# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1121 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1122 --- ## [How to filter for only documents that have a specific field](https://discuss.elastic.co/t/how-to-filter-for-only-documents-that-have-a-specific-field/204134)
**Author:** [@Clang](https://discuss.elastic.co/u/Clang)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 9:59pm UTC](https://discuss.elastic.co/t/how-to-filter-for-only-documents-that-have-a-specific-field/204134 "2019-10-17T21:59:11Z")
Only some of our pages have a certain field associated with them. Let's call that field translated\_ja and the value would be a URL string. I want to provide a filter on the form that ultimately calls the swiftype search.… --- ## [Convert field type for ILM managed indices](https://discuss.elastic.co/t/convert-field-type-for-ilm-managed-indices/203486)
**Author:** [@penguinairlines](https://discuss.elastic.co/u/penguinairlines)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 8:50pm UTC](https://discuss.elastic.co/t/convert-field-type-for-ilm-managed-indices/203486 "2019-10-17T20:50:30Z")
I'm running into what I would assume is a common problem. Apologies in advanced for the long post, I just reviewed my steps and I realize that there are a lot of steps involved. Hopefully fleshing out this process will r… --- ## [Unassigned shard with inconsistent primary state and doc count differences](https://discuss.elastic.co/t/unassigned-shard-with-inconsistent-primary-state-and-doc-count-differences/203847)
**Author:** [@johnfzc](https://discuss.elastic.co/u/johnfzc)\ **Replies:** 16\ **Last updated:** [October 17, 2019, 7:49pm UTC](https://discuss.elastic.co/t/unassigned-shard-with-inconsistent-primary-state-and-doc-count-differences/203847 "2019-10-17T19:49:16Z")
I have a three node ES cluster running 5.6.5. Last week I restarted the servers in the cluster to make changes to their disk configuration, I did not follow any process to do this but after 12 hours the cluster and index… --- ## [ES 7.4.0 and SQL CLI Script :: Environment Variable Issue?](https://discuss.elastic.co/t/es-7-4-0-and-sql-cli-script-environment-variable-issue/203678)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [October 17, 2019, 7:41pm UTC](https://discuss.elastic.co/t/es-7-4-0-and-sql-cli-script-environment-variable-issue/203678 "2019-10-17T19:41:15Z")
Hi ELK Sensei (s), I recently upgraded to Elasticsearch 7.4.0 because I want to take advantage of the SQL-like queries. But I’m hitting issues with the CLI interface script. First off: I’m on an Ubuntu box, 16.04.4. My… --- ## [Elasticsearch Service 7.4/7.3 wont start](https://discuss.elastic.co/t/elasticsearch-service-7-4-7-3-wont-start/202842)
**Author:** [@Mike31mSalus](https://discuss.elastic.co/u/Mike31mSalus)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 6:36pm UTC](https://discuss.elastic.co/t/elasticsearch-service-7-4-7-3-wont-start/202842 "2019-10-17T18:36:29Z")
Fresh install on Windows Server 2016, Java jre-8u211x64. The install completes perfectly fine, but when i attempt to start the "Elasticsearch" service it looks like it is starting then stops. Below are the event logs of… --- ## [Attempting to use Curator (Elasticsearch)](https://discuss.elastic.co/t/attempting-to-use-curator-elasticsearch/204099)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 6:16pm UTC](https://discuss.elastic.co/t/attempting-to-use-curator-elasticsearch/204099 "2019-10-17T18:16:47Z")
Hello, I am trying to install curator for elasticsearch on Ubuntu. However, we are trying to have control of the location and have it set into a custom/given directory. I have tried using a tar package, however, it seems… --- ## [How to restore all snapshots from s3 repository](https://discuss.elastic.co/t/how-to-restore-all-snapshots-from-s3-repository/204053)
