# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1081 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1082 --- ## [ELK on Windows Server 2016 with Filebeat on Windows 10 client - not working](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659)
**Author:** [@JY\_DT](https://discuss.elastic.co/u/JY_DT)\ **Replies:** 9\ **Last updated:** [November 28, 2019, 10:29am UTC](https://discuss.elastic.co/t/elk-on-windows-server-2016-with-filebeat-on-windows-10-client-not-working/209659 "2019-11-28T10:29:14Z")
Hello, I've setup ELK 7.4.2 on Windows Server 2016, with some of these references: http://robwillis.info/2019/05/installing-elk-7-elasticsearch-logstash-and-kibana-windows-server-2016/ and I've setup Filebeat on… --- ## [Is is possible to partially update a dest doc with transforms?](https://discuss.elastic.co/t/is-is-possible-to-partially-update-a-dest-doc-with-transforms/209808)
**Author:** [@kostistsaprailis](https://discuss.elastic.co/u/kostistsaprailis)\ **Replies:** 4\ **Last updated:** [November 28, 2019, 10:26am UTC](https://discuss.elastic.co/t/is-is-possible-to-partially-update-a-dest-doc-with-transforms/209808 "2019-11-28T10:26:01Z")
Hello all, I'm trying to figure out if it's possible to update only some fields of a document with dataframe transforms similar to the way the index document update API works (https://www.elastic.co/guide/en/elasticsear… --- ## [JVM heap usage is high](https://discuss.elastic.co/t/jvm-heap-usage-is-high/209784)
**Author:** [@chanakagl](https://discuss.elastic.co/u/chanakagl)\ **Replies:** 6\ **Last updated:** [November 28, 2019, 10:20am UTC](https://discuss.elastic.co/t/jvm-heap-usage-is-high/209784 "2019-11-28T10:20:55Z")
Hi, We have 7 nodes cluster with 3 masters and 4 data nodes. We have one index with, 4 shards, 1 replica size - 3.5GB 12894 documents which is getting 100/s search requests normally and indexing rate is very low. B… --- ## [Pipeline Aggregation for Date histrogram with terms in Java, elastic 6.6](https://discuss.elastic.co/t/pipeline-aggregation-for-date-histrogram-with-terms-in-java-elastic-6-6/209828)
**Author:** [@SRI\_SUSHMA\_Karra](https://discuss.elastic.co/u/SRI_SUSHMA_Karra)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 10:20am UTC](https://discuss.elastic.co/t/pipeline-aggregation-for-date-histrogram-with-terms-in-java-elastic-6-6/209828 "2019-11-28T10:20:37Z")
Hi, I am kind of struugling with coming up with a Java equivalent to the solution posted here. AggregationBuilders.global("global\_aggregation") .subAggregation(AggregationBuilders.dateHistogram("dateAggr") … --- ## [Splita data to several docs](https://discuss.elastic.co/t/splita-data-to-several-docs/209823)
**Author:** [@Alon\_Goldenberg](https://discuss.elastic.co/u/Alon_Goldenberg)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 10:05am UTC](https://discuss.elastic.co/t/splita-data-to-several-docs/209823 "2019-11-28T10:05:28Z")
Hello, We have data that partially comes as a list of dicts, and we want to split the data to several docs, so that each dict in the list will be a different doc in Elastic. Any idea how to do it? we tried with Amazon … --- ## [Not able to create multiple nested type mapping for hierarchical json data](https://discuss.elastic.co/t/not-able-to-create-multiple-nested-type-mapping-for-hierarchical-json-data/209803)
**Author:** [@abhi\_jeet](https://discuss.elastic.co/u/abhi_jeet)\ **Replies:** 3\ **Last updated:** [November 28, 2019, 10:00am UTC](https://discuss.elastic.co/t/not-able-to-create-multiple-nested-type-mapping-for-hierarchical-json-data/209803 "2019-11-28T10:00:19Z")
I have a json file which contains hierarchical structure. I want to create multiple nested type mapping for this data. When i do it and try to search a field it gives exception in search query. Below is the example of j… --- ## [Elasticsearch from single node to cluster](https://discuss.elastic.co/t/elasticsearch-from-single-node-to-cluster/209821)
**Author:** [@mycloudcms](https://discuss.elastic.co/u/mycloudcms)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 9:51am UTC](https://discuss.elastic.co/t/elasticsearch-from-single-node-to-cluster/209821 "2019-11-28T09:51:30Z")
Hi, I plan to upgrade our ELK setup, where from single server will migrate to new cluster. I plan a 3 server setup for Elastic and have some questions if you could help. As data will be shared across 3 servers, will be… --- ## [Elastic Cloud as Code](https://discuss.elastic.co/t/elastic-cloud-as-code/209819)
