegalArgumentException: failed to parse date field \[Tue Feb 06 2029 00:00:00 GMT-0500 (Eastern Standard Time)\] with format \[yyyy-MM-dd'T'HH:mm:ss.SSSZ||yyyy-MM-dd'T'HH:mm:ss.SSS'Z'|… --- ## [ES 6.8 Force primary shards of the same index to be allocated to different physical hosts](https://discuss.elastic.co/t/es-6-8-force-primary-shards-of-the-same-index-to-be-allocated-to-different-physical-hosts/217434)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 13\ **Last updated:** [February 5, 2020, 9:42am UTC](https://discuss.elastic.co/t/es-6-8-force-primary-shards-of-the-same-index-to-be-allocated-to-different-physical-hosts/217434 "2020-02-05T09:42:32Z")
Hi Team, Is there a way to force primary shards in the same index to be allocated to different physical hosts? (I mean a physical server and not an elasticsearch node.) I know we can do this for replicas of the same sh… --- ## [Email and SSN regex patterns for elastic search](https://discuss.elastic.co/t/email-and-ssn-regex-patterns-for-elastic-search/217869)
**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 9:39am UTC](https://discuss.elastic.co/t/email-and-ssn-regex-patterns-for-elastic-search/217869 "2020-02-05T09:39:56Z")
Hi, I am trying to recognize Email ids and SSNs in files using elastic search. Could somebody tell me the correct regexp patterns to recognize SSN and Email ids. I am using these below patterns: Email: "\[a-zA-Z0-9\]+@… --- ## [Hit results of watcher always returns the same value](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926)
**Author:** [@Noureddine\_Brahmi](https://discuss.elastic.co/u/Noureddine_Brahmi)\ **Replies:** 4\ **Last updated:** [February 5, 2020, 9:22am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926 "2020-02-05T09:22:06Z")
I noticed since I upgraded to elasticsearch 7.5, that the hit results of my watcher always return the same value "10000", no matter what condition or query I use in the watcher. I feel like there is come kind of maximum… --- ## [Elastic 6.3: Is there any way where I can define use same routing as parent?](https://discuss.elastic.co/t/elastic-6-3-is-there-any-way-where-i-can-define-use-same-routing-as-parent/217911)
**Author:** [@Antriksh\_Jain](https://discuss.elastic.co/u/Antriksh_Jain)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 7:52am UTC](https://discuss.elastic.co/t/elastic-6-3-is-there-any-way-where-i-can-define-use-same-routing-as-parent/217911 "2020-02-05T07:52:25Z")
I am using Elastic6.3 version. Since parent and child must use same routing (in order to present in same shard) Is there any setting/parameter where while indexing child document mention that use routing same as parent… --- ## [Querying elastic with Python API](https://discuss.elastic.co/t/querying-elastic-with-python-api/217922)
**Author:** [@sandeepduppalli](https://discuss.elastic.co/u/sandeepduppalli)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 7:34am UTC](https://discuss.elastic.co/t/querying-elastic-with-python-api/217922 "2020-02-05T07:34:06Z")
Hi Team I have been given assignment of developing a Python API for connecting Elasticsearch and get the things that are requested. For this I have used Python flask. I am trying to test it with Postman. But I am failin… --- ## [How to increase the time for a get request in kibana?](https://discuss.elastic.co/t/how-to-increase-the-time-for-a-get-request-in-kibana/217912)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 6:32am UTC](https://discuss.elastic.co/t/how-to-increase-the-time-for-a-get-request-in-kibana/217912 "2020-02-05T06:32:35Z")
Hi, i am using elk 7.1.1 with x-pack installed. I am trying to perform a get command in kibana dev console to get the list of all snapshots GET \_cat/snapshots/\/ output { "statusCode": 504, "err… --- ## [Storing aggregation in elasticsearch](https://discuss.elastic.co/t/storing-aggregation-in-elasticsearch/217904)
