# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1134 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1135 --- ## [Sorting all hits by a nested field value](https://discuss.elastic.co/t/sorting-all-hits-by-a-nested-field-value/202336)
**Author:** [@bvarga](https://discuss.elastic.co/u/bvarga)\ **Replies:** 2\ **Last updated:** [October 4, 2019, 1:00pm UTC](https://discuss.elastic.co/t/sorting-all-hits-by-a-nested-field-value/202336 "2019-10-04T13:00:27Z")
Hi! Is it possible to sort a query result by the value of a nested field, across all hits? To give you an example, let's say I am storing sellers and their products. A document stores the information of a single seller… --- ## [Security, best practice when using ES with custom Frontend](https://discuss.elastic.co/t/security-best-practice-when-using-es-with-custom-frontend/202339)
**Author:** [@sebnap](https://discuss.elastic.co/u/sebnap)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 12:38pm UTC](https://discuss.elastic.co/t/security-best-practice-when-using-es-with-custom-frontend/202339 "2019-10-04T12:38:00Z")
Hello, since Elastic released some of the security features from X-Pack, I'm wondering if something did change in the security related best practices, as for example to have a Proxy installed before ES. I have a couple … --- ## [Range aggregation in a pipeline aggregation](https://discuss.elastic.co/t/range-aggregation-in-a-pipeline-aggregation/201768)
**Author:** [@Uzo](https://discuss.elastic.co/u/Uzo)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 12:08pm UTC](https://discuss.elastic.co/t/range-aggregation-in-a-pipeline-aggregation/201768 "2019-10-04T12:08:47Z")
Hello, I want to do the following pipeline aggregation : A term aggregation For each term do an average aggregation (so here it's a sub aggregation) Then do a range aggregation on the previous average values. Right n… --- ## [\[7.0.1\] Heap pressure - What are FST's used for?](https://discuss.elastic.co/t/7-0-1-heap-pressure-what-are-fsts-used-for/202297)
**Author:** [@gna](https://discuss.elastic.co/u/gna)\ **Replies:** 2\ **Last updated:** [October 4, 2019, 10:56am UTC](https://discuss.elastic.co/t/7-0-1-heap-pressure-what-are-fsts-used-for/202297 "2019-10-04T10:56:51Z")
Dear developers, please help me understand what FST's (Finite-state transducer) are and what they are actually used for. Context: My elasticsearch test instances are under a lot of heap pressure (75%+ even after FullG… --- ## [Should doc\['field\_name'\] remove duplicates?](https://discuss.elastic.co/t/should-doc-field-name-remove-duplicates/202333)
**Author:** [@gautesk](https://discuss.elastic.co/u/gautesk)\ **Replies:** 0\ **Last updated:** [October 4, 2019, 11:23am UTC](https://discuss.elastic.co/t/should-doc-field-name-remove-duplicates/202333 "2019-10-04T11:23:09Z")
I am running elasticsearch 6.3 and try to perform a terms aggregation with a script as source. In the script, I use doc values to access a list that contains duplicates. It seems like all duplicates are removed when I us… --- ## [Upgrade to Master and Data only node configuration from master-data node](https://discuss.elastic.co/t/upgrade-to-master-and-data-only-node-configuration-from-master-data-node/201923)
**Author:** [@Ilayda\_Akinalan](https://discuss.elastic.co/u/Ilayda_Akinalan)\ **Replies:** 8\ **Last updated:** [October 4, 2019, 11:14am UTC](https://discuss.elastic.co/t/upgrade-to-master-and-data-only-node-configuration-from-master-data-node/201923 "2019-10-04T11:14:49Z")
Currently I have 3 nodes, 330 indices and 1,822 shards and approx 3 TB of memory. Currently these 3 nodes are master-data nodes and its not coping well with the load. I was planning to keep these 3 nodes as data nodes,… --- ## [Effeciency of cross cluster search](https://discuss.elastic.co/t/effeciency-of-cross-cluster-search/198465)
**Author:** [@divyang](https://discuss.elastic.co/u/divyang)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 10:48am UTC](https://discuss.elastic.co/t/effeciency-of-cross-cluster-search/198465 "2019-10-04T10:48:25Z")
Hi, I want to query an elastic index across different clusters in different data centers . I need to query it to generate a consolidated report. I have some questions 1\] Will cardinality and nested aggregations … --- ## [Deprecation warnings in Elasticsearch 6.8.3](https://discuss.elastic.co/t/deprecation-warnings-in-elasticsearch-6-8-3/202162)
