# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1072 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1073 --- ## [Geoip property into filebeat index template - help](https://discuss.elastic.co/t/geoip-property-into-filebeat-index-template-help/211197)
**Author:** [@Cdnvballer](https://discuss.elastic.co/u/Cdnvballer)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 10:14pm UTC](https://discuss.elastic.co/t/geoip-property-into-filebeat-index-template-help/211197 "2019-12-09T22:14:06Z")
My elk setup leverages filebeats and logstash, based on this Standard visualization runs and I was able to use logstash conditions to add \[geoip\]\[location\]\[latitude\] and \[geoip\]\[location\]\[longitude\] , with help from h… --- ## [Elasticsearch CPU utilization metrics are normalized by default](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-metrics-are-normalized-by-default/210660)
**Author:** [@marko\_vranjkovic](https://discuss.elastic.co/u/marko_vranjkovic)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:21pm UTC](https://discuss.elastic.co/t/elasticsearch-cpu-utilization-metrics-are-normalized-by-default/210660 "2019-12-09T21:21:42Z")
Can someone confirm that by using all default settings Elasticsearch CPU utilization metrics in Kibana stack monitoring are normalized, e.g. for 4 CPUs the CPU utilization goes from 0% to 100%. This question is just a f… --- ## [Ingest KV processor and pattern](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 8:44pm UTC](https://discuss.elastic.co/t/ingest-kv-processor-and-pattern/211157 "2019-12-09T20:44:08Z")
Hello, I'm trying to use the kv processor with patterns. As mentioned in the documentation, the "field\_split" can use a regex pattern to use for splitting key-value pairs, but I can't find examples. I have a working PC… --- ## [Question about Digital ocean droplets and ELK](https://discuss.elastic.co/t/question-about-digital-ocean-droplets-and-elk/211177)
**Author:** [@hacbobross](https://discuss.elastic.co/u/hacbobross)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 7:08pm UTC](https://discuss.elastic.co/t/question-about-digital-ocean-droplets-and-elk/211177 "2019-12-09T19:08:56Z")
Hello everyone, I am considering getting a Digital Ocean droplet to install ELK on and practice some things. I was wondering what should the sys requirements be? This is not going to be a Prod install so nothing critica… --- ## [Access denied to certs when starting Elasticsearch](https://discuss.elastic.co/t/access-denied-to-certs-when-starting-elasticsearch/210782)
**Author:** [@NogNeetMachinaal](https://discuss.elastic.co/u/NogNeetMachinaal)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 4:42pm UTC](https://discuss.elastic.co/t/access-denied-to-certs-when-starting-elasticsearch/210782 "2019-12-09T16:42:58Z")
Hi Everybody, I'm experiencing some trouble when starting Elasticsearch: java.nio.file.AccessDeniedException: /etc/elasticsearch/certs/elastic-stack-ca.p12 The outcome of "ls -l": root@elk:/usr/share/elasticsearch# ls… --- ## [Datafeed fails if time\_field is not mapped in all indices](https://discuss.elastic.co/t/datafeed-fails-if-time-field-is-not-mapped-in-all-indices/208132)
**Author:** [@cosruss](https://discuss.elastic.co/u/cosruss)\ **Replies:** 3\ **Last updated:** [December 9, 2019, 4:42pm UTC](https://discuss.elastic.co/t/datafeed-fails-if-time-field-is-not-mapped-in-all-indices/208132 "2019-12-09T16:42:48Z")
Version 6.8 (Hoping it is fixed in later versions, but haven't found anything in the release notes) Working with a new team that has just started sending new data in, stored in daily indices. The new data includes a cus… --- ## [Queries on has\_parent / has\_child don't return any hits](https://discuss.elastic.co/t/queries-on-has-parent-has-child-dont-return-any-hits/210587)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 4:03pm UTC](https://discuss.elastic.co/t/queries-on-has-parent-has-child-dont-return-any-hits/210587 "2019-12-09T16:03:45Z")
I have a very simple join relationship that has been defined as : es.indices.create( index= "docpage", body= { "mappings": { "properties": { "my\_document": { "type… --- ## [Watcher name and description](https://discuss.elastic.co/t/watcher-name-and-description/210408)
