# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1129 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1130 --- ## [How to filter out a few inner objects from search query results](https://discuss.elastic.co/t/how-to-filter-out-a-few-inner-objects-from-search-query-results/203080)
**Author:** [@smaheshbhat](https://discuss.elastic.co/u/smaheshbhat)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 5:50pm UTC](https://discuss.elastic.co/t/how-to-filter-out-a-few-inner-objects-from-search-query-results/203080 "2019-10-10T17:50:03Z")
Hi, I have the following schema and two documents and a search query on them. I want to know how can I only display specific language's names and descriptions in each of my search result. For example in the query result… --- ## [ELK Cluster - Role of master node](https://discuss.elastic.co/t/elk-cluster-role-of-master-node/202867)
**Author:** [@Farhan\_Umer](https://discuss.elastic.co/u/Farhan_Umer)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 4:27pm UTC](https://discuss.elastic.co/t/elk-cluster-role-of-master-node/202867 "2019-10-10T16:27:51Z")
In an ELK cluster, does master node and data node keep same copy of shards? In case of failure of master node or data node, will we have a copy of indices on the other node? Like if master is lost, will i be able to use … --- ## [How to apply json parser for particular grok parsed field and get new json parsed fields](https://discuss.elastic.co/t/how-to-apply-json-parser-for-particular-grok-parsed-field-and-get-new-json-parsed-fields/203064)
**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 3:46pm UTC](https://discuss.elastic.co/t/how-to-apply-json-parser-for-particular-grok-parsed-field-and-get-new-json-parsed-fields/203064 "2019-10-10T15:46:59Z")
Hi there! I'd like to have already parsed field app\_message additionally parsed with fields like language, companyEmail, country , Please suggest the proper way to do this. \ #@i… --- ## [Snapshot lifecycle management in basic version of elastic](https://discuss.elastic.co/t/snapshot-lifecycle-management-in-basic-version-of-elastic/202856)
**Author:** [@kadiveti](https://discuss.elastic.co/u/kadiveti)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 2:32pm UTC](https://discuss.elastic.co/t/snapshot-lifecycle-management-in-basic-version-of-elastic/202856 "2019-10-10T14:32:41Z")
Hi Can someone Please provide step by step process for slm in elastic search basic 7.x version. I had tried post /\_slm/my policy name .. It is not recognizing giving error like index name error. Please help me to sol… --- ## [DSL query for "exact" match in fuzzy searches](https://discuss.elastic.co/t/dsl-query-for-exact-match-in-fuzzy-searches/203026)
**Author:** [@Luigi\_Bardelli](https://discuss.elastic.co/u/Luigi_Bardelli)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 2:17pm UTC](https://discuss.elastic.co/t/dsl-query-for-exact-match-in-fuzzy-searches/203026 "2019-10-10T14:17:26Z")
(newbie here, I hope it's the correct forum) Hi all, I am using elastic to do some fuzzy searches on few indexed text fields, so far so good. My question: I would like to limit the results as follows: Let's say that … --- ## [ES and Curator Docker images for ARM](https://discuss.elastic.co/t/es-and-curator-docker-images-for-arm/203019)
**Author:** [@huanggze](https://discuss.elastic.co/u/huanggze)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 12:35pm UTC](https://discuss.elastic.co/t/es-and-curator-docker-images-for-arm/203019 "2019-10-10T12:35:45Z")
Are arm-based images available for both elasticsearch and curator? I could only find amd-based elasticsearch images on Docker Hub. Besides, it seems that the Dockerfile for curator on github is x86 specific. --- ## [Alias Datatype with multi-fields value](https://discuss.elastic.co/t/alias-datatype-with-multi-fields-value/203028)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 1:00pm UTC](https://discuss.elastic.co/t/alias-datatype-with-multi-fields-value/203028 "2019-10-10T13:00:30Z")
Hi All, I am trying to creating a mapping with aliases that involve mapping to a multifield property. However, I am running into errors. I have read the docs on the alias datatype, however I don't think it is clear enou… --- ## [Elastic ML Job Monitoring](https://discuss.elastic.co/t/elastic-ml-job-monitoring/202976)
