# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1108 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1109 --- ## [Raw Log Size](https://discuss.elastic.co/t/raw-log-size/205958)
**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 11:38pm UTC](https://discuss.elastic.co/t/raw-log-size/205958 "2019-10-30T23:38:35Z")
We are currently on Elasticstack and I've been charged with comparing to Azure Sentinel. Sentinel pricing is based on size of logs ingested. I can query for index sizes but I believe those include the parsed metadata as … --- ## [Wrong year selected Elastic search SQL Query (also any better way to do this)](https://discuss.elastic.co/t/wrong-year-selected-elastic-search-sql-query-also-any-better-way-to-do-this/201972)
**Author:** [@Avinash\_D\_Silva](https://discuss.elastic.co/u/Avinash_D_Silva)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 10:54pm UTC](https://discuss.elastic.co/t/wrong-year-selected-elastic-search-sql-query-also-any-better-way-to-do-this/201972 "2019-10-30T22:54:30Z")
POST \_sql { "query": "SELECT AVG(parameters.strength.numericValue) as signal\_strength, DAY\_OF\_MONTH(timestamp) as dom, MONTH\_OF\_YEAR(timestamp) as moy, YEAR(timestamp) as yr FROM \\"performance\*\\" where name='Monitor'… --- ## [Group Same fieldvalue documents and aggreate on different field values](https://discuss.elastic.co/t/group-same-fieldvalue-documents-and-aggreate-on-different-field-values/204086)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 10:51pm UTC](https://discuss.elastic.co/t/group-same-fieldvalue-documents-and-aggreate-on-different-field-values/204086 "2019-10-30T22:51:28Z")
I have two indexes t-click and t-impression. I created a common index as t\*. index t-click tid: "sdalfk-234k" event: "click" tid: "sdalfk-234k" event: "click" index t-impression tid: "sdalfk-234k" site: "google… --- ## [Error: "no known master node" and "\[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]"](https://discuss.elastic.co/t/error-no-known-master-node-and-service-unavailable-1-state-not-recovered-initialized/205942)
**Author:** [@Thomas82](https://discuss.elastic.co/u/Thomas82)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 7:47pm UTC](https://discuss.elastic.co/t/error-no-known-master-node-and-service-unavailable-1-state-not-recovered-initialized/205942 "2019-10-30T19:47:58Z")
Running a single-node cluster and was working great. I had to reboot the server and am now seeing errors regarding "no known master node" and "\[SERVICE\_UNAVAILABLE/1/state not recovered / initialized\]" (see logs below). … --- ## [Elasticsearch Index Rollover](https://discuss.elastic.co/t/elasticsearch-index-rollover/205763)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 3\ **Last updated:** [October 30, 2019, 7:11pm UTC](https://discuss.elastic.co/t/elasticsearch-index-rollover/205763 "2019-10-30T19:11:04Z")
I have a problem, for some reason the previous Elasticsearch Admin configured an Index in a way that this index does not create a daily rollout. I will explain this better: I have a filebeat index running and every sing… --- ## [Installing Elasticsearch 7.4 on a Raspberry Pi 4 (Raspbian Buster)](https://discuss.elastic.co/t/installing-elasticsearch-7-4-on-a-raspberry-pi-4-raspbian-buster/202599)
**Author:** [@glassman](https://discuss.elastic.co/u/glassman)\ **Replies:** 10\ **Last updated:** [October 30, 2019, 6:01pm UTC](https://discuss.elastic.co/t/installing-elasticsearch-7-4-on-a-raspberry-pi-4-raspbian-buster/202599 "2019-10-30T18:01:28Z")
I'm currently trying to install ES on an RPi 4B. I've used this thread as a sort of guide. Here are the steps I've taken: sudo apt-get install default-jre sudo nano /etc/profile export JAVA\_HOME=$(readlink -f /usr/bi… --- ## [Field expansion matches too many fields, limit: 1024, got: 2089](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-2089/205896)
**Author:** [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 3:35pm UTC](https://discuss.elastic.co/t/field-expansion-matches-too-many-fields-limit-1024-got-2089/205896 "2019-10-30T15:35:12Z")
Elastic: 7.4 Kibana: 7.4 Elastic cluster contains 6 nodes, Each node has 1 TB HDD and 32GB RAM (24GB assigned to Elastic) service and 8vcpu I am getting too many fields issue while searching for string fromDiscovery t… --- ## [Search Vietnamese character](https://discuss.elastic.co/t/search-vietnamese-character/205888)
