# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1067 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1068 --- ## [Server config for cluster](https://discuss.elastic.co/t/server-config-for-cluster/211899)
**Author:** [@vonix](https://discuss.elastic.co/u/vonix)\ **Replies:** 1\ **Last updated:** [December 15, 2019, 6:53am UTC](https://discuss.elastic.co/t/server-config-for-cluster/211899 "2019-12-15T06:53:50Z")
Hi, I'm trying to figure out server config for an ES cluster design. My current config is 3 master nodes and 9 data nodes, each 2gb of ram. I want to index large amounts of data ~120gb. Currently when I do it in bulk … --- ## [Multi\_match with most\_fields option does not behave as documented](https://discuss.elastic.co/t/multi-match-with-most-fields-option-does-not-behave-as-documented/211897)
**Author:** [@Pascal\_Rapicault](https://discuss.elastic.co/u/Pascal_Rapicault)\ **Replies:** 0\ **Last updated:** [December 15, 2019, 4:33am UTC](https://discuss.elastic.co/t/multi-match-with-most-fields-option-does-not-behave-as-documented/211897 "2019-12-15T04:33:16Z")
Hello, The documentation on multi\_match query \[1\] with most\_fields specified, does not behave as documented. The documentation says "The score from each match clause is added together, then divided by the number of m… --- ## [Kibana unable to connect to elasticsearch after upgrade 6.6.8 to 7.5.0](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch-after-upgrade-6-6-8-to-7-5-0/211817)
**Author:** [@happycampo](https://discuss.elastic.co/u/happycampo)\ **Replies:** 9\ **Last updated:** [December 14, 2019, 6:49pm UTC](https://discuss.elastic.co/t/kibana-unable-to-connect-to-elasticsearch-after-upgrade-6-6-8-to-7-5-0/211817 "2019-12-14T18:49:55Z")
Using docker here. Upgraded elasticsearch and now cannot attach to it with kibana. We have a premium license and have had x-pack configured. I inherited it and honestly do not understand the configuration all that wel… --- ## [Elasticsearch: Couldn't connect to any of the configured Elasticsearch hosts - connection refused\]](https://discuss.elastic.co/t/elasticsearch-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-connection-refused/211860)
**Author:** [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Replies:** 5\ **Last updated:** [December 14, 2019, 6:33pm UTC](https://discuss.elastic.co/t/elasticsearch-couldnt-connect-to-any-of-the-configured-elasticsearch-hosts-connection-refused/211860 "2019-12-14T18:33:13Z")
Hello, I have to virtualmachine with ubunu 19.10 in my local lab. Host A: 192.168.29.90 /etc/filebeat/filebeat.yml filebeat.inputs: - type: log paths: - /opt/zeek/logs/current/\*.log filebeat.config.modules: … --- ## [Elastic search intervals query](https://discuss.elastic.co/t/elastic-search-intervals-query/211833)
**Author:** [@vamsi\_yadav](https://discuss.elastic.co/u/vamsi_yadav)\ **Replies:** 6\ **Last updated:** [December 14, 2019, 12:38pm UTC](https://discuss.elastic.co/t/elastic-search-intervals-query/211833 "2019-12-14T12:38:46Z")
TEXT : A simple sentence contains only one independent clause I want the query to return proximity search. Simple w/3 one -\> I need to return the above text documents. --- ## [Strict Dynamic Mappings With Dynamic Templates](https://discuss.elastic.co/t/strict-dynamic-mappings-with-dynamic-templates/211629)
**Author:** [@phivos](https://discuss.elastic.co/u/phivos)\ **Replies:** 1\ **Last updated:** [December 14, 2019, 12:37pm UTC](https://discuss.elastic.co/t/strict-dynamic-mappings-with-dynamic-templates/211629 "2019-12-14T12:37:15Z")
Hi Is it possible to apply strict dynamic mappings using dynamic templates with patterns? The goal is to allow structured strict dynamic mappings. Example: PUT \_template/test-template { "index\_patterns": \[ … --- ## [Count values in terms based on the starting character](https://discuss.elastic.co/t/count-values-in-terms-based-on-the-starting-character/211658)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 1\ **Last updated:** [December 14, 2019, 12:32pm UTC](https://discuss.elastic.co/t/count-values-in-terms-based-on-the-starting-character/211658 "2019-12-14T12:32:03Z")
Hello, I have an index seach-2019-08\* and it has term site. I want to count the terms based on the starting character of the site. GET search-2019-08\*/\_count { "query": { "bool": { "must": \[ { "term": { "s… --- ## [Single field with multiple date types (date and date\_nanos)](https://discuss.elastic.co/t/single-field-with-multiple-date-types-date-and-date-nanos/211726)
