# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1075

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1076

---

## [Hive 3.1.1 ES-Hadoop Connector](https://discuss.elastic.co/t/hive-3-1-1-es-hadoop-connector/205992)

<div class="topic-metadata">

**Author:** [@Loo\_Ying\_Ting](https://discuss.elastic.co/u/Loo_Ying_Ting)\
**Replies:** 5\
**Last updated:** [December 5, 2019, 10:47am UTC](https://discuss.elastic.co/t/hive-3-1-1-es-hadoop-connector/205992 "2019-12-05T10:47:58Z")

</div>

Continuing the discussion from Support for HDFS 3.1.1 and Hive 3.1: My Hive version is 3.1.1 Hi I keep getting error Error: java.lang.RuntimeException: Error in configuring object at org.apache.hadoop.util.Reflection…

---

## [ILM Waiting for Allocation on Warm Node](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-node/208285)

<div class="topic-metadata">

**Author:** [@anilozyurt](https://discuss.elastic.co/u/anilozyurt)\
**Replies:** 6\
**Last updated:** [December 5, 2019, 10:13am UTC](https://discuss.elastic.co/t/ilm-waiting-for-allocation-on-warm-node/208285 "2019-12-05T10:13:16Z")

</div>

Hi, I'm using 3 nodes cluster and monthly indices with 6 primary and 1 replica shards. es-node-1 Hot node es-node-2 Warm node es-node-3 Cold node Using the ILM policy with no rollover and the monthly indices stuck a…

---

## [How to index documents which contain pascal-case strings and do some stemming associations?](https://discuss.elastic.co/t/how-to-index-documents-which-contain-pascal-case-strings-and-do-some-stemming-associations/209469)

<div class="topic-metadata">

**Author:** [@deostroll](https://discuss.elastic.co/u/deostroll)\
**Replies:** 3\
**Last updated:** [December 5, 2019, 9:53am UTC](https://discuss.elastic.co/t/how-to-index-documents-which-contain-pascal-case-strings-and-do-some-stemming-associations/209469 "2019-12-05T09:53:13Z")

</div>

For e.g. I have a document as follows: { "filename": "SRV\_MODA\_ACCT\_FSCK", "svcName": "VerifyAddOperationForUserTransactions" } If I'd provide search terms such as "srv", "moda", "acct", etc, I'd (for e.g.) want th…

---

## [Searching based on custom header field in APM index](https://discuss.elastic.co/t/searching-based-on-custom-header-field-in-apm-index/209855)

<div class="topic-metadata">

**Author:** [@anand\_gt](https://discuss.elastic.co/u/anand_gt)\
**Replies:** 1\
**Last updated:** [December 5, 2019, 9:25am UTC](https://discuss.elastic.co/t/searching-based-on-custom-header-field-in-apm-index/209855 "2019-12-05T09:25:41Z")

</div>

Hi Team, I need to search based on a custom header field, say "context.request.headers.ua-device", I followed below procedure to make that field searchable by changing the index template. But even after indexing the …

---

## [How do I switch off RBAC in Elasticsearch?](https://discuss.elastic.co/t/how-do-i-switch-off-rbac-in-elasticsearch/210530)

<div class="topic-metadata">

**Author:** [@Graham\_Leggett](https://discuss.elastic.co/u/Graham_Leggett)\
**Replies:** 5\
**Last updated:** [December 5, 2019, 8:56am UTC](https://discuss.elastic.co/t/how-do-i-switch-off-rbac-in-elasticsearch/210530 "2019-12-05T08:56:22Z")

</div>

When switching on transport TLS as below, the configuration has the side effect of switching on role based access control on the http frontend, which locks me out of my cluster with a request for a basic authentication p…

---

## [Elastic Search 6.8.5 high cpu load](https://discuss.elastic.co/t/elastic-search-6-8-5-high-cpu-load/210641)

<div class="topic-metadata">

**Author:** [@ioannigz](https://discuss.elastic.co/u/ioannigz)\
**Replies:** 0\
**Last updated:** [December 5, 2019, 8:24am UTC](https://discuss.elastic.co/t/elastic-search-6-8-5-high-cpu-load/210641 "2019-12-05T08:24:47Z")

