# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1106 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1107 --- ## [ES cluster goes into red frequently](https://discuss.elastic.co/t/es-cluster-goes-into-red-frequently/206051)
**Author:** [@AKSHAY\_ARDAK](https://discuss.elastic.co/u/AKSHAY_ARDAK)\ **Replies:** 20\ **Last updated:** [November 1, 2019, 1:42pm UTC](https://discuss.elastic.co/t/es-cluster-goes-into-red-frequently/206051 "2019-11-01T13:42:39Z")
Current version of ES = 5.1.1 When the cluster goes into red state below are the logs Master server logs Caused by: org.elasticsearch.transport.NodeDisconnectedException: \[elsdata09\]\[10.10.0.102:9200\]\[cluster:monitor/… --- ## [Ranking not working for Search query with AllIndices](https://discuss.elastic.co/t/ranking-not-working-for-search-query-with-allindices/206173)
**Author:** [@gurjit\_buck](https://discuss.elastic.co/u/gurjit_buck)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 1:30pm UTC](https://discuss.elastic.co/t/ranking-not-working-for-search-query-with-allindices/206173 "2019-11-01T13:30:48Z")
Hi, I am using rankfeature for ranking purpose, Since there are multiple (4) indexes, the search query result with option AllIndices the result is not correctely sorted, seems ranking working for indvisual index and th… --- ## [Ingest pipeline to parse basename from path](https://discuss.elastic.co/t/ingest-pipeline-to-parse-basename-from-path/205809)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [November 1, 2019, 12:47pm UTC](https://discuss.elastic.co/t/ingest-pipeline-to-parse-basename-from-path/205809 "2019-11-01T12:47:26Z")
Hi, I can't quite figure out how to use dissect/grok in an ingest pipeline to obtain the basename from a UNIX path. Basically, I would like each of the following inputs to return { "name" : "ssh" }: ssh bin/ssh /usr/… --- ## [How to send application logs from a NodeJS app to the Elastic Stack hosted in Kubernetes?](https://discuss.elastic.co/t/how-to-send-application-logs-from-a-nodejs-app-to-the-elastic-stack-hosted-in-kubernetes/206161)
**Author:** [@THPubs](https://discuss.elastic.co/u/THPubs)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 12:20pm UTC](https://discuss.elastic.co/t/how-to-send-application-logs-from-a-nodejs-app-to-the-elastic-stack-hosted-in-kubernetes/206161 "2019-11-01T12:20:46Z")
I'm building a NodeJS application and trying to use the Elastic Stack to collect the logs. The logs I want are: Error logs Application logs like, user logged in, user performed this task, system performed this task, et… --- ## [I get search hits on deleted objects](https://discuss.elastic.co/t/i-get-search-hits-on-deleted-objects/206015)
**Author:** [@DesireeNordlund](https://discuss.elastic.co/u/DesireeNordlund)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 12:00pm UTC](https://discuss.elastic.co/t/i-get-search-hits-on-deleted-objects/206015 "2019-11-01T12:00:21Z")
Hi I delete a post in the index by C# code. I do a delete by query. I get this response: Valid NEST response built from a successful (200) low level call on POST: /parlan\_ra/\_delete\_by\_query Audit trail of this API … --- ## [On-going troubles with field expansion](https://discuss.elastic.co/t/on-going-troubles-with-field-expansion/206145)
**Author:** [@alastairs](https://discuss.elastic.co/u/alastairs)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 11:01am UTC](https://discuss.elastic.co/t/on-going-troubles-with-field-expansion/206145 "2019-11-01T11:01:34Z")
I'm running Elasticsearch 7.4.0 and Filebeat 7.4.0. It seems that, when I query over a period longer than the current filebeat index has been open, I receive the following message: elasticsearch field expansion matches … --- ## [Array search](https://discuss.elastic.co/t/array-search/205682)
**Author:** [@privatechen](https://discuss.elastic.co/u/privatechen)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 10:46am UTC](https://discuss.elastic.co/t/array-search/205682 "2019-11-01T10:46:08Z")
for example, I got three items like: {"arr":\["a", "b", "c"\]}, {"arr":\["a", "b"\]}, {"arr":\["a", "c"\]} my search like this: "query":{ "bool":{ "must":\[ { "term":{ "arr":{ "value":"a" } } }, { "term":{ "ar… --- ## [Get nearby lines after query result](https://discuss.elastic.co/t/get-nearby-lines-after-query-result/206139)
