# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1142

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1143

---

## [Automatically create role based on index](https://discuss.elastic.co/t/automatically-create-role-based-on-index/199693)

<div class="topic-metadata">

**Author:** [@sthomps](https://discuss.elastic.co/u/sthomps)\
**Replies:** 3\
**Last updated:** [September 26, 2019, 1:25pm UTC](https://discuss.elastic.co/t/automatically-create-role-based-on-index/199693 "2019-09-26T13:25:14Z")

</div>

Hi, In my setup I'll be creating indexes where the index is the id = an associated group of applications. This id will be in an LDAP tree where the user has access to a # of id's. Is there a way to automatically setup…

---

## [Elasticsearch ranking aggregation with multiple terms query](https://discuss.elastic.co/t/elasticsearch-ranking-aggregation-with-multiple-terms-query/201219)

<div class="topic-metadata">

**Author:** [@Azeem\_Akhtar](https://discuss.elastic.co/u/Azeem_Akhtar)\
**Replies:** 1\
**Last updated:** [September 26, 2019, 11:42am UTC](https://discuss.elastic.co/t/elasticsearch-ranking-aggregation-with-multiple-terms-query/201219 "2019-09-26T11:42:29Z")

</div>

I have two indices documents and recommendations with the following mappings: Documents: { "id": string, "document\_text" : string, "author" : { "name": string } ...other fields } Recommendations: { …

---

## [Kubernetes state\_pod, state\_node, state\_container information missing in Kubernetes dashboard](https://discuss.elastic.co/t/kubernetes-state-pod-state-node-state-container-information-missing-in-kubernetes-dashboard/201206)

<div class="topic-metadata">

**Author:** [@Surya369](https://discuss.elastic.co/u/Surya369)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 10:14am UTC](https://discuss.elastic.co/t/kubernetes-state-pod-state-node-state-container-information-missing-in-kubernetes-dashboard/201206 "2019-09-26T10:14:58Z")

</div>

Hi there, I am unable to get the kube-state -metrics in the Kibana Kubernetes dashboard. I have checked in the discover tab and find that the kube-state-metrics server is getting connected during some instances of time…

---

## [Cannot allocate because all found copies of the shard are either stale or corrupt](https://discuss.elastic.co/t/cannot-allocate-because-all-found-copies-of-the-shard-are-either-stale-or-corrupt/201202)

<div class="topic-metadata">

**Author:** [@Lakshman\_Singh](https://discuss.elastic.co/u/Lakshman_Singh)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 9:58am UTC](https://discuss.elastic.co/t/cannot-allocate-because-all-found-copies-of-the-shard-are-either-stale-or-corrupt/201202 "2019-09-26T09:58:22Z")

</div>

nested: IndexShardRecoveryException\[failed to fetch index version after copying it over\]; nested: IndexShardRecoveryException\[shard allocated for local recovery (post api), should exist, but doesn't, current files: \]; ne…

---

## [Cluster Reroute Retry Failed Null Pointer Exception](https://discuss.elastic.co/t/cluster-reroute-retry-failed-null-pointer-exception/201204)

<div class="topic-metadata">

**Author:** [@Bellicapelli0](https://discuss.elastic.co/u/Bellicapelli0)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 10:01am UTC](https://discuss.elastic.co/t/cluster-reroute-retry-failed-null-pointer-exception/201204 "2019-09-26T10:01:24Z")

</div>

Good morning everyone. Last night one of the machines with one of the nodes of my cluster shutdown, so this morning I restarted it and waited for shard allocation. After waiting for a while, the restarted node only had …

---

## [ES 7.3.2 on CentOS: JvmOptionsParser - cannot resolve ES\_TMPDIR](https://discuss.elastic.co/t/es-7-3-2-on-centos-jvmoptionsparser-cannot-resolve-es-tmpdir/201076)

<div class="topic-metadata">

**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 9:45am UTC](https://discuss.elastic.co/t/es-7-3-2-on-centos-jvmoptionsparser-cannot-resolve-es-tmpdir/201076 "2019-09-26T09:45:56Z")

