# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1113 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1114 --- ## [Cluster state update](https://discuss.elastic.co/t/cluster-state-update/205145)
**Author:** [@simplesmente](https://discuss.elastic.co/u/simplesmente)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 7:39pm UTC](https://discuss.elastic.co/t/cluster-state-update/205145 "2019-10-24T19:39:03Z")
Currently I have a 4mb (compressed, according to /\_cluster/state) cluster state and it's taking about 3 seconds to update every time it needs to be updated. We have thousands of stored search templates in our cluster st… --- ## [The file role\_mapping.yml is not loaded or used](https://discuss.elastic.co/t/the-file-role-mapping-yml-is-not-loaded-or-used/204521)
**Author:** [@cglencr](https://discuss.elastic.co/u/cglencr)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 6:39pm UTC](https://discuss.elastic.co/t/the-file-role-mapping-yml-is-not-loaded-or-used/204521 "2019-10-24T18:39:32Z")
I am attempting to use the Active Directory realm for authentication via Kibana. But believe I have the format for a AD account wrong. I am using the distinguished name but think for individual users it is not what I s… --- ## [Can't config my logstash.conf correctly](https://discuss.elastic.co/t/cant-config-my-logstash-conf-correctly/205126)
**Author:** [@AgustinCerda](https://discuss.elastic.co/u/AgustinCerda)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 6:09pm UTC](https://discuss.elastic.co/t/cant-config-my-logstash-conf-correctly/205126 "2019-10-24T18:09:58Z")
Hi, I'm new with elk stack, i'm trying to pull data from a view in oracle, now i'm stuck with the logstash.conf file. input { jdbc { jdbc\_validate\_connection =\> true jdbc\_driver\_library =\> "/etc/logstash/conf.d/jdbc/… --- ## [Elastic SQL and cURL not playing nice](https://discuss.elastic.co/t/elastic-sql-and-curl-not-playing-nice/204971)
**Author:** [@rdesanno](https://discuss.elastic.co/u/rdesanno)\ **Replies:** 5\ **Last updated:** [October 24, 2019, 6:09pm UTC](https://discuss.elastic.co/t/elastic-sql-and-curl-not-playing-nice/204971 "2019-10-24T18:09:07Z")
I'm having the hardest time trying to figure out what i'm doing wrong here and hope that someone else has some pointers I can run the following query in Dev Tools POST \_sql { "query": "SELECT agent.hostname AS HOST, … --- ## [Searching string terms within arrays](https://discuss.elastic.co/t/searching-string-terms-within-arrays/205125)
**Author:** [@Joao\_D\_Junior](https://discuss.elastic.co/u/Joao_D_Junior)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 5:59pm UTC](https://discuss.elastic.co/t/searching-string-terms-within-arrays/205125 "2019-10-24T17:59:28Z")
I am trying to search for a particular element within an array through a term, but when querying, I get nothing p.s: I am using elasticsearch 7.x. I created the following query: POST spring/\_search { "query": { "… --- ## [Query question on search dependent on results](https://discuss.elastic.co/t/query-question-on-search-dependent-on-results/205108)
**Author:** [@berryma4](https://discuss.elastic.co/u/berryma4)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 5:57pm UTC](https://discuss.elastic.co/t/query-question-on-search-dependent-on-results/205108 "2019-10-24T17:57:54Z")
Is it possible to have a single query where the returned hits match the following: search a field "a", but also return records which have the same value for field "b" as the records returned by field "a". --- ## [How to update max\_snapshot\_bytes\_per\_sec setting for an existing repository?](https://discuss.elastic.co/t/how-to-update-max-snapshot-bytes-per-sec-setting-for-an-existing-repository/204797)
**Author:** [@Rajiv](https://discuss.elastic.co/u/Rajiv)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 4:05pm UTC](https://discuss.elastic.co/t/how-to-update-max-snapshot-bytes-per-sec-setting-for-an-existing-repository/204797 "2019-10-24T16:05:17Z")
Hello: Is there a way to update the max\_snapshot\_bytes\_per\_sec setting on a repository without deleting and recreating it? We have an S3 repo configured with a bunch of snapshots. As the daily data volume has grown the… --- ## [Skewed shards on index even with enough disk space in all physical nodes](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974)
