# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1154 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1155 --- ## [Long running search tasks and the index.search.slowlog.threshold.query.warn setting](https://discuss.elastic.co/t/long-running-search-tasks-and-the-index-search-slowlog-threshold-query-warn-setting/199734)
**Author:** [@o1o1o11o1](https://discuss.elastic.co/u/o1o1o11o1)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 10:27pm UTC](https://discuss.elastic.co/t/long-running-search-tasks-and-the-index-search-slowlog-threshold-query-warn-setting/199734 "2019-09-16T22:27:40Z")
I have set index.search.slowlog.threshold.query.warn to 60s to catch some slow searches, however even though I see search tasks running for more than 120 seconds, I don't see anything in the slow logs on any of data node… --- ## [Starting ES with TLS options](https://discuss.elastic.co/t/starting-es-with-tls-options/199468)
**Author:** [@NewmazN24](https://discuss.elastic.co/u/NewmazN24)\ **Replies:** 12\ **Last updated:** [September 16, 2019, 9:23pm UTC](https://discuss.elastic.co/t/starting-es-with-tls-options/199468 "2019-09-16T21:23:07Z")
Fresh install, I didn't modify any of my file except elasticsearch.yml. I do not know what I need to do, did wrong. Java is installed as well. Addon to ES yaml xpack.security.enabled: true xpack.security.transport.ss… --- ## [If I have syslogs from multiple types of devices and multiple ILM policies, how should I structure these?](https://discuss.elastic.co/t/if-i-have-syslogs-from-multiple-types-of-devices-and-multiple-ilm-policies-how-should-i-structure-these/199727)
**Author:** [@wmassingham](https://discuss.elastic.co/u/wmassingham)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 8:59pm UTC](https://discuss.elastic.co/t/if-i-have-syslogs-from-multiple-types-of-devices-and-multiple-ilm-policies-how-should-i-structure-these/199727 "2019-09-16T20:59:58Z")
I have syslogs from multiple types of network devices from multiple customers being processed by logstash. Our end goal is to sell different tiers of data retention. I'm thinking that if we can put a field in the syslog … --- ## [Max\_nodes: 1000](https://discuss.elastic.co/t/max-nodes-1000/199722)
**Author:** [@SirJune](https://discuss.elastic.co/u/SirJune)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 8:32pm UTC](https://discuss.elastic.co/t/max-nodes-1000/199722 "2019-09-16T20:32:52Z")
So i started to add authentication in my POC instance. I ran this "elasticsearch-setup-passwords interactive" and followed the prompt, till it exited with: Unexpected response code \[400\] from calling PUT http://192.168… --- ## [Migrating to Elastic on Azure](https://discuss.elastic.co/t/migrating-to-elastic-on-azure/199719)
**Author:** [@vinitp](https://discuss.elastic.co/u/vinitp)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 7:40pm UTC](https://discuss.elastic.co/t/migrating-to-elastic-on-azure/199719 "2019-09-16T19:40:52Z")
Hi, We have been using ES 6.8 (running on VM on Azure) for some time. Since ES as a Service is available on Azure, we decided to try it out. We use Spring-ElasticSearch framework to connect to the ES instance. The Previ… --- ## [How do I ensure an index is the first for a document?](https://discuss.elastic.co/t/how-do-i-ensure-an-index-is-the-first-for-a-document/199349)
**Author:** [@jcavalieri](https://discuss.elastic.co/u/jcavalieri)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 7:25pm UTC](https://discuss.elastic.co/t/how-do-i-ensure-an-index-is-the-first-for-a-document/199349 "2019-09-16T19:25:56Z")
In a concurrent system, I believe I understand optimistic locking and passing the version query string parameter along. However, that is only if the document exists. I.e. you can't send ?version=0. What is the equivalent… --- ## [Tried to export monitoring to remote cluster unsuccessfully](https://discuss.elastic.co/t/tried-to-export-monitoring-to-remote-cluster-unsuccessfully/199715)
**Author:** [@bigdamhero](https://discuss.elastic.co/u/bigdamhero)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 7:01pm UTC](https://discuss.elastic.co/t/tried-to-export-monitoring-to-remote-cluster-unsuccessfully/199715 "2019-09-16T19:01:00Z")
I tried to add the setting to allow me to see the monitoring data local and send it to a monitoring cluster. PUT \_cluster/settings { "persistent": { "xpack.monitoring.exporters.cloud\_monitoring.type": "http", "xpack… --- ## [Elasticsearch conversion of string to keyword / text](https://discuss.elastic.co/t/elasticsearch-conversion-of-string-to-keyword-text/199714)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 6:57pm UTC](https://discuss.elastic.co/t/elasticsearch-conversion-of-string-to-keyword-text/199714 "2019-09-16T18:57:05Z")
