# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1088 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1089 --- ## [Cannot use non-grouped column error. How to get around this?](https://discuss.elastic.co/t/cannot-use-non-grouped-column-error-how-to-get-around-this/208579)
**Author:** [@pgervais](https://discuss.elastic.co/u/pgervais)\ **Replies:** 4\ **Last updated:** [November 20, 2019, 10:16pm UTC](https://discuss.elastic.co/t/cannot-use-non-grouped-column-error-how-to-get-around-this/208579 "2019-11-20T22:16:43Z")
I'm running the following SQL command as shown below. This command looks at all row between the respective start and date and find the MAX of the TotalCPULoadMIPS field for each day. If i remove the "@timestamp" the SQL… --- ## [Shard Allocation after new indexes is created](https://discuss.elastic.co/t/shard-allocation-after-new-indexes-is-created/207162)
**Author:** [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Replies:** 5\ **Last updated:** [November 20, 2019, 8:47pm UTC](https://discuss.elastic.co/t/shard-allocation-after-new-indexes-is-created/207162 "2019-11-20T20:47:03Z")
When my indexes rolled over nothing is being written to the new index. How can I fix this? --- ## [Remove \_id field from having fielddata](https://discuss.elastic.co/t/remove-id-field-from-having-fielddata/208595)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 3\ **Last updated:** [November 20, 2019, 8:28pm UTC](https://discuss.elastic.co/t/remove-id-field-from-having-fielddata/208595 "2019-11-20T20:28:00Z")
I'm currently getting huge fielddata stored in RAM when a user does an aggregation on the \_id field. I'd like to prevent that from happening because it breaks the system down if someone does that. Is there any recommenda… --- ## [ESMS Performance issue](https://discuss.elastic.co/t/esms-performance-issue/208747)
**Author:** [@Gopal\_Chauhan](https://discuss.elastic.co/u/Gopal_Chauhan)\ **Replies:** 3\ **Last updated:** [November 20, 2019, 8:07pm UTC](https://discuss.elastic.co/t/esms-performance-issue/208747 "2019-11-20T20:07:34Z")
Hi , We were facing lot of performance issue in our cluster (elastic version 7.1, 3 md and 2d on linux boxes). Then we created two separate ingest node but still performance issue was there. Our nodes were going own ra… --- ## [Sorting with from and to with search\_after](https://discuss.elastic.co/t/sorting-with-from-and-to-with-search-after/208755)
**Author:** [@dkishore](https://discuss.elastic.co/u/dkishore)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 6:39pm UTC](https://discuss.elastic.co/t/sorting-with-from-and-to-with-search-after/208755 "2019-11-20T18:39:02Z")
Hi How to sort on all the available values on an index with from and to with search\_after like below when we use from:0 it always picks the 100 records and performs a sort on that chunk of items from:0, "size": 100, … --- ## [400, 'mapper\_parsing\_exception', 'No type specified for field \[file\]'](https://discuss.elastic.co/t/400-mapper-parsing-exception-no-type-specified-for-field-file/208745)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 5:15pm UTC](https://discuss.elastic.co/t/400-mapper-parsing-exception-no-type-specified-for-field-file/208745 "2019-11-20T17:15:37Z")
I am using the following code to create an index. Don't understand what is required to fix the error. es.indices.create( index= "prestotest", body= { "mappings": { "properties": { "file" : { "properties ": { "url… --- ## [How to Upgrade ELK from 7.1.0 to the latest version](https://discuss.elastic.co/t/how-to-upgrade-elk-from-7-1-0-to-the-latest-version/208736)
**Author:** [@kamalesh](https://discuss.elastic.co/u/kamalesh)\ **Replies:** 1\ **Last updated:** [November 20, 2019, 5:39pm UTC](https://discuss.elastic.co/t/how-to-upgrade-elk-from-7-1-0-to-the-latest-version/208736 "2019-11-20T17:39:29Z")
Hi All , Can anyone please help me on how to upgrade the ELK instance from 7.1.0 to the latest version with step by step procedure. If already had any post on the same, Please do share the thread . Thanks in Advance… --- ## [Access for private repositories](https://discuss.elastic.co/t/access-for-private-repositories/208400)
