# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1116 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1117 --- ## [Parent circuit breaker calculation seems to be wrong with version 7.x](https://discuss.elastic.co/t/parent-circuit-breaker-calculation-seems-to-be-wrong-with-version-7-x/183530)
**Author:** [@e-orz](https://discuss.elastic.co/u/e-orz)\ **Replies:** 21\ **Last updated:** [October 22, 2019, 7:52pm UTC](https://discuss.elastic.co/t/parent-circuit-breaker-calculation-seems-to-be-wrong-with-version-7-x/183530 "2019-10-22T19:52:31Z")
Hi, After upgrading to ES we started to notice that sometimes search or bulk request fail with: \[parent\] Data too large, data for \[\\] would be \[3070458198/2.8gb\], which is larger than the limit of \[30… --- ## [Is this expected behaviour of split processor in a pipeline?](https://discuss.elastic.co/t/is-this-expected-behaviour-of-split-processor-in-a-pipeline/204754)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 4:29am UTC](https://discuss.elastic.co/t/is-this-expected-behaviour-of-split-processor-in-a-pipeline/204754 "2019-10-23T04:29:14Z")
I am on ES 7.2.0 I create a simple pipeline: PUT \_ingest/pipeline/test\_pipeline { "description": "test", "processors": \[ { "split": { "field": "message", "target\_field": "splitdata", … --- ## [Aggregate Query on a Large Number of Documents by filtering out fewer doc counts](https://discuss.elastic.co/t/aggregate-query-on-a-large-number-of-documents-by-filtering-out-fewer-doc-counts/204721)
**Author:** [@rvshchwl](https://discuss.elastic.co/u/rvshchwl)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 3:18am UTC](https://discuss.elastic.co/t/aggregate-query-on-a-large-number-of-documents-by-filtering-out-fewer-doc-counts/204721 "2019-10-23T03:18:28Z")
I am trying to write an Aggregate Query for Elasticsearch, that can be performed on a large volume of data, but also filters out any buckets that have a small doc count. The data I am using is structured as follows (rel… --- ## [EFK ILM Configuration](https://discuss.elastic.co/t/efk-ilm-configuration/204577)
**Author:** [@ZMMWMY](https://discuss.elastic.co/u/ZMMWMY)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 2:29am UTC](https://discuss.elastic.co/t/efk-ilm-configuration/204577 "2019-10-23T02:29:50Z")
I use efk(filebeat,fluentd,elasticsearch) to collect my application logs and create new indexes every day. Like sxc-gateway-2019.10.20, sxc-gateway-2019.10.21, sxc-stocke-service-2019.10.20, sxc-stocke-service-2019.10.2… --- ## [Extract year from date field and assign to new field](https://discuss.elastic.co/t/extract-year-from-date-field-and-assign-to-new-field/204691)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 2:23am UTC](https://discuss.elastic.co/t/extract-year-from-date-field-and-assign-to-new-field/204691 "2019-10-23T02:23:19Z")
Hi All, is there a way to extract year from date field and assign to new field? I want to update existing mapping with new field or i can re-index with new new mapping as well. Please suggest. --- ## [Can Oracle Data Integrator (ODI) insert records into Elasticsearch](https://discuss.elastic.co/t/can-oracle-data-integrator-odi-insert-records-into-elasticsearch/204698)
**Author:** [@mmch](https://discuss.elastic.co/u/mmch)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 1:20am UTC](https://discuss.elastic.co/t/can-oracle-data-integrator-odi-insert-records-into-elasticsearch/204698 "2019-10-23T01:20:00Z")
Can Oracle Data Integrator (ODI) insert records into Elasticsearch? I've used logstash, but that's not what I'm trying to do. I basically want to be able to read a delimited file from a directory, and write those recor… --- ## [Performance of keyword vs fielddata](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742)
**Author:** [@yungnvn](https://discuss.elastic.co/u/yungnvn)\ **Replies:** 1\ **Last updated:** [October 23, 2019, 1:11am UTC](https://discuss.elastic.co/t/performance-of-keyword-vs-fielddata/204742 "2019-10-23T01:11:42Z")
Hi, I had a couple of questions regarding keywords vs fielddata. I understand if fielddata type for "text" fields are enabled, it is much more performance intensive since it has to store it in the JVM memory itself. … --- ## [Fuzzy query with simple query string](https://discuss.elastic.co/t/fuzzy-query-with-simple-query-string/204745)
