# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1029 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1030 --- ## [Elasticsearch 7.5.2 Cluster on EC2: Security Group](https://discuss.elastic.co/t/elasticsearch-7-5-2-cluster-on-ec2-security-group/217481)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 2\ **Last updated:** [February 1, 2020, 11:09am UTC](https://discuss.elastic.co/t/elasticsearch-7-5-2-cluster-on-ec2-security-group/217481 "2020-02-01T11:09:15Z")
Hi There, I'm testing out a 3 x ES Node cluster on EC2. When I set my Security Group to inbound allow all (outbound is allow all in all cases), the cluster has no issue. But when I set a new SG to allow inbound 9200, 9… --- ## [How to achieve website hits count](https://discuss.elastic.co/t/how-to-achieve-website-hits-count/217490)
**Author:** [@nikhilesh](https://discuss.elastic.co/u/nikhilesh)\ **Replies:** 0\ **Last updated:** [February 1, 2020, 11:07am UTC](https://discuss.elastic.co/t/how-to-achieve-website-hits-count/217490 "2020-02-01T11:07:59Z")
HI All, I would like to get the IIS website hits counts in ELK..can anyone please help how to achieve? which beat can be used to get that? Thanks Nikhilesh Gade --- ## [Is it okay to have multiple ES nodes on one machine?](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-es-nodes-on-one-machine/217486)
**Author:** [@Arman\_Ajdani](https://discuss.elastic.co/u/Arman_Ajdani)\ **Replies:** 3\ **Last updated:** [February 1, 2020, 9:53am UTC](https://discuss.elastic.co/t/is-it-okay-to-have-multiple-es-nodes-on-one-machine/217486 "2020-02-01T09:53:12Z")
Is it okay to have multiple ES nodes on one machine? what are the cons to this action? --- ## [How to assign correctly shards when a new node join cluster?](https://discuss.elastic.co/t/how-to-assign-correctly-shards-when-a-new-node-join-cluster/217436)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 3\ **Last updated:** [February 1, 2020, 6:54am UTC](https://discuss.elastic.co/t/how-to-assign-correctly-shards-when-a-new-node-join-cluster/217436 "2020-02-01T06:54:52Z")
Hi, this is my current scenario: 9 DATA nodes A lot of indices (avg size 5 GB and 3 shards and 2 replica) 1 big index (100 GB size and 12 shards and 3 replica) When a new DATA node joins the cluster, Elasticsearch w… --- ## [Search documents with specific field value in time range](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422)
**Author:** [@PeterH](https://discuss.elastic.co/u/PeterH)\ **Replies:** 1\ **Last updated:** [February 1, 2020, 4:35am UTC](https://discuss.elastic.co/t/search-documents-with-specific-field-value-in-time-range/217422 "2020-02-01T04:35:47Z")
I want to search all documents that have a field "logLevel" set to "WARNING" in the last 24 hours. How do I have to format this query for \_search or python elasticsearch? This is my current query: "query": { "term": {… --- ## [Elasticsearch with TLS for external and HTTP for localhost?](https://discuss.elastic.co/t/elasticsearch-with-tls-for-external-and-http-for-localhost/217428)
**Author:** [@ptselios](https://discuss.elastic.co/u/ptselios)\ **Replies:** 1\ **Last updated:** [February 1, 2020, 4:33am UTC](https://discuss.elastic.co/t/elasticsearch-with-tls-for-external-and-http-for-localhost/217428 "2020-02-01T04:33:37Z")
Is it possible to make Elasticsearch for listen on HTTPS for external traffic (traffic that targets the IP of the machine) and use plain HTTP for localhost connections? I have Kibana on the same host as Elasticsearch an… --- ## [Add deprecated warning more broadly (in doc pages)](https://discuss.elastic.co/t/add-deprecated-warning-more-broadly-in-doc-pages/217429)
**Author:** [@spottedmahn](https://discuss.elastic.co/u/spottedmahn)\ **Replies:** 1\ **Last updated:** [February 1, 2020, 4:30am UTC](https://discuss.elastic.co/t/add-deprecated-warning-more-broadly-in-doc-pages/217429 "2020-02-01T04:30:58Z")
Preface: new to Elasticsearch... I Googled for some info about the Java SDK and I ended up here on the document index api page, cool :sunglasses:, that should do the trick for what I need :+1:. Only to eventually find … --- ## [Obtaining results from different similarity measures](https://discuss.elastic.co/t/obtaining-results-from-different-similarity-measures/217477)