**Author:** [@luksi1](https://discuss.elastic.co/u/luksi1)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 2:58pm UTC](https://discuss.elastic.co/t/watcher-name-and-description/210408 "2019-12-09T14:58:17Z")
Am I missing something in the Watcher API? I don't see any way to add a name with spaces or a description via the API. https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-api-put-watch.html --- ## [Is there a list of causes for cluster blocks?](https://discuss.elastic.co/t/is-there-a-list-of-causes-for-cluster-blocks/209866)
**Author:** [@aisaavedra](https://discuss.elastic.co/u/aisaavedra)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 2:45pm UTC](https://discuss.elastic.co/t/is-there-a-list-of-causes-for-cluster-blocks/209866 "2019-12-09T14:45:13Z")
Hi, Just now, our Logstash stopped receiving and emitting events, the cause was a cluster\_block\_exception on our Elasticsearch cluster {"level":"INFO","loggerName":"logstash.outputs.elasticsearch","timeMillis":15749462… --- ## [\[Painless\] Stored script - Multiline - Parsing Error](https://discuss.elastic.co/t/painless-stored-script-multiline-parsing-error/211091)
**Author:** [@Remy\_Letient](https://discuss.elastic.co/u/Remy_Letient)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 2:21pm UTC](https://discuss.elastic.co/t/painless-stored-script-multiline-parsing-error/211091 "2019-12-09T14:21:18Z")
Hello, I'm new with the usage of script. I understand they are 2 modes to write the script itseft, in a single line and in multiline with the usage of """. But I found sample on Web, but in all cases I have a parsing ex… --- ## [Can't return number from script\_fields?](https://discuss.elastic.co/t/cant-return-number-from-script-fields/211133)
**Author:** [@Wassim\_Ben\_Amor](https://discuss.elastic.co/u/Wassim_Ben_Amor)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 2:20pm UTC](https://discuss.elastic.co/t/cant-return-number-from-script-fields/211133 "2019-12-09T14:20:26Z")
Hello I am trying to use script\_fields. This is my ES request : { "query": { "match\_all": {} }, "script\_fields": { "test": { "script": { "lang": "painless", "source": "(doc\['type'\].v… --- ## [Error cannot execute binary file when trying to run elasticsearch after installation](https://discuss.elastic.co/t/error-cannot-execute-binary-file-when-trying-to-run-elasticsearch-after-installation/210934)
**Author:** [@CrisRus](https://discuss.elastic.co/u/CrisRus)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:54pm UTC](https://discuss.elastic.co/t/error-cannot-execute-binary-file-when-trying-to-run-elasticsearch-after-installation/210934 "2019-12-09T13:54:26Z")
Hello, when trying to install Elasticsearch 7.5, I get the following error mentioned in the subject I have just followed the instructions here: https://www.elastic.co/guide/en/elastic-stack-get-started/7.5/get-started… --- ## [Can Elastic store data on multiple file systems?](https://discuss.elastic.co/t/can-elastic-store-data-on-multiple-file-systems/211002)
**Author:** [@yishain11](https://discuss.elastic.co/u/yishain11)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:51pm UTC](https://discuss.elastic.co/t/can-elastic-store-data-on-multiple-file-systems/211002 "2019-12-09T13:51:04Z")
Hi everyone! I got a question from a client and I didn't found any clear answer for: Can elastic store data on multiple file systems? If I have a linux machine with multiple file systems, can I configure elastic you u… --- ## [Cluster issues](https://discuss.elastic.co/t/cluster-issues/211036)
**Author:** [@owen\_li](https://discuss.elastic.co/u/owen_li)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:49pm UTC](https://discuss.elastic.co/t/cluster-issues/211036 "2019-12-09T13:49:19Z")
"stacktrace": \["org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]; "at org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(Clus… --- ## [Default path of roles/alerting which are defined in Watcher](https://discuss.elastic.co/t/default-path-of-roles-alerting-which-are-defined-in-watcher/211083)
**Author:** [@Banshidhar\_Mishra](https://discuss.elastic.co/u/Banshidhar_Mishra)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:33pm UTC](https://discuss.elastic.co/t/default-path-of-roles-alerting-which-are-defined-in-watcher/211083 "2019-12-09T13:33:18Z")
I am using elasticsearch 7.3.0, I want to know the backend path where alerting rules are stored? --- ## [Rigth configuration to send mail (gmail)](https://discuss.elastic.co/t/rigth-configuration-to-send-mail-gmail/211031)
