# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1101 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1102 --- ## [\[Elastic 7.2.1\] Problem creating a cluster from 3 single nodes](https://discuss.elastic.co/t/elastic-7-2-1-problem-creating-a-cluster-from-3-single-nodes/206798)
**Author:** [@lexav1978](https://discuss.elastic.co/u/lexav1978)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 9:11am UTC](https://discuss.elastic.co/t/elastic-7-2-1-problem-creating-a-cluster-from-3-single-nodes/206798 "2019-11-07T09:11:00Z")
Hello, I have 3 elastic servers initially in standalone mode, and I wanted to create a cluster with those 3 servers. I configure them but the cluster/health tells me that there is only one node in my cluster. The clus… --- ## [How to query the docs of an index having the time filter is null](https://discuss.elastic.co/t/how-to-query-the-docs-of-an-index-having-the-time-filter-is-null/206814)
**Author:** [@geethusureshkrishna](https://discuss.elastic.co/u/geethusureshkrishna)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 9:09am UTC](https://discuss.elastic.co/t/how-to-query-the-docs-of-an-index-having-the-time-filter-is-null/206814 "2019-11-07T09:09:13Z")
Some of the docs in an index having the time filter is null/none/no value. How to create a GET query to filter out those documents? --- ## [Red Health on Elasticsearch](https://discuss.elastic.co/t/red-health-on-elasticsearch/206927)
**Author:** [@antonopo](https://discuss.elastic.co/u/antonopo)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 9:05am UTC](https://discuss.elastic.co/t/red-health-on-elasticsearch/206927 "2019-11-07T09:05:18Z")
Hi, Everyday i am facing red health on Elasticsearch. Then i am chencking the indices under index management and i am seeing one or two red metricbeat indices. After i marked them and i deleted them the cluster health c… --- ## [How to set the JVM Garbage Collector logs to the stdout and not in /var/log/elasticsearch/gc.log](https://discuss.elastic.co/t/how-to-set-the-jvm-garbage-collector-logs-to-the-stdout-and-not-in-var-log-elasticsearch-gc-log/206922)
**Author:** [@missmarior](https://discuss.elastic.co/u/missmarior)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 9:03am UTC](https://discuss.elastic.co/t/how-to-set-the-jvm-garbage-collector-logs-to-the-stdout-and-not-in-var-log-elasticsearch-gc-log/206922 "2019-11-07T09:03:58Z")
Hello, I would like to put an option in my docker-compose.yml (ES\_JAVA\_OPTS) to say at the JVM to write logs on the stdout but if I give the stdout path, it says that I don't have the rights ("permission denied") and I … --- ## [Failed to start elasticsearch.service](https://discuss.elastic.co/t/failed-to-start-elasticsearch-service/206895)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 9:01am UTC](https://discuss.elastic.co/t/failed-to-start-elasticsearch-service/206895 "2019-11-07T09:01:09Z")
Hi, I am trying to start elasticsearch service using these commands, sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable elasticsearch.service sudo systemctl start elasticsearch.service but i get this, Fail… --- ## [Add more data nodes or more RAM/disk space to existed nodes?](https://discuss.elastic.co/t/add-more-data-nodes-or-more-ram-disk-space-to-existed-nodes/206877)
**Author:** [@yiy](https://discuss.elastic.co/u/yiy)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 7:09am UTC](https://discuss.elastic.co/t/add-more-data-nodes-or-more-ram-disk-space-to-existed-nodes/206877 "2019-11-07T07:09:03Z")
This is how our current cluster setup on VMWARE: 3 master nodes: 8G RAM each, plus 2 data nodes: 8G RAM/ 500GB disk space, each on different physical disk for redundancy. Recently we just started collecting NetFlow da… --- ## [Per second aggregation across documents](https://discuss.elastic.co/t/per-second-aggregation-across-documents/205661)
**Author:** [@Madala](https://discuss.elastic.co/u/Madala)\ **Replies:** 5\ **Last updated:** [November 7, 2019, 6:52am UTC](https://discuss.elastic.co/t/per-second-aggregation-across-documents/205661 "2019-11-07T06:52:05Z")
Hi Team, We are using ES as analytics engine for our video platform. Users watch videos and we capture what second of the video is watched in every session. We have a use case where we need to plot a retention graph for… --- ## [Master not discovered, removed nodes have been totally destroyed](https://discuss.elastic.co/t/master-not-discovered-removed-nodes-have-been-totally-destroyed/206143)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 7\ **Last updated:** [November 6, 2019, 11:49am UTC](https://discuss.elastic.co/t/master-not-discovered-removed-nodes-have-been-totally-destroyed/206143 "2019-11-06T11:49:58Z")
