# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1039 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1040 --- ## [ELK Red status](https://discuss.elastic.co/t/elk-red-status/216015)
**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 10:06am UTC](https://discuss.elastic.co/t/elk-red-status/216015 "2020-01-22T10:06:00Z")
Hi, Every day i am facing an issue on my ELK cluster with red status. Some Indexes everyday are red so i am deleting them and they are recreating and after this the ELK Status is becoming green again. Here is the log o… --- ## [Configuration file. Path to data: path error](https://discuss.elastic.co/t/configuration-file-path-to-data-path-error/216010)
**Author:** [@VIGNESHkumar](https://discuss.elastic.co/u/VIGNESHkumar)\ **Replies:** 3\ **Last updated:** [January 22, 2020, 9:58am UTC](https://discuss.elastic.co/t/configuration-file-path-to-data-path-error/216010 "2020-01-22T09:58:55Z")
while configuring the latest version of elasticsearch.yml file. the path where we need to store the index cannot be accessed throws an error Masternode not discovered exception. But the same elasticsearch.yml file is wor… --- ## [Elasticsearch 1.7 logrotation crashes for clusters with low logging](https://discuss.elastic.co/t/elasticsearch-1-7-logrotation-crashes-for-clusters-with-low-logging/216017)
**Author:** [@workaround](https://discuss.elastic.co/u/workaround)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-1-7-logrotation-crashes-for-clusters-with-low-logging/216017 "2020-01-22T09:27:59Z")
Hello, We have specific active Elasticsearch clusters whose logrotation crushes frequently. We have more than 100 elasticsearch clusters and just some specific keep crushing their logrotation. After investigation, I h… --- ## [Does ES store \_id field in Lucene as its docid?](https://discuss.elastic.co/t/does-es-store-id-field-in-lucene-as-its-docid/215977)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 2\ **Last updated:** [January 22, 2020, 9:32am UTC](https://discuss.elastic.co/t/does-es-store-id-field-in-lucene-as-its-docid/215977 "2020-01-22T09:32:35Z")
As the title asked, Does ES store \_id field in Lucene as its docid? Or ES just store \_id field as an index-field and each time ES write a doc, lucene create an unique docid and return to ES? --- ## [Conditional function score boost based on used search term](https://discuss.elastic.co/t/conditional-function-score-boost-based-on-used-search-term/216016)
**Author:** [@DerrickXp](https://discuss.elastic.co/u/DerrickXp)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 9:23am UTC](https://discuss.elastic.co/t/conditional-function-score-boost-based-on-used-search-term/216016 "2020-01-22T09:23:46Z")
I have client that requested a feature to apply certain boosts only when a certain search term is used. My first thought is that this should not be necessary with the right configuration and doc content. But after a demo… --- ## [Example: predicting flight delays, but per carrier](https://discuss.elastic.co/t/example-predicting-flight-delays-but-per-carrier/216007)
**Author:** [@Sven\_Beauprez](https://discuss.elastic.co/u/Sven_Beauprez)\ **Replies:** 0\ **Last updated:** [January 22, 2020, 8:07am UTC](https://discuss.elastic.co/t/example-predicting-flight-delays-but-per-carrier/216007 "2020-01-22T08:07:55Z")
I am learning about the way ES uses regression analysis and looking at the example of flight carriers, I wonder if it is possible to group on a certain field such as carrier and have predictions per carrier. In the exam… --- ## [Named query within nested query](https://discuss.elastic.co/t/named-query-within-nested-query/215923)
**Author:** [@meirshal](https://discuss.elastic.co/u/meirshal)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 8:17am UTC](https://discuss.elastic.co/t/named-query-within-nested-query/215923 "2020-01-22T08:17:24Z")
Hey folks! I’ve encountered something that looked to me like a bug, involving named queries inside nested queries. I’ve also found this issue on Github: https://github.com/elastic/elasticsearch/issues/46231 It looks ve… --- ## [Kibana CircuitBreakingException](https://discuss.elastic.co/t/kibana-circuitbreakingexception/215668)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 1\ **Last updated:** [January 22, 2020, 3:52am UTC](https://discuss.elastic.co/t/kibana-circuitbreakingexception/215668 "2020-01-22T03:52:42Z")
