# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1041 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1042 --- ## [Do sharding & flush hot threads indicate slow indexing?](https://discuss.elastic.co/t/do-sharding-flush-hot-threads-indicate-slow-indexing/214663)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 3:37pm UTC](https://discuss.elastic.co/t/do-sharding-flush-hot-threads-indicate-slow-indexing/214663 "2020-01-20T15:37:42Z")
Hello everyone, I notice in my hot threads that it's spending a lot of time in write related sections of code. Also, I'm experiencing slower indexing rate than usual (45% decrease) Here's the output: https://gist.githu… --- ## [Pagination 10000 document total limit](https://discuss.elastic.co/t/pagination-10000-document-total-limit/214897)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 4\ **Last updated:** [January 20, 2020, 3:16pm UTC](https://discuss.elastic.co/t/pagination-10000-document-total-limit/214897 "2020-01-20T15:16:20Z")
I am using pagination from my .net app with nest client to just get 50 docs on each page of the grid and that works fine but the response to the search response.HitsMetadata.Total.Value is always 10000 event there are mo… --- ## [Elastic Cloud custom domain?](https://discuss.elastic.co/t/elastic-cloud-custom-domain/214853)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 3:10pm UTC](https://discuss.elastic.co/t/elastic-cloud-custom-domain/214853 "2020-01-20T15:10:31Z")
When it is going to be possible to have a custom domain for elastic in cloud? like elastic.mydomain.com so that we can embed url in applications and doesnt change and can enable fw rules for that. --- ## [Shards based on specific nodes](https://discuss.elastic.co/t/shards-based-on-specific-nodes/215763)
**Author:** [@Shams\_ul\_Hassan](https://discuss.elastic.co/u/Shams_ul_Hassan)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 3:09pm UTC](https://discuss.elastic.co/t/shards-based-on-specific-nodes/215763 "2020-01-20T15:09:56Z")
Hi Team, We have a 3 master and 10 data nodes. This is designed to hold 1TB data of a year. Which is 3 months hot data which would be 300 GB apporx, that means 6 shards. Six months warm data which is 600 GB comes to 12… --- ## [REPLACE in scripted field](https://discuss.elastic.co/t/replace-in-scripted-field/215703)
**Author:** [@Anne\_Kim](https://discuss.elastic.co/u/Anne_Kim)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 2:36pm UTC](https://discuss.elastic.co/t/replace-in-scripted-field/215703 "2020-01-20T14:36:35Z")
Hello, I'm trying to convert a string into a number by extracting dots with the help of regexp. Here is the scripted field for this: if (doc\['build.keyword'\].size() != 0) { def m = /\[0-9\]+\\.\[0-9\]+\\.\[0-9\]+\\.\[0-9\]+/… --- ## [Brute Force Watcher and Alert](https://discuss.elastic.co/t/brute-force-watcher-and-alert/215708)
**Author:** [@mdp](https://discuss.elastic.co/u/mdp)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 2:06pm UTC](https://discuss.elastic.co/t/brute-force-watcher-and-alert/215708 "2020-01-20T14:06:06Z")
Hi, I am looking at support/advice on modifying a watcher to accomplish: A single email and alert output for each occurrence where there a user has failed logins x times in x minutes. The alert and email to contain a … --- ## [How to see how long we can retain the indexes in Curator?](https://discuss.elastic.co/t/how-to-see-how-long-we-can-retain-the-indexes-in-curator/215523)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 1:45pm UTC](https://discuss.elastic.co/t/how-to-see-how-long-we-can-retain-the-indexes-in-curator/215523 "2020-01-20T13:45:10Z")
How can we see how long indexes can be retained for? Can we make a scheduled task for it? How can we maintain an index by looking into freeing up disk space in intervals? 1: action: delete\_indices description: \>- … --- ## [Slowlog performance. could it deteriorate cluster's performance?](https://discuss.elastic.co/t/slowlog-performance-could-it-deteriorate-clusters-performance/215740)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 1:11pm UTC](https://discuss.elastic.co/t/slowlog-performance-could-it-deteriorate-clusters-performance/215740 "2020-01-20T13:11:17Z")
