# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1084 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1085 --- ## [Getting xpack missing authentication token error after uninstalling xpack](https://discuss.elastic.co/t/getting-xpack-missing-authentication-token-error-after-uninstalling-xpack/207582)
**Author:** [@lschmid](https://discuss.elastic.co/u/lschmid)\ **Replies:** 7\ **Last updated:** [November 25, 2019, 5:49pm UTC](https://discuss.elastic.co/t/getting-xpack-missing-authentication-token-error-after-uninstalling-xpack/207582 "2019-11-25T17:49:42Z")
Hello, I understand that with xpack installed you need to pass credentials along with a request. In this case, I have uninstalled xpack on all nodes in the cluster and restarted the cluster. On cluster restart, the sta… --- ## [Join relationship using Elasticsearch client interface](https://discuss.elastic.co/t/join-relationship-using-elasticsearch-client-interface/209347)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 5:24pm UTC](https://discuss.elastic.co/t/join-relationship-using-elasticsearch-client-interface/209347 "2019-11-25T17:24:50Z")
I am looking for any examples that implement parent-child relationship using the python interface. I can define a mapping such as es.indices.create( index= "docpage", body= { "mappings": { … --- ## [Sorting by date vs date\_nanos](https://discuss.elastic.co/t/sorting-by-date-vs-date-nanos/209342)
**Author:** [@NZangelidis](https://discuss.elastic.co/u/NZangelidis)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 4:09pm UTC](https://discuss.elastic.co/t/sorting-by-date-vs-date-nanos/209342 "2019-11-25T16:09:18Z")
Hello, In our test environment we have been indexing documents with a date data type with this format yyyy-MM-ddTHH:mm:ssZ, and using that for searching and sorting. However we were trying to do pagination and since we … --- ## [Elasticsearch Indexing Rate - API](https://discuss.elastic.co/t/elasticsearch-indexing-rate-api/209312)
**Author:** [@stevesimpson](https://discuss.elastic.co/u/stevesimpson)\ **Replies:** 3\ **Last updated:** [November 25, 2019, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-rate-api/209312 "2019-11-25T14:53:17Z")
Hi, I'm trying to calculate the Indexing rate for our cluster using the API. I'm basically trying to replicate the data from the "Monitoring" graphs for our external alerting system. As you can see these are showing an … --- ## [How can I filter out logs in the termial?](https://discuss.elastic.co/t/how-can-i-filter-out-logs-in-the-termial/209318)
**Author:** [@ishv](https://discuss.elastic.co/u/ishv)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 2:01pm UTC](https://discuss.elastic.co/t/how-can-i-filter-out-logs-in-the-termial/209318 "2019-11-25T14:01:54Z")
I'm using Elasticsearch in my Node.js app - is there any possibility to filter out the logs that are showing in the terminal? For example, show only errors, warnings. I'm running the application via docker-compose and… --- ## [Would Elasticsearch Throttle A Kibana Request to Seven Rows?](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [November 25, 2019, 1:09pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106 "2019-11-25T13:09:40Z")
Hi Elasticsearch Mages, I have what is probably a difficult forum question… but I’ve gotta ask all the same. I have an ELK pipeline for monitoring network traffic. My Kibana (v 7.4.0) is used to display data from my E… --- ## [Suggestions for ELK instll](https://discuss.elastic.co/t/suggestions-for-elk-instll/209308)
**Author:** [@seddikalaouiismaili](https://discuss.elastic.co/u/seddikalaouiismaili)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 12:59pm UTC](https://discuss.elastic.co/t/suggestions-for-elk-instll/209308 "2019-11-25T12:59:59Z")
Hello team , We have to install ELK stack on our infrastructure, separated in 2 sites with 3 nodes for each one . we will implement the clustering method betwen sites, actif/passif node . Q : did you know any best con… --- ## [Slop query on multiple phrases](https://discuss.elastic.co/t/slop-query-on-multiple-phrases/209306)