**Author:** [@alastairs](https://discuss.elastic.co/u/alastairs)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 9:47am UTC](https://discuss.elastic.co/t/elastic-cloud-as-code/209819 "2019-11-28T09:47:31Z")
Hi there What options are available for automating deployment and configuration of a cluster on Elastic Cloud? I’m thinking of things like deploying appropriate ILM policies, creating users and roles, etc., as well as t… --- ## [Having count?1](https://discuss.elastic.co/t/having-count-1/209246)
**Author:** [@shaharzi](https://discuss.elastic.co/u/shaharzi)\ **Replies:** 1\ **Last updated:** [November 28, 2019, 9:23am UTC](https://discuss.elastic.co/t/having-count-1/209246 "2019-11-28T09:23:31Z")
hello, how i can imitate the posibility to do having count \> x? i want to find more then one docs that has the save value in specific fields. thanks. --- ## [Multiple aggregates in Watcher configuration logging output](https://discuss.elastic.co/t/multiple-aggregates-in-watcher-configuration-logging-output/209455)
**Author:** [@elastic\_user.pk](https://discuss.elastic.co/u/elastic_user.pk)\ **Replies:** 1\ **Last updated:** [November 28, 2019, 9:19am UTC](https://discuss.elastic.co/t/multiple-aggregates-in-watcher-configuration-logging-output/209455 "2019-11-28T09:19:55Z")
Hello, I need help regarding logging text of the Watcher alert. I've created a Watcher in elastic-search with the following configuration: { "trigger": { "schedule": { "interval": "30m" } }, "input… --- ## [Failed to execute bulk item (index)](https://discuss.elastic.co/t/failed-to-execute-bulk-item-index/209700)
**Author:** [@mital\_sm](https://discuss.elastic.co/u/mital_sm)\ **Replies:** 3\ **Last updated:** [November 28, 2019, 9:12am UTC](https://discuss.elastic.co/t/failed-to-execute-bulk-item-index/209700 "2019-11-28T09:12:13Z")
I am trying to import a excel file into elasticSearch and have done that fine. But there are some documents (rows in excel) which are not included in the data injest. I digged into the issue with this and found that ther… --- ## [Send Email from watcher when the system get specify log](https://discuss.elastic.co/t/send-email-from-watcher-when-the-system-get-specify-log/209566)
**Author:** [@mord](https://discuss.elastic.co/u/mord)\ **Replies:** 1\ **Last updated:** [November 28, 2019, 9:13am UTC](https://discuss.elastic.co/t/send-email-from-watcher-when-the-system-get-specify-log/209566 "2019-11-28T09:13:19Z")
Hello Everyone. My Elasticsearch getting logs of "Security risk found" in Event Name(field). I want to get details of this log to my email. In my watcher I create a new alert with this text: { "trigger": { "sc… --- ## [How to map already fields in a index to ECS fields in elasticsearch](https://discuss.elastic.co/t/how-to-map-already-fields-in-a-index-to-ecs-fields-in-elasticsearch/208868)
**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\ **Replies:** 7\ **Last updated:** [November 28, 2019, 8:33am UTC](https://discuss.elastic.co/t/how-to-map-already-fields-in-a-index-to-ecs-fields-in-elasticsearch/208868 "2019-11-28T08:33:32Z")
Suppose I want to map my ClientIP field to ECS fIeld what is the approach. The ClientIP filed is already created in the index . Can I map it to ECS field,if the ClientIP field is already created --- ## [Scalar product sort for vector types](https://discuss.elastic.co/t/scalar-product-sort-for-vector-types/208791)
**Author:** [@dvisz-inf](https://discuss.elastic.co/u/dvisz-inf)\ **Replies:** 3\ **Last updated:** [November 28, 2019, 8:30am UTC](https://discuss.elastic.co/t/scalar-product-sort-for-vector-types/208791 "2019-11-28T08:30:55Z")
Hi all :slight\_smile: Presumably ES has some optimized scalar product scoring/sorting for textual relevance similarity scoring using documents' term vectors. Is this same mechanism available for dense\_vector and sparse… --- ## [Multiple Indices Search: Failed to find nested object under path](https://discuss.elastic.co/t/multiple-indices-search-failed-to-find-nested-object-under-path/209753)
**Author:** [@abshek](https://discuss.elastic.co/u/abshek)\ **Replies:** 1\ **Last updated:** [November 28, 2019, 7:09am UTC](https://discuss.elastic.co/t/multiple-indices-search-failed-to-find-nested-object-under-path/209753 "2019-11-28T07:09:13Z")
Hi I need to run a search query across multiple indices (say, idx-users and idx-meta). The mapping for each is different. idx-users has a nested field (path: staysAt, field: staysAt.street), while idx-meta doesn't have… --- ## [TLS On Elasticsearch REST API For Use With External Clients](https://discuss.elastic.co/t/tls-on-elasticsearch-rest-api-for-use-with-external-clients/209689)