**Author:** [@data\_smith](https://discuss.elastic.co/u/data_smith)\ **Replies:** 1\ **Last updated:** [December 14, 2019, 12:27pm UTC](https://discuss.elastic.co/t/single-field-with-multiple-date-types-date-and-date-nanos/211726 "2019-12-14T12:27:56Z")
Is it possible to have a single field have multiple date types (date and date\_nanos)? I need date\_nanos for the precision but certain tools, such as Kibana streaming logs, only support regular date. So i'd like to inde… --- ## [Percolation exact match](https://discuss.elastic.co/t/percolation-exact-match/211759)
**Author:** [@jtryan](https://discuss.elastic.co/u/jtryan)\ **Replies:** 1\ **Last updated:** [December 14, 2019, 12:14pm UTC](https://discuss.elastic.co/t/percolation-exact-match/211759 "2019-12-14T12:14:23Z")
I've been following the guide linked below: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-percolate-query.html In these examples bonsai or tree will match any documents as illustrated in the… --- ## [Group by terms and get count of nested array property?](https://discuss.elastic.co/t/group-by-terms-and-get-count-of-nested-array-property/211823)
**Author:** [@tzn01](https://discuss.elastic.co/u/tzn01)\ **Replies:** 2\ **Last updated:** [December 14, 2019, 10:37am UTC](https://discuss.elastic.co/t/group-by-terms-and-get-count-of-nested-array-property/211823 "2019-12-14T10:37:02Z")
I would like to get the count from a document series where an array item matches some value. I have documents like these: { "Name": "jason", "Todos": \[{ "State": "COMPLETED" "Timer": 10 … --- ## [Elasticsearch not starting on boot](https://discuss.elastic.co/t/elasticsearch-not-starting-on-boot/211779)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 1\ **Last updated:** [December 14, 2019, 10:32am UTC](https://discuss.elastic.co/t/elasticsearch-not-starting-on-boot/211779 "2019-12-14T10:32:55Z")
Team, More often then not, ElasticSearch is not starting after reboot. It is added to systemd =\> at least an attempt is made. But I need to do a manual service eleasticsearch restart to get it up. When researching th… --- ## [Show time with millisecond](https://discuss.elastic.co/t/show-time-with-millisecond/211863)
**Author:** [@Yoav\_Ben\_Moha](https://discuss.elastic.co/u/Yoav_Ben_Moha)\ **Replies:** 3\ **Last updated:** [December 14, 2019, 8:36am UTC](https://discuss.elastic.co/t/show-time-with-millisecond/211863 "2019-12-14T08:36:54Z")
Hi, On Elastic search version 7.4 , I need to have a column that keep time results which include milliseconds as well. For example: Name result A 32.45 B 2.12.67 (32.45 m… --- ## [How to store a backup (snapshot) of my indexes to local storage using python in elasticsearch and then also be able to restore them?](https://discuss.elastic.co/t/how-to-store-a-backup-snapshot-of-my-indexes-to-local-storage-using-python-in-elasticsearch-and-then-also-be-able-to-restore-them/210940)
**Author:** [@hjiop\_oop](https://discuss.elastic.co/u/hjiop_oop)\ **Replies:** 5\ **Last updated:** [December 14, 2019, 7:13am UTC](https://discuss.elastic.co/t/how-to-store-a-backup-snapshot-of-my-indexes-to-local-storage-using-python-in-elasticsearch-and-then-also-be-able-to-restore-them/210940 "2019-12-14T07:13:50Z")
Hello, I know that I need to create a snapshot (?) for doing so, but can someone please tell me how? Say I have indexes: indexA and indexB How do I go about storing a snapshot (containing these indexes) to local stora… --- ## [Best practices to introduce a syslog server between log sources and elasticsearch](https://discuss.elastic.co/t/best-practices-to-introduce-a-syslog-server-between-log-sources-and-elasticsearch/211581)
**Author:** [@jawadak](https://discuss.elastic.co/u/jawadak)\ **Replies:** 4\ **Last updated:** [December 14, 2019, 5:54am UTC](https://discuss.elastic.co/t/best-practices-to-introduce-a-syslog-server-between-log-sources-and-elasticsearch/211581 "2019-12-14T05:54:03Z")
Hi, I have a requirement to store the raw logs collected from the endpoints. So I am planning to introduce a syslog server between endpoint and elasticsearch. The general deployment would be, Log sources -\> rsyslog/sysl… --- ## [Watcher - Alarm to match two field from two index](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195)