**Author:** [@saranravipati](https://discuss.elastic.co/u/saranravipati)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 12:54pm UTC](https://discuss.elastic.co/t/slop-query-on-multiple-phrases/209306 "2019-11-25T12:54:36Z")
Hi, I am using ES version 6.5 and I have a use case where i need to search for multiple phrases between a slop value, I tried the different queries but I am not able to get the desired results. Ex: I need to find docum… --- ## [Can I have one Index per User?](https://discuss.elastic.co/t/can-i-have-one-index-per-user/209248)
**Author:** [@saiphani\_jupudi](https://discuss.elastic.co/u/saiphani_jupudi)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 12:36pm UTC](https://discuss.elastic.co/t/can-i-have-one-index-per-user/209248 "2019-11-25T12:36:57Z")
Hi, This is my use case. We are from analytics domain. We track the traffic coming to website & generate some reports with the collected data. We are planning to assign one index per user. Currently we have 33000 activ… --- ## [Help with query aggregation for data table](https://discuss.elastic.co/t/help-with-query-aggregation-for-data-table/209298)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 12:14pm UTC](https://discuss.elastic.co/t/help-with-query-aggregation-for-data-table/209298 "2019-11-25T12:14:37Z")
Hi, Following are 3 example documents containing the total memory on a host and the hypervisor it is hosted on. I would like to create a table visualisation that shows the amount of unassigned memory on each hypervisor,… --- ## [Cant find Metadata file in a bundle](https://discuss.elastic.co/t/cant-find-metadata-file-in-a-bundle/208711)
**Author:** [@AndresL](https://discuss.elastic.co/u/AndresL)\ **Replies:** 3\ **Last updated:** [November 25, 2019, 11:56am UTC](https://discuss.elastic.co/t/cant-find-metadata-file-in-a-bundle/208711 "2019-11-25T11:56:05Z")
In a ESS Deployment, im configuring SAML with ADFS. Because our cloud deployment cant reach our internal ADFS, i uploaded the metadata file: saml/medatadata.xml -\> zip in saml.zip Then i update the cluster and everythi… --- ## [Change parent for children](https://discuss.elastic.co/t/change-parent-for-children/208943)
**Author:** [@Ekaterina\_Nekrasova](https://discuss.elastic.co/u/Ekaterina_Nekrasova)\ **Replies:** 8\ **Last updated:** [November 25, 2019, 11:45am UTC](https://discuss.elastic.co/t/change-parent-for-children/208943 "2019-11-25T11:45:29Z")
Hi ! i have the index with two types : Group and Person, where Group is a parent and Person is a child. The persons can change the groups, for example today into Geroup1 i have Person1, Person2 and Person3, and tomorrow… --- ## [Rally cannot start](https://discuss.elastic.co/t/rally-cannot-start/209233)
**Author:** [@vishal\_viswanathan](https://discuss.elastic.co/u/vishal_viswanathan)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 11:24am UTC](https://discuss.elastic.co/t/rally-cannot-start/209233 "2019-11-25T11:24:31Z")
Hi, I am not able to start the rally using below File "/usr/local/lib/python3.7/site-packages/esrally/racecontrol.py", line 366, in run pipeline(cfg) File "/usr/local/lib/python3.7/site-packages/esrally/racecontrol.p… --- ## [Elastic-cloud performance vs monitoring discrepancy](https://discuss.elastic.co/t/elastic-cloud-performance-vs-monitoring-discrepancy/208568)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 11:22am UTC](https://discuss.elastic.co/t/elastic-cloud-performance-vs-monitoring-discrepancy/208568 "2019-11-25T11:22:45Z")
Hi, I'm using the hosted ES cloud service and I find that the graphs on the "Performance" tab vs the Stack monitoring are quite different and if you had any idea which one I can trust more, it'd be great. Here's an exam… --- ## [ALL fields from 1 day](https://discuss.elastic.co/t/all-fields-from-1-day/209290)
**Author:** [@Arnodl](https://discuss.elastic.co/u/Arnodl)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 11:07am UTC](https://discuss.elastic.co/t/all-fields-from-1-day/209290 "2019-11-25T11:07:54Z")
hey, how can I display all the fields that are in the index from one day. I am looking for fields that are not in ECS --- ## [What is adjust\_pure\_negative?](https://discuss.elastic.co/t/what-is-adjust-pure-negative/209187)
**Author:** [@chanakagl](https://discuss.elastic.co/u/chanakagl)\ **Replies:** 5\ **Last updated:** [November 25, 2019, 10:41am UTC](https://discuss.elastic.co/t/what-is-adjust-pure-negative/209187 "2019-11-25T10:41:00Z")
Can someone please explain what does "adjust\_pure\_negative" do exactly. I couldn't find any documentation regarding on this. I'm using Elasticsearch 6.8.2 version. --- ## [Multi-Match Bool Prefix Query - search query for search-as-you-type and keyword fields](https://discuss.elastic.co/t/multi-match-bool-prefix-query-search-query-for-search-as-you-type-and-keyword-fields/209274)
