# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1105 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1106 --- ## [\[watchers\] over all documents or top?](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815)
**Author:** [@real\_legend](https://discuss.elastic.co/u/real_legend)\ **Replies:** 3\ **Last updated:** [November 4, 2019, 10:04am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815 "2019-11-04T10:04:55Z")
hi there while creating new alarm there is a 'over' field with two values: 1. all documents 2. top i want to know what each of them means? --- ## [ILM is not working](https://discuss.elastic.co/t/ilm-is-not-working/206319)
**Author:** [@hadesy](https://discuss.elastic.co/u/hadesy)\ **Replies:** 0\ **Last updated:** [November 4, 2019, 2:51am UTC](https://discuss.elastic.co/t/ilm-is-not-working/206319 "2019-11-04T02:51:01Z")
I am using ELK stack 7.4.1, I have an ILM policy set but looks like its not working. The maximum index size I set is 50GB. GET /log-test/\_ilm/explain { "indices" : { "log-test-2019.10.31-000001" : { "index" … --- ## [Ignoring fields from indexing and updating same fields](https://discuss.elastic.co/t/ignoring-fields-from-indexing-and-updating-same-fields/205760)
**Author:** [@Ivan\_Petrovic](https://discuss.elastic.co/u/Ivan_Petrovic)\ **Replies:** 3\ **Last updated:** [November 4, 2019, 9:54am UTC](https://discuss.elastic.co/t/ignoring-fields-from-indexing-and-updating-same-fields/205760 "2019-11-04T09:54:43Z")
Hi everyone, We are about to release Elasticsearch in production for our time-series analytics data. We have few concerns about optimizing performance. By default ES indexes all fields and we want to prevent that. As … --- ## [Difference between sorting in index level and inside query](https://discuss.elastic.co/t/difference-between-sorting-in-index-level-and-inside-query/205385)
**Author:** [@liorisme6](https://discuss.elastic.co/u/liorisme6)\ **Replies:** 4\ **Last updated:** [November 4, 2019, 9:52am UTC](https://discuss.elastic.co/t/difference-between-sorting-in-index-level-and-inside-query/205385 "2019-11-04T09:52:18Z")
Hi, What's the difference between sorting according to a specific field (adding a sort clause in the query itself) and adding sorting in the index definition (meaning, sorting it on the segment level), without adding so… --- ## [Increase Elasticsearch maximum dimensions for sparse vectors](https://discuss.elastic.co/t/increase-elasticsearch-maximum-dimensions-for-sparse-vectors/204808)
**Author:** [@Pablo\_gps](https://discuss.elastic.co/u/Pablo_gps)\ **Replies:** 2\ **Last updated:** [November 4, 2019, 8:22am UTC](https://discuss.elastic.co/t/increase-elasticsearch-maximum-dimensions-for-sparse-vectors/204808 "2019-11-04T08:22:43Z")
Using sparse vectors in elastic search has two dimensional limits. On the one hand, vectors should not have more than 1024 elements. This can be solved, as seen in this question. The second limit is not the number of e… --- ## [ES7.4 returns unsupported symbol in geohash](https://discuss.elastic.co/t/es7-4-returns-unsupported-symbol-in-geohash/206306)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [November 4, 2019, 8:10am UTC](https://discuss.elastic.co/t/es7-4-returns-unsupported-symbol-in-geohash/206306 "2019-11-04T08:10:44Z")
Mapping defined as this: "source": { "properties": { "address": { "type": "keyword", "fields": { "text": { "type" : "text" } } }, "ip": { "type": "ip" }, "… --- ## [Replace existing record if \_id matches (filebeat)](https://discuss.elastic.co/t/replace-existing-record-if-id-matches-filebeat/206351)
**Author:** [@avizen-j](https://discuss.elastic.co/u/avizen-j)\ **Replies:** 0\ **Last updated:** [November 4, 2019, 7:58am UTC](https://discuss.elastic.co/t/replace-existing-record-if-id-matches-filebeat/206351 "2019-11-04T07:58:00Z")
Hello, Lets say I have 3 records with same correlation id. The only thing that is different is statuses of these records (active, errornous, issued). I want the flow to be like that: Example: 1000 records are generat… --- ## [Filebeat dashboard create failing](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 9\ **Last updated:** [November 4, 2019, 7:19am UTC](https://discuss.elastic.co/t/filebeat-dashboard-create-failing/203699 "2019-11-04T07:19:40Z")
