# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1136 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1137 --- ## [Elasticsearch will no start](https://discuss.elastic.co/t/elasticsearch-will-no-start/202045)
**Author:** [@Bubba\_Shakes](https://discuss.elastic.co/u/Bubba_Shakes)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 8:02pm UTC](https://discuss.elastic.co/t/elasticsearch-will-no-start/202045 "2019-10-02T20:02:16Z")
Rebooted the server, ubuntu 1804 and now elasticsearch will not start and I can't determine why, was working fine before the reboot, java issue?. Below is the error and log: ● elasticsearch.service - Elasticsearch Lo… --- ## [ILM multiple aliases](https://discuss.elastic.co/t/ilm-multiple-aliases/202035)
**Author:** [@RockD](https://discuss.elastic.co/u/RockD)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:56pm UTC](https://discuss.elastic.co/t/ilm-multiple-aliases/202035 "2019-10-02T18:56:26Z")
Hi Some context first: I have multiple beats (metric, audit, heart ....), and making use of the common schema, and make the elastic to store the events on a single common index, in this case an index called simply beats… --- ## [How do I summarize the buckets from a term aggregation](https://discuss.elastic.co/t/how-do-i-summarize-the-buckets-from-a-term-aggregation/202033)
**Author:** [@PaulY](https://discuss.elastic.co/u/PaulY)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:52pm UTC](https://discuss.elastic.co/t/how-do-i-summarize-the-buckets-from-a-term-aggregation/202033 "2019-10-02T18:52:18Z")
Hi I have query that looks like... { "query": { "bool": { "must": \[ {"match": {"TxnCode.keyword": "XX"}} \] } }, "size": 0, "aggs": { "date\_buckets": { "terms": { "… --- ## [How to remove filebeat (index/Data) to reclaim space](https://discuss.elastic.co/t/how-to-remove-filebeat-index-data-to-reclaim-space/202032)
**Author:** [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:45pm UTC](https://discuss.elastic.co/t/how-to-remove-filebeat-index-data-to-reclaim-space/202032 "2019-10-02T18:45:32Z")
Hi my disk is almost full, i need to clear old data (i.e index or data or indices) what is the best way to do ? Can i just select filebeat-index which are more then 10 old and jsut click on Delete ? will that clear us… --- ## [Visualization of multi-value field with aggregation](https://discuss.elastic.co/t/visualization-of-multi-value-field-with-aggregation/202021)
**Author:** [@elastic25](https://discuss.elastic.co/u/elastic25)\ **Replies:** 4\ **Last updated:** [October 2, 2019, 6:22pm UTC](https://discuss.elastic.co/t/visualization-of-multi-value-field-with-aggregation/202021 "2019-10-02T18:22:19Z")
Newbie to the ELK stack and semi-technical. Our use case is to use the stack to run some analytics for pricing and product data broken down by different multi-value fields. I will start with source data structure and wh… --- ## [INDEX or POSITION of an \_id within the result of a typical search query](https://discuss.elastic.co/t/index-or-position-of-an-id-within-the-result-of-a-typical-search-query/202026)
**Author:** [@hive](https://discuss.elastic.co/u/hive)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:10pm UTC](https://discuss.elastic.co/t/index-or-position-of-an-id-within-the-result-of-a-typical-search-query/202026 "2019-10-02T18:10:33Z")
Is there anyway I can find the INDEX or POSITION of an \_id within the result of a typical search query? Requirement is to load the search page in its sorted order and by default load the range that matches a specific \_… --- ## [Mitigate performance impact of Beats](https://discuss.elastic.co/t/mitigate-performance-impact-of-beats/202025)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:03pm UTC](https://discuss.elastic.co/t/mitigate-performance-impact-of-beats/202025 "2019-10-02T18:03:22Z")
Hello All, Any recommendations on how to address performance impact of Beats? For example, imagine a production server named "Cheddar." It is an Ultra-Low Latency server at the NYSE. The powers at be are concerned abo… --- ## ["search\_after" not working](https://discuss.elastic.co/t/search-after-not-working/202024)
**Author:** [@hive](https://discuss.elastic.co/u/hive)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 6:01pm UTC](https://discuss.elastic.co/t/search-after-not-working/202024 "2019-10-02T18:01:37Z")
I am using a Java client to search. I see below request generated with appropriate "search\_after" values and sort columns (i also see result data sorted based on these columns). Response does NOT start with "Greg" as me… --- ## [Granted documents query with filter by @timestamp](https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834)