**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 5:52pm UTC](https://discuss.elastic.co/t/how-to-restore-all-snapshots-from-s3-repository/204053 "2019-10-17T17:52:20Z")
Here are examples for 1 snapshot restore curl -u ${USERNAME}:${PASSWORD} -X POST "localhost:9200/\_snapshot/s3-backup/curator-20191017074006/\_restore?pretty" curl -u ${USERNAME}:${PASSWORD} -X POST -H "Content-Type: app… --- ## [Combine two queries like a OR statement](https://discuss.elastic.co/t/combine-two-queries-like-a-or-statement/204100)
**Author:** [@Federico\_Pazos](https://discuss.elastic.co/u/Federico_Pazos)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 4:36pm UTC](https://discuss.elastic.co/t/combine-two-queries-like-a-or-statement/204100 "2019-10-17T16:36:30Z")
Hi! I'm trying to create an Elastic Search query to modify the data received but I don't have much knowledge about Elastic and I don't know how to accomplish that. I have my "tasks" data with three properties, assignedT… --- ## [ES migration options](https://discuss.elastic.co/t/es-migration-options/203703)
**Author:** [@SpeedDaemon](https://discuss.elastic.co/u/SpeedDaemon)\ **Replies:** 4\ **Last updated:** [October 17, 2019, 4:28pm UTC](https://discuss.elastic.co/t/es-migration-options/203703 "2019-10-17T16:28:54Z")
I'm currently in the process of moving an Elasticsearch cluster from VM/SAN to physical/local disk. Current cluster is 6 VMs, each with 2 data nodes and either a master or client node (total 3 master, 3 client, 12 data)… --- ## [Dead connection to ES](https://discuss.elastic.co/t/dead-connection-to-es/200597)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 4\ **Last updated:** [October 17, 2019, 3:58pm UTC](https://discuss.elastic.co/t/dead-connection-to-es/200597 "2019-10-17T15:58:09Z")
Preformatted textI am trying to send some logs to Elastic search service which i have configured in AWS console , below is my sample config file input { file { path =\> "/var/log/logstash/\*.log" start\_position =\> "be… --- ## [Unstable after starting nodes](https://discuss.elastic.co/t/unstable-after-starting-nodes/200526)
**Author:** [@Tex](https://discuss.elastic.co/u/Tex)\ **Replies:** 14\ **Last updated:** [October 17, 2019, 3:11pm UTC](https://discuss.elastic.co/t/unstable-after-starting-nodes/200526 "2019-10-17T15:11:01Z")
Hi, ES: v7.3.2 I create a brand new cluster with 3 master nodes, no problem all running fine. but each time that i want to add a node ( no master ) after some time ( 1h ) the node disappear, monitoring show node was re… --- ## [Accessing the inverse index](https://discuss.elastic.co/t/accessing-the-inverse-index/204005)
**Author:** [@ftr](https://discuss.elastic.co/u/ftr)\ **Replies:** 5\ **Last updated:** [October 17, 2019, 3:09pm UTC](https://discuss.elastic.co/t/accessing-the-inverse-index/204005 "2019-10-17T15:09:19Z")
I am currently researching the contents of an index on an old 1.7.1 ES cluster, in relation to GDPR related issues. In other words, I need to know exactly what can be retrieved from the cluster. I have come up against a… --- ## [How to match multiple should clauses?](https://discuss.elastic.co/t/how-to-match-multiple-should-clauses/204066)
**Author:** [@randomuser](https://discuss.elastic.co/u/randomuser)\ **Replies:** 5\ **Last updated:** [October 17, 2019, 2:50pm UTC](https://discuss.elastic.co/t/how-to-match-multiple-should-clauses/204066 "2019-10-17T14:50:21Z")
Hello, I'm looking for a way of matching multiple should cases. To explain this better, lets use this example: "query": { "bool": { "must": \[ ... \] "should": \[ { "terms" … --- ## [\[Theoretical\] How does query filtering upon nested aggregation work?](https://discuss.elastic.co/t/theoretical-how-does-query-filtering-upon-nested-aggregation-work/204072)