Hi, I have removed half of nodes of cluster, and the removed nodes and machines have been totally destroyed. the existing cluster log like: master not discovered or elected yet, an election requires at least nodes wit… --- ## [Wrong doc\_count on Children Aggregation](https://discuss.elastic.co/t/wrong-doc-count-on-children-aggregation/206903)
**Author:** [@DeeeFOX](https://discuss.elastic.co/u/DeeeFOX)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 6:26am UTC](https://discuss.elastic.co/t/wrong-doc-count-on-children-aggregation/206903 "2019-11-07T06:26:47Z")
request: POST /test\_tsdb\_alias/\_search?routing=ms\_nginxgas3\_count&track\_total\_hits=true { "query": { "bool": { "filter": \[ { "has\_parent": { "parent\_type": "t", "que… --- ## [Cluster elasticsearch on basic license](https://discuss.elastic.co/t/cluster-elasticsearch-on-basic-license/206733)
**Author:** [@Mohammad\_Mousavi](https://discuss.elastic.co/u/Mohammad_Mousavi)\ **Replies:** 5\ **Last updated:** [November 7, 2019, 6:13am UTC](https://discuss.elastic.co/t/cluster-elasticsearch-on-basic-license/206733 "2019-11-07T06:13:26Z")
Hi, I have 1 elasticsearch node, I've installed another node in another DC. Now I wanna have a cluster between 2 node so data can be HA. Based on documentations I've added this config (on master): cluster.name: mycluste… --- ## [How To Add a New Field, Then Populate It Based On Another Field's Value?](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [November 7, 2019, 12:43am UTC](https://discuss.elastic.co/t/how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206190 "2019-11-07T00:43:11Z")
Hello Elasticsearch Sorcerers, I am running Logstash v7.4.0 and Elasticsearch v7.4.0 in a nicely-working pipeline. My chain of fruit stores are sending my sales information to Logstash; Logstash then pushes that data t… --- ## [NEST SortScriptDescriptor class](https://discuss.elastic.co/t/nest-sortscriptdescriptor-class/206724)
**Author:** [@Paulo\_Henrique\_PH](https://discuss.elastic.co/u/Paulo_Henrique_PH)\ **Replies:** 1\ **Last updated:** [November 7, 2019, 12:16am UTC](https://discuss.elastic.co/t/nest-sortscriptdescriptor-class/206724 "2019-11-07T00:16:05Z")
Hi guys, I was using the "SortScriptDescriptor" class in this part of a c# app: SortScriptDescriptor\ sortScriptDescriptor = new SortScriptDescriptor\(); if (sort… --- ## [Question on missing documents, timeouts, shard failures, and partial search results](https://discuss.elastic.co/t/question-on-missing-documents-timeouts-shard-failures-and-partial-search-results/206869)
**Author:** [@loren](https://discuss.elastic.co/u/loren)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 10:42pm UTC](https://discuss.elastic.co/t/question-on-missing-documents-timeouts-shard-failures-and-partial-search-results/206869 "2019-11-06T22:42:45Z")
ES7.4. I have queries that perform ID searches on documents I know exist in the index (which has 1 replica). As a sanity check, I raise an error if I get back less than 100%. This is rare but it happens. The cluster is u… --- ## [Rollover request failed but the index is created](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091)
**Author:** [@Alex\_Huo](https://discuss.elastic.co/u/Alex_Huo)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 9:23pm UTC](https://discuss.elastic.co/t/rollover-request-failed-but-the-index-is-created/206091 "2019-11-06T21:23:29Z")
Hey there, I got a 503 response when using \_rollover API. Here is the response. { "error": { "root\_cause": \[ { "type": "process\_cluster\_event\_timeout\_exception", … --- ## [Error in track preparator: The provided corpus \['DATA\_C\_corpus'\] does not match any of the corpora \['DATA\_A\_corpus', 'DATA\_B\_corpus', 'DATA\_C\_corpus'\]](https://discuss.elastic.co/t/error-in-track-preparator-the-provided-corpus-data-c-corpus-does-not-match-any-of-the-corpora-data-a-corpus-data-b-corpus-data-c-corpus/206478)