hi, currently I'm using the slowlog feature on cluster (3 master, 10 data, 2 coordinating only). These are my settings: "search" : { "slowlog" : { "level" : "trace", "threshold" : { "f… --- ## [The index pattern \\* does not contain any of the following compatible field types: geo\_point](https://discuss.elastic.co/t/the-index-pattern-index-name-does-not-contain-any-of-the-following-compatible-field-types-geo-point/215689)
**Author:** [@ruranga](https://discuss.elastic.co/u/ruranga)\ **Replies:** 11\ **Last updated:** [January 20, 2020, 1:08pm UTC](https://discuss.elastic.co/t/the-index-pattern-index-name-does-not-contain-any-of-the-following-compatible-field-types-geo-point/215689 "2020-01-20T13:08:36Z")
Hi, When I try to create a visualization -\> coordinated map by using geoip i'm getting below error "The index pattern \\* does not contain any of the following compatible field types: geo\_point" But I'm ge… --- ## [Is there any performance impact on Elastic searches when you have a lot of writes on index?](https://discuss.elastic.co/t/is-there-any-performance-impact-on-elastic-searches-when-you-have-a-lot-of-writes-on-index/215687)
**Author:** [@sberthez](https://discuss.elastic.co/u/sberthez)\ **Replies:** 4\ **Last updated:** [January 20, 2020, 1:06pm UTC](https://discuss.elastic.co/t/is-there-any-performance-impact-on-elastic-searches-when-you-have-a-lot-of-writes-on-index/215687 "2020-01-20T13:06:29Z")
Hi, We are currently working on an application using Elastic search and we try to evaluate benefits and constraints on each differents architecture choices related to spreading data on multiple indexes or using a single… --- ## [Enabling TTL & RBAC on an existing cluster with Indexes](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414)
**Author:** [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Replies:** 6\ **Last updated:** [January 20, 2020, 12:30pm UTC](https://discuss.elastic.co/t/enabling-ttl-rbac-on-an-existing-cluster-with-indexes/215414 "2020-01-20T12:30:10Z")
Hi, Below is the scenario. I have a multi-node Elasticsearch cluster with indices. I want to enable the TTL,RBAC security on it. If I follow the steps given in the documentation, would that work? As there are indices… --- ## [What I specify a doc with a field other than '\_id'?](https://discuss.elastic.co/t/what-i-specify-a-doc-with-a-field-other-than-id/215736)
**Author:** [@khalidnajm](https://discuss.elastic.co/u/khalidnajm)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 12:24pm UTC](https://discuss.elastic.co/t/what-i-specify-a-doc-with-a-field-other-than-id/215736 "2020-01-20T12:24:39Z")
In the MLT query, in order to search by document, rather than terms, I know I can specify a document by its \_id. I find tedious, because I have to search for the document within the index and then copy other it's \_id to … --- ## [How to write rolling upgrade IT among versions in elasticsearch project](https://discuss.elastic.co/t/how-to-write-rolling-upgrade-it-among-versions-in-elasticsearch-project/215606)
**Author:** [@kaihong](https://discuss.elastic.co/u/kaihong)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 12:08pm UTC](https://discuss.elastic.co/t/how-to-write-rolling-upgrade-it-among-versions-in-elasticsearch-project/215606 "2020-01-20T12:08:02Z")
Recently I checked out a new branch called 6.7.0\_rc1 with some minor changes in elasticsearch, and I need to write some BWC test cases (UT or IT) to ensure rolling upgrade scenario from 6.7.0 to 6.7.0-rc1. Currently I d… --- ## [Indexing eml files](https://discuss.elastic.co/t/indexing-eml-files/215557)
**Author:** [@ataoumi](https://discuss.elastic.co/u/ataoumi)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 12:03pm UTC](https://discuss.elastic.co/t/indexing-eml-files/215557 "2020-01-20T12:03:01Z")
Hi Everyone, I'm trying to index eml files and I'm not very excited by converting my files to HTML or other formats already supported. Any tips or suggestions Cheers --- ## [Working with changing sets of synonyms](https://discuss.elastic.co/t/working-with-changing-sets-of-synonyms/215334)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 9\ **Last updated:** [January 20, 2020, 11:37am UTC](https://discuss.elastic.co/t/working-with-changing-sets-of-synonyms/215334 "2020-01-20T11:37:36Z")