**Author:** [@mhnamaki](https://discuss.elastic.co/u/mhnamaki)\ **Replies:** 0\ **Last updated:** [February 1, 2020, 2:00am UTC](https://discuss.elastic.co/t/obtaining-results-from-different-similarity-measures/217477 "2020-02-01T02:00:20Z")
In order to obtain more relevant results from a query, I'm going to ensemble the results from different similarity modules (e.g. BM25, DFR, DFI, and IB). Link to Similarity Modules The ideal case is if I could say for … --- ## [Counting users per number of sessions](https://discuss.elastic.co/t/counting-users-per-number-of-sessions/217470)
**Author:** [@Andre\_Carneiro](https://discuss.elastic.co/u/Andre_Carneiro)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 10:23pm UTC](https://discuss.elastic.co/t/counting-users-per-number-of-sessions/217470 "2020-01-31T22:23:54Z")
First of all: Hi! My company is adopting ELK stack and i'm translating our old reports to the new stack, so my problem is a report on frequency of sessions per user, as in: 10 users have 1 logged session 20 users have… --- ## [Is there Hourly ElasticSearch Consulting?](https://discuss.elastic.co/t/is-there-hourly-elasticsearch-consulting/217465)
**Author:** [@jeffreygatsby](https://discuss.elastic.co/u/jeffreygatsby)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 9:46pm UTC](https://discuss.elastic.co/t/is-there-hourly-elasticsearch-consulting/217465 "2020-01-31T21:46:23Z")
I have an elastic search cluster running on Elastic Cloud. For the most part it works, but there are a couple of one off issues that I would like to get fixed. See (https://discuss.elastic.co/t/general-search-not-wor… --- ## [Is there a way to force the \_seq\_no and \_primary\_term fields in a scroll](https://discuss.elastic.co/t/is-there-a-way-to-force-the-seq-no-and-primary-term-fields-in-a-scroll/217412)
**Author:** [@LordMathis](https://discuss.elastic.co/u/LordMathis)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 9:07pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-force-the-seq-no-and-primary-term-fields-in-a-scroll/217412 "2020-01-31T21:07:31Z")
Hello ELK community, I have built an application where the user passes us a search body. We want to use the concurrency that was implemented with the \_seq\_no but to do this we need to add '"seq\_no\_primary\_term": true' t… --- ## [Convert string to int by reindexing](https://discuss.elastic.co/t/convert-string-to-int-by-reindexing/217456)
**Author:** [@joelxref](https://discuss.elastic.co/u/joelxref)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 8:56pm UTC](https://discuss.elastic.co/t/convert-string-to-int-by-reindexing/217456 "2020-01-31T20:56:49Z")
I have quite a few indexes matching the pattern logstash-\* In them I have a keyword called 'bytes\_read'. It's type according to elasticsearch is string. This is due to an issue with our logstash configuration. I have c… --- ## [Shard recovery thread count](https://discuss.elastic.co/t/shard-recovery-thread-count/217283)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 4\ **Last updated:** [January 31, 2020, 7:32pm UTC](https://discuss.elastic.co/t/shard-recovery-thread-count/217283 "2020-01-31T19:32:59Z")
I have noticed in my cluster that there are maximum of 2 recovery tasks running whenever shard relocation happens. Is this a configurable setting? I would like to experiment with more threads moving shards to speed up … --- ## [Does Elastic Search Service support Canadian French and Mexican Spanish language analyzer?](https://discuss.elastic.co/t/does-elastic-search-service-support-canadian-french-and-mexican-spanish-language-analyzer/217325)
**Author:** [@shefu](https://discuss.elastic.co/u/shefu)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 6:34pm UTC](https://discuss.elastic.co/t/does-elastic-search-service-support-canadian-french-and-mexican-spanish-language-analyzer/217325 "2020-01-31T18:34:15Z")
I need to implement language analyzers for Canadian French and Mexican Spanish. As per below documentation, french and Spanish analyzer supported by Elastic Search service: https://www.elastic.co/guide/en/elasticsearch… --- ## [How to perform filter based on aggregation of nested fields? (similar to nested sorting)](https://discuss.elastic.co/t/how-to-perform-filter-based-on-aggregation-of-nested-fields-similar-to-nested-sorting/217442)
**Author:** [@f3l1xss](https://discuss.elastic.co/u/f3l1xss)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 6:04pm UTC](https://discuss.elastic.co/t/how-to-perform-filter-based-on-aggregation-of-nested-fields-similar-to-nested-sorting/217442 "2020-01-31T18:04:38Z")
I have an index like below: cargroup "mappings": { "properties": { "id": { "type": "integer" }, "cars": { "type": "nested", "properties": { … --- ## [Elasticsearch with TLS does not start](https://discuss.elastic.co/t/elasticsearch-with-tls-does-not-start/217401)