Can someone let me know what rules do elasticsearch follows to map a string field to text/keyword when an elasticsearch cluster running 2.3 is upgraded to 5.6.16? For example how will the below string properties map to … --- ## [ES Upgrade: v2.3 to v5.6 - why were my indexes renamed like this?](https://discuss.elastic.co/t/es-upgrade-v2-3-to-v5-6-why-were-my-indexes-renamed-like-this/199711)
**Author:** [@tryptych](https://discuss.elastic.co/u/tryptych)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 6:43pm UTC](https://discuss.elastic.co/t/es-upgrade-v2-3-to-v5-6-why-were-my-indexes-renamed-like-this/199711 "2019-09-16T18:43:40Z")
I recently upgraded us from v2.3 to v5.6 (I'm extremely new to ES so go easy on me). Previously my indexes were each in their own directory like so: ls /mnt/store1/elasticsearch/data/graylog/nodes/0/indices/ graylog2\_… --- ## [How many shards for a Single Node?](https://discuss.elastic.co/t/how-many-shards-for-a-single-node/199701)
**Author:** [@Michael\_Ramirez\_Pare](https://discuss.elastic.co/u/Michael_Ramirez_Pare)\ **Replies:** 2\ **Last updated:** [September 16, 2019, 6:12pm UTC](https://discuss.elastic.co/t/how-many-shards-for-a-single-node/199701 "2019-09-16T18:12:07Z")
In our current Env we are running a Single Node Elasticsearch so I set up One Shard and Cero Replica for all my indexes. But there are a suggestions to increment the number of the shards for using more the CPU usage. Mor… --- ## [Firewall log in ECS](https://discuss.elastic.co/t/firewall-log-in-ecs/198224)
**Author:** [@phruby](https://discuss.elastic.co/u/phruby)\ **Replies:** 4\ **Last updated:** [September 16, 2019, 6:00pm UTC](https://discuss.elastic.co/t/firewall-log-in-ecs/198224 "2019-09-16T18:00:04Z")
I have a couple of basic questions regarding mapping firewall log fields to Elastic Common Schema, in the way compatible with the intentions of ECS designers. Firewall is deployed on a server determined by the 'origin' … --- ## [Verifying Zero-Based Compressed OOPs & reviewing my JVM configs](https://discuss.elastic.co/t/verifying-zero-based-compressed-oops-reviewing-my-jvm-configs/196979)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 5:33pm UTC](https://discuss.elastic.co/t/verifying-zero-based-compressed-oops-reviewing-my-jvm-configs/196979 "2019-09-16T17:33:43Z")
I'm running into some odd behavior with my Elasticsearch (v7.2) clusters where they're hitting the OOM circuit breaker exception under relatively light load, considering their physical memory allocation is 31GB. The err… --- ## [Basic criteria for sorting](https://discuss.elastic.co/t/basic-criteria-for-sorting/199687)
**Author:** [@kguruprasadh](https://discuss.elastic.co/u/kguruprasadh)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 3:37pm UTC](https://discuss.elastic.co/t/basic-criteria-for-sorting/199687 "2019-09-16T15:37:46Z")
I am creating a simple index and trying to sort as follows: { "mappings": { "type\_mapping": { "properties": { "checksort": { "type": "text" } } } } } And I try to sor… --- ## [ElasticSearch 7.3 ClusterFormationFailureHelper master not discovered yet, this n ode has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes](https://discuss.elastic.co/t/elasticsearch-7-3-clusterformationfailurehelper-master-not-discovered-yet-this-n-ode-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/199680)
**Author:** [@alxdaly](https://discuss.elastic.co/u/alxdaly)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 3:11pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-clusterformationfailurehelper-master-not-discovered-yet-this-n-ode-has-not-previously-joined-a-bootstrapped-v7-cluster-and-this-node-must-discover-master-eligible-nodes/199680 "2019-09-16T15:11:10Z")
I'm trying to setup 2 nodes using the same instance on a single server. I've been trying to base this on how our ElasticSearch 5.x server was configured but for the most recent version. When trying to start up each insta… --- ## [Indexing PDFs directly](https://discuss.elastic.co/t/indexing-pdfs-directly/199124)