</div>

I'm trying to spin up multiple ES instances on a server, this used to work with ES 6.x, but does not work with the recent version: ES\_LOCAL\_PORT=9100 export ES\_PATH\_CONF=${HOME}/etc/elasticsearch1 export ES\_JAVA\_OPTS="…

---

## [What is the difference in aggregating data in Elasticsearch vs Kibana?](https://discuss.elastic.co/t/what-is-the-difference-in-aggregating-data-in-elasticsearch-vs-kibana/201196)

<div class="topic-metadata">

**Author:** [@sahishnu.patil](https://discuss.elastic.co/u/sahishnu.patil)\
**Replies:** 1\
**Last updated:** [September 26, 2019, 9:35am UTC](https://discuss.elastic.co/t/what-is-the-difference-in-aggregating-data-in-elasticsearch-vs-kibana/201196 "2019-09-26T09:35:23Z")

</div>

Aggregations can be applied at Elasticsearch and at Kibana . What is the difference in aggregating data at these locations ?

---

## [Cannot GET \_source if \_id has spaces in it](https://discuss.elastic.co/t/cannot-get-source-if-id-has-spaces-in-it/201045)

<div class="topic-metadata">

**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 8:48am UTC](https://discuss.elastic.co/t/cannot-get-source-if-id-has-spaces-in-it/201045 "2019-09-26T08:48:40Z")

</div>

We have a document indexed with the \_id field set to "STT -30247-010" (note the space). We are unable to retrieve this document via the API (documents without spaces in the \_id) work fine. With a \_search (q=\_id="STT -3…

---

## [Search.query\_time\_in\_millis and search.query\_total metrics](https://discuss.elastic.co/t/search-query-time-in-millis-and-search-query-total-metrics/201186)

<div class="topic-metadata">

**Author:** [@tetiana](https://discuss.elastic.co/u/tetiana)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 8:38am UTC](https://discuss.elastic.co/t/search-query-time-in-millis-and-search-query-total-metrics/201186 "2019-09-26T08:38:37Z")

</div>

Hi, The same metrics search.query\_time\_in\_millis, search.query\_total are provided by Node API and Index API, how they are calculated? is it just a sum of shards metrics search.query\_time\_in\_millis, search.query\_total, l…

---

## [Exact match in the filter query](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321)

<div class="topic-metadata">

**Author:** [@JohnM](https://discuss.elastic.co/u/JohnM)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 8:29am UTC](https://discuss.elastic.co/t/exact-match-in-the-filter-query/200321 "2019-09-26T08:29:05Z")

</div>

Hi friends, I am making my python script to query es to search Linux syslog. the script sends the following query. {'query': {'bool': {'filter': \[{'query\_string': {'query': 'oom-killer AND exim'}}, {'range': {'@timest…

---

## [Split search results the same way everytime](https://discuss.elastic.co/t/split-search-results-the-same-way-everytime/201180)

<div class="topic-metadata">

**Author:** [@satishns](https://discuss.elastic.co/u/satishns)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 8:12am UTC](https://discuss.elastic.co/t/split-search-results-the-same-way-everytime/201180 "2019-09-26T08:12:08Z")

</div>

I want to split my search results into say 3 buckets. When I rerun my search again after a week, i want the record to be landed in the same bucket as it did in the past. Records may get added / removed into the bucket bu…

---

## [\_update\_by\_query is very slow (version 7.3 elastic cloud)](https://discuss.elastic.co/t/update-by-query-is-very-slow-version-7-3-elastic-cloud/201173)

<div class="topic-metadata">

**Author:** [@jadore](https://discuss.elastic.co/u/jadore)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 7:48am UTC](https://discuss.elastic.co/t/update-by-query-is-very-slow-version-7-3-elastic-cloud/201173 "2019-09-26T07:48:55Z")

</div>

when I use this query from dev tools in Kibana POST some\_index/\_update\_by\_query?conflicts=proceed { "script": { "source": "ctx.\_source.view\_count = 0", "lang": "painless" } } it will return { "ok": false…

---

## [How to set the heap-size reasonably](https://discuss.elastic.co/t/how-to-set-the-heap-size-reasonably/201168)

<div class="topic-metadata">

**Author:** [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 7:29am UTC](https://discuss.elastic.co/t/how-to-set-the-heap-size-reasonably/201168 "2019-09-26T07:29:05Z")