**Author:** [@carmezsa](https://discuss.elastic.co/u/carmezsa)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 1:32pm UTC](https://discuss.elastic.co/t/rigth-configuration-to-send-mail-gmail/211031 "2019-12-09T13:32:46Z")
Hi, I sorry but I don\`t understand where is the error to send mail with guiward watcher test. Elasticsearch version: 7.5 OS: ubuntu 19.10 My configuration. Check 1: File: /etc/elasticsearch.yml Information xpa… --- ## [CCR and deleted indices](https://discuss.elastic.co/t/ccr-and-deleted-indices/211116)
**Author:** [@matt\_db](https://discuss.elastic.co/u/matt_db)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:20pm UTC](https://discuss.elastic.co/t/ccr-and-deleted-indices/211116 "2019-12-09T13:20:56Z")
I am testing CCR and would like to know if it is possible to delete a follower index if the source index is deleted. For example we create a new index in the remote cluster and our CCR auto follow pattern replicates it.… --- ## [Elasticsearch 7.2.1 doesn't work scroll in program](https://discuss.elastic.co/t/elasticsearch-7-2-1-doesnt-work-scroll-in-program/211112)
**Author:** [@datatek](https://discuss.elastic.co/u/datatek)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-7-2-1-doesnt-work-scroll-in-program/211112 "2019-12-09T13:01:20Z")
Hello, I am using Elasticphp for elasticsearch 7.2.1. Scroll coding doesn't work at all. I need some many samples. Many thanks --- ## [Elasticsearch snapshot cannot on mounted DFS drive](https://discuss.elastic.co/t/elasticsearch-snapshot-cannot-on-mounted-dfs-drive/210715)
**Author:** [@Jiri\_Safar](https://discuss.elastic.co/u/Jiri_Safar)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-cannot-on-mounted-dfs-drive/210715 "2019-12-09T12:49:22Z")
Hi guys, I need to backup some index in my Elasticsearch and I would like to use options in Kibana to save/restore snapshots. I have already mount DFS share in to /mn/elk on all nodes (data and also masters nodes) and p… --- ## [Elasticsearch behavior when stop indexing the biggest part of your messages](https://discuss.elastic.co/t/elasticsearch-behavior-when-stop-indexing-the-biggest-part-of-your-messages/211105)
**Author:** [@tvdruenen](https://discuss.elastic.co/u/tvdruenen)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 11:56am UTC](https://discuss.elastic.co/t/elasticsearch-behavior-when-stop-indexing-the-biggest-part-of-your-messages/211105 "2019-12-09T11:56:30Z")
Hi Elastic fanatics, Last couple of years I was able to find everything I wanted to know in either the official documentation or in this forum. For the first time I stumbled upon something I'm not sure about but also ca… --- ## [Elasticsearch 7.4 snapshot retention not working](https://discuss.elastic.co/t/elasticsearch-7-4-snapshot-retention-not-working/211097)
**Author:** [@jaiganesh06](https://discuss.elastic.co/u/jaiganesh06)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 11:28am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-snapshot-retention-not-working/211097 "2019-12-09T11:28:38Z")
Hi All, I have configured daily snapshot policy without retention and it is working fine. { "daily-snapshots" : { "version" : 1, "modified\_date\_millis" : 1575888007858, "policy" : { "name" : "\"… --- ## [Fields include in watcher not working properly. (Email Alert)](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 3\ **Last updated:** [December 9, 2019, 11:19am UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841 "2019-12-09T11:19:55Z")
Hi, I have set up of ELK 7.4.2 on a linux server. There I am receiving a palto alto logs and I want to trigger alert for any drop or deny event. I am able to fire alert for this. But when I am specifying the filed name … --- ## [Create\_weight takes too long](https://discuss.elastic.co/t/create-weight-takes-too-long/211093)
