# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1068

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1069

---

## [\[7.5.0\] Snapshot linked to ILM](https://discuss.elastic.co/t/7-5-0-snapshot-linked-to-ilm/211773)

<div class="topic-metadata">

**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Replies:** 0\
**Last updated:** [December 13, 2019, 9:45am UTC](https://discuss.elastic.co/t/7-5-0-snapshot-linked-to-ilm/211773 "2019-12-13T09:45:02Z")

</div>

Hi there! I've already set some index lifecycle policies and they work like a charm. Now, having the possibility to handle the snapshots through the SLM, I'd like to take them one step further. Unfortunately, it appea…

---

## [Invalid NEST response built from a unsuccessful () low level call on PUT: /indexname/\_doc/888](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-put-indexname-doc-888/211282)

<div class="topic-metadata">

**Author:** [@EmpeRoar](https://discuss.elastic.co/u/EmpeRoar)\
**Replies:** 2\
**Last updated:** [December 13, 2019, 11:24am UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-low-level-call-on-put-indexname-doc-888/211282 "2019-12-13T11:24:14Z")

</div>

Invalid NEST response built from a unsuccessful () low level call on PUT: \[1\] BadRequest: Node: http://localhost:9200/ Took: 00:00:00.2651740 OriginalException: System.Net.Http.HttpRequestException: Cannot assign reque…

---

## [Exact matches have same score as fuzzy matches](https://discuss.elastic.co/t/exact-matches-have-same-score-as-fuzzy-matches/211451)

<div class="topic-metadata">

**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\
**Replies:** 3\
**Last updated:** [December 13, 2019, 9:50am UTC](https://discuss.elastic.co/t/exact-matches-have-same-score-as-fuzzy-matches/211451 "2019-12-13T09:50:16Z")

</div>

Hi When executing match queries with fuzziness applied we are seeing exact matches have the same score as fuzzy matches. I have come across suggested solutions to promote exact matches by including additional queries w…

---

## [Duplicate field 'field'\\n at \[Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@xxxxx; line: 7, column: 18](https://discuss.elastic.co/t/duplicate-field-field-n-at-source-org-elasticsearch-transport-netty4-bytebufstreaminput-xxxxx-line-7-column-18/211554)

<div class="topic-metadata">

**Author:** [@Shiv18](https://discuss.elastic.co/u/Shiv18)\
**Replies:** 9\
**Last updated:** [December 13, 2019, 9:15am UTC](https://discuss.elastic.co/t/duplicate-field-field-n-at-source-org-elasticsearch-transport-netty4-bytebufstreaminput-xxxxx-line-7-column-18/211554 "2019-12-13T09:15:27Z")

</div>

Hi Team, I'm trying to create ingest pipeline in elasticsearch for lowercase few fields. below is my api, PUT \_ingest/pipeline/lowercase\_pipeline { "description" : "lowercases the incoming field values", "processors…

---

## [ElasticSearch: strange docs.count value after reindex](https://discuss.elastic.co/t/elasticsearch-strange-docs-count-value-after-reindex/211362)

<div class="topic-metadata">

**Author:** [@maxozerov](https://discuss.elastic.co/u/maxozerov)\
**Replies:** 2\
**Last updated:** [December 13, 2019, 8:34am UTC](https://discuss.elastic.co/t/elasticsearch-strange-docs-count-value-after-reindex/211362 "2019-12-13T08:34:09Z")

</div>

Cluster Info: 3 nodes Elasticsearch:7.3.2 (two data-node; one just master) Indices Settings: pri: 2 & rep 1 Standalone: 1 node Elasticsearch:7.5.0 Indices Settings: pri: 1 & rep 0 MIgrate Cluster-Elasticsearch:7.3…

---

## [How to Enable Anomaly alerts](https://discuss.elastic.co/t/how-to-enable-anomaly-alerts/211664)

<div class="topic-metadata">

**Author:** [@sankarn](https://discuss.elastic.co/u/sankarn)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 2:16pm UTC](https://discuss.elastic.co/t/how-to-enable-anomaly-alerts/211664 "2019-12-12T14:16:53Z")