**Author:** [@as50790](https://discuss.elastic.co/u/as50790)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 10:44am UTC](https://discuss.elastic.co/t/deprecation-warnings-in-elasticsearch-6-8-3/202162 "2019-10-04T10:44:49Z")
Hi, Could you please help me figuring out how to get rid of these deprecation warnings? \[WARN \]\[o.e.d.c.ParseField \] \[analytics\_08\] key \[timeout\] is not supported in the metadata section and will be rejected in 7… --- ## [Unable to install Elastic search with Open distro](https://discuss.elastic.co/t/unable-to-install-elastic-search-with-open-distro/202326)
**Author:** [@vejibeta](https://discuss.elastic.co/u/vejibeta)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 10:31am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-search-with-open-distro/202326 "2019-10-04T10:31:45Z")
Unable to install Elastic search with Open distro. commands(from official website of open distro): wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-oss-7.2.0-amd64.deb sudo dpkg -i elasticsearch-… --- ## [Non linguistic text in piece of content](https://discuss.elastic.co/t/non-linguistic-text-in-piece-of-content/201813)
**Author:** [@EmericW](https://discuss.elastic.co/u/EmericW)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 10:13am UTC](https://discuss.elastic.co/t/non-linguistic-text-in-piece-of-content/201813 "2019-10-04T10:13:02Z")
Hi, I have the following piece of text in a field using the standard tokenizer. ...erlegging van het EAB.\
Cass. 31 mei 2016, AR P.16.0606.N The standard tokenizer splits the P.16.0606.N into different parts due … --- ## [Keyword/Ignore\_above seems to be ignored with Custom Analyzer](https://discuss.elastic.co/t/keyword-ignore-above-seems-to-be-ignored-with-custom-analyzer/201306)
**Author:** [@DeadJim](https://discuss.elastic.co/u/DeadJim)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 10:07am UTC](https://discuss.elastic.co/t/keyword-ignore-above-seems-to-be-ignored-with-custom-analyzer/201306 "2019-10-04T10:07:19Z")
I've seen a historical post(closed) without resolution on this - apologies if I'm whipping a dead horse. tldr; implementation of a Custom Analyzer leads to Ingestion-Pipeline Errors of "Document contains at least one i… --- ## [Elasticsearch dsl (python) scanerror](https://discuss.elastic.co/t/elasticsearch-dsl-python-scanerror/201980)
**Author:** [@duttad](https://discuss.elastic.co/u/duttad)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-python-scanerror/201980 "2019-10-04T09:48:06Z")
I am getting the following error while trying to scroll through results: elasticsearch.helpers.ScanError: Scroll request has only succeeded on 13 shards out of 14 The code looks like this: from elasticsearch\_dsl impor… --- ## [Geo\_point expected - Elasticsearch version 7.3.2](https://discuss.elastic.co/t/geo-point-expected-elasticsearch-version-7-3-2/201495)
**Author:** [@lmariselvam](https://discuss.elastic.co/u/lmariselvam)\ **Replies:** 7\ **Last updated:** [October 4, 2019, 9:11am UTC](https://discuss.elastic.co/t/geo-point-expected-elasticsearch-version-7-3-2/201495 "2019-10-04T09:11:28Z")
I'm trying to index a document with a valid "geo\_point" data, but I got an error saying "geo\_point expected". Can someone please advise? Request: curl -X PUT "10.80.0.78:9200/production-index/mytype/mydocument1?pretty"… --- ## [Create two logs from one log](https://discuss.elastic.co/t/create-two-logs-from-one-log/202307)
**Author:** [@111221](https://discuss.elastic.co/u/111221)\ **Replies:** 0\ **Last updated:** [October 4, 2019, 8:44am UTC](https://discuss.elastic.co/t/create-two-logs-from-one-log/202307 "2019-10-04T08:44:47Z")
I have question about logstash filter. I wanna filter it that create 2 logs from 1 logs. ex. If 1 log input logstash then 2 logs output in the same log. Is it possible? --- ## [OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release 7.4.0](https://discuss.elastic.co/t/openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release-7-4-0/202099)
**Author:** [@lwin](https://discuss.elastic.co/u/lwin)\ **Replies:** 2\ **Last updated:** [October 4, 2019, 8:33am UTC](https://discuss.elastic.co/t/openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release-7-4-0/202099 "2019-10-04T08:33:45Z")
D:\\elasticsearch-7.4.0-windows-x86\_64\\elasticsearch-7.4.0\\bin\>elasticsearch.bat OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. … --- ## [Elasticsearch master not discovered exception in AWS EC2 instance](https://discuss.elastic.co/t/elasticsearch-master-not-discovered-exception-in-aws-ec2-instance/202292)
