# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1102 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1103 --- ## [How to search UTF-8 characters in Elastic Search](https://discuss.elastic.co/t/how-to-search-utf-8-characters-in-elastic-search/206736)
**Author:** [@Sadhiya](https://discuss.elastic.co/u/Sadhiya)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 9:47am UTC](https://discuss.elastic.co/t/how-to-search-utf-8-characters-in-elastic-search/206736 "2019-11-06T09:47:11Z")
I have UTF-8 characters ingested into Elastic search. They got ingested as Json String. When I try to search the documents using Search Query I am getting Parse Error as below: Parse Error: reason : Cannot parse 'm-att… --- ## [How create watcher email alerts and elasticsearch.yml file settings](https://discuss.elastic.co/t/how-create-watcher-email-alerts-and-elasticsearch-yml-file-settings/206314)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 12\ **Last updated:** [November 6, 2019, 9:45am UTC](https://discuss.elastic.co/t/how-create-watcher-email-alerts-and-elasticsearch-yml-file-settings/206314 "2019-11-06T09:45:39Z")
please share step by step configure watcher and elasticsearch.yml file settings and smtp mail configurations . thanks in advance . --- ## [CP of CAP in elasticsearch and one can achieve this by configuration](https://discuss.elastic.co/t/cp-of-cap-in-elasticsearch-and-one-can-achieve-this-by-configuration/206763)
**Author:** [@Abhishek\_Goswami](https://discuss.elastic.co/u/Abhishek_Goswami)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 9:17am UTC](https://discuss.elastic.co/t/cp-of-cap-in-elasticsearch-and-one-can-achieve-this-by-configuration/206763 "2019-11-06T09:17:03Z")
As I am new to elasticsearch \[version 7.4\] and with a lot of studies it is not clear till now how much shards / Nodes are preferred in particular index. As of now, I have configured 3 shards and 2 replicas with 3 Nodes(… --- ## [Group by option with Basic License in Elasticsearch 7.2](https://discuss.elastic.co/t/group-by-option-with-basic-license-in-elasticsearch-7-2/206607)
**Author:** [@skdasari](https://discuss.elastic.co/u/skdasari)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 9:28am UTC](https://discuss.elastic.co/t/group-by-option-with-basic-license-in-elasticsearch-7-2/206607 "2019-11-06T09:28:25Z")
Hello All, License Type: Basic license. Version : Elasticsearch 7.2.1 Problem: Unable to perform Group by search Description: I am trying to generate a report for max\_cpu utilized for all servers for a day. Is it pos… --- ## [Number format](https://discuss.elastic.co/t/number-format/206750)
**Author:** [@Rakesh4](https://discuss.elastic.co/u/Rakesh4)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 9:07am UTC](https://discuss.elastic.co/t/number-format/206750 "2019-11-06T09:07:52Z")
Hi, I have one input as 28 M G ROAD, is there any way ES can generate terms for number as 28,28th, twentyEight etc. Any help appreciated. --- ## [VolumeMounts](https://discuss.elastic.co/t/volumemounts/206759)
**Author:** [@kiran\_kumar1](https://discuss.elastic.co/u/kiran_kumar1)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 9:06am UTC](https://discuss.elastic.co/t/volumemounts/206759 "2019-11-06T09:06:28Z")
Hi Team, while deploying logstash am getting issue like this ,could you please help on this. Events: Type Reason Age From Message Warni… --- ## [ElasticSearch Index combinations of tokens with delimiter](https://discuss.elastic.co/t/elasticsearch-index-combinations-of-tokens-with-delimiter/206747)
**Author:** [@ankur\_singla](https://discuss.elastic.co/u/ankur_singla)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 8:43am UTC](https://discuss.elastic.co/t/elasticsearch-index-combinations-of-tokens-with-delimiter/206747 "2019-11-06T08:43:56Z")
Hey, I am using ES version 6.8.1 & I am indexing below document in index. PUT test/\_doc/1 --\>1 {"test\_data": "hello test 1"} PUT test/\_doc/2 --\>2 {"test\_data": "hello@test@aip"} PUT test/\_doc/3 … --- ## [Why does the field docs.deleted count returns as zero in elasticsearch \_cat/indices API response?](https://discuss.elastic.co/t/why-does-the-field-docs-deleted-count-returns-as-zero-in-elasticsearch-cat-indices-api-response/206537)