</div>

Hi Support team, Need your real support in triggering email alerts from Machine Learning Anomaly . Below are steps followed: Enabled SMTP access for my ELK Server and i am able to trigger a test mail from ELK server (…

---

## [Time is getting change in ES](https://discuss.elastic.co/t/time-is-getting-change-in-es/211747)

<div class="topic-metadata">

**Author:** [@DILIP\_SHARMA](https://discuss.elastic.co/u/DILIP_SHARMA)\
**Replies:** 0\
**Last updated:** [December 13, 2019, 5:13am UTC](https://discuss.elastic.co/t/time-is-getting-change-in-es/211747 "2019-12-13T05:13:54Z")

</div>

hi i am pumping data in to ES in local timezone in log stash i am specifying time zone date { match =\> \[ "documentdate", "ISO8601","YYYY-MM-dd HH:mm:ss:SSS", "YYYY-MM-dd HH:mm:ss","YYYY-MM-dd HH:mm" \] target =\> "…

---

## [~Enable Basic Authendication](https://discuss.elastic.co/t/enable-basic-authendication/211734)

<div class="topic-metadata">

**Author:** [@ranganathan8929](https://discuss.elastic.co/u/ranganathan8929)\
**Replies:** 1\
**Last updated:** [December 13, 2019, 12:50am UTC](https://discuss.elastic.co/t/enable-basic-authendication/211734 "2019-12-13T00:50:22Z")

</div>

Hi Team, i have installed the Elasticsearch basic subscription. Can i enable basic authentication on subscription and let help us how to enable the authentication. Regards, Ranga

---

## [Paginate by unique field count](https://discuss.elastic.co/t/paginate-by-unique-field-count/211582)

<div class="topic-metadata">

**Author:** [@EOX](https://discuss.elastic.co/u/EOX)\
**Replies:** 2\
**Last updated:** [December 13, 2019, 12:14am UTC](https://discuss.elastic.co/t/paginate-by-unique-field-count/211582 "2019-12-13T00:14:29Z")

</div>

Hi all, Say I have a Venue and Event entity. On the search page, I want to show paginated list of Venues and corresponding Events at that venue in 7 days (One to Many). One simple approach is to do a global search for…

---

## [Create advance watcher](https://discuss.elastic.co/t/create-advance-watcher/210347)

<div class="topic-metadata">

**Author:** [@shivudu](https://discuss.elastic.co/u/shivudu)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 11:47pm UTC](https://discuss.elastic.co/t/create-advance-watcher/210347 "2019-12-12T23:47:06Z")

</div>

Hi Team, I enable email alert in Elasticsearch after that it is enabled in kibana also. \[In kibana dashboard \>management\>watcher\] I created one sample watcher by clicking on "create watcher" and I executed manually , i…

---

## [APM unable to Connect to Elastic Host](https://discuss.elastic.co/t/apm-unable-to-connect-to-elastic-host/211544)

<div class="topic-metadata">

**Author:** [@kenio](https://discuss.elastic.co/u/kenio)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 11:07pm UTC](https://discuss.elastic.co/t/apm-unable-to-connect-to-elastic-host/211544 "2019-12-12T23:07:26Z")

</div>

Hello - I am working the on the completion of our elastic stack and running into issues getting the APM host communicate with the Elasticsearch host for one reason or another. Below are the two errors I see when checkin…

---

## [org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed but cluster Health is yellow](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed-but-cluster-health-is-yellow/211720)

<div class="topic-metadata">

**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 8:54pm UTC](https://discuss.elastic.co/t/org-elasticsearch-action-search-searchphaseexecutionexception-all-shards-failed-but-cluster-health-is-yellow/211720 "2019-12-12T20:54:20Z")

</div>

Hi I had my elastic instance all running fine, hosted on OpenStack, but then all of a sudden Kibana doesnt load and on checking the logs I realized there was an issue. I dont know how to fix it. This is the issue \> …

