# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1132 --- ## [Match String required in Response using Query Match](https://discuss.elastic.co/t/match-string-required-in-response-using-query-match/202757)
**Author:** [@abhishek.tripathi](https://discuss.elastic.co/u/abhishek.tripathi)\ **Replies:** 0\ **Last updated:** [October 9, 2019, 3:55am UTC](https://discuss.elastic.co/t/match-string-required-in-response-using-query-match/202757 "2019-10-09T03:55:49Z")
HI, I am using below query for searching record in Elastic Search: { "query": { "match" : { "record" : { "query" : "black or ball OR Wheel OR bonnet", "fuzziness": "AUTO" } } } } Result: { "took": 4, "time… --- ## [Issue while running fscrawler on Linux](https://discuss.elastic.co/t/issue-while-running-fscrawler-on-linux/202586)
**Author:** [@shreyasht](https://discuss.elastic.co/u/shreyasht)\ **Replies:** 2\ **Last updated:** [October 9, 2019, 2:55am UTC](https://discuss.elastic.co/t/issue-while-running-fscrawler-on-linux/202586 "2019-10-09T02:55:32Z")
Hello I am getting below exception while running fscrawler on linux. I wish the error was little more descriptive. I am using java 8 and fscrawler-es7-2.7 bin/fscrawler test Exception in thread "main" java.lang.Number… --- ## [Performance of post\_filter](https://discuss.elastic.co/t/performance-of-post-filter/202752)
**Author:** [@hkazuakey](https://discuss.elastic.co/u/hkazuakey)\ **Replies:** 0\ **Last updated:** [October 9, 2019, 2:03am UTC](https://discuss.elastic.co/t/performance-of-post-filter/202752 "2019-10-09T02:03:29Z")
Hello, I have a question about performance of post\_filter. According to the legacy document (definitive guide), performance consideration is required and it should be used only in combination with aggregations. However,… --- ## [Is it possible to map multiple source doc fields to the same index field](https://discuss.elastic.co/t/is-it-possible-to-map-multiple-source-doc-fields-to-the-same-index-field/202735)
**Author:** [@haroutk](https://discuss.elastic.co/u/haroutk)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 9:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-map-multiple-source-doc-fields-to-the-same-index-field/202735 "2019-10-08T21:34:42Z")
Hi folks, does anyone know if it's possible to map two different source fields to a single index field? For example, i will be storing two differnt types of a source docs (source1 and sourc2) in the same index source… --- ## [Streaming custom data source to Elastic](https://discuss.elastic.co/t/streaming-custom-data-source-to-elastic/202613)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 2\ **Last updated:** [October 8, 2019, 8:42pm UTC](https://discuss.elastic.co/t/streaming-custom-data-source-to-elastic/202613 "2019-10-08T20:42:44Z")
Hello - This is a question around best practices for streaming custom data to Elastic. Currently I have a script to pull 1 event from my API and then post it to /indexname/\_doc. This works great, but now i am asking, w… --- ## [Data modeling: querying multiple "types" off a single denormalised index](https://discuss.elastic.co/t/data-modeling-querying-multiple-types-off-a-single-denormalised-index/202722)
**Author:** [@iftheshoefritz](https://discuss.elastic.co/u/iftheshoefritz)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 8:26pm UTC](https://discuss.elastic.co/t/data-modeling-querying-multiple-types-off-a-single-denormalised-index/202722 "2019-10-08T20:26:58Z")
(I'm using types in a relational sense, not in the old elasticsearch "multiple types in an index" sense) I have a typical relational data model with several types in a hierarchy. For illustration sake, let's call this a… --- ## [SQL api doesnt allow {preference}](https://discuss.elastic.co/t/sql-api-doesnt-allow-preference/202590)
**Author:** [@acv2](https://discuss.elastic.co/u/acv2)\ **Replies:** 2\ **Last updated:** [October 8, 2019, 6:00pm UTC](https://discuss.elastic.co/t/sql-api-doesnt-allow-preference/202590 "2019-10-08T18:00:16Z")
Just leaving this around here as a question/suggestion. why is not possible to use preference when executing queries through SQL api, I have a HOT WARM COLD architecture and im trying to reroute queries base on preferen… --- ## [Date\_time\_parse\_exception - Elasticsearch version 7.3.2](https://discuss.elastic.co/t/date-time-parse-exception-elasticsearch-version-7-3-2/202652)