**Author:** [@viniciof](https://discuss.elastic.co/u/viniciof)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:48pm UTC](https://discuss.elastic.co/t/skewed-shards-on-index-even-with-enough-disk-space-in-all-physical-nodes/204974 "2019-10-24T15:48:43Z")
Hi everyone, I have an index (shown below) which is not evenly distributed accross my 10 data nodes cluster. Each node in the cluster has at least 1.1 TB free, only the one called arm-lc-004 has ~700GB free only bu… --- ## [Does read-only index option really affect the performace?](https://discuss.elastic.co/t/does-read-only-index-option-really-affect-the-performace/205081)
**Author:** [@boubakr](https://discuss.elastic.co/u/boubakr)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 3:32pm UTC](https://discuss.elastic.co/t/does-read-only-index-option-really-affect-the-performace/205081 "2019-10-24T15:32:58Z")
Does read-only option really affect the performace? If yes, how? If not why? My scenario is this: I've daily indexes with lots of documets (from 5/10 to 100 GB per day, it depens). If each day I make the indexes of yes… --- ## [ES SQL :: Syntax for "sum( Value1 \* Value2)"?](https://discuss.elastic.co/t/es-sql-syntax-for-sum-value1-value2/204914)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 3:11pm UTC](https://discuss.elastic.co/t/es-sql-syntax-for-sum-value1-value2/204914 "2019-10-24T15:11:54Z")
Hi Elasticsearch Ninja Masters, I’ve recently spun up an Elasticsearch v7.4.0 Docker container, and I’m using the “elasticsearch-sql-cli” script to run SQL-like queries off my ES instance. Which is awesome, thank you f… --- ## [Enabling fips - ES 6.8](https://discuss.elastic.co/t/enabling-fips-es-6-8/204906)
**Author:** [@S\_Chase](https://discuss.elastic.co/u/S_Chase)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 3:10pm UTC](https://discuss.elastic.co/t/enabling-fips-es-6-8/204906 "2019-10-24T15:10:14Z")
The ES docs for FIPS 140.2 compliance refers to making changes to the hashing methods. Those docs state. You must set the cache.hash\_algo realm settings and the xpack.security.authc.password\_hashing.algorithm setting t… --- ## [Error startup with error SECCOMP\_SET\_MODE\_FILTER](https://discuss.elastic.co/t/error-startup-with-error-seccomp-set-mode-filter/205099)
**Author:** [@xujohn](https://discuss.elastic.co/u/xujohn)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 2:47pm UTC](https://discuss.elastic.co/t/error-startup-with-error-seccomp-set-mode-filter/205099 "2019-10-24T14:47:38Z")
When I start elasticsearch data nodes, it shows: \[DEBUG\]\[o.e.b.SystemCallFilter \] \[www.company.com\] seccomp(SECCOMP\_SET\_MODE\_FILTER): Function not implemented, falling back to prctl(PR\_SET\_SECCOMP)... And the process… --- ## [Watcher - How to reference an index field value in an email body](https://discuss.elastic.co/t/watcher-how-to-reference-an-index-field-value-in-an-email-body/205063)
**Author:** [@fim](https://discuss.elastic.co/u/fim)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 2:41pm UTC](https://discuss.elastic.co/t/watcher-how-to-reference-an-index-field-value-in-an-email-body/205063 "2019-10-24T14:41:42Z")
I would like to trigger a watcher alert using Kibana Watcher UI. The condition works fine but I would like to give additional information in the email body. In my case the watcher will triggered when a transaction durat… --- ## [Can not remove hits.hits.sort field from response of /\_search request with sort](https://discuss.elastic.co/t/can-not-remove-hits-hits-sort-field-from-response-of-search-request-with-sort/204992)
**Author:** [@muziyoshiz](https://discuss.elastic.co/u/muziyoshiz)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 2:34pm UTC](https://discuss.elastic.co/t/can-not-remove-hits-hits-sort-field-from-response-of-search-request-with-sort/204992 "2019-10-24T14:34:27Z")
Hello Elasticsearch Team, In our use case, we want to get only document IDs of the matched documents as a result of search API /\_search. But when I call search API with a query including "sort" field, the response cont… --- ## [For kibana security](https://discuss.elastic.co/t/for-kibana-security/204682)