**Author:** [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Replies:** 5\ **Last updated:** [December 14, 2019, 3:06am UTC](https://discuss.elastic.co/t/watcher-alarm-to-match-two-field-from-two-index/209195 "2019-12-14T03:06:02Z")
I am trying to deploy a watcher to my lab home. I have logs from zeek (json) and logs from intelmq (Threat Intelligence Sharing). I need compare one field from zeek\_index (field: id.resp\_h) with one field from intelmq\_in… --- ## [CPU 16 cores with 32 threads will create 32 shards for an index?](https://discuss.elastic.co/t/cpu-16-cores-with-32-threads-will-create-32-shards-for-an-index/211610)
**Author:** [@vuvantuancntt](https://discuss.elastic.co/u/vuvantuancntt)\ **Replies:** 1\ **Last updated:** [December 13, 2019, 11:24pm UTC](https://discuss.elastic.co/t/cpu-16-cores-with-32-threads-will-create-32-shards-for-an-index/211610 "2019-12-13T23:24:20Z")
Hi all, I am estimating number of shard for an index. I am focus on number of shards and CPU cores, threads only. Other things I have calculated already and I aware it. My server has a 16 cores CPU, thread number is 32. … --- ## [Elasticsearch rolling restart recovery is slow](https://discuss.elastic.co/t/elasticsearch-rolling-restart-recovery-is-slow/211740)
**Author:** [@nemtso](https://discuss.elastic.co/u/nemtso)\ **Replies:** 2\ **Last updated:** [December 13, 2019, 7:56pm UTC](https://discuss.elastic.co/t/elasticsearch-rolling-restart-recovery-is-slow/211740 "2019-12-13T19:56:20Z")
Hi, I am trying to improve rolling restart process of our Elasticsearch cluster and looking for advice. We have a 8 node cluster on version 5.6.3: 5 Data nodes 3 master nodes 1 Coordinator node (with Kibana on it) Th… --- ## [Sort on scripted metric fields](https://discuss.elastic.co/t/sort-on-scripted-metric-fields/211840)
**Author:** [@Seetha93](https://discuss.elastic.co/u/Seetha93)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 7:53pm UTC](https://discuss.elastic.co/t/sort-on-scripted-metric-fields/211840 "2019-12-13T19:53:45Z")
Is there way to sort on the scripted sub aggregations? --- ## [Need help with a dynamic mapping](https://discuss.elastic.co/t/need-help-with-a-dynamic-mapping/211639)
**Author:** [@matd](https://discuss.elastic.co/u/matd)\ **Replies:** 2\ **Last updated:** [December 13, 2019, 5:56pm UTC](https://discuss.elastic.co/t/need-help-with-a-dynamic-mapping/211639 "2019-12-13T17:56:13Z")
I'm struggling with dynamic mappings. My docs (coming from logs) include a parameters object with lots of nested properties, that I want to partially index. Especially, I have some fields that I want to dynamically map… --- ## [Remove top 15% and worst 25% of document from result](https://discuss.elastic.co/t/remove-top-15-and-worst-25-of-document-from-result/211827)
**Author:** [@bebeDobreRano](https://discuss.elastic.co/u/bebeDobreRano)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 5:44pm UTC](https://discuss.elastic.co/t/remove-top-15-and-worst-25-of-document-from-result/211827 "2019-12-13T17:44:00Z")
Hello, I have a query that finds documents matching selected values in filters, then the result is ordered by my numeric integer field, DESC. The harder part starts with the fact that I need to reduce the result by rem… --- ## [Issue indexing a field on elasticsearch 6.8](https://discuss.elastic.co/t/issue-indexing-a-field-on-elasticsearch-6-8/211140)
**Author:** [@mgaspereyra](https://discuss.elastic.co/u/mgaspereyra)\ **Replies:** 5\ **Last updated:** [December 13, 2019, 4:40pm UTC](https://discuss.elastic.co/t/issue-indexing-a-field-on-elasticsearch-6-8/211140 "2019-12-13T16:40:09Z")
Hi Everybody! I Apologize to post this issue, as I think it should be easy to solve, but I am not finding the way to solve it. My situation is as follows: I have a Kong server which pushes his logs to elasticsearch, t… --- ## [Elastic Stack Windows Server hardware requirements](https://discuss.elastic.co/t/elastic-stack-windows-server-hardware-requirements/211820)
**Author:** [@Elasticuser3](https://discuss.elastic.co/u/Elasticuser3)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 4:50pm UTC](https://discuss.elastic.co/t/elastic-stack-windows-server-hardware-requirements/211820 "2019-12-13T16:50:52Z")
Hello, We currently have Windows Server 2012/R2 and trying to start building the Beats, Logstash, Elasticsearch, and Kibana into our environment. What are the recommended hardware requirements (number of cores, RAM, ha… --- ## [ILM setting are not honored](https://discuss.elastic.co/t/ilm-setting-are-not-honored/211797)