Hi, I installed Elastic and Kibana on one server and Filebeat on another. Running file except for 'sudo filebeat setup -e' I changed 'localhost' to the right IP in elastic, kibana and filebeat yml's but still this err… --- ## [Index.lifecycle.rollover\_alias is Empty](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty/206323)
**Author:** [@stevetso](https://discuss.elastic.co/u/stevetso)\ **Replies:** 0\ **Last updated:** [November 4, 2019, 3:45am UTC](https://discuss.elastic.co/t/index-lifecycle-rollover-alias-is-empty/206323 "2019-11-04T03:45:55Z")
Hi, In the index template, I forgot to define the index.lifecycle.rollover\_alias and triggered the following error: Index lifecycle error illegal\_argument\_exception: setting \[index.lifecycle.rollover\_alias\] for index… --- ## [Simple nested query returns no matches](https://discuss.elastic.co/t/simple-nested-query-returns-no-matches/206303)
**Author:** [@ChristoKiwi](https://discuss.elastic.co/u/ChristoKiwi)\ **Replies:** 1\ **Last updated:** [November 4, 2019, 2:19am UTC](https://discuss.elastic.co/t/simple-nested-query-returns-no-matches/206303 "2019-11-04T02:19:18Z")
My first post, please be gentle. I have 100 Million records in an AWS ElasticSearch instance running 6.8, with the mapping: "mappings":{ "message":{ "properties":{ "messageID":{ "type":"long" }, "conten… --- ## [Custom grok pattern to pull field from large text](https://discuss.elastic.co/t/custom-grok-pattern-to-pull-field-from-large-text/202946)
**Author:** [@c95mbq](https://discuss.elastic.co/u/c95mbq)\ **Replies:** 1\ **Last updated:** [November 3, 2019, 9:29pm UTC](https://discuss.elastic.co/t/custom-grok-pattern-to-pull-field-from-large-text/202946 "2019-11-03T21:29:52Z")
Apologies for the poor topic, it was the best I could do, sad as that is. I'm really struggling with this but here's what I'm trying to do. I have a large number of documents that are in RTF format. The documents themse… --- ## [Bad number display regardless of Mapping used (float, double)](https://discuss.elastic.co/t/bad-number-display-regardless-of-mapping-used-float-double/206297)
**Author:** [@crpj](https://discuss.elastic.co/u/crpj)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 4:53pm UTC](https://discuss.elastic.co/t/bad-number-display-regardless-of-mapping-used-float-double/206297 "2019-11-03T16:53:39Z")
Hello all :grinning: After researching and testing I could not figure out why I am still getting wrong numbers returned by queries regardless of the mapping used. E.g. 8.217157748E9 I tried float and double. For the re… --- ## [ES HA and Load Balancing](https://discuss.elastic.co/t/es-ha-and-load-balancing/206294)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 3:07pm UTC](https://discuss.elastic.co/t/es-ha-and-load-balancing/206294 "2019-11-03T15:07:55Z")
Hi, Here's my setup: 2 - coordinating nodes (esnode1,esnode2) 3 - master/data node (esnode3,esnode4,esnode5) 1 - data node (esnode6) should i configure logstash to hosts=\> esnode1, esnode2 only ? or should i s… --- ## [Question about the refresh parameter](https://discuss.elastic.co/t/question-about-the-refresh-parameter/206287)
**Author:** [@111231](https://discuss.elastic.co/u/111231)\ **Replies:** 2\ **Last updated:** [November 3, 2019, 3:02pm UTC](https://discuss.elastic.co/t/question-about-the-refresh-parameter/206287 "2019-11-03T15:02:04Z")
If I make 2 requests to es in sequence, which is firing the second request after the first request is returned. My question is that If I set the refresh parameter of the second request to TRUE. would the change of the f… --- ## [Elasticsearch aggregation performance on long vs float/scaled\_float/double](https://discuss.elastic.co/t/elasticsearch-aggregation-performance-on-long-vs-float-scaled-float-double/206262)
**Author:** [@kevin\_Art](https://discuss.elastic.co/u/kevin_Art)\ **Replies:** 0\ **Last updated:** [November 3, 2019, 1:16am UTC](https://discuss.elastic.co/t/elasticsearch-aggregation-performance-on-long-vs-float-scaled-float-double/206262 "2019-11-03T01:16:58Z")
i'm just wondering if there's someone here who have tried to check if there's a performance difference between using long and float/scaled\_float in elasticsearch specially when using sum aggregation? for the long, the n… --- ## [Kibana HTTPS with Search Guard](https://discuss.elastic.co/t/kibana-https-with-search-guard/205301)