</div>

Hi everyone, I'm new for elasticsearch and I know that the ES Heap-size is usually 50% of my physical RAM and cannot exceed 32GB. My 1st question is, if my physical RAM has only 32GB, and there are other programs runnin…

---

## [ElasticSearch NEST: Bulk-indexing operation does not make use of specified document IDs](https://discuss.elastic.co/t/elasticsearch-nest-bulk-indexing-operation-does-not-make-use-of-specified-document-ids/201003)

<div class="topic-metadata">

**Author:** [@Miao](https://discuss.elastic.co/u/Miao)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 7:28am UTC](https://discuss.elastic.co/t/elasticsearch-nest-bulk-indexing-operation-does-not-make-use-of-specified-document-ids/201003 "2019-09-26T07:28:15Z")

</div>

I currently use the ElasticSearch NEST 7.x library. On the VM that hosts my ElasticSearch master node, I am running a web server which receives JSON data via REST. These JSON data are then to be saved inside ElasticSear…

---

## [\[ERROR\]OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release](https://discuss.elastic.co/t/error-openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release/201092)

<div class="topic-metadata">

**Author:** [@valentine-dev](https://discuss.elastic.co/u/valentine-dev)\
**Replies:** 1\
**Last updated:** [September 26, 2019, 7:21am UTC](https://discuss.elastic.co/t/error-openjdk-64-bit-server-vm-warning-option-useconcmarksweepgc-was-deprecated-in-version-9-0-and-will-likely-be-removed-in-a-future-release/201092 "2019-09-26T07:21:18Z")

</div>

I just set up a GKE ES cluster with 3 master eligible nodes, 3 data nodes, and 2 coordinator nodes. I haven't created any index yet. Following is the logging from Stackdriver: \[2019-09-24 23:01:24.158 PDT\] OpenJDK 64…

---

## [Aggregation of two fields in single query](https://discuss.elastic.co/t/aggregation-of-two-fields-in-single-query/200803)

<div class="topic-metadata">

**Author:** [@rgranit](https://discuss.elastic.co/u/rgranit)\
**Replies:** 5\
**Last updated:** [September 26, 2019, 7:01am UTC](https://discuss.elastic.co/t/aggregation-of-two-fields-in-single-query/200803 "2019-09-26T07:01:21Z")

</div>

Hello, I have aמ index with documents that contain several fields, among these are: grade person\_id I wish to create an aggregation that count the number of documents found for each person\_id and for each person sum …

---

## [Ecommerce data model with ES](https://discuss.elastic.co/t/ecommerce-data-model-with-es/201158)

<div class="topic-metadata">

**Author:** [@svbhayani](https://discuss.elastic.co/u/svbhayani)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 6:58am UTC](https://discuss.elastic.co/t/ecommerce-data-model-with-es/201158 "2019-09-26T06:58:59Z")

</div>

Hello , I want to create a schema design in ES to support below business model I have Hundreds of thousands of articles ~1000K Each article may have different prices/offers like Samsumg S10 can have different 50 or mo…

---

## [Elasticsearch 1.5.2 service stops after 5 - 6 hours](https://discuss.elastic.co/t/elasticsearch-1-5-2-service-stops-after-5-6-hours/201138)

<div class="topic-metadata">

**Author:** [@Harsh\_Vadodaria](https://discuss.elastic.co/u/Harsh_Vadodaria)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 5:53am UTC](https://discuss.elastic.co/t/elasticsearch-1-5-2-service-stops-after-5-6-hours/201138 "2019-09-26T05:53:49Z")

</div>

Dear all, I recently found that ES service stops after few hours of activity. I am using version 1.5.2 and the server contains 8g of RAM and 155g of heap. I changed value of ES\_HEAP\_SIZE=1024m in /etc/default/elasticsea…

---

## [Azure cloud discovery plugin not working for 6.7.2](https://discuss.elastic.co/t/azure-cloud-discovery-plugin-not-working-for-6-7-2/201141)