**Author:** [@randomuser](https://discuss.elastic.co/u/randomuser)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 2:06pm UTC](https://discuss.elastic.co/t/theoretical-how-does-query-filtering-upon-nested-aggregation-work/204072 "2019-10-17T14:06:07Z")
I've just used a really neat option - filtering upon nested aggregation values. I love it, it works the way it's supposed to, but I'm interested in how does it work and in which order are the filters/aggregations execute… --- ## [How can I obtain a list of indices in ILM lifecycle error state](https://discuss.elastic.co/t/how-can-i-obtain-a-list-of-indices-in-ilm-lifecycle-error-state/204027)
**Author:** [@bruce289](https://discuss.elastic.co/u/bruce289)\ **Replies:** 2\ **Last updated:** [October 17, 2019, 2:06pm UTC](https://discuss.elastic.co/t/how-can-i-obtain-a-list-of-indices-in-ilm-lifecycle-error-state/204027 "2019-10-17T14:06:31Z")
Is there any way to get a list of indices that currently have lifecycle errors? I'm trying to setup a watcher job that will send a notification based on whether there are any such indices. Thanks. --- ## [Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana instance is attempting migrations, you can get past this message by deleting index .kibana\_1 and restarting Kibana](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete-if-no-other-kibana-instance-is-attempting-migrations-you-can-get-past-this-message-by-deleting-index-kibana-1-and-restarting-kibana/204051)
**Author:** [@subha1](https://discuss.elastic.co/u/subha1)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 12:35pm UTC](https://discuss.elastic.co/t/another-kibana-instance-appears-to-be-migrating-the-index-waiting-for-that-migration-to-complete-if-no-other-kibana-instance-is-attempting-migrations-you-can-get-past-this-message-by-deleting-index-kibana-1-and-restarting-kibana/204051 "2019-10-17T12:35:09Z")
I have deployed ELK-7 , All the pods have come up successfully , But kibana pod shows this error . Another Kibana instance appears to be migrating the index. Waiting for that migration to complete. If no other Kibana in… --- ## [Safely upgrade from Elasticsearch 1.7.3 to 7.x](https://discuss.elastic.co/t/safely-upgrade-from-elasticsearch-1-7-3-to-7-x/203973)
**Author:** [@deltafarce](https://discuss.elastic.co/u/deltafarce)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 12:21pm UTC](https://discuss.elastic.co/t/safely-upgrade-from-elasticsearch-1-7-3-to-7-x/203973 "2019-10-17T12:21:21Z")
Hello, this might be too basic a question for the forums, but I'm in the process of upgrading our infrastructure and we run the really outdated version of Elasticsearch 1.7.3. It badly needs an upgrade to a service suppo… --- ## [What is the difference in specifying the index in the URL with specifying the index in the query body?](https://discuss.elastic.co/t/what-is-the-difference-in-specifying-the-index-in-the-url-with-specifying-the-index-in-the-query-body/203910)
**Author:** [@Henrique\_Brasileiro](https://discuss.elastic.co/u/Henrique_Brasileiro)\ **Replies:** 3\ **Last updated:** [October 17, 2019, 12:19pm UTC](https://discuss.elastic.co/t/what-is-the-difference-in-specifying-the-index-in-the-url-with-specifying-the-index-in-the-query-body/203910 "2019-10-17T12:19:17Z")
I want to undenstand the performance diference between: GET /\_search { "query": { "terms": { "\_index": \["index\_1", "index\_2"\] } } } and: GET index\_1,index\_2/\_search --- ## [Sub : Data node unable to discover master node in another machine](https://discuss.elastic.co/t/sub-data-node-unable-to-discover-master-node-in-another-machine/203459)