**Author:** [@revglen](https://discuss.elastic.co/u/revglen)\ **Replies:** 2\ **Last updated:** [November 2, 2019, 8:27pm UTC](https://discuss.elastic.co/t/kibana-https-with-search-guard/205301 "2019-11-02T20:27:14Z")
Hello Guys, I installed ElasticSearch and Search Guard which was successful. I am able to access ES using HTTPS ( https://localhost:9200). I have integrated Kibana with Search Guard however there are no settings for Kib… --- ## [Got response code '401' contacting Elasticsearch at URL 7.4](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850)
**Author:** [@Ivan\_D](https://discuss.elastic.co/u/Ivan_D)\ **Replies:** 1\ **Last updated:** [November 2, 2019, 7:45pm UTC](https://discuss.elastic.co/t/got-response-code-401-contacting-elasticsearch-at-url-7-4/205850 "2019-11-02T19:45:56Z")
Hi, i have enabled xpack and facing in issues with logstash connection elasticsearch.yml xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.audit.enabled: true output.conf in logsta… --- ## [Getting Doc Counts using a Rollup query](https://discuss.elastic.co/t/getting-doc-counts-using-a-rollup-query/206110)
**Author:** [@rvshchwl](https://discuss.elastic.co/u/rvshchwl)\ **Replies:** 1\ **Last updated:** [November 2, 2019, 6:53pm UTC](https://discuss.elastic.co/t/getting-doc-counts-using-a-rollup-query/206110 "2019-11-02T18:53:29Z")
I am currently using an Aggregation query to get Document Counts from a Date Histogram of 1 Minute samples. This is my current query: scroll\_query = { "query" : { "range": { "Timestamp": { "gte": "now-30d/d", … --- ## [ES cluster is down: indexing is not supported on a read-only engine](https://discuss.elastic.co/t/es-cluster-is-down-indexing-is-not-supported-on-a-read-only-engine/206229)
**Author:** [@MosheMallal](https://discuss.elastic.co/u/MosheMallal)\ **Replies:** 4\ **Last updated:** [November 2, 2019, 4:05pm UTC](https://discuss.elastic.co/t/es-cluster-is-down-indexing-is-not-supported-on-a-read-only-engine/206229 "2019-11-02T16:05:14Z")
Hi all, we have very sever issue for the past 24H. our ES is down no data is received from logstash into ES. Logstash logs shows unsupported\_operation\_exception: indexing is not supported on a read-only engine. There … --- ## [Is there a way to count nested documents in in a doc](https://discuss.elastic.co/t/is-there-a-way-to-count-nested-documents-in-in-a-doc/206236)
**Author:** [@RITZ\_VERMA](https://discuss.elastic.co/u/RITZ_VERMA)\ **Replies:** 0\ **Last updated:** [November 2, 2019, 1:14pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-count-nested-documents-in-in-a-doc/206236 "2019-11-02T13:14:07Z")
I have a document which contains nested documents.i want to get the count of nested documents associated with a field. --- ## [Slow elasticsearch sql query with aggregation to get Top-N results](https://discuss.elastic.co/t/slow-elasticsearch-sql-query-with-aggregation-to-get-top-n-results/204985)
**Author:** [@letwefly](https://discuss.elastic.co/u/letwefly)\ **Replies:** 5\ **Last updated:** [November 2, 2019, 12:09pm UTC](https://discuss.elastic.co/t/slow-elasticsearch-sql-query-with-aggregation-to-get-top-n-results/204985 "2019-11-02T12:09:58Z")
Hi, I am trying to visualize some data and I am using elasticsearch sql to build some visualizations. I am importing data about 346M with 2000000 docs. This is my slow sql: select userId, count(\*) from tableA where… --- ## [I take index.lifecycle.name bat had a error](https://discuss.elastic.co/t/i-take-index-lifecycle-name-bat-had-a-error/206231)
**Author:** [@Jacky\_zm](https://discuss.elastic.co/u/Jacky_zm)\ **Replies:** 1\ **Last updated:** [November 2, 2019, 8:09am UTC](https://discuss.elastic.co/t/i-take-index-lifecycle-name-bat-had-a-error/206231 "2019-11-02T08:09:16Z")
{ "index": { "lifecycle": { "index.lifecycle.name": "debug-fluentd", "index.lifecycle.rollover\_alias": "debug\_fluentd\_rollover\_alias" } } had a error \[illegal\_argument\_exception\] unknown setting \[index.lifecycle.… --- ## [Indices Keep Returning](https://discuss.elastic.co/t/indices-keep-returning/206157)
