# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1050 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1051 --- ## [Elasticsearch Bool Query Issue](https://discuss.elastic.co/t/elasticsearch-bool-query-issue/214384)
**Author:** [@Venkata\_Naresh](https://discuss.elastic.co/u/Venkata_Naresh)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 12:45pm UTC](https://discuss.elastic.co/t/elasticsearch-bool-query-issue/214384 "2020-01-09T12:45:01Z")
Im unable to query elasticsearch documents for the below scenario. For Ex: ID:1 Val:2,3 I will query ES with combination of ID and Val. So if both matches it should return the matched documents, if not it should retu… --- ## [Can't delete all files elasticsearch](https://discuss.elastic.co/t/cant-delete-all-files-elasticsearch/214413)
**Author:** [@Ramon\_Mateo](https://discuss.elastic.co/u/Ramon_Mateo)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/cant-delete-all-files-elasticsearch/214413 "2020-01-09T12:42:06Z")
Hi I keep trying to delete specific data in an index. My problem is that I have many files in the same index. When I try to delete by query the answer of the query is that it can delete some files but it cannot delete e… --- ## [Performance degradation after upgrading from v6.3.2 to v7.4.2](https://discuss.elastic.co/t/performance-degradation-after-upgrading-from-v6-3-2-to-v7-4-2/213466)
**Author:** [@farin99](https://discuss.elastic.co/u/farin99)\ **Replies:** 9\ **Last updated:** [January 9, 2020, 12:40pm UTC](https://discuss.elastic.co/t/performance-degradation-after-upgrading-from-v6-3-2-to-v7-4-2/213466 "2020-01-09T12:40:22Z")
Hi, we have a cluster with hot and warm nodes. Our warm nodes have around 400 shards. In 7.4.2, we see an increase of 10% in CPU usage in comparison to 6.3.2. According to the hot threads call stacks, it is related to … --- ## [Transport publishing names vs new +7.0 format and es.transport.cname\_in\_publish\_address](https://discuss.elastic.co/t/transport-publishing-names-vs-new-7-0-format-and-es-transport-cname-in-publish-address/214362)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 10\ **Last updated:** [January 9, 2020, 12:27pm UTC](https://discuss.elastic.co/t/transport-publishing-names-vs-new-7-0-format-and-es-transport-cname-in-publish-address/214362 "2020-01-09T12:27:33Z")
Got a 7.5.1 cluster of 12 nodes where the elected master node logs deprecation warnings like these per cluster node very frequently: \[2020-01-09T08:52:41,809\]\[WARN \]\[o.e.d.t.TransportInfo \] \[es-mst2\] transport.publi… --- ## [Failed to load plugin class\[elasticsearch.authenticate.AuthenticatePlugin\]](https://discuss.elastic.co/t/failed-to-load-plugin-class-elasticsearch-authenticate-authenticateplugin/214422)
**Author:** [@kumar\_prasad](https://discuss.elastic.co/u/kumar_prasad)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 12:06pm UTC](https://discuss.elastic.co/t/failed-to-load-plugin-class-elasticsearch-authenticate-authenticateplugin/214422 "2020-01-09T12:06:06Z")
elasticsearch fails to start, i see the below error Caused by: java.lang.ClassCastException: java.util.LinkedHashMap cannot be cast to java.util.ArrayList at com..elasticsearch.authenticate.accesscontrol.utils.ConfigRe… --- ## [Unable to configure SMTP on elasticsearch(7.5)](https://discuss.elastic.co/t/unable-to-configure-smtp-on-elasticsearch-7-5/214389)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 11:41am UTC](https://discuss.elastic.co/t/unable-to-configure-smtp-on-elasticsearch-7-5/214389 "2020-01-09T11:41:16Z")
Hi, I have a setup of elk on centos with a version of 7.5, and I am trying to configure SMTP but I am unable to do it. I have my 1 year license enabled. Due to the following error: \[2020-01-09T20:21:13,278\]\[WARN \]… --- ## [Elasticsearching \*Highlighting\* feature breaks highlights by words, not phrases](https://discuss.elastic.co/t/elasticsearching-highlighting-feature-breaks-highlights-by-words-not-phrases/214337)
**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 11:08am UTC](https://discuss.elastic.co/t/elasticsearching-highlighting-feature-breaks-highlights-by-words-not-phrases/214337 "2020-01-09T11:08:00Z")
ElasticSearch v7.5 Hello and good day! I'm using ElasticSearch's feature called Highlighting . ES is able to emphasize the keywords I'm using in my query\_string query, sample query: GET socialmedia/\_search { "s… --- ## [Aggregate doc\_count per document and not per nested item?](https://discuss.elastic.co/t/aggregate-doc-count-per-document-and-not-per-nested-item/214416)