**Author:** [@toneyalexander](https://discuss.elastic.co/u/toneyalexander)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 8:46pm UTC](https://discuss.elastic.co/t/error-in-track-preparator-the-provided-corpus-data-c-corpus-does-not-match-any-of-the-corpora-data-a-corpus-data-b-corpus-data-c-corpus/206478 "2019-11-06T20:46:54Z")
I'm getting the error in the title on a custom track, and this related question ( https://discuss.elastic.co/t/error-in-load-generator-the-provided-corpus-does-not-match-any-of-the-corpora/185540 ) has no answer. The tr… --- ## [Find top 10 documents when 1 document matches criteria](https://discuss.elastic.co/t/find-top-10-documents-when-1-document-matches-criteria/206696)
**Author:** [@kidrik](https://discuss.elastic.co/u/kidrik)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 8:20pm UTC](https://discuss.elastic.co/t/find-top-10-documents-when-1-document-matches-criteria/206696 "2019-11-06T20:20:13Z")
I have an index with over 30M documents. Every document has a parentId field and a createdOn field. Modified documents have a modifiedOn field. Dates are stored as epoch\_millis. I need to find the top 10 most-recent … --- ## [Per/Node Ip FIlters in Cluster Settings](https://discuss.elastic.co/t/per-node-ip-filters-in-cluster-settings/199384)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 7:35pm UTC](https://discuss.elastic.co/t/per-node-ip-filters-in-cluster-settings/199384 "2019-11-06T19:35:23Z")
Hello, Currently we are setting the xpack.security.http.filter.allow directive in elasticsearch.yml on all our nodes (12). The configuration is different for master / data nodes and ingest/coordination nodes. This mean… --- ## [What roles are needed for a user to create, write, & delete watchers?](https://discuss.elastic.co/t/what-roles-are-needed-for-a-user-to-create-write-delete-watchers/206440)
**Author:** [@Matt\_McGovern](https://discuss.elastic.co/u/Matt_McGovern)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 7:23pm UTC](https://discuss.elastic.co/t/what-roles-are-needed-for-a-user-to-create-write-delete-watchers/206440 "2019-11-06T19:23:06Z")
We have a user defined for this purpose which has the watcher\_admin role, but when we do a put to create a watcher we get the error msg: cluster:admin/script/put is unauthorized for this user. If the watcher\_admin role … --- ## [Curator - Delete oldest index](https://discuss.elastic.co/t/curator-delete-oldest-index/205875)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 5\ **Last updated:** [November 6, 2019, 5:36pm UTC](https://discuss.elastic.co/t/curator-delete-oldest-index/205875 "2019-11-06T17:36:08Z")
Hi, Is there a way to identify the oldest index and delete that using curator? Basically, we want to rollover a index when they meet a size of 10GB and when we get 45 indices in total, we want to remove the oldest inde… --- ## [Curator ssl\_no\_validate: True helm option doesn't work](https://discuss.elastic.co/t/curator-ssl-no-validate-true-helm-option-doesnt-work/206748)
**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 5:31pm UTC](https://discuss.elastic.co/t/curator-ssl-no-validate-true-helm-option-doesnt-work/206748 "2019-11-06T17:31:45Z")
I needed to enable TLS on elasticsearch just to make pods stable after restart(they didn't get up if TLS is disabled). I don't want to have any TLS validation and so on just to make things easier (we have security enable… --- ## [Invalid index name \[\_watcher\], must not start with '\_', '-', or '+'"](https://discuss.elastic.co/t/invalid-index-name-watcher-must-not-start-with-or/203930)
**Author:** [@mv007](https://discuss.elastic.co/u/mv007)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 4:54pm UTC](https://discuss.elastic.co/t/invalid-index-name-watcher-must-not-start-with-or/203930 "2019-11-06T16:54:11Z")
Hello All, I am a newbie in ELK and still learning it. I am planning to setup a watcher functionality. Below is the watcher definition that i have written, I have just followed the online document. However, I am not… --- ## [Terms lookup in a filtered alias](https://discuss.elastic.co/t/terms-lookup-in-a-filtered-alias/206838)
**Author:** [@jmccaskill](https://discuss.elastic.co/u/jmccaskill)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:46pm UTC](https://discuss.elastic.co/t/terms-lookup-in-a-filtered-alias/206838 "2019-11-06T16:46:51Z")
Hello, is a terms lookup query in a filtered alias supposed to be supported? In 6.7.1 and 7.4.2 I am able to execute a terms lookup query directly against an index, but if I try to define a filtered alias on that index … --- ## [Question on Distros](https://discuss.elastic.co/t/question-on-distros/206822)