**Author:** [@Anton\_Matveev](https://discuss.elastic.co/u/Anton_Matveev)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 5:40pm UTC](https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834 "2019-10-02T17:40:17Z")
I have a similar issue with granted documents query (as https://discuss.elastic.co/t/document-level-security-combining-queries-together/136143) I use following query: { "bool": { "filter": \[ { … --- ## [ES site-local addressing scheme](https://discuss.elastic.co/t/es-site-local-addressing-scheme/202007)
**Author:** [@ldenitto](https://discuss.elastic.co/u/ldenitto)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 4:49pm UTC](https://discuss.elastic.co/t/es-site-local-addressing-scheme/202007 "2019-10-02T16:49:20Z")
I'm fairly new to ES and looking forward to implementing it in my environment. When going through the config documentation, I came across this: https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-net… --- ## [S3 bcuket logs ingestion to Elastic search](https://discuss.elastic.co/t/s3-bcuket-logs-ingestion-to-elastic-search/201842)
**Author:** [@sk545](https://discuss.elastic.co/u/sk545)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 4:44pm UTC](https://discuss.elastic.co/t/s3-bcuket-logs-ingestion-to-elastic-search/201842 "2019-10-02T16:44:44Z")
Can i please get list best methods to ingest data from AWS S3 bucket to Elastic search ? shall we use "Functionbeat" to monitor AWS S3 bucket and ship them to Elastic search ? --- ## [Change index mapping with minimal downtime](https://discuss.elastic.co/t/change-index-mapping-with-minimal-downtime/201994)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 3:38pm UTC](https://discuss.elastic.co/t/change-index-mapping-with-minimal-downtime/201994 "2019-10-02T15:38:06Z")
I am using ElasticSearch 6.5. I need to change some mappings in my index. The way I am doing this right now is: Create a new index, with updated mapping. Use Reindex API to move data to new index. Delete an old index. … --- ## [I'm creating a snapshot successfully but when query GET snapshot I don't get a suited response - How come?](https://discuss.elastic.co/t/im-creating-a-snapshot-successfully-but-when-query-get-snapshot-i-dont-get-a-suited-response-how-come/201360)
**Author:** [@Yotam\_Levy](https://discuss.elastic.co/u/Yotam_Levy)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 3:28pm UTC](https://discuss.elastic.co/t/im-creating-a-snapshot-successfully-but-when-query-get-snapshot-i-dont-get-a-suited-response-how-come/201360 "2019-10-02T15:28:28Z")
I get a good response after creating my snapshot, but right after that, I perform a GET to the snapshot I've created and sometimes I get an exception that claims there's no such snapshot in the repository. how can it be… --- ## [Start Elasticsearch as a Service in RHEL with a domain user](https://discuss.elastic.co/t/start-elasticsearch-as-a-service-in-rhel-with-a-domain-user/201990)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 3:25pm UTC](https://discuss.elastic.co/t/start-elasticsearch-as-a-service-in-rhel-with-a-domain-user/201990 "2019-10-02T15:25:12Z")
Hi! We are starting all the stack (Filebeat, Logstash, Elastic and Kibana) with a local user. Can we start these services with a domain user? I mean, right now we have some Filebeats (some in windows, some in RHEL), a… --- ## [Elasticsearch 6.8 in Docker crashing with SIGILL after restart - corrupt state?](https://discuss.elastic.co/t/elasticsearch-6-8-in-docker-crashing-with-sigill-after-restart-corrupt-state/200452)
**Author:** [@retzkek](https://discuss.elastic.co/u/retzkek)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 3:22pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-in-docker-crashing-with-sigill-after-restart-corrupt-state/200452 "2019-10-02T15:22:10Z")
Somewhat recently we upgraded our cluster to 6.8, and in the process started running elasticsearch in Docker containers, one per host, using the elasticsearch:6.8.0 image from docker hub. Testing and deployment went fine… --- ## [Custom week intervals in date\_histogram aggregations](https://discuss.elastic.co/t/custom-week-intervals-in-date-histogram-aggregations/201961)