Hi, in our search case we have several sets of synonyms that we want to apply in different combinations dynamically (at query time). I read this article that talks about search\_analyzer, but I believe for out use case we… --- ## [Elasticsearch has stopped and no longer works](https://discuss.elastic.co/t/elasticsearch-has-stopped-and-no-longer-works/215653)
**Author:** [@4y555](https://discuss.elastic.co/u/4y555)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-has-stopped-and-no-longer-works/215653 "2020-01-20T11:10:00Z")
Hi guys I was using Elasticsearch (with the nextcloud), but the elastic just stopped after a while. Try to install other versions or reinstall the same version, but it doesn't work. Can you help me? Thank you very muc… --- ## [How to send same eventdata track 1billion json documnets to multiple ES instances](https://discuss.elastic.co/t/how-to-send-same-eventdata-track-1billion-json-documnets-to-multiple-es-instances/215667)
**Author:** [@suvarna](https://discuss.elastic.co/u/suvarna)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 11:04am UTC](https://discuss.elastic.co/t/how-to-send-same-eventdata-track-1billion-json-documnets-to-multiple-es-instances/215667 "2020-01-20T11:04:52Z")
Hi , I have configured 4 ES instances independently in single server by providing unique values (for each ES instances) for below commands in Elasticsearch.yml. http.port transport.tcp.port path\_data path\_logs path\_pi… --- ## [List indices with shards on a given node](https://discuss.elastic.co/t/list-indices-with-shards-on-a-given-node/215486)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 1\ **Last updated:** [January 20, 2020, 10:35am UTC](https://discuss.elastic.co/t/list-indices-with-shards-on-a-given-node/215486 "2020-01-20T10:35:50Z")
Elasticsearch 6. Is there a nice way to get a list of indices shards of which are on a given node? The only way I can find is to call \_cat/shards and grep the output for the node name. Node information in Kibana Monitor… --- ## [Master role does not switch automaticaly](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213)
**Author:** [@The-oo](https://discuss.elastic.co/u/The-oo)\ **Replies:** 16\ **Last updated:** [January 20, 2020, 10:09am UTC](https://discuss.elastic.co/t/master-role-does-not-switch-automaticaly/214213 "2020-01-20T10:09:32Z")
Hello everyone, I've recently having issue moving the master role from node to node. I got 3 node in my cluster and there are all 3 master-eligible nodes : I first disable shard allocation on my second node and i le… --- ## [Elasticsearch support both case sensitive & insensitive](https://discuss.elastic.co/t/elasticsearch-support-both-case-sensitive-insensitive/215686)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 10:16am UTC](https://discuss.elastic.co/t/elasticsearch-support-both-case-sensitive-insensitive/215686 "2020-01-20T10:16:17Z")
Setup: Elasticsearch 6.3 I have an index that represents the products catalog. Every document contains one product's data. One of the fields called categories which is an array of strings - List of relevant categories… --- ## [Index S3 and Git Files having metadata in to elastic](https://discuss.elastic.co/t/index-s3-and-git-files-having-metadata-in-to-elastic/215705)
**Author:** [@Aakash\_Sharma](https://discuss.elastic.co/u/Aakash_Sharma)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 9:52am UTC](https://discuss.elastic.co/t/index-s3-and-git-files-having-metadata-in-to-elastic/215705 "2020-01-20T09:52:13Z")
we are looking to index meta-info for S3 documents and Github repo files in to elastic. these files will have additional/metadata fields like howtouse, description, licensenumber etc. Ideally indexing should be event bas… --- ## [Synonym and synonym graph filters](https://discuss.elastic.co/t/synonym-and-synonym-graph-filters/215704)
**Author:** [@ivanibash](https://discuss.elastic.co/u/ivanibash)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 9:51am UTC](https://discuss.elastic.co/t/synonym-and-synonym-graph-filters/215704 "2020-01-20T09:51:41Z")
Hi, this page on synonym graphs reads: The synonym\_graph token filter allows to easily handle synonyms, including multi-word synonyms correctly during the analysis process. Does that mean that a simple "synonyms" f… --- ## [Search doesn't find the document that it should find when index is big?](https://discuss.elastic.co/t/search-doesnt-find-the-document-that-it-should-find-when-index-is-big/214386)