---

## [File and directory permissions for /var/log/elasticsearch that I set revert back whenever I reboot](https://discuss.elastic.co/t/file-and-directory-permissions-for-var-log-elasticsearch-that-i-set-revert-back-whenever-i-reboot/211713)

<div class="topic-metadata">

**Author:** [@theVidVid](https://discuss.elastic.co/u/theVidVid)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 7:26pm UTC](https://discuss.elastic.co/t/file-and-directory-permissions-for-var-log-elasticsearch-that-i-set-revert-back-whenever-i-reboot/211713 "2019-12-12T19:26:21Z")

</div>

Hello, I have a hobby flask web app running the Elasticsearch service. I am running Ubuntu 19.10 and followed the official installation instructions. I have had several issues where the service won't start after resta…

---

## [Field collapsing on alias fields?](https://discuss.elastic.co/t/field-collapsing-on-alias-fields/211589)

<div class="topic-metadata">

**Author:** [@val](https://discuss.elastic.co/u/val)\
**Replies:** 2\
**Last updated:** [December 12, 2019, 9:07am UTC](https://discuss.elastic.co/t/field-collapsing-on-alias-fields/211589 "2019-12-12T09:07:54Z")

</div>

I'm trying to collapse on a field name field1 across different indexes. All indexes but one have the same field name field1 and one index has a different field name field2. So, in that index, I'm defining an alias field f…

---

## [Get doc with \_id in rolling index](https://discuss.elastic.co/t/get-doc-with-id-in-rolling-index/211370)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 4\
**Last updated:** [December 12, 2019, 7:14pm UTC](https://discuss.elastic.co/t/get-doc-with-id-in-rolling-index/211370 "2019-12-12T19:14:02Z")

</div>

Does anybody know how to find a document (with \_id) within rolling index? I cannot use wildcard in indexname. Do I need to search the hard index one by one?

---

## [EC2 PublicIP:9200](https://discuss.elastic.co/t/ec2-publicip-9200/211704)

<div class="topic-metadata">

**Author:** [@chintu](https://discuss.elastic.co/u/chintu)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 5:48pm UTC](https://discuss.elastic.co/t/ec2-publicip-9200/211704 "2019-12-12T17:48:20Z")

</div>

Installed Java 1.8 and elasticsearch 7.x on linux box from EC2 instance. curl localhost:9200 - gives a response as below which means everything is good from installation point of view { "name" : "ip-172-31-46-49.eu-we…

---

## [What are the minimum privileges a user should be granted to connect to Elasticsearch via a sniffing connection pool with basic authentication?](https://discuss.elastic.co/t/what-are-the-minimum-privileges-a-user-should-be-granted-to-connect-to-elasticsearch-via-a-sniffing-connection-pool-with-basic-authentication/211705)

<div class="topic-metadata">

**Author:** [@duncRed](https://discuss.elastic.co/u/duncRed)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 5:49pm UTC](https://discuss.elastic.co/t/what-are-the-minimum-privileges-a-user-should-be-granted-to-connect-to-elasticsearch-via-a-sniffing-connection-pool-with-basic-authentication/211705 "2019-12-12T17:49:25Z")

</div>

Hi We have created a sniffing connection pool to connect to the Elasticsearch cluster. Basic authentication is enabled so Elasticsearch user account details are included in the request. To provide the user with suffic…

---

## [Elasticsearch docker image uses deprecated ConcurrentMarkSweepGC](https://discuss.elastic.co/t/elasticsearch-docker-image-uses-deprecated-concurrentmarksweepgc/211699)

<div class="topic-metadata">

**Author:** [@Prabahar](https://discuss.elastic.co/u/Prabahar)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 5:16pm UTC](https://discuss.elastic.co/t/elasticsearch-docker-image-uses-deprecated-concurrentmarksweepgc/211699 "2019-12-12T17:16:39Z")

</div>

Hello, I have two questions: Question 1: I am seeing elastic search container images "docker.elastic.co/elasticsearch/elasticsearch-oss:6.3.1" are using Option UseConcMarkSweepGC even though image uses JVM v10 Is the…