**Author:** [@Santu](https://discuss.elastic.co/u/Santu)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 8:56am UTC](https://discuss.elastic.co/t/why-does-the-field-docs-deleted-count-returns-as-zero-in-elasticsearch-cat-indices-api-response/206537 "2019-11-06T08:56:58Z")
Hey, I am using elasticsearch 5.X version. and i have created an index along with some documents. POST /\_bulk { "index" : { "\_index" : "index-a", "\_type" : "type-a", "\_id" : "1" } } { "field" : "value1" } { "create"… --- ## [I want to return only terms of a field](https://discuss.elastic.co/t/i-want-to-return-only-terms-of-a-field/205445)
**Author:** [@dinesh\_c](https://discuss.elastic.co/u/dinesh_c)\ **Replies:** 9\ **Last updated:** [November 6, 2019, 8:56am UTC](https://discuss.elastic.co/t/i-want-to-return-only-terms-of-a-field/205445 "2019-11-06T08:56:09Z")
By using terms aggregation I am getting terms as well as doct count but i need only terms is there a way to get only terms. this is the default response ... "aggregations" : { "genres" : { … --- ## [Stuck in Elasticsearch start in Ubuntu 18.04](https://discuss.elastic.co/t/stuck-in-elasticsearch-start-in-ubuntu-18-04/206367)
**Author:** [@Vignesh\_Raja\_M](https://discuss.elastic.co/u/Vignesh_Raja_M)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 8:54am UTC](https://discuss.elastic.co/t/stuck-in-elasticsearch-start-in-ubuntu-18-04/206367 "2019-11-06T08:54:59Z")
Hi all, i get this error msg when i start the elasticsearch service in my ubuntu looking for the proper solution am using stable version see below echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" |… --- ## [Filter nested field only in aggregation](https://discuss.elastic.co/t/filter-nested-field-only-in-aggregation/206741)
**Author:** [@Quang\_D\_Tr\_n](https://discuss.elastic.co/u/Quang_D_Tr_n)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 8:46am UTC](https://discuss.elastic.co/t/filter-nested-field-only-in-aggregation/206741 "2019-11-06T08:46:16Z")
My index has a nested field, looking like this: "services": { "type": "nested", "properties": { "type": { "type": "ke… --- ## [Index with 5 shards, each shard has reached 50gb](https://discuss.elastic.co/t/index-with-5-shards-each-shard-has-reached-50gb/206530)
**Author:** [@dawood\_abdullah](https://discuss.elastic.co/u/dawood_abdullah)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 8:44am UTC](https://discuss.elastic.co/t/index-with-5-shards-each-shard-has-reached-50gb/206530 "2019-11-06T08:44:10Z")
Hi, All my shards have reached 50gb, below are the details data\_v1 2 r STARTED 167362666 50.1gb 10.0.1.37 node-3 data\_v1 2 r STARTED 167362666 50.7gb 10.0.0.176 node-2 data\_v1 2 p STARTED 167362666 50.6gb 10.0… --- ## [Get number of days in a month to aggregate data](https://discuss.elastic.co/t/get-number-of-days-in-a-month-to-aggregate-data/206028)
**Author:** [@Quang\_D\_Tr\_n](https://discuss.elastic.co/u/Quang_D_Tr_n)\ **Replies:** 6\ **Last updated:** [November 6, 2019, 7:40am UTC](https://discuss.elastic.co/t/get-number-of-days-in-a-month-to-aggregate-data/206028 "2019-11-06T07:40:59Z")
I am trying to get the number of days of a month from a timestamp field, and then, divide the one numeric field by this number of days. Right now, my implementation is like this: { "query" : {...}, "script\_fiel… --- ## [\_source\_includes on a tree](https://discuss.elastic.co/t/source-includes-on-a-tree/206438)
**Author:** [@SRALK](https://discuss.elastic.co/u/SRALK)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 7:24am UTC](https://discuss.elastic.co/t/source-includes-on-a-tree/206438 "2019-11-06T07:24:51Z")
Hello, I have a document which contains a tree (of unknown depth) with a lot of information and i want to get only a subset of the data of each node (ex: only the key hello in the following example). { "id": 42, … --- ## [Tutorial on using the full ELK Stack](https://discuss.elastic.co/t/tutorial-on-using-the-full-elk-stack/206731)
**Author:** [@Tunin](https://discuss.elastic.co/u/Tunin)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 7:04am UTC](https://discuss.elastic.co/t/tutorial-on-using-the-full-elk-stack/206731 "2019-11-06T07:04:05Z")
Hi, do you have any tutorial on how I can start using the elastic stack - elk? I need to do a POC and would like to briefly explain the advantages of ELK. if you have any idea on a quick and dirty doc, please let me k… --- ## [How to store reference data in Elasticsearch](https://discuss.elastic.co/t/how-to-store-reference-data-in-elasticsearch/206730)