**Author:** [@Ilamparithi\_Karthike](https://discuss.elastic.co/u/Ilamparithi_Karthike)\ **Replies:** 7\ **Last updated:** [October 4, 2019, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-master-not-discovered-exception-in-aws-ec2-instance/202292 "2019-10-04T07:43:43Z")
We configured elasticsearch in the AWS EC2 instance. It was running smoothly we upgraded to version 7.3.1 (both elasticsearch and kibana in the same version). While starting both services, elasticsearch(ip:9200/?pretty)… --- ## [Elasticsearch 7.4 Netflow questions Logstash or filebeat WTF?](https://discuss.elastic.co/t/elasticsearch-7-4-netflow-questions-logstash-or-filebeat-wtf/202171)
**Author:** [@iukea](https://discuss.elastic.co/u/iukea)\ **Replies:** 5\ **Last updated:** [October 4, 2019, 7:33am UTC](https://discuss.elastic.co/t/elasticsearch-7-4-netflow-questions-logstash-or-filebeat-wtf/202171 "2019-10-04T07:33:58Z")
Hello, I am trying to figure out ElasticSearch and the NetFlow module. I use to think that I would send logs from my firewalls to via UDP to logstash https://www.elastic.co/guide/en/logstash/current/netflow-module.ht… --- ## [How to Ingest SAP Solutions manager data into Elastic search](https://discuss.elastic.co/t/how-to-ingest-sap-solutions-manager-data-into-elastic-search/202295)
**Author:** [@vinay.rao](https://discuss.elastic.co/u/vinay.rao)\ **Replies:** 0\ **Last updated:** [October 4, 2019, 7:29am UTC](https://discuss.elastic.co/t/how-to-ingest-sap-solutions-manager-data-into-elastic-search/202295 "2019-10-04T07:29:33Z")
Dear Team, We need to integrate SAP Solutions manager(Solman) with ELK Stack and to showcase the APP performance data in Kibana Dashboards. So kindly help us how can we integrate Solman with ELK and bring data. Regard… --- ## [Geolocation based search results](https://discuss.elastic.co/t/geolocation-based-search-results/202279)
**Author:** [@Vinayak\_Chauhan](https://discuss.elastic.co/u/Vinayak_Chauhan)\ **Replies:** 3\ **Last updated:** [October 4, 2019, 7:08am UTC](https://discuss.elastic.co/t/geolocation-based-search-results/202279 "2019-10-04T07:08:44Z")
Hello All, Anyone have any idea about detecting IP based geo-location which could be of country or city + country and show search results using Elastic search? Thanks for the help!! --- ## [Elastic Search - Run on server machine](https://discuss.elastic.co/t/elastic-search-run-on-server-machine/202069)
**Author:** [@ashokchinna](https://discuss.elastic.co/u/ashokchinna)\ **Replies:** 3\ **Last updated:** [October 4, 2019, 5:27am UTC](https://discuss.elastic.co/t/elastic-search-run-on-server-machine/202069 "2019-10-04T05:27:27Z")
I created a project on ELK stack. So far, I ran on localhost in my machine. Now, I have ubuntu machine, where i want the instances (ELK Stack) to run on Ubuntu machine. I just updated the elasticsearch.yml by setting … --- ## [Searchguard get error: Searchguard could not be Initialized with error: Root cause: MasterNotDiscoveredException](https://discuss.elastic.co/t/searchguard-get-error-searchguard-could-not-be-initialized-with-error-root-cause-masternotdiscoveredexception/202266)
**Author:** [@Phong\_Xuan](https://discuss.elastic.co/u/Phong_Xuan)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 5:25am UTC](https://discuss.elastic.co/t/searchguard-get-error-searchguard-could-not-be-initialized-with-error-root-cause-masternotdiscoveredexception/202266 "2019-10-04T05:25:33Z")
I use k8s to deploy Elasticsearch. Dockerfile: FROM docker.elastic.co/elasticsearch/elasticsearch:6.3.1 USER elasticsearch RUN elasticsearch-plugin install --batch analysis-kuromoji RUN elasticsearch-plugin install -… --- ## [What does "Could not write all entries for bulk operation" mean when I add two more data nodes into the cluster](https://discuss.elastic.co/t/what-does-could-not-write-all-entries-for-bulk-operation-mean-when-i-add-two-more-data-nodes-into-the-cluster/202280)
**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 5:15am UTC](https://discuss.elastic.co/t/what-does-could-not-write-all-entries-for-bulk-operation-mean-when-i-add-two-more-data-nodes-into-the-cluster/202280 "2019-10-04T05:15:03Z")
I added two more data nodes into the cluster, but I got the exception as follows only for these two nodes, but not from other existing nodes. org.elasticsearch.hadoop.EsHadoopException: Could not write all entries for … --- ## [How to perform automatic update\_by\_query on an index?](https://discuss.elastic.co/t/how-to-perform-automatic-update-by-query-on-an-index/198306)
