# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1122

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1123

---

## [Joda time vs Java Time in 6.8](https://discuss.elastic.co/t/joda-time-vs-java-time-in-6-8/203594)

<div class="topic-metadata">

**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 6:04am UTC](https://discuss.elastic.co/t/joda-time-vs-java-time-in-6-8/203594 "2019-10-17T06:04:52Z")

</div>

got a working 6.8 cluster ingesting data into indicies with templates that defines some date fields like this: "os\_installed": { "type": "date", "format": "MM/DD/YYYY||MM\\/DD\\/YYYY||MM\\\\/DD\\\\/YYYY||strict\_year…

---

## [org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class \[org.elasticsearch.xpack.core.XPackPlugin\]](https://discuss.elastic.co/t/org-elasticsearch-bootstrap-startupexception-java-lang-illegalstateexception-failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/203995)

<div class="topic-metadata">

**Author:** [@aniq](https://discuss.elastic.co/u/aniq)\
**Replies:** 0\
**Last updated:** [October 17, 2019, 7:43am UTC](https://discuss.elastic.co/t/org-elasticsearch-bootstrap-startupexception-java-lang-illegalstateexception-failed-to-load-plugin-class-org-elasticsearch-xpack-core-xpackplugin/203995 "2019-10-17T07:43:14Z")

</div>

i am trying to unable RBAC in elasticsearch but when in enable it in elastic search cnfiguratin elasticsearch stops working follwing is the log file. \<\> at java.lang.reflect.Constructor.newInstance(Constructor.java:481)…

---

## [Fscrawler not indexing the tif / tiff files in elastic search](https://discuss.elastic.co/t/fscrawler-not-indexing-the-tif-tiff-files-in-elastic-search/203294)

<div class="topic-metadata">

**Author:** [@shreyasht](https://discuss.elastic.co/u/shreyasht)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 7:22am UTC](https://discuss.elastic.co/t/fscrawler-not-indexing-the-tif-tiff-files-in-elastic-search/203294 "2019-10-17T07:22:38Z")

</div>

fscrawler is not indexing the tif / tiff files in elastic search. I can see the meta data being indexed, but I cannot see the tiff file context in elastic search. Other than adding the jai jar in lib, do i need to do any…

---

## [Elasticsearch upgrading to 7.4.0 version](https://discuss.elastic.co/t/elasticsearch-upgrading-to-7-4-0-version/203991)

<div class="topic-metadata">

**Author:** [@haythem](https://discuss.elastic.co/u/haythem)\
**Replies:** 1\
**Last updated:** [October 17, 2019, 7:21am UTC](https://discuss.elastic.co/t/elasticsearch-upgrading-to-7-4-0-version/203991 "2019-10-17T07:21:58Z")

</div>

Hi guys , i downloaded the latest version of elasticsearch(7.4.0) and my current verison is the 7.2.1 but my problem is i want to get all the data from and dashboards from the previous version to the new version . can y…

---

## [Reindexing a document of size \> 100mb](https://discuss.elastic.co/t/reindexing-a-document-of-size-100mb/203765)

<div class="topic-metadata">

**Author:** [@daso](https://discuss.elastic.co/u/daso)\
**Replies:** 2\
**Last updated:** [October 17, 2019, 7:10am UTC](https://discuss.elastic.co/t/reindexing-a-document-of-size-100mb/203765 "2019-10-17T07:10:30Z")

</div>

Hi, I am trying to do a remote reindex a document which is of size \>100mb but it is failing with the below exception error={type=illegal\_argument\_exception, reason=Remote responded with a chunk that was too large. Use …

---

## [Rename field names while Indexing a document](https://discuss.elastic.co/t/rename-field-names-while-indexing-a-document/203989)

<div class="topic-metadata">

**Author:** [@Revanth](https://discuss.elastic.co/u/Revanth)\
**Replies:** 0\
**Last updated:** [October 17, 2019, 7:09am UTC](https://discuss.elastic.co/t/rename-field-names-while-indexing-a-document/203989 "2019-10-17T07:09:07Z")

