# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1103 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1104 --- ## [Get /myindex/\_search - return just 1 or 2 Fields not the whole Bucket or Document](https://discuss.elastic.co/t/get-myindex-search-return-just-1-or-2-fields-not-the-whole-bucket-or-document/206632)
**Author:** [@Datakids](https://discuss.elastic.co/u/Datakids)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 3:55pm UTC](https://discuss.elastic.co/t/get-myindex-search-return-just-1-or-2-fields-not-the-whole-bucket-or-document/206632 "2019-11-05T15:55:42Z")
Hi all, im stuck in how to use the search in right way. What I did to get all out of my Index: PUT /myindex/\_settings { "index" : { "max\_result\_window" : 100000 } } Now with following GET Request I can show all the i… --- ## [Status : timeout when I'm starting Elasticsearch](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 2:33pm UTC](https://discuss.elastic.co/t/status-timeout-when-im-starting-elasticsearch/206374 "2019-11-05T14:33:13Z")
Hi ! I just begin to learn the environment ELK one week ago and try to install Elasticsearch on my Debian 10 'Buster'. But I have a really big problem, when I'm doing "systemctl start elasticsearch.service" I got : A… --- ## [Elasticsearch 7 mappping on Elasticsearch 6](https://discuss.elastic.co/t/elasticsearch-7-mappping-on-elasticsearch-6/203681)
**Author:** [@pavolloffay](https://discuss.elastic.co/u/pavolloffay)\ **Replies:** 7\ **Last updated:** [November 5, 2019, 2:30pm UTC](https://discuss.elastic.co/t/elasticsearch-7-mappping-on-elasticsearch-6/203681 "2019-11-05T14:30:44Z")
Hello, is it possible to use Elasticsearch 7 mapping (with no types) on any version of Elasticsearch 6? For instance this mapping: { "mappings":{ "properties":{ "serviceName":{ "type":"keyword", … --- ## [How to change the json objects mapping to geo\_point](https://discuss.elastic.co/t/how-to-change-the-json-objects-mapping-to-geo-point/205438)
**Author:** [@irobot678](https://discuss.elastic.co/u/irobot678)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 2:15pm UTC](https://discuss.elastic.co/t/how-to-change-the-json-objects-mapping-to-geo-point/205438 "2019-11-05T14:15:13Z")
HI, i'm using elk stack of version 7.1.1 with x-pack installed and I have follwing json data in elasticsearch { "id":"someid", "geometry":{ "type": "Point", "coordinates":\[ -76, -10… --- ## [Max size by index?¿](https://discuss.elastic.co/t/max-size-by-index/206411)
**Author:** [@Daniel\_Glez](https://discuss.elastic.co/u/Daniel_Glez)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 2:14pm UTC](https://discuss.elastic.co/t/max-size-by-index/206411 "2019-11-05T14:14:06Z")
Hi, sorry for my kid question. I have just a node with elasticsearch, also a logstash with filebeat in varius nodes. My ask is: ¿I can limit the total size of index? I haven´t may HDD and I need limit it. Any idea? I… --- ## [In ES how can we find that which process is going currently if cpu load is high](https://discuss.elastic.co/t/in-es-how-can-we-find-that-which-process-is-going-currently-if-cpu-load-is-high/204057)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 2:12pm UTC](https://discuss.elastic.co/t/in-es-how-can-we-find-that-which-process-is-going-currently-if-cpu-load-is-high/204057 "2019-11-05T14:12:33Z")
Hi everyone, I m new in ES, I want to that which process is currently running when CPU load is high or any time. --- ## [Quickstart ECK SecurityContext.RunAsUser is forbidden](https://discuss.elastic.co/t/quickstart-eck-securitycontext-runasuser-is-forbidden/206622)
**Author:** [@nfickas](https://discuss.elastic.co/u/nfickas)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 2:04pm UTC](https://discuss.elastic.co/t/quickstart-eck-securitycontext-runasuser-is-forbidden/206622 "2019-11-05T14:04:52Z")
I am currently trying to deploy Elasticsearch onto my kubernetes cluster that is managed via PKS. I was able to successfully start the elastic-operator and install the CRD's. When attempting to deploy an Elasticsearch cl… --- ## [Rollup Aggregation Mismatch in results](https://discuss.elastic.co/t/rollup-aggregation-mismatch-in-results/206621)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:58pm UTC](https://discuss.elastic.co/t/rollup-aggregation-mismatch-in-results/206621 "2019-11-05T13:58:35Z")