**Author:** [@mnv](https://discuss.elastic.co/u/mnv)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 2:52pm UTC](https://discuss.elastic.co/t/custom-week-intervals-in-date-histogram-aggregations/201961 "2019-10-02T14:52:10Z")
Hello! I want create a buckets with date\_histogram with week interval, but I need a week that starts at Thursday and ends on Wednesday from next week: 29.08-04.09, 05.09-11.09, eg. Is that possible in one query? --- ## [Sebp/elk how to run multiple Elastic Stacks in Docker containers on the same host](https://discuss.elastic.co/t/sebp-elk-how-to-run-multiple-elastic-stacks-in-docker-containers-on-the-same-host/201979)
**Author:** [@kmiklas](https://discuss.elastic.co/u/kmiklas)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 2:48pm UTC](https://discuss.elastic.co/t/sebp-elk-how-to-run-multiple-elastic-stacks-in-docker-containers-on-the-same-host/201979 "2019-10-02T14:48:35Z")
How can multiple Docker containers of the sebp/elk image be run on the same host? I've got a Stack running with the following command, default ports: sudo docker run --ulimit nofile=65536:65536 -p 5601:5601 -p 9200:920… --- ## [Filtering with multiple values in elasticsearch (AWS elasticsearch)](https://discuss.elastic.co/t/filtering-with-multiple-values-in-elasticsearch-aws-elasticsearch/201969)
**Author:** [@blackOcean](https://discuss.elastic.co/u/blackOcean)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 2:17pm UTC](https://discuss.elastic.co/t/filtering-with-multiple-values-in-elasticsearch-aws-elasticsearch/201969 "2019-10-02T14:17:50Z")
Hi, We want to search based on testUuid with multiple values and it could be possible that there are more than 500 values. I found two ways through which I can find information : Bool with match\_phrase "query": { … --- ## [Index pattern and size calculation for aggregating logs and metrics for hundreds microservices](https://discuss.elastic.co/t/index-pattern-and-size-calculation-for-aggregating-logs-and-metrics-for-hundreds-microservices/201968)
**Author:** [@surenraju](https://discuss.elastic.co/u/surenraju)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 2:16pm UTC](https://discuss.elastic.co/t/index-pattern-and-size-calculation-for-aggregating-logs-and-metrics-for-hundreds-microservices/201968 "2019-10-02T14:16:50Z")
Hello, We are going to provide elastic stack as service for our internal clients like micro service teams. We are expecting few hundred micro service team to consume elastic stack for application logs and application me… --- ## [Criar index com logstash utilizando settings customizado](https://discuss.elastic.co/t/criar-index-com-logstash-utilizando-settings-customizado/201795)
**Author:** [@fernando.vicente](https://discuss.elastic.co/u/fernando.vicente)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 2:01pm UTC](https://discuss.elastic.co/t/criar-index-com-logstash-utilizando-settings-customizado/201795 "2019-10-02T14:01:44Z")
Boa tarde pessoal, estou tentando criar um Indice no Elasticsearch (7.0.1) a partir do Logstash (7.3.1) quando tento colocar um template de configurações não funciona (quando subo com as configurações padrões funciona s… --- ## [Xpack.security.enabled: true - the cluster fails to connect the nodes](https://discuss.elastic.co/t/xpack-security-enabled-true-the-cluster-fails-to-connect-the-nodes/201415)
**Author:** [@laurentiubanica](https://discuss.elastic.co/u/laurentiubanica)\ **Replies:** 18\ **Last updated:** [October 2, 2019, 1:35pm UTC](https://discuss.elastic.co/t/xpack-security-enabled-true-the-cluster-fails-to-connect-the-nodes/201415 "2019-10-02T13:35:24Z")
Hi, I have setup an elaticsearch cluster of 3 nodes. I'm running the latest version of elasticsearch: 7.3.2. After setting the xpack.security.enabled to true, the cluster has stopped working. After running curl -x to… --- ## [Docker Desktop used space increase +500Mb per day](https://discuss.elastic.co/t/docker-desktop-used-space-increase-500mb-per-day/201957)
**Author:** [@jnick1982](https://discuss.elastic.co/u/jnick1982)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 1:27pm UTC](https://discuss.elastic.co/t/docker-desktop-used-space-increase-500mb-per-day/201957 "2019-10-02T13:27:38Z")
Since migrating from 6.4 to 6.8 and now 7.3.2 I notice that the used space from Docker Desktop on Windows 10 increased every day. I am running a very simple elk stack Elasticsearch/Kibana/Logstash from a docker compose.… --- ## [Setting "max\_determinized\_states" when using \_source to filter fields during match\_all](https://discuss.elastic.co/t/setting-max-determinized-states-when-using-source-to-filter-fields-during-match-all/201956)