**Author:** [@aqiank](https://discuss.elastic.co/u/aqiank)\ **Replies:** 28\ **Last updated:** [January 20, 2020, 9:49am UTC](https://discuss.elastic.co/t/search-doesnt-find-the-document-that-it-should-find-when-index-is-big/214386 "2020-01-20T09:49:31Z")
Hi, I have a problem with Elasticsearch 6.8 (I also tried with 5.6 and 2.4 since we are upgrading) where it can't find the document that I want when the index has over 800K documents but when I create another index with … --- ## [Elasticsearch didn't create ca.key. How can i create new key/crt for new instances?](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479 "2020-01-20T09:48:03Z")
Hi guys, I've used this documentation to encrypt the communication in the ELK (7.4.0) cluster: https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash especially this… --- ## [Can ES not to store original keyword content but a mapping num value (4 save space)?](https://discuss.elastic.co/t/can-es-not-to-store-original-keyword-content-but-a-mapping-num-value-4-save-space/215664)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 9:29am UTC](https://discuss.elastic.co/t/can-es-not-to-store-original-keyword-content-but-a-mapping-num-value-4-save-space/215664 "2020-01-20T09:29:49Z")
We use es as tsdb described in my other question and data look like: { "metric": "metric\_name", "@timestamp": "2020-01-01T01:01:01", "t": { "key1": "val1", "key2": "val2" }, "f": { "name1": 1.2, "name2": … --- ## [Accessing the snapshot after deleting the repository](https://discuss.elastic.co/t/accessing-the-snapshot-after-deleting-the-repository/215682)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 3\ **Last updated:** [January 20, 2020, 9:03am UTC](https://discuss.elastic.co/t/accessing-the-snapshot-after-deleting-the-repository/215682 "2020-01-20T09:03:32Z")
Hi Team, We have accidentally deleted a repository that was having a valid snapshot. We understand from the snapshot documentation that, deleting a repository only unregister, that means only removes the reference to th… --- ## [How to do multiplication on a field like sum function do?](https://discuss.elastic.co/t/how-to-do-multiplication-on-a-field-like-sum-function-do/215690)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 0\ **Last updated:** [January 20, 2020, 8:56am UTC](https://discuss.elastic.co/t/how-to-do-multiplication-on-a-field-like-sum-function-do/215690 "2020-01-20T08:56:09Z")
As title said, how to do multiplication on a field like sum function do like: POST tsdb\_alias/\_search?routing=metric\_name1 { "query": { "bool": { "filter": \[ { "term": { "metric… --- ## [Xpack RBAC vs Kibana Instances/Spaces vs SIEM](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [January 20, 2020, 8:38am UTC](https://discuss.elastic.co/t/xpack-rbac-vs-kibana-instances-spaces-vs-siem/215439 "2020-01-20T08:38:28Z")
Got some architectural questions concerning security. Currently ingesting documents tagged with tenant ID fields into shared indices (winlogbeat-, auditbeat- etc.) for SIEM purposes for our SOC. Would like to grant acc… --- ## [Elasticsearch Influx db connection](https://discuss.elastic.co/t/elasticsearch-influx-db-connection/215289)
**Author:** [@Syed.Ubaid](https://discuss.elastic.co/u/Syed.Ubaid)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 6:25am UTC](https://discuss.elastic.co/t/elasticsearch-influx-db-connection/215289 "2020-01-20T06:25:58Z")
How to connect elasticsearch with influx db? --- ## [How to write a efficient ES query for the below SQL query?](https://discuss.elastic.co/t/how-to-write-a-efficient-es-query-for-the-below-sql-query/215599)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 5\ **Last updated:** [January 20, 2020, 4:53am UTC](https://discuss.elastic.co/t/how-to-write-a-efficient-es-query-for-the-below-sql-query/215599 "2020-01-20T04:53:09Z")
select tag1, tag2, sum(sum\_val) select tag-uid, sum(value) as sum\_val from data\_table group by tag-uid join tag\_table using(tag-uid) group by tag1, tag2 [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1040) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1042)