**Author:** [@Jstall](https://discuss.elastic.co/u/Jstall)\ **Replies:** 1\ **Last updated:** [November 28, 2019, 6:14am UTC](https://discuss.elastic.co/t/tls-on-elasticsearch-rest-api-for-use-with-external-clients/209689 "2019-11-28T06:14:01Z")
Hello all, My use case is I would like to secure the Elastic Search REST API with tls so that I can post to it securely from an external client. I am using a ElasticSearch 7.4 cluster that I deployed via the official M… --- ## [Not able to get data after creating new index pattern](https://discuss.elastic.co/t/not-able-to-get-data-after-creating-new-index-pattern/209786)
**Author:** [@SheetalRIL](https://discuss.elastic.co/u/SheetalRIL)\ **Replies:** 0\ **Last updated:** [November 28, 2019, 4:10am UTC](https://discuss.elastic.co/t/not-able-to-get-data-after-creating-new-index-pattern/209786 "2019-11-28T04:10:43Z")
Hi Team, I have created Visualization using logs coming via APM. The index pattern used for visualization is 'apm-' and all worked fine. Now, we have data coming in with index named as 'apm-dt:span-2019-11-27' but the … --- ## [Geo\_point issue, need help in identifying the issue](https://discuss.elastic.co/t/geo-point-issue-need-help-in-identifying-the-issue/207801)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 4\ **Last updated:** [November 28, 2019, 3:29am UTC](https://discuss.elastic.co/t/geo-point-issue-need-help-in-identifying-the-issue/207801 "2019-11-28T03:29:09Z")
Hey Folks, Can someone please help me on geo\_point? I am using OSS version 7.2.1 and my data is properly being parsed and can see geo information however when I am plotting the geo map on Kibana this is giving me an err… --- ## [(ES 6.5.4) filtering by nested date field](https://discuss.elastic.co/t/es-6-5-4-filtering-by-nested-date-field/209747)
**Author:** [@kev12123](https://discuss.elastic.co/u/kev12123)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 9:03pm UTC](https://discuss.elastic.co/t/es-6-5-4-filtering-by-nested-date-field/209747 "2019-11-27T21:03:50Z")
Hi I'm relatively new ES and I've created an index with the following mapping: { "\_doc": { "date\_detection": "false", "properties": { "@fields": { "properties": { "client": { … --- ## [Elasticsearch constantly allocating shards after high disk usage](https://discuss.elastic.co/t/elasticsearch-constantly-allocating-shards-after-high-disk-usage/209758)
**Author:** [@Jesbourne](https://discuss.elastic.co/u/Jesbourne)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-constantly-allocating-shards-after-high-disk-usage/209758 "2019-11-27T20:54:05Z")
We have a hot/warm data cluster setup where data transfers from our hot nodes to our warm nodes after a set number of days. The disks on the warm nodes got too full and a few reached the low watermark which caused alloca… --- ## [Add a field, when indexing, with string representation of another integer field](https://discuss.elastic.co/t/add-a-field-when-indexing-with-string-representation-of-another-integer-field/205957)
**Author:** [@NiclasK](https://discuss.elastic.co/u/NiclasK)\ **Replies:** 5\ **Last updated:** [November 27, 2019, 8:33pm UTC](https://discuss.elastic.co/t/add-a-field-when-indexing-with-string-representation-of-another-integer-field/205957 "2019-11-27T20:33:44Z")
Hi, I index data that contain a state which is represented as an integer. I would like to translate this number into a string which is easier to remember and search for. What is the recommended way to do this? Example: … --- ## [Limit results by field + aggregations over results](https://discuss.elastic.co/t/limit-results-by-field-aggregations-over-results/209754)
**Author:** [@neesha](https://discuss.elastic.co/u/neesha)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 8:01pm UTC](https://discuss.elastic.co/t/limit-results-by-field-aggregations-over-results/209754 "2019-11-27T20:01:53Z")
In our index, documents may exist multiple times for the same id as we track each version. For our search, we only want to return one result for this field. And I know we can use aggregations to do a search that finds th… --- ## [Percolator node using too much CPU](https://discuss.elastic.co/t/percolator-node-using-too-much-cpu/206676)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 2\ **Last updated:** [November 27, 2019, 7:58pm UTC](https://discuss.elastic.co/t/percolator-node-using-too-much-cpu/206676 "2019-11-27T19:58:22Z")
