# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1099 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1100 --- ## [Updating two documents at once - error management](https://discuss.elastic.co/t/updating-two-documents-at-once-error-management/207223)
**Author:** [@Luigi\_Bardelli](https://discuss.elastic.co/u/Luigi_Bardelli)\ **Replies:** 0\ **Last updated:** [November 9, 2019, 9:42pm UTC](https://discuss.elastic.co/t/updating-two-documents-at-once-error-management/207223 "2019-11-09T21:42:58Z")
Hi all, after reading the optimistic concurrency docs, I would like to understand which is the best way to handle the following scenario: client fetches two "related" documents client does its biz logic, changing both … --- ## [Azure active directory integration with elasticsearch](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023)
**Author:** [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Replies:** 22\ **Last updated:** [November 9, 2019, 7:02pm UTC](https://discuss.elastic.co/t/azure-active-directory-integration-with-elasticsearch/204023 "2019-11-09T19:02:43Z")
Hello, I have elasticsearch server hosted on virtual machine in azure cloud. I have an azure default directory and users added to it. I want to login to elasticsearch using credentials for the users in active directory.… --- ## [Elasticsearch with winlogbeat and geoip](https://discuss.elastic.co/t/elasticsearch-with-winlogbeat-and-geoip/207084)
**Author:** [@scout](https://discuss.elastic.co/u/scout)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 9:59am UTC](https://discuss.elastic.co/t/elasticsearch-with-winlogbeat-and-geoip/207084 "2019-11-08T09:59:15Z")
Hi, I'm trying to enrich log data with geoip information from winlogbeat to elasticsearch but I cannot find how to enable/ enrich that data. I tried to look for document https://www.elastic.co/guide/en/elasticsearch/re… --- ## [Losing documents while reindexing 4 million documents](https://discuss.elastic.co/t/losing-documents-while-reindexing-4-million-documents/206855)
**Author:** [@Vikas\_Kumar1](https://discuss.elastic.co/u/Vikas_Kumar1)\ **Replies:** 3\ **Last updated:** [November 9, 2019, 4:04pm UTC](https://discuss.elastic.co/t/losing-documents-while-reindexing-4-million-documents/206855 "2019-11-09T16:04:55Z")
I am re-indexing 4 million documents. When I create a new index without any mappings (default mappings) it works fine. Means every document get indexed into the new one from source index. But when I create new index wi… --- ## [Ingest pipeline analyze time difference](https://discuss.elastic.co/t/ingest-pipeline-analyze-time-difference/207140)
**Author:** [@Andrii](https://discuss.elastic.co/u/Andrii)\ **Replies:** 2\ **Last updated:** [November 9, 2019, 9:35am UTC](https://discuss.elastic.co/t/ingest-pipeline-analyze-time-difference/207140 "2019-11-09T09:35:47Z")
Hello, I need to route messages which have @timestamp field that differs more than 8 hours from now to a separate topic. I tried to use ingest pipeline with some processors for that. But the only one which comes to my … --- ## [What is the alternative way of querying \_all?](https://discuss.elastic.co/t/what-is-the-alternative-way-of-querying-all/207201)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [November 9, 2019, 3:16am UTC](https://discuss.elastic.co/t/what-is-the-alternative-way-of-querying-all/207201 "2019-11-09T03:16:07Z")
From elasticsearch 6.x \_all has been deprecated. I have a matchQuery like below QueryBuilders.boolQuery() .should(QueryBuilders.matchQuery("\_all", typeAndName.name)) .shou… --- ## [Size is not working with composite aggregations](https://discuss.elastic.co/t/size-is-not-working-with-composite-aggregations/207191)
**Author:** [@Seetha93](https://discuss.elastic.co/u/Seetha93)\ **Replies:** 0\ **Last updated:** [November 9, 2019, 12:51am UTC](https://discuss.elastic.co/t/size-is-not-working-with-composite-aggregations/207191 "2019-11-09T00:51:36Z")
I have the following query: GET index\_name/\_search { "size": 0, "aggs": { "my\_buckets": { "composite": { "size": 100, "sources": \[ { "field1": { "terms"… --- ## [I need to Configure a Watcher that after of the alarm is triggered for first time, the interval de execution increase to 30 minutes](https://discuss.elastic.co/t/i-need-to-configure-a-watcher-that-after-of-the-alarm-is-triggered-for-first-time-the-interval-de-execution-increase-to-30-minutes/207175)