**Author:** [@mma1](https://discuss.elastic.co/u/mma1)\ **Replies:** 14\ **Last updated:** [November 20, 2019, 5:05pm UTC](https://discuss.elastic.co/t/access-for-private-repositories/208400 "2019-11-20T17:05:44Z")
I have rally running via docker using existing Elastic clusters. I am trying to make my own custom tracks and I cannot get rally to git clone my private github repository. If I use ssh git, it fails with: 2019-11-18 22:… --- ## [Elasticsearch cluster status is Red with unassigned shards](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red-with-unassigned-shards/208726)
**Author:** [@adityacs](https://discuss.elastic.co/u/adityacs)\ **Replies:** 2\ **Last updated:** [November 20, 2019, 4:33pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-status-is-red-with-unassigned-shards/208726 "2019-11-20T16:33:04Z")
Hi Team, We use ES 6.4.3 and we see below cluster status {"cluster\_name":"elasticsearch","status":"red","timed\_out":false,"number\_of\_nodes":5,"number\_of\_data\_nodes":2,"active\_primary\_shards":3150,"active\_shards":3161,"… --- ## [Update value of a filed in a list of objects - Elasticsearch (update by query)](https://discuss.elastic.co/t/update-value-of-a-filed-in-a-list-of-objects-elasticsearch-update-by-query/208740)
**Author:** [@Abhilash\_Sathe1](https://discuss.elastic.co/u/Abhilash_Sathe1)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 4:22pm UTC](https://discuss.elastic.co/t/update-value-of-a-filed-in-a-list-of-objects-elasticsearch-update-by-query/208740 "2019-11-20T16:22:05Z")
As shown in the image, I need to create a query that will accept a comma separated string of the id field and whichever id field's value matches, the flag is\_read will change to true. I tried to create something like … --- ## [Index URLs in Elasticsearch and make them clickable in Kibana](https://discuss.elastic.co/t/index-urls-in-elasticsearch-and-make-them-clickable-in-kibana/208738)
**Author:** [@Steztric](https://discuss.elastic.co/u/Steztric)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 4:20pm UTC](https://discuss.elastic.co/t/index-urls-in-elasticsearch-and-make-them-clickable-in-kibana/208738 "2019-11-20T16:20:18Z")
I am working on a .NET project so I am using NEST. I want to index an object that has a URL property. I want to index it in such a way that Kibana recognises that it is a URL and allows me to click on it to open the URL … --- ## [Cluster unstable after upgrade to ES 7.4.2](https://discuss.elastic.co/t/cluster-unstable-after-upgrade-to-es-7-4-2/208731)
**Author:** [@octave](https://discuss.elastic.co/u/octave)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 3:30pm UTC](https://discuss.elastic.co/t/cluster-unstable-after-upgrade-to-es-7-4-2/208731 "2019-11-20T15:30:45Z")
Hello, We recently upgraded our cluster from 6.8 to 7.4.2 and are now facing a major stability issue: the cluster randomly loses its master then is unable to re-elect a new one. Our current configuration is: 6 nodes … --- ## [Access Denied Exception in elasticsearch v5.6](https://discuss.elastic.co/t/access-denied-exception-in-elasticsearch-v5-6/206276)
**Author:** [@amirhossein](https://discuss.elastic.co/u/amirhossein)\ **Replies:** 16\ **Last updated:** [November 20, 2019, 3:20pm UTC](https://discuss.elastic.co/t/access-denied-exception-in-elasticsearch-v5-6/206276 "2019-11-20T15:20:36Z")
Hi, i have a cluster with 3 nodes. elasticsearch UID is different and their GID is same, But when I get the information of the snapshot on the Kibana, all the processes failed, here is part of the logs of the snapshot: … --- ## [Hour Extraction](https://discuss.elastic.co/t/hour-extraction/206624)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 5\ **Last updated:** [November 20, 2019, 3:19pm UTC](https://discuss.elastic.co/t/hour-extraction/206624 "2019-11-20T15:19:11Z")
Hello! I am trying to extract the hour from the timestamp using a scripted field. I haven't a clue how. Any thoughts? The reason I need to do it in a scripted field is because of the timezone change. When I pull the ho… --- ## [Is Watcher webhook action support multi-document?](https://discuss.elastic.co/t/is-watcher-webhook-action-support-multi-document/207663)
**Author:** [@Izek](https://discuss.elastic.co/u/Izek)\ **Replies:** 1\ **Last updated:** [November 20, 2019, 3:07pm UTC](https://discuss.elastic.co/t/is-watcher-webhook-action-support-multi-document/207663 "2019-11-20T15:07:56Z")
Hi there, I am try to use watcher to post the data from one elastic cloud cluster to another one. But seems like the multi-document support is not working multi-document support And I saw a discussion before mentione… --- ## [Word delimiter filter with preserve\_original](https://discuss.elastic.co/t/word-delimiter-filter-with-preserve-original/207123)