**Author:** [@rajuleo](https://discuss.elastic.co/u/rajuleo)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 12:58pm UTC](https://discuss.elastic.co/t/elastic-ml-job-monitoring/202976 "2019-10-10T12:58:13Z")
Team, Is there anyway to monitor the ML jobs running and send alerts? --- ## [Writing and Reading a text file from Elasticsearch Plugin](https://discuss.elastic.co/t/writing-and-reading-a-text-file-from-elasticsearch-plugin/203022)
**Author:** [@Eeshan](https://discuss.elastic.co/u/Eeshan)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 12:49pm UTC](https://discuss.elastic.co/t/writing-and-reading-a-text-file-from-elasticsearch-plugin/203022 "2019-10-10T12:49:45Z")
Hi, I am working on a plugin, which generates meta-data from indexed documents. During the generation of this meta-data, I want to store some temporary data in a file and again read that file in future. The output of th… --- ## [Number format exception for geo\_point field](https://discuss.elastic.co/t/number-format-exception-for-geo-point-field/201759)
**Author:** [@Jason\_Wee](https://discuss.elastic.co/u/Jason_Wee)\ **Replies:** 6\ **Last updated:** [October 10, 2019, 12:45pm UTC](https://discuss.elastic.co/t/number-format-exception-for-geo-point-field/201759 "2019-10-10T12:45:11Z")
Hi, in elasticsearch log file, we often see this \[2019-10-01 09:39:10,694\]\[INFO \]\[rest.suppressed \] /my\_index/my\_type/1569915520584.1689070526/\_update Params: {version\_type=force, doc\_as\_upsert=true, index=my\_i… --- ## [Match\_phrase\_prefix in Elasticsearch 7.3.0](https://discuss.elastic.co/t/match-phrase-prefix-in-elasticsearch-7-3-0/202894)
**Author:** [@valentine-dev](https://discuss.elastic.co/u/valentine-dev)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 12:44pm UTC](https://discuss.elastic.co/t/match-phrase-prefix-in-elasticsearch-7-3-0/202894 "2019-10-10T12:44:24Z")
Why I got 7 results for "6531 148 str" but no results for "6531 148 st"? Is it because there are more than 50 terms in the sorted term dictionary between "st" and "str" based on https://www.elastic.co/guide/en/elasticse… --- ## [Whitelist in AWS Elastic Search 6.5.4 host](https://discuss.elastic.co/t/whitelist-in-aws-elastic-search-6-5-4-host/203015)
**Author:** [@Liz\_Miller](https://discuss.elastic.co/u/Liz_Miller)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 12:38pm UTC](https://discuss.elastic.co/t/whitelist-in-aws-elastic-search-6-5-4-host/203015 "2019-10-10T12:38:54Z")
Hello, I'm trying to upgrade a 2.3 cluster to 6.5.4 by creating a new cluster of 6.5.4 and trying to pull the documents from the old 2.3. I'm following this guide: https://www.elastic.co/guide/en/elasticsearch/referen… --- ## [Watcher - Action formating message](https://discuss.elastic.co/t/watcher-action-formating-message/203017)
**Author:** [@cesarlino](https://discuss.elastic.co/u/cesarlino)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 12:34pm UTC](https://discuss.elastic.co/t/watcher-action-formating-message/203017 "2019-10-10T12:34:26Z")
Hi, I am playing with Watcher to setup an alert for certain threshold. If condition is met, then I want to send a message via Slack with the aggregated value. Everything is working perfectly, except the number looks lik… --- ## [Using an array as parameter for update script](https://discuss.elastic.co/t/using-an-array-as-parameter-for-update-script/202998)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 12:12pm UTC](https://discuss.elastic.co/t/using-an-array-as-parameter-for-update-script/202998 "2019-10-10T12:12:21Z")
I am using ElasticSearch 6.5, invoking commands by Kibana 6.5. My documents have user field which is an array of user structures. I want to construct a script, that will update some of the structures in this array based… --- ## [How do we add features like did you mean this and suggestion](https://discuss.elastic.co/t/how-do-we-add-features-like-did-you-mean-this-and-suggestion/203013)
**Author:** [@SalmanZahid96](https://discuss.elastic.co/u/SalmanZahid96)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 12:10pm UTC](https://discuss.elastic.co/t/how-do-we-add-features-like-did-you-mean-this-and-suggestion/203013 "2019-10-10T12:10:09Z")
I am making a search engine using elasticsearch in which i want some features like 'Did you mean this' and 'Suggestions' like google does. My index contains a document like this: { "نام" : "قرآنی انسائیکلوپیڈیا", "… --- ## [Watcher - simulate shows it should fire, but it isn't](https://discuss.elastic.co/t/watcher-simulate-shows-it-should-fire-but-it-isnt/202808)