**Author:** [@andres\_fever](https://discuss.elastic.co/u/andres_fever)\ **Replies:** 1\ **Last updated:** [November 9, 2019, 12:06am UTC](https://discuss.elastic.co/t/i-need-to-configure-a-watcher-that-after-of-the-alarm-is-triggered-for-first-time-the-interval-de-execution-increase-to-30-minutes/207175 "2019-11-09T00:06:11Z")
Hello, I have an alarm developed in a wacther in kibana and the interval from execution is 1 minute so when the condition is true a long time, this alarm activates all time. I need that after of the alarm is triggered f… --- ## [Upgrading elasticsearch from 5.6.5 to 7.4.0](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-5-to-7-4-0/206599)
**Author:** [@Rajanikanta](https://discuss.elastic.co/u/Rajanikanta)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 11:53pm UTC](https://discuss.elastic.co/t/upgrading-elasticsearch-from-5-6-5-to-7-4-0/206599 "2019-11-08T23:53:28Z")
I have upgraded the rest high level client from 5.6.5 to 7.4.0 , seeing the below exceptions: Caused by: org.apache.openejb.OpenEJBException: Unable to create annotation scanner for web module oi: null at org.apache.op… --- ## [License installation problems with x-pack on Elasticsearch 5.6.10](https://discuss.elastic.co/t/license-installation-problems-with-x-pack-on-elasticsearch-5-6-10/207181)
**Author:** [@jhshen](https://discuss.elastic.co/u/jhshen)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 10:53pm UTC](https://discuss.elastic.co/t/license-installation-problems-with-x-pack-on-elasticsearch-5-6-10/207181 "2019-11-08T22:53:08Z")
On Elasticsearch 5.6.10 complex, I recently installed x-pack and I've subscribed to Elastic licenses which has been downloaded. I've generated certificates for both the client machine and the CA Root certificate, and I'v… --- ## [Watcher Notifications via email and Slack](https://discuss.elastic.co/t/watcher-notifications-via-email-and-slack/205931)
**Author:** [@Mauricio\_Borges](https://discuss.elastic.co/u/Mauricio_Borges)\ **Replies:** 10\ **Last updated:** [November 8, 2019, 10:35pm UTC](https://discuss.elastic.co/t/watcher-notifications-via-email-and-slack/205931 "2019-11-08T22:35:07Z")
Hi Everyone! I am using ELK via Docker Compose and I am interesting to setup Watcher Notifications via email and integrated with Slack. Any step by step procedure to I achieve that ? When I set commented lines below fr… --- ## [ES 6.8 vs 7.4 memory issues](https://discuss.elastic.co/t/es-6-8-vs-7-4-memory-issues/202849)
**Author:** [@andrx](https://discuss.elastic.co/u/andrx)\ **Replies:** 11\ **Last updated:** [November 8, 2019, 9:36pm UTC](https://discuss.elastic.co/t/es-6-8-vs-7-4-memory-issues/202849 "2019-11-08T21:36:25Z")
The following is not a part of aws elasticsearch managed service. I have ES6.8 cluster on m4.2xlarge (32GB RAM) centos7 machines on aws. GET \_cat/nodes?v&s=name ip heap.percent ram.percent cpu load\_1m load\_5m … --- ## [APM PHP Agent Setup](https://discuss.elastic.co/t/apm-php-agent-setup/207172)
**Author:** [@Ghaith\_Haddad](https://discuss.elastic.co/u/Ghaith_Haddad)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 8:54pm UTC](https://discuss.elastic.co/t/apm-php-agent-setup/207172 "2019-11-08T20:54:12Z")
Im having a really hard time setting up my APM PHP Agent on a test EC2 server, can anyone please show me how to configure it properly to send log data to my ELK Server. I tried asking this question on the Git repo but th… --- ## [ILM Policy Update from Kibana Never Applies](https://discuss.elastic.co/t/ilm-policy-update-from-kibana-never-applies/206661)
**Author:** [@jameswatson3](https://discuss.elastic.co/u/jameswatson3)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 8:43pm UTC](https://discuss.elastic.co/t/ilm-policy-update-from-kibana-never-applies/206661 "2019-11-08T20:43:36Z")
I have recently enabled ILM policy per documentation and it is working according to the policies and indexes created at the time of implementation. However, if I make a change (in this case to the max\_size attribute) th… --- ## [Logstash Hangs when installing amazon\_es plugin on Windows](https://discuss.elastic.co/t/logstash-hangs-when-installing-amazon-es-plugin-on-windows/207169)
**Author:** [@kcb](https://discuss.elastic.co/u/kcb)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 8:34pm UTC](https://discuss.elastic.co/t/logstash-hangs-when-installing-amazon-es-plugin-on-windows/207169 "2019-11-08T20:34:00Z")
We have downloaded logstash-output-amazon\_es for Windows from GitHub. We have ran a gem build on the downloaded gemspec file to create a gem file. We are then try to install the plugin from the gem file via: ".\\bin\\logst… --- ## [Percolate query alternative for given use case](https://discuss.elastic.co/t/percolate-query-alternative-for-given-use-case/207165)