</div>

Hello. I am new to Elasticsearch. I use one installation on my server with version 6.8.5 for a magento 2 instance I have. I am using java-8-openjdk openjdk version "1.8.0\_222". Although it not the first time I use the sa…

---

## [Can´t authenticate against Active Directory](https://discuss.elastic.co/t/can-t-authenticate-against-active-directory/210420)

<div class="topic-metadata">

**Author:** [@atarallo](https://discuss.elastic.co/u/atarallo)\
**Replies:** 3\
**Last updated:** [December 5, 2019, 8:00am UTC](https://discuss.elastic.co/t/can-t-authenticate-against-active-directory/210420 "2019-12-05T08:00:36Z")

</div>

I've installed elk stack from repo packages on Centos 7.7. I´ve successfully started collecting data with metric beat and filebeat. But I can´t authenticate against active directory I tested with openldaptools from the …

---

## [Elasicsearch cluster setup](https://discuss.elastic.co/t/elasicsearch-cluster-setup/210456)

<div class="topic-metadata">

**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\
**Replies:** 14\
**Last updated:** [December 5, 2019, 7:24am UTC](https://discuss.elastic.co/t/elasicsearch-cluster-setup/210456 "2019-12-05T07:24:06Z")

</div>

Hi I wan to setup a two node cluster in which i want only data node and master node is it possible? if it is then what will be the configuration done in both nodes

---

## [Elasticsearch master cluster problem on kubernetes (installed via helm chart stable/elastic-stack)](https://discuss.elastic.co/t/elasticsearch-master-cluster-problem-on-kubernetes-installed-via-helm-chart-stable-elastic-stack/210127)

<div class="topic-metadata">

**Author:** [@anon546463](https://discuss.elastic.co/u/anon546463)\
**Replies:** 1\
**Last updated:** [December 5, 2019, 7:15am UTC](https://discuss.elastic.co/t/elasticsearch-master-cluster-problem-on-kubernetes-installed-via-helm-chart-stable-elastic-stack/210127 "2019-12-05T07:15:51Z")

</div>

Hello, I've installed elastic-stack using command: helm upgrade --install elk-training stable/elastic-stack -f values.yaml default elasticsearch settings: values.yml: http://dpaste.com/2KM8VGR kubectl get po,svc …

---

## [Elasticsearch upgrade from 5.6 to 7.4](https://discuss.elastic.co/t/elasticsearch-upgrade-from-5-6-to-7-4/210624)

<div class="topic-metadata">

**Author:** [@nisham](https://discuss.elastic.co/u/nisham)\
**Replies:** 2\
**Last updated:** [December 5, 2019, 6:27am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-5-6-to-7-4/210624 "2019-12-05T06:27:57Z")

</div>

Hello, We have our production cluster running on 5.6 version. We would like to upgrade the Elasticsearch to 7.4 version. Is it possible to directly migrate from 5.x to 7.x ? Also we are using parent child relationship …

---

## [\[error when put index template \]Root mapping definition has unsupported parameters](https://discuss.elastic.co/t/error-when-put-index-template-root-mapping-definition-has-unsupported-parameters/210517)

<div class="topic-metadata">

**Author:** [@Frank\_Wang](https://discuss.elastic.co/u/Frank_Wang)\
**Replies:** 1\
**Last updated:** [December 5, 2019, 6:07am UTC](https://discuss.elastic.co/t/error-when-put-index-template-root-mapping-definition-has-unsupported-parameters/210517 "2019-12-05T06:07:56Z")

</div>

I send following cmd to kibana.dev tool, and get error. what I did wrong? My elasticSearch version is 6.8.0 { "error": { "root\_cause": \[ { "type": "mapper\_parsing\_exception", "reason": "Root mapping definition has unsup…

---

## [New nodes in cluster timing out](https://discuss.elastic.co/t/new-nodes-in-cluster-timing-out/210614)

<div class="topic-metadata">

**Author:** [@tskull](https://discuss.elastic.co/u/tskull)\
**Replies:** 0\
**Last updated:** [December 5, 2019, 4:20am UTC](https://discuss.elastic.co/t/new-nodes-in-cluster-timing-out/210614 "2019-12-05T04:20:07Z")