**Author:** [@StrifeX](https://discuss.elastic.co/u/StrifeX)\ **Replies:** 10\ **Last updated:** [November 2, 2019, 12:06am UTC](https://discuss.elastic.co/t/indices-keep-returning/206157 "2019-11-02T00:06:43Z")
Hello. I'm extremely new to managing an elastic stack, so it is not something I am familiar with. The implementation we have right now is encountering issues, and after trouble shooting for some time I believe it is due … --- ## [Shard allocation for master nodes during rolling upgrades](https://discuss.elastic.co/t/shard-allocation-for-master-nodes-during-rolling-upgrades/206188)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 4\ **Last updated:** [November 1, 2019, 9:24pm UTC](https://discuss.elastic.co/t/shard-allocation-for-master-nodes-during-rolling-upgrades/206188 "2019-11-01T21:24:52Z")
I'm aware that shard allocation needs to be disabled and then re-enabled back during rolling upgrades. My question is: Does this need to be done for master nodes? I reckon this is only needed for data nodes and NOT nee… --- ## [Rollup sum of terms?](https://discuss.elastic.co/t/rollup-sum-of-terms/205265)
**Author:** [@JohanRask](https://discuss.elastic.co/u/JohanRask)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 6:58pm UTC](https://discuss.elastic.co/t/rollup-sum-of-terms/205265 "2019-11-01T18:58:56Z")
Hi, Is it possible to roll up sum of term occurrences, so I can aggregate i.e status\_codes from access logs? I.e, I would like to rollup sum group-by-term "status\_code" over a time period , is this possible? I tried i… --- ## [How to Limit Elasticsearch Log Space](https://discuss.elastic.co/t/how-to-limit-elasticsearch-log-space/206208)
**Author:** [@martinetwork](https://discuss.elastic.co/u/martinetwork)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 6:42pm UTC](https://discuss.elastic.co/t/how-to-limit-elasticsearch-log-space/206208 "2019-11-01T18:42:01Z")
I would like to know how to limit the amount of space elasticsearch logs can take up on my Graylog server. Twice now an overload of elasticsearch logs has used up all the space and caused Graylog to stop working. I fixed… --- ## [Static mapping concatenating multiple locations if arrays](https://discuss.elastic.co/t/static-mapping-concatenating-multiple-locations-if-arrays/206204)
**Author:** [@dancerjohn](https://discuss.elastic.co/u/dancerjohn)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 6:14pm UTC](https://discuss.elastic.co/t/static-mapping-concatenating-multiple-locations-if-arrays/206204 "2019-11-01T18:14:21Z")
I am having an issue with explicit index mapping with a property / field is pulling data from two locations in the \_source object, but only if both locations are arrays. I have posted the question on stackoverflow (befor… --- ## [Grok pattern not getting full message](https://discuss.elastic.co/t/grok-pattern-not-getting-full-message/205834)
**Author:** [@tomsozolins](https://discuss.elastic.co/u/tomsozolins)\ **Replies:** 6\ **Last updated:** [November 1, 2019, 5:29pm UTC](https://discuss.elastic.co/t/grok-pattern-not-getting-full-message/205834 "2019-11-01T17:29:13Z")
Hello! I have have a problem with grok getting full message from log file. Can you please help me? Log message: 2019-10-29 19:27:21.779+02:00 \[ 27\] INFO - State has changed: Rule: Recording FPS, Counter: \\Vi… --- ## [Update specific nested object](https://discuss.elastic.co/t/update-specific-nested-object/206168)
**Author:** [@Vlad\_Dogarescu](https://discuss.elastic.co/u/Vlad_Dogarescu)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 3:54pm UTC](https://discuss.elastic.co/t/update-specific-nested-object/206168 "2019-11-01T15:54:52Z")
I have hotel documents that each have rooms of nested type. { id: hotel\_id, rooms: \[ { id: room\_id\_1, name: "room 1 name" }, { id: room\_id\_2, name: "room 2 name" … --- ## [Elasticsearch is not accessible via machine IP Address](https://discuss.elastic.co/t/elasticsearch-is-not-accessible-via-machine-ip-address/206090)
**Author:** [@premkumar](https://discuss.elastic.co/u/premkumar)\ **Replies:** 5\ **Last updated:** [November 1, 2019, 2:51pm UTC](https://discuss.elastic.co/t/elasticsearch-is-not-accessible-via-machine-ip-address/206090 "2019-11-01T14:51:48Z")
Hi All, I have installed Elasticsearch 7.2 on CentOS 7. After installation without making any changes to the yml file, I was able to access Elasticsearch using the curl command curl http://localhost:9200/\_cluster/healt… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1104) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1106)