**Author:** [@SunilSMenon](https://discuss.elastic.co/u/SunilSMenon)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 5:58am UTC](https://discuss.elastic.co/t/how-to-store-reference-data-in-elasticsearch/206730 "2019-11-06T05:58:43Z")
Hi, We are using ELK for application logs, we want the elasticsearch to refer the application master data which is stored in another system. Objective being the Kibana user can see their applications in their visualiza… --- ## [Search across multiple indices for the same field](https://discuss.elastic.co/t/search-across-multiple-indices-for-the-same-field/206349)
**Author:** [@Ashish1](https://discuss.elastic.co/u/Ashish1)\ **Replies:** 8\ **Last updated:** [November 6, 2019, 5:53am UTC](https://discuss.elastic.co/t/search-across-multiple-indices-for-the-same-field/206349 "2019-11-06T05:53:58Z")
Hello all, I am working on an event based dataset where let's say there is a central customer index and multiple indexes for different events types, say index event\_1, event\_2, event\_3. I want to search across all the … --- ## [Error: no repository definition for http://helm.elastic.co/](https://discuss.elastic.co/t/error-no-repository-definition-for-http-helm-elastic-co/206220)
**Author:** [@pedro.pacm](https://discuss.elastic.co/u/pedro.pacm)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 4:42am UTC](https://discuss.elastic.co/t/error-no-repository-definition-for-http-helm-elastic-co/206220 "2019-11-06T04:42:16Z")
Hi, I have a kubernetes cluster managed by a default Gitlab account. All services are deployed through Gitlabs's CI/CD, so I'm not able to hand Helm directly. I created a custom Helm chart and added the Elasticsearch c… --- ## [Are core security features in ELK free?](https://discuss.elastic.co/t/are-core-security-features-in-elk-free/192020)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 4\ **Last updated:** [August 8, 2019, 7:01am UTC](https://discuss.elastic.co/t/are-core-security-features-in-elk-free/192020 "2019-08-08T07:01:29Z")
Hi, I'm just exploring about the x-pack security features and i have gone through the blog saying core security in Elasticsearch are free : And my query is: Do i get these core security features free if install ELK… --- ## [Authentication issue with elastic user](https://discuss.elastic.co/t/authentication-issue-with-elastic-user/206702)
**Author:** [@learnelastic](https://discuss.elastic.co/u/learnelastic)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 1:31am UTC](https://discuss.elastic.co/t/authentication-issue-with-elastic-user/206702 "2019-11-06T01:31:37Z")
Hello, I successfully changed the password using - elasticsearch-7.4.2/bin/elasticsearch-setup-passwords interactive but not able to use the changed password. Authentication is failing. { "error" : { "root\_cause" :… --- ## [Is ES smart enough to identify a node in a cluster if its IP has been changed?](https://discuss.elastic.co/t/is-es-smart-enough-to-identify-a-node-in-a-cluster-if-its-ip-has-been-changed/206701)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 1:30am UTC](https://discuss.elastic.co/t/is-es-smart-enough-to-identify-a-node-in-a-cluster-if-its-ip-has-been-changed/206701 "2019-11-06T01:30:31Z")
--- ## [Shard Allocation \_name takes bogus name](https://discuss.elastic.co/t/shard-allocation-name-takes-bogus-name/206681)
**Author:** [@naoko](https://discuss.elastic.co/u/naoko)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 10:27pm UTC](https://discuss.elastic.co/t/shard-allocation-name-takes-bogus-name/206681 "2019-11-05T22:27:48Z")
I want to send a certain index to a set of nodes. I see shard allocation filtering seems to be what I need so that different apps (different index) impact set of nodes. I put settings with "index.routing.allocation.inc… --- ## [ILM: Routing data based on AWS availability zones](https://discuss.elastic.co/t/ilm-routing-data-based-on-aws-availability-zones/204713)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 8:42pm UTC](https://discuss.elastic.co/t/ilm-routing-data-based-on-aws-availability-zones/204713 "2019-11-05T20:42:58Z")