**Author:** [@georgina](https://discuss.elastic.co/u/georgina)\ **Replies:** 0\ **Last updated:** [October 23, 2019, 1:09am UTC](https://discuss.elastic.co/t/fuzzy-query-with-simple-query-string/204745 "2019-10-23T01:09:08Z")
I'm trying to get fuzzy searching working using simple\_query\_string. An example query: "query":{ "simple\_query\_string": { "query" : "drover", "fields" : \[ "description^1.0", "title^1.0", "content^1.0" \], "flags… --- ## [How to mix nested object with script in aggregation?](https://discuss.elastic.co/t/how-to-mix-nested-object-with-script-in-aggregation/204741)
**Author:** [@lhartzman](https://discuss.elastic.co/u/lhartzman)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 11:50pm UTC](https://discuss.elastic.co/t/how-to-mix-nested-object-with-script-in-aggregation/204741 "2019-10-22T23:50:19Z")
I want to concatenate 2 document fields, one of which is a nested object. If it were not nested, it wouldn't be a problem, but with script you can't mix nested. A sample mapping is: { "\_doc": { "properties… --- ## [Index / document design for API logs, plus some extra data](https://discuss.elastic.co/t/index-document-design-for-api-logs-plus-some-extra-data/204733)
**Author:** [@D-Sect](https://discuss.elastic.co/u/D-Sect)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 9:32pm UTC](https://discuss.elastic.co/t/index-document-design-for-api-logs-plus-some-extra-data/204733 "2019-10-22T21:32:06Z")
Hello, I am struggling a bit with a business use case, and I am trying to see if Elastic is the right fit. The use case is to be able query our systems' API logs (calls to our APIs from the outside) to answer questions… --- ## [How many shards per node](https://discuss.elastic.co/t/how-many-shards-per-node/204641)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 8:06pm UTC](https://discuss.elastic.co/t/how-many-shards-per-node/204641 "2019-10-22T20:06:40Z")
From blog : A good rule is to ensure to keep the number of shards per node below 20 per GB heap. How many shards per node is better to have a low overhead in case of fault ? --- ## [Can't start Elasticsearch on Ubuntu 19.10](https://discuss.elastic.co/t/cant-start-elasticsearch-on-ubuntu-19-10/204353)
**Author:** [@dandago](https://discuss.elastic.co/u/dandago)\ **Replies:** 5\ **Last updated:** [October 22, 2019, 6:35pm UTC](https://discuss.elastic.co/t/cant-start-elasticsearch-on-ubuntu-19-10/204353 "2019-10-22T18:35:42Z")
I am trying to run Elasticsearch on Ubuntu 19.10, which was released just three days ago. I downloaded the Elasticsearch 7.4.0 .tar.gz file from https://www.elastic.co/downloads/elasticsearch I extracted the .tar.gz I… --- ## [Cluster constantly crashing after upgrade to 7.4](https://discuss.elastic.co/t/cluster-constantly-crashing-after-upgrade-to-7-4/202580)
**Author:** [@frederikwerner](https://discuss.elastic.co/u/frederikwerner)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 6:23pm UTC](https://discuss.elastic.co/t/cluster-constantly-crashing-after-upgrade-to-7-4/202580 "2019-10-22T18:23:53Z")
Hey guys, I recently upgraded my 3 node ES cluster to version 7.4. This cluster, which has been running forever (literally years) without any real problems, just started falling apart since then. Nothing besides the ES … --- ## [Update API script - create array of structures](https://discuss.elastic.co/t/update-api-script-create-array-of-structures/204418)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 3:43pm UTC](https://discuss.elastic.co/t/update-api-script-create-array-of-structures/204418 "2019-10-22T15:43:04Z")
I am using Elasticsearch 6.5. I am writing a script for an update API in painless. I need to add structures to an array of structures. If this field does not exist in the document (I can detect that) I am creating a new … --- ## [Seeing a lot of failed to execute pipeline \[geoip-info\] for document \[auditbeat-7.4.0-insertdatehere./\_doc/null\]](https://discuss.elastic.co/t/seeing-a-lot-of-failed-to-execute-pipeline-geoip-info-for-document-auditbeat-7-4-0-insertdatehere-doc-null/203574)
**Author:** [@starrynight](https://discuss.elastic.co/u/starrynight)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 3:16pm UTC](https://discuss.elastic.co/t/seeing-a-lot-of-failed-to-execute-pipeline-geoip-info-for-document-auditbeat-7-4-0-insertdatehere-doc-null/203574 "2019-10-22T15:16:57Z")
I've just started to configure the pipeline for Elastic SIEM for geopoints and am finding that my pipeline completely stops (usually as the index rolls over for the next day, I literally am not erroring as of 23:58 of th… --- ## [ES SQL Script :: Version Issue and Default Password?](https://discuss.elastic.co/t/es-sql-script-version-issue-and-default-password/204259)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 3:08pm UTC](https://discuss.elastic.co/t/es-sql-script-version-issue-and-default-password/204259 "2019-10-22T15:08:44Z")