**Author:** [@lmariselvam](https://discuss.elastic.co/u/lmariselvam)\ **Replies:** 4\ **Last updated:** [October 8, 2019, 4:13pm UTC](https://discuss.elastic.co/t/date-time-parse-exception-elasticsearch-version-7-3-2/202652 "2019-10-08T16:13:41Z")
I have the mapping defined for "timestamp" field on ES as follows: "timestamp": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss Z" } and I'm trying to index the following document, { "account":"170/170/78202", "times… --- ## [Delete old indexes based on total disk consumption](https://discuss.elastic.co/t/delete-old-indexes-based-on-total-disk-consumption/202681)
**Author:** [@Ali\_Reza\_Haghighat](https://discuss.elastic.co/u/Ali_Reza_Haghighat)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 3:45pm UTC](https://discuss.elastic.co/t/delete-old-indexes-based-on-total-disk-consumption/202681 "2019-10-08T15:45:45Z")
I want to delete old indexes based on total disk consumption (Elastic indexes + Other DBMS stored files + System Log + etc). However, based on the curator documentation, I think the curator can only delete old indexes wh… --- ## [Range condition doesn't work for minutes](https://discuss.elastic.co/t/range-condition-doesnt-work-for-minutes/202648)
**Author:** [@Stevens\_Laurent](https://discuss.elastic.co/u/Stevens_Laurent)\ **Replies:** 5\ **Last updated:** [October 8, 2019, 2:40pm UTC](https://discuss.elastic.co/t/range-condition-doesnt-work-for-minutes/202648 "2019-10-08T14:40:14Z")
Hello, I'm having an issue with the range filter, here is the context : I'm trying to do a simple query that filters on datetime field. My document have a simple mapping : "TRAITEMENT": { "properties": { "d… --- ## [Rest High Level Client Partial Nested Update Script](https://discuss.elastic.co/t/rest-high-level-client-partial-nested-update-script/202688)
**Author:** [@111211](https://discuss.elastic.co/u/111211)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 2:38pm UTC](https://discuss.elastic.co/t/rest-high-level-client-partial-nested-update-script/202688 "2019-10-08T14:38:25Z")
I wanna send Script to ElasticSearch. I want to do a partial update inside a nested array. But It didn't work well... Below is the script code I created. At least this works well in kibana. { "script": { "source" : … --- ## [Elasticsearch status="RED"](https://discuss.elastic.co/t/elasticsearch-status-red/202670)
**Author:** [@MartiM](https://discuss.elastic.co/u/MartiM)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 12:33pm UTC](https://discuss.elastic.co/t/elasticsearch-status-red/202670 "2019-10-08T12:33:31Z")
I am having problems with elasticsearch on production. (only a single server). And i don't know where to start? (ES the dockerized one) Elasticsearch is on red status curl -XGET 'host:9200/\_cluster/health?pretty' { … --- ## [Help me understand shard allocation](https://discuss.elastic.co/t/help-me-understand-shard-allocation/202584)
**Author:** [@mdavidson\_bt](https://discuss.elastic.co/u/mdavidson_bt)\ **Replies:** 5\ **Last updated:** [October 8, 2019, 2:02pm UTC](https://discuss.elastic.co/t/help-me-understand-shard-allocation/202584 "2019-10-08T14:02:19Z")
I have 8 physical nodes in a hot warm configuration. Hot, yellow below. 2 Nodes, 800GB NVMe storage Warm, Red/Not Highlighted, 6 nodes, 5.5TB spinning disk Both Hot and Warm nodes are divided into two 'racks' (they ar… --- ## [Azure IOT Hub data to Elasticsearch cluster](https://discuss.elastic.co/t/azure-iot-hub-data-to-elasticsearch-cluster/202173)
**Author:** [@bhupal](https://discuss.elastic.co/u/bhupal)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 1:48pm UTC](https://discuss.elastic.co/t/azure-iot-hub-data-to-elasticsearch-cluster/202173 "2019-10-08T13:48:37Z")
I'm looking for recommended path/option to insert the data (messages/file upload) received on azure IOT hub to elastic search cluster for reporting/analytics purpose. Gone thru the steps/approach mentioned here however … --- ## [Elasticsearch document bug: elasticsearch 7.2 plainless script bug](https://discuss.elastic.co/t/elasticsearch-document-bug-elasticsearch-7-2-plainless-script-bug/202452)
**Author:** [@laoyang360](https://discuss.elastic.co/u/laoyang360)\ **Replies:** 4\ **Last updated:** [October 8, 2019, 1:18pm UTC](https://discuss.elastic.co/t/elasticsearch-document-bug-elasticsearch-7-2-plainless-script-bug/202452 "2019-10-08T13:18:54Z")
elasticsearch 7.2 plainless script bug \`POST \_scripts/calculate-score { "script": { "lang": "painless", "source": "Math.log(\_score \* 2) + params.my\_modifier" } } GET \_scripts/calculate-score GET \_search { … --- ## [Java API for distance\_feature in Elastic Search](https://discuss.elastic.co/t/java-api-for-distance-feature-in-elastic-search/202615)
