# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1038 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1039 --- ## [Search for string starting with S-1-5-21](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [January 23, 2020, 1:54pm UTC](https://discuss.elastic.co/t/search-for-string-starting-with-s-1-5-21/215924 "2020-01-23T13:54:46Z")
I am storing users SID and ACLs in elastic but when I try to search for group Users (SID: S-1-5-31-\*) it returns all users that contain S or 1 or 5. If used SID.keyword you have you put the exact match SID you cant sepe… --- ## [ILM problems](https://discuss.elastic.co/t/ilm-problems/216132)
**Author:** [@DWbank](https://discuss.elastic.co/u/DWbank)\ **Replies:** 2\ **Last updated:** [January 23, 2020, 12:20pm UTC](https://discuss.elastic.co/t/ilm-problems/216132 "2020-01-23T12:20:08Z")
I have been spinning my wheels for a while on this. I can't figure out where I am missing something. Logstash output output { # \*\*\*\*\*\*\* this is for debuging what has been parsed # file { # pat… --- ## [Match only if query is found in a field found within a specific nested object, and nothing else](https://discuss.elastic.co/t/match-only-if-query-is-found-in-a-field-found-within-a-specific-nested-object-and-nothing-else/215539)
**Author:** [@RedactedProfile](https://discuss.elastic.co/u/RedactedProfile)\ **Replies:** 2\ **Last updated:** [January 23, 2020, 11:19am UTC](https://discuss.elastic.co/t/match-only-if-query-is-found-in-a-field-found-within-a-specific-nested-object-and-nothing-else/215539 "2020-01-23T11:19:12Z")
Let's assume my index's data looks something like this: \[ { "\_index": "doc\_pages", "\_type": "pages", "\_id": "264b406593732ffbd15a5ed4b4e3b5af", "\_score": 1, "\_source": { "record\_id": "264b406… --- ## [Getting continuous warning message (server load very high )](https://discuss.elastic.co/t/getting-continuous-warning-message-server-load-very-high/216226)
**Author:** [@ELK\_CL](https://discuss.elastic.co/u/ELK_CL)\ **Replies:** 0\ **Last updated:** [January 23, 2020, 11:25am UTC](https://discuss.elastic.co/t/getting-continuous-warning-message-server-load-very-high/216226 "2020-01-23T11:25:19Z")
Hi, I am getting following messages: \[2020-01-23T16:50:22,697\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[reporting-1\] \[gc\]\[3421\] overhead, spent \[2.3s\] collecting in the last \[2.5s\] \[2020-01-23T16:50:30,241\]\[WARN \]\[o.e.m.j… --- ## [How should I manage hyphen in my request](https://discuss.elastic.co/t/how-should-i-manage-hyphen-in-my-request/216178)
**Author:** [@ShreyaBhat](https://discuss.elastic.co/u/ShreyaBhat)\ **Replies:** 1\ **Last updated:** [January 23, 2020, 10:48am UTC](https://discuss.elastic.co/t/how-should-i-manage-hyphen-in-my-request/216178 "2020-01-23T10:48:12Z")
I have tried the following but it does not work if I have a hyphen in my id: http://localhost:9200/account/useraccounts/\_search?q=id:"\* CMRZ\*" when I send \<--\> then result is 1-CMRZ-121 \<--\> 1-CMRZ-121 1-CMRZ- \<--\> 1-… --- ## [Date parse error in template](https://discuss.elastic.co/t/date-parse-error-in-template/216101)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 2\ **Last updated:** [January 23, 2020, 10:42am UTC](https://discuss.elastic.co/t/date-parse-error-in-template/216101 "2020-01-23T10:42:52Z")
after creation of template i am getting error , "reason"=\>"failed to parse date field \[06-APR-18 12:58:13\] with format \[dd-MMM-yy HH:mm:ss\]", "caused\_by"=\>{"type"=\>"date\_time\_parse\_exception", "reason"=\>"Text '06-APR-1… --- ## [ELK with SSL, possible issues?](https://discuss.elastic.co/t/elk-with-ssl-possible-issues/216205)
**Author:** [@nick.ilarionov](https://discuss.elastic.co/u/nick.ilarionov)\ **Replies:** 3\ **Last updated:** [January 23, 2020, 10:39am UTC](https://discuss.elastic.co/t/elk-with-ssl-possible-issues/216205 "2020-01-23T10:39:00Z")
Hello all! I am fairly new to the ELK stack and am trying to run a Proof of Concept of it. Getting it up and running under http was fairly easy, following the guides. However, as I want to have SSL enabled on all commun… --- ## [Search for non indexed fields is not working Please help](https://discuss.elastic.co/t/search-for-non-indexed-fields-is-not-working-please-help/215996)