**Author:** [@shashwat001](https://discuss.elastic.co/u/shashwat001)\ **Replies:** 1\ **Last updated:** [February 5, 2020, 6:24am UTC](https://discuss.elastic.co/t/storing-aggregation-in-elasticsearch/217904 "2020-02-05T06:24:17Z")
I want to store summarized data in elasticsearch for a time series input. I want to get aggregated data per 5 minutes. Does elasticsearch provide any feature to aggregate data and store in it? I don't want to do aggregat… --- ## [Install elasticsearch rpm in different directory](https://discuss.elastic.co/t/install-elasticsearch-rpm-in-different-directory/217908)
**Author:** [@Ram\_29](https://discuss.elastic.co/u/Ram_29)\ **Replies:** 0\ **Last updated:** [February 5, 2020, 6:20am UTC](https://discuss.elastic.co/t/install-elasticsearch-rpm-in-different-directory/217908 "2020-02-05T06:20:55Z")
Hi I want to install elasticsearch rpm in /opt/ instead of /usr/share. Im planning to use rpm relocate. But then I have to update all startup scripts manually?? Is there any easy way? Regards Ram --- ## [ELK Autoprovision with X-Pack Security in Docker container](https://discuss.elastic.co/t/elk-autoprovision-with-x-pack-security-in-docker-container/216517)
**Author:** [@lungati](https://discuss.elastic.co/u/lungati)\ **Replies:** 5\ **Last updated:** [February 5, 2020, 1:19am UTC](https://discuss.elastic.co/t/elk-autoprovision-with-x-pack-security-in-docker-container/216517 "2020-02-05T01:19:22Z")
I have the following bash script that I'd like to run while building the elk image (sebp/elk) so that it can create the builtin users using credentials I've saved in a file (the current setup doesn't allow for a better w… --- ## [Term Lookup Filter array Max size limit](https://discuss.elastic.co/t/term-lookup-filter-array-max-size-limit/217890)
**Author:** [@Rajesh\_Shetty](https://discuss.elastic.co/u/Rajesh_Shetty)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 11:36pm UTC](https://discuss.elastic.co/t/term-lookup-filter-array-max-size-limit/217890 "2020-02-04T23:36:42Z")
We are on still using 1.7 using term lookup filter (https://www.elastic.co/blog/terms-filter-lookup) a lot for filtering out data thru id mapping . Question is what is the limit of how big a document can be in terms of a… --- ## [Nested aggregation of 7 documents takes 1 min](https://discuss.elastic.co/t/nested-aggregation-of-7-documents-takes-1-min/217823)
**Author:** [@naoko](https://discuss.elastic.co/u/naoko)\ **Replies:** 21\ **Last updated:** [February 4, 2020, 10:33pm UTC](https://discuss.elastic.co/t/nested-aggregation-of-7-documents-takes-1-min/217823 "2020-02-04T22:33:36Z")
I have the following query where query will return 7 hits and if execute without agg, it complete in 62ms. removing nested "hour\_bucket" agg will complete in 180ms but executing nested aggs takes about 1 min is the qu… --- ## [How to paginate items with specified order with ElasticSearch](https://discuss.elastic.co/t/how-to-paginate-items-with-specified-order-with-elasticsearch/217888)
**Author:** [@jmessin1](https://discuss.elastic.co/u/jmessin1)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 10:27pm UTC](https://discuss.elastic.co/t/how-to-paginate-items-with-specified-order-with-elasticsearch/217888 "2020-02-04T22:27:24Z")
Im trying to browse a user's ratings sorted by their rating date with pagination. If it's simply getting a page of results then I can just paginate before calling ElasticSearch, i.e. fetch 20 items sorted by rating date,… --- ## [Faild to connect spark-elasticsearch with keystore location as hdfs](https://discuss.elastic.co/t/faild-to-connect-spark-elasticsearch-with-keystore-location-as-hdfs/217880)
**Author:** [@maniarch](https://discuss.elastic.co/u/maniarch)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 9:49pm UTC](https://discuss.elastic.co/t/faild-to-connect-spark-elasticsearch-with-keystore-location-as-hdfs/217880 "2020-02-04T21:49:31Z")
Hi , I'm running my spark job against a secured elasticsearch cluster. I have trustore.jks and keystore.jks generated , if i run run my spark job with ,jks on local path they are working fine but if i put my jks fil… --- ## [Problem to Disable xpack.security.enabled](https://discuss.elastic.co/t/problem-to-disable-xpack-security-enabled/217872)