**Author:** [@Laurens\_Mertens](https://discuss.elastic.co/u/Laurens_Mertens)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 10:56am UTC](https://discuss.elastic.co/t/aggregate-doc-count-per-document-and-not-per-nested-item/214416 "2020-01-09T10:56:37Z")
Hi, my documents have the following document structure (I changed the document type to frog and colors per year here to make it more clear): { "id": "489191", "type": "frog", "color\_types": \[ { … --- ## [Data frame vs datafeed vs rollup](https://discuss.elastic.co/t/data-frame-vs-datafeed-vs-rollup/213811)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 6\ **Last updated:** [January 9, 2020, 9:43am UTC](https://discuss.elastic.co/t/data-frame-vs-datafeed-vs-rollup/213811 "2020-01-09T09:43:56Z")
Hello There are few components in the Elastic stack, which I'm not sure I understand the difference and when to use which. for ML I use (currently) datafeed with pre-defined query (in practice it seems to aggregate met… --- ## [Received response for a request that has timed out](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out/214377)
**Author:** [@Lawrence](https://discuss.elastic.co/u/Lawrence)\ **Replies:** 0\ **Last updated:** [January 9, 2020, 9:09am UTC](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out/214377 "2020-01-09T09:09:42Z")
Hello, In recent weeks, the cluster goes back many errors of "Timeout" while there was no change over. The cluster is currently composed of 7 nodes (3 master / data / ingest and 4 datas) and is running on version 5.6.7… --- ## [Should elasticsearch data restore work when the cluster is red?](https://discuss.elastic.co/t/should-elasticsearch-data-restore-work-when-the-cluster-is-red/214357)
**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\ **Replies:** 2\ **Last updated:** [January 9, 2020, 8:52am UTC](https://discuss.elastic.co/t/should-elasticsearch-data-restore-work-when-the-cluster-is-red/214357 "2020-01-09T08:52:08Z")
Hi, I have taken a backup on my data on a healthy cluster. Now, due to index curruption or some other reason my cluster went into red state and I tried to restore my data. All the restore curl commands was running fine… --- ## ["xpack.security.transport.ssl.truststore.path" "SSL resources should be placed in"](https://discuss.elastic.co/t/xpack-security-transport-ssl-truststore-path-ssl-resources-should-be-placed-in/214324)
**Author:** [@johndpalm](https://discuss.elastic.co/u/johndpalm)\ **Replies:** 1\ **Last updated:** [January 9, 2020, 7:57am UTC](https://discuss.elastic.co/t/xpack-security-transport-ssl-truststore-path-ssl-resources-should-be-placed-in/214324 "2020-01-09T07:57:00Z")
I'm storing my elasticsearch.yml config file and the PKCS#12 certificates in different paths. ES\_PATH\_CONF=C:\\Repos\\DevOps\\Elastic\\config\\elasticsearch\\elasticsearch-config elasticsearch.yml xpack.security.enabled: tr… --- ## [Index full document or subset?](https://discuss.elastic.co/t/index-full-document-or-subset/214144)
**Author:** [@Rvs](https://discuss.elastic.co/u/Rvs)\ **Replies:** 7\ **Last updated:** [January 9, 2020, 2:53am UTC](https://discuss.elastic.co/t/index-full-document-or-subset/214144 "2020-01-09T02:53:44Z")
I Had a newbie question. Would appreciate some advice here. Should i index my entire document or only the data (subset)within my document that i know will be searched on. What is the philosophy of elasticsearch. Should… --- ## [Xpack.security.audit.outputs: \[ index, logfile \] in 7.x?](https://discuss.elastic.co/t/xpack-security-audit-outputs-index-logfile-in-7-x/214336)
**Author:** [@retr0s](https://discuss.elastic.co/u/retr0s)\ **Replies:** 0\ **Last updated:** [January 9, 2020, 2:39am UTC](https://discuss.elastic.co/t/xpack-security-audit-outputs-index-logfile-in-7-x/214336 "2020-01-09T02:39:44Z")
Hello, Uptil 6.2 the security audits could be sent to an ES index by setting this line elasticsearch.yml file xpack.security.audit.outputs: \[ index, logfile \] https://www.elastic.co/guide/en/x-pack/current/auditing.ht… --- ## [Pyspark write to elasticsearch with empty fields](https://discuss.elastic.co/t/pyspark-write-to-elasticsearch-with-empty-fields/214328)