**Author:** [@Ivan.fernandez](https://discuss.elastic.co/u/Ivan.fernandez)\ **Replies:** 2\ **Last updated:** [December 13, 2019, 4:06pm UTC](https://discuss.elastic.co/t/ilm-setting-are-not-honored/211797 "2019-12-13T16:06:48Z")
Hi, We have configured our filebeat indices configure to make rollover when they reach 50G or every day. The 50G condition is never honored, the daily rollover is not done every day. There are no other changes in the de… --- ## [Gsub not replacing pattern on "url.original" field](https://discuss.elastic.co/t/gsub-not-replacing-pattern-on-url-original-field/211736)
**Author:** [@blinx](https://discuss.elastic.co/u/blinx)\ **Replies:** 2\ **Last updated:** [December 13, 2019, 3:47pm UTC](https://discuss.elastic.co/t/gsub-not-replacing-pattern-on-url-original-field/211736 "2019-12-13T15:47:30Z")
Hi, I am trying to modify the filebeat-7.5.0-apache-access-default my goal is to remove part of the url.original field using gsub but then when simulating I dont see any change. So far my procedure was Deleting the c… --- ## [Results from ES index are null without error](https://discuss.elastic.co/t/results-from-es-index-are-null-without-error/211804)
**Author:** [@mbrimmer83](https://discuss.elastic.co/u/mbrimmer83)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 2:41pm UTC](https://discuss.elastic.co/t/results-from-es-index-are-null-without-error/211804 "2019-12-13T14:41:02Z")
On ES 7.2 and using Elasticsearch Client for Node JS. After I delete a document from my ES index, I sometimes have a brief period of time where future queries will return null results so they don't have a body or hits t… --- ## [How to find the number of roles and users defined in elastic search](https://discuss.elastic.co/t/how-to-find-the-number-of-roles-and-users-defined-in-elastic-search/211812)
**Author:** [@shri\_palchuri](https://discuss.elastic.co/u/shri_palchuri)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 3:31pm UTC](https://discuss.elastic.co/t/how-to-find-the-number-of-roles-and-users-defined-in-elastic-search/211812 "2019-12-13T15:31:20Z")
I can use /\_security/role/ to get the details of a specific role, is there any syntax to get the number of roles defined? --- ## [Balancing cluster by segments memory usage](https://discuss.elastic.co/t/balancing-cluster-by-segments-memory-usage/211809)
**Author:** [@crs](https://discuss.elastic.co/u/crs)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 3:12pm UTC](https://discuss.elastic.co/t/balancing-cluster-by-segments-memory-usage/211809 "2019-12-13T15:12:51Z")
Hi, I have cluster running on 8 nodes with many indices. Each node holds 1300-1400 segments but they differ v.much in terms of segments memory usage. Minimum is 12,9GB - max 17.9GB. Average memory usage is ~15GB per nod… --- ## [Indexes with different shards, diffent responce time for same query](https://discuss.elastic.co/t/indexes-with-different-shards-diffent-responce-time-for-same-query/211798)
**Author:** [@giannisapi](https://discuss.elastic.co/u/giannisapi)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 2:00pm UTC](https://discuss.elastic.co/t/indexes-with-different-shards-diffent-responce-time-for-same-query/211798 "2019-12-13T14:00:03Z")
Hi Guys, First of all thanks for taking the time to read my topic. I have create two indexex: First one: has 7 shards and the second has 4. Basically I did a reindex from test\_2 to test\_3 so they contain the same doc… --- ## [Error during setup es cluster with docker on different vm 7.5](https://discuss.elastic.co/t/error-during-setup-es-cluster-with-docker-on-different-vm-7-5/211791)
**Author:** [@kmacew](https://discuss.elastic.co/u/kmacew)\ **Replies:** 1\ **Last updated:** [December 13, 2019, 1:10pm UTC](https://discuss.elastic.co/t/error-during-setup-es-cluster-with-docker-on-different-vm-7-5/211791 "2019-12-13T13:10:51Z")
Hi, I try to setup es cluster with two nodes on different machines. That's my master elasticsearch.yml file: cluster.name: "xyz" network.host: 0.0.0.0 discovery.seed\_hosts: \["10.8.11.86", "192.168.207.206"\] node.ma… --- ## [Custom field type?](https://discuss.elastic.co/t/custom-field-type/211751)
**Author:** [@beginner99](https://discuss.elastic.co/u/beginner99)\ **Replies:** 1\ **Last updated:** [December 13, 2019, 12:55pm UTC](https://discuss.elastic.co/t/custom-field-type/211751 "2019-12-13T12:55:55Z")
Is it possible to create a custom field type via plugin or any other means? The idea would be to make the calling applications far easier: In my use-case the passed in data would be "interpreted" by a 3rd party library … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1066) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1068)