---

## [Detect invalid latitude and longitude values in an index](https://discuss.elastic.co/t/detect-invalid-latitude-and-longitude-values-in-an-index/211687)

<div class="topic-metadata">

**Author:** [@Mateo\_Loaiza\_Rios](https://discuss.elastic.co/u/Mateo_Loaiza_Rios)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 4:18pm UTC](https://discuss.elastic.co/t/detect-invalid-latitude-and-longitude-values-in-an-index/211687 "2019-12-12T16:18:00Z")

</div>

I am trying to detect by means of a regular expression if the latitude and longitude fields are not valid, but it does not work for me. At this time the values of these 2 fields are string. I was trying to merge latitude…

---

## [Migration leads to index pattern ID failure / Hardcoded ID](https://discuss.elastic.co/t/migration-leads-to-index-pattern-id-failure-hardcoded-id/211482)

<div class="topic-metadata">

**Author:** [@t3fsx](https://discuss.elastic.co/u/t3fsx)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 3:46pm UTC](https://discuss.elastic.co/t/migration-leads-to-index-pattern-id-failure-hardcoded-id/211482 "2019-12-12T15:46:17Z")

</div>

Scenario: Several filebeat agents dispatching information to Elastic Index Pattern created for filebeat-\* On a cluster migration, I just wanted to export my visualizations to the new cluster. Exported the visualizatio…

---

## [Elastic search missing aggregation](https://discuss.elastic.co/t/elastic-search-missing-aggregation/211586)

<div class="topic-metadata">

**Author:** [@Bala\_Kumar](https://discuss.elastic.co/u/Bala_Kumar)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 3:02pm UTC](https://discuss.elastic.co/t/elastic-search-missing-aggregation/211586 "2019-12-12T15:02:15Z")

</div>

I'm new to elastic search and I'm using elastic search .nest I want to do aggregation of a field..If the field is missing or null ,I want to change the field and use the value of changed field in the same aggregation.Is…

---

## [Elasticsearch 5.4.1 service failed to start](https://discuss.elastic.co/t/elasticsearch-5-4-1-service-failed-to-start/211501)

<div class="topic-metadata">

**Author:** [@fengliplatform](https://discuss.elastic.co/u/fengliplatform)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 2:40pm UTC](https://discuss.elastic.co/t/elasticsearch-5-4-1-service-failed-to-start/211501 "2019-12-12T14:40:58Z")

</div>

It seems it failed to start and status stayed to RED. Any idea? Thanks Following errors are in elasticsearch log file: \[2019-11-26T10:53:03,141\]\[WARN \]\[o.e.b.Natives \] cannot register console handler because JNA is not…

---

## [ELK Installation order matters?](https://discuss.elastic.co/t/elk-installation-order-matters/211653)

<div class="topic-metadata">

**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\
**Replies:** 1\
**Last updated:** [December 12, 2019, 2:34pm UTC](https://discuss.elastic.co/t/elk-installation-order-matters/211653 "2019-12-12T14:34:45Z")

</div>

I have read in several places that the installation of the ELK stack should follow the order ES-\>Kibana-\>Logstash, is this still relevant? I ask this because if I install ES, logstash and kibana in different machines th…

---

## [ELK Stack integration with Keycloak](https://discuss.elastic.co/t/elk-stack-integration-with-keycloak/210909)

<div class="topic-metadata">

**Author:** [@sencer](https://discuss.elastic.co/u/sencer)\
**Replies:** 14\
**Last updated:** [December 12, 2019, 2:24pm UTC](https://discuss.elastic.co/t/elk-stack-integration-with-keycloak/210909 "2019-12-12T14:24:01Z")

</div>

Hello, We are trying to add a layer of Authorization into our ELK stack with Keycloak for our commercial product, and stumbled upon a third party plugin called Search Guard. Although Search Guard works pretty well, aft…