**Author:** [@lwronski](https://discuss.elastic.co/u/lwronski)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 10:07am UTC](https://discuss.elastic.co/t/multi-match-bool-prefix-query-search-query-for-search-as-you-type-and-keyword-fields/209274 "2019-11-25T10:07:19Z")
Hi, I want to find out, how multi match works for search-as-you-type and keyword type fields in one query. If I make multi match query on only search-as-you-type fields, I get expected result. If only, I make query whi… --- ## [Elastic/Elasticsearch community members are invited to take part in the Express 2019 F/OSS-Firms Survey!](https://discuss.elastic.co/t/elastic-elasticsearch-community-members-are-invited-to-take-part-in-the-express-2019-f-oss-firms-survey/209272)
**Author:** [@moneil](https://discuss.elastic.co/u/moneil)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 10:02am UTC](https://discuss.elastic.co/t/elastic-elasticsearch-community-members-are-invited-to-take-part-in-the-express-2019-f-oss-firms-survey/209272 "2019-11-25T10:02:45Z")
Hi everyone We are looking for participants to help us with a study on the sustainability of free and open source software, ‘Mapping the co-production of digital infrastructure by peer projects and firms’, which is fund… --- ## [How to change size during scroll](https://discuss.elastic.co/t/how-to-change-size-during-scroll/209265)
**Author:** [@shashwat001](https://discuss.elastic.co/u/shashwat001)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 9:34am UTC](https://discuss.elastic.co/t/how-to-change-size-during-scroll/209265 "2019-11-25T09:34:56Z")
I am running scroll on multiple indexes which are built on timeseries data. I have an index for each day with a common prefix in indexname. Earlier I was giving index name wildcard to serve scroll but since it was using … --- ## [Elasticsearch index name with date/time](https://discuss.elastic.co/t/elasticsearch-index-name-with-date-time/209259)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 9:26am UTC](https://discuss.elastic.co/t/elasticsearch-index-name-with-date-time/209259 "2019-11-25T09:26:35Z")
Hi I have created a index as "test-000001" and alias as "test\_search" I have given rollover action as below action: rollover description: \>- Rollover the index associated with alias 'aliasname', which should be in t… --- ## [No cipher suits](https://discuss.elastic.co/t/no-cipher-suits/209209)
**Author:** [@laijianbin](https://discuss.elastic.co/u/laijianbin)\ **Replies:** 4\ **Last updated:** [November 25, 2019, 9:21am UTC](https://discuss.elastic.co/t/no-cipher-suits/209209 "2019-11-25T09:21:27Z")
when zipkin connect to elasticsearch which Connections are secured using Transport Layer Security. \[2019-11-25T10:01:04,749\]\[WARN \]\[o.e.h.n.Netty4HttpServerTransport\] \[lFAgPu1\] caught exception while handling client ht… --- ## [Watcher alert when specific event logged against unique IP](https://discuss.elastic.co/t/watcher-alert-when-specific-event-logged-against-unique-ip/209252)
**Author:** [@elastic\_user.pk](https://discuss.elastic.co/u/elastic_user.pk)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 8:54am UTC](https://discuss.elastic.co/t/watcher-alert-when-specific-event-logged-against-unique-ip/209252 "2019-11-25T08:54:49Z")
Hi, I am new to Elasticsearch and want to configure alerts when there are more than X number of failed login attempts from unique IP (i.e alert should not be triggered when total failed login attempts are more than X. O… --- ## [Trying to find difference between two column for two different rows for a time series data](https://discuss.elastic.co/t/trying-to-find-difference-between-two-column-for-two-different-rows-for-a-time-series-data/209250)
**Author:** [@Alok\_Singh](https://discuss.elastic.co/u/Alok_Singh)\ **Replies:** 0\ **Last updated:** [November 25, 2019, 8:47am UTC](https://discuss.elastic.co/t/trying-to-find-difference-between-two-column-for-two-different-rows-for-a-time-series-data/209250 "2019-11-25T08:47:10Z")
Let say we have an indexed table in Kibana with columns as "time", "svalue", "lvalue". Now, say they have values as (t1,S1,L1), (t2,S2,L2),(t3,S3,L3) and so on. I need to add a watcher to check if (Ln - Sn+1). = 0 , th… --- ## [Authentication of \[elastic\] was terminated by realm\[reserved\] - failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/207077)