**Author:** [@Marinho\_DevOPs](https://discuss.elastic.co/u/Marinho_DevOPs)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 8:28pm UTC](https://discuss.elastic.co/t/problem-to-disable-xpack-security-enabled/217872 "2020-02-04T20:28:47Z")
Hi, I try to disable authentication in ECK K8S 7.5, but not working in spec \> config \> xpack.security.enabled. Could help me please --- ## [Elasticsearch bulk indexing issue](https://discuss.elastic.co/t/elasticsearch-bulk-indexing-issue/217830)
**Author:** [@giorgio](https://discuss.elastic.co/u/giorgio)\ **Replies:** 8\ **Last updated:** [February 4, 2020, 8:20pm UTC](https://discuss.elastic.co/t/elasticsearch-bulk-indexing-issue/217830 "2020-02-04T20:20:44Z")
I had issue that elasticsearch would become not responsive after few bulk index calls. I solved it by setting refresh\_interval to -1 before I call bulk api and set to 1s after i'm done ( https://discuss.elastic.co/t/stra… --- ## [Cross Cluster search || \_index value filtering](https://discuss.elastic.co/t/cross-cluster-search-index-value-filtering/217769)
**Author:** [@DeepakBhatt](https://discuss.elastic.co/u/DeepakBhatt)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 10:48am UTC](https://discuss.elastic.co/t/cross-cluster-search-index-value-filtering/217769 "2020-02-04T10:48:24Z")
Hi Team, While using cross cluster search we are not able to filter out the records on \_index attribute. We are using ES version 6.8 FYI. Please find the below query: GET index1,index2,cluster2:index3,cluster2:index4… --- ## [How to remove count column from visualization](https://discuss.elastic.co/t/how-to-remove-count-column-from-visualization/217845)
**Author:** [@Jasonbourne](https://discuss.elastic.co/u/Jasonbourne)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 3:29pm UTC](https://discuss.elastic.co/t/how-to-remove-count-column-from-visualization/217845 "2020-02-04T15:29:38Z")
I don't want to reveal the count but I want to display the count percentages instead. How can I only display this percentage and the first column and remove the count one I don't seem to be able to figure it out. Thank… --- ## [Use distance on dense vectors in relevance score (at query time)](https://discuss.elastic.co/t/use-distance-on-dense-vectors-in-relevance-score-at-query-time/217012)
**Author:** [@thomas-chauvet](https://discuss.elastic.co/u/thomas-chauvet)\ **Replies:** 2\ **Last updated:** [February 4, 2020, 3:21pm UTC](https://discuss.elastic.co/t/use-distance-on-dense-vectors-in-relevance-score-at-query-time/217012 "2020-02-04T15:21:21Z")
I use elasticsearch to combine different things: search in text score based on dense vector (cosine similarity) I use a query with function\_score. The first part is the search in the text (giving a score) and THEN a s… --- ## [Filebeat out put plugin](https://discuss.elastic.co/t/filebeat-out-put-plugin/217834)
**Author:** [@Mohammad.ali](https://discuss.elastic.co/u/Mohammad.ali)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 2:34pm UTC](https://discuss.elastic.co/t/filebeat-out-put-plugin/217834 "2020-02-04T14:34:17Z")
Hello everyone, Right now i have a cluster with 4 nodes. 3x(master-data) 1x(data only). in some scenario i am using file beat to send logs directly to elasticsearch and in some other scenario to log-stash. my question… --- ## [Elasticsearch log rotatio not working using log4j2.properties](https://discuss.elastic.co/t/elasticsearch-log-rotatio-not-working-using-log4j2-properties/217824)
**Author:** [@saumilmac](https://discuss.elastic.co/u/saumilmac)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-log-rotatio-not-working-using-log4j2-properties/217824 "2020-02-04T13:52:34Z")
I am trying to rotate my elasticsearch logs using log4j2. However, using the below configuration I am not able to do so. Any help would be appreciated. status = error log action execution errors for easier debugging lo… --- ## [ES7.5: Documents not searchable after update](https://discuss.elastic.co/t/es7-5-documents-not-searchable-after-update/217788)