**Author:** [@R.mohan\_raj](https://discuss.elastic.co/u/R.mohan_raj)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 12:08pm UTC](https://discuss.elastic.co/t/sub-data-node-unable-to-discover-master-node-in-another-machine/203459 "2019-10-17T12:08:43Z")
I am trying to deploy a 2 node(1 master,1 data) elasticsearch cluster using docker and was able to start the first node as master without any issues but when I try to start the second… --- ## [Unable to allocate index](https://discuss.elastic.co/t/unable-to-allocate-index/203653)
**Author:** [@Merlin\_Nunez](https://discuss.elastic.co/u/Merlin_Nunez)\ **Replies:** 7\ **Last updated:** [October 17, 2019, 12:02pm UTC](https://discuss.elastic.co/t/unable-to-allocate-index/203653 "2019-10-17T12:02:15Z")
Hi All, I´veen facing issue with an elasticsearch cluster, that first out of the blue, and later after a restart failed to allocate an index. The cluser has a single node atm and replication is disabled. When I check … --- ## [Bucket Sort on non-numeric (keyword) field](https://discuss.elastic.co/t/bucket-sort-on-non-numeric-keyword-field/204041)
**Author:** [@mateuszjarzyna](https://discuss.elastic.co/u/mateuszjarzyna)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 11:44am UTC](https://discuss.elastic.co/t/bucket-sort-on-non-numeric-keyword-field/204041 "2019-10-17T11:44:11Z")
I have index with products, each product has category and category\_owner. I'd like to show on my GUI table with all categories sorted by category\_owner, but table must be pageable. I know there is a way to sort (and pag… --- ## [Attempted to send a bulk request to elasticsearch' but Elasticsearch appears to be unreachable](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable/204029)
**Author:** [@wangzf](https://discuss.elastic.co/u/wangzf)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 10:47am UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-but-elasticsearch-appears-to-be-unreachable/204029 "2019-10-17T10:47:00Z")
hi,i hava a question ,my cluster is green ,but my logstasht hava this error Oct 15 09:17:16 logstashmysql logstash\[14839\]: \[2019-10-15T09:17:16,974\]\[WARN \]\[logstash.outputs.elasticsearch\] Marking url as dead. Last error… --- ## [Question shard allocation awareness?](https://discuss.elastic.co/t/question-shard-allocation-awareness/201565)
**Author:** [@CJ1](https://discuss.elastic.co/u/CJ1)\ **Replies:** 15\ **Last updated:** [October 17, 2019, 10:26am UTC](https://discuss.elastic.co/t/question-shard-allocation-awareness/201565 "2019-10-17T10:26:07Z")
Enabled shard allocation awareness/forced-awareness in the cluster, right now enabled for two zones "cluster.routing.allocation.awareness.attributes" : "rack\_id" "cluster.routing.allocation.awareness.force.rack\_id.value… --- ## [ES 7.4.0: Getting Exception when reading remote cluster stats](https://discuss.elastic.co/t/es-7-4-0-getting-exception-when-reading-remote-cluster-stats/203884)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 1\ **Last updated:** [October 17, 2019, 10:17am UTC](https://discuss.elastic.co/t/es-7-4-0-getting-exception-when-reading-remote-cluster-stats/203884 "2019-10-17T10:17:51Z")
I just did a fresh install of 7.4 on a 2 node setup and getting following exception on node\_1 when I run command \`\`curl -XGET "localhost:9200/\_cat/allocation"\` on node\_1. \[2019-10-16T16:26:45,007\]\[DEBUG\]\[o.e.a.a.c.n.s.T… --- ## [ElasticSearch error Kibana not loading data](https://discuss.elastic.co/t/elasticsearch-error-kibana-not-loading-data/204012)