**Author:** [@geethusureshkrishna](https://discuss.elastic.co/u/geethusureshkrishna)\ **Replies:** 5\ **Last updated:** [November 25, 2019, 8:46am UTC](https://discuss.elastic.co/t/authentication-of-elastic-was-terminated-by-realm-reserved-failed-to-authenticate-user-elastic/207077 "2019-11-25T08:46:42Z")
I have an Elasticsearch cluster with version 7.3.2. The cluster was stopped because of the error " Authentication of \[elastic\] was terminated by realm\[reserved\] - failed to authenticate user \[elastic\]. Failed to retrieve… --- ## [How to set user elasticseach?](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217)
**Author:** [@chin](https://discuss.elastic.co/u/chin)\ **Replies:** 6\ **Last updated:** [November 25, 2019, 8:32am UTC](https://discuss.elastic.co/t/how-to-set-user-elasticseach/209217 "2019-11-25T08:32:52Z")
elasticsearch version: 7.4.0 I use 3 server to create 3 nodes and set the elasticsearch.yml discovery.seed\_hosts: \["host1:9301", "host2:9301", "host3:9301"\] cluster.initial\_master\_nodes: \["node1", "node2", "node3"\] … --- ## [Is there a way to limit RES memory used by ES](https://discuss.elastic.co/t/is-there-a-way-to-limit-res-memory-used-by-es/209100)
**Author:** [@rnataraja](https://discuss.elastic.co/u/rnataraja)\ **Replies:** 9\ **Last updated:** [November 25, 2019, 8:08am UTC](https://discuss.elastic.co/t/is-there-a-way-to-limit-res-memory-used-by-es/209100 "2019-11-25T08:08:57Z")
ES 6.8.3 I understand from reading up through forum that ES will use more than actually the Heap Max. On our systems we see that if its given 32Gig of Max Heap. It slowly keeps increasing and consumes a lot more than 32… --- ## [LEAK: ByteBuf.release() was not called before it's garbage-collected](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/207063)
**Author:** [@Mac\_Oscar](https://discuss.elastic.co/u/Mac_Oscar)\ **Replies:** 4\ **Last updated:** [November 25, 2019, 7:37am UTC](https://discuss.elastic.co/t/leak-bytebuf-release-was-not-called-before-its-garbage-collected/207063 "2019-11-25T07:37:20Z")
Hi, I have a problem I have never encountered, so I need some help. My es cluster has two masters and four data nodes. Master 1 is the standby node and it is also the problem node. Everything is working normally！！！ … --- ## [Multi tenant Elasticsearch deployment - storage usage](https://discuss.elastic.co/t/multi-tenant-elasticsearch-deployment-storage-usage/209098)
**Author:** [@Ravi\_Narayan](https://discuss.elastic.co/u/Ravi_Narayan)\ **Replies:** 1\ **Last updated:** [November 25, 2019, 6:42am UTC](https://discuss.elastic.co/t/multi-tenant-elasticsearch-deployment-storage-usage/209098 "2019-11-25T06:42:48Z")
Hello, I have a multi tenant environment where the indexes are shared between tenants.The tenant data is secured using filtered alias . But I need a way to track the storage used by each tenant in order to move their d… --- ## [Elastic shard question?](https://discuss.elastic.co/t/elastic-shard-question/209213)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [November 25, 2019, 5:45am UTC](https://discuss.elastic.co/t/elastic-shard-question/209213 "2019-11-25T05:45:55Z")
Hi everyone I have a question upon shard in elasticsearch First how many primary shard should i have in an index Second will there be an increase in searching time if i set many primary shard in an index Thank you. --- ## [Problem with Logstash posing to ElasticSearch](https://discuss.elastic.co/t/problem-with-logstash-posing-to-elasticsearch/209201)
**Author:** [@JennS](https://discuss.elastic.co/u/JennS)\ **Replies:** 0\ **Last updated:** [November 24, 2019, 8:04pm UTC](https://discuss.elastic.co/t/problem-with-logstash-posing-to-elasticsearch/209201 "2019-11-24T20:04:32Z")
{ "template": "snmplogger-\*", "settings": { "index": { "refresh\_interval": "10s", "number\_of\_replicas": 1, "number\_of\_shards": 6 } }, "mappings" : { "default" : { "\_source" : { "enabled" : false } }, "doc" :… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1083) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1085)