**Author:** [@zmira\_meriem](https://discuss.elastic.co/u/zmira_meriem)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 2:03pm UTC](https://discuss.elastic.co/t/for-kibana-security/204682 "2019-10-24T14:03:45Z")
hi pllz any help i wanna secure kibana with https...how can i do that??? thnx --- ## [Is it possible to reset the rejected queue?](https://discuss.elastic.co/t/is-it-possible-to-reset-the-rejected-queue/204711)
**Author:** [@mwills](https://discuss.elastic.co/u/mwills)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 1:52pm UTC](https://discuss.elastic.co/t/is-it-possible-to-reset-the-rejected-queue/204711 "2019-10-24T13:52:44Z")
It is possible to reset the rejected queue in the thread pool when it has exceeded the 200 queue size through the API? --- ## [Can't Filter Aggregation Results](https://discuss.elastic.co/t/cant-filter-aggregation-results/204497)
**Author:** [@ryes](https://discuss.elastic.co/u/ryes)\ **Replies:** 4\ **Last updated:** [October 24, 2019, 12:57pm UTC](https://discuss.elastic.co/t/cant-filter-aggregation-results/204497 "2019-10-24T12:57:04Z")
Hello, all! I have an index with web transaction logs. It consists of requests and responses. An index looks like this: { request\_id: '1234', message: 'request', path: '/fare' } { request\_id: '1234', message: 'respons… --- ## [Slow Index create](https://discuss.elastic.co/t/slow-index-create/204862)
**Author:** [@gintek](https://discuss.elastic.co/u/gintek)\ **Replies:** 7\ **Last updated:** [October 24, 2019, 12:47pm UTC](https://discuss.elastic.co/t/slow-index-create/204862 "2019-10-24T12:47:26Z")
Hi, We are struggling with ES performance issue, we have daily indexes and minute or two after midnight our cluster is unavailable. Logstash indexer reports time out, after around 10 min everything back to normal. we tr… --- ## [Does elasticsearch automatically close replicated indices?](https://discuss.elastic.co/t/does-elasticsearch-automatically-close-replicated-indices/205019)
**Author:** [@kley](https://discuss.elastic.co/u/kley)\ **Replies:** 12\ **Last updated:** [October 24, 2019, 12:43pm UTC](https://discuss.elastic.co/t/does-elasticsearch-automatically-close-replicated-indices/205019 "2019-10-24T12:43:59Z")
Hey everybody :wave: I have a new question about the behavior of elasticsearch when it comes to cross cluster replication. First up, I cannot reproduce the issue, and I don't see any logs regarding an API call for clos… --- ## [TermVector of artifical doc + filtering](https://discuss.elastic.co/t/termvector-of-artifical-doc-filtering/205065)
**Author:** [@vptu](https://discuss.elastic.co/u/vptu)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 12:32pm UTC](https://discuss.elastic.co/t/termvector-of-artifical-doc-filtering/205065 "2019-10-24T12:32:02Z")
Hi, first of all I'm fairly new to elasticsearch so sorry if the question is too obvious to answer. I've created an index with multiple documents stored. I want to use the term vector api to create term vectors based … --- ## [Log management with elasticsearch](https://discuss.elastic.co/t/log-management-with-elasticsearch/205061)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 12:20pm UTC](https://discuss.elastic.co/t/log-management-with-elasticsearch/205061 "2019-10-24T12:20:39Z")
I would like to use elasticsearch as log management. How can I avoid that someone change o delete these logs and how can I verify their integrity. --- ## [Email and password field in /etc/elasticsearch/elasticsearch.yml](https://discuss.elastic.co/t/email-and-password-field-in-etc-elasticsearch-elasticsearch-yml/205023)
**Author:** [@elktester](https://discuss.elastic.co/u/elktester)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 9:56am UTC](https://discuss.elastic.co/t/email-and-password-field-in-etc-elasticsearch-elasticsearch-yml/205023 "2019-10-24T09:56:59Z")
Hello all; well, i'm new to elasticsearch, and i'm trying to configure elasticsearch to receive alerts, but I do not know what to put in the email and password field: /etc/elasticsearch/elasticsearch.yml xpack.notifi… --- ## [Elasticsearch heap usage increase after switching from Oracle Java 8 to OpenJDK11](https://discuss.elastic.co/t/elasticsearch-heap-usage-increase-after-switching-from-oracle-java-8-to-openjdk11/205034)