**Author:** [@srivatsalya](https://discuss.elastic.co/u/srivatsalya)\ **Replies:** 3\ **Last updated:** [January 23, 2020, 10:12am UTC](https://discuss.elastic.co/t/search-for-non-indexed-fields-is-not-working-please-help/215996 "2020-01-23T10:12:30Z")
Hello, I want to filter the search results using non indexed field. { "\_index" : "shipmentdata\_v1", "\_type" : "\_doc", "\_id" : "128Q711U", "\_score" : 1.0, "\_source" : { "bundleId" : 13663, "customerId" : 101456 … --- ## [Plugin that can intersect an automaton with the completion suggester FSTs](https://discuss.elastic.co/t/plugin-that-can-intersect-an-automaton-with-the-completion-suggester-fsts/215908)
**Author:** [@luk.morbee](https://discuss.elastic.co/u/luk.morbee)\ **Replies:** 1\ **Last updated:** [January 23, 2020, 8:54am UTC](https://discuss.elastic.co/t/plugin-that-can-intersect-an-automaton-with-the-completion-suggester-fsts/215908 "2020-01-23T08:54:33Z")
If I understood it correctly an FST is created per segment for every completion suggester. Suppose we would want to write an Elasticsearch plugin that would allow us to intersect a given automaton (i.e. search logic you… --- ## [Situation after updating Mapping of Elastic](https://discuss.elastic.co/t/situation-after-updating-mapping-of-elastic/216175)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 1\ **Last updated:** [January 23, 2020, 8:28am UTC](https://discuss.elastic.co/t/situation-after-updating-mapping-of-elastic/216175 "2020-01-23T08:28:28Z")
Hi all, I will explain a situation, please suggest all possible solutions. Lets say, I create a static mapping(dynamic= false) for two attributes "name" , "surname" and add one million documents(with additional fields … --- ## [Gettiing "circuit\_breaking\_exception" while performing \_reindex on multiple indices. Indices sizes are in mb's](https://discuss.elastic.co/t/gettiing-circuit-breaking-exception-while-performing-reindex-on-multiple-indices-indices-sizes-are-in-mbs/216184)
**Author:** [@mnehav25](https://discuss.elastic.co/u/mnehav25)\ **Replies:** 0\ **Last updated:** [January 23, 2020, 6:16am UTC](https://discuss.elastic.co/t/gettiing-circuit-breaking-exception-while-performing-reindex-on-multiple-indices-indices-sizes-are-in-mbs/216184 "2020-01-23T06:16:32Z")
{ "took" : 49704, "timed\_out" : false, "total" : 8745492, "updated" : 0, "created" : 276000, "deleted" : 0, "batches" : 276, "version\_conflicts" : 0, "noops" : 0, "retries" : { "bulk" : 0, "search" : 0 }, "… --- ## [Could some one help me](https://discuss.elastic.co/t/could-some-one-help-me/216124)
**Author:** [@pmohan](https://discuss.elastic.co/u/pmohan)\ **Replies:** 1\ **Last updated:** [January 23, 2020, 5:43am UTC](https://discuss.elastic.co/t/could-some-one-help-me/216124 "2020-01-23T05:43:46Z")
I'm trying to PUT a cloudlfare template on to a ELK 7.5 and its failing to create a template. Below is the error { "error": { "root\_cause": \[ { "type": "mapper\_parsing\_exception", "reason": "Root mapping definitio… --- ## [Wildcard search with space in the text](https://discuss.elastic.co/t/wildcard-search-with-space-in-the-text/215797)
**Author:** [@jwlee](https://discuss.elastic.co/u/jwlee)\ **Replies:** 10\ **Last updated:** [January 23, 2020, 4:56am UTC](https://discuss.elastic.co/t/wildcard-search-with-space-in-the-text/215797 "2020-01-23T04:56:34Z")
Wildcard search seems not working if a value contains space. For example, if a value is "hello world" and if you do search hel\* it does not return anything. Below is the query that I used: { "query": { "bool": … --- ## [Pi 4+ 4gb seems to give me a Cyclic Heap error preventing ingestion](https://discuss.elastic.co/t/pi-4-4gb-seems-to-give-me-a-cyclic-heap-error-preventing-ingestion/216143)
**Author:** [@fallenreaper](https://discuss.elastic.co/u/fallenreaper)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 9:43pm UTC](https://discuss.elastic.co/t/pi-4-4gb-seems-to-give-me-a-cyclic-heap-error-preventing-ingestion/216143 "2020-01-22T21:43:20Z")
Hey All, First post. I put this on stack overflow ( https://stackoverflow.com/questions/59740792/monitoring-indexing-stats-gives-me-a-current-indexing-set-to-0-i-think-somethin ), but i wanted to generally summarize it… --- ## [No detection of fields in query\_string query strings results in "field expansion matches too many fields"](https://discuss.elastic.co/t/no-detection-of-fields-in-query-string-query-strings-results-in-field-expansion-matches-too-many-fields/216137)