**Author:** [@Dhanushka1282](https://discuss.elastic.co/u/Dhanushka1282)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 9:31am UTC](https://discuss.elastic.co/t/elasticsearch-error-kibana-not-loading-data/204012 "2019-10-17T09:31:54Z")
Hi guys im getting below error when starting elasticsearch . Can you guys please help me to fix the this issue \[2019-10-17T14:53:43,856\]\[INFO \]\[o.e.c.m.MetaDataIndexTemplateService\] \[node-1\] adding template \[.manageme… --- ## [Audit logs not updating properly](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013)
**Author:** [@arun.kumar92](https://discuss.elastic.co/u/arun.kumar92)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 9:33am UTC](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013 "2019-10-17T09:33:19Z")
Hi Folks I'm facing an issue in elasticsearch audit logs part. Audit logs not updating after somtime during restart. Configuration details Kindly go through the below log4j2.properties file \`status = error appender.c… --- ## [How to get XPACK running for Detecting DNS Data Exfiltration](https://discuss.elastic.co/t/how-to-get-xpack-running-for-detecting-dns-data-exfiltration/202962)
**Author:** [@octogar](https://discuss.elastic.co/u/octogar)\ **Replies:** 7\ **Last updated:** [October 17, 2019, 9:21am UTC](https://discuss.elastic.co/t/how-to-get-xpack-running-for-detecting-dns-data-exfiltration/202962 "2019-10-17T09:21:23Z")
On this page: https://www.elastic.co/what-is/elasticsearch-machine-learning/recipes/dns-data-exfiltration-tunneling ..when you click on the example there are directions: https://github.com/elastic/examples/blob/master/M… --- ## [Alias with high number of indices](https://discuss.elastic.co/t/alias-with-high-number-of-indices/204008)
**Author:** [@ctombaugh](https://discuss.elastic.co/u/ctombaugh)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 8:57am UTC](https://discuss.elastic.co/t/alias-with-high-number-of-indices/204008 "2019-10-17T08:57:07Z")
I have a collection of around 100,000,000 documents, which consists of a few thousand subsets (each tens to millions of documents). Most of these subsets are regularly updated (wipe and replace, a few times per month). U… --- ## [Could not find the java in JAVA\_HOME or bundled at C:\\Software\\elasticsearch-7.4.0-windows-x86\_64\\elasticsearch-7.4.0\\jdk](https://discuss.elastic.co/t/could-not-find-the-java-in-java-home-or-bundled-at-c-software-elasticsearch-7-4-0-windows-x86-64-elasticsearch-7-4-0-jdk/204000)
**Author:** [@pratapkuraganti](https://discuss.elastic.co/u/pratapkuraganti)\ **Replies:** 0\ **Last updated:** [October 17, 2019, 8:28am UTC](https://discuss.elastic.co/t/could-not-find-the-java-in-java-home-or-bundled-at-c-software-elasticsearch-7-4-0-windows-x86-64-elasticsearch-7-4-0-jdk/204000 "2019-10-17T08:28:10Z")
Hi all, We are facing an issue while installing the Elasticsearch software in window 2016 server. " Could not find the java in JAVA\_HOME or bundled at C:\\Software\\elasticsearch-7.4.0-windows-x86\_64\\elasticsearch-7.4.0\\… --- ## [Simple example of new configuration of three node cluster, since v7.x update uses new settings](https://discuss.elastic.co/t/simple-example-of-new-configuration-of-three-node-cluster-since-v7-x-update-uses-new-settings/203922)
**Author:** [@AnitaL](https://discuss.elastic.co/u/AnitaL)\ **Replies:** 6\ **Last updated:** [October 17, 2019, 8:00am UTC](https://discuss.elastic.co/t/simple-example-of-new-configuration-of-three-node-cluster-since-v7-x-update-uses-new-settings/203922 "2019-10-17T08:00:27Z")
Hi, I took the Elasticsearch Engineer 1 training this summer (ES 6.x), then completed the Engineer 2 training (ES 7.x) Since I learned this the config settings no longer use : discovery.zen.ping.unicast.hosts: \["server… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1120) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1122)