</div>

I have a JSON object with some of the fields like this:- { "desc": "this is test description", "name": "some random name", } While indexing this document, I would like to change the field names …

---

## [Not able to start data node for ES cluster](https://discuss.elastic.co/t/not-able-to-start-data-node-for-es-cluster/203986)

<div class="topic-metadata">

**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Replies:** 0\
**Last updated:** [October 17, 2019, 6:57am UTC](https://discuss.elastic.co/t/not-able-to-start-data-node-for-es-cluster/203986 "2019-10-17T06:57:11Z")

</div>

Hello @dadoonet, Can you please help me in this? I am trying develop elasticsearch clustering using 2 servers. They both are different hosts. I want to create one data and one master node. Please find below Elasticsea…

---

## [Problem with starting rally daemon](https://discuss.elastic.co/t/problem-with-starting-rally-daemon/203540)

<div class="topic-metadata">

**Author:** [@Akshay\_Raj](https://discuss.elastic.co/u/Akshay_Raj)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 6:22am UTC](https://discuss.elastic.co/t/problem-with-starting-rally-daemon/203540 "2019-10-17T06:22:40Z")

</div>

Hi, I have a cluster setup on AWS that I am trying to benchmark. Towards this, I have a coordinator instance and 2 load drivers setup. These systems all have rally setup and rally starts up fine. However when I try runn…

---

## [How do I setup my cluster to maximize CPU util % while testing with Rally](https://discuss.elastic.co/t/how-do-i-setup-my-cluster-to-maximize-cpu-util-while-testing-with-rally/203726)

<div class="topic-metadata">

**Author:** [@Akshay\_Raj](https://discuss.elastic.co/u/Akshay_Raj)\
**Replies:** 9\
**Last updated:** [October 17, 2019, 6:17am UTC](https://discuss.elastic.co/t/how-do-i-setup-my-cluster-to-maximize-cpu-util-while-testing-with-rally/203726 "2019-10-17T06:17:31Z")

</div>

Hi, I have a cluster setup with the objective to test elasticsearch nodes using rally. As of now I have a benchmark coordinator, 2 load drivers and 3 elasticsearch nodes. I wish to maximize the load I can place upon the…

---

## [BooleanQuery$TooManyClauses with synonym filter](https://discuss.elastic.co/t/booleanquery-toomanyclauses-with-synonym-filter/203636)

<div class="topic-metadata">

**Author:** [@tomoko](https://discuss.elastic.co/u/tomoko)\
**Replies:** 2\
**Last updated:** [October 17, 2019, 5:37am UTC](https://discuss.elastic.co/t/booleanquery-toomanyclauses-with-synonym-filter/203636 "2019-10-17T05:37:56Z")

</div>

How can I avoid TooManyCaluses failure when I use kuromoji tokenizer with the synonym filter with specifying synonym dictionary which contains about 500K words? How can I calculate to find an appropriate value as the max…

---

## [Elasticsearch high CPU Utilization](https://discuss.elastic.co/t/elasticsearch-high-cpu-utilization/203881)

<div class="topic-metadata">

**Author:** [@Jayabal\_K](https://discuss.elastic.co/u/Jayabal_K)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 5:31am UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-utilization/203881 "2019-10-17T05:31:50Z")

</div>

Hi, I have a elastic setup which consists of 5 datanode, 1 master and 1 client node. Each datanode consists of 1.5 vCPU, and 4GB Memory. My indexing rate is 10K logs per second. During the indexing time the CPU usage …

---

## [SSLHandshakeException: No available authentication scheme](https://discuss.elastic.co/t/sslhandshakeexception-no-available-authentication-scheme/203961)

<div class="topic-metadata">

**Author:** [@Vikas\_Yadav](https://discuss.elastic.co/u/Vikas_Yadav)\
**Replies:** 1\
**Last updated:** [October 17, 2019, 4:59am UTC](https://discuss.elastic.co/t/sslhandshakeexception-no-available-authentication-scheme/203961 "2019-10-17T04:59:46Z")

</div>

\[SSLHandshakeException: No available authentication scheme\] tried to form a cluster of 2 nodes with basic security enabled getting this error on the master node