---

## [FScrawler stuck at 2.6gb index size](https://discuss.elastic.co/t/fscrawler-stuck-at-2-6gb-index-size/211094)

<div class="topic-metadata">

**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\
**Replies:** 16\
**Last updated:** [December 12, 2019, 1:30pm UTC](https://discuss.elastic.co/t/fscrawler-stuck-at-2-6gb-index-size/211094 "2019-12-12T13:30:04Z")

</div>

I have elasticsearch that uses fscrawler to index a folder that is about 5TB. The \_settings.yml has not been modified except that it should update after every 3 hours. Everything goes well until the index grew to 2.6g…

---

## [Elastic 6.6 Elasticsearch Unrestricted Access Information Disclosure](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579)

<div class="topic-metadata">

**Author:** [@pugdummy](https://discuss.elastic.co/u/pugdummy)\
**Replies:** 8\
**Last updated:** [December 12, 2019, 2:06pm UTC](https://discuss.elastic.co/t/elastic-6-6-elasticsearch-unrestricted-access-information-disclosure/211579 "2019-12-12T14:06:22Z")

</div>

Hello, I'm new with Elastic and we are only using this on UiPath for monitoring. We recently got this vulnerability: Elasticsearch Unrestricted Access Information Disclosure Can anyone help me on what to do to fix this…

---

## [Sorting of results returned by autocomplete](https://discuss.elastic.co/t/sorting-of-results-returned-by-autocomplete/211638)

<div class="topic-metadata">

**Author:** [@Vikash\_Verma](https://discuss.elastic.co/u/Vikash_Verma)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 11:36am UTC](https://discuss.elastic.co/t/sorting-of-results-returned-by-autocomplete/211638 "2019-12-12T11:36:13Z")

</div>

Hi, I have a simple index having following mapping: { "mappings": { "\_doc": { "dynamic": "strict", "properties": { "coordinates": { "type": "geo\_point" }, "suggest"…

---

## [Cross Cluster Replication on Google Kubernetes Engine(GKE)](https://discuss.elastic.co/t/cross-cluster-replication-on-google-kubernetes-engine-gke/211654)

<div class="topic-metadata">

**Author:** [@SukeshGupta](https://discuss.elastic.co/u/SukeshGupta)\
**Replies:** 0\
**Last updated:** [December 12, 2019, 1:21pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-on-google-kubernetes-engine-gke/211654 "2019-12-12T13:21:55Z")

</div>

Hi, We have one GKE cluster in US region with 3 nodes and one more GKE cluster with 3 nodes in Asia region. How to perform cross cluster replication ? In the doc they have given like below PUT /\_cluster/settings { "…

---

## [Upgrading from 6.6.8 to 7.5.0 having all sorts of problems - Please help](https://discuss.elastic.co/t/upgrading-from-6-6-8-to-7-5-0-having-all-sorts-of-problems-please-help/211407)

<div class="topic-metadata">

**Author:** [@happycampo](https://discuss.elastic.co/u/happycampo)\
**Replies:** 14\
**Last updated:** [December 12, 2019, 12:52pm UTC](https://discuss.elastic.co/t/upgrading-from-6-6-8-to-7-5-0-having-all-sorts-of-problems-please-help/211407 "2019-12-12T12:52:08Z")

</div>

Right now my PRODUCTION instance of this is down... Any help would be greatly appreciated. I'm running with docker containers on separate vms. I inherited it and I have upgraded it in the past from 5x to 6.6.1. I just…

---

## [Deleted indices manually](https://discuss.elastic.co/t/deleted-indices-manually/211641)

<div class="topic-metadata">

**Author:** [@Nurlan199206](https://discuss.elastic.co/u/Nurlan199206)\
**Replies:** 3\
**Last updated:** [December 12, 2019, 12:49pm UTC](https://discuss.elastic.co/t/deleted-indices-manually/211641 "2019-12-12T12:49:03Z")

</div>

disk space fill up on the server. i am manually deleted folders with indices from /var/lib/elasticsearch/nodes/0/indices.. and restarted kibana and elasticsearch, after this kibana web page showing "Kibana server is no…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1067)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1069)