**Author:** [@skowron-line](https://discuss.elastic.co/u/skowron-line)\ **Replies:** 3\ **Last updated:** [November 20, 2019, 3:05pm UTC](https://discuss.elastic.co/t/word-delimiter-filter-with-preserve-original/207123 "2019-11-20T15:05:47Z")
I have such case My mapping is PUT my\_index { "settings": { "analysis": { "filter": { "my\_length": { "type": "length", "min": 2 }, "my\_word": { "type": … --- ## [Kibana snapshot and restore policies - how to set snapshot retention, meaning how long to keep specific snapshots](https://discuss.elastic.co/t/kibana-snapshot-and-restore-policies-how-to-set-snapshot-retention-meaning-how-long-to-keep-specific-snapshots/208717)
**Author:** [@raulk89](https://discuss.elastic.co/u/raulk89)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 2:37pm UTC](https://discuss.elastic.co/t/kibana-snapshot-and-restore-policies-how-to-set-snapshot-retention-meaning-how-long-to-keep-specific-snapshots/208717 "2019-11-20T14:37:02Z")
Hi Elastic and kibana 7.4.2 There is this feature in kibana, that I can create snapshot policies to automatically back up my cluster. My question is, how the old snapshots are getting deleted automatically and how can… --- ## [Trying to setup a cluster on version 6.5](https://discuss.elastic.co/t/trying-to-setup-a-cluster-on-version-6-5/208724)
**Author:** [@gotigers](https://discuss.elastic.co/u/gotigers)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 2:49pm UTC](https://discuss.elastic.co/t/trying-to-setup-a-cluster-on-version-6-5/208724 "2019-11-20T14:49:19Z")
I am trying to setup a 3 node cluster but only two are joining. the yml settings are the same on all three vm's. Am I missing a particular setting? Thanks in advance! --- ## [Changed mapping from text+keyword to keyword, queries not working now](https://discuss.elastic.co/t/changed-mapping-from-text-keyword-to-keyword-queries-not-working-now/208723)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 2:47pm UTC](https://discuss.elastic.co/t/changed-mapping-from-text-keyword-to-keyword-queries-not-working-now/208723 "2019-11-20T14:47:24Z")
Hi! I have some indices which some field mappings where text and keyword. In Kibana I used "field.keyword" to use the keyword mapped value. As well, in an application I made I used queries pointing to "field.keyword". … --- ## [1KB JSON doc becomes 17KB after indexing with many fields of type "Keyword"](https://discuss.elastic.co/t/1kb-json-doc-becomes-17kb-after-indexing-with-many-fields-of-type-keyword/208720)
**Author:** [@Madala](https://discuss.elastic.co/u/Madala)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 2:44pm UTC](https://discuss.elastic.co/t/1kb-json-doc-becomes-17kb-after-indexing-with-many-fields-of-type-keyword/208720 "2019-11-20T14:44:45Z")
Hi Team, We are trying to do our Volume sizing exercise and found that a json doc of size 1KB is taking up about 17KB in the index. Our use case is metrics related and most of the fields do not need indexing for search.… --- ## [Add New Node](https://discuss.elastic.co/t/add-new-node/208606)
**Author:** [@Hoang\_Ph\_m](https://discuss.elastic.co/u/Hoang_Ph_m)\ **Replies:** 1\ **Last updated:** [November 20, 2019, 12:30pm UTC](https://discuss.elastic.co/t/add-new-node/208606 "2019-11-20T12:30:02Z")
Hello! My name is Hoang. I'm a newbie. I doing a project and use ElasticSearch. In Cluster, these are three nodes. I config, each shard is (3 primary shard and 2 replica). Now, I want to add a new node to Cluster. Quest… --- ## [After rolling over, new index doesn't have dynamic template mappings from old one](https://discuss.elastic.co/t/after-rolling-over-new-index-doesnt-have-dynamic-template-mappings-from-old-one/205716)
**Author:** [@sensei-wu](https://discuss.elastic.co/u/sensei-wu)\ **Replies:** 2\ **Last updated:** [November 20, 2019, 12:30pm UTC](https://discuss.elastic.co/t/after-rolling-over-new-index-doesnt-have-dynamic-template-mappings-from-old-one/205716 "2019-11-20T12:30:01Z")
In elasticsearch 6.4, I have an alias /foo which had an index of the format /foo-000001. This index was created with a mapping which also included dynamic template. When data grew, I rolled over using POST /foo/\_rollove… --- ## [Ealsticsearch is stop when Xpack setiing enable](https://discuss.elastic.co/t/ealsticsearch-is-stop-when-xpack-setiing-enable/207613)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 14\ **Last updated:** [November 20, 2019, 12:01pm UTC](https://discuss.elastic.co/t/ealsticsearch-is-stop-when-xpack-setiing-enable/207613 "2019-11-20T12:01:08Z")