**Author:** [@aaronloes](https://discuss.elastic.co/u/aaronloes)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 7:52pm UTC](https://discuss.elastic.co/t/percolate-query-alternative-for-given-use-case/207165 "2019-11-08T19:52:49Z")
I'm checking to see if there is a better way to achieve the same goal that the percolate query does for me but with less overhead. I have an index where each document is a product (say Acme Anvils). I want to determine … --- ## [Index management and rollover](https://discuss.elastic.co/t/index-management-and-rollover/202226)
**Author:** [@Marcell0e](https://discuss.elastic.co/u/Marcell0e)\ **Replies:** 34\ **Last updated:** [November 8, 2019, 7:37pm UTC](https://discuss.elastic.co/t/index-management-and-rollover/202226 "2019-11-08T19:37:53Z")
I have setup ILM and everything was going good until the index didn't roll over like I thought it would. I have it set to 30Gbs or 60 days. My first question is do both requirements have to be met before it will roll o… --- ## [Discovery ec2 for elasticsearch 7.4.2](https://discuss.elastic.co/t/discovery-ec2-for-elasticsearch-7-4-2/207159)
**Author:** [@Igor\_Golebiowski](https://discuss.elastic.co/u/Igor_Golebiowski)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 7:29pm UTC](https://discuss.elastic.co/t/discovery-ec2-for-elasticsearch-7-4-2/207159 "2019-11-08T19:29:53Z")
Hi, I'm trying to setup elasticsearch cluster on ECS on AWS. I'm able to start 3 elasticsearch nodes, each on separate host but I'm not able to connect those instances to one cluster. I've checked https://medium.com/@de… --- ## [Unassigned shards and Elasticsearch health turns RED](https://discuss.elastic.co/t/unassigned-shards-and-elasticsearch-health-turns-red/207065)
**Author:** [@Sundaramoorthy\_Anand](https://discuss.elastic.co/u/Sundaramoorthy_Anand)\ **Replies:** 12\ **Last updated:** [November 8, 2019, 7:03pm UTC](https://discuss.elastic.co/t/unassigned-shards-and-elasticsearch-health-turns-red/207065 "2019-11-08T19:03:16Z")
Hi, I'm having a single node cluster architecture where my ELK is in a server (say servA) and Filebeat is in remote server. there are 2 remote servers say filebeat-A(fA) in serverB(sB) and filebeat-B(fB) in serverC(sC) … --- ## [The bulk request must be terminated by a newline \[\\\\n\]](https://discuss.elastic.co/t/the-bulk-request-must-be-terminated-by-a-newline-n/207155)
**Author:** [@PrabhuRajendran](https://discuss.elastic.co/u/PrabhuRajendran)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 6:03pm UTC](https://discuss.elastic.co/t/the-bulk-request-must-be-terminated-by-a-newline-n/207155 "2019-11-08T18:03:30Z")
Hi, I am trying to add bulk request via cURL http client, when i try pass json file am getting "The bulk request must be terminated by a newline \[\\n\]" Could some one help why am getting even if added newline at end of … --- ## [How do I create an ElasticSearch filter on two nested objects so that the results only includes documents that match both conditions](https://discuss.elastic.co/t/how-do-i-create-an-elasticsearch-filter-on-two-nested-objects-so-that-the-results-only-includes-documents-that-match-both-conditions/206656)
**Author:** [@fitterweb](https://discuss.elastic.co/u/fitterweb)\ **Replies:** 5\ **Last updated:** [November 8, 2019, 4:34pm UTC](https://discuss.elastic.co/t/how-do-i-create-an-elasticsearch-filter-on-two-nested-objects-so-that-the-results-only-includes-documents-that-match-both-conditions/206656 "2019-11-08T16:34:07Z")
How do I create an ElasticSearch filter query on nested objects so that the results match both? I have documents that include nested objects like the following: { "objectNumber": "1", "nestedObjects": \[ { … --- ## [Multiple query with wildcard](https://discuss.elastic.co/t/multiple-query-with-wildcard/205920)
**Author:** [@icirco](https://discuss.elastic.co/u/icirco)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 3:31pm UTC](https://discuss.elastic.co/t/multiple-query-with-wildcard/205920 "2019-11-08T15:31:10Z")
hello, How to query easily ? Is any tool to help to implement the query ? I've success to query on a range time but I would like to add a condition on a message pattern... How to do that ? I've tried something like th… --- ## [Master not discovered or elected yet](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/206911)