**Author:** [@chenyiping111](https://discuss.elastic.co/u/chenyiping111)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 10:48am UTC](https://discuss.elastic.co/t/create-weight-takes-too-long/211093 "2019-12-09T10:48:29Z")
when i use query to search, the profile API show me the each TermQuery search time, the time of create\_weight takes 90%. I use shingle (2 words, 3 words), is that makes term dictionary too large? Any suggest can help? m… --- ## [Indexing large text fields](https://discuss.elastic.co/t/indexing-large-text-fields/210694)
**Author:** [@Maxim\_Golman](https://discuss.elastic.co/u/Maxim_Golman)\ **Replies:** 2\ **Last updated:** [December 9, 2019, 10:22am UTC](https://discuss.elastic.co/t/indexing-large-text-fields/210694 "2019-12-09T10:22:56Z")
Hello, I'm trying to index news and other articles that my clients upload and allow free text search on them. Is elasticsearch the right choice since there's a limit to text field size which get indexed. --- ## [\[HELP\] Access other value doc into aggregates scripts](https://discuss.elastic.co/t/help-access-other-value-doc-into-aggregates-scripts/211082)
**Author:** [@natinho68](https://discuss.elastic.co/u/natinho68)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 9:38am UTC](https://discuss.elastic.co/t/help-access-other-value-doc-into-aggregates-scripts/211082 "2019-12-09T09:38:49Z")
Hi ! I try to do a script into an aggregates with els 7. I have an index like this : { "doc\_address": { "aliases": {}, "mappings": { "properties": { "address": { "properties": { "checked": { "type": "boolean" … --- ## [How to aggregate when two fields equal each other](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041)
**Author:** [@Ronin](https://discuss.elastic.co/u/Ronin)\ **Replies:** 1\ **Last updated:** [December 9, 2019, 9:22am UTC](https://discuss.elastic.co/t/how-to-aggregate-when-two-fields-equal-each-other/211041 "2019-12-09T09:22:36Z")
I may be going about this all wrong, but I have the following document structure: { "@timestamp: "the time", "source.ip": "100.100.1.1", "destination.ip": "10.10.1.1", "bytes\_transferred": 5000 } And I am tryin… --- ## [\_meta for Fs-Crawler Mapping](https://discuss.elastic.co/t/meta-for-fs-crawler-mapping/210889)
**Author:** [@alipfi](https://discuss.elastic.co/u/alipfi)\ **Replies:** 6\ **Last updated:** [December 9, 2019, 9:02am UTC](https://discuss.elastic.co/t/meta-for-fs-crawler-mapping/210889 "2019-12-09T09:02:10Z")
I would like my Elasticsearch to also read custom-metadata. I read about the \_meta field and I am not sure how to implement it in my FS-Crawler Mappings. Does anyone have some experience with this field an can help? So … --- ## [Can I use elastic search freely in Azure?](https://discuss.elastic.co/t/can-i-use-elastic-search-freely-in-azure/211061)
**Author:** [@Croos](https://discuss.elastic.co/u/Croos)\ **Replies:** 3\ **Last updated:** [December 9, 2019, 8:05am UTC](https://discuss.elastic.co/t/can-i-use-elastic-search-freely-in-azure/211061 "2019-12-09T08:05:49Z")
Hi, I'm working on a E-commerce system using Microservices architecture with .NetCore and planned to host in Azure using Docker and Kubernetes. Can I use ElasticSearch without any costing for my project? --- ## [How to increase elastic search disk space](https://discuss.elastic.co/t/how-to-increase-elastic-search-disk-space/211062)
**Author:** [@arrchana](https://discuss.elastic.co/u/arrchana)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 7:29am UTC](https://discuss.elastic.co/t/how-to-increase-elastic-search-disk-space/211062 "2019-12-09T07:29:40Z")
I just executed the below command which returned the elastic search disk space GET \_cat/nodes?v&h=id,diskTotal,diskUsed,diskAvail,diskUsedPercent Output: id diskTotal diskUsed diskAvail diskUsedPercent qzxs 9.6… --- ## [Index Lifecycle Management from Kibana UI not working](https://discuss.elastic.co/t/index-lifecycle-management-from-kibana-ui-not-working/211055)
**Author:** [@sumitpramanik](https://discuss.elastic.co/u/sumitpramanik)\ **Replies:** 0\ **Last updated:** [December 9, 2019, 6:32am UTC](https://discuss.elastic.co/t/index-lifecycle-management-from-kibana-ui-not-working/211055 "2019-12-09T06:32:45Z")
Hi, I am trying to implement index lifecycle management from Kibana UI. Note that I have already implemented X-Pack Security for Elasticsearch, Logstash and Kibana, but not for beats. Now I am facing weird problem. Belo… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1071) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1073)