When I configure X-pack setting Enable my elasticsearch services stop. What to do? --- ## [How to sub aggregation from nested aggregation in Java](https://discuss.elastic.co/t/how-to-sub-aggregation-from-nested-aggregation-in-java/208688)
**Author:** [@Soumitra\_Goswami](https://discuss.elastic.co/u/Soumitra_Goswami)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 11:55am UTC](https://discuss.elastic.co/t/how-to-sub-aggregation-from-nested-aggregation-in-java/208688 "2019-11-20T11:55:33Z")
I have some nested fields, of which I want to calculate all distinct values, for example: "author":{ "type":"nested", "properties":{ "first\_name":{ "type": "text", "fields": { "keyword": { … --- ## [FSCrawler over HTTPS](https://discuss.elastic.co/t/fscrawler-over-https/208592)
**Author:** [@sealsj](https://discuss.elastic.co/u/sealsj)\ **Replies:** 1\ **Last updated:** [November 20, 2019, 11:50am UTC](https://discuss.elastic.co/t/fscrawler-over-https/208592 "2019-11-20T11:50:47Z")
Greetings: I am trying to use FSCrawler to crawl a remote site over https. Does anyone know if this is even possible? I've read the docs and tried doing it over SSH butI get the "Error while crawling https://myserver.pa… --- ## [Why use checksum to verify segment files？](https://discuss.elastic.co/t/why-use-checksum-to-verify-segment-files/208636)
**Author:** [@cigarl](https://discuss.elastic.co/u/cigarl)\ **Replies:** 7\ **Last updated:** [November 20, 2019, 11:47am UTC](https://discuss.elastic.co/t/why-use-checksum-to-verify-segment-files/208636 "2019-11-20T11:47:40Z")
When I restart the cluster,I found that many copies are copied from 0，the reason is that the checksum of the segment files is inconsistent,and then I wrote a demo by using the Lucene interface，the result is the same oper… --- ## [AWS Elasticsearch Best Practice for Indexes](https://discuss.elastic.co/t/aws-elasticsearch-best-practice-for-indexes/208634)
**Author:** [@Fei\_YU](https://discuss.elastic.co/u/Fei_YU)\ **Replies:** 2\ **Last updated:** [November 20, 2019, 11:43am UTC](https://discuss.elastic.co/t/aws-elasticsearch-best-practice-for-indexes/208634 "2019-11-20T11:43:28Z")
We have been using AWS Elasticsearch Service for a while ( few years ) with the current configuration: No Master dedicated Nodes. 2k+ indexes and 10K primary shards, 20K shards with one replica. 4 instances 8GB memory … --- ## [Build failure for elasticsearch 7.2 on PPC64LE](https://discuss.elastic.co/t/build-failure-for-elasticsearch-7-2-on-ppc64le/208687)
**Author:** [@sarvesh.tamba](https://discuss.elastic.co/u/sarvesh.tamba)\ **Replies:** 0\ **Last updated:** [November 20, 2019, 11:43am UTC](https://discuss.elastic.co/t/build-failure-for-elasticsearch-7-2-on-ppc64le/208687 "2019-11-20T11:43:12Z")
I am trying to build elasticsearch version 7.2 on PPC64LE inside a registry.access.redhat.com/ubi7/ubi-minimal based container. Initially I ran into error: unmappable character (0xE0) for encoding US-ASCII errors, w… --- ## [Using Nested Field like main data source](https://discuss.elastic.co/t/using-nested-field-like-main-data-source/208571)
**Author:** [@salihklc](https://discuss.elastic.co/u/salihklc)\ **Replies:** 0\ **Last updated:** [November 19, 2019, 7:51pm UTC](https://discuss.elastic.co/t/using-nested-field-like-main-data-source/208571 "2019-11-19T19:51:23Z")
Hello everyone, I'm developing a website which using elasticsearch for showing data on datatable with fully supported features (paging,sorting, etc.) (you can see example data below, and easy to figure out thats a groc… --- ## [Some of the Fortigate fields are not searchable?](https://discuss.elastic.co/t/some-of-the-fortigate-fields-are-not-searchable/205371)
**Author:** [@Long\_Thai](https://discuss.elastic.co/u/Long_Thai)\ **Replies:** 6\ **Last updated:** [November 20, 2019, 10:49am UTC](https://discuss.elastic.co/t/some-of-the-fortigate-fields-are-not-searchable/205371 "2019-11-20T10:49:51Z")
I am using kv() to identify key/value pairs. The stream of inputs are from /var/log/syslog and filbeat. I rename some of the fields like type, subtype, user, group, service to fgt\_type, fgt\_subtype, fgt\_user, fgt\_group… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1087) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1089)