**Author:** [@shah.ravi52](https://discuss.elastic.co/u/shah.ravi52)\ **Replies:** 0\ **Last updated:** [November 1, 2019, 10:01am UTC](https://discuss.elastic.co/t/get-nearby-lines-after-query-result/206139 "2019-11-01T10:01:44Z")
As per our requirement, I have to search a string in ES logs. And, print five lines before and after the result query. Is there any way to do that? --- ## [Upgrade](https://discuss.elastic.co/t/upgrade/206116)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 5\ **Last updated:** [November 1, 2019, 8:26am UTC](https://discuss.elastic.co/t/upgrade/206116 "2019-11-01T08:26:02Z")
Hi. I need to upgrade a simple Elasticsearch 6.5.4 cluster (3 master eligible+data servers) to 6.8.3. The upgrade guide says this can be done without any service interruption. Disabling shard replication and re-enabling … --- ## [Node shutdown due to OutOfMemoryError: Direct buffer memory](https://discuss.elastic.co/t/node-shutdown-due-to-outofmemoryerror-direct-buffer-memory/205994)
**Author:** [@Odd\_Erik\_Gronberg](https://discuss.elastic.co/u/Odd_Erik_Gronberg)\ **Replies:** 17\ **Last updated:** [November 1, 2019, 8:11am UTC](https://discuss.elastic.co/t/node-shutdown-due-to-outofmemoryerror-direct-buffer-memory/205994 "2019-11-01T08:11:52Z")
Hi, We are running a 5 node cluster with 3 data nodes (where 1 is master eligible) and 2 master (non-data eligible nodes) as windows services. Each of the data node has 6 GB allocated heap memory and runs on machines w… --- ## [Failed to obtain node locks, tried \[\[/usr/share/elasticsearch/data\]\] with lock id \[0\]](https://discuss.elastic.co/t/failed-to-obtain-node-locks-tried-usr-share-elasticsearch-data-with-lock-id-0/205706)
**Author:** [@Benni](https://discuss.elastic.co/u/Benni)\ **Replies:** 10\ **Last updated:** [November 1, 2019, 7:54am UTC](https://discuss.elastic.co/t/failed-to-obtain-node-locks-tried-usr-share-elasticsearch-data-with-lock-id-0/205706 "2019-11-01T07:54:44Z")
Hello, I have already found many approaches for this error. Unfortunately none of them helped me to solve my problem. It seems to be an old friend of Elasticsearch. org.elasticsearch.bootstrap.StartupException: java.lan… --- ## [Comparing two indices in elasticsearch](https://discuss.elastic.co/t/comparing-two-indices-in-elasticsearch/206038)
**Author:** [@Vikash\_Singh1](https://discuss.elastic.co/u/Vikash_Singh1)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 7:39am UTC](https://discuss.elastic.co/t/comparing-two-indices-in-elasticsearch/206038 "2019-11-01T07:39:55Z")
Hey Is it possible in elasticsearch to compare fields from two documents???? --- ## [Any possible way to re-index the current index, just like a copy of current index with associated data in it](https://discuss.elastic.co/t/any-possible-way-to-re-index-the-current-index-just-like-a-copy-of-current-index-with-associated-data-in-it/206121)
**Author:** [@Joseph\_Raj](https://discuss.elastic.co/u/Joseph_Raj)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 7:33am UTC](https://discuss.elastic.co/t/any-possible-way-to-re-index-the-current-index-just-like-a-copy-of-current-index-with-associated-data-in-it/206121 "2019-11-01T07:33:46Z")
I want to re-index the existing index because the current index shows in red status so i want to make it green. If i create a copy of existing index with the same data linked to it. ill delete the old index that is in r… --- ## [Partial word highlighting doesn't work properly](https://discuss.elastic.co/t/partial-word-highlighting-doesnt-work-properly/205797)
**Author:** [@Ilamparithi\_Karthike](https://discuss.elastic.co/u/Ilamparithi_Karthike)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 7:14am UTC](https://discuss.elastic.co/t/partial-word-highlighting-doesnt-work-properly/205797 "2019-11-01T07:14:52Z")
I am using highlighting(fvh) in the elasticsearch to highlight the keyword. When I do a search with keyword 5-2011, it produces the result with the keyword 005-2011 but it doesn't highlight the keyword. My query to hig… --- ## [Indexing performance - Choppy graphs - FreeBSD ZFS](https://discuss.elastic.co/t/indexing-performance-choppy-graphs-freebsd-zfs/206088)
**Author:** [@LogBabel](https://discuss.elastic.co/u/LogBabel)\ **Replies:** 9\ **Last updated:** [November 1, 2019, 5:09am UTC](https://discuss.elastic.co/t/indexing-performance-choppy-graphs-freebsd-zfs/206088 "2019-11-01T05:09:37Z")
Hello all. Seeking some ideas to help diagnose our cluster performance. I'll start with the specs: Data nodes: 5x 64-core 64GB RAM. Oracle Java 8. FreeBSD. ZFS RAID10 36TB. Search/ingest nodes: 2x with same spec… --- ## [Exclude Significant Term Aggregation With Different Field](https://discuss.elastic.co/t/exclude-significant-term-aggregation-with-different-field/204759)