---

## [Field level security](https://discuss.elastic.co/t/field-level-security/203573)

<div class="topic-metadata">

**Author:** [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Replies:** 10\
**Last updated:** [October 17, 2019, 4:58am UTC](https://discuss.elastic.co/t/field-level-security/203573 "2019-10-17T04:58:24Z")

</div>

I am trying to setup one role to have read permission on particular fields, but the testing is a bit confusing. In Role Management, I choose one indice with Read privilege, and then turn on the Grant Access to specific …

---

## [Disk-to-heap ratio for Frozen Indices?](https://discuss.elastic.co/t/disk-to-heap-ratio-for-frozen-indices/203945)

<div class="topic-metadata">

**Author:** [@jonusko](https://discuss.elastic.co/u/jonusko)\
**Replies:** 1\
**Last updated:** [October 17, 2019, 3:59am UTC](https://discuss.elastic.co/t/disk-to-heap-ratio-for-frozen-indices/203945 "2019-10-17T03:59:01Z")

</div>

The Elasticsearch documentation states... Because Elasticsearch does not maintain these transient data structures in memory, frozen indices consume much less heap than normal indices. This allows for a much higher disk…

---

## [How could I know when an index is change?](https://discuss.elastic.co/t/how-could-i-know-when-an-index-is-change/203957)

<div class="topic-metadata">

**Author:** [@Cherry\_Zhang](https://discuss.elastic.co/u/Cherry_Zhang)\
**Replies:** 0\
**Last updated:** [October 17, 2019, 3:00am UTC](https://discuss.elastic.co/t/how-could-i-know-when-an-index-is-change/203957 "2019-10-17T03:00:25Z")

</div>

I want to do something when an index is change, like, a doc is added, or a doc is deleted, or more precisely, I want to know the timestamp when something is changed in an index, is there a way to do that?

---

## [Elasticsearch Cloud on Google - Security Accessing](https://discuss.elastic.co/t/elasticsearch-cloud-on-google-security-accessing/203666)

<div class="topic-metadata">

**Author:** [@Ocean12](https://discuss.elastic.co/u/Ocean12)\
**Replies:** 3\
**Last updated:** [October 17, 2019, 12:51am UTC](https://discuss.elastic.co/t/elasticsearch-cloud-on-google-security-accessing/203666 "2019-10-17T00:51:43Z")

</div>

Hi, first post and I'm not all that knowledgeable about this topic. Can anyone tell me the best way to use my ElasticSearch Google Cloud instance in terms of security? I have a mobile app that is being released as a P…

---

## [Cannot create user](https://discuss.elastic.co/t/cannot-create-user/203813)

<div class="topic-metadata">

**Author:** [@jepper](https://discuss.elastic.co/u/jepper)\
**Replies:** 2\
**Last updated:** [October 16, 2019, 11:17pm UTC](https://discuss.elastic.co/t/cannot-create-user/203813 "2019-10-16T23:17:59Z")

</div>

I post this, with xpack enabled and trial license curl -X POST "https://127.0.0.1:9200/\_xpack/security/role/demo\_admin" -u elastic:password -k -H "Content-Type: application/json" --data '{"indices": \[{"names": \[ "\*" \],"…

---

## [Pipeline aggregation to compute histogram of average values of a field, bucketed by term?](https://discuss.elastic.co/t/pipeline-aggregation-to-compute-histogram-of-average-values-of-a-field-bucketed-by-term/202273)

<div class="topic-metadata">

**Author:** [@Jonathan\_Rice](https://discuss.elastic.co/u/Jonathan_Rice)\
**Replies:** 11\
**Last updated:** [October 16, 2019, 10:25pm UTC](https://discuss.elastic.co/t/pipeline-aggregation-to-compute-histogram-of-average-values-of-a-field-bucketed-by-term/202273 "2019-10-16T22:25:24Z")

</div>

I'm trying to figure out how to compute a histogram of the average values of fields within "term" buckets. I think this is probably a case for a sibling aggregation, but I can't figure out the approach. For example, cons…