**Author:** [@jtgajda](https://discuss.elastic.co/u/jtgajda)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 2:44pm UTC](https://discuss.elastic.co/t/indexing-pdfs-directly/199124 "2019-09-16T14:44:40Z")
I was able to upload 1650 PDF documents into Elasticsearch using the ingestor plugin. However, it looks like I am locked into the schema that was generated and am also not happy with search performance. As such, I am t… --- ## [How to validate ldap authenticaion on elasticsearch](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611)
**Author:** [@Nikhil\_Pillai](https://discuss.elastic.co/u/Nikhil_Pillai)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 2:31pm UTC](https://discuss.elastic.co/t/how-to-validate-ldap-authenticaion-on-elasticsearch/199611 "2019-09-16T14:31:59Z")
How do i validate if my ldap configuration on elasticsearch is proper or not. xpack: security: authc: realms: ldap1: type: ldap order: 0 url: "ldap://ldapauth.example.co… --- ## [The same query is really slow 20% of the time](https://discuss.elastic.co/t/the-same-query-is-really-slow-20-of-the-time/198483)
**Author:** [@rickbenchsci](https://discuss.elastic.co/u/rickbenchsci)\ **Replies:** 10\ **Last updated:** [September 16, 2019, 2:26pm UTC](https://discuss.elastic.co/t/the-same-query-is-really-slow-20-of-the-time/198483 "2019-09-16T14:26:10Z")
When running some of our msearch queries, the response time is usually around 500ms. However about 20% of the time the response time skyrockets to anywhere between 2000ms to 13000ms. The index has about 120GB data, 20 s… --- ## [Rollover index is not working as expected after applied the policy to index](https://discuss.elastic.co/t/rollover-index-is-not-working-as-expected-after-applied-the-policy-to-index/199604)
**Author:** [@krish2](https://discuss.elastic.co/u/krish2)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 8:21am UTC](https://discuss.elastic.co/t/rollover-index-is-not-working-as-expected-after-applied-the-policy-to-index/199604 "2019-09-16T08:21:46Z")
Hi , I have created a new ILM policy for rollover index , but when I run the below command I'm getting the below error , and the policy is also not applied to the existing index. Kibana Devtools console: GET filebeat-… --- ## [Ingest processor vs token filter & char filter](https://discuss.elastic.co/t/ingest-processor-vs-token-filter-char-filter/199594)
**Author:** [@skowron-line](https://discuss.elastic.co/u/skowron-line)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 1:48pm UTC](https://discuss.elastic.co/t/ingest-processor-vs-token-filter-char-filter/199594 "2019-09-16T13:48:38Z")
Hi I want to ask about difference of token filter and ingest processor for lowercase and char filter html strip and ingest processor html strip, any example when use which. --- ## [Watcher State Firing Constantly | Elasticsearch](https://discuss.elastic.co/t/watcher-state-firing-constantly-elasticsearch/198252)
**Author:** [@ntran](https://discuss.elastic.co/u/ntran)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 1:44pm UTC](https://discuss.elastic.co/t/watcher-state-firing-constantly-elasticsearch/198252 "2019-09-16T13:44:02Z")
Hi all, My watcher is constantly firing, with either "Partially Throttled" or "Throttled" for my comment. Is this an issue? or is there something wrong with my server? // Screenshot is below Thanks, Nhung --- ## [Updating date fields not working](https://discuss.elastic.co/t/updating-date-fields-not-working/199492)
**Author:** [@ebdavison](https://discuss.elastic.co/u/ebdavison)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 1:40pm UTC](https://discuss.elastic.co/t/updating-date-fields-not-working/199492 "2019-09-16T13:40:19Z")
I have a document that I am trying to update and it contains a date. If the source gets updated (in a RDBMS) then I am trying to update the document in elasticsearch. The document, ID 1, is like this: { '@… --- ## [Looking for guidance setting up elastic search with Invision Community](https://discuss.elastic.co/t/looking-for-guidance-setting-up-elastic-search-with-invision-community/197929)
**Author:** [@makeswithit](https://discuss.elastic.co/u/makeswithit)\ **Replies:** 3\ **Last updated:** [September 16, 2019, 1:26pm UTC](https://discuss.elastic.co/t/looking-for-guidance-setting-up-elastic-search-with-invision-community/197929 "2019-09-16T13:26:25Z")
Has anyone set up the cloud elastic search with Invision Community? If so, I don't understand what to add in the "Elasticsearch Server" field. Can someone clarify that for me? --- ## [Watcher take in account different queries](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 2\ **Last updated:** [September 16, 2019, 1:23pm UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388 "2019-09-16T13:23:49Z")