**Author:** [@Stuart\_Moore](https://discuss.elastic.co/u/Stuart_Moore)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 11:35am UTC](https://discuss.elastic.co/t/watcher-simulate-shows-it-should-fire-but-it-isnt/202808 "2019-10-10T11:35:30Z")
I am trying to write a watcher. I've tested the search expression on the console, and it appears to work. When I use "Simulate" within Kibana, it says that the trigger should fire. However, it isn't firing - the UI shows… --- ## [CircuitBreakingException: \[parent\] Data too large IN ES 7.x](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-in-es-7-x/192801)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 18\ **Last updated:** [October 10, 2019, 11:26am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-in-es-7-x/192801 "2019-10-10T11:26:49Z")
Cluster always get CircuitBreakingException after update to ES7.x, especially running recovery tasks or indexing large data: \[internal:index/shard/recovery/start\_recovery\] or \[cluster:monitor/nodes/info\[n\]\], then node le… --- ## [G1GC cause CircuitBreakingException: \[parent\] Data too large on 7.1.1](https://discuss.elastic.co/t/g1gc-cause-circuitbreakingexception-parent-data-too-large-on-7-1-1/187272)
**Author:** [@Wing924](https://discuss.elastic.co/u/Wing924)\ **Replies:** 39\ **Last updated:** [October 10, 2019, 11:26am UTC](https://discuss.elastic.co/t/g1gc-cause-circuitbreakingexception-parent-data-too-large-on-7-1-1/187272 "2019-10-10T11:26:20Z")
Elasticsearch version ( bin/elasticsearch --version ): 7.1.1 Plugins installed : none JVM version ( java -version ): openjdk version "11.0.3" 2019-04-16 LTS OpenJDK Runtime Environment 18.9 (build 11.0.3+7-LTS) … --- ## [Can I access the field values in top hits aggs?](https://discuss.elastic.co/t/can-i-access-the-field-values-in-top-hits-aggs/202983)
**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 8:59am UTC](https://discuss.elastic.co/t/can-i-access-the-field-values-in-top-hits-aggs/202983 "2019-10-10T08:59:45Z")
my data.... {"first\_seq":"aa", "second\_seq":1, "status":"LOADING"} {"first\_seq":"aa", "second\_seq":2, "status":"LOADING"} {"first\_seq":"aa", "second\_seq":3, "status":"LOADING"} {"first\_seq":"aa", "second\_seq":4, "sta… --- ## [Elasticsearch cluster health is fluctuating between yellow and red](https://discuss.elastic.co/t/elasticsearch-cluster-health-is-fluctuating-between-yellow-and-red/202877)
**Author:** [@Vishal\_0611](https://discuss.elastic.co/u/Vishal_0611)\ **Replies:** 11\ **Last updated:** [October 10, 2019, 10:51am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-health-is-fluctuating-between-yellow-and-red/202877 "2019-10-10T10:51:08Z")
Hi folks, We are facing a weird problem in one of our ES database server. Cluster health is constantly fluctuating between RED and Yellow. Need help to identify/root cause the same. Is it corruption issue/ Misconfigurat… --- ## [Count total number of words from all documents from a specific field accordingly](https://discuss.elastic.co/t/count-total-number-of-words-from-all-documents-from-a-specific-field-accordingly/203003)
**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 10:46am UTC](https://discuss.elastic.co/t/count-total-number-of-words-from-all-documents-from-a-specific-field-accordingly/203003 "2019-10-10T10:46:45Z")
Hello and good day! Someone asked this question but no one seems answered or tried to suggest techniques: https://discuss.elastic.co/t/count-the-number-of-words-in-the-field-elastic-search-6-2/121373 Now, I'm trying to… --- ## [Thinning Of Timeseries Data](https://discuss.elastic.co/t/thinning-of-timeseries-data/202971)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 8:43am UTC](https://discuss.elastic.co/t/thinning-of-timeseries-data/202971 "2019-10-10T08:43:01Z")
Hey, I wonder what is the best way to thin out timeseries data for example collected by metricbeat. We dont need to know the exact CPU usage in second X 30 days ago of a particular server. It is sufficient to have a one… --- ## [Hot, Warm Setup Storage Based](https://discuss.elastic.co/t/hot-warm-setup-storage-based/202974)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 1\ **Last updated:** [October 10, 2019, 8:22am UTC](https://discuss.elastic.co/t/hot-warm-setup-storage-based/202974 "2019-10-10T08:22:25Z")