**Author:** [@Hoang\_Nguyen1](https://discuss.elastic.co/u/Hoang_Nguyen1)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:55pm UTC](https://discuss.elastic.co/t/search-vietnamese-character/205888 "2019-10-30T14:55:48Z")
I want to search accent character in my language. For example: I want to find the word "vành đúc" when i type "vanh duc" --- ## ["RemoteTransportException" exception frequently displaying](https://discuss.elastic.co/t/remotetransportexception-exception-frequently-displaying/205886)
**Author:** [@khaiolopes](https://discuss.elastic.co/u/khaiolopes)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:52pm UTC](https://discuss.elastic.co/t/remotetransportexception-exception-frequently-displaying/205886 "2019-10-30T14:52:00Z")
The log below is being displayed frequently. This happened after I restarted the ELK services. Version ELK: 7.3 \[2019-10-30T11:30:26,653\]\[DEBUG\]\[o.e.a.s.TransportSearchAction\] \[elasticnode-01\] \[qualifications-histori… --- ## [Single large cluster or multiple smaller clusters with remote search](https://discuss.elastic.co/t/single-large-cluster-or-multiple-smaller-clusters-with-remote-search/205879)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 2:29pm UTC](https://discuss.elastic.co/t/single-large-cluster-or-multiple-smaller-clusters-with-remote-search/205879 "2019-10-30T14:29:44Z")
We migrated from ES 5.6 with one large cluster hosting 2TB of daily indices and things were working pretty good to 6 smaller ES 7.1 clusters with remote cluster search. We've noticed that the performance was not so great… --- ## [Cluster design for specific use case](https://discuss.elastic.co/t/cluster-design-for-specific-use-case/205825)
**Author:** [@Virgile-a](https://discuss.elastic.co/u/Virgile-a)\ **Replies:** 4\ **Last updated:** [October 30, 2019, 12:44pm UTC](https://discuss.elastic.co/t/cluster-design-for-specific-use-case/205825 "2019-10-30T12:44:45Z")
Hi there, TLDR; I'm new to ES. I want to start an elastic cluster for the following use case : We manage billions of tiny documents. There is basically no documents movements (documents are rarely added) but they can… --- ## [Is CCR a good High Availability solution?](https://discuss.elastic.co/t/is-ccr-a-good-high-availability-solution/205719)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 0\ **Last updated:** [October 29, 2019, 4:36pm UTC](https://discuss.elastic.co/t/is-ccr-a-good-high-availability-solution/205719 "2019-10-29T16:36:24Z")
Hi! I use Elasticsearch along wih Logstash and Filebeat, to save logs. In order to get high availability, I am thinking in using CCR, because half or more than half of my nodes could be lost at any time. Elasticsearch… --- ## [Whitespace analyzer (char-filter And token-filter)](https://discuss.elastic.co/t/whitespace-analyzer-char-filter-and-token-filter/205664)
**Author:** [@Irakli](https://discuss.elastic.co/u/Irakli)\ **Replies:** 6\ **Last updated:** [October 30, 2019, 12:12pm UTC](https://discuss.elastic.co/t/whitespace-analyzer-char-filter-and-token-filter/205664 "2019-10-30T12:12:56Z")
Hi there, As I know we have 3 steps on text field when document with text field is indexed in elasticsearch. First - Char-filter process, Second - Tokenizing process, Third - Token filtering process I have the follo… --- ## [ElasticSearch Connect Exception](https://discuss.elastic.co/t/elasticsearch-connect-exception/205657)
**Author:** [@souravbasu45](https://discuss.elastic.co/u/souravbasu45)\ **Replies:** 9\ **Last updated:** [October 30, 2019, 11:38am UTC](https://discuss.elastic.co/t/elasticsearch-connect-exception/205657 "2019-10-30T11:38:35Z")
I am getting a java.net.ConnectException: Timeout connecting when I am trying to connect to the ELasticSearch cluster at port 9200. The error is as follows: java.net.ConnectException: Timeout connecting to \[/172.29.57.… --- ## [Geoip is mapped as a string by default](https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835)
**Author:** [@moscha](https://discuss.elastic.co/u/moscha)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 11:30am UTC](https://discuss.elastic.co/t/geoip-is-mapped-as-a-string-by-default/205835 "2019-10-30T11:30:04Z")
Hello all. I am fairly new to ELK and I am trying to troubleshoot a problem I am facing with geoip. I followed this guide to install everything: https://www.elastic.co/guide/en/elastic-stack-get-started/7.4/get-started-… --- ## [Error kibana security](https://discuss.elastic.co/t/error-kibana-security/205442)