We have an ES cluster with 12 percolator nodes. Today, ingestion of data got slow and we noticed 2 of the percolator nodes were using more CPU than the other 10. In this image, user CPU usage of problematic percolators i… --- ## [Elasticsearch org.elasticsearch.index.engine.EngineException"failed to recover translog"](https://discuss.elastic.co/t/elasticsearch-org-elasticsearch-index-engine-engineexception-failed-to-recover-translog/209714)
**Author:** [@apizano](https://discuss.elastic.co/u/apizano)\ **Replies:** 4\ **Last updated:** [November 27, 2019, 5:58pm UTC](https://discuss.elastic.co/t/elasticsearch-org-elasticsearch-index-engine-engineexception-failed-to-recover-translog/209714 "2019-11-27T17:58:12Z")
Hi guys, I'm an intern at my software engineering company adding a health endpoint (using Spring Actuator) to our API for our Elasticsearch service. I am using POSTMAN to view the JSON response and it's sending it corre… --- ## [Disk space and read\_only\_allow\_delete](https://discuss.elastic.co/t/disk-space-and-read-only-allow-delete/209739)
**Author:** [@dale.busse](https://discuss.elastic.co/u/dale.busse)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 5:42pm UTC](https://discuss.elastic.co/t/disk-space-and-read-only-allow-delete/209739 "2019-11-27T17:42:00Z")
Question about the setting read\_only\_allow\_delete. We ran out of disk space, created more space and set that setting to false so indexes could be written to again and all is working fine. So now that we are operational… --- ## [Unavailable\_shards\_exception, reason=index\_xyz 0 primary shard is not active Timeout: 1m](https://discuss.elastic.co/t/unavailable-shards-exception-reason-index-xyz-0-primary-shard-is-not-active-timeout-1m/209730)
**Author:** [@Shivesh\_Kumar](https://discuss.elastic.co/u/Shivesh_Kumar)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 4:36pm UTC](https://discuss.elastic.co/t/unavailable-shards-exception-reason-index-xyz-0-primary-shard-is-not-active-timeout-1m/209730 "2019-11-27T16:36:54Z")
I am using Elasticsearch 7 and it keeps throwing the below Error. My application is just trying to push a document with index document\_published\_data. For the same, I have created the BulkProcessor and using the bulk A… --- ## [Rebooted vm that hosted elasticsearch and not nothing is working](https://discuss.elastic.co/t/rebooted-vm-that-hosted-elasticsearch-and-not-nothing-is-working/209729)
**Author:** [@happycampo](https://discuss.elastic.co/u/happycampo)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 5:00pm UTC](https://discuss.elastic.co/t/rebooted-vm-that-hosted-elasticsearch-and-not-nothing-is-working/209729 "2019-11-27T17:00:25Z")
So I rebooted my elasticsearch vm and now I can't seem to get anything working again. I REALLY need to restore this. Anyone able to help me work through this? \> \[root@elasticsearch etc\]# curl -k -u elastic -XGET 'ht… --- ## [RestHighLevelClient Reindex Timeout](https://discuss.elastic.co/t/resthighlevelclient-reindex-timeout/209728)
**Author:** [@Escalus](https://discuss.elastic.co/u/Escalus)\ **Replies:** 0\ **Last updated:** [November 27, 2019, 4:34pm UTC](https://discuss.elastic.co/t/resthighlevelclient-reindex-timeout/209728 "2019-11-27T16:34:42Z")
Hello, I have a java client that invokes a reindex in our database. The old version used the transport client and locked like this: Settings settings = Settings.builder() .put("client.transport.sniff", true) .put("… --- ## [Search across multiple indices with diffrent fields](https://discuss.elastic.co/t/search-across-multiple-indices-with-diffrent-fields/209706)
**Author:** [@william\_ganrot](https://discuss.elastic.co/u/william_ganrot)\ **Replies:** 3\ **Last updated:** [November 27, 2019, 4:44pm UTC](https://discuss.elastic.co/t/search-across-multiple-indices-with-diffrent-fields/209706 "2019-11-27T16:44:22Z")
Hi! I have a cluster with multiple indices which have different fields with the same content. For example one index has the field 'FullName' and another field might have 'FirstName' & 'LastName'. I want to search a full… --- ## [Filebeat, replace fields from a dictionary](https://discuss.elastic.co/t/filebeat-replace-fields-from-a-dictionary/209709)
**Author:** [@111248](https://discuss.elastic.co/u/111248)\ **Replies:** 1\ **Last updated:** [November 27, 2019, 4:02pm UTC](https://discuss.elastic.co/t/filebeat-replace-fields-from-a-dictionary/209709 "2019-11-27T16:02:23Z")
Hello. I have log file complex structure, for example: {20191029084915,1,2} Also I have a dictionary file: {5,"AAA",1}, {5,"BBB",2}, {6,"CCC",1}, {6,"DDD",2}, I need to read the log file and realtime replace the … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1080) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1082)