**Author:** [@aaron\_ximm](https://discuss.elastic.co/u/aaron_ximm)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:22pm UTC](https://discuss.elastic.co/t/no-detection-of-fields-in-query-string-query-strings-results-in-field-expansion-matches-too-many-fields/216137 "2020-01-22T22:22:35Z")
Hi, I am migrating from 5.6.x to 7.5.1. Testing existing application use of query\_string queries (either via DSL or implicitly in URI search) is breaking. I believes this is because of changes to how these queries are… --- ## [Elasticsearch 6.8.5 License JAR for Transport Client](https://discuss.elastic.co/t/elasticsearch-6-8-5-license-jar-for-transport-client/216123)
**Author:** [@jpappd](https://discuss.elastic.co/u/jpappd)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 7:32pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-5-license-jar-for-transport-client/216123 "2020-01-22T19:32:42Z")
Starting a transport client in Elasticsearch 6.8.5 results in the following failure. Presumably a client license plugin of some sort is required. What is the Elastic Maven repository URL to download this missing binary? … --- ## [Is there a way to avoid very similar documents one after another in results?](https://discuss.elastic.co/t/is-there-a-way-to-avoid-very-similar-documents-one-after-another-in-results/216122)
**Author:** [@ffknob](https://discuss.elastic.co/u/ffknob)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-avoid-very-similar-documents-one-after-another-in-results/216122 "2020-01-22T19:25:52Z")
Imagine a transactional system where sometimes the user can apply the same operation to a group of items. This operation generates a text based on a model provided by the user and only changes one or two specific terms: … --- ## [Search Engine and Elasticsearch](https://discuss.elastic.co/t/search-engine-and-elasticsearch/215930)
**Author:** [@Serhii\_Oleksenko](https://discuss.elastic.co/u/Serhii_Oleksenko)\ **Replies:** 6\ **Last updated:** [January 22, 2020, 7:01pm UTC](https://discuss.elastic.co/t/search-engine-and-elasticsearch/215930 "2020-01-22T19:01:40Z")
Hello! Are there search engines that use elastic? Search Engines that are completely independent of the search giants (Google, Bing). --- ## [ElasticSearch 6.7: Big difference between parent circuit breaker and jvm used heap](https://discuss.elastic.co/t/elasticsearch-6-7-big-difference-between-parent-circuit-breaker-and-jvm-used-heap/215967)
**Author:** [@musfiqur](https://discuss.elastic.co/u/musfiqur)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 6:05pm UTC](https://discuss.elastic.co/t/elasticsearch-6-7-big-difference-between-parent-circuit-breaker-and-jvm-used-heap/215967 "2020-01-22T18:05:35Z")
Hi, We are using ES 6.7. We are looking at 2 metrics: Parent Circuit Breaker Used memory JVM used heap We see that ES circuit breaker are way off. We see that for the same timestamp: Used heap returns 17.85 GB where… --- ## [Ansible role elastic.elasticsearch - how to set listen address of http and api endpoints](https://discuss.elastic.co/t/ansible-role-elastic-elasticsearch-how-to-set-listen-address-of-http-and-api-endpoints/216096)
**Author:** [@jdelvecchio](https://discuss.elastic.co/u/jdelvecchio)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 5:27pm UTC](https://discuss.elastic.co/t/ansible-role-elastic-elasticsearch-how-to-set-listen-address-of-http-and-api-endpoints/216096 "2020-01-22T17:27:50Z")
Hi, I'm using https://github.com/elastic/ansible-elasticsearch and cannot find the variables to set the listen address of the elasticsearch endpoints. By default, they are set to listen on 'localhost' which is a problem … --- ## [Logs are not coming in logs folder in Windows](https://discuss.elastic.co/t/logs-are-not-coming-in-logs-folder-in-windows/216005)
**Author:** [@naveen\_kumar2](https://discuss.elastic.co/u/naveen_kumar2)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 2:56pm UTC](https://discuss.elastic.co/t/logs-are-not-coming-in-logs-folder-in-windows/216005 "2020-01-22T14:56:41Z")
After Installing Elastic search in Windows 10, logs are not coming in logs folder , I have also changed the elasticsearch.yml file and update the path, still logs are not coming, Can anyone help here? --- ## [Recommendation on very large text fields](https://discuss.elastic.co/t/recommendation-on-very-large-text-fields/216079)
**Author:** [@Jimmy](https://discuss.elastic.co/u/Jimmy)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 2:45pm UTC](https://discuss.elastic.co/t/recommendation-on-very-large-text-fields/216079 "2020-01-22T14:45:38Z")
Hi, I have an index which one of the fields can contain thousands of characters, it's a field which an user can input some html information, and in some cases a base64 encoded image. This field does not need to be sear… --- ## [Rolling upgrade from 5.6 to 6.8 fails to start](https://discuss.elastic.co/t/rolling-upgrade-from-5-6-to-6-8-fails-to-start/215918)