**Author:** [@xiaochong2dai](https://discuss.elastic.co/u/xiaochong2dai)\ **Replies:** 0\ **Last updated:** [January 9, 2020, 1:42am UTC](https://discuss.elastic.co/t/pyspark-write-to-elasticsearch-with-empty-fields/214328 "2020-01-09T01:42:36Z")
Hi I'm new to elasticsearch and right now writing a spark dataframe to elasticsearch. The dataframe has below schema: df.printSchema() root |-- col1: array (nullable = true) | |-- element: struct (containsNull … --- ## [How to connect elasticsearch with kibana without using the username and password](https://discuss.elastic.co/t/how-to-connect-elasticsearch-with-kibana-without-using-the-username-and-password/214315)
**Author:** [@Deepthi\_Tummala](https://discuss.elastic.co/u/Deepthi_Tummala)\ **Replies:** 0\ **Last updated:** [January 8, 2020, 10:32pm UTC](https://discuss.elastic.co/t/how-to-connect-elasticsearch-with-kibana-without-using-the-username-and-password/214315 "2020-01-08T22:32:58Z")
Hi, I want to connect kibana to elasticsearch without entering the username and password in kibana.yml file. I am using Basic version of the elasticsearch. So I am unable to use PKI realm. Is there anyother way to conne… --- ## ["missing" agg weird results](https://discuss.elastic.co/t/missing-agg-weird-results/212430)
**Author:** [@dvisz-inf](https://discuss.elastic.co/u/dvisz-inf)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 9:46pm UTC](https://discuss.elastic.co/t/missing-agg-weird-results/212430 "2020-01-08T21:46:47Z")
I get some odd looking results from this query: POST my-index/\_search?pretty { "size": 0, "aggs": { "a": { "terms": { "field": "foo.a" }, "aggs": { "missing\_b": { "mis… --- ## [Is there a way to batch your query when facing with too\_many\_buckets\_exception](https://discuss.elastic.co/t/is-there-a-way-to-batch-your-query-when-facing-with-too-many-buckets-exception/214293)
**Author:** [@Tomaz\_Bratanic1](https://discuss.elastic.co/u/Tomaz_Bratanic1)\ **Replies:** 4\ **Last updated:** [January 8, 2020, 7:43pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-batch-your-query-when-facing-with-too-many-buckets-exception/214293 "2020-01-08T19:43:12Z")
I use the following query: { "aggs": { "2": { "terms": { "field": "deviceID.keyword", "order": { "\_key": "desc" }, "size": 500000 }, "aggs": { "1… --- ## [Send Cisco ASA Logs to ElasticSearch](https://discuss.elastic.co/t/send-cisco-asa-logs-to-elasticsearch/213749)
**Author:** [@YogeshAggarwal](https://discuss.elastic.co/u/YogeshAggarwal)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 7:06pm UTC](https://discuss.elastic.co/t/send-cisco-asa-logs-to-elasticsearch/213749 "2020-01-08T19:06:20Z")
Hi, I am new to Elastic and need some help as i could not find an answer even after extensive googling. I have installed Elasticsearch 7.5, kibana 7.5, Filebeat and Logstash. All of these things works fine when i forwa… --- ## [New on-prem installation](https://discuss.elastic.co/t/new-on-prem-installation/214135)
**Author:** [@mike.wright88](https://discuss.elastic.co/u/mike.wright88)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 6:27pm UTC](https://discuss.elastic.co/t/new-on-prem-installation/214135 "2020-01-08T18:27:53Z")
Hello, new to this forum, and I am working on getting a 5-node installation setup. i setup two data nodes and they work enough to tell me that they can't find the master ... but I noticed that the data nodes installed to… --- ## [Download Index ElasticCloud to Elasticsearch onPremise](https://discuss.elastic.co/t/download-index-elasticcloud-to-elasticsearch-onpremise/214104)
**Author:** [@rguerrero](https://discuss.elastic.co/u/rguerrero)\ **Replies:** 6\ **Last updated:** [January 8, 2020, 5:33pm UTC](https://discuss.elastic.co/t/download-index-elasticcloud-to-elasticsearch-onpremise/214104 "2020-01-08T17:33:08Z")
I want to download all the data that is in my index that is in ElasticCloud and put in an elasticsearch onpremise instance since I have to close the ElasticCloud instance. I'm thinking of pulling the information with Lo… --- ## [Watcher condition: when node is down](https://discuss.elastic.co/t/watcher-condition-when-node-is-down/214275)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 5:23pm UTC](https://discuss.elastic.co/t/watcher-condition-when-node-is-down/214275 "2020-01-08T17:23:09Z")
I would like to set up a watcher that triggers an action (email for example) when one of the cluster nodes is down. From the documentation I know, that it's possible to monitor cluster status from /\_cluster/health. But … --- ## [Is curator delete log files or only delete indices?](https://discuss.elastic.co/t/is-curator-delete-log-files-or-only-delete-indices/213969)