**Author:** [@ptselios](https://discuss.elastic.co/u/ptselios)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 4:35pm UTC](https://discuss.elastic.co/t/elasticsearch-with-tls-does-not-start/217401 "2020-01-31T16:35:21Z")
Hello, I have an ELK AIO installation that works just fine without TLS. When I configure TLS for HTTP doesn't start and we have no indication why. The certificate is signed from our internal CA which is configured on … --- ## [ES 7.4 Search performance is much slow than ES 5.5](https://discuss.elastic.co/t/es-7-4-search-performance-is-much-slow-than-es-5-5/217425)
**Author:** [@taoyantu](https://discuss.elastic.co/u/taoyantu)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/es-7-4-search-performance-is-much-slow-than-es-5-5/217425 "2020-01-31T16:20:26Z")
We currently use the ES 5.5 version and plan to upgrade to the ES 7.4 version. I deployed two environments,use the same server , 88 core cpu , 256G memory , the cluster have 3 servers, each server starts 3 nodes, the cl… --- ## [GitLab monitoring by ELK for commits, projects](https://discuss.elastic.co/t/gitlab-monitoring-by-elk-for-commits-projects/217416)
**Author:** [@Balaji](https://discuss.elastic.co/u/Balaji)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 3:49pm UTC](https://discuss.elastic.co/t/gitlab-monitoring-by-elk-for-commits-projects/217416 "2020-01-31T15:49:50Z")
I have created a filebeat to read the GitLab below log files and I would able to see the log details in Kibana. I need to create virtualization for commits, projects, users in the GitLab, I understood all these are of… --- ## [Find difference between two clusters](https://discuss.elastic.co/t/find-difference-between-two-clusters/217417)
**Author:** [@brhardwick](https://discuss.elastic.co/u/brhardwick)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 3:58pm UTC](https://discuss.elastic.co/t/find-difference-between-two-clusters/217417 "2020-01-31T15:58:05Z")
We have a use case that requires us to replace clusters regularly. My current approach is a Blue/Green-type deployment like the following: Cluster A is running, bring up Cluster B and wait for it to be live. Cluster A… --- ## [Trouble to understand some simple query](https://discuss.elastic.co/t/trouble-to-understand-some-simple-query/217387)
**Author:** [@Guss4241](https://discuss.elastic.co/u/Guss4241)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 3:49pm UTC](https://discuss.elastic.co/t/trouble-to-understand-some-simple-query/217387 "2020-01-31T15:49:54Z")
Hi, i'm working with elasticsearch since some weeks now and I'm on the final step for my company project, but I have have some trouble to understand a trouble with a simple query. in my index I have a nested field call… --- ## [Data Node Error \[Timed out when collecting data error\]](https://discuss.elastic.co/t/data-node-error-timed-out-when-collecting-data-error/216879)
**Author:** [@B.M](https://discuss.elastic.co/u/B.M)\ **Replies:** 0\ **Last updated:** [January 28, 2020, 4:36pm UTC](https://discuss.elastic.co/t/data-node-error-timed-out-when-collecting-data-error/216879 "2020-01-28T16:36:23Z")
Hi, we have a 9 nodes cluster in production that has been running for 10 days without any issues until a couple days ago when we increased the shard number from 2 shards & 1 replica to 3 shards & 1 replica. Juste after… --- ## [Elasticsearch 6.2 service failed to start](https://discuss.elastic.co/t/elasticsearch-6-2-service-failed-to-start/216898)
**Author:** [@csrowell](https://discuss.elastic.co/u/csrowell)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-6-2-service-failed-to-start/216898 "2020-01-31T14:40:27Z")
We did Windows updates this month and are now getting these errors: Windows Event Log: The Elasticsearch 6.2.4 (elasticsearch-service-x64) service terminated with the following service-specific error: Incorrect functi… --- ## [Using fuzziness in span queries](https://discuss.elastic.co/t/using-fuzziness-in-span-queries/217357)
**Author:** [@svr](https://discuss.elastic.co/u/svr)\ **Replies:** 1\ **Last updated:** [January 31, 2020, 2:27pm UTC](https://discuss.elastic.co/t/using-fuzziness-in-span-queries/217357 "2020-01-31T14:27:33Z")
I try to implement a search for a phrase by using a span query as I found at stackoverflow: But I have to write it as a request for NEST in VB.NET: Dim sSpanClauses As New List(Of ISpanQuery) For Each w In word.Split… --- ## [Returns Different Datas from same query with elastic and nest](https://discuss.elastic.co/t/returns-different-datas-from-same-query-with-elastic-and-nest/217370)