ELK - 7.4.1 I have indices in the form of clicks-2019-07-01 date format. I created an index as clicks-2019-07\* and rollup with the aggregation to find the value count of specific term id. Index: clicks-2019-07\* … --- ## [Sorting on value from script field](https://discuss.elastic.co/t/sorting-on-value-from-script-field/206377)
**Author:** [@hiimcarsten](https://discuss.elastic.co/u/hiimcarsten)\ **Replies:** 4\ **Last updated:** [November 5, 2019, 1:51pm UTC](https://discuss.elastic.co/t/sorting-on-value-from-script-field/206377 "2019-11-05T13:51:55Z")
Hello everyone, The result of my executed query should be a number of documents including script fields, and optionally some sorting. The script fields rely on real-time data I am passing in the params, so the script fi… --- ## [Elasticsearch Search queries are slow for the first few attempts](https://discuss.elastic.co/t/elasticsearch-search-queries-are-slow-for-the-first-few-attempts/206620)
**Author:** [@pjaikumar](https://discuss.elastic.co/u/pjaikumar)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:29pm UTC](https://discuss.elastic.co/t/elasticsearch-search-queries-are-slow-for-the-first-few-attempts/206620 "2019-11-05T13:29:22Z")
Hi, We are facing a latency issue with queries where it takes up-to 9 secs for the first time and then slowly it reduces to 5s,3s..etc and eventually it comes lighting fast with less than 150 millisecond. Again it goes … --- ## [Index \[filebeat-7.4.1-YYYY.MM.DD\] is not the write index for alias \[filebeat-7.4.1\]](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405)
**Author:** [@rverchere](https://discuss.elastic.co/u/rverchere)\ **Replies:** 1\ **Last updated:** [November 5, 2019, 1:22pm UTC](https://discuss.elastic.co/t/index-filebeat-7-4-1-yyyy-mm-dd-is-not-the-write-index-for-alias-filebeat-7-4-1/206405 "2019-11-05T13:22:00Z")
Hi, After installation on 1 filebeat agent to a new 7.4.1 Elastic cluster, I have the following errors on my filebeat indices: Index lifecycle error illegal\_argument\_exception: index \[filebeat-7.4.1-2019.11.04\] is not… --- ## [Elasticsearch shard rebalancing not working properly, should we delete a shard manually in ES?](https://discuss.elastic.co/t/elasticsearch-shard-rebalancing-not-working-properly-should-we-delete-a-shard-manually-in-es/206614)
**Author:** [@yash.tandon](https://discuss.elastic.co/u/yash.tandon)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-shard-rebalancing-not-working-properly-should-we-delete-a-shard-manually-in-es/206614 "2019-11-05T13:00:31Z")
--- ## [Manage index created by roll-up job with ILM policy](https://discuss.elastic.co/t/manage-index-created-by-roll-up-job-with-ilm-policy/206609)
**Author:** [@mi\_do](https://discuss.elastic.co/u/mi_do)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 12:35pm UTC](https://discuss.elastic.co/t/manage-index-created-by-roll-up-job-with-ilm-policy/206609 "2019-11-05T12:35:48Z")
Hello, I have a daily index created by logstash and pushed to elasticsearch. From this daily index I've created a new index using a roll-up job. The issue I have is that this newly created index is getting bigger and … --- ## [With FSCrawler 2.7 I am not able to index pdf and other types of documents which worked fine with 2.6](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246)
**Author:** [@rkmohapatra](https://discuss.elastic.co/u/rkmohapatra)\ **Replies:** 8\ **Last updated:** [November 5, 2019, 12:35pm UTC](https://discuss.elastic.co/t/with-fscrawler-2-7-i-am-not-able-to-index-pdf-and-other-types-of-documents-which-worked-fine-with-2-6/206246 "2019-11-05T12:35:44Z")
FSCrawler log says this. \[Elasticsearch exception \[type=mapper\_parsing\_exception, reason=failed to parse\]\]; nested: ElasticsearchException\[Elasticsearch exception \[type=illegal\_argument\_exception, reason=Malformed conte… --- ## [\_id is consuming a lot of the fielddata memory](https://discuss.elastic.co/t/id-is-consuming-a-lot-of-the-fielddata-memory/205933)
**Author:** [@aryon](https://discuss.elastic.co/u/aryon)\ **Replies:** 11\ **Last updated:** [November 5, 2019, 12:28pm UTC](https://discuss.elastic.co/t/id-is-consuming-a-lot-of-the-fielddata-memory/205933 "2019-11-05T12:28:05Z")
Hello, I have a 3 node cluster (16 vCPU, 64 GB of RAM, 3 Tb of data per node, JVM Heap at 30GB) with 450 indices (1 primary shard and 1 replica per indice). Following an upgrade from 6.7 to 6.8, the activation of TLS o… --- ## [Parent Aggregation Doc Count At Child Level](https://discuss.elastic.co/t/parent-aggregation-doc-count-at-child-level/206441)