Hey, we are planning to setup a new cluster with 5 hardware servers. Each server will use a 2TB PCIe SSD and ~10TB of SAS Storage. We are collecting logs and timeseries. After a few days data should be moved to the SAS … --- ## [Cannot log in to Kibana in Azure](https://discuss.elastic.co/t/cannot-log-in-to-kibana-in-azure/202838)
**Author:** [@B\_Z](https://discuss.elastic.co/u/B_Z)\ **Replies:** 4\ **Last updated:** [October 10, 2019, 8:14am UTC](https://discuss.elastic.co/t/cannot-log-in-to-kibana-in-azure/202838 "2019-10-10T08:14:01Z")
I've created an ElasticStack from Azure but when I try to log in to Kibana through the IP Address (IPADDRESS:5601) then this error is generated: {"statusCode":403,"error":"Forbidden","message":"Forbidden"} Can you plea… --- ## [Sort terms aggregation hits by topHits first hit](https://discuss.elastic.co/t/sort-terms-aggregation-hits-by-tophits-first-hit/202952)
**Author:** [@Hanan\_Aharonof](https://discuss.elastic.co/u/Hanan_Aharonof)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 6:23am UTC](https://discuss.elastic.co/t/sort-terms-aggregation-hits-by-tophits-first-hit/202952 "2019-10-10T06:23:52Z")
Hi, I'm running the following query: GET security/\_search { "size": 0, "query": { "match\_all": {} }, "aggs": { "aggBy": { "terms": { "field": "assetType", "size": 250, "order": { "\_count": "asc" } }, "ag… --- ## [I want to create alert for same Source-ip and same destination-ip but different port](https://discuss.elastic.co/t/i-want-to-create-alert-for-same-source-ip-and-same-destination-ip-but-different-port/202816)
**Author:** [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)\ **Replies:** 2\ **Last updated:** [October 10, 2019, 6:12am UTC](https://discuss.elastic.co/t/i-want-to-create-alert-for-same-source-ip-and-same-destination-ip-but-different-port/202816 "2019-10-10T06:12:56Z")
Hello, My question is Trigger alert when Sourc-ip and Destination-ip is same but different destination port trigger alert and I am facing problem here is my configuration. PUT \_xpack/watcher/watch/vertical-port-scan {… --- ## [Unable to search special character](https://discuss.elastic.co/t/unable-to-search-special-character/202938)
**Author:** [@Ramesh\_balasubramani](https://discuss.elastic.co/u/Ramesh_balasubramani)\ **Replies:** 0\ **Last updated:** [October 10, 2019, 4:16am UTC](https://discuss.elastic.co/t/unable-to-search-special-character/202938 "2019-10-10T04:16:45Z")
GET logs\*/\_search { "query": { "match\_phrase": { "message": "2=2" } } } Result : "message": "2019-10-10 09:28:59.301644 xxx.xxx.xxx.xxx switchapp event=process\_started process\_name=kw… --- ## [Can't delete ML jobs which was on hard\_limit](https://discuss.elastic.co/t/cant-delete-ml-jobs-which-was-on-hard-limit/202634)
**Author:** [@EunBae\_Park](https://discuss.elastic.co/u/EunBae_Park)\ **Replies:** 3\ **Last updated:** [October 10, 2019, 12:59am UTC](https://discuss.elastic.co/t/cant-delete-ml-jobs-which-was-on-hard-limit/202634 "2019-10-10T00:59:22Z")
Hi, This is Jason. I'm in trouble for deleting hard-limited ml-job. I'd deleted them yesterday, however It's still deleting :frowning: I used dev-tool to delete them again today, but failed like below How can I d… --- ## [Remove or increase ignore\_above on a text.keyword field](https://discuss.elastic.co/t/remove-or-increase-ignore-above-on-a-text-keyword-field/202879)
**Author:** [@camay123](https://discuss.elastic.co/u/camay123)\ **Replies:** 1\ **Last updated:** [October 9, 2019, 9:55pm UTC](https://discuss.elastic.co/t/remove-or-increase-ignore-above-on-a-text-keyword-field/202879 "2019-10-09T21:55:01Z")
I am trying to increase or remove the ignore\_above on a particular field on my index: "emlBody" : { "type" : "text", "fields" : { "keyword" : { "type" : "keyword", … --- ## [Normalizer not working](https://discuss.elastic.co/t/normalizer-not-working/202911)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 1\ **Last updated:** [October 9, 2019, 9:35pm UTC](https://discuss.elastic.co/t/normalizer-not-working/202911 "2019-10-09T21:35:11Z")
\*\* sorry is this is a repeated question. I have already done research in this forum and did not find solution. \*\* I have added normalizer to my existing index. So this is what did. created new\_my\_index witt my mapping… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1128) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1130)