**Author:** [@rakaziwi](https://discuss.elastic.co/u/rakaziwi)\ **Replies:** 1\ **Last updated:** [November 1, 2019, 3:58am UTC](https://discuss.elastic.co/t/exclude-significant-term-aggregation-with-different-field/204759 "2019-11-01T03:58:41Z")
Hello, Is it possible to filter the bucket list result of significant term aggregations using multiple fields to be filtered? I am trying to create a recommendation feature using ES based on this article at medium htt… --- ## [Giant Data File](https://discuss.elastic.co/t/giant-data-file/206107)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 0\ **Last updated:** [October 31, 2019, 9:15pm UTC](https://discuss.elastic.co/t/giant-data-file/206107 "2019-10-31T21:15:41Z")
Just finished upgrading from 7.2 to 7.4.1 and was cleaning up the 7.2 installations when something caught my eye. In the root of my 7.2 elasticsearch folder, I have a file named data that is about 18GB in size, what is … --- ## [Kerberos, ActiveDirectory and Token API Combination](https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080)
**Author:** [@j0t0](https://discuss.elastic.co/u/j0t0)\ **Replies:** 0\ **Last updated:** [October 31, 2019, 4:29pm UTC](https://discuss.elastic.co/t/kerberos-activedirectory-and-token-api-combination/206080 "2019-10-31T16:29:40Z")
I'm looking for some guidance on how best to implement access security to search. My search clients are all Windows apps running in an AD domain. I have configured Elasticsearch with a Kerberos realm for authentication… --- ## [Filtering in a Nested Sort appears to break sort](https://discuss.elastic.co/t/filtering-in-a-nested-sort-appears-to-break-sort/204118)
**Author:** [@wittjosiah](https://discuss.elastic.co/u/wittjosiah)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 6:59pm UTC](https://discuss.elastic.co/t/filtering-in-a-nested-sort-appears-to-break-sort/204118 "2019-10-31T18:59:12Z")
I've run into a weird issue with nested sorts. When specifying a sort as such: "sort": \[ { "variations.price.regular": { "mode": "min", "order": "asc", "nested": { "path": "va… --- ## [Best practices for multi language search and index](https://discuss.elastic.co/t/best-practices-for-multi-language-search-and-index/206086)
**Author:** [@ixsorribas](https://discuss.elastic.co/u/ixsorribas)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 6:35pm UTC](https://discuss.elastic.co/t/best-practices-for-multi-language-search-and-index/206086 "2019-10-31T18:35:34Z")
Hi, i´m new :slight\_smile: I have the next scenario: a document with a nested field that includes one or more "blocks" with a text field each. That text field could be in one of four different languages. (I know the lan… --- ## [Multi-match query with boolean prefix on search\_as\_you\_type is always 1.0](https://discuss.elastic.co/t/multi-match-query-with-boolean-prefix-on-search-as-you-type-is-always-1-0/206049)
**Author:** [@2DSharp](https://discuss.elastic.co/u/2DSharp)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 6:28pm UTC](https://discuss.elastic.co/t/multi-match-query-with-boolean-prefix-on-search-as-you-type-is-always-1-0/206049 "2019-10-31T18:28:00Z")
Hi, I am trying to set up a search system on my java application. I have tried using MatchQuery for searches however I am trying to add a suggestions feature that will suggest autocompletion results. I have used the ht… --- ## [DateMath in Watcher Definition for Index name](https://discuss.elastic.co/t/datemath-in-watcher-definition-for-index-name/205914)
**Author:** [@Andrew\_Riley](https://discuss.elastic.co/u/Andrew_Riley)\ **Replies:** 2\ **Last updated:** [October 31, 2019, 4:43pm UTC](https://discuss.elastic.co/t/datemath-in-watcher-definition-for-index-name/205914 "2019-10-31T16:43:14Z")
I'm trying to set up a watcher that searches a filebeat index with a date in the name. The watcher itself is executing, but not firing, and I'm concerned that it's because the index isn't being resolved correctly. The … --- ## [Use Painless to only return a subset of the Watch payload](https://discuss.elastic.co/t/use-painless-to-only-return-a-subset-of-the-watch-payload/205553)