**Author:** [@Justin\_Cross1](https://discuss.elastic.co/u/Justin_Cross1)\ **Replies:** 0\ **Last updated:** [November 4, 2019, 4:41pm UTC](https://discuss.elastic.co/t/parent-aggregation-doc-count-at-child-level/206441 "2019-11-04T16:41:50Z")
I am using parent-child mapping and have a query using has\_parent where I search on parent fields and it returns the children. Then in there I also have a filter on the child fields as well. That is working good. But n… --- ## [Can we use ELK under basic license for develope and sell our software and use ELK us monitoring module?](https://discuss.elastic.co/t/can-we-use-elk-under-basic-license-for-develope-and-sell-our-software-and-use-elk-us-monitoring-module/206595)
**Author:** [@111209](https://discuss.elastic.co/u/111209)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 11:15am UTC](https://discuss.elastic.co/t/can-we-use-elk-under-basic-license-for-develope-and-sell-our-software-and-use-elk-us-monitoring-module/206595 "2019-11-05T11:15:38Z")
I\`m not lawyer so sorry if my question is some stupid. But can we use ELK under basic license for develope and sell our software and use ELK us monitoring module ? --- ## [\\ELK was unexpected at this time](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 6\ **Last updated:** [November 5, 2019, 10:37am UTC](https://discuss.elastic.co/t/elk-was-unexpected-at-this-time/206541 "2019-11-05T10:37:27Z")
I am Getting Error while running application as elasticsearch from command prompt Error : \\ELK was unexpected at this time. Java -verison java version "1.8.0\_201" Java(TM) SE Runtime Environment (build 1.8.0\_201-b09… --- ## [Curator - Python related error](https://discuss.elastic.co/t/curator-python-related-error/206446)
**Author:** [@ORich](https://discuss.elastic.co/u/ORich)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 10:05am UTC](https://discuss.elastic.co/t/curator-python-related-error/206446 "2019-11-05T10:05:01Z")
Dear all, just upgraded from yum command line the elasticsearch-curator pkg from 5.6.0 to 5.8.1 on same server CentOS Linux release 7.6.1810 I am not able to run anymore /opt/elasticsearch-curator/curator\_cli --versio… --- ## [How to update hashmap data in ElasticSearch using API Update in Java](https://discuss.elastic.co/t/how-to-update-hashmap-data-in-elasticsearch-using-api-update-in-java/206533)
**Author:** [@Javeed\_Shaik](https://discuss.elastic.co/u/Javeed_Shaik)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 7:13am UTC](https://discuss.elastic.co/t/how-to-update-hashmap-data-in-elasticsearch-using-api-update-in-java/206533 "2019-11-05T07:13:56Z")
I am trying to update data in Elastic Search Server using the following Code. The code is written on Java 1.8. and Elastic Search version 6.2.1 I have used the following to insert the data in elastic search. HashMap\ **Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 9:45am UTC](https://discuss.elastic.co/t/rollup-job-remote-transport-exception-elk-7-4-1/206575 "2019-11-05T09:45:22Z") Hello, ELK Version - 7.4.1. I'm using Kibana GUI to create rollup index I am creating a rollup job based on the index pattern, but I need the specific range. For example: I have index on based on everyday as click-… --- ## [Best way to export elastic index to json / local file format](https://discuss.elastic.co/t/best-way-to-export-elastic-index-to-json-local-file-format/206560)
**Author:** [@tom\_es](https://discuss.elastic.co/u/tom_es)\ **Replies:** 1\ **Last updated:** [November 5, 2019, 9:43am UTC](https://discuss.elastic.co/t/best-way-to-export-elastic-index-to-json-local-file-format/206560 "2019-11-05T09:43:42Z")
Hi, we would like to export elastic index into local file (or by rest), to some kind of format (for example, json). our index contains million of documents (~1 GB size). is there a recommended way for doing this using… --- ## [HTTP request in Watcher transform](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553)
**Author:** [@gerard1](https://discuss.elastic.co/u/gerard1)\ **Replies:** 1\ **Last updated:** [November 5, 2019, 9:41am UTC](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553 "2019-11-05T09:41:38Z")
Before sending a Watcher alert into Slack, I would like to check with an external API, for example, if an IP has been reported as abusive in public databases. Is possible to do so with Painless or any other transform sc… --- ## [Bool Query: Order of Execution?](https://discuss.elastic.co/t/bool-query-order-of-execution/206403)