**Author:** [@zmira\_meriem](https://discuss.elastic.co/u/zmira_meriem)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 10:51am UTC](https://discuss.elastic.co/t/error-kibana-security/205442 "2019-10-30T10:51:04Z")
hi plz some one can help me when i configure kibana ssl and i want to setup index i have this issue: HTTP GET request: Get https://@ip\_kibana:5601/api/status: x509: cannot validate certificate for @ ip kibana because i… --- ## [Editing index settings / ILM post index creation](https://discuss.elastic.co/t/editing-index-settings-ilm-post-index-creation/205722)
**Author:** [@Callahan](https://discuss.elastic.co/u/Callahan)\ **Replies:** 1\ **Last updated:** [October 30, 2019, 9:58am UTC](https://discuss.elastic.co/t/editing-index-settings-ilm-post-index-creation/205722 "2019-10-30T09:58:21Z")
Hi, I'm trying to change the index settings, specifically the ILM of an index. Throuigh an initial config error, the ILM that was applied to the index caused the following elements to be set: "index.routing.allocatio… --- ## [Elasticsearch storage limits](https://discuss.elastic.co/t/elasticsearch-storage-limits/205810)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 1\ **Last updated:** [October 30, 2019, 8:33am UTC](https://discuss.elastic.co/t/elasticsearch-storage-limits/205810 "2019-10-30T08:33:39Z")
Hello, Does Elasticsearch have a storage limit that it can handle? Does this limit go to RAM and / or CPU? Is there a formula? And in the case of 3 or 5 node clusters how do we understand the maximum storage that can … --- ## [Error document missing in create document](https://discuss.elastic.co/t/error-document-missing-in-create-document/205811)
**Author:** [@Mehrdad.dev](https://discuss.elastic.co/u/Mehrdad.dev)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 8:28am UTC](https://discuss.elastic.co/t/error-document-missing-in-create-document/205811 "2019-10-30T08:28:32Z")
Hi. I want to create a new document in elastic search with golang. my code : \_, err := s.client.Index().Index("profile").Type(typ).Id(user.ID).BodyJson(user).Do(ctx) if err != nil { return err } this … --- ## [\[ES6 upgrade ES7\] The two-node cluster works normally, but the master node fails, the slave node tries to reconnect, and does not recommend itself as the new master node](https://discuss.elastic.co/t/es6-upgrade-es7-the-two-node-cluster-works-normally-but-the-master-node-fails-the-slave-node-tries-to-reconnect-and-does-not-recommend-itself-as-the-new-master-node/205777)
**Author:** [@LiZhe1258](https://discuss.elastic.co/u/LiZhe1258)\ **Replies:** 10\ **Last updated:** [October 30, 2019, 6:12am UTC](https://discuss.elastic.co/t/es6-upgrade-es7-the-two-node-cluster-works-normally-but-the-master-node-fails-the-slave-node-tries-to-reconnect-and-does-not-recommend-itself-as-the-new-master-node/205777 "2019-10-30T06:12:12Z")
1，服务器：x86\_64 x86\_64 x86\_64 GNU/Linux，双节点(log1和log2)，小网通信 2，软件版本：elasticsearch7.3.1，不带x-pack增强功能 3，工作模式：既作为master候选节点，也作为数据节点，log1的主分片在自己这，副本分片在log2那里，log2同理 4，elasticsearch.yml配置：除名称外两节点一致 cluster.name: log-search-cl… --- ## [Inline Script with Parameters and Stored Script performance](https://discuss.elastic.co/t/inline-script-with-parameters-and-stored-script-performance/204070)
**Author:** [@aadishj02](https://discuss.elastic.co/u/aadishj02)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 5:33am UTC](https://discuss.elastic.co/t/inline-script-with-parameters-and-stored-script-performance/204070 "2019-10-30T05:33:32Z")
Hi, Is there any performance difference between the inline script with parameters and stored script? And also how is elasticsearch not compiling the script if I use the same inline script with parameters multiple times? … --- ## [Elastic search Crawling issue](https://discuss.elastic.co/t/elastic-search-crawling-issue/205586)
**Author:** [@ashwin-aera](https://discuss.elastic.co/u/ashwin-aera)\ **Replies:** 0\ **Last updated:** [October 29, 2019, 5:03am UTC](https://discuss.elastic.co/t/elastic-search-crawling-issue/205586 "2019-10-29T05:03:44Z")
Hi, I have been using trial version of Swiftype site search on my website which is developed on React. The site search was working really fine when I found that the hidden data on my website is not getting crawled, hidde… --- ## [Sorting for IP\[IPv4 & IPv6\]](https://discuss.elastic.co/t/sorting-for-ip-ipv4-ipv6/205361)