</div>

Hey there, I have a cluster self hosted on GCP. Initially I had 5 a cluster with 5 nodes, and I'm downscaling to 3 smaller nodes. I have added the extra 3 VMs and installed elastic on each. Each have been added to the …

---

## [Understanding log settings](https://discuss.elastic.co/t/understanding-log-settings/210599)

<div class="topic-metadata">

**Author:** [@estevez](https://discuss.elastic.co/u/estevez)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 10:17pm UTC](https://discuss.elastic.co/t/understanding-log-settings/210599 "2019-12-04T22:17:32Z")

</div>

Hi I have some confusion on the log settings. Specifically what this setting is doing and how it is related with the rest of the log settings: index.search.slowlog.level: info If I'm understanding the rest right, t…

---

## [Cross-Cluster Search With Hostname/Path](https://discuss.elastic.co/t/cross-cluster-search-with-hostname-path/210597)

<div class="topic-metadata">

**Author:** [@immolation](https://discuss.elastic.co/u/immolation)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 9:52pm UTC](https://discuss.elastic.co/t/cross-cluster-search-with-hostname-path/210597 "2019-12-04T21:52:11Z")

</div>

Hello! I have Elasticsearch running in Kubernetes, and there is a cluster in each AWS Availability Zone (AZ). I am working on setting up cross-cluster searching across all AZs and currently have it working, but not in a …

---

## [Data Storage Policy in Elastic Search](https://discuss.elastic.co/t/data-storage-policy-in-elastic-search/209121)

<div class="topic-metadata">

**Author:** [@kjain14](https://discuss.elastic.co/u/kjain14)\
**Replies:** 3\
**Last updated:** [December 4, 2019, 10:01pm UTC](https://discuss.elastic.co/t/data-storage-policy-in-elastic-search/209121 "2019-12-04T22:01:50Z")

</div>

Hi, The version of ES is 7.0.0. I am curious to know how index stored at ES nodes. Let me give you one scenario: In our ES cluster, there are 5 indices including .kibana. The \_cat/shards api has been showing that data …

---

## [Looking for a complete list of ansible-elasticsearch variables](https://discuss.elastic.co/t/looking-for-a-complete-list-of-ansible-elasticsearch-variables/209547)

<div class="topic-metadata">

**Author:** [@RLPowellJr](https://discuss.elastic.co/u/RLPowellJr)\
**Replies:** 2\
**Last updated:** [December 4, 2019, 9:50pm UTC](https://discuss.elastic.co/t/looking-for-a-complete-list-of-ansible-elasticsearch-variables/209547 "2019-12-04T21:50:42Z")

</div>

Greetings all! I am working with the ansible-elasticsearch Ansible playbook from https://github.com/elastic/ansible-elasticsearch. I'm relatively new to Ansible and very new to this playbook. I can get the playbook to…

---

## [Cluster\_block\_exception FORBIDDEN/8/index write (api)](https://discuss.elastic.co/t/cluster-block-exception-forbidden-8-index-write-api/210594)

<div class="topic-metadata">

**Author:** [@alatas](https://discuss.elastic.co/u/alatas)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 9:31pm UTC](https://discuss.elastic.co/t/cluster-block-exception-forbidden-8-index-write-api/210594 "2019-12-04T21:31:19Z")

</div>

Hi, we have a single node elk cluster running on ubuntu over docker. ELK version is 6.4.3. We started to get "cluster\_block\_exception with FORBIDDEN/8/index write api" error on the logstash output. I checked all the iss…

---

## [Delete index cause the Master node offline](https://discuss.elastic.co/t/delete-index-cause-the-master-node-offline/210457)

<div class="topic-metadata">

**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\
**Replies:** 5\
**Last updated:** [December 4, 2019, 7:55pm UTC](https://discuss.elastic.co/t/delete-index-cause-the-master-node-offline/210457 "2019-12-04T19:55:21Z")