Hi, We have an index "Server-Index" where we sometimes get a string indexed with the contents "foo". A few seconds later some other messages will get indexed as well that is tied to the "foo" string above. What we want … --- ## [Mapping issue when creating ML job](https://discuss.elastic.co/t/mapping-issue-when-creating-ml-job/198728)
**Author:** [@admlko](https://discuss.elastic.co/u/admlko)\ **Replies:** 34\ **Last updated:** [September 16, 2019, 1:23pm UTC](https://discuss.elastic.co/t/mapping-issue-when-creating-ml-job/198728 "2019-09-16T13:23:10Z")
I'm running Elastic Stack 6.8.1 and trying to recreate a ML job. It has been working fine for a couple of years now, but I deleted the old job and tried to create it again, it doesn't allow it to be created. The error … --- ## [Issues with JMeter and Elasticsearch+Kibana](https://discuss.elastic.co/t/issues-with-jmeter-and-elasticsearch-kibana/199667)
**Author:** [@DarthRKO89](https://discuss.elastic.co/u/DarthRKO89)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 1:13pm UTC](https://discuss.elastic.co/t/issues-with-jmeter-and-elasticsearch-kibana/199667 "2019-09-16T13:13:05Z")
Hello there guys, I began to work with elastic stack since last week and I encountered a lot of problems but that's probably because I'm a newbie with those kind of tools. I need to configure ElasticSearch and Kibana t… --- ## [Filtering data based on date using data frames](https://discuss.elastic.co/t/filtering-data-based-on-date-using-data-frames/199665)
**Author:** [@cvaibh92](https://discuss.elastic.co/u/cvaibh92)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 1:07pm UTC](https://discuss.elastic.co/t/filtering-data-based-on-date-using-data-frames/199665 "2019-09-16T13:07:07Z")
Hi, We have a use case where we need to support sorting and pagination on aggregated data and it should be exact(not approximate).We tried different approaches but could not achieve what we wanted. "Collapse" helped i… --- ## [Where do I put my search template file?](https://discuss.elastic.co/t/where-do-i-put-my-search-template-file/199659)
**Author:** [@decodeit](https://discuss.elastic.co/u/decodeit)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 12:26pm UTC](https://discuss.elastic.co/t/where-do-i-put-my-search-template-file/199659 "2019-09-16T12:26:33Z")
I am trying to connect my elasticsearch cluster from react front end. where do I store the search template. and how would it be read. Thanks --- ## [Elasticsearch node fails after kibana startup .action.search.SearchPhaseExecutionException: all shards failed](https://discuss.elastic.co/t/elasticsearch-node-fails-after-kibana-startup-action-search-searchphaseexecutionexception-all-shards-failed/199658)
**Author:** [@O\_K](https://discuss.elastic.co/u/O_K)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 12:26pm UTC](https://discuss.elastic.co/t/elasticsearch-node-fails-after-kibana-startup-action-search-searchphaseexecutionexception-all-shards-failed/199658 "2019-09-16T12:26:33Z")
I have 2 nodes { "cluster\_name" : "elasticsearch", "status" : "green", "timed\_out" : false, "number\_of\_nodes" : 2, "number\_of\_data\_nodes" : 2, "active\_primary\_shards" : 3, "active\_shards" : 6, "relocatin… --- ## [How do I connect ELK stack to Sentilo platform](https://discuss.elastic.co/t/how-do-i-connect-elk-stack-to-sentilo-platform/199651)
**Author:** [@Jarlies](https://discuss.elastic.co/u/Jarlies)\ **Replies:** 0\ **Last updated:** [September 16, 2019, 11:53am UTC](https://discuss.elastic.co/t/how-do-i-connect-elk-stack-to-sentilo-platform/199651 "2019-09-16T11:53:40Z")
Greetings, I am currently connecting sentilo to elk stack and documentation on sentilo site does not cover the elk stack side of configuration, modification etc. --- ## [Advanced Watch calculate buckets](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063)
**Author:** [@Amaral](https://discuss.elastic.co/u/Amaral)\ **Replies:** 1\ **Last updated:** [September 16, 2019, 11:34am UTC](https://discuss.elastic.co/t/advanced-watch-calculate-buckets/198063 "2019-09-16T11:34:45Z")
I want to create a advanced watch wich count a specific operation of specific service during more than 1 second to execute. If the number of cases is greater than 1% of total of cases, the watch send a alert. Ex: (durat… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1153) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1155)