---

## [Elasticsearch 7.4 won't start properly](https://discuss.elastic.co/t/elasticsearch-7-4-wont-start-properly/201891)

<div class="topic-metadata">

**Author:** [@phucvandinh](https://discuss.elastic.co/u/phucvandinh)\
**Replies:** 14\
**Last updated:** [October 16, 2019, 9:48pm UTC](https://discuss.elastic.co/t/elasticsearch-7-4-wont-start-properly/201891 "2019-10-16T21:48:17Z")

</div>

I have a problem after upgrade elasticsearch from 7.3 to 7.4 on my dedicated server, it won't be able to start ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; ena…

---

## [Hadoop connection with Elasticsearch](https://discuss.elastic.co/t/hadoop-connection-with-elasticsearch/203065)

<div class="topic-metadata">

**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Replies:** 1\
**Last updated:** [October 16, 2019, 8:32pm UTC](https://discuss.elastic.co/t/hadoop-connection-with-elasticsearch/203065 "2019-10-16T20:32:44Z")

</div>

Hi, While trying to connect to elasticsearch through hive, getting below exception ERROR : Job Submission failed with exception 'org.elasticsearch.hadoop.EsHadoopIllegalArgumentException(Cannot detect ES version - ty…

---

## [Elasticsearch Hadoop Connection](https://discuss.elastic.co/t/elasticsearch-hadoop-connection/202501)

<div class="topic-metadata">

**Author:** [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Replies:** 1\
**Last updated:** [October 16, 2019, 8:31pm UTC](https://discuss.elastic.co/t/elasticsearch-hadoop-connection/202501 "2019-10-16T20:31:25Z")

</div>

Hi, I am trying to add hive table into Elasticsearch. Have added the jar in hive-site.xml file. CDH 5.11 Hadoop 2.6 Hive 1.1.0 elasticsearch-hadoop-7.3.2.jar Elasticsearch 7.3.2 I am able to successfully create ta…

---

## [Correct settings for "es.nodes.wan.only"](https://discuss.elastic.co/t/correct-settings-for-es-nodes-wan-only/58743)

<div class="topic-metadata">

**Author:** [@darthapple](https://discuss.elastic.co/u/darthapple)\
**Replies:** 12\
**Last updated:** [October 16, 2019, 8:29pm UTC](https://discuss.elastic.co/t/correct-settings-for-es-nodes-wan-only/58743 "2019-10-16T20:29:03Z")

</div>

Hello, I am trying to run a spark job to load data from emr to ES cluster hosted by elastic.co. \[ cluster ID "665e60" \] Following is code snippet i am using to test this. import java.io.PrintStream import org.apache…

---

## [Hive real time or near real time sync with ES](https://discuss.elastic.co/t/hive-real-time-or-near-real-time-sync-with-es/202103)

<div class="topic-metadata">

**Author:** [@bharat1](https://discuss.elastic.co/u/bharat1)\
**Replies:** 4\
**Last updated:** [October 16, 2019, 8:24pm UTC](https://discuss.elastic.co/t/hive-real-time-or-near-real-time-sync-with-es/202103 "2019-10-16T20:24:38Z")

</div>

Dear All, Have a scenario, I am successfully able to bring Hive table data to ES. At the same time when it comes to sync latest updated row data from same Hive table then there is a manual work required to get the updat…

---

## [EsHadoopNoNodesLeftException-all nodes failed On Spark.SaveToES](https://discuss.elastic.co/t/eshadoopnonodesleftexception-all-nodes-failed-on-spark-savetoes/202161)

<div class="topic-metadata">

**Author:** [@Ramakrishnan\_Venkata](https://discuss.elastic.co/u/Ramakrishnan_Venkata)\
**Replies:** 1\
**Last updated:** [October 16, 2019, 8:19pm UTC](https://discuss.elastic.co/t/eshadoopnonodesleftexception-all-nodes-failed-on-spark-savetoes/202161 "2019-10-16T20:19:45Z")