**Author:** [@sgTextSearch](https://discuss.elastic.co/u/sgTextSearch)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 12:33pm UTC](https://discuss.elastic.co/t/java-api-for-distance-feature-in-elastic-search/202615 "2019-10-08T12:33:40Z")
I am trying to implement a relevance boost for date and geo-location fields using elastic search distance\_feature. What Java API corresponds to distance\_feature query? Using decay function does not solve my use case Th… --- ## [OEM for using Elastic stack basic subscription](https://discuss.elastic.co/t/oem-for-using-elastic-stack-basic-subscription/202665)
**Author:** [@pcanand1990](https://discuss.elastic.co/u/pcanand1990)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 12:15pm UTC](https://discuss.elastic.co/t/oem-for-using-elastic-stack-basic-subscription/202665 "2019-10-08T12:15:48Z")
I am using Basic subscription of elastic and planning to deploy the same on customer tools with basic license. Should I become an OEM partner with elastic if I have to deploy or distribute elastic components with basic… --- ## [Can i "Filter" certain logs into a Special Index?](https://discuss.elastic.co/t/can-i-filter-certain-logs-into-a-special-index/202639)
**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 12:15pm UTC](https://discuss.elastic.co/t/can-i-filter-certain-logs-into-a-special-index/202639 "2019-10-08T12:15:14Z")
Hey guys, since i still pretty new to this topic, i wanted to know if the following would be Possible: I've got a costumer who has different retention periods for different logs. In this case, the logs concerning the … --- ## [Merge indexes in elasticseach from reindex api](https://discuss.elastic.co/t/merge-indexes-in-elasticseach-from-reindex-api/202663)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 12:06pm UTC](https://discuss.elastic.co/t/merge-indexes-in-elasticseach-from-reindex-api/202663 "2019-10-08T12:06:54Z")
how can I merge two indexes eg: wanted to merger index1 and index 2 and make one index index1 hotelcode hotelname citycode index2 citycode cityname --- ## [ElasticSearch orderby length of field](https://discuss.elastic.co/t/elasticsearch-orderby-length-of-field/202644)
**Author:** [@Sanjay\_Agnani](https://discuss.elastic.co/u/Sanjay_Agnani)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-orderby-length-of-field/202644 "2019-10-08T12:06:27Z")
Hello there , i have any elasticSearch Index with an requirement where field needs to be sorted based on it's length. Have used below aggregate: { "size": 0, "aggs": { "groupByMake": { "terms": { … --- ## [Creating a watcher comparing the last and previous status of a windows service](https://discuss.elastic.co/t/creating-a-watcher-comparing-the-last-and-previous-status-of-a-windows-service/202536)
**Author:** [@J\_Weeda](https://discuss.elastic.co/u/J_Weeda)\ **Replies:** 3\ **Last updated:** [October 8, 2019, 11:20am UTC](https://discuss.elastic.co/t/creating-a-watcher-comparing-the-last-and-previous-status-of-a-windows-service/202536 "2019-10-08T11:20:59Z")
Hello, can provide any guidance on how to form the input query for a watcher to retrieve the last and previous status ("windows.service.state") for each "windows.service.display\_name" collected through a metricbeat. Is … --- ## [Multiline codec in elasticsearch](https://discuss.elastic.co/t/multiline-codec-in-elasticsearch/202646)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 10:06am UTC](https://discuss.elastic.co/t/multiline-codec-in-elasticsearch/202646 "2019-10-08T10:06:27Z")
From filebeat multiline are sent as follows . Wed Feb 01 17:54:00 2017 ORA-xxxx: message ORA-xxxx: message This ORA line can be any numbers ( no definite) how do i use the ingest grok processor pattern? --- ## [How to index file have content json with FSCrawler](https://discuss.elastic.co/t/how-to-index-file-have-content-json-with-fscrawler/202607)