**Author:** [@skills-anand](https://discuss.elastic.co/u/skills-anand)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 2:14pm UTC](https://discuss.elastic.co/t/master-not-discovered-or-elected-yet/206911 "2019-11-07T14:14:24Z")
Hello, I have a cluster with 4 nodes. Where node 1 is master and all other nodes i set master as false. I tried to connect with 3 nodes properly when i start connecting with node 4 in same cluster i got the following e… --- ## [Default\_operator 'AND' with query\_string does not work properly](https://discuss.elastic.co/t/default-operator-and-with-query-string-does-not-work-properly/203667)
**Author:** [@Flinou](https://discuss.elastic.co/u/Flinou)\ **Replies:** 4\ **Last updated:** [November 8, 2019, 1:55pm UTC](https://discuss.elastic.co/t/default-operator-and-with-query-string-does-not-work-properly/203667 "2019-11-08T13:55:55Z")
I have some issues trying to make default\_operator AND work with query\_string on multiple fields. (Elastic Search v 7.2) Here is my query and the document indexed : POST testeur/\_doc/document { "content": "attention … --- ## ["No search context found for id" during reindex](https://discuss.elastic.co/t/no-search-context-found-for-id-during-reindex/206169)
**Author:** [@tomhe](https://discuss.elastic.co/u/tomhe)\ **Replies:** 1\ **Last updated:** [November 8, 2019, 1:39pm UTC](https://discuss.elastic.co/t/no-search-context-found-for-id-during-reindex/206169 "2019-11-08T13:39:40Z")
I've started to get the following exception during reindex operations: elasticsearch.exceptions.NotFoundError: NotFoundError(404, 'search\_phase\_execution\_exception', 'No search context found for id \[3764110\]') What can… --- ## [Match\_phrase + fuzziness query porting from ES 1.7.x to ES 7.1.x](https://discuss.elastic.co/t/match-phrase-fuzziness-query-porting-from-es-1-7-x-to-es-7-1-x/207109)
**Author:** [@joneslee85](https://discuss.elastic.co/u/joneslee85)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/match-phrase-fuzziness-query-porting-from-es-1-7-x-to-es-7-1-x/207109 "2019-11-08T12:25:59Z")
Here is my ES 1.7.x match\_phrase query with fuzziness # https://www.elastic.co/guide/en/elasticsearch/reference/1.7/query-dsl-match-query.html # ES 1.7.x { "match\_phrase": { "highlightable": { "query": "this… --- ## [Issues with searching data in array](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 9\ **Last updated:** [November 8, 2019, 12:25pm UTC](https://discuss.elastic.co/t/issues-with-searching-data-in-array/204420 "2019-11-08T12:25:30Z")
Hi Team, Issues in searching the data in kibana. It is not working as expected. The situation is The kind of logs which are collected are firewall logs There are 2 fields Action and matches.action Action specif… --- ## [Get distinct term values but order by another value](https://discuss.elastic.co/t/get-distinct-term-values-but-order-by-another-value/206012)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 2\ **Last updated:** [November 8, 2019, 12:05pm UTC](https://discuss.elastic.co/t/get-distinct-term-values-but-order-by-another-value/206012 "2019-11-08T12:05:06Z")
Hello, I struggling with a query to get the unique values for a term called metric from my index while sorting the result on a different (numeric) field: metric\_order. Consider below example: metric: metric\_order: A … --- ## [No doc was generated while rollup job stats indicate processing](https://discuss.elastic.co/t/no-doc-was-generated-while-rollup-job-stats-indicate-processing/207076)
**Author:** [@simmonHuong](https://discuss.elastic.co/u/simmonHuong)\ **Replies:** 0\ **Last updated:** [November 8, 2019, 9:14am UTC](https://discuss.elastic.co/t/no-doc-was-generated-while-rollup-job-stats-indicate-processing/207076 "2019-11-08T09:14:31Z")
{ "config": { "id": "rollup\_myindex\_2018\_by\_7d", "index\_pattern": "myindex\_2018\*", "rollup\_index": "rolledup\_myindex\_2018", "cron": "0 \* \* \* \* ?", "groups": { "date\_histogram": { "inte… --- ## [Array of strings](https://discuss.elastic.co/t/array-of-strings/207075)
**Author:** [@irfanh94](https://discuss.elastic.co/u/irfanh94)\ **Replies:** 3\ **Last updated:** [November 8, 2019, 10:30am UTC](https://discuss.elastic.co/t/array-of-strings/207075 "2019-11-08T10:30:09Z")
Hey folks, I have this mapping for vehicles: "vehicles" : { "type": "text" } And documents inside, are like: "vehicles" : \[ "triumph daytona 750 749 1992", "triumph trident 750 2018" \] My questio… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1098) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1100)