**Author:** [@cramos](https://discuss.elastic.co/u/cramos)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 4:27pm UTC](https://discuss.elastic.co/t/question-on-distros/206822 "2019-11-06T16:27:02Z")
All, I am fairly new to ELK, and I am having a hard time reconciling the different distros in my head. Is the OSS distro: https://www.elastic.co/downloads/elasticsearch-oss The same as the OpenDistro: https://opendist… --- ## [How to grant roles from other system to elasticsearch?](https://discuss.elastic.co/t/how-to-grant-roles-from-other-system-to-elasticsearch/206829)
**Author:** [@lethienhoang](https://discuss.elastic.co/u/lethienhoang)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 3:56pm UTC](https://discuss.elastic.co/t/how-to-grant-roles-from-other-system-to-elasticsearch/206829 "2019-11-06T15:56:11Z")
At work. User want to log data to elasticsearch(development by C#, NEST, ..) In the system, I have a lot user with multiple roles in my sql and UI search data from elasticsearch. But I have a problem. User want to logi… --- ## [How do I implement exact full text search on an index created by fscrawler](https://discuss.elastic.co/t/how-do-i-implement-exact-full-text-search-on-an-index-created-by-fscrawler/206617)
**Author:** [@Denn](https://discuss.elastic.co/u/Denn)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 1:39pm UTC](https://discuss.elastic.co/t/how-do-i-implement-exact-full-text-search-on-an-index-created-by-fscrawler/206617 "2019-11-06T13:39:59Z")
I have an index that I created with fscrawler... How do I do a full text search on the content so that it matches words exactly even the cases? if ($q2 == '') { $params = \[ 'index' =\> 'trial2', 'body' =\> \[ 'quer… --- ## [Sort nested fields cross parent documents](https://discuss.elastic.co/t/sort-nested-fields-cross-parent-documents/206799)
**Author:** [@permagne](https://discuss.elastic.co/u/permagne)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 1:37pm UTC](https://discuss.elastic.co/t/sort-nested-fields-cross-parent-documents/206799 "2019-11-06T13:37:25Z")
Hi, We have a model that looks something like this: Order: { properties: { ... shipments: { type: "nested", properties: { ... deliveryDate: { type: "date" }, } } } } We need to be able to searc… --- ## [No Handlers could be found for logger "elasticsearch"](https://discuss.elastic.co/t/no-handlers-could-be-found-for-logger-elasticsearch/206117)
**Author:** [@tharu85](https://discuss.elastic.co/u/tharu85)\ **Replies:** 16\ **Last updated:** [November 6, 2019, 1:20pm UTC](https://discuss.elastic.co/t/no-handlers-could-be-found-for-logger-elasticsearch/206117 "2019-11-06T13:20:29Z")
I have created a python script to create snapshot on elasticsearch including elasticsearch-curator library. How ever this script worked perfectly more than one year and suddenly I got following error. I tried adding logg… --- ## [Install curator on windows](https://discuss.elastic.co/t/install-curator-on-windows/206773)
**Author:** [@Anam\_Alfiya](https://discuss.elastic.co/u/Anam_Alfiya)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 1:10pm UTC](https://discuss.elastic.co/t/install-curator-on-windows/206773 "2019-11-06T13:10:12Z")
Is there any step by step guide to install curator v5 on windows-8? --- ## [How to aggregate data on elastic sent by logstash](https://discuss.elastic.co/t/how-to-aggregate-data-on-elastic-sent-by-logstash/205140)
**Author:** [@krishna\_bhargav](https://discuss.elastic.co/u/krishna_bhargav)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 12:14pm UTC](https://discuss.elastic.co/t/how-to-aggregate-data-on-elastic-sent-by-logstash/205140 "2019-11-06T12:14:30Z")
I am working on below schema, grouping multiple households based on the keyinformation. We could achieve this with the logstash aggregate filter. But this is having performance issue and also cannot run with multiple thr… --- ## [Error changing type /mapping from object to nested](https://discuss.elastic.co/t/error-changing-type-mapping-from-object-to-nested/206781)
**Author:** [@kailash](https://discuss.elastic.co/u/kailash)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 11:29am UTC](https://discuss.elastic.co/t/error-changing-type-mapping-from-object-to-nested/206781 "2019-11-06T11:29:33Z")
I am trying to change object type to nested by PUT lfx2\_lp\_prices1/\_mapping { "properties" : { "NoMDEntries" : {"type" : "nested"} } } But getting error "type": "illegal\_argument\_exception", "reaso… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1100) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1102)