Hi , Version - ELK 7.1.0 cluster - Single node ELK cluster installed in AWS VM Have added the date filter in Kibana dashboard , If select more than 2 dates of data getting below error All shards failed for phase: \[qu… --- ## [ES 7.5 translog recovery is extremely slow](https://discuss.elastic.co/t/es-7-5-translog-recovery-is-extremely-slow/215505)
**Author:** [@Jonathan\_Mendenhall](https://discuss.elastic.co/u/Jonathan_Mendenhall)\ **Replies:** 14\ **Last updated:** [January 22, 2020, 2:45am UTC](https://discuss.elastic.co/t/es-7-5-translog-recovery-is-extremely-slow/215505 "2020-01-22T02:45:24Z")
A sample of the response from the recovery API: "translog" : { "recovered" : 17201, "total" : 4686825, "percent" : "0.4%", "total\_on\_start" : -1, "total\_time\_in\_millis" : 1790702 } This is on an index that is no … --- ## [Compare 2 indexes with many fields and same structure and set alert watcher on threshold](https://discuss.elastic.co/t/compare-2-indexes-with-many-fields-and-same-structure-and-set-alert-watcher-on-threshold/215965)
**Author:** [@adifucan](https://discuss.elastic.co/u/adifucan)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 11:45pm UTC](https://discuss.elastic.co/t/compare-2-indexes-with-many-fields-and-same-structure-and-set-alert-watcher-on-threshold/215965 "2020-01-21T23:45:32Z")
Hi guys! I'm looking for an advice. I have 2 indexes with many identical fields. I just want to compare values of these fields and send an email notification if these values are beyond some threshold. So is it possible… --- ## [Elasticsearch settings do not seem to be applied via Docker env variables?](https://discuss.elastic.co/t/elasticsearch-settings-do-not-seem-to-be-applied-via-docker-env-variables/213384)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 8:28pm UTC](https://discuss.elastic.co/t/elasticsearch-settings-do-not-seem-to-be-applied-via-docker-env-variables/213384 "2020-01-21T20:28:06Z")
I'm running a small test cluster via docker-compose on a desktop in my office, I've configured each node via environment variables. Not by using elasticsearch.yml. My main node looks like: version: '3.3' services: es… --- ## [Tool for ingesting SaaS audit logs into Elasticsearch](https://discuss.elastic.co/t/tool-for-ingesting-saas-audit-logs-into-elasticsearch/215948)
**Author:** [@arkadiy](https://discuss.elastic.co/u/arkadiy)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 8:27pm UTC](https://discuss.elastic.co/t/tool-for-ingesting-saas-audit-logs-into-elasticsearch/215948 "2020-01-21T20:27:56Z")
Hi all, I've been building a product to ingest audit logs from all your SaaS tools (think G Suite, Okta, Github, Dropbox, Zendesk, Salesforce, etc) and push them into Elasticsearch. The product is in a beta state and I… --- ## [ElasticSearch Old-Gen Heap filling up quickly](https://discuss.elastic.co/t/elasticsearch-old-gen-heap-filling-up-quickly/215944)
**Author:** [@musfiqur](https://discuss.elastic.co/u/musfiqur)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 7:55pm UTC](https://discuss.elastic.co/t/elasticsearch-old-gen-heap-filling-up-quickly/215944 "2020-01-21T19:55:58Z")
Hi, From our grafana logs, we see that our old-gen heap is filling up quickly (in 10 minutes). We are using ES 6.7 with with 11 nodes and 28 shards. We have seen multiple outages when the old-gen heap is filling quickl… --- ## [Hung tasks in ES, that cannot be cancelled using the Task API](https://discuss.elastic.co/t/hung-tasks-in-es-that-cannot-be-cancelled-using-the-task-api/215942)
**Author:** [@Lasse\_Vang\_Gravesen](https://discuss.elastic.co/u/Lasse_Vang_Gravesen)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 7:42pm UTC](https://discuss.elastic.co/t/hung-tasks-in-es-that-cannot-be-cancelled-using-the-task-api/215942 "2020-01-21T19:42:42Z")
I have an on-going problem with accumulating read/search tasks that appear to be stuck. The included picture shows the situation, where the 02 index has accumulated ~70 search tasks that never go away. The tasks are … --- ## [Serilog Elasticsearch logs not making it to the server (but buffering correctly)](https://discuss.elastic.co/t/serilog-elasticsearch-logs-not-making-it-to-the-server-but-buffering-correctly/215466)
**Author:** [@ljh33txm](https://discuss.elastic.co/u/ljh33txm)\ **Replies:** 1\ **Last updated:** [January 21, 2020, 6:53pm UTC](https://discuss.elastic.co/t/serilog-elasticsearch-logs-not-making-it-to-the-server-but-buffering-correctly/215466 "2020-01-21T18:53:07Z")
I have an ELK stack locally hosted (v7.0) on a Windows IIS web server and the logs are not making it to the server. Server is running, I can reach the reserved URL and get back the generic json package saying Elasticsear… --- ## [How to retrieve the length of an array in a nested document using painless](https://discuss.elastic.co/t/how-to-retrieve-the-length-of-an-array-in-a-nested-document-using-painless/215934)