</div>

When I delete a big-data index,I saw my master node offline and recovery a while later. I just feel the delete syntax is calling in the data node,have nothing to do with the master node. Somebody help me to figure it o…

---

## [Elasticsearch not restarting](https://discuss.elastic.co/t/elasticsearch-not-restarting/210583)

<div class="topic-metadata">

**Author:** [@pksinghal](https://discuss.elastic.co/u/pksinghal)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 7:10pm UTC](https://discuss.elastic.co/t/elasticsearch-not-restarting/210583 "2019-12-04T19:10:23Z")

</div>

While restarting elasticsearch, getting this error : \[2019-12-05T00:26:09,539\]\[WARN \]\[o.e.b.ElasticsearchUncaughtExceptionHandler\] uncaught exception in thread \[main\] org.elasticsearch.bootstrap.StartupException: org.…

---

## [Can we connect esrally to KAFKA](https://discuss.elastic.co/t/can-we-connect-esrally-to-kafka/210512)

<div class="topic-metadata">

**Author:** [@kumarvikash1](https://discuss.elastic.co/u/kumarvikash1)\
**Replies:** 2\
**Last updated:** [December 4, 2019, 7:06pm UTC](https://discuss.elastic.co/t/can-we-connect-esrally-to-kafka/210512 "2019-12-04T19:06:50Z")

</div>

Hi All, I am exploring a pipeline esrally-\>Kafka-\>ELK for one of the POC. i understand, esrally works fine ( and only ) with ElasticSearch. Is there any way, where i can use esrally as load generator and feed that data…

---

## [Enable compression while indexing data using Hive/Elastic connector](https://discuss.elastic.co/t/enable-compression-while-indexing-data-using-hive-elastic-connector/210265)

<div class="topic-metadata">

**Author:** [@sachinjose](https://discuss.elastic.co/u/sachinjose)\
**Replies:** 2\
**Last updated:** [December 4, 2019, 6:43pm UTC](https://discuss.elastic.co/t/enable-compression-while-indexing-data-using-hive-elastic-connector/210265 "2019-12-04T18:43:37Z")

</div>

Hi Team, We are using Hive/Elasticsearch(connector) for batch indexing data to ES, Can some one pls share the configs in the indexer side to enable compression(gzip/deflate) for the data in transit(bulk write) in order …

---

## [Elastic search automatically changing the date type field year value to 1970](https://discuss.elastic.co/t/elastic-search-automatically-changing-the-date-type-field-year-value-to-1970/209749)

<div class="topic-metadata">

**Author:** [@dhshaw](https://discuss.elastic.co/u/dhshaw)\
**Replies:** 9\
**Last updated:** [December 4, 2019, 6:32pm UTC](https://discuss.elastic.co/t/elastic-search-automatically-changing-the-date-type-field-year-value-to-1970/209749 "2019-12-04T18:32:27Z")

</div>

I am using Elastic search version 7.2 and my date field mapping is "agent\_utc\_time": { "type": "date", "format": "MM/dd/YYYY HH:mm:ss || MM/dd/YYYY || YYYY-MM-dd" }, I am inserting the date value as: "agent\_utc\_time…

---

## [Elasticsearch returning inconsistent data](https://discuss.elastic.co/t/elasticsearch-returning-inconsistent-data/210442)

<div class="topic-metadata">

**Author:** [@Veshnu\_Ramakrishnan](https://discuss.elastic.co/u/Veshnu_Ramakrishnan)\
**Replies:** 1\
**Last updated:** [December 4, 2019, 1:04pm UTC](https://discuss.elastic.co/t/elasticsearch-returning-inconsistent-data/210442 "2019-12-04T13:04:00Z")

</div>

I have an index which stores user information. On one side I am updating the index with changes. The other side I am search user with display name. I have a problem now. Say { "name": "gOz7nH2Sk3242342"}. Then i change …

---

## [Aggregation max-result-window](https://discuss.elastic.co/t/aggregation-max-result-window/210571)

<div class="topic-metadata">

**Author:** [@Nathan\_Johnson](https://discuss.elastic.co/u/Nathan_Johnson)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 4:54pm UTC](https://discuss.elastic.co/t/aggregation-max-result-window/210571 "2019-12-04T16:54:22Z")