**Author:** [@sls89](https://discuss.elastic.co/u/sls89)\ **Replies:** 1\ **Last updated:** [February 4, 2020, 1:46pm UTC](https://discuss.elastic.co/t/es7-5-documents-not-searchable-after-update/217788 "2020-02-04T13:46:41Z")
Hi, I have several documents in an index and try to update / create just one attribute (the attribute will be added and is not set by creating the document) therefore I tried both via \_update or \_update\_by\_query API. T… --- ## [Listen to new nodes added to cluster](https://discuss.elastic.co/t/listen-to-new-nodes-added-to-cluster/217820)
**Author:** [@Praveen\_Giri](https://discuss.elastic.co/u/Praveen_Giri)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 1:42pm UTC](https://discuss.elastic.co/t/listen-to-new-nodes-added-to-cluster/217820 "2020-02-04T13:42:37Z")
Is there a way to listen to new nodes discovered by a cluster? --- ## [Elasticsearch Query to combine \_source and inner\_hits result using nested query](https://discuss.elastic.co/t/elasticsearch-query-to-combine-source-and-inner-hits-result-using-nested-query/217819)
**Author:** [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 1:41pm UTC](https://discuss.elastic.co/t/elasticsearch-query-to-combine-source-and-inner-hits-result-using-nested-query/217819 "2020-02-04T13:41:11Z")
Do you have any ways on how to combine the \_source and inner\_hits result to a single document? I am using nested query to filter my fields that is stored in array for a specific document but it shows the original docume… --- ## [Elasticsearch process is killed by OOM killer](https://discuss.elastic.co/t/elasticsearch-process-is-killed-by-oom-killer/217792)
**Author:** [@ashok6](https://discuss.elastic.co/u/ashok6)\ **Replies:** 3\ **Last updated:** [February 4, 2020, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-process-is-killed-by-oom-killer/217792 "2020-02-04T13:17:57Z")
Hi, We have a 32GB c5.4xlarge ( 4 nodes cluster ) for the elastic search and the elastic search process is getting killed after a period of 3 weeks and there is no enough memopry left to restart the process. So had to m… --- ## [Best way to have a big cluster on a huge bare metal](https://discuss.elastic.co/t/best-way-to-have-a-big-cluster-on-a-huge-bare-metal/217805)
**Author:** [@Arman\_Ajdani](https://discuss.elastic.co/u/Arman_Ajdani)\ **Replies:** 0\ **Last updated:** [February 4, 2020, 12:42pm UTC](https://discuss.elastic.co/t/best-way-to-have-a-big-cluster-on-a-huge-bare-metal/217805 "2020-02-04T12:42:12Z")
Suppose I have a bare metal with a huge amount of RAM, What is the best approach to have a cluster of ES node, using VM? Multiple instances on different ports? or use an orchestration like Kubernetes? I need a cluster fo… --- ## [Action class not found on jar file, but works on Eclipse, how is that?](https://discuss.elastic.co/t/action-class-not-found-on-jar-file-but-works-on-eclipse-how-is-that/217670)
**Author:** [@franzisk](https://discuss.elastic.co/u/franzisk)\ **Replies:** 2\ **Last updated:** [February 4, 2020, 11:38am UTC](https://discuss.elastic.co/t/action-class-not-found-on-jar-file-but-works-on-eclipse-how-is-that/217670 "2020-02-04T11:38:34Z")
I am using Spring Boot Starter to persist data to Elasticsearch but when I build the jar file it says there is a missing class. What´s wrong? I am using 7.5.2 version. My pom.xml dependency is... \ \ **Author:** [@wall](https://discuss.elastic.co/u/wall)\ **Replies:** 2\ **Last updated:** [February 4, 2020, 11:14am UTC](https://discuss.elastic.co/t/is-it-possible-to-reactivate-trial-after-reverting-back-to-basic/217766 "2020-02-04T11:14:44Z") Hi Team, I'm testing some non-basic machine learning features and I've activated Trial version. I realized though, I have limited time to explore this in the next days, so I though to revert to basic and activate trial… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1025) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1027)