**Author:** [@PiCarODD](https://discuss.elastic.co/u/PiCarODD)\ **Replies:** 3\ **Last updated:** [January 8, 2020, 4:12pm UTC](https://discuss.elastic.co/t/is-curator-delete-log-files-or-only-delete-indices/213969 "2020-01-08T16:12:58Z")
Hi, I need some help with curator. Curator delete indices well but my storage increase and increase. Thanks --- ## [On premise pricing requirement for ELK](https://discuss.elastic.co/t/on-premise-pricing-requirement-for-elk/214267)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 1\ **Last updated:** [January 8, 2020, 3:53pm UTC](https://discuss.elastic.co/t/on-premise-pricing-requirement-for-elk/214267 "2020-01-08T15:53:40Z")
Hi All, i tried to use the https://www.elastic.co/subscriptions#contact-us link to contact the team and used the form , so far there is no response. i want to understand what is the price of the Gold subsription , and … --- ## [Elastic master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes](https://discuss.elastic.co/t/elastic-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/214118)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 10\ **Last updated:** [January 8, 2020, 3:52pm UTC](https://discuss.elastic.co/t/elastic-master-not-discovered-yet-this-node-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/214118 "2020-01-08T15:52:49Z")
Hi , I have upgraded my elasticsearch cluster of 3 nodes from 7.4.0 to 7.5.1 and after completing the upgradation of the ES . I'm getting this error master not discovered yet, this node has not previously joined a boot… --- ## [Regex pattern\_replace](https://discuss.elastic.co/t/regex-pattern-replace/214047)
**Author:** [@elink12](https://discuss.elastic.co/u/elink12)\ **Replies:** 4\ **Last updated:** [January 8, 2020, 3:18pm UTC](https://discuss.elastic.co/t/regex-pattern-replace/214047 "2020-01-08T15:18:56Z")
Hi friend, I have a problem. I don’t understand why it works like this? #My filter pattern 'my\_pattern\_replace' =\> \[ "type" =\> "pattern\_replace", "pattern" =\> "(\[0-9.,-\]+)\\s?(car\\b|cars\\b|cars\\w+)", "replacement" =\> … --- ## [Elasticsearch github](https://discuss.elastic.co/t/elasticsearch-github/214256)
**Author:** [@aioanei\_adrian](https://discuss.elastic.co/u/aioanei_adrian)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 3:06pm UTC](https://discuss.elastic.co/t/elasticsearch-github/214256 "2020-01-08T15:06:56Z")
Hello, I want to start helping elasticsearch development but I can't find anywhere the way you are working. I have forked your repo but I cloud not be able to found your coding rules or any other details that a beginner… --- ## [How much index size is allowed in free subscription?](https://discuss.elastic.co/t/how-much-index-size-is-allowed-in-free-subscription/214055)
**Author:** [@Rachit\_Gargava](https://discuss.elastic.co/u/Rachit_Gargava)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 12:57pm UTC](https://discuss.elastic.co/t/how-much-index-size-is-allowed-in-free-subscription/214055 "2020-01-08T12:57:03Z")
Hi, I am new to ELK; I am using the free subscription to store, index and Visualize my data using Elastic Search, Logstash and Kibana. What is the maximum limit till that I can store the data in index for free tier sub… --- ## [Test the fault tolerant mechanism for ES cluster nodes](https://discuss.elastic.co/t/test-the-fault-tolerant-mechanism-for-es-cluster-nodes/214160)
**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\ **Replies:** 15\ **Last updated:** [January 8, 2020, 11:51am UTC](https://discuss.elastic.co/t/test-the-fault-tolerant-mechanism-for-es-cluster-nodes/214160 "2020-01-08T11:51:14Z")
Hello, I have configured 3 node ES cluster. All 3 nodes are master eligible. So if one goes down other should be eligible to elect itself as a master node and will form a 2 node cluster. How i can check this with my c… --- ## [Ingest attachment search with multi match query](https://discuss.elastic.co/t/ingest-attachment-search-with-multi-match-query/214208)
**Author:** [@ib3](https://discuss.elastic.co/u/ib3)\ **Replies:** 2\ **Last updated:** [January 8, 2020, 11:49am UTC](https://discuss.elastic.co/t/ingest-attachment-search-with-multi-match-query/214208 "2020-01-08T11:49:11Z")
Does it possible to use multi match query with attachment content? Content store as base64\_encode. When i use http://search-elastic.test:9200/elasticsearch\_attachments\_index/\_search?q=calford&pretty=true its working fin… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1049) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1051)