**Author:** [@kamala\_enderson](https://discuss.elastic.co/u/kamala_enderson)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 12:38pm UTC](https://discuss.elastic.co/t/returns-different-datas-from-same-query-with-elastic-and-nest/217370 "2020-01-31T12:38:02Z")
Hello, If it is so easy question, I'm so sorry ,I am new at elasticsearch. I use nest for elasticsearch and when I think the two way of same query in Kibana and Nest, I get different result. So where is my code wrong ?… --- ## [Date format parse error](https://discuss.elastic.co/t/date-format-parse-error/217234)
**Author:** [@F\_eq\_kx](https://discuss.elastic.co/u/F_eq_kx)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 1:36pm UTC](https://discuss.elastic.co/t/date-format-parse-error/217234 "2020-01-31T13:36:32Z")
I'm getting Caused by: java.lang.IllegalArgumentException: failed to parse date field \[Thu Jan 30 15:31:42 +00:00 2020\] with format \[strict\_date\_optional\_time||epoch\_millis||E M dd HH:mm:ss Z yyyy\] when ingesting some da… --- ## [Part of (message) field to new field - how?](https://discuss.elastic.co/t/part-of-message-field-to-new-field-how/217212)
**Author:** [@Tommie](https://discuss.elastic.co/u/Tommie)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 1:32pm UTC](https://discuss.elastic.co/t/part-of-message-field-to-new-field-how/217212 "2020-01-31T13:32:33Z")
There's an index with (message) fields like: selection xyz finished. elapsed\_millis: 73, rows=4 selection shorter finished. elapsed\_millis: 165, rows=454 selection another finished. elapsed\_millis: 9999, rows=0 Is it… --- ## [Preferred method of setting JVM options for process memory](https://discuss.elastic.co/t/preferred-method-of-setting-jvm-options-for-process-memory/217378)
**Author:** [@TheVintik](https://discuss.elastic.co/u/TheVintik)\ **Replies:** 0\ **Last updated:** [January 31, 2020, 1:29pm UTC](https://discuss.elastic.co/t/preferred-method-of-setting-jvm-options-for-process-memory/217378 "2020-01-31T13:29:13Z")
Hello, I have a question about memory for ElasticSearch. I am using 7x version, and I was setup my OS (centos 7 / 32 GB RAM) with the following configs (ES\_JAVA\_OPTS="-Xms16g -Xmx16g"): When I restarted my ES service… --- ## [Find latest value of X for each term in Y - Splunk equivalent](https://discuss.elastic.co/t/find-latest-value-of-x-for-each-term-in-y-splunk-equivalent/217346)
**Author:** [@wiouser](https://discuss.elastic.co/u/wiouser)\ **Replies:** 5\ **Last updated:** [January 31, 2020, 12:17pm UTC](https://discuss.elastic.co/t/find-latest-value-of-x-for-each-term-in-y-splunk-equivalent/217346 "2020-01-31T12:17:39Z")
Hi, I have a time series data in an index. I am trying to find latest value of a field1 split by terms in field2. Then apply a filter example field1=SUCCESS and count the resulting terms. I just want to return only t… --- ## [Elasticsearch7.4 multinode cluster - Bootstrap Service discovery on Openshift cluster](https://discuss.elastic.co/t/elasticsearch7-4-multinode-cluster-bootstrap-service-discovery-on-openshift-cluster/217356)
**Author:** [@bishtj](https://discuss.elastic.co/u/bishtj)\ **Replies:** 2\ **Last updated:** [January 31, 2020, 11:52am UTC](https://discuss.elastic.co/t/elasticsearch7-4-multinode-cluster-bootstrap-service-discovery-on-openshift-cluster/217356 "2020-01-31T11:52:06Z")
Hi, I am working on upgrading 3 node cluster elasticsearch5.5 hosted on openshift to elasticsearch7.4. Everything works on dev/qa ( single node cluster). My solution is to create brand new cluster and then migrate his… --- ## [Is there a way to implement a keep last N docs per id in a specific index?](https://discuss.elastic.co/t/is-there-a-way-to-implement-a-keep-last-n-docs-per-id-in-a-specific-index/217249)
**Author:** [@kostistsaprailis](https://discuss.elastic.co/u/kostistsaprailis)\ **Replies:** 3\ **Last updated:** [January 31, 2020, 11:34am UTC](https://discuss.elastic.co/t/is-there-a-way-to-implement-a-keep-last-n-docs-per-id-in-a-specific-index/217249 "2020-01-31T11:34:33Z")
Hello all, I have a weird question, I would like to know if there's some way to implement a grouping filter on a index. E.g. Say for example that we have an index where each doc is one customer purchase, and we keep al… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1028) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1030)