Hi Elasticsearch Masters, I’m running ES v 7.4.0 as a Docker container. My host box is a Ubuntu box, 16.04.4; my version of Docker is 17.09.0-ce, build afdb6d4. I want to use the /usr/share/elasticsearch/bin/elasticse… --- ## [Splitting Content](https://discuss.elastic.co/t/splitting-content/204676)
**Author:** [@NashSLX](https://discuss.elastic.co/u/NashSLX)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 3:08pm UTC](https://discuss.elastic.co/t/splitting-content/204676 "2019-10-22T15:08:22Z")
I'm looking for some input on how to solve a specific issue. I have an idea already, but I'm worried I'm getting a bit off track by just adding more and more analyzers to a single field. Our index contains documents in … --- ## [Significance of the property ignore\_above\>256 in ElasticSearch](https://discuss.elastic.co/t/significance-of-the-property-ignore-above-256-in-elasticsearch/204487)
**Author:** [@Varun\_S](https://discuss.elastic.co/u/Varun_S)\ **Replies:** 4\ **Last updated:** [October 22, 2019, 2:28pm UTC](https://discuss.elastic.co/t/significance-of-the-property-ignore-above-256-in-elasticsearch/204487 "2019-10-22T14:28:15Z")
Hi, I have created index with default configuration . Ex:- 1 shard and ignore\_above\>256. But when i am pushing string which has more than 300 characters, Elaticsearch is indexing the data and also all 300 characters ar… --- ## [Analysis a string and then search in Elastic Search](https://discuss.elastic.co/t/analysis-a-string-and-then-search-in-elastic-search/204661)
**Author:** [@Mehrdad.dev](https://discuss.elastic.co/u/Mehrdad.dev)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 2:12pm UTC](https://discuss.elastic.co/t/analysis-a-string-and-then-search-in-elastic-search/204661 "2019-10-22T14:12:40Z")
Hi everyone . I have a micro service that get a string and want to search in Elastic Search. I have two field in my Elastic Search : 1- FirstName 2- LastName But when the user write a string for search another us… --- ## [Error with curl when trying out \_rollover api](https://discuss.elastic.co/t/error-with-curl-when-trying-out-rollover-api/204655)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 1:49pm UTC](https://discuss.elastic.co/t/error-with-curl-when-trying-out-rollover-api/204655 "2019-10-22T13:49:43Z")
Hi, I'm trying to call the following with CURL in a container: "curl -g -u admin:password "https://10.233.24.239:9200/logs\_write/\_rollover" -H 'Content-Type: application/json' -d '{"conditions": {"max\_size": "5gb"}}'" … --- ## [How to Import the Github Repository , Issues into the Elastic search. I want to connect to github from Elastic search using JDBC or any other option](https://discuss.elastic.co/t/how-to-import-the-github-repository-issues-into-the-elastic-search-i-want-to-connect-to-github-from-elastic-search-using-jdbc-or-any-other-option/204424)
**Author:** [@manu4387](https://discuss.elastic.co/u/manu4387)\ **Replies:** 3\ **Last updated:** [October 22, 2019, 1:19pm UTC](https://discuss.elastic.co/t/how-to-import-the-github-repository-issues-into-the-elastic-search-i-want-to-connect-to-github-from-elastic-search-using-jdbc-or-any-other-option/204424 "2019-10-22T13:19:17Z")
How to Import the Github Repository , Issues into the Elastic search. I want to connect to github from Elastic search using JDBC or any other option. --- ## [Failed, restarting discovery Master not available](https://discuss.elastic.co/t/failed-restarting-discovery-master-not-available/203401)
**Author:** [@nytramworc](https://discuss.elastic.co/u/nytramworc)\ **Replies:** 12\ **Last updated:** [October 22, 2019, 1:17pm UTC](https://discuss.elastic.co/t/failed-restarting-discovery-master-not-available/203401 "2019-10-22T13:17:26Z")
Hi I hope someone here can help. i've recently setup a three node cluster on AKS using the elasticsearch helm chart, using pretty much all of the default values (aprat from the obvious persistent volumes etc..) and ever… --- ## [Which parameter we need to use for network\_host in IPv6 for ElasticSearch](https://discuss.elastic.co/t/which-parameter-we-need-to-use-for-network-host-in-ipv6-for-elasticsearch/204048)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 5\ **Last updated:** [October 22, 2019, 12:53pm UTC](https://discuss.elastic.co/t/which-parameter-we-need-to-use-for-network-host-in-ipv6-for-elasticsearch/204048 "2019-10-22T12:53:47Z")