**Author:** [@EZprogramming](https://discuss.elastic.co/u/EZprogramming)\ **Replies:** 5\ **Last updated:** [October 4, 2019, 5:08am UTC](https://discuss.elastic.co/t/how-to-perform-automatic-update-by-query-on-an-index/198306 "2019-10-04T05:08:21Z")
Here is an example: POST /test-scholarship/\_doc { "student": "George", "grade": 98 } I want to add a new field (scholarship) to the above doc. POST /test-scholarship/\_update\_by\_query { "script": "ctx.\_source.sch… --- ## [How do I access term frequency in painless scripting?](https://discuss.elastic.co/t/how-do-i-access-term-frequency-in-painless-scripting/200976)
**Author:** [@Ben\_Wilde](https://discuss.elastic.co/u/Ben_Wilde)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 3:43am UTC](https://discuss.elastic.co/t/how-do-i-access-term-frequency-in-painless-scripting/200976 "2019-10-04T03:43:40Z")
I want to do an aggregation where I measure the average frequency of a given term. The only way I can see of doing this is via a painless script. But according to the docs, I only have doc available which has all the fie… --- ## [Upgrade from OpenJDK 8 to OpenJDk 11 for elasticsearch Docker](https://discuss.elastic.co/t/upgrade-from-openjdk-8-to-openjdk-11-for-elasticsearch-docker/200960)
**Author:** [@Konathala\_Naveen](https://discuss.elastic.co/u/Konathala_Naveen)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 3:42am UTC](https://discuss.elastic.co/t/upgrade-from-openjdk-8-to-openjdk-11-for-elasticsearch-docker/200960 "2019-10-04T03:42:19Z")
We want to upgrade from OpenJDk 8 to OpenJDk 11 for elasticsearch Docker. And we are using the Adopt openJdk 8 . As per this link https://www.elastic.co/guide/en/elasticsearch/reference/current/setup.html . It is rec… --- ## [How to execute Lucene query inside Elasticsearch](https://discuss.elastic.co/t/how-to-execute-lucene-query-inside-elasticsearch/200626)
**Author:** [@saimaz](https://discuss.elastic.co/u/saimaz)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 3:36am UTC](https://discuss.elastic.co/t/how-to-execute-lucene-query-inside-elasticsearch/200626 "2019-10-04T03:36:48Z")
Hey there, I'm writing an Elasticsearch plugin. Can someone direct me to the right place how to execute a Lucene query in the Query Builder or Rescoring part from a plugin? The reason for a Lucene is because I want to … --- ## [Unknown plugin for the miniduke git project](https://discuss.elastic.co/t/unknown-plugin-for-the-miniduke-git-project/200426)
**Author:** [@Manimekalai\_K](https://discuss.elastic.co/u/Manimekalai_K)\ **Replies:** 1\ **Last updated:** [October 4, 2019, 3:32am UTC](https://discuss.elastic.co/t/unknown-plugin-for-the-miniduke-git-project/200426 "2019-10-04T03:32:34Z")
For this project I have build plugin zip. And when I try to install plugin getting error as Unknown plugin. I have installed in ES 5.6.7 --- ## [Elasticsearch 6.7.1 index not created](https://discuss.elastic.co/t/elasticsearch-6-7-1-index-not-created/202260)
**Author:** [@sunny1](https://discuss.elastic.co/u/sunny1)\ **Replies:** 0\ **Last updated:** [October 4, 2019, 12:53am UTC](https://discuss.elastic.co/t/elasticsearch-6-7-1-index-not-created/202260 "2019-10-04T00:53:28Z")
Hello, I did fresh install for elasticsearch, filebeat and kibana all version 6.7.1 All of them started normally, but when i feed data to filebeat, index is not created on elasticsearch. When i did " \`\`\` filebeat.exe -… --- ## [Logs from another platform](https://discuss.elastic.co/t/logs-from-another-platform/202243)
**Author:** [@shappy123](https://discuss.elastic.co/u/shappy123)\ **Replies:** 0\ **Last updated:** [October 3, 2019, 9:03pm UTC](https://discuss.elastic.co/t/logs-from-another-platform/202243 "2019-10-03T21:03:13Z")
Hi , We had an AKS ( Azure cluster ) where we use to get logs through fluentbit and landed on elasticsearch , where in Kibana it shows the logs as per cluster.... Now we had a different environment which is not part of… --- ## [Doubt in ES query](https://discuss.elastic.co/t/doubt-in-es-query/202213)
**Author:** [@Joao\_Daniel](https://discuss.elastic.co/u/Joao_Daniel)\ **Replies:** 1\ **Last updated:** [October 3, 2019, 8:53pm UTC](https://discuss.elastic.co/t/doubt-in-es-query/202213 "2019-10-03T20:53:37Z")
Hi, I have an index with has a lot of documents (+100MM). All documents have a field called "code" with has integers as values. I'm trying to retrive documents that have code set to 4732 OR 4756 OR 4758. If I ran the q… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1133) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1135)