**Author:** [@QuincyBowers](https://discuss.elastic.co/u/QuincyBowers)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 5:48pm UTC](https://discuss.elastic.co/t/how-to-retrieve-the-length-of-an-array-in-a-nested-document-using-painless/215934 "2020-01-21T17:48:25Z")
My question is, how do I get the length of an array field in a nested document using a painless script. Here is the problem I am trying to solve. We have documents which can have a set of labels assigned to them. Thes… --- ## [Dealing with highly scored sequences of words](https://discuss.elastic.co/t/dealing-with-highly-scored-sequences-of-words/215927)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 5:18pm UTC](https://discuss.elastic.co/t/dealing-with-highly-scored-sequences-of-words/215927 "2020-01-21T17:18:10Z")
I have an elastic search filter which for the sake of argument looks like this "french\_company\_synonyms": { "expand": "true", "type": "synonym\_graph", … --- ## [Max lines in a message](https://discuss.elastic.co/t/max-lines-in-a-message/215925)
**Author:** [@whoatemyjam](https://discuss.elastic.co/u/whoatemyjam)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 5:05pm UTC](https://discuss.elastic.co/t/max-lines-in-a-message/215925 "2020-01-21T17:05:42Z")
hi I was trying to parse a some logs (using filebeat and logstash to elastic)and put them as multiline which came to be around 800 lines for each message , but the message in in discover in kibana and logUI in kibana … --- ## [Compare two same filed value from two different indexes](https://discuss.elastic.co/t/compare-two-same-filed-value-from-two-different-indexes/215910)
**Author:** [@elkparser](https://discuss.elastic.co/u/elkparser)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 4:10pm UTC](https://discuss.elastic.co/t/compare-two-same-filed-value-from-two-different-indexes/215910 "2020-01-21T16:10:55Z")
Hi, I have a data like this: index1: sample\_2020\_01\_21 in this index i have data: { "jobName":"ABC" "jobduration": 20 } index1: sample\_2020\_01\_20 in this index i have data: { "jobName":"ABC" "jobduration": 40 … --- ## [Shared filesystem](https://discuss.elastic.co/t/shared-filesystem/215013)
**Author:** [@elasticus](https://discuss.elastic.co/u/elasticus)\ **Replies:** 8\ **Last updated:** [January 21, 2020, 4:01pm UTC](https://discuss.elastic.co/t/shared-filesystem/215013 "2020-01-21T16:01:20Z")
I'm looking for the Elastic best practises/supported configurations for shared filesystem with specific regard to performing snapshot backups. --- ## [High query/indexing time one node (cpu ok)](https://discuss.elastic.co/t/high-query-indexing-time-one-node-cpu-ok/215907)
**Author:** [@bruno\_z](https://discuss.elastic.co/u/bruno_z)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 3:32pm UTC](https://discuss.elastic.co/t/high-query-indexing-time-one-node-cpu-ok/215907 "2020-01-21T15:32:21Z")
I'm facing high query/indexing time for just one node. My cluster has 8 nodes My index has 5 primary shards and 3 replicas I checked the shards using the \_cat/shards api, and everything looks as expected. The cpu … --- ## [Index Sorting and terminate\_after combination](https://discuss.elastic.co/t/index-sorting-and-terminate-after-combination/198233)
**Author:** [@HenriqueLimao](https://discuss.elastic.co/u/HenriqueLimao)\ **Replies:** 2\ **Last updated:** [January 21, 2020, 3:25pm UTC](https://discuss.elastic.co/t/index-sorting-and-terminate-after-combination/198233 "2020-01-21T15:25:04Z")
I have an index in ES 6.6 used to search regular content that should be scored differently based on the user. Today we have more than 50 fields that can be used to calculate this score. In order to speed up the query, I… --- ## [Separate documents from API request](https://discuss.elastic.co/t/separate-documents-from-api-request/215902)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 3:06pm UTC](https://discuss.elastic.co/t/separate-documents-from-api-request/215902 "2020-01-21T15:06:10Z")