**Author:** [@singamsundeep](https://discuss.elastic.co/u/singamsundeep)\ **Replies:** 2\ **Last updated:** [October 30, 2019, 4:59am UTC](https://discuss.elastic.co/t/sorting-for-ip-ipv4-ipv6/205361 "2019-10-30T04:59:05Z")
Hi, Is that possible to do sorting for the Ip type? or should we convert to integer format and do sorting on the integer converted value. --- ## [Full text search multi match over multiple indies](https://discuss.elastic.co/t/full-text-search-multi-match-over-multiple-indies/205788)
**Author:** [@Babytut](https://discuss.elastic.co/u/Babytut)\ **Replies:** 0\ **Last updated:** [October 30, 2019, 4:21am UTC](https://discuss.elastic.co/t/full-text-search-multi-match-over-multiple-indies/205788 "2019-10-30T04:21:06Z")
I want to do full text search over multiple indies. For each index, I want query search over some fields not all and put these fields in multi-match's fields option. My indies have some same field names so I want to sep… --- ## [Why the node is not master-eligible?](https://discuss.elastic.co/t/why-the-node-is-not-master-eligible/205651)
**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\ **Replies:** 4\ **Last updated:** [October 29, 2019, 10:10pm UTC](https://discuss.elastic.co/t/why-the-node-is-not-master-eligible/205651 "2019-10-29T22:10:22Z")
I started the ES cluster in docker following the docker-compose template (changing the es01/es02 to nes01/nes02 to avoid the name conflict). sni@elk:~$ sudo curl http://localhost:9200/\_cat/nodes?v ip heap.percen… --- ## [\[ES5.6\] Unassigned Shards due to DANGLING\_INDEX\_IMPORTED](https://discuss.elastic.co/t/es5-6-unassigned-shards-due-to-dangling-index-imported/204739)
**Author:** [@UDixit](https://discuss.elastic.co/u/UDixit)\ **Replies:** 5\ **Last updated:** [October 29, 2019, 7:30pm UTC](https://discuss.elastic.co/t/es5-6-unassigned-shards-due-to-dangling-index-imported/204739 "2019-10-29T19:30:04Z")
We are seeing multiple cases where an index was deleted \> 1 month ago but after a node restart the shards of this index becomes unassigned due to DANGLING\_INDEX\_IMPORTED. Actually, the corresponding index uuuid folder i… --- ## [List of current active scrolls](https://discuss.elastic.co/t/list-of-current-active-scrolls/205302)
**Author:** [@jay224](https://discuss.elastic.co/u/jay224)\ **Replies:** 2\ **Last updated:** [October 29, 2019, 7:05pm UTC](https://discuss.elastic.co/t/list-of-current-active-scrolls/205302 "2019-10-29T19:05:13Z")
Is there a way to know how many scroll\_ids are currently active and how long they have been running? We want to know how many scrolls are currently running and clear long running scroll -Thanks --- ## [Benefits of force merging an append-only index](https://discuss.elastic.co/t/benefits-of-force-merging-an-append-only-index/205551)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [October 29, 2019, 6:58pm UTC](https://discuss.elastic.co/t/benefits-of-force-merging-an-append-only-index/205551 "2019-10-29T18:58:28Z")
Hi, It's not clear to me whether there are any benefits to force merging an index to which documents were only ever added (no updates or deletes), and if so, what these are? Thanks. --- ## [Remove field from a structure](https://discuss.elastic.co/t/remove-field-from-a-structure/205712)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [October 29, 2019, 5:48pm UTC](https://discuss.elastic.co/t/remove-field-from-a-structure/205712 "2019-10-29T17:48:19Z")
I am using Elasticsearch 6.5. Let say, that my Elasticsearch document looks like this: "\_source" : { "field1" : "val1", "field2" : "val2", "struct1" : { "inner\_field1" : "inner val1", "inner\_fie… --- ## [\[Elasticsearch\] Delete logs](https://discuss.elastic.co/t/elasticsearch-delete-logs/204631)
**Author:** [@thebeaoliveira](https://discuss.elastic.co/u/thebeaoliveira)\ **Replies:** 2\ **Last updated:** [October 29, 2019, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-logs/204631 "2019-10-29T16:53:54Z")
Hello! I would like to know if I can delete the logs below as I am trying to optimize disk space. files location: cd /var/log/elasricsearch elastic\_audit.json elastic-deprecation-1.json elastic-deprecation.json ela… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1107) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1109)