**Author:** [@doruchiulan](https://discuss.elastic.co/u/doruchiulan)\ **Replies:** 0\ **Last updated:** [October 2, 2019, 1:17pm UTC](https://discuss.elastic.co/t/setting-max-determinized-states-when-using-source-to-filter-fields-during-match-all/201956 "2019-10-02T13:17:43Z")
I have a long list of fields that I want to include in my results during a match\_all query (1600+) This triggers the following error: { \* "error": { \* "root\_cause": \[ \* { \* "type": "too\_complex\_to\_determini… --- ## [Writing aggregate with filtering](https://discuss.elastic.co/t/writing-aggregate-with-filtering/200930)
**Author:** [@Dennis\_Monsewicz](https://discuss.elastic.co/u/Dennis_Monsewicz)\ **Replies:** 4\ **Last updated:** [October 2, 2019, 1:04pm UTC](https://discuss.elastic.co/t/writing-aggregate-with-filtering/200930 "2019-10-02T13:04:06Z")
I'm trying to write an ElasticSearch aggregate query that includes filtering where I am wanting to grab all of the tags off a all of the documents where a user id matches the one I specify. I have this code: { "size"… --- ## [Inomplete populate](https://discuss.elastic.co/t/inomplete-populate/201748)
**Author:** [@CHANGUEL\_Sami](https://discuss.elastic.co/u/CHANGUEL_Sami)\ **Replies:** 3\ **Last updated:** [October 2, 2019, 12:35pm UTC](https://discuss.elastic.co/t/inomplete-populate/201748 "2019-10-02T12:35:41Z")
Hi, I'am a beginner, I'm using ES 6.1.1 in a Symfony project (via fos\_elastica bundle) When I run populate command the progress bar stops at 75% : root@ce30fac77888/app# php bin/console fos:elastica:populate Resetting… --- ## [Constant high CPU usage](https://discuss.elastic.co/t/constant-high-cpu-usage/201785)
**Author:** [@Ismael\_Attoumani](https://discuss.elastic.co/u/Ismael_Attoumani)\ **Replies:** 2\ **Last updated:** [October 2, 2019, 12:26pm UTC](https://discuss.elastic.co/t/constant-high-cpu-usage/201785 "2019-10-02T12:26:18Z")
Hello, I'm using elasticsearch (7.3.0) on a single debian 9 (strech) instance (6 cpu / 32gb RAM). I'm seeing a constant CPU usage at 100% even if I stop all indexing and there are only around 50 http connections. "http… --- ## [Json parse exception with status 500 post upgrade to 7.4.0](https://discuss.elastic.co/t/json-parse-exception-with-status-500-post-upgrade-to-7-4-0/201936)
**Author:** [@starrynight](https://discuss.elastic.co/u/starrynight)\ **Replies:** 2\ **Last updated:** [October 2, 2019, 12:05pm UTC](https://discuss.elastic.co/t/json-parse-exception-with-status-500-post-upgrade-to-7-4-0/201936 "2019-10-02T12:05:59Z")
I've upgraded from 7.3.2 to 7.4.0 and in attempting to follow the rolling upgrades document -- I've issued a: \[root@host elasticsearch\]# curl -X PUT -u elastic "ipaddy:9200/\_cluster/settings?pretty" -H 'Content-Type: ap… --- ## [How to migrate index into other machine](https://discuss.elastic.co/t/how-to-migrate-index-into-other-machine/201922)
**Author:** [@daniel.velasco](https://discuss.elastic.co/u/daniel.velasco)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 10:16am UTC](https://discuss.elastic.co/t/how-to-migrate-index-into-other-machine/201922 "2019-10-02T10:16:51Z")
Hi. I have two machines, in the first I have indexes that I want migrate them to the second machine, but in the second machine I have some indexes that I don't want lose them. I had proved to copy the indices folder bu… --- ## [Protect Watchers from being accidently deleted](https://discuss.elastic.co/t/protect-watchers-from-being-accidently-deleted/201916)
**Author:** [@Ahmad\_Hawasli](https://discuss.elastic.co/u/Ahmad_Hawasli)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 9:08am UTC](https://discuss.elastic.co/t/protect-watchers-from-being-accidently-deleted/201916 "2019-10-02T09:08:06Z")
I have implemented Kibana spaces. Users are allowed only to see their corrsoponding indices. In addition, some users from different spaces have a manage\_watchers privilege set. My questions is: Is there a way to prevent… --- ## [Elasticsearch version values](https://discuss.elastic.co/t/elasticsearch-version-values/201899)
**Author:** [@tomas321](https://discuss.elastic.co/u/tomas321)\ **Replies:** 1\ **Last updated:** [October 2, 2019, 9:06am UTC](https://discuss.elastic.co/t/elasticsearch-version-values/201899 "2019-10-02T09:06:59Z")
Hi, I'm familiar with minimum\_index\_compatibility\_version and hope it indicates the minimum version required for index compatibility (e.g. reindex). But I'm not sure what minimum\_wire\_compatibility\_version means. [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1135) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1137)