**Author:** [@Vo\_Van\_Huy](https://discuss.elastic.co/u/Vo_Van_Huy)\ **Replies:** 2\ **Last updated:** [October 8, 2019, 8:19am UTC](https://discuss.elastic.co/t/how-to-index-file-have-content-json-with-fscrawler/202607 "2019-10-08T08:19:41Z")
I have file json(/tmp/es/ecep\_elib\_table\_books.json) with content: I config file /\_default/6/\_settings.json I config file \_settings.json into my job When I run bin/fscrawler --config\_dir ./demo\_01 demo\_01 --rest… --- ## [Why is my Elasticsearch index using so much disk space?](https://discuss.elastic.co/t/why-is-my-elasticsearch-index-using-so-much-disk-space/202117)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 13\ **Last updated:** [October 8, 2019, 8:10am UTC](https://discuss.elastic.co/t/why-is-my-elasticsearch-index-using-so-much-disk-space/202117 "2019-10-08T08:10:21Z")
Elasticsearch version (bin/elasticsearch --version): 5.6.11 Plugins installed: JVM version (java -version): openjdk version "1.8.0\_222" OpenJDK Runtime Environment (build 1.8.0\_222-8u222-b10-1ubuntu1~16.04.1-b10) … --- ## [Elastic login with Smart Card - Parsing certificate fields (Elasticsearch 7.4)](https://discuss.elastic.co/t/elastic-login-with-smart-card-parsing-certificate-fields-elasticsearch-7-4/202616)
**Author:** [@KenK73](https://discuss.elastic.co/u/KenK73)\ **Replies:** 0\ **Last updated:** [October 8, 2019, 5:47am UTC](https://discuss.elastic.co/t/elastic-login-with-smart-card-parsing-certificate-fields-elasticsearch-7-4/202616 "2019-10-08T05:47:40Z")
Hello, We recently upgraded to v7.4 so we could utilize the new support for smartcard authentication. It works in general, but it's not going to work in our environment because of the formatting of our Active Directory … --- ## [Es cant show the lastest message](https://discuss.elastic.co/t/es-cant-show-the-lastest-message/201601)
**Author:** [@kin122](https://discuss.elastic.co/u/kin122)\ **Replies:** 2\ **Last updated:** [October 8, 2019, 4:51am UTC](https://discuss.elastic.co/t/es-cant-show-the-lastest-message/201601 "2019-10-08T04:51:40Z")
hi why elk7.0 cant show the latest message. as the picture shows,the timestamp cant match the logs. system date is right. How do I locate the problem？3ks --- ## [Fields out of \_source](https://discuss.elastic.co/t/fields-out-of-source/202598)
**Author:** [@maicoldv159](https://discuss.elastic.co/u/maicoldv159)\ **Replies:** 1\ **Last updated:** [October 8, 2019, 4:38am UTC](https://discuss.elastic.co/t/fields-out-of-source/202598 "2019-10-08T04:38:18Z")
I have a customer that want to create an index with stored fields out of the \_source, in the same place than "\_index", "\_type", "\_score", "\_id". It should be something like { "\_index" : "MyIndex", "\_type" : "doc", "\_… --- ## [What exactly does painless do under the hood of painless script's Array contains method?](https://discuss.elastic.co/t/what-exactly-does-painless-do-under-the-hood-of-painless-scripts-array-contains-method/201592)
**Author:** [@wusongchao](https://discuss.elastic.co/u/wusongchao)\ **Replies:** 2\ **Last updated:** [October 8, 2019, 2:26am UTC](https://discuss.elastic.co/t/what-exactly-does-painless-do-under-the-hood-of-painless-scripts-array-contains-method/201592 "2019-10-08T02:26:53Z")
Suppose that i have a doc mapping field like below { "template": { "mappings":{ "template":{ "properties": { "sth": { "type": "long" … --- ## [Bulk api consuming new tcp port for every write which happens periodically every 1m](https://discuss.elastic.co/t/bulk-api-consuming-new-tcp-port-for-every-write-which-happens-periodically-every-1m/202436)
**Author:** [@singamsundeep](https://discuss.elastic.co/u/singamsundeep)\ **Replies:** 7\ **Last updated:** [October 7, 2019, 9:08pm UTC](https://discuss.elastic.co/t/bulk-api-consuming-new-tcp-port-for-every-write-which-happens-periodically-every-1m/202436 "2019-10-07T21:08:06Z")
Hi, I'm using elastic java highclientrestclient and bulk processor, when writing data periodically every 1m, noticed new tcp port is used and old port remains in established state, after a while noticed lot of tcp connec… --- ## [Cluster turning into green state takes long time](https://discuss.elastic.co/t/cluster-turning-into-green-state-takes-long-time/202440)
**Author:** [@AKSHAY\_ARDAK](https://discuss.elastic.co/u/AKSHAY_ARDAK)\ **Replies:** 8\ **Last updated:** [October 7, 2019, 8:59pm UTC](https://discuss.elastic.co/t/cluster-turning-into-green-state-takes-long-time/202440 "2019-10-07T20:59:10Z")
Hi Folks, Currently facing issue in the elasticsearch cluster During the upgrade/restart of the nodes in the cluster ,it takes long time to turn the cluster into green state from yellow. I am following the below steps… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1130) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1132)