**Author:** [@A\_B](https://discuss.elastic.co/u/A_B)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 9:43am UTC](https://discuss.elastic.co/t/elasticsearch-heap-usage-increase-after-switching-from-oracle-java-8-to-openjdk11/205034 "2019-10-24T09:43:27Z")
Hello all, I have started testing of running Elasticsearch on OpenJDK11 and noticed that the jvm heap usage has changed. I changed the JAVA version and had to adjust jvm.options. I'm using Elasticsearch version 6.8.2. … --- ## [Negative size parameter](https://discuss.elastic.co/t/negative-size-parameter/205032)
**Author:** [@b789](https://discuss.elastic.co/u/b789)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 9:34am UTC](https://discuss.elastic.co/t/negative-size-parameter/205032 "2019-10-24T09:34:24Z")
Hi, while doing some test with elasticsearch (version 6.7) i notice that the size parameter seems to be ignored when set to -1 (the query returns 10 results as default) but setting it to a lower number, like -2 return a… --- ## [Implement product filter in Front End](https://discuss.elastic.co/t/implement-product-filter-in-front-end/205021)
**Author:** [@wjonkerhulst](https://discuss.elastic.co/u/wjonkerhulst)\ **Replies:** 0\ **Last updated:** [October 24, 2019, 8:51am UTC](https://discuss.elastic.co/t/implement-product-filter-in-front-end/205021 "2019-10-24T08:51:43Z")
Hey, I'am looking to built a products filter. I found some other post with the same question : https://discuss.elastic.co/t/query-for-ecommerce-product-filter-using-aggregation/47736 https://discuss.elastic.co/t/aggre… --- ## [I cannot use case in Kibana 6.8.3](https://discuss.elastic.co/t/i-cannot-use-case-in-kibana-6-8-3/204864)
**Author:** [@Minisha\_M](https://discuss.elastic.co/u/Minisha_M)\ **Replies:** 1\ **Last updated:** [October 24, 2019, 8:41am UTC](https://discuss.elastic.co/t/i-cannot-use-case-in-kibana-6-8-3/204864 "2019-10-24T08:41:10Z")
Case statements doesn't work in kibana canvas. I am using Kibana 6.8.3. Does it support case? For instance the below query giving me weird errors. Like below: Expression failed with the message: \[essql\] Couldnt parse … --- ## [Searching Duplicate terms in Index based on ID, splits the Id with limiter "-"](https://discuss.elastic.co/t/searching-duplicate-terms-in-index-based-on-id-splits-the-id-with-limiter/204900)
**Author:** [@Vinothkumar\_Ganeshan](https://discuss.elastic.co/u/Vinothkumar_Ganeshan)\ **Replies:** 2\ **Last updated:** [October 24, 2019, 8:28am UTC](https://discuss.elastic.co/t/searching-duplicate-terms-in-index-based-on-id-splits-the-id-with-limiter/204900 "2019-10-24T08:28:28Z")
Hello, I'm trying to find the duplicate based on a term "TDID" in a index. Basically the TDID : "00000-00000-0000000-00000" GET ttd-2019-04\*/\_search { "size" : 0, "\_source": \["TDID"\], "query": { "term": { "even… --- ## [Need to get latest 2 records](https://discuss.elastic.co/t/need-to-get-latest-2-records/204092)
**Author:** [@pathri](https://discuss.elastic.co/u/pathri)\ **Replies:** 9\ **Last updated:** [October 24, 2019, 8:15am UTC](https://discuss.elastic.co/t/need-to-get-latest-2-records/204092 "2019-10-24T08:15:27Z")
Hi, i need a query to fetch last and 2nd last record entered the index. What should be the query other than putting size: 2 after sorting and all? thanks --- ## [Efficient storage](https://discuss.elastic.co/t/efficient-storage/204684)
**Author:** [@eddie4](https://discuss.elastic.co/u/eddie4)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 8:13am UTC](https://discuss.elastic.co/t/efficient-storage/204684 "2019-10-24T08:13:49Z")
Hello, am planning on storing 1,5TB of textfiles in Elasticsearch. However I do not have a lot of space to spare above the text file size. Now I have been reading up on elastic search and how to minimize storage and I ha… --- ## [Logstash Error csv](https://discuss.elastic.co/t/logstash-error-csv/204814)
**Author:** [@Sakthivanan](https://discuss.elastic.co/u/Sakthivanan)\ **Replies:** 3\ **Last updated:** [October 24, 2019, 8:12am UTC](https://discuss.elastic.co/t/logstash-error-csv/204814 "2019-10-24T08:12:54Z")
this is my logstash file: input { file { type =\> "csv" start\_position=\>"beginning" path =\> "D:/Chrome Downloads/Text file/csv files/KPI Master.csv" sincedb\_path=\>"nul" } } filter { } output { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1112) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1114)