we had deployed elasticsearch in kubernetes environment on IPv6 vms , when we set network\_host parameter as "site", ElasticSearch pods shows the below error For site parameter we are getting org.elasticsearch.bootstrap… --- ## [Trying to configure Kibana 7.0 with ES 7.0 locally on Windows 10](https://discuss.elastic.co/t/trying-to-configure-kibana-7-0-with-es-7-0-locally-on-windows-10/204648)
**Author:** [@Reeshabh\_Choudhary](https://discuss.elastic.co/u/Reeshabh_Choudhary)\ **Replies:** 0\ **Last updated:** [October 22, 2019, 12:47pm UTC](https://discuss.elastic.co/t/trying-to-configure-kibana-7-0-with-es-7-0-locally-on-windows-10/204648 "2019-10-22T12:47:40Z")
My ES is running on localhost:9200 and in kibana.yml, I have kept default settings, without changing anything. I am getting the following error on Kibana console: License information from the X-Pack plugin could not be … --- ## [Boost should query](https://discuss.elastic.co/t/boost-should-query/204546)
**Author:** [@atef](https://discuss.elastic.co/u/atef)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 12:42pm UTC](https://discuss.elastic.co/t/boost-should-query/204546 "2019-10-22T12:42:11Z")
Is there anyone can help me how to boost sould query my example is the following "should": \[ { "multi\_match": { "query": "apple", "fuzziness": "AUTO", "fields": \["name", "name.stemmed"\] }}, { "multi\_match": { "query":… --- ## [Weird replication auto altering mapping behavior \[Solved\]](https://discuss.elastic.co/t/weird-replication-auto-altering-mapping-behavior-solved/204638)
**Author:** [@cedric\_landre](https://discuss.elastic.co/u/cedric_landre)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 12:20pm UTC](https://discuss.elastic.co/t/weird-replication-auto-altering-mapping-behavior-solved/204638 "2019-10-22T12:20:08Z")
Hello everyone, I encoutered a very strange behavior causing query error due to invalid type. On a project I create several indexes with the same mapping, but different names "anSampleOriginalIndex" : { "mappi… --- ## [Unable to authenticate roles for ldap users](https://discuss.elastic.co/t/unable-to-authenticate-roles-for-ldap-users/204619)
**Author:** [@sanket07](https://discuss.elastic.co/u/sanket07)\ **Replies:** 1\ **Last updated:** [October 22, 2019, 11:12am UTC](https://discuss.elastic.co/t/unable-to-authenticate-roles-for-ldap-users/204619 "2019-10-22T11:12:37Z")
I am able to authenticate the user but not the role assigned to it in role\_mapping.yml file. Getting following error {"error":{"root\_cause":\[{"type":"security\_exception","reason":"action \[cluster:monitor/main\] is unaut… --- ## [Creating a watcher to compare a float value](https://discuss.elastic.co/t/creating-a-watcher-to-compare-a-float-value/204578)
**Author:** [@Shan\_Chathusanda](https://discuss.elastic.co/u/Shan_Chathusanda)\ **Replies:** 6\ **Last updated:** [October 22, 2019, 10:46am UTC](https://discuss.elastic.co/t/creating-a-watcher-to-compare-a-float-value/204578 "2019-10-22T10:46:24Z")
Hi, Currently I am working on a watcher in Kibana 7.x. In here I need to compare a field (which is a float value) and perform an action. I am using a advanced watch for this requirement. Here I extract the field that I … --- ## [Custom fields in ECS](https://discuss.elastic.co/t/custom-fields-in-ecs/199721)
**Author:** [@phruby](https://discuss.elastic.co/u/phruby)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 8:49am UTC](https://discuss.elastic.co/t/custom-fields-in-ecs/199721 "2019-10-22T08:49:25Z")
Hello, for our use case is sometimes important to include fields not present in Elastic Common Schema. There are two main cases: Fields that conceptually belong an existing ECS fieldset, but are not included to ECS 1… --- ## [Alias update](https://discuss.elastic.co/t/alias-update/204481)
**Author:** [@QwerFact](https://discuss.elastic.co/u/QwerFact)\ **Replies:** 2\ **Last updated:** [October 22, 2019, 8:45am UTC](https://discuss.elastic.co/t/alias-update/204481 "2019-10-22T08:45:20Z")
Dear community, I'm looking for a solution to update alias based on time indices. Especially to clear old indices. I have created an indice template: PUT \_template/data { "index\_patterns": \["logs-data-\*"\], "setting… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1115) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1117)