<div class="topic-metadata">

**Author:** [@shankar\_s](https://discuss.elastic.co/u/shankar_s)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 5:45am UTC](https://discuss.elastic.co/t/azure-cloud-discovery-plugin-not-working-for-6-7-2/201141 "2019-09-26T05:45:16Z")

</div>

i'm trying to build up the 3-master 3-nodes elastic search stack in azure using vm. when i configure the elasticsearch with azure cloud discovery plugin i dont see that both master can communicate & it is not able to j…

---

## [\[Resolved\]ES7.0.1 - Error in elasticsearch 'Failed to parse mapping \[\_doc\]'](https://discuss.elastic.co/t/resolved-es7-0-1-error-in-elasticsearch-failed-to-parse-mapping-doc/200998)

<div class="topic-metadata">

**Author:** [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 5:39am UTC](https://discuss.elastic.co/t/resolved-es7-0-1-error-in-elasticsearch-failed-to-parse-mapping-doc/200998 "2019-09-26T05:39:07Z")

</div>

Hi Team, I observed an error in elasticsearch. how to resolve it? \[2019-09-25T14:32:07,690\]\[INFO \]\[o.e.l.LicenseService \] \[node-1\] license \[e57e4a0d-4f0a-4e25-8beb-2e6192495d41\] mode \[trial\] - valid \[2019-09-25T14…

---

## [What does master having high load of CPU could mean?](https://discuss.elastic.co/t/what-does-master-having-high-load-of-cpu-could-mean/201139)

<div class="topic-metadata">

**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\
**Replies:** 4\
**Last updated:** [September 26, 2019, 5:27am UTC](https://discuss.elastic.co/t/what-does-master-having-high-load-of-cpu-could-mean/201139 "2019-09-26T05:27:43Z")

</div>

From some guidance, it suggests that master nodes do not need much cpu/memory. From my clusters, this looks true for most of the time. But sometimes, I do observe one of the master node has a high load\_5m. e.g. 5 or 6, b…

---

## [Access issues not able to get Elasticsearch status from Browser?](https://discuss.elastic.co/t/access-issues-not-able-to-get-elasticsearch-status-from-browser/200876)

<div class="topic-metadata">

**Author:** [@ent\_1](https://discuss.elastic.co/u/ent_1)\
**Replies:** 4\
**Last updated:** [September 26, 2019, 4:31am UTC](https://discuss.elastic.co/t/access-issues-not-able-to-get-elasticsearch-status-from-browser/200876 "2019-09-26T04:31:49Z")

</div>

unable to get Elasticsearch status from Browser help me out sort the issue

---

## [Memory/cpu ratio to disk size](https://discuss.elastic.co/t/memory-cpu-ratio-to-disk-size/200752)

<div class="topic-metadata">

**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\
**Replies:** 6\
**Last updated:** [September 26, 2019, 4:58am UTC](https://discuss.elastic.co/t/memory-cpu-ratio-to-disk-size/200752 "2019-09-26T04:58:26Z")

</div>

Could I get some comments on concerns/ insights on the following resource( cpu/ memory and disk size) configuration for one of my Elasticsearch cluster? Data volume: throughput: 18K docs/ second ( very continous load) …

---

## [Can data nodes have different size of disk in one cluster?](https://discuss.elastic.co/t/can-data-nodes-have-different-size-of-disk-in-one-cluster/201134)

<div class="topic-metadata">

**Author:** [@yuecong](https://discuss.elastic.co/u/yuecong)\
**Replies:** 1\
**Last updated:** [September 26, 2019, 4:33am UTC](https://discuss.elastic.co/t/can-data-nodes-have-different-size-of-disk-in-one-cluster/201134 "2019-09-26T04:33:53Z")

</div>

does anyone know any concern if I construct a cluster with data nodes with different disk size? e.g. 5 data nodes with 200GB Disk 5 data nodes with 1TB disk and 5 data nodes with 10TB disk. Will this cause any issue…

---

## [Howto locate Logstash variables in Elasticsearch and Kibana](https://discuss.elastic.co/t/howto-locate-logstash-variables-in-elasticsearch-and-kibana/200957)