Hi, We're using logstash with the HTTP\_input plugin, to index events from a ReST API. The problem is that for every API request, we effectively index duplicates. If we run a GET request the output looks something like t… --- ## [ES cluster stops working when enabling too many Logstash workers to send bulk requests to it](https://discuss.elastic.co/t/es-cluster-stops-working-when-enabling-too-many-logstash-workers-to-send-bulk-requests-to-it/215898)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 2:44pm UTC](https://discuss.elastic.co/t/es-cluster-stops-working-when-enabling-too-many-logstash-workers-to-send-bulk-requests-to-it/215898 "2020-01-21T14:44:14Z")
I've noticed that when I scale-out the number of Logstash apps I have in containers writing to same ES cluster it stops all activity (index & search) But as soon as I go back to the reduced number of workers (from 20 to… --- ## [Noise Word handling on ingest](https://discuss.elastic.co/t/noise-word-handling-on-ingest/215871)
**Author:** [@TWhitehouse](https://discuss.elastic.co/u/TWhitehouse)\ **Replies:** 7\ **Last updated:** [January 21, 2020, 2:35pm UTC](https://discuss.elastic.co/t/noise-word-handling-on-ingest/215871 "2020-01-21T14:35:17Z")
Hi All One of my current use cases is to take input from a SQL DB of service desk ticket subjects and descriptions, and be able to show words that are trending (meaning we have a potential problem). So far I've importe… --- ## [Return matching analyzed field when querying](https://discuss.elastic.co/t/return-matching-analyzed-field-when-querying/215889)
**Author:** [@nogias](https://discuss.elastic.co/u/nogias)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 1:46pm UTC](https://discuss.elastic.co/t/return-matching-analyzed-field-when-querying/215889 "2020-01-21T13:46:58Z")
Hi everybody, Context: My real product is a bit complex, so I'm explaining it as blog post, then. I have blog posts which are stored in ES. I have an analyzer to analyze posts' content into tokens. The analyzer will … --- ## [Search-as-you-type datatype + text array = not working](https://discuss.elastic.co/t/search-as-you-type-datatype-text-array-not-working/215888)
**Author:** [@traed](https://discuss.elastic.co/u/traed)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 1:42pm UTC](https://discuss.elastic.co/t/search-as-you-type-datatype-text-array-not-working/215888 "2020-01-21T13:42:37Z")
I'm trying out the search\_as\_you\_type datatype instead of implementing a custom analyser for autosuggestions. My old solution worked when searching a text-field such as: 'text' =\> \[ 'type' =\> 'text', 'fields' =\> \[ '… --- ## [Which is the right tool to save and digest user search queries?](https://discuss.elastic.co/t/which-is-the-right-tool-to-save-and-digest-user-search-queries/215648)
**Author:** [@Aaron\_Pitts](https://discuss.elastic.co/u/Aaron_Pitts)\ **Replies:** 1\ **Last updated:** [January 21, 2020, 1:02pm UTC](https://discuss.elastic.co/t/which-is-the-right-tool-to-save-and-digest-user-search-queries/215648 "2020-01-21T13:02:32Z")
Hi guys, I have a wordpress site which uses Elastic search. It is a site to search many thousands of watches. The user can filter by many things such as dial/strap/case materials, sizes, colours, brand etc. What would b… --- ## [How to check if query applies to new document](https://discuss.elastic.co/t/how-to-check-if-query-applies-to-new-document/215873)
**Author:** [@Marcin\_Kukielka](https://discuss.elastic.co/u/Marcin_Kukielka)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 11:35am UTC](https://discuss.elastic.co/t/how-to-check-if-query-applies-to-new-document/215873 "2020-01-21T11:35:51Z")
Hi, Is there an efficient way to check whether document will be in result set of given query? I have a set of queries that I need to iterate and check if the new document applies to them, in terms of filtering and sear… --- ## [RestHighLevelClient elastic listener timeout after waiting for \[300000\] ms](https://discuss.elastic.co/t/resthighlevelclient-elastic-listener-timeout-after-waiting-for-300000-ms/215869)
**Author:** [@ANGI2019](https://discuss.elastic.co/u/ANGI2019)\ **Replies:** 0\ **Last updated:** [January 21, 2020, 11:16am UTC](https://discuss.elastic.co/t/resthighlevelclient-elastic-listener-timeout-after-waiting-for-300000-ms/215869 "2020-01-21T11:16:07Z")
we're running a 3 node cluster of Elasticsearch, version 6.2.4 we launch an integration of new data by batch every morning. we have listener timeout after waiting for \[300000\] ms every first request restHighLevelClien… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1038) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1040)