**Author:** [@bobes](https://discuss.elastic.co/u/bobes)\ **Replies:** 2\ **Last updated:** [October 31, 2019, 3:24pm UTC](https://discuss.elastic.co/t/use-painless-to-only-return-a-subset-of-the-watch-payload/205553 "2019-10-31T15:24:10Z")
Apologies if this has been asked before, but i'm really stumped on this. What i'm trying to do is populate an email action in Watcher with a list of all results where an aggregation returns a doc\_count \> 5. I know the pr… --- ## [How to determine a difference in results from the same query?](https://discuss.elastic.co/t/how-to-determine-a-difference-in-results-from-the-same-query/206063)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 0\ **Last updated:** [October 31, 2019, 2:44pm UTC](https://discuss.elastic.co/t/how-to-determine-a-difference-in-results-from-the-same-query/206063 "2019-10-31T14:44:41Z")
My settings: Elasticsearch version ( bin/elasticsearch --version ): 5.6.11 Plugins installed : JVM version ( java -version ): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubun… --- ## [cURL POST to Elasticsearch using AD credentials](https://discuss.elastic.co/t/curl-post-to-elasticsearch-using-ad-credentials/206036)
**Author:** [@Ty9000](https://discuss.elastic.co/u/Ty9000)\ **Replies:** 6\ **Last updated:** [October 31, 2019, 2:44pm UTC](https://discuss.elastic.co/t/curl-post-to-elasticsearch-using-ad-credentials/206036 "2019-10-31T14:44:05Z")
Elasticsearch and Kibana version 7.4.1 (same machine) Build type RPM Hello! Just some background - I have gotten Active Directory authentication working for Kibana, I can log in using AD username/password. I have also … --- ## [Combine two queries in one](https://discuss.elastic.co/t/combine-two-queries-in-one/206020)
**Author:** [@DesireeNordlund](https://discuss.elastic.co/u/DesireeNordlund)\ **Replies:** 2\ **Last updated:** [October 31, 2019, 1:27pm UTC](https://discuss.elastic.co/t/combine-two-queries-in-one/206020 "2019-10-31T13:27:58Z")
I have a search field where the user can enter words to search for in a bunch of fields. I use a MultiMatchQuery and it works nicely. But, there as an access issue to it. Besides from the search I do today, I would like… --- ## [Watcher: IP abuse](https://discuss.elastic.co/t/watcher-ip-abuse/204887)
**Author:** [@gerard1](https://discuss.elastic.co/u/gerard1)\ **Replies:** 6\ **Last updated:** [October 31, 2019, 1:19pm UTC](https://discuss.elastic.co/t/watcher-ip-abuse/204887 "2019-10-31T13:19:08Z")
I'm trying to create a Watcher alert to Slack, every time an IP is generating more than 10 logs per minute, of a certain type (for example, ModSecurity). This is what I have so far: { "trigger": { "schedule": { … --- ## [Null reference check in watcher rule using painless script](https://discuss.elastic.co/t/null-reference-check-in-watcher-rule-using-painless-script/205360)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 1:18pm UTC](https://discuss.elastic.co/t/null-reference-check-in-watcher-rule-using-painless-script/205360 "2019-10-31T13:18:11Z")
In my watcher rule, i have implemented a looping for the items from the result as "body": "{"Type":"MemoryUsage","MidThreshold":90,"MaxThreshold":98,"ServerDetails":\[{{\[#ctx\](javascript:void(0);).payload.aggregations.al… --- ## [Elasticsearch fail](https://discuss.elastic.co/t/elasticsearch-fail/205373)
**Author:** [@alpanthiya123](https://discuss.elastic.co/u/alpanthiya123)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 1:16pm UTC](https://discuss.elastic.co/t/elasticsearch-fail/205373 "2019-10-31T13:16:21Z")
Continuing the discussion from Elasticsearch status failed. how to fix this: ● elasticsearch.service - Elasticsearch Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor p Active: failed (Result:… --- ## [Reference Result of Aggregation in Sub-Aggregation](https://discuss.elastic.co/t/reference-result-of-aggregation-in-sub-aggregation/205425)
**Author:** [@gose](https://discuss.elastic.co/u/gose)\ **Replies:** 1\ **Last updated:** [October 31, 2019, 1:15pm UTC](https://discuss.elastic.co/t/reference-result-of-aggregation-in-sub-aggregation/205425 "2019-10-31T13:15:10Z")
How do I refer to "avg\_flight\_min" in the Range Aggregation, replacing the hard-coded value of 100: GET kibana\_sample\_data\_flights/\_search { "size": 0, "aggs": { "avg\_flight\_min": { "avg": { "field… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1105) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1107)