<div class="topic-metadata">

**Author:** [@mohamad.faisel](https://discuss.elastic.co/u/mohamad.faisel)\
**Replies:** 2\
**Last updated:** [September 26, 2019, 3:52am UTC](https://discuss.elastic.co/t/howto-locate-logstash-variables-in-elasticsearch-and-kibana/200957 "2019-09-26T03:52:50Z")

</div>

Hi, I have the following logstash config for filterlog stored in 'conf' subdirectory inside my home directory --- Begin ~/conf/filterlog.conf --- input { file{ path =\> "/var/log/10.9.8.1/filterlog.log" start\_positi…

---

## [How to profile next\_doc take too long?](https://discuss.elastic.co/t/how-to-profile-next-doc-take-too-long/201120)

<div class="topic-metadata">

**Author:** [@Wesley\_Hsiung](https://discuss.elastic.co/u/Wesley_Hsiung)\
**Replies:** 0\
**Last updated:** [September 26, 2019, 12:32am UTC](https://discuss.elastic.co/t/how-to-profile-next-doc-take-too-long/201120 "2019-09-26T00:32:04Z")

</div>

I have one index with 100 million docs, on 12 data nodes(with 12 shards), 16G ram, 500G storge each node; the query is filter on biz id(keyword) and date range and amt range; the biggest biz id have 20 million docs, and …

---

## [How does version upgrades work with Federated cluster](https://discuss.elastic.co/t/how-does-version-upgrades-work-with-federated-cluster/201111)

<div class="topic-metadata">

**Author:** [@pbathala](https://discuss.elastic.co/u/pbathala)\
**Replies:** 0\
**Last updated:** [September 25, 2019, 9:54pm UTC](https://discuss.elastic.co/t/how-does-version-upgrades-work-with-federated-cluster/201111 "2019-09-25T21:54:19Z")

</div>

Hello, I am looking into using elasticsearch federated cluster model to split data between multiple clusters and query them via federated cluster for a holistic view. One thing that is not clear and I am not able to fin…

---

## [Wildcard \* is not working for my index](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040)

<div class="topic-metadata">

**Author:** [@Dibyakanta](https://discuss.elastic.co/u/Dibyakanta)\
**Replies:** 6\
**Last updated:** [September 25, 2019, 7:03pm UTC](https://discuss.elastic.co/t/wildcard-is-not-working-for-my-index/201040 "2019-09-25T19:03:11Z")

</div>

Hi, I have created an index with the following mapping: PUT abc { "mappings": { "type" : { "properties": { "title" : { "type": "text", "analyzer": "standard" } } } } } After this I added documents to it li…

---

## [Problem with join additional nodes to dockerized cluster elasticsearch 6.6.2 + xpack](https://discuss.elastic.co/t/problem-with-join-additional-nodes-to-dockerized-cluster-elasticsearch-6-6-2-xpack/200664)

<div class="topic-metadata">

**Author:** [@amilek](https://discuss.elastic.co/u/amilek)\
**Replies:** 1\
**Last updated:** [September 25, 2019, 6:02pm UTC](https://discuss.elastic.co/t/problem-with-join-additional-nodes-to-dockerized-cluster-elasticsearch-6-6-2-xpack/200664 "2019-09-25T18:02:56Z")

</div>

Hello, everybody! I try to deploy this configuration: ES 6.6.2 on several docker hosts, 3 nodes. Two nodes are master-eligible and one node is "data only". XPACK enabled (basic license). Inter node communication is…

---

## [Rest High Level Client Cluster State](https://discuss.elastic.co/t/rest-high-level-client-cluster-state/200789)

<div class="topic-metadata">

**Author:** [@Rohinaik](https://discuss.elastic.co/u/Rohinaik)\
**Replies:** 2\
**Last updated:** [September 25, 2019, 5:17pm UTC](https://discuss.elastic.co/t/rest-high-level-client-cluster-state/200789 "2019-09-25T17:17:48Z")

</div>

Is there any way to obtain the cluster state metadata via Rest High Level Client (using transport client we were able to fetch the metadata of the cluster via ClusterStateRequest,ClusterStateResponse APIs)

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1141)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1143)