**Author:** [@st3inbeiss](https://discuss.elastic.co/u/st3inbeiss)\ **Replies:** 1\ **Last updated:** [November 5, 2019, 9:21am UTC](https://discuss.elastic.co/t/bool-query-order-of-execution/206403 "2019-11-05T09:21:36Z")
Hello! I have an elasticsearch cluster with daily indexes for some history functions. For another function, I only need the data for the last hour. My query for this looks something like this: { "query": { "bool": … --- ## [ElasticSearch 5.6 License Renewal](https://discuss.elastic.co/t/elasticsearch-5-6-license-renewal/206420)
**Author:** [@PascalFCS](https://discuss.elastic.co/u/PascalFCS)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 8:46am UTC](https://discuss.elastic.co/t/elasticsearch-5-6-license-renewal/206420 "2019-11-05T08:46:35Z")
Hi, I am using the basic license, which should not expire, but it did. I noticed, when my filebeat nodes couldn't connect to Elasticsearch anymore. GET /\_xpack/license gives me: { "license": { "status": "expired", … --- ## [Repository-s3 not uploading snapshot to s3](https://discuss.elastic.co/t/repository-s3-not-uploading-snapshot-to-s3/206532)
**Author:** [@suratpyari](https://discuss.elastic.co/u/suratpyari)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 8:25am UTC](https://discuss.elastic.co/t/repository-s3-not-uploading-snapshot-to-s3/206532 "2019-11-05T08:25:31Z")
Hi, I am running Elasticsearch on eks cluster. for backup to s3 I have added repository-s3 plugin. When I run following command, curl -X PUT "localhost:9200/\_snapshot/my\_s3\_repository?pretty" -H 'Content-Type: applicat… --- ## [Using cross\_field matching with different analysers](https://discuss.elastic.co/t/using-cross-field-matching-with-different-analysers/206539)
**Author:** [@fen99](https://discuss.elastic.co/u/fen99)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 7:51am UTC](https://discuss.elastic.co/t/using-cross-field-matching-with-different-analysers/206539 "2019-11-05T07:51:15Z")
Hello community, I'm currently doing a project using the cross-field match type, but search fields with different analysers. Example: brand with German Default and categories with German Stemmed analysers. However, this… --- ## [Search field fail after increase the numbers of limited field](https://discuss.elastic.co/t/search-field-fail-after-increase-the-numbers-of-limited-field/206534)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 0\ **Last updated:** [November 5, 2019, 7:15am UTC](https://discuss.elastic.co/t/search-field-fail-after-increase-the-numbers-of-limited-field/206534 "2019-11-05T07:15:42Z")
Dear all After my co worker increase the numbers of limit field when i needed to add more field to an index "settings" : { "index.mapping.total\_fields.limit": 2000 }, now everytime i search something on that spe… --- ## [Elasticsearch malformed query, expected \[END\_OBJECT\] but found \[FIELD\_NAME\]](https://discuss.elastic.co/t/elasticsearch-malformed-query-expected-end-object-but-found-field-name/206050)
**Author:** [@111230](https://discuss.elastic.co/u/111230)\ **Replies:** 2\ **Last updated:** [November 5, 2019, 7:09am UTC](https://discuss.elastic.co/t/elasticsearch-malformed-query-expected-end-object-but-found-field-name/206050 "2019-11-05T07:09:36Z")
My query looks like this { "query": { "bool": { "must": \[ { "has\_parent": { "parent\_type": "doc", "query": { "bool": { "must": \[ { "terms": { "id": \[ 713 \]}}, { "range": { "created": { "lte": "now/d" … --- ## [How to set path.data set to multiple paths within docker](https://discuss.elastic.co/t/how-to-set-path-data-set-to-multiple-paths-within-docker/204162)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 3\ **Last updated:** [November 5, 2019, 6:44am UTC](https://discuss.elastic.co/t/how-to-set-path-data-set-to-multiple-paths-within-docker/204162 "2019-11-05T06:44:51Z")
I found it is possible to configure path.data to multiple paths https://www.elastic.co/guide/en/elasticsearch/reference/master/path-settings.html I want to add ssd1+ssd2 as a disk to elastic-node1 and ssd3+4 to elasti… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1102) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1104)