</div>

Hi, I Get "EsHadoopNoNodesLeftException: Connection error (check network and/or proxy settings)- all nodes failed" When i do a df = spark.sql(select \* from a table)and do a df.saveToES(indexName+"/docs") I have 200 ORC…

---

## [ElasticSearch index template from 6.8 to 7.4 need some help](https://discuss.elastic.co/t/elasticsearch-index-template-from-6-8-to-7-4-need-some-help/203907)

<div class="topic-metadata">

**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\
**Replies:** 1\
**Last updated:** [October 16, 2019, 6:49pm UTC](https://discuss.elastic.co/t/elasticsearch-index-template-from-6-8-to-7-4-need-some-help/203907 "2019-10-16T18:49:05Z")

</div>

Hello guys/girls, I am trying to upgrade from ElasticSearch 6.8 to 7.4 and need some help with my ElasticSearch index template. My current template { "template" : "logstash-\*", "version" : 60001, "settings" : { …

---

## [Elasticsearch.yml path config](https://discuss.elastic.co/t/elasticsearch-yml-path-config/202919)

<div class="topic-metadata">

**Author:** [@fvegaucr1](https://discuss.elastic.co/u/fvegaucr1)\
**Replies:** 2\
**Last updated:** [October 16, 2019, 6:36pm UTC](https://discuss.elastic.co/t/elasticsearch-yml-path-config/202919 "2019-10-16T18:36:30Z")

</div>

Im currently building a cluster following hot warm arch. I have 3 master nodes with 2 OS drives as RAID1 20 data nodes Each of them with 2 OS drives as RAID1 and 8 drives, configure as JBOD. Based on server roles. I o…

---

## [Term\_vectors and custom analyzers](https://discuss.elastic.co/t/term-vectors-and-custom-analyzers/202188)

<div class="topic-metadata">

**Author:** [@bbaronas](https://discuss.elastic.co/u/bbaronas)\
**Replies:** 2\
**Last updated:** [October 16, 2019, 6:30pm UTC](https://discuss.elastic.co/t/term-vectors-and-custom-analyzers/202188 "2019-10-16T18:30:34Z")

</div>

Hello, I'm running Elasticsearch 7.3.2 in Elastic Cloud. I have built a mapping for one of my indices where I have used a custom analyzer: "standard-uax-url-analyzer" that is essentially the standard analyzer, but it is…

---

## [Archive old indices with data compression](https://discuss.elastic.co/t/archive-old-indices-with-data-compression/203879)

<div class="topic-metadata">

**Author:** [@kevinray0030](https://discuss.elastic.co/u/kevinray0030)\
**Replies:** 5\
**Last updated:** [October 16, 2019, 5:51pm UTC](https://discuss.elastic.co/t/archive-old-indices-with-data-compression/203879 "2019-10-16T17:51:33Z")

</div>

Hey all, I am trying to find a solution to where I can keep roughly 90 days of live data on my cluster but then archive anything over 90 days up to a year. This is a compliance requirement. I am currently looking into …

---

## [Match query with altered AND operator](https://discuss.elastic.co/t/match-query-with-altered-and-operator/203891)

<div class="topic-metadata">

**Author:** [@Matthijs](https://discuss.elastic.co/u/Matthijs)\
**Replies:** 0\
**Last updated:** [October 16, 2019, 5:09pm UTC](https://discuss.elastic.co/t/match-query-with-altered-and-operator/203891 "2019-10-16T17:09:47Z")

</div>

Hello, I would like to perform a query where I only match against results, where my query contains all the words in the given result. The existing AND operator does a similar thing, but demands that all of the words in …

---

## [How can I download the results of a query?](https://discuss.elastic.co/t/how-can-i-download-the-results-of-a-query/203870)

<div class="topic-metadata">

**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\
**Replies:** 1\
**Last updated:** [October 16, 2019, 4:46pm UTC](https://discuss.elastic.co/t/how-can-i-download-the-results-of-a-query/203870 "2019-10-16T16:46:22Z")

</div>

Hi In the image attached, I queried an index for a time period of 3 months. Now I want to download that information. It can be .csv or json. Is it possible to do that?

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1121)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1123)