**Author:** [@pmadley](https://discuss.elastic.co/u/pmadley)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 2:29pm UTC](https://discuss.elastic.co/t/rolling-upgrade-from-5-6-to-6-8-fails-to-start/215918 "2020-01-22T14:29:38Z")
Pretty sure I exactly followed the instructions here: Install Elasticsearch with RPM | Elasticsearch Guide \[6.8\] | Elastic However tailing journalctl says the following. Anybody got any suggestions. I've very much a D… --- ## [Query for automplete feature?](https://discuss.elastic.co/t/query-for-automplete-feature/215949)
**Author:** [@rishabh\_jain](https://discuss.elastic.co/u/rishabh_jain)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 2:21pm UTC](https://discuss.elastic.co/t/query-for-automplete-feature/215949 "2020-01-22T14:21:40Z")
should we use edge\_ngram for autocomplete? If yes will it have any any impact on query execution? If no then what is the use of ngram if one can search using query\_string query? Also let suppose want to create ngram o… --- ## [DISK I/O Monitor alert from new relic for Elastic search nodes](https://discuss.elastic.co/t/disk-i-o-monitor-alert-from-new-relic-for-elastic-search-nodes/215981)
**Author:** [@Ajay16](https://discuss.elastic.co/u/Ajay16)\ **Replies:** 7\ **Last updated:** [January 22, 2020, 1:39pm UTC](https://discuss.elastic.co/t/disk-i-o-monitor-alert-from-new-relic-for-elastic-search-nodes/215981 "2020-01-22T13:39:53Z")
i am getting disk i/o monitor alert from new relic for the elastic search nodes(2 nodes)., how can i resolve this issue., help me out of this.,new to elastic search --- ## [Master node not discovered exception while executing /\_cat/indices query in elasticsearch](https://discuss.elastic.co/t/master-node-not-discovered-exception-while-executing-cat-indices-query-in-elasticsearch/216072)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 1:36pm UTC](https://discuss.elastic.co/t/master-node-not-discovered-exception-while-executing-cat-indices-query-in-elasticsearch/216072 "2020-01-22T13:36:46Z")
cannot able to execute any query in elasticsearch. Masternode not discoverd exception occurs --- ## [Build elasticsearch from source, docker problem](https://discuss.elastic.co/t/build-elasticsearch-from-source-docker-problem/216062)
**Author:** [@0mod4](https://discuss.elastic.co/u/0mod4)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 1:01pm UTC](https://discuss.elastic.co/t/build-elasticsearch-from-source-docker-problem/216062 "2020-01-22T13:01:06Z")
Hi, I try to build the latest version of elasticsearch to contritubte to kibana. I used ./gradlew assemble and I keep on getting Process 'command '/usr/bin/docker'' finished with non-zero exit value 1 My docker version… --- ## [Run cluster in docker, on 2 hosts](https://discuss.elastic.co/t/run-cluster-in-docker-on-2-hosts/216019)
**Author:** [@Nikolay\_Shalnev](https://discuss.elastic.co/u/Nikolay_Shalnev)\ **Replies:** 8\ **Last updated:** [January 22, 2020, 12:43pm UTC](https://discuss.elastic.co/t/run-cluster-in-docker-on-2-hosts/216019 "2020-01-22T12:43:55Z")
Hi. I have 2 hosts and 2 docker-compose file. version: '3.6' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:7.5.1 environment: - node.name=predprod-rumcelk1 / predprod-rum… --- ## [Consul discovery plugin?](https://discuss.elastic.co/t/consul-discovery-plugin/215960)
**Author:** [@rgarrigue](https://discuss.elastic.co/u/rgarrigue)\ **Replies:** 4\ **Last updated:** [January 22, 2020, 12:31pm UTC](https://discuss.elastic.co/t/consul-discovery-plugin/215960 "2020-01-22T12:31:57Z")
Hi there I'm wondering if there's any plan for a discovery plugin based on Consul ? Best regards, Rémy --- ## [Replace string with multiple patterns on ingest node](https://discuss.elastic.co/t/replace-string-with-multiple-patterns-on-ingest-node/216039)
**Author:** [@AndresL](https://discuss.elastic.co/u/AndresL)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 11:28am UTC](https://discuss.elastic.co/t/replace-string-with-multiple-patterns-on-ingest-node/216039 "2020-01-22T11:28:34Z")
Hi, i have certain numbers in format xxxx-xxxx or format xxxxxxxx that i want to replace on the ingest-node. i will also like to verify if the message contains some credit card info. It seems i cant use multiple gsubs [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1037) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1039)