</div>

Hi Possibly silly question, but I can't find an explicit answer for this in the aggregations docs. From the docs: The context of the execution defines what this document set is (e.g. a top-level aggregation executes …

---

## [How to make string aggregatable](https://discuss.elastic.co/t/how-to-make-string-aggregatable/210562)

<div class="topic-metadata">

**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Replies:** 4\
**Last updated:** [December 4, 2019, 4:03pm UTC](https://discuss.elastic.co/t/how-to-make-string-aggregatable/210562 "2019-12-04T16:03:08Z")

</div>

Dear all, i have some question regarding the field mapping since i need some field in my index to be able to use in visualize i need to make it aggregatable, but i still need the ability of the text type to search part…

---

## [How to import a GeoJSON to elastic.. using Logstash or any other possible way](https://discuss.elastic.co/t/how-to-import-a-geojson-to-elastic-using-logstash-or-any-other-possible-way/207001)

<div class="topic-metadata">

**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\
**Replies:** 11\
**Last updated:** [December 4, 2019, 3:40pm UTC](https://discuss.elastic.co/t/how-to-import-a-geojson-to-elastic-using-logstash-or-any-other-possible-way/207001 "2019-12-04T15:40:05Z")

</div>

My sample GeoJSON file.. "type": "FeatureCollection", "features": \[ { "type": "Feature", "properties": { "FIDindex": 6035 }, "geometry": { "type": "Polygon", "coordi…

---

## [Elasticsearch nodejs client update function](https://discuss.elastic.co/t/elasticsearch-nodejs-client-update-function/210560)

<div class="topic-metadata">

**Author:** [@Jagadeesh\_ctm](https://discuss.elastic.co/u/Jagadeesh_ctm)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 3:29pm UTC](https://discuss.elastic.co/t/elasticsearch-nodejs-client-update-function/210560 "2019-12-04T15:29:25Z")

</div>

Hi I am using elastic-search java script client while i am writing a simple update command i am getting an error const EsResponse = await esClient.update({ id: "dfsfsdfd213123XFTFG", index: "test", …

---

## [IntegTestTask failed because the task path has space](https://discuss.elastic.co/t/integtesttask-failed-because-the-task-path-has-space/210554)

<div class="topic-metadata">

**Author:** [@Ethan-Zhang](https://discuss.elastic.co/u/Ethan-Zhang)\
**Replies:** 0\
**Last updated:** [December 4, 2019, 3:04pm UTC](https://discuss.elastic.co/t/integtesttask-failed-because-the-task-path-has-space/210554 "2019-12-04T15:04:05Z")

</div>

If we run the IntegTestTask, it will create a dir as build/cluster/integTestCluster node0 And If we resolve this path in our codes, it will have escape word like build/cluster/integTestCluster%20node0. Many func will we…

---

## [Keyword field is missing](https://discuss.elastic.co/t/keyword-field-is-missing/210339)

<div class="topic-metadata">

**Author:** [@tcaminade](https://discuss.elastic.co/u/tcaminade)\
**Replies:** 2\
**Last updated:** [December 4, 2019, 2:56pm UTC](https://discuss.elastic.co/t/keyword-field-is-missing/210339 "2019-12-04T14:56:26Z")

</div>

Hi all, I am spinning an ELK stack (6.6.1). Everything worked well, when suddenly all the "keyword" fields vanished from my items (new indexes, but also older ones that for sure did get those fields in the past). I have…

---

## [Find earliest document per id](https://discuss.elastic.co/t/find-earliest-document-per-id/210546)

<div class="topic-metadata">

**Author:** [@ngruson](https://discuss.elastic.co/u/ngruson)\
**Replies:** 1\
**Last updated:** [December 4, 2019, 1:50pm UTC](https://discuss.elastic.co/t/find-earliest-document-per-id/210546 "2019-12-04T13:50:01Z")

</div>

I have an index in Elasticsearch which contains multiple documents per ID. For the 50 most recent IDs, I'd like to select the first document based on the timestamp. Is such a thing possible with Elasticsearch? For exa…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1074)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1076)