We currently have hot and warm nodes spread around 3 availability zones (AZ) in AWS. I want to start using ILM, and I'd like to know how to configure the data transfer between warm and hot nodes so that hot nodes in an … --- ## [Watch docker container up or down](https://discuss.elastic.co/t/watch-docker-container-up-or-down/206092)
**Author:** [@Benoit\_Martin](https://discuss.elastic.co/u/Benoit_Martin)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 8:30pm UTC](https://discuss.elastic.co/t/watch-docker-container-up-or-down/206092 "2019-11-05T20:30:15Z")
I try to create a watch to alert if one or much from a list of specific container is down. I already use metricbeat to gather the docker container metric. I need help to define this watch. It is not so simple :slight\_smi… --- ## [getDayOfWeek() return type change in 7.0](https://discuss.elastic.co/t/getdayofweek-return-type-change-in-7-0/206494)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 8:16pm UTC](https://discuss.elastic.co/t/getdayofweek-return-type-change-in-7-0/206494 "2019-11-05T20:16:18Z")
Hi, We are seeing the following deprecation log messages in our 6.8 cluster: The return type of \[getDayOfWeek()\] will change to an enum in 7.0. Use getDayOfWeekEnum().getValue(). However, having upgraded our test clus… --- ## [Your distribution is broken](https://discuss.elastic.co/t/your-distribution-is-broken/206638)
**Author:** [@pditommaso](https://discuss.elastic.co/u/pditommaso)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 7:55pm UTC](https://discuss.elastic.co/t/your-distribution-is-broken/206638 "2019-11-05T19:55:50Z")
Running Elasticsearch with the following command docker run -d --name elasticsearch --rm --name es -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" elasticsearch:6.8.4 I'm getting the following error on a basi… --- ## [Adding metadata to a query for slow log analysis](https://discuss.elastic.co/t/adding-metadata-to-a-query-for-slow-log-analysis/206664)
**Author:** [@rocky67z](https://discuss.elastic.co/u/rocky67z)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 6:55pm UTC](https://discuss.elastic.co/t/adding-metadata-to-a-query-for-slow-log-analysis/206664 "2019-11-05T18:55:18Z")
I have reviewed the Elasticsearch reference and have been unable to identify a way to add miscellaneous metadata to a query (not as query parameters to match/filter results), but instead specifically for the purposes of … --- ## [Cluster Error: data too large - marking and sending shards](https://discuss.elastic.co/t/cluster-error-data-too-large-marking-and-sending-shards/206663)
**Author:** [@Jorge\_Rodrigo\_Bogado](https://discuss.elastic.co/u/Jorge_Rodrigo_Bogado)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 6:51pm UTC](https://discuss.elastic.co/t/cluster-error-data-too-large-marking-and-sending-shards/206663 "2019-11-05T18:51:22Z")
Hi, i had a power issue and the cluster had been down for nearly 10 hours. Now I have the following outputs: http://serverip:9200/\_cluster/health cluster\_name "cluster-name" status "yellow" timed\_out false … --- ## [Backups with Curator](https://discuss.elastic.co/t/backups-with-curator/202509)
**Author:** [@dawid](https://discuss.elastic.co/u/dawid)\ **Replies:** 4\ **Last updated:** [November 5, 2019, 4:49pm UTC](https://discuss.elastic.co/t/backups-with-curator/202509 "2019-11-05T16:49:27Z")
Hi, I am doing a monthly backups of indices (backing up everything older than a month to a backup repository) and then deleting those indices from Elasticsearch using Curator snapshot and delete indices actions. My que… --- ## [Failing scripted field in Elastic 7.4.2](https://discuss.elastic.co/t/failing-scripted-field-in-elastic-7-4-2/206503)
**Author:** [@ShaneLillie\_RAD](https://discuss.elastic.co/u/ShaneLillie_RAD)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 4:40pm UTC](https://discuss.elastic.co/t/failing-scripted-field-in-elastic-7-4-2/206503 "2019-11-05T16:40:02Z")
Hi, I have the following Painless scripted field in Kibana: return doc\['a'\].size() != 0 && doc\['b'\].size() != 0 && doc\['a'\].value == doc\['b'\].value; And I'm not sure why but that is giving me the following error: No … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1101) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1103)